- NANOG - lists.nanog.org

NANOG 56 - Dallas, TX: Call For Presentations
by David Temkin 14 Aug '12

14 Aug '12

NANOG Community, After a great NANOG in Vancouver, BC, the survey results are in from 55 and we are already assembling a world-class program for NANOG 56. The North American Network Operators' Group (NANOG) will hold its 56th meeting in Dallas, TX on October 21 - 23, 2012 and join with ARIN on October 24, 2012. Terremark, a Verzion company, will be our host for NANOG 56. The NANOG Program Committee is now seeking proposals for presentations, panels, tutorials, tracks sessions, and keynote materials for the NANOG 56 program. We invite presentations highlighting issues relating to technology already deployed or soon-to-be deployed in the Internet. Vendors are encouraged to work with operators to present real-world deployment experiences with the vendor's products and interoperability. NANOG 56 submissions are welcome at http://pc.nanog.org <http://pc.nanog.org/> For further information on what the Program Committee is seeking, please see http://www.nanog.org/meetings/nanog56/callforpresentations.html When considering submitting a presentation, keep these important dates in mind: Presentation Abstracts and Draft Slides Due: 06-August-2012 Final Slides Due: 27-August-2012 Draft Program Published: 17-September-2012 Final Agenda Published: 1-October-2012 Please submit your materials to http://pc.nanog.org Looking forward to seeing everyone in Dallas! -Dave Temkin (Chair, NANOG Program Committee)

1 1

Re: Does anyone use anycast DHCP service?
by Ryan Malayter 13 Aug '12

13 Aug '12

From: Leo Bicknell <bicknell () ufp org> > Assuming your DHCP servers are properly clustered, simply have your > routers relay all requests to both servers. Here's instructions > on setting up ISC DHCPD for redundant (pooled) servers: > http://www.madboa.com/geek/dhcp-failover/ .. > Works great, no single point of failure, no anycast. It may very well work *most* of the time, or during controlled failover, but it looks pretty creaky to me. Some thoughts: 1) No third-party "witness" service for the cluster, making split-brain scenarios a very real possibility. 2) Multi-master databases are quite challenging in practice. This one appears to rely on timestamps from the system clock for conflict detection, which has been shown to be unreliable time and again in the application space. 3) There are single points of failure. You've traded hardware as a single point of failure for "bug-free implementation of clustering code on both DHCP servers" as a single point of failure. In general, software is far less reliable than hardware. I think it would be far more reliable to simply have two independent DHCP servers with mutually exclusive address ranges, and have one system be secondary and "delay" its responses by 2s so it always "loses" when the primary is up and running well. Yes, you lose the ability for clients to get the same IP during a lease refresh if the primary is down, but that is a small price to pay for simplicity and robustness. -- RPM

4 4

IPV6 Anycast for streaming
by Voice of the Blind ™ Network Operation 13 Aug '12

13 Aug '12

Hello, is a anycasted Prefix a good idea for Streaming? here's what we're thinking about: 1. get a /48 from a LIR or a RIR and anounce it through Hurricanne through several Tunnel server including Singapor, New york and Amsterdam 2. run 3 diferent Icecast server in each of the locations where frankfurd would be the Master Server while the 2 others would be a slave relay 3. Assign same Ipv6 address to each of the icecast server where we would be using other prefix to do Inter server communication so if someone is in North America would go through new york, if is in south east asia would be throug SG, otherwise africa/Europ would go through Frankfurd is that a good idea for streaming performance ? any other suggestion is welcome Thank you -- Voice of the Blind ™ Network Operation http://www.vobradio.org/ Phone: +1-347-759-5883

3 3

IPSec Problems
by Bret Clark 13 Aug '12

13 Aug '12

Anyone seeing their customers having problems with IPSec tunnels? Its a strange problem where the customer can ping the other end, but are having trouble keeping the IPSec tunnels active. I was able to preference some of our customer routes out of another BGP edge router which solved their problem. The only common issue (so far) is that the issue seems to occur when traffic goes over a Level3 connection otherwise the IPSec tunnels work fine. Its a rather strange problem though why IPSec is only being affecting but nothing else and I not saying L3 is the reason, but not sure. I opened a support ticket with one of our upstream providers and they mention their own customers have seen similar problems. Scratching my head on this one! Thanks, Bret

1 0

Re: IPV6 Anycast for streaming
by Ryan Malayter 13 Aug '12

13 Aug '12

From: Voice of the Blind ™ Network Operation <noc () vobradio org> > Hello, is a anycasted Prefix a good idea for Streaming? Maybe. I've used TCP anycast-based CDNs (CacheFly and MaxCDN/NetDNA), and they work very well. I observe they generally work something like this: 1. DNS resolution with long TTLs returning anycasted IPs. 2. Smaller HTTP requests served directly from anycast IP with http keepalives enabled. 3. Large objects and streams do an application layer redirect (HTTP or whatever stream protocol) to a DNS name that returns unicast IPs for the node you initially reached via anycast. I would recommend looking at CDNs however, as this is an area where scale does matter and you will find it very difficult to do this better or cheaper yourself.

3 2

Comcast outage
by Grant Ridder 11 Aug '12

11 Aug '12

Does anyone know about or experiencing a Comcast outage in the Santa Clara area? -Grant

2 1

DNSChanger Prefixes are re-allocated and advertised ...
by Barry Greene 11 Aug '12

11 Aug '12

Hi Team, FYI - Two prefixes from the DNS Changer/Rover Digital take down have been re-allocated. One of the prefixes - 85.255.112.0/20 - was advertised Friday morning. There is a blog post with some of the details here: "Beware! DNS Changer’s IP Blocks are re-allocated and advertised!" - http://www.senki.org/archives/930 A general feeling of surprise summarizes several of the behind the scenes security conversation. A general recommendation of "be careful of the traffic going to and from these netblocks" is the best advice at this time. Barry

2 1

RE: [SMBManagedServices] RE: next hop packet loss
by Jim Ray 11 Aug '12

11 Aug '12

Get a load of this: New version of Firefox works fine. Methinks Mozilla released a turd. -----Original Message----- From: SMBManagedServices(a)yahoogroups.com [mailto:SMBManagedServices@yahoogroups.com] On Behalf Of James_TDS Sent: Friday, August 10, 2012 11:47 AM To: SMBManagedServices(a)yahoogroups.com Subject: RE: [SMBManagedServices] RE: next hop packet loss As I said I suspect Checkpoint is "breaking the Internet" in an attempt to block various DDOS attacks. The failure of tracert and ICMP is not isolated to Checkpoint and Above.net as I had a similar problem with a local TW customer on a static IP. Because their in house router was down and not responding to anything TW would drop the Tracert long before it even came close to my client. I gave them heck about this as it made it impossible to remotely monitor the customer because when the customer calls and says the "Internet is down" the first thing I do is tracert to their IP. When I see the route die in another city that tells me the ISP is having issues vs. the route dying one hop out from my customer's IP. They gave me some crap about active routing and such. Put anything on that IP and have it respond to pings and the route will complete. As I said Telnet checkpoint.com 80 fails for me but SLChecker works so again it's probably some DDOS thing and they are checking user agents before replying and I assume SLCheck mimics IE or something. Handy tool. -----Original Message----- From: SMBManagedServices(a)yahoogroups.com [mailto:SMBManagedServices@yahoogroups.com] On Behalf Of Jim Ray Sent: Friday, August 10, 2012 8:23 AM To: SMBManagedServices(a)yahoogroups.com Subject: RE: [SMBManagedServices] RE: next hop packet loss I am stumped why http://www.checkpoint.com won't resolve with Firefox yet will with Internet Explorer and Safari. I know Microsoft won't let you do what you need to do with Firefox yet am surprised with Check Point. Above.net is not echoing ICMP, though, before one reaches Check Point. >From the NANOG group, I found out it is possible to use command line switch to specify type of traffic and to get around ICMP issue. Apparently, TCP works; however, another person said UDP is preferred embodiment. This test resolved web site yet resulted in lost connection: telnet www.checkpoint.com 80 GET / HTTP/1.1 Host: www.checkpoint.com I captured packets with Wireshark yet did not see anything that jumped out at me as root cause for failure. Meanwhile back at the ranch, my friend brought over business card for Check Point representative, and I plan to pick up the phone and call thereby bypassing TCP/IP in its entirety. -----Original Message----- From: SMBManagedServices(a)yahoogroups.com [mailto:SMBManagedServices@yahoogroups.com] On Behalf Of James_TDS Sent: Thursday, August 09, 2012 10:50 AM To: SMBManagedServices(a)yahoogroups.com Subject: RE: [SMBManagedServices] RE: next hop packet loss Go back a few post and see where I mentioned that the hop in question was not responding to the ICMP request, it wasn't down they just refuse to echo. Probably a more valid test would have been: telnet checkpoint.com 80 GET However I just tested that as well and Checkpoint doesn't respond correctly. Not sure what they are doing on the frontend but they are breaking Internet "rules" probably in an effort to not be DDOS'd. I checked again with SLChecker and it responds correctly so they are likely not responding to Telnet because it doesn't send a user agent ID. -----Original Message----- From: SMBManagedServices(a)yahoogroups.com [mailto:SMBManagedServices@yahoogroups.com] On Behalf Of Jim Ray Sent: Thursday, August 09, 2012 8:39 AM To: SMBManagedServices(a)yahoogroups.com Cc: Herring, David Subject: [SMBManagedServices] RE: next hop packet loss Hey, I get the idgit award for this one. Time Warner's next hop that was dropping packets was really a situation where next hop was not responding to ICMP from tracert. Neither of us was able to diagnose the problem until last night when I found out Safari pulled up http://www.checkpoint.com from same network and Firefox on PC did not. So, apparently, Check Point does not like Firefox. Internet Explorer worked. Meanwhile back at the ranch, I have learned about TCP switch in tracert thanks to peers here and on NANOG and have gotten down and dirty with Wireshark. Regards, Jim Ray, President Neuse River Networks 2 Davis Drive, PO Box 13169 Research Triangle Park, NC 27709 919-838-1672 x100 www.NeuseRiverNetworks.com -----Original Message----- From: Herring, David [mailto:david.herring@twcable.com] Sent: Thursday, August 09, 2012 7:54 AM To: Jim Ray; Adrian Bool Subject: RE: next hop packet loss Got it.. no worries.. I know we are not always the best either! What would be great- that you let the below be known to your user group? I know we let them know when we thought it was Business class problem... David Herring Channel Manager | Channel Partner Program, East Region TWC Business Class 101 Innovation Avenue| Morrisville, NC 27560 919.573.7635 -----Original Message----- From: Jim Ray [mailto:jim@neuse.net] Sent: Wednesday, August 08, 2012 7:48 PM To: Adrian Bool Cc: Herring, David Subject: RE: next hop packet loss Dude...don't laugh too hard when I tell you I found the problem: http://www.CheckPoint.com not compatible with Firefox, only with Safari and Internet Explorer or possibly others. David, apparently, tracert is not a valid test if ICMP is not active. So, my apologies. Regards, Jim Ray, President Neuse River Networks 2 Davis Drive, PO Box 13169 Research Triangle Park, NC 27709 919-838-1672 x100 www.NeuseRiverNetworks.com -----Original Message----- From: Adrian Bool [mailto:aid@logic.org.uk] Sent: Tuesday, August 07, 2012 9:22 AM To: Jim Ray Subject: Re: next hop packet loss Oh, if you do get a connect on the telnet session, type, GET / HTTP/1.1 Host: www.checkpoint.com <return> <return> aid On 7 Aug 2012, at 14:14, "Jim Ray" <jim(a)neuse.net> wrote: > Ah, good eyes :-) > > Thank you, sir. Will try again. > > Regards, > > Jim Ray, President > Neuse River Networks > 2 Davis Drive, PO Box 13169 > Research Triangle Park, NC 27709 > 919-838-1672 x100 > www.NeuseRiverNetworks.com > > > > -----Original Message----- > From: Adrian Bool [mailto:aid@logic.org.uk] > Sent: Tuesday, August 07, 2012 9:14 AM > To: Jim Ray > Subject: Re: next hop packet loss > > > Hi Jim, > > It looks like you just used telnet on its own (so it used port 23, > which > *will* be blocked by Checkpoint). Instead you need to specify the > HTTP port as well, > > telnet www.checkpoint.com 80 > > If you give that a go again; whilst capturing with Wireshark & see > what happens. > > Cheers, > > aid > This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout. ------------------------------------ Moderated and managed Amy LubyYahoo! Groups Links ------------------------------------ Moderated and managed Amy LubyYahoo! Groups Links ------------------------------------ Moderated and managed Amy LubyYahoo! Groups Links ------------------------------------ Moderated and managed Amy LubyYahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/SMBManagedServices/ <*> Your email settings: Individual Email | Traditional <*> To change settings online go to: http://groups.yahoo.com/group/SMBManagedServices/join (Yahoo! ID required) <*> To change settings via email: SMBManagedServices-digest(a)yahoogroups.com SMBManagedServices-fullfeatured(a)yahoogroups.com <*> To unsubscribe from this group, send an email to: SMBManagedServices-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/

2 1

APEWS spam blacklist?
by Tim Burke 11 Aug '12

11 Aug '12

Anyone have a contact involved with the APEWS blacklist? They have had a /19 of ours blacklisted for almost two years and there seems to be no way to contact them to get this resolved.

2 1

Anyone can suggest a good and reliable VPS provider in India ?
by fc lists 11 Aug '12

11 Aug '12

Hi ... This is my last resort. Apologies if this have been discussed before or if is totally OT ... but i figured i could find some useful help here. I need to find a good VPS provider in India where to setup a small set of machines in a Virtual Internal Private network (L2TPD/IPSEC) and an extenrnal VPN to other sites with (IPinIP tunnels and IPSEC) after doing research on internet i decided to try out CTRLs ( http://www.ctrls.com/) that looked the best in terms of ... everything. What looks the best is not always the best as it turns out ... I had all possible problems with them on any layer you can imagine ... from having a server deployed on XEN that would be moved to OPENVZ on rebuild (Bad but not the worst) ... to horrible packet loss to half of the world that basically made them unusable for anything serious. The only requirements i have is that the VPS should be close enough to MUMBAI (don't have an ISP there yet so can't really say "close to what" ) and that their are reliable from a network point of view. Does anyone have any GOOD experience with VPS in india to share with me ? Thanks in advance for your help Francesco

3 2