- mice-discuss - lists.micemn.net

Re: Please welcome KC Fiber to MICE!

by Doug McIntyre

On Wed, Feb 05, 2020 at 05:09:03PM -0600, Jay Hanke wrote: >Name: KC Fiber >Port: MN VoIP Remote Switch (1G) >ASN: 11708 >IPv4: 206.108.255.154/24 >IPv6: 2001:504:27:0:0:2dbc::1/64 >Peering Contact: peering(a)kcfiber.com >Route Servers- YES >BFD: No They have been added to the RR's. Welcome! -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

Feb. 5, 2020

Please welcome KC Fiber to MICE!

by Jay Hanke

Name: KC Fiber Port: MN VoIP Remote Switch (1G) ASN: 11708 IPv4: 206.108.255.154/24 IPv6: 2001:504:27:0:0:2dbc::1/64 Peering Contact: peering(a)kcfiber.com Route Servers- YES BFD: No Welcome aboard! -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

Feb. 5, 2020

DCN 100G Port Upgrade

by Jay Hanke

DCN will be adding a 100G port and keeping their existing 10G port. The new 100G port assignment is Ethernet3/17/1 on the main switch. The new port will use existing IP assignments (labeled Fargo) 206.108.255.60 2001:504:27:0:0:68AA::1 Please provide your Arista compatible optic to Cologix or to Jeremy for installation in the main switch. This email will serve as your LOA/CFA. Welcome Aboard! -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

Jan. 28, 2020

Re: Blackholing DoS traffic

by Andrew Hoyos

Relevant: http://instituut.net/~job/LINX99_route_servers.pdf > On Jan 24, 2020, at 8:38 AM, Chris Wopat <wopat(a)wiscnet.net> wrote: > > On 1/24/20 8:01 AM, Frank Bulk wrote: >> This seems reasonable to me -- what is the timeline to IRR filter implementation? >> > > I would suspect this would require reaching out to MICE participants to > find their AS-SETs to build IRR off of, which should also help reveal > who is actually using IRR, which irrdb their data is at, and so on. > > I would think the best source of this data would be PeeringDB, instead > of MICE generating and maintaining its own list on the participants page. > > An API call to MICE's internal id shows the needed data: asn, irr_as_set: > > https://www.peeringdb.com/api/net?ix_id=446 > > It appears that 50 of the 88 participants have irr_as_set defined in > peeringdb, which is a pretty good start ('work' attached as text file) > > grep name mice.txt | wc -l > 88 > > grep irr_as_set mice.txt | grep \"\" | wc -l > 38 > > Apologies if methods for this have already been discussed, I didn't dig > in the archives. > > Cheers, > -- > Chris Wopat > Network Engineer, WiscNet > wopat(a)wiscnet.net 608-210-3965 > <mice-rr-data.txt>

Jan. 24, 2020

Re: Blackholing DoS traffic

by Chris Wopat

On 1/24/20 8:01 AM, Frank Bulk wrote: > This seems reasonable to me -- what is the timeline to IRR filter implementation? > I would suspect this would require reaching out to MICE participants to find their AS-SETs to build IRR off of, which should also help reveal who is actually using IRR, which irrdb their data is at, and so on. I would think the best source of this data would be PeeringDB, instead of MICE generating and maintaining its own list on the participants page. An API call to MICE's internal id shows the needed data: asn, irr_as_set: https://www.peeringdb.com/api/net?ix_id=446 It appears that 50 of the 88 participants have irr_as_set defined in peeringdb, which is a pretty good start ('work' attached as text file) grep name mice.txt | wc -l 88 grep irr_as_set mice.txt | grep \"\" | wc -l 38 Apologies if methods for this have already been discussed, I didn't dig in the archives. Cheers, -- Chris Wopat Network Engineer, WiscNet wopat(a)wiscnet.net 608-210-3965

Jan. 24, 2020

Re: Blackholing DoS traffic

by Frank Bulk

This seems reasonable to me -- what is the timeline to IRR filter implementation? Frank -----Original Message----- From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Richard Laager Sent: Thursday, January 23, 2020 2:54 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Blackholing DoS traffic On 1/23/20 2:45 PM, Frank Bulk wrote: > Has support for a blackhole community been added? We’d like to start > doing that. AFAIK, no. I think we'd need: - A BGP community* - which when set** causes the route servers to set a next hop of a specific IP address (and probably set no-export too) - which the route servers (?) ARP for, returning a specific MAC - which is blocked by a layer 2 ACL on the core switch and any remotes that are able to do so * At least the well-known blackhole community 65535:666 from RFC 7999. ** The route servers would also have to allow smaller prefixes when the blackhole community is set, so that you could blackhole as small as a single address (in IPv4 at least). See also: https://www.seattleix.net/blackholing In practice, this is probably behind IRR filtering in implemetation priority, because we really should be using IRR filtering so that you can only blackhole your own prefixes. -- Richard

Jan. 24, 2020

Re: Blackholing DoS traffic

by Richard Laager

On 1/23/20 2:45 PM, Frank Bulk wrote: > Has support for a blackhole community been added? We’d like to start > doing that. AFAIK, no. I think we'd need: - A BGP community* - which when set** causes the route servers to set a next hop of a specific IP address (and probably set no-export too) - which the route servers (?) ARP for, returning a specific MAC - which is blocked by a layer 2 ACL on the core switch and any remotes that are able to do so * At least the well-known blackhole community 65535:666 from RFC 7999. ** The route servers would also have to allow smaller prefixes when the blackhole community is set, so that you could blackhole as small as a single address (in IPv4 at least). See also: https://www.seattleix.net/blackholing In practice, this is probably behind IRR filtering in implemetation priority, because we really should be using IRR filtering so that you can only blackhole your own prefixes. -- Richard

Jan. 23, 2020

Re: Blackholing DoS traffic

by Frank Bulk

Has support for a blackhole community been added? We’d like to start doing that. Frank From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Steve Howard Sent: Friday, July 05, 2019 12:33 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Blackholing DoS traffic Hmmm... That is interesting. It would be nice to see functionality added to MICE someday. I especially like the 65535:666 community support because it would work nicely with our existing DDoS handling configuration. On a somewhat related note, we use the free CYMRU Unwanted Traffic Renewal Service ( http://www.team-cymru.com/utrs.html<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.team-2Dcymru.com_ut…> ) to reduce our DDoS traffic. I encourage MICE members to check it out -- as more ASes use it, it becomes more effective. On 06/20/2019 11:33 AM, Frank Bulk wrote: https://www.seattleix.net/blackholing<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.seattleix.net_blac…> Does MICE have an blackholng functionality equivalent to SIX? I was visiting with a DDoS mitigation vendor this morning and was curious if there was a way we could automatically mitigate DoS attack traffic coming from a MICE peer. Regards, Frank ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.iphouse.net_cgi-2…> ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.iphouse.net_cgi-2…>

Jan. 23, 2020

Re: Debian Mirrors

by Ryan Nelson

For a MICE accessible option, the U of M Computer Science department hosts a mirror that has both Ubuntu and Debian repositories (plus some others). The website is http://mirror.umn.edu/. Ubuntu repositories: http://mirror.cs.umn.edu/ubuntu/ Debian repositories: http://mirror.cs.umn.edu/debian/ Ryan Nelson | Senior Network Architect Compudyne | 306 W Michigan Street - Suite 200 | Duluth, MN 55802 rnelson(a)compudyne.com | 218.336.2220 | compudyne.com -----Original Message----- From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Mike Horwath Sent: Monday, January 13, 2020 12:30 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Debian Mirrors On Mon, Jan 13, 2020 at 06:10:06PM +0000, Justin Krejci wrote: > Do they have separate ISOs and packages/updates mirrors? Is that for > everything? Everything that I have downloaded - I find ISOs out there. -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

Jan. 17, 2020

Re: FW: Prefix Hijack: 206.108.255.0/24

by Frank Bulk

Thanks for sorting that out! Frank -----Original Message----- From: Brandon Mulligan <brandon(a)nocix.net> Sent: Tuesday, January 14, 2020 4:51 PM To: Frank Bulk <fbulk(a)mypremieronline.com>; MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> Cc: noc(a)wholesaleinternet.net Subject: Re: FW: Prefix Hijack: 206.108.255.0/24 Frank + MICE, This was sent to a new customer by mistake who then sent it to a route collector. I did not detect this in Cogent's looking glass. This should be resolved now. Sorry for the alert and thanks for the notification! On 1/14/2020 3:37 PM, Frank Bulk wrote: > Not sure if it's valid, but Hurricane Electric says that MICE's /24 is being infringed upon by AS32097 (WholeSale Internet, Inc.) > > Copying WII. > > Frank > > -----Original Message----- > From: no-reply(a)he.net <no-reply(a)he.net> > Sent: Tuesday, January 14, 2020 3:26 PM > Subject: Prefix Hijack: 206.108.255.0/24 > > # Hijack Alert > > You are receiving this e-mail because one of your prefix registrations > matched this alarm. > > Prefix: 206.108.255.0/24 > Infringing AS: 32097 (via peer 23.139.160.84) > AS Path: 26073 32097 > When: 2020-01-14 21:16:50 UTC

Jan. 14, 2020

FW: Prefix Hijack: 206.108.255.0/24

by Frank Bulk

Not sure if it's valid, but Hurricane Electric says that MICE's /24 is being infringed upon by AS32097 (WholeSale Internet, Inc.) Copying WII. Frank -----Original Message----- From: no-reply(a)he.net <no-reply(a)he.net> Sent: Tuesday, January 14, 2020 3:26 PM Subject: Prefix Hijack: 206.108.255.0/24 # Hijack Alert You are receiving this e-mail because one of your prefix registrations matched this alarm. Prefix: 206.108.255.0/24 Infringing AS: 32097 (via peer 23.139.160.84) AS Path: 26073 32097 When: 2020-01-14 21:16:50 UTC

Jan. 14, 2020

Re: WiscNet Remote Switch / Dedicated Remote Switches

by Richard Laager

The board decision is: We encourage remote switch operators to use dedicated switches, which seems like the best solution technically, but we will continue to evaluate proposals on a case-by-case basis with no firm requirement for dedicated switches. The WiscNet proposal is approved. -- Richard

Jan. 14, 2020

Re: Debian Mirrors

by Mike Horwath

On Mon, Jan 13, 2020 at 06:10:06PM +0000, Justin Krejci wrote: > Do they have separate ISOs and packages/updates mirrors? Is that for > everything? Everything that I have downloaded - I find ISOs out there. -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

Jan. 13, 2020

Re: Debian Mirrors

by Justin Krejci

Do they have separate ISOs and packages/updates mirrors? Is that for everything? ________________________________ From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Mike Horwath <drechsau(a)GEEKS.ORG> Sent: Monday, January 13, 2020 12:02 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Debian Mirrors On Mon, Jan 13, 2020 at 05:34:46PM +0000, Justin Krejci wrote: > How big is a full debian mirror? Maybe we can add it. 684 GiB on my system. It's not all that large. -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

Jan. 13, 2020

Re: Debian Mirrors

by Mike Horwath

On Mon, Jan 13, 2020 at 05:34:46PM +0000, Justin Krejci wrote: > How big is a full debian mirror? Maybe we can add it. 684 GiB on my system. It's not all that large. -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

Jan. 13, 2020

Re: Debian Mirrors

by Justin Krejci

As noted, we don't mirror debian specifically but do for ubuntu, centos, and mint. http://mirrors.usinternet.com/ How big is a full debian mirror? Maybe we can add it. ________________________________ From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> on behalf of Richard Laager <rlaager(a)WIKTEL.COM> Sent: Saturday, January 11, 2020 5:40 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Debian Mirrors On 1/11/20 1:43 PM, Jay Hanke wrote: > Is anyone hosting Debian mirrors available over MICE? It's not accessible via MICE, but http://mirror.steadfast.net is relatively close, fast, and mirrors both Debian and Ubuntu. From my machine, it is the closest publicly listed Debian mirror (according to netselect). We have been using it for years for Ubuntu, though I'm going to give the US Internet mirror a try (since they're closer). For Debian, I had switched from Steadfast to Fastly (cdn-fastly.deb.debian.org) My commit message at the time said that Fastly was in Minneapolis and faster, but neither of those things are true today it seems. -- Richard

Jan. 13, 2020

Re: Debian Mirrors

by Richard Laager

On 1/11/20 1:43 PM, Jay Hanke wrote: > Is anyone hosting Debian mirrors available over MICE? It's not accessible via MICE, but http://mirror.steadfast.net is relatively close, fast, and mirrors both Debian and Ubuntu. From my machine, it is the closest publicly listed Debian mirror (according to netselect). We have been using it for years for Ubuntu, though I'm going to give the US Internet mirror a try (since they're closer). For Debian, I had switched from Steadfast to Fastly (cdn-fastly.deb.debian.org) My commit message at the time said that Fastly was in Minneapolis and faster, but neither of those things are true today it seems. -- Richard

Jan. 11, 2020

Re: Debian Mirrors

by Mike Horwath

On Sat, Jan 11, 2020 at 02:06:38PM -0600, Jay Hanke wrote: > > I used to have an official mirror at mirrors.geeks.org and it still > > auto-updates though how perfect it is .. I don't know as I don't do > > much with debian anymore. > > Looks like you're not listed on the Debian website anymore. Does it > still see some public traffic? yep! -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

Jan. 11, 2020

Re: Debian Mirrors

by Jay Hanke

> I used to have an official mirror at mirrors.geeks.org and it still > auto-updates though how perfect it is .. I don't know as I don't do > much with debian anymore. Looks like you're not listed on the Debian website anymore. Does it still see some public traffic? I've been pulling out of the USI archive for Ubuntu for a while (Thanks Justin!) -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

Jan. 11, 2020

Re: Debian Mirrors

by Mike Horwath

On Sat, Jan 11, 2020 at 01:43:39PM -0600, Jay Hanke wrote: > Is anyone hosting Debian mirrors available over MICE? I used to have an official mirror at mirrors.geeks.org and it still auto-updates though how perfect it is .. I don't know as I don't do much with debian anymore. USI has an official mirrors of many different distributions and they have far more bandwidth than I :) -- Mike Horwath, reachable via drechsau(a)Geeks.ORG

Jan. 11, 2020

Debian Mirrors

by Jay Hanke

Is anyone hosting Debian mirrors available over MICE? -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

Jan. 11, 2020

Re: Please Welcome Aureon Network Services to MICE!

by Doug McIntyre

On Fri, Jan 10, 2020 at 10:20:43AM -0600, Jay Hanke wrote: >Name: Aureon Network Services >Port: Ethernet 3/16/1 (Main Switch 100G) >ASN: 5056 >IPv4: 206.108.255.153/24 >IPv6: 2001:504:27:0:0:13c0::1/64 >Peering Contact: peering(a)aureon.net >Route Servers- YES >BFD: No > >Welcome aboard! All setup in the RR. Welcome! -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

Jan. 10, 2020

Re: Please Welcome Aureon Network Services to MICE!

by Jay Hanke

Correct peering address is peering(a)aureon.com On Fri, Jan 10, 2020 at 10:20 AM Jay Hanke <jayhanke(a)southfront.io> wrote: > Name: Aureon Network Services > Port: Ethernet 3/16/1 (Main Switch 100G) > ASN: 5056 > IPv4: 206.108.255.153/24 > IPv6: 2001:504:27:0:0:13c0::1/64 > Peering Contact: peering(a)aureon.net > Route Servers- YES > BFD: No > > Welcome aboard! > > -- > Jay Hanke, President > South Front Networks > jayhanke(a)southfront.io > Phone 612-204-0000 > -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

Jan. 10, 2020

Please Welcome Aureon Network Services to MICE!

by Jay Hanke

Name: Aureon Network Services Port: Ethernet 3/16/1 (Main Switch 100G) ASN: 5056 IPv4: 206.108.255.153/24 IPv6: 2001:504:27:0:0:13c0::1/64 Peering Contact: peering(a)aureon.net Route Servers- YES BFD: No Welcome aboard! -- Jay Hanke, President South Front Networks jayhanke(a)southfront.io Phone 612-204-0000

Jan. 10, 2020

Re: Route reflector check

by Frank Bulk

Mike, It's possible that it's a single prefix that's setting QRator off. I just sent you a copy of our MICE-facing routing table for AS 2381 and we'll see I can jump on the next time I get a QRator alert to compare. I checked for 184.164.25[0-2].0/24 and I don't see it right now. Thanks! Frank From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET> On Behalf Of Michael Hare Sent: Monday, December 30, 2019 3:59 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Route reflector check Hi everyone- Wanted to add a bit more detail to what we (AS 3128) checked on our side. Specifically, 1) our peering session(s) to the RS seems stable from an uptime perspective. 2) I don't see a large delta in outbound bgp messages from us to MICE. 3) we don't run BMP so I don't actually track outbound changes at a level that would conclusive prove what's going on. Frank, is it possible you are being notified about a single route flapping? I did check AS2381's looking glass, specifically a single route (143.235.0.0/16) and it looks stable. Admittedly I didn't look for LG across all MICE members but I'm not sure if any would allow me to run an as-path regexp to see if there is a specific flapping route that is flapping. If someone can help out on that front it could be useful. [output from AS2381 looking glass] [BGP/170] 1w6d 13:08:45, MED 10, localpref 200, from 206.108.255.1 AS path: 3128 3128 3128 3128 I, validation-state: unverified > to 206.108.255.66 via xe-0/1/5.300 [BGP/170] 3w3d 14:51:19, MED 10, localpref 200, from 206.108.255.2 AS path: 3128 3128 3128 3128 I, validation-state: unverified > to 206.108.255.66 via xe-0/1/5.300 Thanks- -Michael From: MICE Discuss <MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> On Behalf Of Frank Bulk Sent: Monday, December 30, 2019 3:37 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> Subject: [MICE-DISCUSS] Route reflector check QRator has been alerting me that AS 3128 is coming and going. It just happened again and wondering if anyone else is seeing this behavior and also how things look on MICE's route reflectors. I already contacted the good folks at the University of Wisconsin and they're not seeing anything on their side. AS Number: AS3128 AS Name: # First seen Last seen 1 2019-12-29 21:49:00 2019-12-29 21:50:00 2 2019-12-29 18:42:00 2019-12-29 18:43:00 3 2019-12-29 17:57:00 2019-12-29 17:58:00 4 2019-12-29 16:27:00 2019-12-29 16:28:00 5 2019-12-29 14:12:00 2019-12-29 14:13:00 6 2019-12-29 13:27:00 2019-12-29 13:28:00 7 2019-12-29 12:42:00 2019-12-29 12:43:00 8 2019-12-29 11:57:00 2019-12-29 11:58:00 9 2019-12-29 11:12:00 2019-12-29 11:13:00 10 2019-12-29 11:04:00 2019-12-29 11:05:00 11 2019-12-29 10:27:00 2019-12-29 10:28:00 12 2019-12-29 08:57:00 2019-12-29 08:58:00 13 2019-12-29 08:12:00 2019-12-29 08:13:00 14 2019-12-29 07:53:00 2019-12-29 07:54:00 15 2019-12-29 07:27:00 2019-12-29 07:28:00 16 2019-12-29 06:42:00 2019-12-29 06:43:00 17 2019-12-29 05:57:00 2019-12-29 05:58:00 18 2019-12-29 05:12:00 2019-12-29 05:13:00 19 2019-12-29 04:40:00 2019-12-29 04:41:00 20 2019-12-29 04:27:00 2019-12-29 04:28:00 21 2019-12-29 00:05:00 2019-12-29 00:06:00 22 2019-12-28 23:57:00 2019-12-28 23:58:00 23 2019-12-28 23:12:00 2019-12-28 23:13:00 24 2019-12-28 23:04:00 2019-12-28 23:05:00 25 2019-12-28 22:27:00 2019-12-28 22:28:00 26 2019-12-28 21:42:00 2019-12-28 21:43:00 27 2019-12-28 20:57:00 2019-12-28 20:58:00 28 2019-12-28 20:12:00 2019-12-28 20:13:00 29 2019-12-28 07:27:00 2019-12-28 07:28:00 30 2019-12-28 06:42:00 2019-12-28 06:43:00 31 2019-12-28 05:57:00 2019-12-28 05:58:00 32 2019-12-28 05:12:00 2019-12-28 05:13:00 33 2019-12-27 17:21:00 2019-12-27 17:22:00 34 2019-12-06 07:01:00 2019-12-27 06:10:00 Frank ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.iphouse.net_cgi-2…> ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.iphouse.net_cgi-2…>

Dec. 31, 2019