[175131] in North American Network Operators' Group
RE: another cogent oddity
daemon@ATHENA.MIT.EDU (John van Oppen)
Thu Oct 9 13:47:59 2014
X-Original-To: nanog@nanog.org
From: John van Oppen <jvanoppen@spectrumnet.us>
To: ryanL <ryan.landry@gmail.com>, North American Network Operators Group
<nanog@nanog.org>
Date: Thu, 9 Oct 2014 17:39:18 +0000
In-Reply-To: <CAK_-TSbAKotBKgaUTMJHXOzdLM1bz0LdMjyopQozhbYQp0ChZQ@mail.gmail.com>
Errors-To: nanog-bounces@nanog.org
cogent is well known not to filter in any useful way... in terms of sources=
that should not be there, we see the same thing (or did the last time I lo=
oked).=0A=
=0A=
=0A=
=0A=
John van Oppen=0A=
Spectrum Networks=0A=
Direct: 206-973-8302=0A=
Main: 206-973-8300=0A=
=0A=
________________________________________=0A=
From: NANOG [nanog-bounces+jvanoppen=3Dspectrumnet.us@nanog.org] on behalf =
of ryanL [ryan.landry@gmail.com]=0A=
Sent: Thursday, October 09, 2014 10:35 AM=0A=
To: North American Network Operators Group=0A=
Subject: another cogent oddity=0A=
=0A=
you may remember me from the weird cogent route retention / loop=0A=
problem i brought up last week. it remains unsolved by cogent to date.=0A=
=0A=
also remembering i'm a relatively new cogent customer, i recently=0A=
noticed some packets floating into my network that had cos and ipp=0A=
markings on them. i figured i'd try to find where they were coming=0A=
from, so i crafted up something like this and placed it inbound on my=0A=
two transits (cogent and xo), excluding network control markings.=0A=
=0A=
from {=0A=
dscp [ af11 af12 af13 af21 af22 af23 af31 af32 af33 af41 af42=0A=
af43 cs1 cs2 cs3 cs4 cs5 ef ];=0A=
precedence [ 1 2 3 4 5 ];=0A=
}=0A=
=0A=
all of it is coming in from cogent:=0A=
=0A=
COGENT-NOT-BE -> 4217788987=0A=
XO-NOT-BE -> 0=0A=
=0A=
i shifted all traffic to XO just to make sure. the XO counter doesn't budge=
.=0A=
=0A=
seems like one transit is remarking everything to best effort before=0A=
sending to me (which is preferred), and the other is not.=0A=
=0A=
am i odd to think that this is... odd?=0A=
=0A=
i also get a remarkable amount of hits against these destinations=0A=
coming in on the cogent side, whereas i get none on the XO side.=0A=
=0A=
show policy-options prefix-list PUBLIC-BAD-NETS=0A=
10.0.0.0/8;=0A=
169.254.0.0/16;=0A=
172.16.0.0/12;=0A=
192.168.0.0/16;=0A=
224.0.0.0/4;=0A=
=0A=
ryan=0A=
