- NANOG - lists.nanog.org

mac limit per VPLS domain
by Adam Vitkovsky 30 Aug '12

30 Aug '12

I'm wondering what would be the sane default MAC limit per VPLS domain as well as per port assuming the RSP can hold up to 512K MAC addresses please? I believe the answer would partly depend on the business model (like I can start with 2 MACs per port and 50 per domain and have customers to pay extra for additional MACs) as well as expected number of VPLS customers/domains Thank you

2 1

Fwd: LSMSGCV: Your message to curtis.starnes@granburyisd.org was blocked as spam - please reply to forward it
by Harry Hoffman 30 Aug '12

30 Aug '12

Damnit, Curtis. If your filtering mail like this then you should use a different identity for your nanog traffic! -- Sent from my Android phone with K-9 Mail. Please excuse my brevity. challenge(a)granburyisd.org wrote: Did you send an email to: curtis.starnes(a)granburyisd.org from: hhoffman(a)ip-solutions.net? If yes, it got caught as unsolicited email by our spam blocker. You can release the mail from spam quarantine by simply replying to this message. At the same time the spam blocker will recognize you as a trusted sender (from this email address) and automatically add you to my Allow list for this and any future communication. Many illegal spammers forge email addresses to try to get past spam blocking software. These spammers send hundreds of millions of spam messages a day, clogging email servers and wasting people’s time. We regret that these spammers have forced us to send this message to you. Original From: hhoffman(a)ip-solutions.net Original To: curtis.starnes(a)granburyisd.org LSMSGCV For more information about our spam blocking software please visit www.lightspeedsystems.com

3 3

Help Request on Bonn/Germany
by Olivier CALVANO 30 Aug '12

30 Aug '12

Hi anyone know a company in Bonn in Germany capable of working on a customer site to connect a cisco router? Thnkas Olivier

2 1

[NANOG-announce] Call for Volunteers -- NANOG Education Committee
by Steve Gibbard 29 Aug '12

29 Aug '12

(my apologies to those receiving a second copy of this. The first copy ran into a mail filtering issue and didn't go out to most of the list) At the Vancouver meeting in June, I presented a preliminary proposal for a NANOG education initiative, which would put together a NANOG-created educational program for junior (and possibly more advanced) network operators. There was broad support from the community, and now it's time to refine the idea and turn it into something that can be implemented. We are seeking volunteers to join the Education Committee and work on the final proposal and its implementation. Among the issues that need to be decided are: - What format should the classes have? - What subject matter should they cover, and what should the curriculum be? - Who should be teaching them -- volunteers from the community or paid instructors? - Where should the classes be taught? At NANOG venues before, after, or during the conferences? At independent sites at non-conference times? - Cost structures: What should the classes cost and what will be included? - Other sources of financial support: Tuition? Sponsorships? Donations? Subsidies from the NANOG conferences? - And all sorts of other issues The expected commitment from members of the Education Committee will be as follows: - Attend bi-weekly conference calls - Research issues as needed, and provide feedback to the group The goal will be to have a reasonably solid proposal in time for the October NANOG meeting, and a final proposal in time for the February meeting. If you are interested in volunteering for this committee, please contact me. Thanks, Steve Gibbard NANOG Board scg(a)newnog.org _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Re: Level 3 BGP Advertisements
by Nick Olsen 29 Aug '12

29 Aug '12

I hear you guys, It's done that way for a bit of traffic steering. If I could get away with just the aggregates I would, Trust me. Nick Olsen Network Operations (855) FLSPEED x106 ---------------------------------------- From: "Berry Mobley" <berry(a)gadsdenst.org> Sent: Wednesday, August 29, 2012 3:45 PM To: nanog(a)nanog.org Subject: Re: Level 3 BGP Advertisements [...] >Please, unless you really know why you need to do otherwise, just >originate your aggregates. +1

3 3

Re: Level 3 BGP Advertisements
by Nick Olsen 29 Aug '12

29 Aug '12

Thanks for the input Jon. I should note that is exactly what we are doing. The /24's are actually tagged with the advertise to customers, prepend to peers community. Nick Olsen Network Operations (855) FLSPEED x106 ---------------------------------------- From: "Jon Lewis" <jlewis(a)lewis.org> Sent: Wednesday, August 29, 2012 3:48 PM To: "Nick Olsen" <nick(a)flhsi.com> Subject: Re: Level 3 BGP Advertisements On Wed, 29 Aug 2012, Nick Olsen wrote: > Anyways, I've always thought that was standard practice. And its never been > a problem. Until we brought up peering with level 3.. No...I'd call that global table pollution. In general, there's no reason you should announce your CIDRs and all their /24 subnets. > I noticed that while the /24's made it out to the world. The larger > counterparts (2 /21's and a /20) did not. So, I start sniffing around. Find > that I do indeed see the prefixes in Level 3's looking glass but they > aren't handing it off to peers. So, Naturally, I land on this being some > kind of prefix filtering issue and open a ticket with Level 3. They tell me > this is standard practice. And If I want to see the /20 or /21's make it > out to the rest of the world, I need to stop sending the /24's. > > Does this sound normal? No. I announce to Level3 our IP space and 2 subnets of each CIDR (i.e. /17 + 2 /18 subnets of that /17, etc.), but I use community tags (and other tricks) to mark the more specifics as advertise to [certain] L3 customers only, and let the less specifics out to the world. The only problems I've had with this have been when L3 peers have become customers, and one L3 customer doing something odd (never did find out what) that caused them to effectively null route our space until I kept them from seeing the more specifics (creative abuse of loop detection). Level3's prefix filter for your session should be built based on IRR data. If it's not doing what you want, you probably haven't setup the IRR data properly. ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

2 1

ARIN Governance - Seeking Nominations for the ARIN Board, AC, and NRO NC
by John Curran 28 Aug '12

28 Aug '12

NANOGers - There are only a few days left to nominate folks for election to the the ARIN Board of Trustees, the ARIN Advisory Council (AC), or on the Number Resource Organization (NRO) Number Council. Please see the attached message for details, and move promptly to nominate if you are aware of anyone who would do a good job serving the community in such a capacity. Thank you! /John John Curran President and CEO ARIN Begin forwarded message: From: ARIN <info(a)arin.net<mailto:info@arin.net>> Subject: [arin-announce] Seeking Nominations: Board, AC, and NRO NC Date: August 28, 2012 11:23:24 AM EDT To: <arin-announce(a)arin.net<mailto:arin-announce@arin.net>> General Members in good standing are invited to nominate candidates for two (2) seats on the Board of Trustees (Board), five (5) seats on the Advisory Council (AC), and one (1) seat on the Number Resource Organization (NRO) Number Council that become open when current terms expire on 31 December 2012. The Board of Trustees and Advisory Council elections have a Nomination Committee (NomCom) that is responsible for identifying, recruiting, and certifying a properly selected slate of candidates to be placed in nomination before the membership for election. This year's NomCom members are: Board of Trustee members Timothy Denton and Scott Bradner, Advisory Council members Chris Grundemann and Kevin Blumberg, and general member volunteers Stephen Middleton, Justin Clutter, and Peter Rocca. Timothy Denton is serving as NomCom Chair. New Board and Advisory Council terms begin 1 January 2013. Board members Paul Andersen and Scott Bradner, and Advisory Council representatives Stacy Hughes, Chris Morrow, Bill Sandiford, Robert Seastrom, and Heather Schiller will conclude their current terms on 31 December 2012. Louie Lee’s seat for the NRO NC also becomes open this year. Incumbents may be re-elected for consecutive terms. Please note: 1. You must be a Trustee or an ARIN General Member in good standing to make nominations for the Board and AC. However, those nominated do not need to be ARIN members. Self-nominations from General Members in good standing are permitted. Any individual, regardless of ARIN membership status, may nominate one or more candidates for any open NRO Number Council position. Please review the nomination instructions at: https://www.arin.net/participate/elections/instructions.html#nominate 2. All nominees must confirm that they qualify to serve and do not violate the Nomination and Appointment Conflict of Interest List at: https://www.arin.net/participate/elections/conflicts.html 3. Nominations must be received by 17:00 ET on Tuesday, 4 September 2012. In accordance with ARIN's Bylaws, each Trustee or General Member in good standing may make up to three nominations for each open seat for the Board and AC. 4. Each nominee must submit the relevant nominee questionnaire by 6 September in order to run for a position they are available at: Board and AC: https://www.arin.net/participate/elections/elec_procedures.html#botcv NRO NC: https://www.arin.net/participate/elections/nronumbercouncil.html#nccv If you are interested in nominating yourself or any other individual to become a member of the Board, AC, or NRO NC, visit ARIN Election Headquarters to fill out the nomination form: https://www.arin.net/app/election/ ARIN will contact all nominees via email and/or telephone to verify that they are willing and able to fulfill a three-year term. If ARIN cannot reach the nominee, the nomination will be rejected. You may view the initial requirements and responsibilities of Board Members at: https://www.arin.net/about_us/bot_requirements.html The Advisory Council requirements and responsibilities are available at: https://www.arin.net/about_us/ac_requirements.html The NRO NC requirements and responsibilities can be viewed at: https://www.arin.net/about_us/nronc_requirements.html Visit Election Headquarters to view the qualifications for Board of Trustees and Advisory Council positions and for further information regarding the election process and timeline. Now is also a good time for member organizations to check to make certain that they have a Designated Member Representative (DMR) eligible to vote in the upcoming election. Direct any questions to info(a)arin.net<mailto:info@arin.net>. Regards, Communications and Member Services American Registry for Internet Numbers (ARIN)

1 0

Optical network simulator
by Walter Keen 28 Aug '12

28 Aug '12

Does anyone happen to know of an optical network simulator? I'm trying to examine the behaviour of a 3-8 node sonet ADM ring using 2-fiber UPSR when one interface has intermittent severely errored seconds.

4 4

Bizarre (.bz) abuse report - are we alone?
by Jay Hennigan 28 Aug '12

28 Aug '12

OK, we're pretty vigilant about policing abusers on our network. This just showed up from "no-reply(a)abuse.bz". Please see my responses inline. Mail origin IP is from an ISP in the Netherlands. Some information redacted to protect the guilty. Is this type of thing typical these days and we're just lucky so far and behind the curve on the futility of trying to take action on reports of network abuse? -------- Original Message -------- Subject: Re: Illegal activity from 207.71.241.252 Date: Sun, 26 Aug 2012 19:13:39 -0700 From: Jay Hennigan <jay(a)west.net> To: [redacted] CC: [redacted] Sent to RIPE WHOIS contacts for mail origin IP [redacted]. On 8/25/12 3:29 PM, no-reply(a)abuse.bz wrote: > We have noticed illegal activity from [redacted] aimed at one of our servers. > Please disable these brute force attempts, port scans and/or neighbour scanning technologies. > If you are not sure how to, please use Google to find more information about the SPT/DPT (source/destination port). > Alternatively, consult with your system administrator, forums, communities and any other sources of help. > > PLEASE NOTE: We have replaced our own IP with 127.0.0.1 for privacy and security purposes. > The destination IP address does not matter because you should solve your exploits properly instead of nullrouting our IP. > With the exact time, IP address, source port and destination port you have plenty of information to address this issue. > Our IP address is not mentioned anywhere and there are no DNS records pointed to it - hence we know your IP address is being abusive. This report isn't particularly helpful. In fact, it in itself is somewhat abusive of our time. First, I had to dig through the headers of the email to find a (hopefully) deliverable address to which I could respond. Second, these logs seem to be two attempts to visit a website within a very short period of time. Two tries each on TCP 80 and TCP 443. Hardly what most reasonable people would call a brute force attempt, port scan, etc. No typical exploit ports, no brute force hammering, just an attempt to connect to a web server, retried once for 80 and 443. Do you think it would be reasonable for us to query our customer and ask if someone there might have fat-fingered a web address on one of 70+ workstations yesterday, or that someone at any of tens of thousands of nameservers worldwide has fat-fingered the A record of some random website? This report appears to be robot-generated, and deliberately designed to make it difficult for a human to reply, being sent from a write-only mailbox. By masking the destination IP of a web request, you make it rather difficult to track it down in the event that it is indeed abusive in the first place. NOC personnel and resources are a finite resource. You appear to be robo-sending abuse reports that are: 1. Sent from a write-only mailbox 2. Containing logs deliberately modified to prevent tracking the abuse 3. Depicting activity that doesn't appear to be abusive Already, abuse departments at ISPs are generally shorthanded. This type of thing is even more likely to cause legitimate reports to be ignored. If you feel that this warrants further attention, please respond with a message that is: 1. Sent by a human being. 2. Has a deliverable reply address. 3. Demonstrates activity that indeed constitutes abuse. 4. Contains logs of the abuse sufficient for us to take action against our customer (such as the IP address being abused, or at least the subnet). > Here are our raw firewall logs, limited to 100 lines with timezone Central European Time. There is also an timestamp since epoch (UNIX time). > == > [2012-08-25 01:01:30 CET] [Timestamp: 1345849290] [11883637.767804] Firewall: *TCP_IN Blocked* IN=eth0 OUT= SRC=[redacted] DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=64182 DF PROTO=TCP SPT=56463 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 > [2012-08-25 01:01:31 CET] [Timestamp: 1345849292] [11883639.265682] Firewall: *TCP_IN Blocked* IN=eth0 OUT= SRC=[redacted] DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=44605 DF PROTO=TCP SPT=57003 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 > [2012-08-25 01:01:38 CET] [Timestamp: 1345849299] [11883646.105990] Firewall: *TCP_IN Blocked* IN=eth0 OUT= SRC=[redacted] DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=39054 DF PROTO=TCP SPT=33537 DPT=443 WINDOW=5840 RES=0x00 SYN URGP=0 > [2012-08-25 01:01:38 CET] [Timestamp: 1345849299] [11883646.411775] Firewall: *TCP_IN Blocked* IN=eth0 OUT= SRC=[redacted] DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=37931 DF PROTO=TCP SPT=33645 DPT=443 WINDOW=5840 RES=0x00 SYN URGP=0 > -- -- Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

6 8

Sprint Outage - Chicago
by John Schneider 27 Aug '12

27 Aug '12

Sprint appears to be having major network issues in the Chicago area. Confirmed by sprint as CRS down in Chicago affecting multiple customers nationwide.

6 6