Skip to content

Instantly share code, notes, and snippets.

View tonusoo's full-sized avatar

Martin Tonusoo tonusoo

16 followers · 3 following
  • Tallinn, Estonia
View GitHub Profile
@tonusoo
tonusoo / napt-44.conf
Created April 28, 2026 15:22
Port Address Translation with MS-DPC || j-nsp mailing list thread: https://puck.nether.net/pipermail/juniper-nsp/2026-April/039361.html
root@lab-mx960> show configuration services
service-set pat-service-set {
nat-rules rule-napt-44;
interface-service {
/* first PIC of MS-DPC in slot 9; Multiservices MIC should use "ms" interface instead of "sp" interface */
service-interface sp-9/0/0;
}
}
nat {
pool napt-pool {
@tonusoo
tonusoo / aspa_logic.py
Last active April 14, 2026 11:44
A validation script for the "ASPA-based AS Path Verification Examples" document referenced in https://datatracker.ietf.org/doc/draft-ietf-sidrops-aspa-verification/ based on https://github.com/QratorLabs/ASPA
#!/usr/bin/env python3
# https://github.com/QratorLabs/ASPA
# https://github.com/ksriram25/IETF/blob/main/ASPA_path_verification_examples.pdf
import sys
import logging
DEBUG_MODE = True
@tonusoo
tonusoo / ROA-ASPA-openssl.txt
Created March 30, 2026 14:21
Extracting and decoding the ASN.1 DER payloads of RPKI CMS signed objects using OpenSSL
martin@validator-2:~$ # routinator dump --output /tmp/routinator-dump/
martin@validator-2:~$ # "<- ..." comments below are manually added
martin@validator-2:~$ openssl cms -verify -noverify -inform DER -in /tmp/routinator-dump/store/rrdp.arin.net/rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/69fd0156-bb1f-48b6-bf32-c9492286f195/de4a1dfa-8867-4aef-a2e6-131e93add9f9/5486ade0-fc94-3e8d-89dc-e03fab376ea9.roa -outform DER | openssl asn1parse -inform DER -i -dump
CMS Verification successful
0:d=0 hl=2 l= 28 cons: SEQUENCE
2:d=1 hl=2 l= 3 prim: INTEGER :02571B <- ASN 153371 (RFC 6482 ASID)
7:d=1 hl=2 l= 21 cons: SEQUENCE
9:d=2 hl=2 l= 19 cons: SEQUENCE
11:d=3 hl=2 l= 2 prim: OCTET STRING
0000 - 00 02 .. <- v6 addr family (RFC 6482 addressFamily)
@tonusoo
tonusoo / Junos-25-4-RTBH-routes-validation.conf
Last active March 18, 2026 12:17
RTBH prefixes validation on Junos || PoC setup || NANOG mailing list thread: https://lists.nanog.org/archives/list/nanog@lists.nanog.org/thread/O5XX6BHOSMINX4HKT2SMVOI66SMYXFOR/
root@vjr-17> show configuration routing-options bmp
/* Rotonda */
station BMP-feed-for-RTBH-1 {
/* if the session breaks, then the router tries to reestablish it every 30 seconds */
connection-mode active;
/* Route Monitoring messages are sent only for peers defined under specific BGP groups */
route-monitoring {
none;
}
station-address 10.10.8.3;
@tonusoo
tonusoo / Juniper_MX_host-outbound_traffic.png
Last active February 2, 2026 08:03
Host-outbound TCP SYN captured on internal bridge connecting the control- and forwarding-plane on MX-series router || discussion on Packet Pushers Slack group
Juniper_MX_host-outbound_traffic.png
@tonusoo
tonusoo / check_logs.bash
Created November 12, 2025 12:35
logtail functionality for journalctl versions older than 242 not supporting the "--cursor-file" option
#!/usr/bin/env bash
get_journal_logs() {
log_type="$1"
if [[ "$log_type" == "system" ]]; then
args+=( "--dmesg" )
@tonusoo
tonusoo / bgp-vortex-lab.jpg
Last active October 23, 2025 15:34
NANOG mailing list thread: https://lists.nanog.org/archives/list/nanog@lists.nanog.org/thread/SU76M47AOL5742T6Q5OW2DBMRNSYU42Y/
bgp-vortex-lab.jpg
@tonusoo
tonusoo / packet_capture_in_g-bird1.txt
Created September 17, 2025 08:47
Junos Non-Stop Active Routing and Fault-Tolerant TCP/IP test setup; https://cseweb.ucsd.edu/~marzullo/pubs/fttcp2.pdf
root@bird1:~# # acknowledgements to the client(10.10.10.1) are withheld until the hot backup has received the corresponding data
root@bird1:~# tshark -c 4 -i enp7s0 -f 'tcp and port 179'
Running as user "root" and group "root". This could be dangerous.
Capturing on 'enp7s0'
1 0.000000000 10.10.10.1 → 10.10.10.0 BGP 85 KEEPALIVE Message
2 0.601193559 10.10.10.0 → 10.10.10.1 TCP 66 179 → 60153 [ACK] Seq=1 Ack=20 Win=16384 Len=0 TSval=2273170037 TSecr=1268402651
3 4.135022182 10.10.10.0 → 10.10.10.1 BGP 85 KEEPALIVE Message
4 4.135067259 10.10.10.1 → 10.10.10.0 TCP 66 60153 → 179 [ACK] Seq=20 Ack=20 Win=126 Len=0 TSval=1268406786 TSecr=2273173570
4 packets captured
root@bird1:~#
@tonusoo
tonusoo / shutdown-bgp-session.bash
Last active September 7, 2025 20:09
NANOG mailing list thread: https://lists.nanog.org/archives/list/nanog@lists.nanog.org/thread/CS25Q74D72EUV3MVHOMT3GNZ5HGRZWGV/
#!/usr/bin/env bash
# Configures Juniper router to inject a 0x0b control character to
# "Shutdown Communication" field(RFC 9003) of a BGP cease NOTIFICATION message.
#
# Usage example:
# ./shutdown-bgp-session.bash | ssh root@192.168.103.20 -p 830 -s netconf
vertical_tab=$'\v'
@tonusoo
tonusoo / route.patch
Last active August 8, 2025 12:50
disables fallback to less specific routes explained in RFC 4191 3.2 and 3.6; patch --ignore-whitespace net/ipv6/route.c route.patch; tested on Linux 6.12.38
--- net/ipv6/route.c~ 2025-08-08 13:44:04.928000000 +0300
+++ net/ipv6/route.c 2025-08-08 13:48:01.448000000 +0300
@@ -2221,24 +2221,13 @@
int fib6_table_lookup(struct net *net, struct fib6_table *table, int oif,
struct flowi6 *fl6, struct fib6_result *res, int strict)
{
- struct fib6_node *fn, *saved_fn;
+ struct fib6_node *fn;
fn = fib6_node_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);