- NANOG - lists.nanog.org

Tier 1 robust DDoS protection solution! No, not yet!
by Ramy Hashish 02 Apr '15

02 Apr '15

Due to the enterprise market demand on DDoS protection solutions - which was initiated by a DDoS vendor, all operators in my country are trying to deploy their solution as fast as they can. As a result to the recent vendor's competition in DDoS protection, the detection/mitigation time can be seconds rather than minutes. However, for some reason tier 1 providers cannot keep pace with these fast mitigation responses, not to mention the tier one providers who are only providing the BGP-based blackholing for DDoS, this inconsistency will finally lead to inefficient DDoS mitigation solution. I have my own concerns about today's DDoS mitigation solutions, however I need to know what are tier one provider's plans for DDoS mitigation? Regards, Ramy

1 0

RFC 7511 - Scenic Routing for IPv6
by Sadiq Saif 01 Apr '15

01 Apr '15

Informational of course. :) https://tools.ietf.org/html/rfc7511 -- Sadiq Saif https://staticsafe.ca

7 6

Re: PoC for shortlisted DDoS Vendors
by Kenneth McRae 01 Apr '15

01 Apr '15

Why aren't you also looking at Hauwei? On Apr 01, 2015, at 09:53 AM, Mohamed Kamal <mkamal(a)noor.net> wrote: In our effort to pick up a reasonably priced DDoS appliance with a competitive features, we're in a process of doing a PoC for the following shortlisted vendors: 1- RioRey 2- NSFocus 3- Arbor 4- A10 The setup will be inline. So it would be great if anyone have done this before and can help provide the appropriate tools, advices, or the testing documents for efficient PoC. Thanks. -- Mohamed Kamal Core Network Sr. Engineer

1 0

Charter NOC contact?
by Shawn L 01 Apr '15

01 Apr '15

Can someone from Charter's NOC contact me off list? We have a mutual customer who's having issues and not getting anywhere going through normal channels. thanks

1 0

Re: Experience Brocade ICX7750 and other vendor SFP
by i3D.net - Martijn Schmidt 01 Apr '15

01 Apr '15

Hello, Brandon Martin<lists.nanog(a)monmotha.net> , 31/3/2015 10:07 PM: I'm not sure where the VDX line ends up in this. It's apparently somewhat the result of actually merging the two technology lines, and it runs somewhat different software as a result. The VDX was AFAIK already in development before Brocade bought Foundry, which is further backed up by the fact that in e.g. FlexOptix's transceiver re-programming tool you have to select a "Brocade Storage" firmware for those transceivers rather than the "Brocade IP" firmware used for Foundry-like gear. It is however true that Brocade has since ported over a lot of Foundry features to the VDX platform. As for optics: it will work well (read: interface comes up and passes traffic) with most other-vendor transceivers even if you don't re-program, but like the Foundry-lineage kit you lose light level monitoring when the firmware doesn't match. Best regards, Martijn Schmidt http://www.i3D.net i3D.net is a private company registered in The Netherlands at Meent 93b, Rotterdam. Registration #: 14074337 - VAT # NL 8202.63.886.B01. i3D.net is CDSA certified on Content Protection and Security and provides hosting from 16 global ISO-certified datacenters. We are ranked in the Deloitte Technology Fast 500 EMEA as one of the fastest growing technology companies.

1 0

Experience Brocade ICX7750 and other vendor SFP
by Florian Figula 31 Mar '15

31 Mar '15

Hi all, does anyone have experiences regarding Brocade ICX7750 and other vendors SFP. Information will be helpful for planing new infrastructure and costs. Thanks to all! Greets, Florian

5 5

WEBCAST TODAY: NEDAS NYC In-Building Wireless Summit
by Joly MacFie 31 Mar '15

31 Mar '15

FYI, I will webcast the NENAS NYC Summit today. What: NEDAS NYC In-Building Wireless Summit When: Tuesday, March 31, 2015 9am-5pm EDT | 1300-2100 UTC Agenda: https://www.nedas.com/events/nedas-nyc-spring-building-wireless-summit-agen… Webcast: https://new.livestream.com/internetsociety/nedasnyc -- --------------------------------------------------------------- Joly MacFie 218 565 9365 Skype:punkcast WWWhatsup NYC - http://wwwhatsup.com http://pinstand.com - http://punkcast.com VP (Admin) - ISOC-NY - http://isoc-ny.org -------------------------------------------------------------- -

1 0

Broken SSL cert caused by router?
by Mike 30 Mar '15

30 Mar '15

Hi, I have a very odd problem. We've recently gotten a 'real' ssl certificate from godaddy to cover our domain (*.domain.com) and have installed it in several places where needed for email (imap/starttls and etc) and web. This works great, seems ok according to various online TLS certificate checkers, and I get the green lock when testing using my own browsers and such. I have a customer however that uses our web mail system now secured with ssl. I myself and many others use it and get the green lock. But, whenever any station at the customer tries using it, they get a broken lock and 'your connection is not private'. The actual error displayed below is 'cert_authority_invalid' and it's "Go Daddy Secure Certificate Authority - G2". And it gets worse - whenever I go to the location and use my own laptop, the very one that 'works' when at my office, I ALSO get the error. AND EVEN WORSE - when I connect to my cell phone provided hotspot, the error goes away! As weird as this all sounds, I got it nailed down to one device - they have a Cisco/Meraki MX64W as their internet gateway - and when I remove that device from the chain and go 'straight' out to the internet, suddenly, the certificate problem goes away entirely. How is this possible? Can anyone comment on these devices and tell me what might be going on here? Mike-

14 18

Re: Generating IPv6 list with filtergen.level3.net
by Courtney Smith 29 Mar '15

29 Mar '15

On Mar 28, 2015, at 8:00 AM, nanog-request(a)nanog.org wrote: >> >> >> Does anyone know if filtergen is going to support IPv6-length subnet >> masks? Trying to use -le=128 returns an error. I can work around with >> sed, but just curious if this tool is still being developed. > > May I recommend a different approach instead? > > Download and compile bgpq3: > > git clone https://github.com/snar/bgpq3.git && cd bgpq3 && ./configure && make > > Run bgpq3: > > Vurt:~ job$ bgpq3 -6 -A -R 128 -l AS15562pfx AS15562 > no ipv6 prefix-list AS15562pfx > ipv6 prefix-list AS15562pfx permit 2001:67c:208c::/48 le 128 > ipv6 prefix-list AS15562pfx permit 2001:67c:2980::/48 le 128 > ipv6 prefix-list AS15562pfx permit 2001:728:1808::/48 le 128 > >> Also curious if the tool now supports IOS-XR RPL > > bgpq3 supports BIRD, IOS, XR, JunOS & JSON output. See bgpq3 -h for all > options > > Kind regards, > > Job There is a Perl module NET::IRR. That is what I switched to for IPv6 support after using IRRPT for a few years. IRRPT has been rewritten in Python but have not had time to play with. It includes IPv6 support. You probably have to modify it to output in XR's set format. That's what I did with the original IRRPT. http://search.cpan.org/~tcaine/Net-IRR/lib/Net/IRR.pm https://github.com/ktims/irrpt-ng Courtney Smith courtneysmith(a)comcast.net I wanna devise a virus To bring dire straits to your environment Crush your corporations with a mild touch Trash your whole computer system and revert you to papyrus

1 0

booster to gain distance above 60km
by Rodrigo Augusto 28 Mar '15

28 Mar '15

Hi folks we have a point and have a 63km between point A to point B. We have a sigle fiber ( only one fiber) and use a fiberstore sfp+ 10GB dibi 1270/1330 module to connect these sites. All attenuation are okI don¹t have any trouble on fiber . I have received this signal on my sfp+: Receiver signal average optical power : 0.0026 mW / -25.85 dBm Does anyone know if have some possible to amplifier this scenario to get more 7db ? Is it possible to put any booster or any way to solve this? I think to use a optical PreAmlifierbut I don¹t know if is possible because my scenario have just one fiberor, use a ROPA- remote optical pumping amplifier) because I have 63km Does anyone have some idea? Rodrigo Augusto Gestor de T.I. Grupo Connectoway http://www.connectoway.com.br <http://www.connectoway.com.br/> http://www.1telecom.com.br <http://www.1telecom.com.br/> * rodrigo(a)connectoway.com.br <mailto:rodrigo@connectoway.com.br> ( (81) 3497-6060 ( (81) 8184-3646 ( INOC-DBA 52965*100

4 5