West Coast Peering / Packet Loss issues between AS7018 (AT) and AS6461

[Alex Buie]

Since roughly 6:30AM local time on Tuesday we have been seeing
significantly increased packet loss (20-40%) and latency increase of
~30-40ms from customers on the west coast hosted out of AS7018
(AT/sbcglobal) towards our addresses announced through Zayo (AS6461).

Has anyone else noticed or seen this? We're working through our channels
with the carrier but the latency profile is such that it seems likely it
may be affecting others as well and I wanted to ask the group. Any
incidents that anyone is aware of which may be related?

Thanks,


*Alex Buie*Senior Cloud Operations Engineer

450 Century Pkwy # 100 Allen, TX 75013
<https://maps.google.com/?q=450+Century+Pkwy+STE+100+%7C+Allen,+TX+%7C+75013=gmail=g>
D: 469-884-0225 | www.cytracom.com

Arista “IP-SLA” / Active Probing

[Alex Buie]

Hello all,

We find ourselves trying to solve a requirement where we would like to test
the viability of our paths to the internet and tear down the bgp session if
it is determined to be faulty. We had an issue recently where we did not
lose link or bgp but the carrier lost the ability to route traffic to the
internet for us and our existing automatic detection and remediation
strategies failed to detect this condition and we lost customer packets.

Conceptually, we have a pair of DCS7050-QX landing a fiber each from two
ISPs with default routes on BGP at a dozen POPs around the US.

One of the ISPs is our primary transit, and one is predominantly for peered
customers, but we can use it for transit during issues with the primary
circuits.

I did some research on this and it seems like perhaps the on-boot event
handler launching a python daemon to do this active probing out each isp
circuit and then making config changes in response to transit failures
might be the best option available to us.

However, I thought I’d reach out to the broader community to see if there’s
a better way to solve this, has an example script, or if anyone has
recommendations for methods of active monitoring for protecting against
this sort of failure.

Thanks in advance for any insight and time.




*Alex Buie*Senior Cloud Operations Engineer

450 Century Pkwy # 100 Allen, TX 75013
<https://maps.google.com/?q=450+Century+Pkwy+STE+100+%7C+Allen,+TX+%7C+75013=gmail=g>
D: 469-884-0225 | www.cytracom.com

Re: Ticketmaster contact

[Alex Buie]

Thank you for the tips so far. It was mentioned to me off-list this might
be more helpful with our AS and relevant ranges, so including them here in
case that's helpful. Sorry for not including them originally!

AS: 396163


69.194.4.0/23
104.225.212.0/23


*Alex Buie*Senior Cloud Operations Engineer

450 Century Pkwy # 100 Allen, TX 75013
<https://maps.google.com/?q=450+Century+Pkwy+STE+100+%7C+Allen,+TX+%7C+75013=gmail=g>
D: 469-884-0225 | www.cytracom.com



On Fri, Jan 13, 2023 at 6:32 AM Alex Buie  wrote:

> Hi NANOG,
>
> We're an ISP providing residential and business fixed internet
> services, and all of our ranges are blocked from accessing
> ticketmaster with the attached "Pardon the interruption, you are
> superhuman or a bot" message and have been for some time; customer
> complaint velocity has increased especially as of late so it's been a
> priority to try and get this working. We've done extensive checking to
> ensure there is no bot activity or scalping transiting our network, we
> aren't using cgNAT - each IP is a specific customer end installation
> (home/office), and we have rPKI set up.
>
> Is there anyone from Ticketmaster on list who'd be willing to contact
> me for a conversation to see if we can resolve this for our mutual
> customers? Or could anyone provide me with a decent technical contact
> if they might have one? I would be eternally grateful. I have tried
> "fan support" numerous times, which provided helpful (/s) suggestions
> like "try purchasing tickets over LTE", or "use a different internet
> connection, like at a coffee shop", or "contact your ISP" (myself?
> lol), depending on the day. Also tried their "Global Monitoring
> Support" organization by phone and by email with little success.
>
> ARIN contacts bounce back as a 550 5.7.133
> RESOLVER.RST.SenderNotAuthenticatedForGroup, looks like o365
> configured to not accept external messages.
>
> If you've successfully managed to work this out with them, have any
> tips, or recognize what WAF/engine they're using from the page layout
> with UUID at the bottom to help me identify who else I might try
> contacting to see about getting recategorized, I would really
> appreciate hearing from you.
>
> Thanks a bunch!
>
>
> Alex Buie
> Senior Cloud Operations Engineer
>
> 450 Century Pkwy # 100 Allen, TX 75013
> D: 469-884-0225 | www.cytracom.com
>

Ticketmaster contact

[Alex Buie]

Hi NANOG,

We're an ISP providing residential and business fixed internet
services, and all of our ranges are blocked from accessing
ticketmaster with the attached "Pardon the interruption, you are
superhuman or a bot" message and have been for some time; customer
complaint velocity has increased especially as of late so it's been a
priority to try and get this working. We've done extensive checking to
ensure there is no bot activity or scalping transiting our network, we
aren't using cgNAT - each IP is a specific customer end installation
(home/office), and we have rPKI set up.

Is there anyone from Ticketmaster on list who'd be willing to contact
me for a conversation to see if we can resolve this for our mutual
customers? Or could anyone provide me with a decent technical contact
if they might have one? I would be eternally grateful. I have tried
"fan support" numerous times, which provided helpful (/s) suggestions
like "try purchasing tickets over LTE", or "use a different internet
connection, like at a coffee shop", or "contact your ISP" (myself?
lol), depending on the day. Also tried their "Global Monitoring
Support" organization by phone and by email with little success.

ARIN contacts bounce back as a 550 5.7.133
RESOLVER.RST.SenderNotAuthenticatedForGroup, looks like o365
configured to not accept external messages.

If you've successfully managed to work this out with them, have any
tips, or recognize what WAF/engine they're using from the page layout
with UUID at the bottom to help me identify who else I might try
contacting to see about getting recategorized, I would really
appreciate hearing from you.

Thanks a bunch!


Alex Buie
Senior Cloud Operations Engineer

450 Century Pkwy # 100 Allen, TX 75013
D: 469-884-0225 | www.cytracom.com

Re: Wifi Calling Firewall Holes to Punch

[Alex Buie via NANOG]

It's been a minute since I've set this up in a corp/campus wifi scenario,
but my notes for Verizon VoWiFi  from the last time I did say that you need
outbound udp/500 and udp/4500 IPSec protocol (IKE and ESP) permitted out
the firewall. Tunnel endpoints live in 141.207.0.0/16, so hopefully that
lets you scope the rule enough to please your ISO.

Devices will also need the ability to make an HTTPS request to
https://spg.vzw.com/SSFGateway/e911Location/changeAddress

As well, DNS queries for the ePDG domain wo.vzwwo.com need to be permitted.

That _should_ be all you need to get it bootstrapped.

Alex

On Fri, Jul 17, 2020 at 12:39 PM Lyden, John C  wrote:

> Hey gang.
>
>
>
> We’re setting up a unified wireless network for the students here, and to
> get around the issues with Nintendo and NAT we devoted a large chunk of
> public IP space to them.
>
>
>
> We’re aware that this is causing issues with wifi calling on Verizon, TMo
> etc because it appears they initiate the SIP session inbound.
>
>
>
> Does anybody have a handy list of IP blocks and ports? T-Mobile had a
> decent page but other providers just said “open up 4500 and 500” and our
> ISO guys don’t like that.
>
>
>
> Thanks if someone can help.
>
>
>
> John C. Lyden
>
> Manager of Network Infrastructure, Infrastructure Services
>
> Division of Information Resources & Technology, Rowan University
>
>
>


-- 
*Alex Buie*
Associate Network Engineer
Datto, Inc.
475-288-4550 (o)
585-653-8779 (c)
www.datto.com

<http://www.datto.com/support-sig/>

Join the conversation! [image: Facebook] <http://www.facebook.com/dattoinc>
  [image: Twitter] <https://twitter.com/Datto> [image: LinkedIn]
<https://www.linkedin.com/company/5213385>  [image: Blog RSS]
<http://blog.datto.com/blog> [image: Slideshare]
<http://www.slideshare.net/backupify>  [image: Spiceworks]
<https://community.spiceworks.com/pages/datto>

Re: HPE SAS Solid State Drives - Critical Firmware Upgrade Required

[Alex Buie via NANOG]

Looking at a handful of images and listings online, it appears at least
some (?) are Samsung - for example, HP 816562-B21 is just a rebadged
Samsung MZ-ILS4800.

Unknown whether it only affects the HPE digitally signed firmware, or all
firmwares, though.

On Tue, Nov 26, 2019 at 3:58 PM  wrote:

> Since this is a SSD manufacturer problem does it impact other servers
> that might have SSD from the same manufacturer???
>
> HP hasn't said who the manufacturer is?
>
> Geoff
>
>
> On 11/26/19 1:45 PM, Patrick W. Gilmore wrote:
> > I do not normally post about firmware bugs, but I have this nightmare
> scenario running through my head of someone with a couple of mirrored HPE
> SSD arrays and all the drives going POOF!  simultaneously. Even with an
> off-site backup, that could be disastrous. So if you have HPE SSDs, check
> this announcement.
> >
> >
> https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00092491en_us
> >
>
>

-- 
*Alex Buie*
Technical Support Expert, Level 3 - Networking
Datto, Inc.
475-288-4550 (o)
585-653-8779 (c)
www.datto.com

<http://www.datto.com/support-sig/>

Join the conversation! [image: Facebook] <http://www.facebook.com/dattoinc>
  [image: Twitter] <https://twitter.com/Datto> [image: LinkedIn]
<https://www.linkedin.com/company/5213385>  [image: Blog RSS]
<http://blog.datto.com/blog> [image: Slideshare]
<http://www.slideshare.net/backupify>  [image: Spiceworks]
<https://community.spiceworks.com/pages/datto>

Re: Cellular backup connections

[Alex Buie]

We deploy routers with Verizon LTE failover - for full functionality, make
sure your MTU is 1428 or less, per their specifications.

Here's an example doc from Spirent that talks about it.

https://support.spirent.com/SC_KnowledgeView?Id=FAQ14556


Alex

On Mon, Jun 24, 2019, 7:51 AM Dovid Bender  wrote:

> I am getting the same for SSH and https traffic. It's strange. Where the
> response is something small like:
> 
> Moved to this https://63.XX.XX.XX:443/auth.asp;>location.
> 
> It works But when I try to load pages that are any bigger it fails. Like I
> said before I assume it's either an issue with the MTU or window szie. I
> was just wondering if anyone encountered such an issue before. It's not
> easy getting to someone that knows something. When you have some sort of
> concrete info the level1 techs tend to pass you along faster.
>
>
>
>
>
> On Mon, Jun 24, 2019 at 7:41 AM J. Hellenthal 
> wrote:
>
>> Could be wrong on this but direct SSH on the LTE side may possibly be not
>> allowed(filtered) and might just be something you could discuss in a ticket
>> with Verizon.
>>
>> --
>>  J. Hellenthal
>>
>> The fact that there's a highway to Hell but only a stairway to Heaven
>> says a lot about anticipated traffic volume.
>>
>> On Jun 24, 2019, at 04:50, Dovid Bender  wrote:
>>
>> All,
>>
>> I finally got around to putting in a Verizon LTE connection and the ping
>> times are pretty good. There is the occasional issue however for the most
>> part ping times are < 50 ms. I have another strange issue though. When I
>> try to ssh or connect via the endpoints web interface it fails. If I first
>> connect via PPTP or SSL VPN then it works. I ruled out it being my IP since
>> if I connect direct from the PPTP or SSL VPN box then it fails as well. It
>> seems the tunnel does something (perhaps lowering the MTU or fragmenting
>> packets) that allows it to work. Any thoughts?
>>
>> TIA.
>>
>>
>>
>>
>> On Mon, Feb 4, 2019 at 8:18 AM Dovid Bender  wrote:
>>
>>> Anyone know if Verizon static IP's over LTE have same issue where they
>>> bounce the traffic around before it gets back to the NY metro area?
>>>
>>>
>>>
>>> On Thu, Jan 3, 2019 at 6:46 PM Dovid Bender  wrote:
>>>
 All,

 Thanks for all of the feedback. I was on site today and noticed two
 things.
 1) As someone mentioned it could be for static IP's they have the
 traffic going to a specific location. The POP is in NJ there was a min.
 latency of 120ms which prob had to do with this.
 2) I was watching the ping times and it looked something like this:
 400ms
 360ms
 330ms
 300ms
 260ms
 210ms
 170ms
 140ms
 120ms
 400ms
 375ms

 It seems to have been coming in "waves". I assume this has to do with
 "how cellular work" and the signal. I tried moving it around by putting it
 down low on the floor, moving it locations etc. and saw the same thing
 every time. I am going to try Verizon next and see how it goes.



 On Sat, Dec 29, 2018 at 12:13 PM Mark Milhollan 
 wrote:

> On Fri, 28 Dec 2018, Dovid Bender wrote:
>
> >I finally got around to setting up a cellular backup device in our
> new POP.
>
> >When SSH'ing in remotely the connection seems rather slow.
>
> Perhaps using MOSH can help make the interactive CLI session less
> annoying.
>
> >Verizon they charge $500.00 just to get a public IP and I want to
> avoid
> >that if possible.
>
> You might look into have it call out / maintain a connection back to
> your infrastructure.
>
>
> /mark
>

Re: Verizon Wireless 4G Voice/Data

[Alex Buie]

Issue is supposedly resolved. Please test :)
On Jun 14, 2016 7:33 PM, "Kraig Beahn"  wrote:

> Thanks Alex and Allen,
>
> All of the devices tested on our side have Florida NPA/NXX's, including
> data only devices, which is more than likely the reason we are seeing
> issues elsewhere across the country.
>
> Seems to be reports elsewhere of similar issues, however is probably
> related to the same style MSC/HLR routing (back to Florida)
>
> The issue still persists, as of the timestamp of this email, tho, we did
> confirm 911 was unaffected, at least in the North Florida territory.
>
> Sent via EnguiFi LTE Mobile
> On Jun 14, 2016 7:15 PM, "Allen Kitchen" 
> wrote:
>
> > Confirming problems making or receiving calls to phone numbers with a
> > Florida LATA, no matter where those phones actually reside. (In this
> case,
> > SW PA.) Verizon wireless website shows "temporarily unavailable while we
> > upgrade our systems" on selected My Vz pages.
> >
> > ..Allen
> >
> >
> > > On Jun 14, 2016, at 18:34, Kraig Beahn  wrote:
> > >
> > > Looks like Verizon Wireless 4G voice, intermittent data services and
> some
> > > 3g voices services are currently non-functional, specifically in the
> SE,
> > > however, seeing reports nationwide as well.
> > >
> > >
> > > --
> >
>

Re: Verizon Wireless 4G Voice/Data

[Alex Buie]

Large scale outage in FL, primarily affecting customers who have Advanced
Calling (VoLTE) turned on and calling CDMA/PSTN destinations. However it
appears there are many areas whose data connectivity is also affected.

Will pass along any updates I can.

Over 2k calls in the Tech Support queue right now, wish me luck! Time to
jump into the sharks. Haha.

Alex
(VZW tech)

All statements and opinions are my own and do not reflect that of  Verizon
Wireless or its subsidiaries.
On Jun 14, 2016 6:35 PM, "Kraig Beahn"  wrote:

Looks like Verizon Wireless 4G voice, intermittent data services and some
3g voices services are currently non-functional, specifically in the SE,
however, seeing reports nationwide as well.


--

Re: Netflix VPN detection - actual engineer needed

[Alex Buie]

Agreed. I find it silly that as a US citizen on my US-bank-paid-for Netflix
account with US physical address information suddenly cannot watch things
when travelling I legally could if I were standing in another place.

On Fri, Jun 3, 2016 at 4:09 PM, Cryptographrix 
wrote:

> I have a VPN connection at my house. There's no way for them to know the
> difference between me using my home network connection from Hong Kong or my
> home network connection from my house.
>
> Are they going to disable connectivity from everywhere they can detect an
> open VPN port to, also?
>
> If they trust my v4 address, they can use that to establish historical
> reference. Additionally, they can fail over to v4 if they do not trust the
> v6 address.
>
>
>
>
> On Fri, Jun 3, 2016 at 4:05 PM Spencer Ryan  wrote:
>
> > There is no way for Netflix to know the difference between you being in
> NY
> > and using the tunnel, and you living in Hong Kong and using the tunnel.
> >
> >
> > *Spencer Ryan* | Senior Systems Administrator | sr...@arbor.net
> > *Arbor Networks*
> > +1.734.794.5033 (d) | +1.734.846.2053 (m)
> > www.arbornetworks.com
> >
> > On Fri, Jun 3, 2016 at 4:03 PM, Cryptographrix  >
> > wrote:
> >
> >> Same, but until there's a real IPv6 presence in the US, it's really
> >> annoying that they haven't come up with some fix for this.
> >>
> >> I have no plans to turn off IPv6 at home - I actually have many uses for
> >> it, and as much as I dislike the controversy around it, think that
> adoption
> >> needs to be prioritized, not penalized.
> >>
> >> Additionally, I think that discussing content provider control over
> >> regional decisions isn't productive to the conversation, as they didn't
> >> build the banhammer (wouldn't you want to control your own content if
> you
> >> had made content specific to regional laws etc?).
> >>
> >> I.e. - not all shows need to have regional restrictions between New York
> >> (where I live) and California (where my IPv6 /64 says I live).
> >>
> >> I'm able to watch House in the any state in the U.S.? Great - ignore my
> >> intra-US proxy connection.
> >>
> >> My Netflix account randomly tries to connect from Tokyo because I forgot
> >> to shut off my work VPN? Finelet me know and I'll turn *that* off.
> >>
> >>
> >>
> >>
> >>
> >>
> >> On Fri, Jun 3, 2016 at 3:49 PM Spencer Ryan  wrote:
> >>
> >>> I don't blame them for blocking a (effectively) anonymous tunnel
> broker.
> >>> I'm sure their content providers are forcing their hand.
> >>> On Jun 3, 2016 3:46 PM, "Cryptographrix" 
> >>> wrote:
> >>>
>  Netflix needs to figure out a fix for this until ISPs actually provide
>  IPv6
>  natively.
> 
> 
> 
>  On Fri, Jun 3, 2016 at 3:13 PM Blair Trosper  >
>  wrote:
> 
>  > Confirmed that Hurricane Electric's TunnelBroker is now blocked by
>  > Netflix.  Anyone nice people from Netflix perhaps want to take a
>  crack at
>  > this?
>  >
>  >
>  >
>  > On Thu, Jun 2, 2016 at 2:15 PM,  wrote:
>  >
>  > > Had the same problem at my house, but it was caused by the IPv6
>  > connection
>  > > to HE.  Turned of V6 and the device worked.
>  > >
>  > >
>  > > --
>  > >
>  > > Sent with Airmail
>  > >
>  > > On June 1, 2016 at 10:29:03 PM, Matthew Kaufman (
> matt...@matthew.at
>  )
>  > > wrote:
>  > >
>  > > Every device in my house is blocked from Netflix this evening due
> to
>  > > their new "VPN blocker". My house is on my own IP space, and the
>  outside
>  > > of the NAT that the family devices are on is 198.202.199.254,
>  announced
>  > > by AS 11994. A simple ping from Netflix HQ in Los Gatos to my
> house
>  > > should show that I'm no farther away than Santa Cruz, CA as
>  microwaves
>  > > fly.
>  > >
>  > > Unfortunately, when one calls Netflix support to talk about this,
>  the
>  > > only response is to say "call your ISP and have them turn off the
>  VPN
>  > > software they've added to your account". And they absolutely
> refuse
>  to
>  > > escalate. Even if you tell them that you are essentially your own
>  ISP.
>  > >
>  > > So... where's the Netflix network engineer on the list who all of
>  us can
>  > > send these issues to directly?
>  > >
>  > > Matthew Kaufman
>  > >
>  >
> 
> >>>
> >
>

Re: Netflix VPN detection - actual engineer needed

[Alex Buie]

This is not a zero sum solution. Fallback to IP geolocation if more precise
location detection is not available, but if it is, use that. You could even
have a "location score" composite index composed of all the different
locale and historical session data you've accumulated. (cf things like
cloudflare bad-actor detection which uses many heuristics to determine if
you are who you say you are and whether to serve content to you)

On Fri, Jun 3, 2016 at 4:43 PM, Spencer Ryan  wrote:

> And what about the millions of TVs, DVD players and all the other embedded
> devices that don't/can't support any kind of location services?
> On Jun 3, 2016 4:38 PM, "Cryptographrix"  wrote:
>
> > It's much less hard to make an IP connection lie about it's location than
> > it is to make a non-rooted (which is easy to detect) iOS device lie about
> > it's AGPS-derived location.
> >
> > In all cases.
> > On Fri, Jun 3, 2016 at 4:28 PM Naslund, Steve 
> > wrote:
> >
> > > Two problem I see with that.
> > >
> > > 1.  My TV is going to have a hard time figuring out its GPS
> location
> > > inside my living room.
> > > 2.  It's not hard to make a device lie about a GPS position.
> > >
> > > Steven Naslund
> > > Chicago IL
> > >
> > > -Original Message-
> > > From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of
> Cryptographrix
> > > Sent: Friday, June 03, 2016 3:18 PM
> > > To: Robert Jacobs; Spencer Ryan
> > > Cc: North American Network Operators' Group
> > > Subject: Re: Netflix VPN detection - actual engineer needed
> > >
> > > To be honest, I don't care about content providers having control over
> > > regional access controls - it's completely technologically backwards,
> but
> > > they're all about time zones so they can do what they want.
> > >
> > > BUT there are more reliable ways than using an IP to get geographic
> > > location in an era where any website can request your GPS location.
> > >
> > > They have an iOS team that can provide them with *the most
> > authoritatively
> > > precise location of my device* for their Apple TV app.
> > >
> > > My IP should be the last thing they check to determine my location. I
> can
> > > do a million things to tweak that, including things that their proxy
> > > detection will never ever find out about.
> > >
> > >
> > > On Fri, Jun 3, 2016 at 3:55 PM Robert Jacobs 
> > > wrote:
> > >
> > > > Seems everyone continues to forget the content providers are not
> > > > Netflix...They are the Disney, Discovery, NBC, Turner ect... These
> are
> > > > the ones that put clauses and restrictions in their licensing and
> > > > re-broadcast agreements forcing things like Netflix is doing..
> > > >
> > > > Robert Jacobs | Network Director/Architect
> > > >
> > > > Direct:  832-615-7742
> > > > Main:   832-615-8000
> > > > Fax:713-510-1650
> > > >
> > > > 5959 Corporate Dr. Suite 3300; Houston, TX 77036
> > > >
> > > >
> > > >
> > > > A Certified Woman-Owned Business
> > > >
> > > > 24x7x365 Customer  Support: 832-615-8000 | supp...@pslightwave.com
> > > > This electronic message contains information from Phonoscope
> Lightwave
> > > > which may be privileged and confidential. The information is intended
> > > > to be for the use of individual(s) or entity named above. If you are
> > > > not the intended recipient, any disclosure, copying, distribution or
> > > > use of the contents of this information is prohibited. If you have
> > > > received this electronic message in error, please notify me by
> > > > telephone or e-mail immediately.
> > > >
> > > >
> > > >
> > > > -Original Message-
> > > > From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Spencer
> Ryan
> > > > Sent: Friday, June 3, 2016 2:49 PM
> > > > To: Cryptographrix 
> > > > Cc: North American Network Operators' Group 
> > > > Subject: Re: Netflix VPN detection - actual engineer needed
> > > >
> > > > I don't blame them for blocking a (effectively) anonymous tunnel
> > broker.
> > > > I'm sure their content providers are forcing their hand.
> > > > On Jun 3, 2016 3:46 PM, "Cryptographrix" 
> > > wrote:
> > > >
> > > > > Netflix needs to figure out a fix for this until ISPs actually
> > > > > provide
> > > > > IPv6 natively.
> > > > >
> > > > >
> > > > >
> > > > > On Fri, Jun 3, 2016 at 3:13 PM Blair Trosper
> > > > > 
> > > > > wrote:
> > > > >
> > > > > > Confirmed that Hurricane Electric's TunnelBroker is now blocked
> by
> > > > > > Netflix.  Anyone nice people from Netflix perhaps want to take a
> > > > > > crack at this?
> > > > > >
> > > > > >
> > > > > >
> > > > > > On Thu, Jun 2, 2016 at 2:15 PM,  wrote:
> > > > > >
> > > > > > > Had the same problem at my house, but it was caused by the IPv6
> > > > > > connection
> > > > > > > to HE.  Turned of V6 and the device worked.
> > > > > 

Re: Binge On! - get your umbrellas out, stuff's hitting the fan.

[Alex Buie]

Ugh, I had to deal with this almost daily at $large_metered_us_carrier. We
have WiFi hotspots and USB modems and inevitably the customers who usually
use <2GB and have plans based on that usage got slapped with huge Windows
10 overages. Explaining that no, your "geebee" meter isn't broken,
Microsoft just shafted you got so tiring, especially when they don't have
the faintest clue what Windows Update or data or anything of the sort mean,
just barely enough to sign into their AOL account and check the weather.

The bad part is how aggressively Microsoft is downloading it to your HD
even if you don't accept it. (See Windows.BT folder, )

I am "eagerly" awaiting the next wave of update renaming/repushing.

> On Jan 9, 2016 2:57 PM,  wrote:
>>
>> On Sat, 09 Jan 2016 11:12:16 -0600, Mike Hammett said:
>> > Bytes uploaded and\or downloaded. That's all that should matter.
Initiated by
>> > you or not.
>>
>> You want to be the one explaining to your customer that the reason they
>> got charged for 20G of unexpected transfer was because their 3 Windows 8
>> machines each downloaded Windows 10 without telling them?

Re: SMS gateways

[Alex Buie]

Based on a cursory pass of the FB website I can't find any of their
products that have a CDMA modem - so they're definitely incorrect in that
sense. Voice, text, 2G and 3G data are all CDMA on Verizon, unless you're
doing something with SMS over IMS which is only supported with LTE capable
hardware on the Verizon side.

On Thu, Jan 7, 2016 at 4:40 PM, David Hubbard  wrote:

> Scott, I was interested in that as well, it was in my original post.  I’m
> considering that and the SMSEagle; both are from Europe.  I can’t find too
> much on them from a real world war stories perspective, but there has been
> mention of the FoxBox on nanog in years past, so there are some users out
> there.
>
> I am not going the Microtik+cell modem route that Faisal mentioned in his
> reply post because the intent is to tie the SMS alerting into other systems
> using some form of API, and both FoxBox and SMSEagle make that incredibly
> easy by having a simple http interface for sending texts, or a full API if
> you need to do two way.  The nagios plugin (and Zabbix too) are super
> simple since it’s just HTTP POST to send the alerts.
>
> FoxBox claims it will work on Verizon networks because of the 3G support,
> but that doesn’t leave me with a comfortable feeling, so if we buy in, we’d
> probably get accounts from a GSM carrier for it, although I can’t find
> whether or not AT, etc. offer machine accounts, and I would not want to
> pay $50/mo per device just to send random texts.
>
> I did get an off list reply from someone who let me know that our existing
> OpenGear devices (cell+ethernet console servers that run linux) have the
> ability to send SMS using a utility already present in the OS install.
> Since we already have those in every location we’d also be putting an SMS
> gateway, I’m going to investigate if we could put a cgi script or something
> similar on them to accomplish the same goal with no additional equipment.
>
> David
>
>
>
>
> On 1/7/16, 3:34 PM, "NANOG on behalf of Scott Fisher" <
> nanog-boun...@nanog.org on behalf of littlefish...@gmail.com> wrote:
>
> >Does anyone having experience getting this to work on US networks?
> >
> >http://www.smsfoxbox.it/en/foxbox-lx800-gateway-100.html/
> >
> >I am interested on getting this working with our Nagios notifications.
> >
> >On Wed, Jan 6, 2016 at 9:40 PM, John Levine  wrote:
> >>>Thanks for those pointers. The "mega bill" problem is one I have to
> avoid. We used to use ISDN as backup to T1 circuits,
> >>>but had to abandon that after some wayward fail-overs resulted in $5000
> phone bills. I'll check the plan overage terms
> >>>carefully!
> >>
> >> Sounds like an excellent application for a $10/mo prepaid plan on
> >> something like Tracfone.  If disaster strikes and you need a lot of
> >> data one month, you can add extra credit directly from the phone.
> >>
> >
> >
> >
> >--
> >Scott
>

OT: VPS with Routed IP space

[Alex Buie]

Anybody know of or have recommendations for providers of small
VPS-line boxen (or alternative solutions) to serve as GRE endpoints?
(for a small amount of IP addresses, /29 or /28 at most)

I am finding a lot of places that will give you extra IPs on the box
itself (oftentimes out of the provider's own larger unsubnetted
prefix) but I am looking more for a setup with a single IP on the box
and a prefix routed to it.

TIA for your insight.

Alex

(if you or your company can do this, direct solicitations are okay
too. do keep in mind it's just a personal project and I do not have
larger commercial volume at this time)

Re: Cisco CCNA Training

[Alex Buie]

On Mon, Nov 3, 2014 at 9:42 PM, Larry Sheldon larryshel...@cox.net wrote:

 For learning--work beside an Old Hand that knows it and has a good record.

Speaking of that, I've been wondering for a while if there are ever
network engineer apprenticeships, so to speak, or if you guys knew
of any people or companies who do things like that. Based on my
observations, the flat knowledge of everything will take you only so
far; there's a lot of tips, tricks, non-conforming platform
behavior/bugs and unwritten rules/best practices that really only
come with the time of being a net admin. I was envisioning something
like the electrician or plumber-type things where you learn the
technique from a master artisan of the craft.


It seems like a job where the best training *is* that hands on where
you get to see all the big/fun equipment and learn from production
decisions that were made, strange hardware/configuration problems,
etc, but I'd never really seen anyone/company who does these types of
things, and I'd really like to get more experience in the field.
(everybody I look for that wants a network engineer wants a network
engineer, with experience already)

Finally, just more of a general question, what else would you
recommend to someone who wants to get into the network
engineer/operations roles? This could be anything, from books to
classes, to whatever. I do already have my CCNA and A+ from while in
high school, (my networking I-IV prof was adjunct at the local CC, so
we could dual enroll in the local CC and get them to pay for our cert
tests :D) and most of a bachelors in Networking and Systems
Administration from RIT that I'll be finishing up over the next little
bit. I also love radio (K2FUR! :)), so something with cellular really
fascinates me, although any sort of networking/ops/disaster recovery
really is my passion.


Anyway, thanks for your time and potential suggestions!

Alex

Re: Yahoo is now recycling handles

[Alex Buie]

Whoops, my bad. Misparsed that acronym.


On Mon, Sep 9, 2013 at 6:31 AM, valdis.kletni...@vt.edu wrote:

 On Sun, 08 Sep 2013 19:04:14 -0700, Alex Buie said:

  Recent TOR thing with freedomhosting (?) come to mind...

 That one appears to have been the FBI, which is DOJ not DHS. If you have
 evidence to the contrary, feel free to bring it out in the open.

Re: Yahoo is now recycling handles

[Alex Buie]

Recent TOR thing with freedomhosting (?) come to mind...


On Sun, Sep 8, 2013 at 6:08 PM, valdis.kletni...@vt.edu wrote:

 On Sat, 07 Sep 2013 17:34:36 -0600, Keith Medcalf said:

  Sometimes, it is a deliberate feature which is deliberately used to
 attack
  the visitors of a web site.  Prime example is the DHS.

 I must have missed this one.  Citation please?

Re: CableWiFi SSID in Washington DC?

[Alex Buie]

I haven't tried it in DC, but I can confirm that my parents' XFINITY and
grandparents' OO logins both work on the CableWiFi SSIDs in San Francisco,
and friends in DC with XFINITY say theirs work there. I assume it will also
for you.

(cf
http://www.techspot.com/news/48684-five-us-cable-providers-join-forces-to-offer-5-wireless-hotspots.html
)

-alex


On Sun, Aug 25, 2013 at 6:50 PM, Drew Linsalata drew.linsal...@gmail.comwrote:

 What?  Free?  Public?  How can I NOT connect to that?;-)


 On Sun, Aug 25, 2013 at 6:25 PM, chris tknch...@gmail.com wrote:

  Why don't you try a rogue ad hoc FreePublicWifi ? :)
 
 
 

Re: gTLDs opened up

[Alex Buie]

Am I missing something, or is that purporting to be an IPv4 address
beginning with 478?

http://www.open-root.eu/about-open-root/how-to-install-an-open-root-website-69/


On Thu, Jul 11, 2013 at 1:02 PM, Scott Howard sc...@doc.net.au wrote:

 On Wed, Jun 19, 2013 at 12:05 PM, Randy Bush ra...@psg.com wrote:

  AfriNIC put these wonderful people on stage at the African Internet
  Summit.
 

 At least they are good enough to include the facts in their FAQ :

 * 5 - Do business firms use open roots?*
 *Nowadays, no, or they are not identified. *

   Scott

Re: gTLDs opened up

[Alex Buie]

They apparently have different zones (ie, they run 5 different, separate
roots), and you pay a different price depending on how many zones you
want your TLD to be active in. (cf
http://www.open-root.eu/our-rates/list-of-zones-and-pricing/)


On Thu, Jul 11, 2013 at 1:26 PM, Michael Brown mich...@supermathie.netwrote:

  On 13-07-11 04:08 PM, Alex Buie wrote:

 Am I missing something, or is that purporting to be an IPv4 address
 beginning with 478?

  Heh… it seems as though they mistyped '*78.47.115.194*' there.

  7 - How to distinguish between identical TLDs?

  Within the Icann framework, names such as: tube.com, tube.net, tube.org,
 etc. allow in principle to differentiate different domains under the same
 name.

  Within the open root framework, if there are several .tube, one will
 distinguish them according to the root being activated.
 Wait… so 'open root' isn't a single alternative root namespace? It's
 different depending on… near as I can tell which part of the planet you're
 in?

 Or is the product multiple independent roots… are you buying your own '.'
 tree or a 'tld.' tree?

 Clearly, this will work‽

 Is this the future? Visit my site at
 http://fluttershy.turgid.wonka.^78.47.115.194/index.go;

 --
 Michael Brown| The true sysadmin does not adjust his behaviour
 Systems Administrator| to fit the machine.  He adjusts the 
 machinemich...@supermathie.net  | until it behaves properly.  With a hammer,
  | if necessary.  - Brian

Re: Need help in flushing DNS

[Alex Buie]

Anyone have news/explanation about what's happening/happened?


On Wed, Jun 19, 2013 at 10:34 PM, Paul Ferguson fergdawgs...@gmail.comwrote:

 Sure enough:



  ;  DiG 9.7.3  @localhost yelp.com A
  ; (1 server found)
  ;; global options: +cmd
  ;; Got answer:
  ;; -HEADER- opcode: QUERY, status: NOERROR, id: 53267
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

  ;; QUESTION SECTION:
  ;yelp.com. IN A

  ;; ANSWER SECTION:
  yelp.com. 300 IN A 204.11.56.20

  ;; Query time: 143 msec
  ;; SERVER: 127.0.0.1#53(127.0.0.1)
  ;; WHEN: Thu Jun 20 07:33:13 2013
  ;; MSG SIZE  rcvd: 42





 NetRange: 204.11.56.0 - 204.11.59.255
 CIDR: 204.11.56.0/22
 OriginAS: AS40034
 NetName: CONFLUENCE-NETWORKS--TX3
 NetHandle: NET-204-11-56-0-1
 Parent: NET-204-0-0-0-0
 NetType: Direct Allocation
 Comment: Hosted in Austin TX.
 Comment: Abuse :
 Comment: ab...@confluence-networks.com
 Comment: +1-917-386-6118
 RegDate: 2012-09-24
 Updated: 2012-09-24
 Ref: http://whois.arin.net/rest/net/NET-204-11-56-0-1

 OrgName: Confluence Networks Inc
 OrgId: CN
 Address: 3rd Floor, Omar Hodge Building, Wickhams
 Address: Cay I, P.O. Box 362
 City: Road Town
 StateProv: Tortola
 PostalCode: VG1110
 Country: VG
 RegDate: 2011-04-07
 Updated: 2011-07-05
 Ref: http://whois.arin.net/rest/org/CN

 OrgAbuseHandle: ABUSE3065-ARIN
 OrgAbuseName: Abuse Admin
 OrgAbusePhone: +1-917-386-6118
 OrgAbuseEmail: ab...@confluence-networks.com
 OrgAbuseRef: http://whois.arin.net/rest/poc/ABUSE3065-ARIN

 OrgNOCHandle: NOCAD51-ARIN
 OrgNOCName: NOC Admin
 OrgNOCPhone: +1-415-462-7734
 OrgNOCEmail: n...@confluence-networks.com
 OrgNOCRef: http://whois.arin.net/rest/poc/NOCAD51-ARIN

 OrgTechHandle: TECHA29-ARIN
 OrgTechName: Tech Admin
 OrgTechPhone: +1-415-358-0858
 OrgTechEmail: ipad...@confluence-networks.com
 OrgTechRef: http://whois.arin.net/rest/poc/TECHA29-ARIN


 #
 # ARIN WHOIS data and services are subject to the Terms of Use
 # available at: https://www.arin.net/whois_tou.html
 #

 - ferg



 On Wed, Jun 19, 2013 at 10:30 PM, Grant Ridder shortdudey...@gmail.com
 wrote:

  Yelp is evidently also affected
 
  On Wed, Jun 19, 2013 at 10:19 PM, John Levine jo...@iecc.com wrote:
 
  Reaching out to DNS operators around the globe. Linkedin.com has had
 some
  issues with DNS
  and would like DNS operators to flush their DNS. If you see
  www.linkedin.com resolving NS to
  ns1617.ztomy.com or ns2617.ztomy.com then please flush your DNS.
  
  Any other info please reach out to me off-list.
 
  While you're at it, www.usps.com, www.fidelity.com, and other well
  known sites have had DNS poisoning problems.  When I restarted my
  cache, they look OK.
 
 
 



 --
 Fergie, a.k.a. Paul Ferguson
  fergdawgster(at)gmail.com