GTT IPVPN - Vienna - Circuit offline since maintenance.

[Laurent Dumont]

Hi everyone,

We've have a IP-VPN circuit that has been down for the past 15 hours or so
in Vienna. We are receiving the routes from the GTT BGP but we cant reach
the equipment itself. GTT have confirmed a backbone issue but they have
been unresponsive since.

Anyone is aware of issues? Anyone from GTT can reach out off-list to figure
out the status of the incident?

Thanks

Re: Whats going on at Cogent

[Troy Mursch]

Cogent has done well to remediate the compromised MikroTik routers on their
network. 3,000 IPv4 hosts were found on Aug. 25 (
https://twitter.com/bad_packets/status/1033256704941514752) and today, only
a hundred:
https://censys.io/ipv4?q=%28%28%28%22CoinHive.Anonymous%22%29+AND+%28MikroTik%29%29+AND+location.country_code%3A+US%29+AND+autonomous_system.description.raw%3A+%22COGENT-174+-+Cogent+Communications%22;

__

*Troy Mursch*


On Thu, Oct 18, 2018 at 12:05 PM Aaron Gould  wrote:

> I guess those bots have to sit somewhere.  I don’t know that they would be
> in routers as much as they would be in Microsoft Windows… so if that’s what
> you meant, then I see what you mean Michael
>
>
>
> Niels, I like my cogent and telia internet connections… I just recall
> seeing more ddos on cogent then I did on my previous att, and current
> spectrum… telia is showing a good bit of ddos also
>
>
>
> Let’s put it this way, I can thank Cogent and Telia for helping my get
> better in my ddos mitigation skills  J   … there’s a bright side to
> everything huh
>
>
>
> Aaron
>
>
>
>
>
>
>
> *From:* NANOG [mailto:nanog-boun...@nanog.org] *On Behalf Of *Michael
> Crapse
> *Sent:* Tuesday, October 16, 2018 8:37 PM
> *To:* NANOG list
> *Subject:* Re: Whats going on at Cogent
>
>
>
> Or he's saying that cogent has the biggest network of compromised users.
> Usually ipv4 only eyeball networks tend to have the most bots on net.
>
>
>
>
>
> On Tue, 16 Oct 2018 at 19:22, Niels Bakker  wrote:
>
> * aar...@gvtc.com (Aaron1) [Wed 17 Oct 2018, 00:17 CEST]:
> >However Cogent seems to be the dirtiest in regards to DDOS...
> >however Telia might be catching up... in times past when I receive
> >volumetric DDOS, Cogent typically ranks with the highest on my
> >providers ... AT and spectrum seem to be a bit cleaner
>
> So you're saying, Cogent and Telia have the best backbones and
> interconnects and thus deliver the most of your traffic to you,
> even at times of peak utilization?
>
>
> -- Niels.
>
>

RE: Whats going on at Cogent

[Aaron Gould]

I guess those bots have to sit somewhere.  I don’t know that they would be in 
routers as much as they would be in Microsoft Windows… so if that’s what you 
meant, then I see what you mean Michael

 

Niels, I like my cogent and telia internet connections… I just recall seeing 
more ddos on cogent then I did on my previous att, and current spectrum… telia 
is showing a good bit of ddos also 

 

Let’s put it this way, I can thank Cogent and Telia for helping my get better 
in my ddos mitigation skills  J   … there’s a bright side to everything huh

 

Aaron

 

 

 

From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Michael Crapse
Sent: Tuesday, October 16, 2018 8:37 PM
To: NANOG list
Subject: Re: Whats going on at Cogent

 

Or he's saying that cogent has the biggest network of compromised users. 
Usually ipv4 only eyeball networks tend to have the most bots on net.

 

 

On Tue, 16 Oct 2018 at 19:22, Niels Bakker  wrote:

* aar...@gvtc.com (Aaron1) [Wed 17 Oct 2018, 00:17 CEST]:
>However Cogent seems to be the dirtiest in regards to DDOS...
>however Telia might be catching up... in times past when I receive 
>volumetric DDOS, Cogent typically ranks with the highest on my 
>providers ... AT and spectrum seem to be a bit cleaner

So you're saying, Cogent and Telia have the best backbones and 
interconnects and thus deliver the most of your traffic to you, 
even at times of peak utilization?


-- Niels.

Re: verizon wifi calling stopped working

[Josh Luthman]

The box with NAT would be the only thing that hangs onto sessions -
everything expires at 24 hours, so that would be gone through the weekend
(and some work weeks).

I would think it's failing to dial when I lose VZW or doesn't think it
needs to and a reboot of the phone forces it to.  The phone may have an
IPsec tunnel lingering, I suppose.


Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373

On Thu, Oct 18, 2018 at 11:41 AM, Brielle Bruns  wrote:

> IIRC, the Wifi calling stuff works over IPSec from the devices back to a
> concentrator device.
>
> Are you able to look on your network firewall/router/nat device and see if
> you have lingering IPSec sessions hung open, or if there's a network ALG
> that might be playing a part?
>
> I used to have issues like this with T-Mobile and UMA.
>
>
>
> On 10/18/2018 9:28 AM, Josh Luthman wrote:
>
>> If someone from Verizon Wireless specifically for WiFi calling could
>> reach out to me to fix our devices I would appreciate it.  The WiFi calling
>> works just fine when we reboot in the office, but it will never reconnect
>> (ie we leave the office, get 4G, come back).  I've opened 3-4 tickets with
>> no resolution.
>>
>>
>> Josh Luthman
>> Office: 937-552-2340
>> Direct: 937-552-2343
>> 1100 Wayne St
>> Suite 1337
>> Troy, OH 45373
>>
>> On Wed, Oct 17, 2018 at 1:13 PM, Sean Heskett > af...@zirkel.us>> wrote:
>>
>> Hello,
>>
>> Is anyone from verizon wireless on here.  clients across our network
>> started complaining 2 weeks ago that wifi calling stopped working.
>>   below are some pings at traceroutes to wo.vzwwo.com
>>  which fail.  the first set is with our normal
>> DNS servers and the second set is using 8.8.8.8
>>
>> Thanks,
>>
>> *Sean Heskett*
>> *
>> *
>> *ZIRKEL Wireless *
>> */High-Speed Internet/ for NW Colorado*
>> 970-871-8500 x100 - Office
>> 970-846-8065 - mobile
>> 866-903-4628 - Fax
>> Website  | Facebook
>> 
>>
>>
>> MBP-Sean:~ sean$ ping wo.vzwwo.com 
>>
>> PING wo.vzwwo.com  (141.207.177.233): 56 data
>> bytes
>>
>> Request timeout for icmp_seq 0
>>
>> Request timeout for icmp_seq 1
>>
>> Request timeout for icmp_seq 2
>>
>> Request timeout for icmp_seq 3
>>
>> ^C
>>
>> --- wo.vzwwo.com  ping statistics ---
>>
>> 5 packets transmitted, 0 packets received, 100.0% packet loss
>>
>> MBP-Sean:~ sean$ traceroute wo.vzwwo.com 
>>
>> traceroute: Warning: wo.vzwwo.com  has multiple
>> addresses; using 141.207.177.233
>>
>> traceroute to wo.vzwwo.com  (141.207.177.233),
>> 64 hops max, 52 byte packets
>>
>>   1  192.168.12.1 (192.168.12.1)  0.810 ms  0.586 ms  0.571 ms
>>
>>   2 rtr-edge-rht.zirkelwireless.com
>>  (65.117.208.1)  1.547 ms
>>  1.640 ms  1.550 ms
>>
>>   3 65-117-210-178.zirkelwireless.com
>>  (65.117.210.178)  2.494
>> ms  2.412 ms  2.249 ms
>>
>>   4 72-55-193-5.mammothnetworks.com
>>  (72.55.193.5)  5.149 ms
>>  6.783 ms  5.540 ms
>>
>>   5 be5274.rcr21.b006467-6.den01.atlas.cogentco.com
>> 
>> (38.140.187.145)  5.996 ms  5.880 ms  5.756 ms
>>
>>   6 be3414.ccr21.den01.atlas.cogentco.com
>>  (66.28.4.205)  6.072
>> ms
>>
>> be3415.ccr22.den01.atlas.cogentco.com
>>  (154.54.30.241)
>> 6.252 ms
>>
>> be3414.ccr21.den01.atlas.cogentco.com
>>  (66.28.4.205)  6.203
>> ms
>>
>>   7 be3035.ccr21.mci01.atlas.cogentco.com
>>  (154.54.5.90)  17.542
>> ms
>>
>> be3036.ccr22.mci01.atlas.cogentco.com
>>  (154.54.31.90)
>> 17.646 ms
>>
>> be3035.ccr21.mci01.atlas.cogentco.com
>>  (154.54.5.90)  17.038
>> ms
>>
>>   8 be2433.ccr32.dfw01.atlas.cogentco.com
>>  (154.54.3.213)
>>  27.259 ms  27.265 ms
>>
>> be2432.ccr31.dfw01.atlas.cogentco.com
>>  (154.54.3.133)
>> 27.198 ms
>>
>>   9 be2764.ccr41.dfw03.atlas.cogentco.com
>>  (154.54.47.214)
>>  28.024 ms
>>
>> be2763.ccr41.dfw03.atlas.cogentco.com
>>  (154.54.28.74)
>>  27.870 ms  27.955 ms
>>
>> 10 verizon.dfw03.atlas.cogentco.com
>> 

MSN.com blocking some customers

[Josh Luthman]

I have a couple of customers in a /23 (possibly a /24) seemingly random
that aren't able to get to MSN.com - this is http://msn.com not the win32
app or O365 and such.

Would there be someone that can reach out to me offlist to take a look at
this?  I have two verified cases for the last 4 days where every website
works except for http://msn.com

Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373

Re: [OT?] Anyone else been contacted by networkequipment.net after commenting here?

[Saku Ytti]

Hey.

I got the same spam from Brad and actually have Cat trash to offload,
so I iterated SKUs and counts, and his reply:

---
thank you Saku ...

Feel free to hit me up anytime and have a fun week, Brad
---

Dunno what to make of it, that's as far as it went. I expected offer
or 'we can't sell those', I don't know what this response even means.

On Thu, 18 Oct 2018 at 04:14, Brielle Bruns  wrote:
>
> So I decided to respond to a message earlier - was the first time in
> quite a while on the NANOG list.  Like, we're talking maybe 3-6 months
> since my last post?
>
> This afternoon I get an e-mail from Brad Lovelace
>  asking me if I have cisco, juniper, etc to
> sell to his company, claimed I have done business with him before (even
> though I've never sold any equipment to them, nor have we ever
> communicated before - my e-mail archives go back to 1996 or so).
>
> Isn't the first time I've been contacted by a networking gear vendor
> after they 'mysteriously' got my e-mail address (shortly after I posted
> a comment here) as someone who was interested in their wares.
>
> We may have someone scraping e-mail addresses and names from the nanog
> list - don't suppose the mods might be so gracious enough to look at the
> sub list and see if anyone from networkequipment.net is on here?
>
> Sorry in advance to go somewhat OT.
>
> --
> Brielle Bruns
> The Summit Open Source Development Group
> http://www.sosdg.org/ http://www.ahbl.org



-- 
  ++ytti, me fail English? Impossible.

Re: [OT?] Anyone else been contacted by networkequipment.net after commenting here?

[Scott Weeks]

--- br...@2mbit.com wrote:
From: Brielle Bruns 

RE shaming: networkequipment.net

Isn't the first time I've been contacted by a 
networking gear vendor after they 'mysteriously' 
got my e-mail address (shortly after I posted a 
comment here) as someone who was interested in 
their wares.
-


We should get a list of these folks so we can 
look at it when we're buying so we don't 
purchase from these types of companies/people.

scott

Re: verizon wifi calling stopped working

[Brielle Bruns]

IIRC, the Wifi calling stuff works over IPSec from the devices back to a 
concentrator device.


Are you able to look on your network firewall/router/nat device and see 
if you have lingering IPSec sessions hung open, or if there's a network 
ALG that might be playing a part?


I used to have issues like this with T-Mobile and UMA.



On 10/18/2018 9:28 AM, Josh Luthman wrote:
If someone from Verizon Wireless specifically for WiFi calling could 
reach out to me to fix our devices I would appreciate it.  The WiFi 
calling works just fine when we reboot in the office, but it will never 
reconnect (ie we leave the office, get 4G, come back).  I've opened 3-4 
tickets with no resolution.



Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373

On Wed, Oct 17, 2018 at 1:13 PM, Sean Heskett > wrote:


Hello,

Is anyone from verizon wireless on here.  clients across our network
started complaining 2 weeks ago that wifi calling stopped working.
  below are some pings at traceroutes to wo.vzwwo.com
 which fail.  the first set is with our normal
DNS servers and the second set is using 8.8.8.8

Thanks,

*Sean Heskett*
*
*
*ZIRKEL Wireless *
*/High-Speed Internet/ for NW Colorado*
970-871-8500 x100 - Office
970-846-8065 - mobile
866-903-4628 - Fax
Website  | Facebook



MBP-Sean:~ sean$ ping wo.vzwwo.com 

PING wo.vzwwo.com  (141.207.177.233): 56 data bytes

Request timeout for icmp_seq 0

Request timeout for icmp_seq 1

Request timeout for icmp_seq 2

Request timeout for icmp_seq 3

^C

--- wo.vzwwo.com  ping statistics ---

5 packets transmitted, 0 packets received, 100.0% packet loss

MBP-Sean:~ sean$ traceroute wo.vzwwo.com 

traceroute: Warning: wo.vzwwo.com  has multiple
addresses; using 141.207.177.233

traceroute to wo.vzwwo.com  (141.207.177.233),
64 hops max, 52 byte packets

  1  192.168.12.1 (192.168.12.1)  0.810 ms  0.586 ms  0.571 ms

  2 rtr-edge-rht.zirkelwireless.com
 (65.117.208.1)  1.547 ms 
1.640 ms  1.550 ms


  3 65-117-210-178.zirkelwireless.com
 (65.117.210.178)  2.494
ms  2.412 ms  2.249 ms

  4 72-55-193-5.mammothnetworks.com
 (72.55.193.5)  5.149 ms 
6.783 ms  5.540 ms


  5 be5274.rcr21.b006467-6.den01.atlas.cogentco.com

(38.140.187.145)  5.996 ms  5.880 ms  5.756 ms

  6 be3414.ccr21.den01.atlas.cogentco.com
 (66.28.4.205)  6.072 ms

be3415.ccr22.den01.atlas.cogentco.com
 (154.54.30.241)  6.252 ms

be3414.ccr21.den01.atlas.cogentco.com
 (66.28.4.205)  6.203 ms

  7 be3035.ccr21.mci01.atlas.cogentco.com
 (154.54.5.90)  17.542 ms

be3036.ccr22.mci01.atlas.cogentco.com
 (154.54.31.90)  17.646 ms

be3035.ccr21.mci01.atlas.cogentco.com
 (154.54.5.90)  17.038 ms

  8 be2433.ccr32.dfw01.atlas.cogentco.com
 (154.54.3.213) 
27.259 ms  27.265 ms


be2432.ccr31.dfw01.atlas.cogentco.com
 (154.54.3.133)  27.198 ms

  9 be2764.ccr41.dfw03.atlas.cogentco.com
 (154.54.47.214) 
28.024 ms


be2763.ccr41.dfw03.atlas.cogentco.com
 (154.54.28.74) 
27.870 ms  27.955 ms


10 verizon.dfw03.atlas.cogentco.com
 (154.54.12.206)  27.478
ms  48.841 ms  40.085 ms

11 0.et-10-1-0.gw8.chi13.alter.net
 (140.222.236.209)  40.159 ms

0.et-11-3-0.gw8.chi13.alter.net
 (140.222.231.217)  39.879 ms

0.et-10-1-0.gw8.chi13.alter.net
 (140.222.236.209)  40.217 ms

12  * * *

^C

MBP-Sean:~ sean$ ping wo.vzwwo.com 

PING wo.vzwwo.com  (141.207.193.233): 56 data bytes

Request timeout for icmp_seq 0

Request timeout for icmp_seq 1

Request timeout for icmp_seq 2

^C

--- wo.vzwwo.com  ping statistics ---

4 packets transmitted, 0 packets received, 100.0% packet loss

  

Re: verizon wifi calling stopped working

[Josh Luthman]

If someone from Verizon Wireless specifically for WiFi calling could reach
out to me to fix our devices I would appreciate it.  The WiFi calling works
just fine when we reboot in the office, but it will never reconnect (ie we
leave the office, get 4G, come back).  I've opened 3-4 tickets with no
resolution.


Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373

On Wed, Oct 17, 2018 at 1:13 PM, Sean Heskett  wrote:

> Hello,
>
> Is anyone from verizon wireless on here.  clients across our network
> started complaining 2 weeks ago that wifi calling stopped working.  below
> are some pings at traceroutes to wo.vzwwo.com which fail.  the first set
> is with our normal DNS servers and the second set is using 8.8.8.8
>
> Thanks,
>
> *Sean Heskett*
>
> *ZIRKEL Wireless *
> *High-Speed Internet for NW Colorado*
> 970-871-8500 x100 - Office
> 970-846-8065 - mobile
> 866-903-4628 - Fax
> Website  | Facebook
> 
>
>
> MBP-Sean:~ sean$ ping wo.vzwwo.com
>
> PING wo.vzwwo.com (141.207.177.233): 56 data bytes
>
> Request timeout for icmp_seq 0
>
> Request timeout for icmp_seq 1
>
> Request timeout for icmp_seq 2
>
> Request timeout for icmp_seq 3
>
> ^C
>
> --- wo.vzwwo.com ping statistics ---
>
> 5 packets transmitted, 0 packets received, 100.0% packet loss
>
> MBP-Sean:~ sean$ traceroute wo.vzwwo.com
>
> traceroute: Warning: wo.vzwwo.com has multiple addresses; using
> 141.207.177.233
>
> traceroute to wo.vzwwo.com (141.207.177.233), 64 hops max, 52 byte packets
>
>  1  192.168.12.1 (192.168.12.1)  0.810 ms  0.586 ms  0.571 ms
>
>  2  rtr-edge-rht.zirkelwireless.com (65.117.208.1)  1.547 ms  1.640 ms
> 1.550 ms
>
>  3  65-117-210-178.zirkelwireless.com (65.117.210.178)  2.494 ms  2.412
> ms  2.249 ms
>
>  4  72-55-193-5.mammothnetworks.com (72.55.193.5)  5.149 ms  6.783 ms
> 5.540 ms
>
>  5  be5274.rcr21.b006467-6.den01.atlas.cogentco.com (38.140.187.145)
> 5.996 ms  5.880 ms  5.756 ms
>
>  6  be3414.ccr21.den01.atlas.cogentco.com (66.28.4.205)  6.072 ms
>
> be3415.ccr22.den01.atlas.cogentco.com (154.54.30.241)  6.252 ms
>
> be3414.ccr21.den01.atlas.cogentco.com (66.28.4.205)  6.203 ms
>
>  7  be3035.ccr21.mci01.atlas.cogentco.com (154.54.5.90)  17.542 ms
>
> be3036.ccr22.mci01.atlas.cogentco.com (154.54.31.90)  17.646 ms
>
> be3035.ccr21.mci01.atlas.cogentco.com (154.54.5.90)  17.038 ms
>
>  8  be2433.ccr32.dfw01.atlas.cogentco.com (154.54.3.213)  27.259 ms
> 27.265 ms
>
> be2432.ccr31.dfw01.atlas.cogentco.com (154.54.3.133)  27.198 ms
>
>  9  be2764.ccr41.dfw03.atlas.cogentco.com (154.54.47.214)  28.024 ms
>
> be2763.ccr41.dfw03.atlas.cogentco.com (154.54.28.74)  27.870 ms
> 27.955 ms
>
> 10  verizon.dfw03.atlas.cogentco.com (154.54.12.206)  27.478 ms  48.841
> ms  40.085 ms
>
> 11  0.et-10-1-0.gw8.chi13.alter.net (140.222.236.209)  40.159 ms
>
> 0.et-11-3-0.gw8.chi13.alter.net (140.222.231.217)  39.879 ms
>
> 0.et-10-1-0.gw8.chi13.alter.net (140.222.236.209)  40.217 ms
>
> 12  * * *
>
> ^C
>
> MBP-Sean:~ sean$ ping wo.vzwwo.com
>
> PING wo.vzwwo.com (141.207.193.233): 56 data bytes
>
> Request timeout for icmp_seq 0
>
> Request timeout for icmp_seq 1
>
> Request timeout for icmp_seq 2
>
> ^C
>
> --- wo.vzwwo.com ping statistics ---
>
> 4 packets transmitted, 0 packets received, 100.0% packet loss
>
> MBP-Sean:~ sean$ traceroute wo.vzwwo.com
>
> traceroute: Warning: wo.vzwwo.com has multiple addresses; using
> 141.207.193.233
>
> traceroute to wo.vzwwo.com (141.207.193.233), 64 hops max, 52 byte packets
>
>  1  192.168.12.1 (192.168.12.1)  0.896 ms  0.593 ms  0.583 ms
>
>  2  rtr-edge-rht.zirkelwireless.com (65.117.208.1)  1.453 ms  1.312 ms
> 1.181 ms
>
>  3  65-117-210-178.zirkelwireless.com (65.117.210.178)  2.446 ms  2.061
> ms  2.237 ms
>
>  4  72-55-193-5.mammothnetworks.com (72.55.193.5)  5.152 ms  5.121 ms
> 5.124 ms
>
>  5  be5274.rcr21.b006467-6.den01.atlas.cogentco.com (38.140.187.145)
> 5.716 ms  5.748 ms  5.506 ms
>
>  6  be3414.ccr21.den01.atlas.cogentco.com (66.28.4.205)  5.919 ms
>
> be3415.ccr22.den01.atlas.cogentco.com (154.54.30.241)  6.004 ms
>
> be3414.ccr21.den01.atlas.cogentco.com (66.28.4.205)  7.184 ms
>
>  7  be3035.ccr21.mci01.atlas.cogentco.com (154.54.5.90)  17.233 ms
>
> be3036.ccr22.mci01.atlas.cogentco.com (154.54.31.90)  17.397 ms
>
> be3035.ccr21.mci01.atlas.cogentco.com (154.54.5.90)  17.859 ms
>
>  8  be2433.ccr32.dfw01.atlas.cogentco.com (154.54.3.213)  27.428 ms
> 27.476 ms
>
> be2432.ccr31.dfw01.atlas.cogentco.com (154.54.3.133)  27.606 ms
>
>  9  be2764.ccr41.dfw03.atlas.cogentco.com (154.54.47.214)  28.129 ms
>
> be2763.ccr41.dfw03.atlas.cogentco.com (154.54.28.74)  28.009 ms
> 27.497 ms
>
> 10  verizon.dfw03.atlas.cogentco.com (154.54.12.206)  27.402 ms  27.451
> ms  27.445 ms
>
> 11  0.et-11-3-0.gw10.dfw7.alter.net (140.222.228.115)  29.849 ms  29.039
> ms
>
> 0.et-10-1-0.gw10.dfw7.alter.net 

Anyone from Consolidated Communications here?

[Matt Larson]

Could someone in operations from Consolidated Communications in Vermont please 
contact me off list, if possible?

Thanks,

Matt
--
Matt Larson, VP of Research
ICANN Office of the CTO