September 2009 - NANOG - lists.nanog.org

Re: Single router for P/PE functions
by Erik Schmersal 04 Sep '09

04 Sep '09

> Not only can they, it's done quite frequently. I just completed a >> deployment of seven Juniper MX series routers in a dual ring configuration, >> all acting as combination P/PE devices for a state government WAN backbone. >> Works like a charm. >> >> Erik >> >> >> On Thu, Sep 3, 2009 at 10:20 AM, Serge Vautour <sergevautour(a)yahoo.ca>wrote: >> >>> Hello, >>> >>> I'm pretty confident that a router can be used to perform P & PE >>> functions simultaneously. What about from a best practice perspective? Is >>> this something that should be completely avoided? Why? We're considering >>> doing this as a temporary workaround but we all know temporary usually lasts >>> a long time. I'd like to know what kind of mess awaits if we let this one >>> go. >>> >>> Thanks, >>> Serge >>> >>> >>> >>> __________________________________________________________________ >>> Yahoo! Canada Toolbar: Search from anywhere on the web, and bookmark your >>> favourite sites. Download it now >>> http://ca.toolbar.yahoo.com. >>> >>> >> >

1 0

Power basics- any resources?
by Darren Bolding 04 Sep '09

04 Sep '09

I need to teach an operations group (Systems, Network, Security, IT folks) some basics of power as it applies to the team. Normal things they will see and should understand when they are planning on bringing equipment online etc. I have an idea of many things to talk about, particularly as they apply to our environment, but I was hoping there might be some publicly available slides or docs that I could take advantage of. I'll be happy to share anything we come up with- though this may just be me in front of a whiteboard. Here are some of the questions I plan to cover: What are amps, volts and watts? What are Volt-Amps, and why do they matter? How much can I load that circuit? How does a breaker work? Where are the breakers at our sites? What should you do if a breaker trips? How do we know how much load a device will place on a circuit? How do we monitor power usage? Basic safety. Redundant power. Thanks for any pointers! -- -- Darren Bolding -- -- darren(a)bolding.org --

4 3

Request for a pointer - Linux modifying DSCP on replies?
by Darren Bolding 04 Sep '09

04 Sep '09

I believe this is operational content, but may well be better asked somewhere else. I would love to have a pointer to another list/website. I am looking to do some policy routing based on DSCP marking, and I have this all working inside the networking equipment. I DSCP mark some packets at ingress and I policy-route others based on ACL's matching those DSCP markings. This should allow me to solve some problems in a rather elegant manner, if I do say so myself. And this works fine for some things- I have verified that Ping's to a host work as expected- the Ping shows up at the destination host DSCP marked, and the ICMP reply leaves with the same DSCP marking. However, when I do this with apache and mysql connections (TCP 80/3306), the incoming packets are marked, but the replies are not. My research into the subject doesn't seem to suggest there is a standard for whether replies to a TCP connection are required to have the same DSCP marking, but it seems to make a lot of sense that they would. I've disabled iptables on the server host to no avail. I've looked around for an apache or Linux kernel setting and found nothing. At this point I'm looking for pointers- to a way to solve this issue, or to a better place to ask. I've started investigating writing iptables rules to match incoming connections that have DSCP marking and explicitly mark response traffic, but that seems, I don't know... wrong. Linux kernel we are using is 2.6.9-67.ELsmp. Any help or pointers would be appreciated! --D -- -- Darren Bolding -- -- darren(a)bolding.org --

4 5

83.222.0.0/19 Unroutable on Verizon
by Peter Beckman 03 Sep '09

03 Sep '09

I can't reach 83.222.0.0/19 from Verizon, but I can via Cox Communications Business Fiber as well as Level3. Dies at a peering point it seems: HOST: home Loss% Snt Last Avg Best Wrst StDev 1. mph 0.0% 20 0.7 0.6 0.5 0.7 0.1 2. 10.1.41.89 0.0% 20 2.3 3.6 1.7 26.4 5.6 3. G2-0-3-891.WASHDC-LCR-08.ver 0.0% 20 2.1 1.9 1.6 2.2 0.2 4. so-1-1-0-0.RES-BB-RTR2.veriz 0.0% 20 2.3 2.4 2.2 2.8 0.1 5. 0.so-6-1-0.XL4.IAD8.ALTER.NE 0.0% 20 2.8 2.8 2.6 3.0 0.1 6. 0.xe-8-1-0.BR1.IAD8.ALTER.NE 0.0% 20 5.1 8.4 3.0 40.3 9.4 7. 64.212.107.157 0.0% 20 203.2 14.0 3.0 203.2 44.6 8. ??? 100.0 20 0.0 0.0 0.0 0.0 0.0 Hop 7 alternates between 64.212.107.157 (GBLX) and 204.255.169.202 (MCI dba Verizon) and dies after that. 83.222.32.0/19 seems to route correctly. Can anyone else confirm? Bad BGP Announcement? Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman(a)angryox.com http://www.angryox.com/ ---------------------------------------------------------------------------

4 4

NANOG47 - Program Committee will meet next week to review second round submissions
by Ren Provo 03 Sep '09

03 Sep '09

Hi folks, There are many interesting abstracts in the tool at http://pc.nanog.org and we hope to see a few more presentations arrive prior to next Wednesday. Lightning talks will not be accepted until October. That doesn't mean you can't kick out that first draft to a friend for inspiration! Election season is also drawing close. The election timeline is now online at http://www.nanog.org/governance/elections/2009elections/ Last but not least, the hotel group rate expires this month - http://www.nanog.org/meetings/nanog47/hotel.php Cheers, -ren

1 0

Got this from Educause...
by Robert Mathews (OSIA) 03 Sep '09

03 Sep '09

Apologies in advance, to those who, as administrators of EDU domains, may have already received this from EDUCASE... Finally, DNSSEC is going to make its way to ".edu" Are we ready? Has resistance been obliterated? Test-bed implementation.. Sept, '09.... -- -------- Original Message -------- Subject: Security of .edu Internet Domain to Increase September 3, 2009, Washington, D.C.—EDUCAUSE and VeriSign announced today the initiation of a project to enhance Internet reliability and stability. By the end of March 2010, the project will deploy a security system known as Domain Name Security Extensions (DNSSEC) within the .edu portion of the Internet, which EDUCAUSE manages under a cooperative agreement with the U.S. Department of Commerce. When the project is completed, institutions whose domain names end in .edu will be able to incorporate a digital signature into those names to limit a variety of security vulnerabilities. The Domain Name System (DNS) is the part of the Internet that translates names such as "educause.edu" into numeric addresses (for example, 198.59.61.90). All Internet applications—from electronic mail to online banking—depend on the accuracy and integrity of this translation. Over the years, Internet security experts have discovered a variety of ways that DNS translation may be compromised. The DNSSEC security system limits the problem by allowing owners of domain names to provide a digital signature that adds an extra level of authentication to the translation process. The project plan includes a test-bed implementation, targeted for September 2009, to allow predeployment testing by a number of selected campuses in a nonproduction environment. Final deployment of DNSSEC for .edu will build on the previously announced U.S. Department of Commerce project to deploy DNSSEC at the authoritative root zone of the Internet. [ .... ]

1 0

DENOG1 conference registrations are now open
by Marcus Stoegbauer 03 Sep '09

03 Sep '09

Hi all, the German Network Operators Group (DENOG) is holding its first meeting on the 5th of November 2009 in Frankfurt, Germany. Registrations are now open at http://meeting.denog.de/registration_en.html Please note that you can benefit from our early bird rebate if you register early. A full agenda will be available until the end of September. A quick reminder: We are still accepting applications for presentations or short lightning talks. If you are interested please read our CfP at http://meeting.denog.de/cfp_en.html Hope to see you in November, Marcus

1 0

Re: BGP Hijack by AT&T... was: Need Help Getting IP Unblocked by AT&T
by Brian Raaen 03 Sep '09

03 Sep '09

No is just seems to die in their core network. Dorn Hetzel wrote: > If you traceroute from someplace that sees the announcement from ATT, > does it actually go anywhere beyond the core in ATT (as if they are > sending it to any customer circuit of their) ? > > On Thu, Sep 3, 2009 at 10:23 AM, Brian Raaen <braaen(a)zcorum.com > <mailto:braaen@zcorum.com>> wrote: > > I have not seen any changes yet, although I did get an automated > response from their abuse address that they received my message. > Also, > to answer another question I have not changed backbones in over two > years. I largely suspect that this is an issue of a simple typo > and not > anything malicious. > > -- > ----------------- > Brian Raaen > Network Engineer > email: /braaen(a)zcorum.com/ <http://braaen@zcorum.com/> > <mailto:braaen@zcorum.com <mailto:braaen@zcorum.com>> > > > Gustavo Rodrigues Ramos wrote: > > Hi Brian, has someone from at&t contacted you or have you > noticed any change? > > > > Thanks, > > Gustavo. > > > > > > On Thu, Sep 3, 2009 at 9:43 AM, Brian Raaen<braaen(a)zcorum.com > <mailto:braaen@zcorum.com>> wrote: > > > >> I have sent a complaint to the AT&T abuse contact from my ARIN > contact > >> address asking them to stop announcing the route. > >> > >> -- > >> ----------------- > >> Brian Raaen > >> Network Engineer > >> email: /braaen(a)zcorum.com/ <http://braaen@zcorum.com/> > <mailto:braaen@zcorum.com <mailto:braaen@zcorum.com>> > >> > >> Brian Raaen wrote: > >> > >>> I appreciate the offline replies. After doing some more > research myself > >>> the issue appears to be related to the fact that AT&T is > announcing the > >>> block directly. I did show "ip bgp 72.14.76.0" in a couple > routers and > >>> some showed the route originating in 701 (they were able to > reach it) > >>> and others showed it originating in 7018 (and they could not > reach it). > >>> > >>> Here is my question, since I am an ARIN admin contact for the > IP block > >>> how is the best way to get AT&T to quit announcing the block. > >>> > >>> > >>> > > -- ----------------- Brian Raaen Network Engineer email: /braaen(a)zcorum.com/ <mailto:braaen@zcorum.com> Telephone /678-507-5000x5574/

1 0

Re: BGP Hijack by AT&T... was: Need Help Getting IP Unblocked by AT&T
by Brian Raaen 03 Sep '09

03 Sep '09

I have not seen any changes yet, although I did get an automated response from their abuse address that they received my message. Also, to answer another question I have not changed backbones in over two years. I largely suspect that this is an issue of a simple typo and not anything malicious. -- ----------------- Brian Raaen Network Engineer email: /braaen(a)zcorum.com/ <mailto:braaen@zcorum.com> Gustavo Rodrigues Ramos wrote: > Hi Brian, has someone from at&t contacted you or have you noticed any change? > > Thanks, > Gustavo. > > > On Thu, Sep 3, 2009 at 9:43 AM, Brian Raaen<braaen(a)zcorum.com> wrote: > >> I have sent a complaint to the AT&T abuse contact from my ARIN contact >> address asking them to stop announcing the route. >> >> -- >> ----------------- >> Brian Raaen >> Network Engineer >> email: /braaen(a)zcorum.com/ <mailto:braaen@zcorum.com> >> >> Brian Raaen wrote: >> >>> I appreciate the offline replies. After doing some more research myself >>> the issue appears to be related to the fact that AT&T is announcing the >>> block directly. I did show "ip bgp 72.14.76.0" in a couple routers and >>> some showed the route originating in 701 (they were able to reach it) >>> and others showed it originating in 7018 (and they could not reach it). >>> >>> Here is my question, since I am an ARIN admin contact for the IP block >>> how is the best way to get AT&T to quit announcing the block. >>> >>> >>>

1 0

Telstra issues
by Marcus H. Sachs 03 Sep '09

03 Sep '09

Anybody know what is going on with Telstra? We've got complaints coming in from Down Under that good chunks of the country are belly-up. More here: http://forums.whirlpool.net.au/forum-replies.cfm?t=1274075 Marc -- Marc Sachs <marc(a)sans.org> Director, SANS ISC

4 3