May 2007 - NANOG - lists.nanog.org

Juniper M10i sufficient for BGP, or go with M20?
by Neal Rauhauser 15 May '07

15 May '07

I don't know much about Juniper but I'm about to learn with a new job. If I'm going to take full routes from a couple of upstreams and have a couple of peers will the M10i (768M max) be enough or is the M20 (2048M max) a better choice. Layout here is such that I'd expect to use a single quad gigabit port ethernet blade in each of a pair of M10i/M20 to achieve redundancy. Is there a pricing resource for this stuff online some where? I do *not* want to hear from any sales people over this comment ...

6 7

OT: 2007 Infrastructure Security Survey
by Danny McPherson 14 May '07

14 May '07

Folks, It's time for the Infrastructure Security Survey again, figured I'd include all of nanog@ in the query for respondents this time around (per request[s]). If you're willing to complete the survey please go here to receive a token (which will be mailed to you with a URL for response input): https://sec-survey.tcb.net/index.php?sid=1 Many of you have seen some of the data from the survey at previous NANOG sessions and ISP Security BOFs. You can find the previous editions of the survey report here (if you'd prefer a non-marketing polished version just drop me a line): http://www.tcb.net/ISP_Security_Report-2H2005.pdf http://www.tcb.net/2006-WISR.pdf If you have any questions, comments or concerns please let me know. Thanks in advance! -danny

1 0

Re: Juniper M10i sufficient for BGP, or go with M20?
by Scott Weeks 14 May '07

14 May '07

--- neal(a)lists.rauhauser.net wrote: : I don't know much about Juniper but I'm about to learn : with a new job. If your experience is like mine, you'll fall in love with the M-series and absolutely despise the E-series (Unisphere) : If I'm going to take full routes from a couple of upstreams : and have a couple of peers will the M10i (768M max) be : enough or is the M20 (2048M max) a better choice. I use the M10i platform for some of my border routers. For example, below, I'm receiving full routes from a couple of upstreams and a partial with 768Meg for a good while now and no problems. RE0> show chassis routing-engine <snip> Routing Engine status: DRAM 768 MB Memory utilization 46 percent Model RE-5.0 RE0> show bgp summary <snip> ASN #Active/Received/Damped ------ ---------------------------- AAA 625/994/0 BBB 152613/214987/0 CCC 62655/215400/0 scott

1 0

Cogent Peering
by Kevin Billings 14 May '07

14 May '07

Can someone tell me if there are any tools on the net we can use to evaluate Cogent as a possible Tier 1 peer. We are looking at adding a 1 or 2 Gig connection to them, but after reading some of the posting I am not sure this would be a wise move. Kevin Billings Sr Network Engineer Spirit Telecom 1500 Hampton St Columbia SC http://www.spirittelecom.com

3 2

Re: Juniper M10i sufficient for BGP, or go with M20?
by Neal Rauhauser 14 May '07

14 May '07

M7i is a very, very attractive lab/spare box, but this company wants carrier class - dual engine M10i are the minimum. John Crain wrote: > You might even consider the m7i they can use the same cards > > JC > > On May 13, 2007, at 3:26 PM, Joe Abley wrote: > >> >> >> On 13-May-2007, at 15:33, Neal Rauhauser wrote: >> >>> I don't know much about Juniper but I'm about to learn with a new >>> job. If I'm going to take full routes from a couple of upstreams and >>> have a couple of peers will the M10i (768M max) be enough or is the >>> M20 (2048M max) a better choice. >> >> I think the quick answer based on just that requirement is "an M10i >> will do fine". I am not aware that Juniper sell a router which will >> struggle with a default configuration to handle a few views of the >> full table, but perhaps my rhetorical spectacles are unreasonably >> rosy right now. >> >>> Layout here is such that I'd expect to use a single quad gigabit >>> port ethernet blade in each of a pair of M10i/M20 to achieve >>> redundancy. >>> >>> Is there a pricing resource for this stuff online some where? I do >>> *not* want to hear from any sales people over this comment ... >> >> Try checking the j-nsp archives at >> <https://puck.nether.net/pipermail/juniper-nsp/>. Good luck with not >> hearing from sales people. >> >> >> Joe >> >

2 1

Re: [urgent assistance] 198.32.0.0/16 - Disappeared...
by Fergie 14 May '07

14 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Joe Abley <jabley(a)ca.afilias.info> wrote: >I'm not sure that 198.32.0.0/16 was ever advertised. EP.NET runs a registry for exchange points and other people that Bill feels like helping out and assigns from that number range; since the /16 covers many varied applications and organisations all over the planet, it seems unlikely that a /16 would do anything useful. > >I have no problems reaching FLAG.EP.NET (198.32.4.13), DOT.EP.NET (198.32.2.10), both of which live in subnets numbered from 198.32.0.0/16 and administered by EP.NET directly. > Hi Joe, Yes, I'm aware that 198.32.0.0/16 is a bunch of swampy /24s, but reachability to name servers at ep.net seems to be available again: route-views.isc.routeviews.org> sho ip bgp 198.32.4.13 BGP routing table entry for 198.32.4.0/24 Paths: (9 available, best #9, table Default-IP-Routing-Table) Not advertised to any peer 6079 3356 1239 4555 198.32.176.126 from 198.32.176.126 (207.172.6.3) Origin IGP, metric 1, localpref 100, valid, external Last update: Sun May 13 22:03:59 2007 14361 7385 1239 4555 198.32.176.10 from 198.32.176.10 (66.36.224.11) Origin IGP, localpref 100, valid, external Last update: Sun May 13 22:03:58 2007 174 1239 4555 198.32.176.131 from 198.32.176.131 (154.54.0.8) Origin IGP, metric 2000, localpref 100, valid, external Community: 174:21000 174:22013 Last update: Sun May 13 22:03:57 2007 2497 1239 4555 198.32.176.24 from 198.32.176.24 (216.98.96.13) Origin IGP, localpref 100, valid, external Last update: Sun May 13 22:03:52 2007 4513 3356 1239 4555 198.32.176.48 from 198.32.176.48 (209.10.12.156) Origin IGP, metric 0, localpref 100, valid, external Last update: Sun May 13 22:03:18 2007 1280 174 1239 4555 198.32.176.3 from 198.32.176.3 (149.20.65.193) Origin IGP, localpref 100, valid, external Community: 1280:380 Last update: Sun May 13 22:03:11 2007 3557 1280 174 1239 4555 198.32.176.4 from 198.32.176.4 (192.5.4.246) Origin IGP, localpref 100, valid, external Community: 3557:380 Last update: Sun May 13 22:03:08 2007 2914 1239 4555 198.32.176.14 from 198.32.176.14 (129.250.0.2) Origin IGP, metric 5, localpref 100, valid, external Community: 2914:420 2914:2000 2914:3000 65504:1239 Last update: Sun May 13 22:03:23 2007 7575 1239 4555 198.32.176.177 from 198.32.176.177 (202.158.192.19) Origin IGP, localpref 100, valid, external, best Community: 7575:1003 7575:2019 7575:6003 Last update: Sun May 13 22:03:11 2007 route-views.isc.routeviews.org> So things are back to nromal (for your definition of 'normal')... Cheers, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.1 (Build 1012) wj8DBQFGR9wdq1pz9mNUZTMRAnZQAKDqoSRqbfb2Syi5CzDg66qvr9U2NQCg4dN8 I3ih5D9WI/htiv8jhJ2BeNw= =9VKx -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

ISP Security BOF @NANOG 40
by Danny McPherson 14 May '07

14 May '07

Folks, Can you please try to slot the ISP security BOF into the first day (Monday) of the agenda? Something has come up and I have to leave late Monday night. Thanks for your consideration! -danny

1 0

Re: [urgent assistance] 198.32.0.0/16 - Disappeared...
by Fergie 14 May '07

14 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Joe Abley <jabley(a)ca.afilias.info> wrote: >I'm not sure that 198.32.0.0/16 was ever advertised. EP.NET runs a registry for exchange points and other people that Bill feels like helping out and assigns from that number range; since the /16 covers many varied applications and organisations all over the planet, it seems unlikely that a /16 would do anything useful. > >I have no problems reaching FLAG.EP.NET (198.32.4.13), DOT.EP.NET (198.32.2.10), both of which live in subnets numbered from 198.32.0.0/16 and administered by EP.NET directly. > Hi Joe, Yes, I'm aware that 198.32.0.0/16 is really only a bunch of swampy /24 allocations -- mea cupla. In any event, flag.ep.net seems to be reachable now, so things are good again: route-views.isc.routeviews.org> sho ip bgp 198.32.4.13 BGP routing table entry for 198.32.4.0/24 Paths: (9 available, best #9, table Default-IP-Routing-Table) Not advertised to any peer 6079 3356 1239 4555 198.32.176.126 from 198.32.176.126 (207.172.6.3) Origin IGP, metric 1, localpref 100, valid, external Last update: Sun May 13 22:03:59 2007 14361 7385 1239 4555 198.32.176.10 from 198.32.176.10 (66.36.224.11) Origin IGP, localpref 100, valid, external Last update: Sun May 13 22:03:58 2007 174 1239 4555 198.32.176.131 from 198.32.176.131 (154.54.0.8) Origin IGP, metric 2000, localpref 100, valid, external Community: 174:21000 174:22013 Last update: Sun May 13 22:03:57 2007 2497 1239 4555 198.32.176.24 from 198.32.176.24 (216.98.96.13) Origin IGP, localpref 100, valid, external Last update: Sun May 13 22:03:52 2007 4513 3356 1239 4555 198.32.176.48 from 198.32.176.48 (209.10.12.156) Origin IGP, metric 0, localpref 100, valid, external Last update: Sun May 13 22:03:18 2007 1280 174 1239 4555 198.32.176.3 from 198.32.176.3 (149.20.65.193) Origin IGP, localpref 100, valid, external Community: 1280:380 Last update: Sun May 13 22:03:11 2007 3557 1280 174 1239 4555 198.32.176.4 from 198.32.176.4 (192.5.4.246) Origin IGP, localpref 100, valid, external Community: 3557:380 Last update: Sun May 13 22:03:08 2007 2914 1239 4555 198.32.176.14 from 198.32.176.14 (129.250.0.2) Origin IGP, metric 5, localpref 100, valid, external Community: 2914:420 2914:2000 2914:3000 65504:1239 Last update: Sun May 13 22:03:23 2007 7575 1239 4555 198.32.176.177 from 198.32.176.177 (202.158.192.19) Origin IGP, localpref 100, valid, external, best Community: 7575:1003 7575:2019 7575:6003 Last update: Sun May 13 22:03:11 2007 route-views.isc.routeviews.org> Thanks, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.1 (Build 1012) wj8DBQFGR9M4q1pz9mNUZTMRApQ1AJ0QQwy8+VG4oG5e/sGGNnyKTEFNtwCaAlqb fFEqU5qhPuxmeVOV/qgpwCc= =GdQd -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: [urgent assistance] 198.32.0.0/16 - Disappeared...
by Fergie 14 May '07

14 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just as a follow-up to this: The situation still exists: 198.32.0.0/16 is still missing in action in the routing system, and more importantly, so are EP.net's DNS servers. :-( So, if Bill magically re-appears, or if anyone else can provide any insight or assistance, please contact ops-staff(a)mail-abuse.org. Thanks, - - ferg - -- "Fergie" <fergdawg(a)netzero.net> wrote: Paging Bill Manning... Unfortunately, we've tried to reach Bill, as well as other folks at EP.NET to no avail, and this is impacting us quite negatively. [snip] Not available in any routing tables I have access to or any of the looking glasses from http://www.nanog.org/lookingglass.html. this is significant because any in-addr blocks that are authoritative @ flag.ep.net and dot.ep.net will now suffer from reverse name resolution issues. - - From ATT route server: route-server>sh ip bgp 198.32.4.13 % Network not in table - - From CerfNET route server: route-server>sh ip bgp 198.32.4.13 % Network not in table Allstream Toronto: route-server.east>sh ip bgp 198.32.4.13 % Network not in table This has been a problem since yesterday evening. [snip] FYI, some of our address space has been sub-allocated via EP.net and relies on it's reachability: [DOMAIN whois information for EP.NET ] Domain Name: EP.NET Namespace: ICANN Unsponsored Generic TLD - http://www.icann.org TLD Info: See IANA Whois - http://www.iana.org/root-whois/net.htm Registry: VeriSign, Inc. - http://www.verisign-grs.com Registrar: NETWORK SOLUTIONS, LLC. - http://www.networksolutions.com Whois Server: whois.networksolutions.com Name Server[whois+dns with ip] DOT.EP.NET 198.32.2.10 Name Server[from whois+dns, whois ip]: DOT.EP.NET 2001:478:6:0:230:48FF:FE22:6A29 Name Server[whois+dns with ip] FLAG.EP.NET 198.32.4.13 Updated Date: 11-Jan-2007 Creation Date: 09-Dec-1994 Expiration Date: 08-Dec-2012 Status: clientTransferProhibited [whois.networksolutions.com] Please contact me off-list is you have any inisght into this. Thanks, - - ferg [snip] -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.1 (Build 1012) wj8DBQFGRV/jq1pz9mNUZTMRAjw/AJ0eV+YKWd1L1ze/eTStl+JaJC8s5QCfZhh0 Rf/sutXg5Mj9jK0IZA571do= =8UzZ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

Best practices for abuse@ mailbox and network abuse complaint handling?
by K K 13 May '07

13 May '07

Can anybody point me at best practices for monitoring and responding to abuse complaints, and good solutions for accepting complaints about network abuse? Any recommended outsourced services for processing abuse complaints? My interest in this is to more effectively respond to complaints about "bad" network traffic and abuse originating from IP addresses allocated to my employer and to the not-for-profit ISP I help run. (Two similar needs, two very different budgets). My employer has multiple Internet-connected networks, several IP allocations, and several hundred active domains. Currently abuse@* is sporadically monitored by a Messaging team, and any complaints which seem relevant to the Network or Security groups are forwarded to the appropriate internal contact. This is inefficient and untimely. Probably 98% of the mailbox is from are spammers who've harvested or randomly targeted abuse@ addresses for male enhancement, maybe 1.99% are email abuse complaints from customers who subscribed to company-run mailing lists and then forgot about it (I've worked hard to educate management on responsible mass mailing). But every once in a while there is a legitimate network-related "incident", and my team does need to see those messages in a timely manner. How do other network operators address the need for timely notification of network abuse? Some people are clueful enough to pull up the ARIN records and contact us by phone, but I don't want to depend on the victim of an attack sourced from our network being bright and persistent. Thanks, Kevin Kadow

11 16