May 2009 - NANOG - lists.nanog.org

Re: two interfaces one subnet
by William Pitcock 12 May '09

12 May '09

Completely off topic but, does this subject make anyone else immediately think of 2girls1cup? I blame the internets for my making this correlation... ------Original Message------ From: Martin Hannigan To: Patrick W. Gilmore Cc: NANOG list Subject: Re: two interfaces one subnet Sent: May 12, 2009 11:06 AM On Tue, May 12, 2009 at 12:12 AM, Patrick W. Gilmore <patrick(a)ianai.net>wrote: > On May 11, 2009, at 11:43 PM, Ben Scott wrote: > >> On Mon, May 11, 2009 at 11:01 PM, Patrick W. Gilmore <patrick(a)ianai.net> >> wrote: >> > > Do you even read your own posts? Specifically: >>> >>> On May 11, 2009, at 5:40 PM, Ben Scott wrote: >>> >>> Either way, if >>>> the packet *from* X was addressed *to* B but the response comes back >>>> from *A*, then host X is going to drop the packet as >>>> invalid/irrelevant/etc. >>>> >>> >>> The receiving host X does not care (or even know) if A and B are in the >>> same >>> prefix. >>> >> >> Look again. A and B are *IP addresses*, not hosts. >> > > Sometimes people agree with me, sometimes they don't, and sometimes I agree > with them. But I've yet to have someone claim to be arguing against me > while proving my point. > > Anyone else want to unconfused Ben? I obviously cannot. Really nothing clever about this at all in application or practicality. host> cat /etc/services | grep nntp nntp 119/tcp readnews untp # USENET News Transfer Protocol host1> cat /etc/hosts | grep news 127.0.0.1 localhost 192.168.0.100 clue-store 192.168.0.100 news-out 192.168.0.101 news-in If this didn't work, you'd suppose that virtual machines and IP aliasing wouldn't work either. Unless routes facing the world on the device are "tweaked", this should work fine and be reliable (if implemented cluefully). Am I not getting it? Best, -M< -- Martin Hannigan martin(a)theicelandguy.com p: +16178216079 Power, Network, and Costs Consulting for Iceland Datacenters and Occupants -- William Pitcock SystemInPlace - Simple Hosting Solutions 1-866-519-6149

1 0

10-GigE for servers
by Jason Shoemaker 12 May '09

12 May '09

My company is looking for ways to improve throughput for data transfers between individual servers. We’re exploring the creation of Etherchannels using multiple server NICs, but Etherchannel seems to have the limitation of not supporting per-packet load-balancing, therefore limiting traffic between two individual hosts to 1 Gig. In most of my research, I’ve seen 10-GigE used for traffic aggregation and for the “unified fabric” solution that Cisco and others are pushing. I’m interested in knowing if any of you have attempted to implement 10-GigE at the host level to improve network throughput between individual servers and what your experience was in doing so. Thanks in advance, Jason

9 8

Can Interdomain routing[BGP] self recover from prefix hijack?
by Akmal Shahbaz 12 May '09

12 May '09

HiSolutions like BGPmon.net,Cyclops,etc are doing a very good job of alerting about the prefix hijack/configuration erros/experiments gonig on/etc.But i would like to ask "Alerting the victim is the best we can do after detecting such incidents" or what else we can do?What do you think about "BGP ability to Self recover form prefix hijacks or anomalies?" Is it possible?How?What do you think about "Self healing as the property of Internet?"Thank you.Akmal KhanMS-PhD StudentMMLab(a)SNU.Kr --- On Tue, 5/12/09, nanog-request(a)nanog.org <nanog-request(a)nanog.org> wrote: From: nanog-request(a)nanog.org <nanog-request(a)nanog.org> Subject: NANOG Digest, Vol 16, Issue 43 To: nanog(a)nanog.org Date: Tuesday, May 12, 2009, 1:04 AM Send NANOG mailing list submissions to nanog(a)nanog.org To subscribe or unsubscribe via the World Wide Web, visit http://mailman.nanog.org/mailman/listinfo/nanog or, via email, send a message with subject or body 'help' to nanog-request(a)nanog.org You can reach the person managing the list at nanog-owner(a)nanog.org When replying, please edit your Subject line so it is more specific than "Re: Contents of NANOG digest..." Today's Topics: 1. Re: two interfaces one subnet (David Devereaux-Weber) 2. Re: two interfaces one subnet (Nathan Ward) 3. Re: two interfaces one subnet (Arnold Nipper) 4. Re: two interfaces one subnet (Patrick W. Gilmore) 5. Re: two interfaces one subnet (Patrick W. Gilmore) 6. RE: two interfaces one subnet (Holmes,David A) 7. Re: two interfaces one subnet (Arnold Nipper) 8. Re: two interfaces one subnet (Patrick W. Gilmore) 9. Re: two interfaces one subnet (Chris Adams) 10. Re: two interfaces one subnet (Kevin Oberman) 11. Re: two interfaces one subnet (Ben Scott) ---------------------------------------------------------------------- Message: 1 Date: Mon, 11 May 2009 17:08:45 -0500 From: David Devereaux-Weber <ddevereauxweber(a)gmail.com> Subject: Re: two interfaces one subnet To: Hector Herrera <hectorherrera(a)gmail.com> Cc: nanog(a)nanog.org Message-ID: <f2675b350905111508t11d097afrb68ecb09d3798025(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 In my case, each Ethernet interface has its own unique MAC address. Dave On Mon, May 11, 2009 at 4:28 PM, Hector Herrera <hectorherrera(a)gmail.com>wrote: > On Mon, May 11, 2009 at 2:22 PM, David Devereaux-Weber > <ddevereauxweber(a)gmail.com> wrote: > > Chris, > > > > I work with iHDTV <http://ihdtv.org>, a project that sends uncompressed > high > > definition television (1.5 Gbps) as UDP over two 1 Gbps interfaces. If > both > > interfaces are on the same subnet, the OS sees the same router (gateway) > > address on both interfaces, and the results are sub-optimal ... around > 50% > > packet loss. > > packet loss is probably due to the network switch having to re-learn > the location of the MAC address constantly as it sees packets on two > or more ports with the same MAC address (think STP loops). > > If your network stack and network device (switch) supports LACP, then > you can have multiple connections between a host and a network device. > That is a very easy way to increase capacity and add redundancy. > > That is how all of our VMWare ESX 3.5i servers are connected. > > Hector > ------------------------------ Message: 2 Date: Tue, 12 May 2009 10:08:49 +1200 From: Nathan Ward <nanog(a)daork.net> Subject: Re: two interfaces one subnet To: nanog list <nanog(a)nanog.org> Message-ID: <24F5463D-C5B0-46BD-AB6A-1C376BE742EF(a)daork.net> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes On 12/05/2009, at 9:00 AM, Charles Wyble wrote: > What does two interfaces in one subnet mean? > > Two NICs? Or virtual interfaces? Also, what does one subnet mean? A. Using the same IP prefix on two different networks (ie. ethernet broadcast domains) with an interface in to each, or B. running two interfaces in to the same network (ie. ethernet broadcast domain). In the case of A, are you re-using numbers on each side? In the case of B, are you wanting both interfaces to have the same number(s)? -- Nathan Ward ------------------------------ Message: 3 Date: Tue, 12 May 2009 00:13:19 +0200 From: Arnold Nipper <arnold(a)nipper.de> Subject: Re: two interfaces one subnet To: "Patrick W. Gilmore" <patrick(a)ianai.net> Cc: NANOG list <nanog(a)nanog.org> Message-ID: <4A08A2FF.4040306(a)nipper.de> Content-Type: text/plain; charset="iso-8859-1" On 11.05.2009 23:47 Patrick W. Gilmore wrote > On May 11, 2009, at 5:19 PM, Alex H. Ryu wrote: > >> It may be allowed from host-level, but from router equipment, I don't >> think it was allowed at all. > > Ever used HSRP / VRRP? Two interfaces in the same subnet. Works > fine. In fact, most people think it works _better_ than one interface > in the same subnet. > I guess you are mixing interfaces with IPs now. Don't you? Arnold -- Arnold Nipper / nIPper consulting, Sandhausen, Germany email: arnold(a)nipper.de phone: +49 6224 9259 299 mobile: +49 172 2650958 fax: +49 6224 9259 333

1 0

PPP multilink help
by Andrey Gordon 12 May '09

12 May '09

Hey folks, I'm sure to you it's peanuts, but I'm a bit puzzled (most likely because of the lack of knowledge, I bet). I'm buying an IP backbone from VNZ (presumably MPLS). I get a MLPPP hand off on all sites, so I don't do the actual labeling and switching, so I guess for practical purposes what I'm trying to say is that I have no physical control over the other side of my MLPPP links. When I transfer a large file over FTP (or CIFS, or anything else), I'd expect it to max out either one or both T1, but instead utilization on the T1s is hoovering at 70% on both and sometimes MLPPP link utilization even drops below 50%. What am I'm not gettting here? Tx, Andrey Below is a snip of my config. controller T1 0/0/0 cablelength long 0db channel-group 1 timeslots 1-24 ! controller T1 0/0/1 cablelength long 0db channel-group 1 timeslots 1-24 ! ip nbar custom rdesktop tcp 3389 ip cef ! class-map match-any VoIP match dscp ef class-map match-any interactive match protocol rdesktop match protocol telnet match protocol ssh ! policy-map QWAS class VoIP priority 100 class interactive bandwidth 500 class class-default fair-queue 4096 ! interface Multilink1 description Verizon Business MPLS Circuit ip address x.x.x.150 255.255.255.252 ip flow ingress ip nat inside ip virtual-reassembly load-interval 30 no peer neighbor-route ppp chap hostname R1 ppp multilink ppp multilink links minimum 1 ppp multilink group 1 ppp multilink fragment disable service-policy output QWAS ! interface Serial0/0/0:1 no ip address ip flow ingress encapsulation ppp load-interval 30 fair-queue 4096 256 0 ppp chap hostname R1 ppp multilink ppp multilink group 1 ! interface Serial0/0/1:1 no ip address ip flow ingress encapsulation ppp load-interval 30 fair-queue 4096 256 0 ppp chap hostname R1 ppp multilink ppp multilink group 1 ----- Andrey Gordon [andrey.gordon(a)gmail.com]

5 6

RE: two interfaces one subnet
by Skywing 12 May '09

12 May '09

Yes, similar happens to me all the time with both Windows Server 2008 and Vista with respect to 802.11 putting two interfaces on the same subnet (and LAN segment). I typically am never the wiser until I notice that a SMB connection had gone over to 802.11 first, because that associated before the wire was plugged in, causing data transfers on that connection to be much slower than on a hardline. This is something that happens every day to a great many laptop users, I'd wager. Certainly not by any means up there in "does not work at all, period / incompatible with networking" land, as, at the very least, emperical evidence has a quite different story to say. - S -----Original Message----- From: Chris Adams <cmadams(a)hiwaay.net> Sent: Monday, May 11, 2009 16:29 To: nanog(a)nanog.org <nanog(a)nanog.org> Subject: Re: two interfaces one subnet Once upon a time, Kevin Oberman <oberman(a)es.net> said: > > From: Chris Meidinger <cmeidinger(a)sendmail.com> > > For example, eth0 is 10.0.0.1/24 and eth1 is 10.0.0.2/24, nothing like > > bonding going on. The customers usually have the idea of running one > > interface for administration and another for production (which is a > > _good_ idea) but they want to do it in the same subnet (not such a > > good idea...) > > This will not work right. One interface can be 10.0.0.1/24, but any > added interfaces would need to be /32 (10.0.0.2/32). I don't know which OS(es) you are using, but that's not true in Linux. I see this all the time at home; if I plug my notebook into the wired LAN and still have the wireless enabled, both will get an IP (in the same subnet) from DHCP. The wired link is the preferred default route by default, but you can easily set up routes for some networks via the wireless link. You can also set up multipath routing to send packets out both links. I think you can also use IP policy routing to control the choice of outbound interface by rule (e.g. based on source address). -- Chris Adams <cmadams(a)hiwaay.net> Systems and Network Administrator - HiWAAY Internet Services I don't speak for anybody but myself - that's enough trouble.

1 0

Speaking of weird ASPATHs
by Jason Lewis 11 May '09

11 May '09

I started seeing these on May 8th. * 95.87.192.0/18 3257 9070 43561 {196738} * 8928 9070 43561 {196738} *> 8928 9070 43561 {196738} * 1273 9050 8866 43561 {196738} * 6762 8400 8866 43561 {196738}

2 1

need help in bandwidth
by Deric Kwok 11 May '09

11 May '09

Hi all Any better ways to contr ol the bandwidth? and how? eg: in hardware : switch, router or software: iptables...tc, access-list Thank you for your help

1 0

host.net contact person
by Tom Wright 11 May '09

11 May '09

Hi - I'm trying to resolve an IRRD mirroring issue. The contact e-mail "db-admin(a)rr.host.net" bounces. http://rr.host.net/help-mirroring.html Does anyone have the correct address or the details of someone at host.net who could give me a hand? Thanks! -- Kind Regards, Tom Wright Internode Network Operations P: +61 8 8228 2999 W: http://www.internode.on.net

1 0

webpage doesn't worok from specific address
by Juraj Benak 11 May '09

11 May '09

Hi everyone, I've got very unique (at least I think) problem. I have a webpage hosted on fatcow.com -> www.langports.fatcow.com <http://www.langports.fatcow.com/> The problem is that I can't access it from my computer! I'm working in an English language college and we have 2 separated networks - one for staff and the other one for students. I'm able to connect to the webpage from student's network but not from the staff's. I contacted fatcow support, they checked it from their end everything seems all right so they told me to contact my ISP. I contacted Telstra which is managing our both connections; they checked it from their end and say there is nothing wrong, they don't block anything and I should again contact fatcow. I got as well different results from tracert - 2 more hops while going through student's network (the one that works). Do you have any idea what could be wrong? I'm using Fortigate A100 as router and there has been no change last few months. Could you please advise me what program should I use to find out exactly where the problem occurs and what is the cause? Firefow return this message: Connection Interrupted. The document contains no data. The network link was interrupted while negotiating a connection. Please try again. Thanks, Juraj

2 1

RE: webpage doesn't worok from specific address
by Juraj Benak 11 May '09

11 May '09

Hi Dave, Yes I did check it by IP address. Internal DNS - no changes at all. All other webpages work without any problem so I'm sure it can't be DNS. I tried ping on langports.fatcow.com from the Fortigate and there is no response either... -----Original Message----- From: Dave Larter [mailto:dave@stayonline.com] Sent: Monday, 11 May 2009 10:29 AM To: Juraj Benak Subject: RE: webpage doesn't worok from specific address Links work for me on the outside, maybe internal DNS? Have you checked by IP? Hosts if a Win env? -----Original Message----- From: Juraj Benak [mailto:jb@langports.com] Sent: Sunday, May 10, 2009 8:23 PM To: nanog(a)nanog.org Subject: webpage doesn't worok from specific address Hi everyone, I've got very unique (at least I think) problem. I have a webpage hosted on fatcow.com -> www.langports.fatcow.com <http://www.langports.fatcow.com/> The problem is that I can't access it from my computer! I'm working in an English language college and we have 2 separated networks - one for staff and the other one for students. I'm able to connect to the webpage from student's network but not from the staff's. I contacted fatcow support, they checked it from their end everything seems all right so they told me to contact my ISP. I contacted Telstra which is managing our both connections; they checked it from their end and say there is nothing wrong, they don't block anything and I should again contact fatcow. I got as well different results from tracert - 2 more hops while going through student's network (the one that works). Do you have any idea what could be wrong? I'm using Fortigate A100 as router and there has been no change last few months. Could you please advise me what program should I use to find out exactly where the problem occurs and what is the cause? Firefow return this message: Connection Interrupted. The document contains no data. The network link was interrupted while negotiating a connection. Please try again. Thanks, Juraj __________ Information from ESET NOD32 Antivirus, version of virus signature database 4063 (20090508) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com __________ Information from ESET NOD32 Antivirus, version of virus signature database 4063 (20090508) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

1 0