- mice-discuss - lists.micemn.net

Re: Blackhole IP if needed?

by Richard Laager

On 4/6/20 5:17 PM, Andrew Hoyos wrote: > This came up in two different conversations in June and January (per > mice-discuss archives) > I think the concern here is that the route servers aren’t doing IRR > filtering of members yet. > I agree 100% with the approach below, but with one caveat - we need to > be filtering members on the route servers first via IRR. > Otherwise, nothing preventing a member from advertising a /32 tagged > with a blackhole community of 8.8.8.8, or another member’s IP address. Nothing is stopping me from announcing 8.8.8.0/24 right now, right? I agree that the IRR filtering is important, but is that absolutely necessary here? -- Richard

April 6, 2020

Re: Blackhole IP if needed?

by Andrew Hoyos

This came up in two different conversations in June and January (per mice-discuss archives) I think the concern here is that the route servers aren’t doing IRR filtering of members yet. I agree 100% with the approach below, but with one caveat - we need to be filtering members on the route servers first via IRR. Otherwise, nothing preventing a member from advertising a /32 tagged with a blackhole community of 8.8.8.8, or another member’s IP address. — Andrew Hoyos hoyosa(a)gmail.com <mailto:hoyosa@gmail.com> > On Apr 6, 2020, at 5:12 PM, Richard Laager <rlaager(a)WIKTEL.COM> wrote: > > On 4/6/20 4:50 PM, Frank Bulk wrote: >> One our IPs, 96.31.13.225, was on the receiving end of a volumetric DoS >> attack for about 20 minutes and some of the incoming traffic was going >> over our MICE link. >> >> Do the MICE admins have a way to blackhole our IP, if needed? > > No. > > I'd love to see us implement something like this: > https://www.seattleix.net/blackholing > > Let's see if we can get this done. Here's what I see as steps: > > 1) Pick IPs and MACs. > Here's a proposal: > IPv4: 206.108.255.0 > same idea as SIX > IPv6: 2001:504:27:0:0:FFFF::666 > from 65535:666 used in RFC 7999 > MAC: 66:66:de:ad:be:ef > same as SIX > > 2) Jeremy?: Configure MAC ACLs to drop traffic to that MAC on the core > switches. > > 3) Doug?: Configure the route servers to: > accept /32 (IPv4) and /128 (IPv6) > set next-hop to the blackhole IP (see above) > add no-export community > when: > next-hop == blackhole IP > OR > 65535:666 is set > See also the BIRD example on the SIX page. > > 4) Me: Document this on our website & notify the members it's ready. > Ask, but not require, that remote switches do the same. > > -- > Richard

April 6, 2020

Re: Blackhole IP if needed?

by Richard Laager

On 4/6/20 4:50 PM, Frank Bulk wrote: > One our IPs, 96.31.13.225, was on the receiving end of a volumetric DoS > attack for about 20 minutes and some of the incoming traffic was going > over our MICE link. > > Do the MICE admins have a way to blackhole our IP, if needed? No. I'd love to see us implement something like this: https://www.seattleix.net/blackholing Let's see if we can get this done. Here's what I see as steps: 1) Pick IPs and MACs. Here's a proposal: IPv4: 206.108.255.0 same idea as SIX IPv6: 2001:504:27:0:0:FFFF::666 from 65535:666 used in RFC 7999 MAC: 66:66:de:ad:be:ef same as SIX 2) Jeremy?: Configure MAC ACLs to drop traffic to that MAC on the core switches. 3) Doug?: Configure the route servers to: accept /32 (IPv4) and /128 (IPv6) set next-hop to the blackhole IP (see above) add no-export community when: next-hop == blackhole IP OR 65535:666 is set See also the BIRD example on the SIX page. 4) Me: Document this on our website & notify the members it's ready. Ask, but not require, that remote switches do the same. -- Richard

April 6, 2020

Blackhole IP if needed?

by Frank Bulk

One our IPs, 96.31.13.225, was on the receiving end of a volumetric DoS attack for about 20 minutes and some of the incoming traffic was going over our MICE link. Do the MICE admins have a way to blackhole our IP, if needed? Frank Premier Communications (AS53347) FiberNet Communications (AS18883)

April 6, 2020

Re: ADV: [MICE-DISCUSS] Zayo outage in the metro?

by Jeff Dahna

We have a A-Link to Plymouth down since 10:14pm yesterday. No maintenance notice either. I put in a ticket with IQ last night. IQ response was Zayo maintenance, no notification and were added to the master ticket. Zayo went past maintenance window and was hands off 9ish. 10:30am - Called IQ to escalate and got the usual response. Still not fixed.... Jeff Dahna General Manager | City of Windom Telecom Dept-Windomnet On Apr 4, 2020 13:58, Dean Bahls <dean.bahls(a)COOPERATIVE-NETWORKS.COM> wrote: Anyone know of an outage that Zayo has been experiencing in the Metro area since about 10:30pm last night? We’ve found that it was a planned maintenance that nobody had been notified about. I don’t know if it affects other systems (like Ethernet or dark fiber), but toll services using Intelliquent (Onvoy) have been down since that time and nobody has gotten any updates about this thing. Thanks for any info you can share! Dean Dean Bahls Network Services Manager | Cooperative Network Services, LLC 14 Main St SW | PO Box J | Menahga, MN 56464 218.346.3635 (Direct) | 218.564.3000 (Main Office) dean.bahls(a)cooperative-networks.com<mailto:dean.bahls@cooperative-networks.com> [cid:image003.jpg@01D60A89.0CBE6550] ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

April 4, 2020

Zayo outage in the metro?

by Dean Bahls

Anyone know of an outage that Zayo has been experiencing in the Metro area since about 10:30pm last night? We've found that it was a planned maintenance that nobody had been notified about. I don't know if it affects other systems (like Ethernet or dark fiber), but toll services using Intelliquent (Onvoy) have been down since that time and nobody has gotten any updates about this thing. Thanks for any info you can share! Dean Dean Bahls Network Services Manager | Cooperative Network Services, LLC 14 Main St SW | PO Box J | Menahga, MN 56464 218.346.3635 (Direct) | 218.564.3000 (Main Office) dean.bahls(a)cooperative-networks.com <mailto:dean.bahls@cooperative-networks.com>

April 4, 2020

Re: [ADV] [MICE-DISCUSS] Wiscnet Remote Switch

by Richard Laager

On 4/3/20 11:05 AM, Doug McIntyre wrote: > I have allocated Port-Channel 37 for Wiscnet. That's what I was assuming it was going to be. So I just pushed the changes I made. The website should be updated, including the equipment diagram and the Order Form. -- Richard

April 3, 2020

Re: [ADV] [MICE-DISCUSS] Wiscnet Remote Switch

by Doug McIntyre

On Fri, Apr 03, 2020 at 08:03:08AM -0500, Jay Hanke wrote: >Please allocate port Ethernet 3/22/1 on the Main Switch for the new Wiscnet >Remote switch. > >Please configure the port as a single member LAG group and the port >security settings for a remote switch. > All set, I have allocated Port-Channel 37 for Wiscnet. -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

April 3, 2020

Wiscnet Remote Switch

by Jay Hanke

Please allocate port Ethernet 3/22/1 on the Main Switch for the new Wiscnet Remote switch. Please configure the port as a single member LAG group and the port security settings for a remote switch. Welcome Aboard Again! -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

April 3, 2020

Re: [ADV] [MICE-DISCUSS] Savage Communications Upgrade

by Doug McIntyre

On Thu, Apr 02, 2020 at 03:03:34PM -0500, Jay Hanke wrote: >Savage Communications is upgrading from 1x10G to 2x10G LAG. > >Please allocate Ethernet 5/33 on the Main switch. This will require a new >LAG and then their existing port (4/33) will be migrated into the LAG. Okay, Port-Channel36 setup, Eth 5/33 put into the LACP lag, and ready to go for them to cut their traffic over to it when they are ready. Once traffic has stopped over 4/33, we can put that into the LAG group and they can continue along when they want. -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

April 2, 2020

Savage Communications Upgrade

by Jay Hanke

Savage Communications is upgrading from 1x10G to 2x10G LAG. Please allocate Ethernet 5/33 on the Main switch. This will require a new LAG and then their existing port (4/33) will be migrated into the LAG. Welcome Aboard (again). -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

April 2, 2020

Re: BGP alerts about AS 53740 (OPTBIT)

by Andrew Hoyos

Two general schools of thought here: a.) carry the MICE prefix in your IGP (OSPF, ISIS, etc) - not BGP, if you need it to recurse next hops. While this is the ‘easy button’, it has the unintended impact of allowing things on your network to directly target MICE IPs which should be avoided - the only things we want talking to directly to MICE IP’s are other BGP speaking routers to establish BGP sessions. b.) set next-hop-self on your sessions on IXP facing router, so next hop is rewritten to the router itself towards the rest of your network. That way, you don’t need to carry the IX prefix in your IGP at all. > On Mar 30, 2020, at 5:56 PM, Abhi Devireddy <abhi(a)DEVIREDDY.COM> wrote: > > And you would be right... I needed a downstream device to have that route. > It's been fixed now. Sorry for the extraneous alert. > > I'll check that on our other session (AS3789) as well. > > Abhi > From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Andrew Hoyos <hoyosa(a)GMAIL.COM> > Sent: Monday, March 30, 2020 5:52 PM > To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> > Subject: Re: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) > > One of the most common reasons we see this is from ‘redist connected’ without any sanity check or prefix filter. > >> On Mar 30, 2020, at 5:49 PM, Jeremy Lumby <jlumby(a)MNVOIP.COM <mailto:jlumby@MNVOIP.COM>> wrote: >> >> Abhi, >> >> It is not as much a question about filtering prefixes, it is more a question of why your network would originate 206.108.255.0/24 <https://radar.qrator.net/as53740/graph#206.108.255.0/24> >> >> Jeremy Lumby >> Minnesota VoIP >> 9217 17th Ave S #216 >> Bloomington, MN 55425 >> M: 612-355-7740 >> D: 612-392-6814 >> F: 952-873-7425 >> jlumby(a)mnvoip.com <mailto:jlumby@mnvoip.com> >> >> >> >> From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>] On Behalf Of Abhi Devireddy >> Sent: Monday, March 30, 2020 5:29 PM >> To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> >> Subject: Re: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) >> >> Frank, >> That's really interesting. I'm sending QRator an unfiltered BGP feed and that might be triggering the error(?). >> I'll try to filter my feed to QRator to deny the MICE prefix and see if that fixes it. >> >> Open to suggestions as well. >> Abhi >> From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> on behalf of Frank Bulk <fbulk(a)MYPREMIERONLINE.COM <mailto:fbulk@MYPREMIERONLINE.COM>> >> Sent: Monday, March 30, 2020 5:11 PM >> To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> <MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> >> Subject: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) >> >> Curious if anyone can make sense of this alert from QRator. Are they suggesting OPTBIT is advertising MICE’s /24? >> >> I’ve seen this come and go since Sunday night at 10:09 pm Central. >> >> Frank >> >> From: Radar by Qrator <no-reply(a)qrator.net <mailto:no-reply@qrator.net>> >> Sent: Monday, March 30, 2020 2:49 AM >> >> Subject: [BGP ALERT] [HIGH] <AS18883> Created Hijacks >> >> Time: 30.03.2020 07:42:00 UTC >> Created Hijacks >> New IPv4 incidents: >> Target Prefix >> Target ASN >> Affected prefix >> Affected ASN >> Severity >> Propagation >> 206.108.255.0/24 <https://radar.qrator.net/as18883/graph#206.108.255.0/24> >> 18883 (FIBERNET-NETWORK-OPERATIONS-CENTER) <https://radar.qrator.net/as18883> >> 206.108.255.0/24 <https://radar.qrator.net/as53740/graph#206.108.255.0/24> >> 53740 (OPTBIT) <https://radar.qrator.net/as53740> >> High >> 1 >> AS Names involved in the incident: >> AS18883 (FIBERNET-NETWORK-OPERATIONS-CENTER), AS53740 (OPTBIT) >> Active IPv4 incident count: 16 >> Radar by Qrator <https://radar.qrator.net/> >> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> >> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1>

March 30, 2020

Re: BGP alerts about AS 53740 (OPTBIT)

by Abhi Devireddy

And you would be right... I needed a downstream device to have that route. It's been fixed now. Sorry for the extraneous alert. I'll check that on our other session (AS3789) as well. Abhi ________________________________ From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Andrew Hoyos <hoyosa(a)GMAIL.COM> Sent: Monday, March 30, 2020 5:52 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Subject: Re: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) One of the most common reasons we see this is from ‘redist connected’ without any sanity check or prefix filter. On Mar 30, 2020, at 5:49 PM, Jeremy Lumby <jlumby(a)MNVOIP.COM<mailto:jlumby@MNVOIP.COM>> wrote: Abhi, It is not as much a question about filtering prefixes, it is more a question of why your network would originate 206.108.255.0/24<https://radar.qrator.net/as53740/graph#206.108.255.0/24> Jeremy Lumby Minnesota VoIP 9217 17th Ave S #216 Bloomington, MN 55425 M: 612-355-7740 D: 612-392-6814 F: 952-873-7425 jlumby(a)mnvoip.com<mailto:jlumby@mnvoip.com> From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Abhi Devireddy Sent: Monday, March 30, 2020 5:29 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> Subject: Re: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) Frank, That's really interesting. I'm sending QRator an unfiltered BGP feed and that might be triggering the error(?). I'll try to filter my feed to QRator to deny the MICE prefix and see if that fixes it. Open to suggestions as well. Abhi ________________________________ From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> on behalf of Frank Bulk <fbulk(a)MYPREMIERONLINE.COM<mailto:fbulk@MYPREMIERONLINE.COM>> Sent: Monday, March 30, 2020 5:11 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> <MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> Subject: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) Curious if anyone can make sense of this alert from QRator. Are they suggesting OPTBIT is advertising MICE’s /24? I’ve seen this come and go since Sunday night at 10:09 pm Central. Frank From: Radar by Qrator <no-reply(a)qrator.net<mailto:no-reply@qrator.net>> Sent: Monday, March 30, 2020 2:49 AM Subject: [BGP ALERT] [HIGH] <AS18883> Created Hijacks Time: 30.03.2020 07:42:00 UTC Created Hijacks New IPv4 incidents: Target Prefix Target ASN Affected prefix Affected ASN Severity Propagation 206.108.255.0/24<https://radar.qrator.net/as18883/graph#206.108.255.0/24> 18883 (FIBERNET-NETWORK-OPERATIONS-CENTER)<https://radar.qrator.net/as18883> 206.108.255.0/24<https://radar.qrator.net/as53740/graph#206.108.255.0/24> 53740 (OPTBIT)<https://radar.qrator.net/as53740> High 1 AS Names involved in the incident: AS18883 (FIBERNET-NETWORK-OPERATIONS-CENTER), AS53740 (OPTBIT) Active IPv4 incident count: 16 Radar by Qrator<https://radar.qrator.net/> ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

March 30, 2020

Re: BGP alerts about AS 53740 (OPTBIT)

by Andrew Hoyos

One of the most common reasons we see this is from ‘redist connected’ without any sanity check or prefix filter. > On Mar 30, 2020, at 5:49 PM, Jeremy Lumby <jlumby(a)MNVOIP.COM> wrote: > > Abhi, > > It is not as much a question about filtering prefixes, it is more a question of why your network would originate 206.108.255.0/24 <https://radar.qrator.net/as53740/graph#206.108.255.0/24> > > Jeremy Lumby > Minnesota VoIP > 9217 17th Ave S #216 > Bloomington, MN 55425 > M: 612-355-7740 > D: 612-392-6814 > F: 952-873-7425 > jlumby(a)mnvoip.com <mailto:jlumby@mnvoip.com> > > > > From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>] On Behalf Of Abhi Devireddy > Sent: Monday, March 30, 2020 5:29 PM > To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> > Subject: Re: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) > > Frank, > That's really interesting. I'm sending QRator an unfiltered BGP feed and that might be triggering the error(?). > I'll try to filter my feed to QRator to deny the MICE prefix and see if that fixes it. > > Open to suggestions as well. > Abhi > From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> on behalf of Frank Bulk <fbulk(a)MYPREMIERONLINE.COM <mailto:fbulk@MYPREMIERONLINE.COM>> > Sent: Monday, March 30, 2020 5:11 PM > To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> <MICE-DISCUSS(a)LISTS.IPHOUSE.NET <mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> > Subject: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) > > Curious if anyone can make sense of this alert from QRator. Are they suggesting OPTBIT is advertising MICE’s /24? > > I’ve seen this come and go since Sunday night at 10:09 pm Central. > > Frank > > From: Radar by Qrator <no-reply(a)qrator.net <mailto:no-reply@qrator.net>> > Sent: Monday, March 30, 2020 2:49 AM > > Subject: [BGP ALERT] [HIGH] <AS18883> Created Hijacks > > Time: 30.03.2020 07:42:00 UTC > Created Hijacks > New IPv4 incidents: > Target Prefix > Target ASN > Affected prefix > Affected ASN > Severity > Propagation > 206.108.255.0/24 <https://radar.qrator.net/as18883/graph#206.108.255.0/24> > 18883 (FIBERNET-NETWORK-OPERATIONS-CENTER) <https://radar.qrator.net/as18883> > 206.108.255.0/24 <https://radar.qrator.net/as53740/graph#206.108.255.0/24> > 53740 (OPTBIT) <https://radar.qrator.net/as53740> > High > 1 > AS Names involved in the incident: > AS18883 (FIBERNET-NETWORK-OPERATIONS-CENTER), AS53740 (OPTBIT) > Active IPv4 incident count: 16 > Radar by Qrator <https://radar.qrator.net/> > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1> > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 <http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1>

March 30, 2020

Re: BGP alerts about AS 53740 (OPTBIT)

by Richard Laager

On 3/30/20 5:29 PM, Abhi Devireddy wrote: > I'll try to filter my feed to QRator to deny the MICE prefix and see if > that fixes it. > > Open to suggestions as well. Why is the MICE /24 in your BGP RIB at all? (Admittedly, there are two schools of thought on this.) -- Richard

March 30, 2020

Re: BGP alerts about AS 53740 (OPTBIT)

by Jeremy Lumby

Abhi, It is not as much a question about filtering prefixes, it is more a question of why your network would originate 206.108.255.0/24 Jeremy Lumby Minnesota VoIP 9217 17th Ave S #216 Bloomington, MN 55425 M: 612-355-7740 D: 612-392-6814 F: 952-873-7425 jlumby(a)mnvoip.com From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Abhi Devireddy Sent: Monday, March 30, 2020 5:29 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) Frank, That's really interesting. I'm sending QRator an unfiltered BGP feed and that might be triggering the error(?). I'll try to filter my feed to QRator to deny the MICE prefix and see if that fixes it. Open to suggestions as well. Abhi From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Frank Bulk <fbulk(a)MYPREMIERONLINE.COM> Sent: Monday, March 30, 2020 5:11 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Subject: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) Curious if anyone can make sense of this alert from QRator. Are they suggesting OPTBIT is advertising MICE’s /24? I’ve seen this come and go since Sunday night at 10:09 pm Central. Frank From: Radar by Qrator <no-reply(a)qrator.net> Sent: Monday, March 30, 2020 2:49 AM Subject: [BGP ALERT] [HIGH] <AS18883> Created Hijacks Time: 30.03.2020 07:42:00 UTC Created Hijacks New IPv4 incidents: Target PrefixTarget ASNAffected prefixAffected ASNSeverityPropagation 206.108.255.0/2418883 (FIBERNET-NETWORK-OPERATIONS-CENTER) 206.108.255.0/2453740 (OPTBIT) High 1 AS Names involved in the incident: AS18883 (FIBERNET-NETWORK-OPERATIONS-CENTER), AS53740 (OPTBIT) Active IPv4 incident count: 16 Radar by Qrator To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

March 30, 2020

Re: BGP alerts about AS 53740 (OPTBIT)

by Abhi Devireddy

Frank, That's really interesting. I'm sending QRator an unfiltered BGP feed and that might be triggering the error(?). I'll try to filter my feed to QRator to deny the MICE prefix and see if that fixes it. Open to suggestions as well. Abhi ________________________________ From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Frank Bulk <fbulk(a)MYPREMIERONLINE.COM> Sent: Monday, March 30, 2020 5:11 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Subject: [MICE-DISCUSS] BGP alerts about AS 53740 (OPTBIT) Curious if anyone can make sense of this alert from QRator. Are they suggesting OPTBIT is advertising MICE’s /24? I’ve seen this come and go since Sunday night at 10:09 pm Central. Frank From: Radar by Qrator <no-reply(a)qrator.net> Sent: Monday, March 30, 2020 2:49 AM Subject: [BGP ALERT] [HIGH] <AS18883> Created Hijacks Time: 30.03.2020 07:42:00 UTC Created Hijacks New IPv4 incidents: Target Prefix Target ASN Affected prefix Affected ASN Severity Propagation 206.108.255.0/24<https://radar.qrator.net/as18883/graph#206.108.255.0/24> 18883 (FIBERNET-NETWORK-OPERATIONS-CENTER)<https://radar.qrator.net/as18883> 206.108.255.0/24<https://radar.qrator.net/as53740/graph#206.108.255.0/24> 53740 (OPTBIT)<https://radar.qrator.net/as53740> High 1 AS Names involved in the incident: AS18883 (FIBERNET-NETWORK-OPERATIONS-CENTER), AS53740 (OPTBIT) Active IPv4 incident count: 16 Radar by Qrator<https://radar.qrator.net> ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

March 30, 2020

BGP alerts about AS 53740 (OPTBIT)

by Frank Bulk

Curious if anyone can make sense of this alert from QRator. Are they suggesting OPTBIT is advertising MICE's /24? I've seen this come and go since Sunday night at 10:09 pm Central. Frank From: Radar by Qrator <no-reply(a)qrator.net> Sent: Monday, March 30, 2020 2:49 AM Subject: [BGP ALERT] [HIGH] <AS18883> Created Hijacks Time: 30.03.2020 07:42:00 UTC Created Hijacks New IPv4 incidents: Target Prefix Target ASN Affected prefix Affected ASN Severity Propagation 206.108.255.0/24<https://radar.qrator.net/as18883/graph#206.108.255.0/24> 18883 (FIBERNET-NETWORK-OPERATIONS-CENTER)<https://radar.qrator.net/as18883> 206.108.255.0/24<https://radar.qrator.net/as53740/graph#206.108.255.0/24> 53740 (OPTBIT)<https://radar.qrator.net/as53740> High 1 AS Names involved in the incident: AS18883 (FIBERNET-NETWORK-OPERATIONS-CENTER), AS53740 (OPTBIT) Active IPv4 incident count: 16 Radar by Qrator<https://radar.qrator.net>

March 30, 2020

Re: Cloudflare Route Server Update

by Richard Laager

On 3/27/20 12:38 PM, Jay Hanke wrote: > Per Cloudflare anycast routes are not available via the route servers > and require a bilateral connection. Done. -- Richard

March 27, 2020

Cloudflare Route Server Update

by Jay Hanke

Please update Cloudflare's Route Server entry to Partial on the MICE participants page. Per Cloudflare anycast routes are not available via the route servers and require a bilateral connection. Thanks! -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

March 27, 2020

Re: Charter upgrade status

by Jeremy Lumby

Yes, the upgrade is complete, and running clean. Charter now has 20G of capacity to MICE. From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of David Farmer Sent: Friday, March 27, 2020 5:56 AM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Charter upgrade status It looks like Charter's port-channel was activated around midnight, could someone confirm both 10G are active in the port-channel? Thanks On Wed, Mar 25, 2020 at 12:26 PM Colin Murphy <murphy(a)umn.edu> wrote: Thanks Chris for the info. I've emailed Charter as well. Thanks, Colin Murphy Sr. Network Engineer Office of Information Technology University of Minnesota Northern Lights Gigapop Desk: 612-626-0870 On Wed, Mar 25, 2020 at 12:23 PM Chris Wopat <wopat(a)wiscnet.net> wrote: On 3/25/20 12:21 PM, Colin Murphy wrote: > > Fyi, I've de-preferred the routes we receive from Charter until the second link is up and running. We've done the same. Ours should have dropped about 1gbps off, moving this traffic to Chicago for us. Looking at their current graphs, they're no longer maxed out at this time. We had emailed Charter about this prior to this MICE thread, they did confirm the upgrade was in progress. -- Chris Wopat Network Engineer, WiscNet wopat(a)wiscnet.net 608-210-3965 To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 -- =============================================== David Farmer Email:farmer@umn.edu Networking & Telecommunication Services Office of Information Technology University of Minnesota 2218 University Ave SE Phone: 612-626-0815 Minneapolis, MN 55414-3029 Cell: 612-812-9952 =============================================== To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

March 27, 2020

Re: Charter upgrade status

by David Farmer

It looks like Charter's port-channel was activated around midnight, could someone confirm both 10G are active in the port-channel? Thanks On Wed, Mar 25, 2020 at 12:26 PM Colin Murphy <murphy(a)umn.edu> wrote: > Thanks Chris for the info. I've emailed Charter as well. > > Thanks, > > Colin Murphy > Sr. Network Engineer > Office of Information Technology > University of Minnesota > Northern Lights Gigapop > Desk: 612-626-0870 > > > On Wed, Mar 25, 2020 at 12:23 PM Chris Wopat <wopat(a)wiscnet.net> wrote: > >> On 3/25/20 12:21 PM, Colin Murphy wrote: >> > >> > Fyi, I've de-preferred the routes we receive from Charter until the >> second link is up and running. >> >> We've done the same. Ours should have dropped about 1gbps off, moving >> this traffic to Chicago for us. >> >> Looking at their current graphs, they're no longer maxed out at this time. >> >> We had emailed Charter about this prior to this MICE thread, they did >> confirm the upgrade was in progress. >> >> -- >> Chris Wopat >> Network Engineer, WiscNet >> wopat(a)wiscnet.net 608-210-3965 >> > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > -- =============================================== David Farmer Email:farmer@umn.edu Networking & Telecommunication Services Office of Information Technology University of Minnesota 2218 University Ave SE Phone: 612-626-0815 Minneapolis, MN 55414-3029 Cell: 612-812-9952 ===============================================

March 27, 2020

Re: Charter upgrade status

by Colin Murphy

Thanks Chris for the info. I've emailed Charter as well. Thanks, Colin Murphy Sr. Network Engineer Office of Information Technology University of Minnesota Northern Lights Gigapop Desk: 612-626-0870 On Wed, Mar 25, 2020 at 12:23 PM Chris Wopat <wopat(a)wiscnet.net> wrote: > On 3/25/20 12:21 PM, Colin Murphy wrote: > > > > Fyi, I've de-preferred the routes we receive from Charter until the > second link is up and running. > > We've done the same. Ours should have dropped about 1gbps off, moving > this traffic to Chicago for us. > > Looking at their current graphs, they're no longer maxed out at this time. > > We had emailed Charter about this prior to this MICE thread, they did > confirm the upgrade was in progress. > > -- > Chris Wopat > Network Engineer, WiscNet > wopat(a)wiscnet.net 608-210-3965 >

March 25, 2020

Re: Charter upgrade status

by Chris Wopat

On 3/25/20 12:21 PM, Colin Murphy wrote: > > Fyi, I've de-preferred the routes we receive from Charter until the second link is up and running. We've done the same. Ours should have dropped about 1gbps off, moving this traffic to Chicago for us. Looking at their current graphs, they're no longer maxed out at this time. We had emailed Charter about this prior to this MICE thread, they did confirm the upgrade was in progress. -- Chris Wopat Network Engineer, WiscNet wopat(a)wiscnet.net 608-210-3965

March 25, 2020

Re: Charter upgrade status

by Colin Murphy

Fyi, I've de-preferred the routes we receive from Charter until the second link is up and running. Thanks, Colin Murphy Sr. Network Engineer Office of Information Technology University of Minnesota Northern Lights Gigapop Desk: 612-626-0870 On Wed, Mar 25, 2020 at 11:55 AM Jay Hanke <jayhanke(a)southfront.io> wrote: > Charter is adding a second 10G link. The cross connect and optic have been > installed but it has not been lagged into service yet. > > On Wed, Mar 25, 2020 at 11:53 AM Colin Murphy <murphy(a)umn.edu> wrote: > >> Hello Mice group, >> I'm getting user complaints from charter home users accessing GigaPoP >> participants. Does anyone know when Charter will be completing the >> conversion of a single 10 gig to a 2x10 gig port channel with their >> current link being maxed out? >> >> Thanks, >> >> Colin Murphy >> Sr. Network Engineer >> Office of Information Technology >> University of Minnesota >> Northern Lights Gigapop >> Desk: 612-626-0870 >> >> ------------------------------ >> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >> > > > -- > Jay Hanke, President > South Front Networks > jayhanke(a)southfront.io > Phone 612-204-0000 > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >

March 25, 2020