NANOG 87 Agenda

Full Abstract

Description: Exploration of the history of the Domain Number System (DNS), the original design, how it works, and its evolution. 

The Domain Name System (DNS) is a distributed database that maps domain names to IP addresses and is a core piece of Internet functionality. This 1-day seminar will kick off our 87th community-wide conference in Atlanta, GA. 

Learn about the DNS via discussion and real-world, real-time, hands-on investigation. The DNS is a critical part of Internet functionality. It is quite an old protocol, with many, many modifications made over the years. We'll talk about the original designs and current implementations while seeing all this in action using freely available tools, mostly Dig.

This class is free. Registration is required to attend.

https://www.nanog.org/events/nanog-87-dns-fundamentals/registration/registrant

Full Abstract

The Members Meeting agenda and link to the webinar details are available for Members only. You MUST be signed in with your NANOG Profile account to view the Members Meeting Agenda page. Please bring (or share via email) any questions you would like to discuss at the meeting.

Full Abstract

In this presentation, we will provide a synopsis of the criminal DDoS-for-hire ecosystem; examine details of a simultaneous, internationally-orchestrated takedown of multiple DDoS-for-hire services in December of 2022; and assess the real-world impact of this action via statistical analysis of global DDoS attack activity.

Full Abstract

Sophisticated attackers, typically nation-state actors, have begun to leverage access to key DNS infrastructure to then hijack target organization domains. Target organizations now not only
include government domains, but also large network operators. Most concerningly, these domain hijacks bypass traditional DNS protections, and are imperceptible to the users. In this talk, we describe our methodology for identifying domain hijacks in the wild, and our results from using this methodology to identify a range of victims demonstrating that domain hijacks have evolved into a favored intrusion tactic. Finally, we also discuss what these findings mean for organizations looking to secure their infrastructure.

Full Abstract

There are many platforms out there to help you automate your deployments and configurations of your network devices out there. This panel will cover some of the major ones such as Ansible, Puppet, Salt, Kubernetes, Nornir, Netmiko, Netpalm

We shall focus on:
1) When to start automating
2) Compare and contrast
— Matt Griswold – Ansible
— Mau Rojas – Kubernetes
— Rick – Puppet & Salt
— Thomas Donnelly – Nornir/Netmiko
— Nick Bogle - Netpalm / Rest Abstraction Layer
3) Also discuss languages:
— Kubernetes = Go
— Helm = go template
— Ansible = python
— The decisions you make now will gate evolution later
4) Source of Truth / Getting Started -> WHAT are you automating, touch on everyone's use cases

Full Abstract

ARIN is a nonprofit, member-based organization that administers IP addresses & ASNs in support of the operation and growth of the Internet. Hear from ARIN’s Chief Customer Officer on where the organization sits with IPv6 growth, IPv4 Waitlist and Transfer stats, along with other notable updates across our programs and services.

Full Abstract

Network Engineering Jeopardy will consist of three teams competing for all the glory!

Full Abstract

We analyze the properties of 712 prefixes that appeared in Spamhaus’
Don’t Route Or Peer (DROP) list over a nearly three-year period
from June 2019 to March 2022. We show that attackers are subverting multiple defenses against malicious use of address space,
including creating fraudulent Internet Routing Registry records for
prefixes shortly before using them. Other attackers disguised their
activities by announcing routes with spoofed origin ASes consistent
with historic route announcements, and in one case, with the ASN
in a Route Origin Authorization. We quantify the substantial and
actively-exploited attack surface in unrouted address space, which
warrants reconsideration of RPKI eligibility restrictions by RIRs,
and reconsideration of AS0 policies by both operators and RIRs.

Full Abstract

ARIN President and CEO John Curran will provide a brief summary of global developments in the Internet Number Registry System, including ongoing developments in AFRINIC governance.

Full Abstract

We not only connect LANs together, we also connect with each through venues such as NANOG meetings and mailing lists. Increasingly we also utilize a number of more modern social media platforms to connect and interact with one another. One such platform that has recently attracted a great deal of interest is the "fediverse" and specifically the micro-blogging software better known as Mastodon. This lightning talk provides a quick introduction to Mastodon, netop-specific suggestions on how to get started, and a nudge to to consider joining others there.

Full Abstract

Address:
215 Peachtree Street Northeast
Atlanta, GA 30303
(404) 688-7625

*NANOG Badge required for entry

Full Abstract

The idea is to share the impact and the records that the FIFA World Cup 2022 generated over the Internet, and also the users. Warning NANOG that the next one is going to be in USA, Canada and Mexico, so better get ready for new records.

Showing how capacity on the customers or peers should be ready for events with this characteristic to let the users use the internet without bad experiences.

Full Abstract

Pluggable Digital Coherent Optics (DCO) is a breakthrough technology that allows routers to integrate state of the art coherent DWDM interfaces without the need for specialized hardware. This is possible thanks to the incredible power efficiencies and compactness of recent DCO implementations over QSFP56-DD and other transceivers that can be deployed directly into standard 400GE host ports. Replacing traditional DWDM transponders by pluggable DCO significantly lowers the cost of building high-speed networks with massive capacity and extended reaches. Even greater gains in cost efficiencies are possible with Routed Optical Networking, a novel network architecture that couples DCO with innovations in IP/MPLS, management and automation to build a fully converged and programmable network architecture optimized at the packet switching layer.

As the industry embraces DCO, adoption increases and new use cases are explored, questions about how to manage this technology when deployed in the routers emerge. What are the new optical parameters that DCO expose to the router? How to leverage them for pro-active fiber and DWDM performance management? How to give visibility of that data to fellow transport operations teams and data lakes without exposing the IP network details?

This session will present DCO technology covering its basic concepts, the new optical signal monitoring capabilities enabled by its built-in the Digital Signal Processors (DSPs) and transport encapsulations, and how they can be used to enhance IP networks and their operations. It will also discuss the state of the industry standards and open networking initiatives that can be leveraged to build a multi-vendor ecosystem.

Full Abstract

The need to reliably monitor today’s ever-growing networks in the WAN, edge, and data center domains is now more critical than ever. The industry relies largely on SNMP to monitor present networks, a protocol that falls short when used to monitor large networks let alone the increasingly complex networks of the future.

Openconfig's gRPC-based streaming telemetry protocol, gNMI is considered by many to be the prime successor to SNMP. It packs features to build modern monitoring stacks, such as a push-based telemetry model, reliable transport, default TLS security, data model-based access to monitored data leaves, and exceptional performance on the wire.

This tutorial introduces gNMIc, an open-source software suite which blends together a feature-rich gNMI CLI client and a performant, highly-available telemetry collector. Focusing on gNMI-based streaming telemetry, gNMIc sets itself apart from other general-purpose collectors with unique features including high availability and clustering of collector instances, rich data processing pipelines, sheer support for various outputs for metrics, and embedded caching, to name a few.

By the end of this session, participants will understand how gNMIc can be used to configure network devices, and building a modern open-source telemetry stack comprised of a collector, time-series DB, and visualization layer.

Full Abstract

Recent research studies highlighted a phenomenon known as “BGP zombies", which refers to active RIB entries for prefixes that have been withdrawn, but still persist in BGP routing tables.
The research has investigated the prevalence and characteristics of BGP zombies, with a focus on data collected from RIPE RIS, and found that ASes announcing a high number of prefixes, and also prefixes with a higher degree of "noise" (e.g. BGP beacons), are more likely to have BGP zombies.
In this presentation, we aim to raise awareness to the BGP zombie phenomenon and extend previous work by investigating:

• the identification of BGP zombies using a BGP monitoring platform other than RIPE RIS (namely the Code BGP Platform) will yield comparable results to those obtained from RIS Live
• whether announcing a limited number of new prefixes, originated from a new AS not announcing other prefixes, will still result in BGP zombies

Our results reveal that BGP zombies are a pervasive problem in the Internet routing system, regardless of the monitoring platform and prefix announcement characteristics utilized. We advocate that monitoring platforms should develop mechanisms for accurately identifying and labeling BGP routes as zombies, as well as implementing strategies for promptly alerting users to their presence in order to mitigate the potential negative effects they may have on network stability and performance.

Full Abstract

DE-CIX has been working on the introduction of EVPN on its peering platform since the beginning of 2022. Considering the increasing number of participants, especially in New York and Frankfurt, the introduction of EVPN, including ProxyARP/ND, is required to get the exponentially growing broadcast/multicast traffic in the Peering LANs under control and to reduce the load on customer routers. Additionally, further security features based on a ProxyARP/ND agent according to RFC 9161 are activated and the protocol stack of the DE-CIX global network will be expanded to include RSVP-TE and sBFD. In this presentation, we will present the course of the project, benefits, and side effects for DE-CIX customers explained in technical detail.

Full Abstract

Synopsis: Measurement Lab and Cloudflare want to empower network operators with free and open access to data that represents their user’s experience. Our presentation will:

1. Discuss how end-users define “good Internet” and how AIMScore defines the answer
2. Announce the free and open availability of AIMScore data that enable network operators to get actionable insights from CloudFlare and Measurement Lab’s speed tests
3.Solicit feedback from NANOG community about access and usability of the data and discuss future milestones

Running a distributed network is a challenge by itself, but ensuring that users are having a good experience on that network adds a layer of complexity that can make anyone’s head spin. It’s hard enough ensuring that users can reach the Internet through your network, but ensuring that they can access a myriad of services and applications at peak performance for each is orders of magnitude harder, especially when each application has a different concept of what peak performance looks like. To put it another way: it’s hard enough to know if every user on your network can access Discord, Netflix, and Dota reliably, but it’s even harder to know if every user on your network has a good experience accessing those services because each of those have completely different understandings of what it means to have a good experience.

The way we use the Internet on top of a network is ever changing, and the success criteria for the ways we use the Internet is also constantly changing. New metrics like responsiveness are being developed and rolled out to help track these new criteria. Being able to make sure that users have a good experience on your network no matter what is critical for customer retention and cost efficiency. If people have a good experience, they’ll keep using your network. And if people have a good experience, they won’t call support and try and get things fixed.

We are proposing a framework and data set that will not only give you insight into what applications consider success, but ways to programmatically detect when users in your network are experiencing degradations from success: Aggregated Internet Measurement

Full Abstract

We're going to launch a survey to collect information on the state of network automation in 2023. Anonymized and analyzed results of the survey response will be provided to all participants, as well as presented at one or more major networking conference(s). My hope is that we will be accepted to present the results at NANOG 88.

I intend to use my 10 minutes to describe the trends in networking and network automation that we are seeing, the different types of automation in the wild today, and primarily to introduce the survey to the audience in hopes of increasing participation and thus providing better results for all.

You can find the survey here: https://docs.google.com/forms/d/e/1FAIpQLSc5J_i2rkcpgkvI83Vj3DRVsau5jZ1u99M7p_ecWOgnW_9XHg/viewform?usp=sf_link