March 2020 - mice-discuss - lists.micemn.net

Re: BGP alerts about AS 53740 (OPTBIT)

by Andrew Hoyos

Two general schools of thought here: a.) carry the MICE prefix in your IGP (OSPF, ISIS, etc) - not BGP, if you need it to recurse next hops. While this is the ‘easy button’, it has the unintended impact of allowing things on your network to directly target MICE IPs which should be avoided - the only things we want talking to directly to MICE IP’s are other BGP speaking routers to establish BGP sessions. b.) set next-hop-self on your sessions on IXP facing router, so next hop is rewritten to the router itself towards the rest of your network. That way, you don’t need to carry the IX prefix in your IGP at all. > On Mar 30, 2020, at 5:56 PM, Abhi Devireddy <abhi(a)DEVIREDDY.COM> wrote: > > And you would be right... I needed a downstream device to have that route. > It's been fixed now. Sorry for the extraneous alert. > > I'll check that on our other session (AS3789) as well. > > Abhi > From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Andrew Hoyos <hoyosa(a)GMAIL.COM> > Sent: Monday, March 30, 2020 5:52 PM > To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> > Subject: Re: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) > > One of the most common reasons we see this is from ‘redist connected’ without any sanity check or prefix filter. > >> On Mar 30, 2020, at 5:49 PM, Jeremy Lumby <jlumby(a)MNVOIP.COM <mailto:jlumby@MNVOIP.COM>> wrote: >> >> Abhi, >> >> It is not as much a question about filtering prefixes, it is more a question of why your network would originate 206.108.255.0/24 <https://radar.qrator.net/as53740/graph#206.108.255.0/24> >> >> Jeremy Lumby >> Minnesota VoIP >> 9217 17th Ave S #216 >> Bloomington, MN 55425 >> M: 612-355-7740 >> D: 612-392-6814 >> F: 952-873-7425 >> jlumby(a)mnvoip.com <mailto:jlumby@mnvoip.com> >> >> >> >> From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>] On Behalf Of Abhi Devireddy >> Sent: Monday, March 30, 2020 5:29 PM >> To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> >> Subject: Re: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) >> >> Frank, >> That's really interesting. I'm sending QRator an unfiltered BGP feed and that might be triggering the error(?). >> I'll try to filter my feed to QRator to deny the MICE prefix and see if that fixes it. >> >> Open to suggestions as well. >> Abhi >> From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> on behalf of Frank Bulk <fbulk(a)MYPREMIERONLINE.COM <mailto:fbulk@MYPREMIERONLINE.COM>> >> Sent: Monday, March 30, 2020 5:11 PM >> To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> <MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> >> Subject: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) >> >> Curious if anyone can make sense of this alert from QRator. Are they suggesting OPTBIT is advertising MICE’s /24? >> >> I’ve seen this come and go since Sunday night at 10:09 pm Central. >> >> Frank >> >> From: Radar by Qrator <no-reply(a)qrator.net <mailto:no-reply@qrator.net>> >> Sent: Monday, March 30, 2020 2:49 AM >> >> Subject: [BGP ALERT] [HIGH] <AS18883> Created Hijacks >> >> Time: 30.03.2020 07:42:00 UTC >> Created Hijacks >> New IPv4 incidents: >> Target Prefix >> Target ASN >> Affected prefix >> Affected ASN >> Severity >> Propagation >> 206.108.255.0/24 <https://radar.qrator.net/as18883/graph#206.108.255.0/24> >> 18883 (FIBERNET-NETWORK-OPERATIONS-CENTER) <https://radar.qrator.net/as18883> >> 206.108.255.0/24 <https://radar.qrator.net/as53740/graph#206.108.255.0/24> >> 53740 (OPTBIT) <https://radar.qrator.net/as53740> >> High >> 1 >> AS Names involved in the incident: >> AS18883 (FIBERNET-NETWORK-OPERATIONS-CENTER), AS53740 (OPTBIT) >> Active IPv4 incident count: 16 >> Radar by Qrator <https://radar.qrator.net/> >> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> >> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1>

March 30, 2020

Re: BGP alerts about AS 53740 (OPTBIT)

by Abhi Devireddy

And you would be right... I needed a downstream device to have that route. It's been fixed now. Sorry for the extraneous alert. I'll check that on our other session (AS3789) as well. Abhi ________________________________ From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Andrew Hoyos <hoyosa(a)GMAIL.COM> Sent: Monday, March 30, 2020 5:52 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Subject: Re: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) One of the most common reasons we see this is from ‘redist connected’ without any sanity check or prefix filter. On Mar 30, 2020, at 5:49 PM, Jeremy Lumby <jlumby(a)MNVOIP.COM<mailto:jlumby@MNVOIP.COM>> wrote: Abhi, It is not as much a question about filtering prefixes, it is more a question of why your network would originate 206.108.255.0/24<https://radar.qrator.net/as53740/graph#206.108.255.0/24> Jeremy Lumby Minnesota VoIP 9217 17th Ave S #216 Bloomington, MN 55425 M: 612-355-7740 D: 612-392-6814 F: 952-873-7425 jlumby(a)mnvoip.com<mailto:jlumby@mnvoip.com> From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Abhi Devireddy Sent: Monday, March 30, 2020 5:29 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> Subject: Re: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) Frank, That's really interesting. I'm sending QRator an unfiltered BGP feed and that might be triggering the error(?). I'll try to filter my feed to QRator to deny the MICE prefix and see if that fixes it. Open to suggestions as well. Abhi ________________________________ From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> on behalf of Frank Bulk <fbulk(a)MYPREMIERONLINE.COM<mailto:fbulk@MYPREMIERONLINE.COM>> Sent: Monday, March 30, 2020 5:11 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> <MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> Subject: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) Curious if anyone can make sense of this alert from QRator. Are they suggesting OPTBIT is advertising MICE’s /24? I’ve seen this come and go since Sunday night at 10:09 pm Central. Frank From: Radar by Qrator <no-reply(a)qrator.net<mailto:no-reply@qrator.net>> Sent: Monday, March 30, 2020 2:49 AM Subject: [BGP ALERT] [HIGH] <AS18883> Created Hijacks Time: 30.03.2020 07:42:00 UTC Created Hijacks New IPv4 incidents: Target Prefix Target ASN Affected prefix Affected ASN Severity Propagation 206.108.255.0/24<https://radar.qrator.net/as18883/graph#206.108.255.0/24> 18883 (FIBERNET-NETWORK-OPERATIONS-CENTER)<https://radar.qrator.net/as18883> 206.108.255.0/24<https://radar.qrator.net/as53740/graph#206.108.255.0/24> 53740 (OPTBIT)<https://radar.qrator.net/as53740> High 1 AS Names involved in the incident: AS18883 (FIBERNET-NETWORK-OPERATIONS-CENTER), AS53740 (OPTBIT) Active IPv4 incident count: 16 Radar by Qrator<https://radar.qrator.net/> ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

March 30, 2020

Re: BGP alerts about AS 53740 (OPTBIT)

by Andrew Hoyos

One of the most common reasons we see this is from ‘redist connected’ without any sanity check or prefix filter. > On Mar 30, 2020, at 5:49 PM, Jeremy Lumby <jlumby(a)MNVOIP.COM> wrote: > > Abhi, > > It is not as much a question about filtering prefixes, it is more a question of why your network would originate 206.108.255.0/24 <https://radar.qrator.net/as53740/graph#206.108.255.0/24> > > Jeremy Lumby > Minnesota VoIP > 9217 17th Ave S #216 > Bloomington, MN 55425 > M: 612-355-7740 > D: 612-392-6814 > F: 952-873-7425 > jlumby(a)mnvoip.com <mailto:jlumby@mnvoip.com> > > > > From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>] On Behalf Of Abhi Devireddy > Sent: Monday, March 30, 2020 5:29 PM > To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> > Subject: Re: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) > > Frank, > That's really interesting. I'm sending QRator an unfiltered BGP feed and that might be triggering the error(?). > I'll try to filter my feed to QRator to deny the MICE prefix and see if that fixes it. > > Open to suggestions as well. > Abhi > From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> on behalf of Frank Bulk <fbulk(a)MYPREMIERONLINE.COM <mailto:fbulk@MYPREMIERONLINE.COM>> > Sent: Monday, March 30, 2020 5:11 PM > To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> <MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> > Subject: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) > > Curious if anyone can make sense of this alert from QRator. Are they suggesting OPTBIT is advertising MICE’s /24? > > I’ve seen this come and go since Sunday night at 10:09 pm Central. > > Frank > > From: Radar by Qrator <no-reply(a)qrator.net <mailto:no-reply@qrator.net>> > Sent: Monday, March 30, 2020 2:49 AM > > Subject: [BGP ALERT] [HIGH] <AS18883> Created Hijacks > > Time: 30.03.2020 07:42:00 UTC > Created Hijacks > New IPv4 incidents: > Target Prefix > Target ASN > Affected prefix > Affected ASN > Severity > Propagation > 206.108.255.0/24 <https://radar.qrator.net/as18883/graph#206.108.255.0/24> > 18883 (FIBERNET-NETWORK-OPERATIONS-CENTER) <https://radar.qrator.net/as18883> > 206.108.255.0/24 <https://radar.qrator.net/as53740/graph#206.108.255.0/24> > 53740 (OPTBIT) <https://radar.qrator.net/as53740> > High > 1 > AS Names involved in the incident: > AS18883 (FIBERNET-NETWORK-OPERATIONS-CENTER), AS53740 (OPTBIT) > Active IPv4 incident count: 16 > Radar by Qrator <https://radar.qrator.net/> > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1>

March 30, 2020

Re: BGP alerts about AS 53740 (OPTBIT)

by Richard Laager

On 3/30/20 5:29 PM, Abhi Devireddy wrote: > I'll try to filter my feed to QRator to deny the MICE prefix and see if > that fixes it. > > Open to suggestions as well. Why is the MICE /24 in your BGP RIB at all? (Admittedly, there are two schools of thought on this.) -- Richard

March 30, 2020

Re: BGP alerts about AS 53740 (OPTBIT)

by Jeremy Lumby

Abhi, It is not as much a question about filtering prefixes, it is more a question of why your network would originate 206.108.255.0/24 Jeremy Lumby Minnesota VoIP 9217 17th Ave S #216 Bloomington, MN 55425 M: 612-355-7740 D: 612-392-6814 F: 952-873-7425 jlumby(a)mnvoip.com From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Abhi Devireddy Sent: Monday, March 30, 2020 5:29 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) Frank, That's really interesting. I'm sending QRator an unfiltered BGP feed and that might be triggering the error(?). I'll try to filter my feed to QRator to deny the MICE prefix and see if that fixes it. Open to suggestions as well. Abhi From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Frank Bulk <fbulk(a)MYPREMIERONLINE.COM> Sent: Monday, March 30, 2020 5:11 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Subject: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) Curious if anyone can make sense of this alert from QRator. Are they suggesting OPTBIT is advertising MICE’s /24? I’ve seen this come and go since Sunday night at 10:09 pm Central. Frank From: Radar by Qrator <no-reply(a)qrator.net> Sent: Monday, March 30, 2020 2:49 AM Subject: [BGP ALERT] [HIGH] <AS18883> Created Hijacks Time: 30.03.2020 07:42:00 UTC Created Hijacks New IPv4 incidents: Target PrefixTarget ASNAffected prefixAffected ASNSeverityPropagation 206.108.255.0/2418883 (FIBERNET-NETWORK-OPERATIONS-CENTER) 206.108.255.0/2453740 (OPTBIT) High 1 AS Names involved in the incident: AS18883 (FIBERNET-NETWORK-OPERATIONS-CENTER), AS53740 (OPTBIT) Active IPv4 incident count: 16 Radar by Qrator To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

March 30, 2020

Re: BGP alerts about AS 53740 (OPTBIT)

by Abhi Devireddy

Frank, That's really interesting. I'm sending QRator an unfiltered BGP feed and that might be triggering the error(?). I'll try to filter my feed to QRator to deny the MICE prefix and see if that fixes it. Open to suggestions as well. Abhi ________________________________ From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Frank Bulk <fbulk(a)MYPREMIERONLINE.COM> Sent: Monday, March 30, 2020 5:11 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Subject: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) Curious if anyone can make sense of this alert from QRator. Are they suggesting OPTBIT is advertising MICE’s /24? I’ve seen this come and go since Sunday night at 10:09 pm Central. Frank From: Radar by Qrator <no-reply(a)qrator.net> Sent: Monday, March 30, 2020 2:49 AM Subject: [BGP ALERT] [HIGH] <AS18883> Created Hijacks Time: 30.03.2020 07:42:00 UTC Created Hijacks New IPv4 incidents: Target Prefix Target ASN Affected prefix Affected ASN Severity Propagation 206.108.255.0/24<https://radar.qrator.net/as18883/graph#206.108.255.0/24> 18883 (FIBERNET-NETWORK-OPERATIONS-CENTER)<https://radar.qrator.net/as18883> 206.108.255.0/24<https://radar.qrator.net/as53740/graph#206.108.255.0/24> 53740 (OPTBIT)<https://radar.qrator.net/as53740> High 1 AS Names involved in the incident: AS18883 (FIBERNET-NETWORK-OPERATIONS-CENTER), AS53740 (OPTBIT) Active IPv4 incident count: 16 Radar by Qrator<https://radar.qrator.net> ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

March 30, 2020

BGP alerts about AS 53740 (OPTBIT)

by Frank Bulk

Curious if anyone can make sense of this alert from QRator. Are they suggesting OPTBIT is advertising MICE's /24? I've seen this come and go since Sunday night at 10:09 pm Central. Frank From: Radar by Qrator <no-reply(a)qrator.net> Sent: Monday, March 30, 2020 2:49 AM Subject: [BGP ALERT] [HIGH] <AS18883> Created Hijacks Time: 30.03.2020 07:42:00 UTC Created Hijacks New IPv4 incidents: Target Prefix Target ASN Affected prefix Affected ASN Severity Propagation 206.108.255.0/24<https://radar.qrator.net/as18883/graph#206.108.255.0/24> 18883 (FIBERNET-NETWORK-OPERATIONS-CENTER)<https://radar.qrator.net/as18883> 206.108.255.0/24<https://radar.qrator.net/as53740/graph#206.108.255.0/24> 53740 (OPTBIT)<https://radar.qrator.net/as53740> High 1 AS Names involved in the incident: AS18883 (FIBERNET-NETWORK-OPERATIONS-CENTER), AS53740 (OPTBIT) Active IPv4 incident count: 16 Radar by Qrator<https://radar.qrator.net>

March 30, 2020

Re: Cloudflare Route Server Update

by Richard Laager

On 3/27/20 12:38 PM, Jay Hanke wrote: > Per Cloudflare anycast routes are not available via the route servers > and require a bilateral connection. Done. -- Richard

March 27, 2020

Cloudflare Route Server Update

by Jay Hanke

Please update Cloudflare's Route Server entry to Partial on the MICE participants page. Per Cloudflare anycast routes are not available via the route servers and require a bilateral connection. Thanks! -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

March 27, 2020

Re: Charter upgrade status

by Jeremy Lumby

Yes, the upgrade is complete, and running clean. Charter now has 20G of capacity to MICE. From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of David Farmer Sent: Friday, March 27, 2020 5:56 AM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Charter upgrade status It looks like Charter's port-channel was activated around midnight, could someone confirm both 10G are active in the port-channel? Thanks On Wed, Mar 25, 2020 at 12:26 PM Colin Murphy <murphy(a)umn.edu> wrote: Thanks Chris for the info. I've emailed Charter as well. Thanks, Colin Murphy Sr. Network Engineer Office of Information Technology University of Minnesota Northern Lights Gigapop Desk: 612-626-0870 On Wed, Mar 25, 2020 at 12:23 PM Chris Wopat <wopat(a)wiscnet.net> wrote: On 3/25/20 12:21 PM, Colin Murphy wrote: > > Fyi, I've de-preferred the routes we receive from Charter until the second link is up and running. We've done the same. Ours should have dropped about 1gbps off, moving this traffic to Chicago for us. Looking at their current graphs, they're no longer maxed out at this time. We had emailed Charter about this prior to this MICE thread, they did confirm the upgrade was in progress. -- Chris Wopat Network Engineer, WiscNet wopat(a)wiscnet.net 608-210-3965 To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 -- =============================================== David Farmer Email:farmer@umn.edu Networking & Telecommunication Services Office of Information Technology University of Minnesota 2218 University Ave SE Phone: 612-626-0815 Minneapolis, MN 55414-3029 Cell: 612-812-9952 =============================================== To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

March 27, 2020