- NANOG - lists.nanog.org

Internet Edge and Defense in Depth
by Holmes,David A 05 Jan '12

05 Jan '12

Some firewall vendors are proposing to collapse all Internet edge functions into a single device (border router, firewall, IPS, caching engine, proxy, etc.). A general Internet edge design principle has been the "defense in depth" concept. Is anyone collapsing all Internet edge functions into one device? Regards, David ________________________________ This communication, together with any attachments or embedded links, is for the sole use of the intended recipient(s) and may contain information that is confidential or legally protected. If you are not the intended recipient, you are hereby notified that any review, disclosure, copying, dissemination, distribution or use of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by return e-mail message and delete the original and all copies of the communication, along with any attachments or embedded links, from your system.

13 13

Looking for a Tier 1 ISP Mentor for career advice.
by Tyler Haske 05 Jan '12

05 Jan '12

Hi. I have some big goals and a lot of enthusiasm but I need direction. I'm looking for a mentor who can help me focus my career so eventually I wind up working at one of the Tier I ISPs as a senior tech. I want to handle the big pipes that hold everyone's data. This is what I want to do with my life. I have my CCNA, and when I graduate college I'll have a CCNP, and the ability to move anywhere in the USA. Please message me off-list. Thank you, Tyler.

23 26

IPv6 resolvers
by Seth Mos 05 Jan '12

05 Jan '12

Hi Nanog, Owen, I was wondering if many people are seeing horrendous latency on the free Hurricane Electric resolvers? Both accessing the v4 or v6 resolvers have horrendous latency. This could well be coupled to their free nature and popularity. So far when contacting Hurricane Electric they restart the resolver on their end and all is well again, but now other pfSense users in the US were noticing these latency issues as well, leading me to believe it is a larger issue. But I was wondering if a more permanent solution for these resolvers exist. 74.82.42.42 2373 msec 2001:470:20::2 2592 msec The google DNS server I'm using is doing swimmingly so far, OpenDNS seems ok too. 2001:4860:4860::8844 16 msec Kind regards, Seth Mos

6 9

2012-Big-Data-Big-Traffic
by Henry Linneweh 04 Jan '12

04 Jan '12

New issues for massive data movement http://www.infineta.com/sites/default/files/pdf/IRG-2012-Big-Data-Big-Traff… Henry

1 0

Does anybody out there use Authentication Header (AH)?
by John Smith 04 Jan '12

04 Jan '12

Hi, I am trying to see if there are people who use AH specially since RFC 4301 has a MAY for AH and a MUST for ESP-NULL. While operators may not care about a MAY or a MUST in an RFC, but the IETF protocols and vendors do. So all protocols that require IPsec for authentication implicitly have a MAY for AH and a MUST for ESP-NULL. Given that there is hardly a difference between the two, I am trying to understand the scenarios where people might want to use AH? OR is it that people dont care and just use what their vendors provide them? Regards, John

5 9

CenturyLink - DNS admin needed
by Graham Wooden 04 Jan '12

04 Jan '12

Hello, Any CenturyLink DNS admin folks lingering around? If so, can you contact me off-list? I believe there is some erroneous data lingering in the DNS caching servers and would like to get that resolved. TTL has appeared to have come and gone and it¹s not refreshing. FYI - I tried to go through our support channels (we¹re a TDM based customer), but that isn¹t proving to be getting us anywhere... Thank you, -graham

1 0

Problems with 100.42.32.0/20
by Josh Baird 03 Jan '12

03 Jan '12

Hi, We just received 100.42.32.0/20 from ARIN. According to ARIN, this block was received from IANA in November 2010 and was issued to us in November 2011. Since we started using it, we have seen many problems with different Geo-IP providers incorrectly classifying the block - both location and provider wise (lots of them think this is Verizon space for some reason in both Canada and Kansas). I have followed http://nanog.cluepon.net/index.php/GeoIP and contacted most of these providers already. Not one has returned my email/inquiry. The main problem that I am seeing is that Verizon/UUNET is filtering access to some of their networks from 100.42.32.0/20. We are currently unable to reach any of UUNET.net's authoritative DNS servers (198.6.1.83, 198.6.1.161, etc) and appear to be filtered by some Verizon Business/UUNET routers. $ traceroute 198.6.1.83 traceroute to 198.6.1.83 (198.6.1.83), 30 hops max, 40 byte packets 1 209.65.192.129 (209.65.192.129) 1.491 ms 1.716 ms 1.942 ms 2 vl41-irtr1.dan100.net.kywimax.com (209.65.192.45) 0.551 ms 0.582 ms 0.587 ms 3 rrcs-173-197-155-189.west.biz.rr.com (173.197.155.189) 0.474 ms 0.519 ms 0.505 ms 4 ae8.chcgill3-rtr1.kc.rr.com (65.28.199.197) 20.349 ms 20.340 ms 20.409 ms 5 ae-5-1.cr0.chi30.tbone.rr.com (66.109.6.112) 20.243 ms 20.235 ms 20.223 ms 6 107.14.17.147 (107.14.17.147) 27.982 ms 27.567 ms 27.540 ms 7 216.156.72.165.ptr.us.xo.net (216.156.72.165) 20.945 ms te1-2-0d0.cir1.chicago2-il.us.xo.net (216.156.72.5) 20.920 ms 216.156.72.157.ptr.us.xo.net (216.156.72.157) 20.912 ms 8 (204.255.168.97) 20.868 ms 20.826 ms 20.910 ms 9 (152.63.66.77) 36.133 ms 36.243 ms 36.233 ms 10 (152.63.43.109) 45.859 ms 45.853 ms 45.843 ms 11 (152.63.38.9) 45.177 ms 45.175 ms 45.168 ms 12 * * * 13 * * * 14 * (207.18.173.162) 46.105 ms !X * (pos5-0.soesr1.ash.ops.us.uu.net) I have contacted VZW Business' IP-NOC and was not really given a contact that could help me with this situation. I have also emailed filters(a)lists.verizonbusiness.com and I'm awaiting a response (hopefully). Would anyone happen to have an idea of why I am seeing so many problems with this block, and who I may be able to reach out to at VZB to hopefully get this issue resolved? Thanks.

1 1

Multicast video stream to EIA analog channel
by Matt Bernardi 03 Jan '12

03 Jan '12

Hello all, I am new to the mailing list and wanted to pick some of your guys brains about something. I work for a small cable service provider. What I am trying to do is receive a multicast stream, modulate it and send it out as an EIA analog channel. I know there is equipment built for this specific reason(RGP SEP, APEX1000, etc) but this is just going to be a temporary fix as we are doing a total video overhaul and moving to all MPEG4 capable equipment. I figured there is a way to accomplish this with linux as my budget isn't very large, but all of my reasearch hasn't really helped so I'm reaching out to you. Has anyone ever done this? or know of any good reference sites for this? Any info would be greatly appreciated. Thanks again, Matt Bernardi

2 2

Redundant multicast routing
by Mark Smith 03 Jan '12

03 Jan '12

Hi What's your recipe to implement redundant multicast (stub) routing? Let's think about the simplest scenario. We have 2 routers, R1 and R2 and 3 ip networks. All 3 networks are directly connected to both routers and the routers are performing unicast routing between networks using VRRP as the redundancy protocol. Let's disregard L2 redundancy here and assume it works. Same goes with igmp snoop. net1: 192.168.1.0/24, VRRP .254, R1 .1, R2 .2 net2: 192.168.2.0/24, VRRP .254, R1 .1, R2 .2 net3: 192.168.3.0/24, VRRP .254, R1 .1, R2 .2 Say multicast source is in net1 and receiver in net2. If I did not need redundancy in multicast, I would just configure all interfaces on R1 as pim passive and it would (probably) work. But if I want the multicast routing to be redundant, what should I do? If I add the R2 interfaces as pim passive, the multicast is forwarded to net2 (and net3) twice because R1 and R2 do not know about each other. I tested this. If I configure all R1 and R2 interfaces as pim dense, the destination receives multicast fine, but it is flooded between R1 and R3 2 or 3 times (because pim dense floods the multicast to all pim neighbors and R1 and R2 are pim neighbors in all 2 networks). So, core links are unnecessarily consumed. I tested this, too. One choice could be to use pim sparse and configure R1 and R2 to be anycast RPs using loopback interface and configure MSDP peering between them. But given the simplicity of the topology, this seems unnecessarily complex configuration. I have not tested this yet. Maybe MVR could be solution but I think it will cause stream multiplication too. I have not tested MVR yet either. I would like to keep the recipe as vendor agnostic as possible. Thanks for help :)

2 1

HotICE 2012 -- paper registration deadline Friday Jan 6, 2012
by Ramana Kompella 03 Jan '12

03 Jan '12

[Apologies if you received multiple copies of this CFP] The 2nd USENIX Workshop on Hot Topics in Management of Internet, Cloud, and Enterprise Networks and Services (Hot-ICE '12) Program Co-Chairs invite you to contribute to the refereed papers. The Hot-ICE workshop seeks to bring together researchers and practitioners working on network and service management in the Internet, cloud, and enterprise domains. Paper registration is due *January 6, 2012*, by 11:59 p.m. PST (i.e. Friday !). Complete paper submissions are due January 13, 2012, by 11:59 p.m. PST. For more information and the submission guidelines, please visit http://www.usenix.org/hotice12/cfpa. Hot-ICE '12 will be held on April 24, 2012, in San Jose, CA, and will be co-located with NSDI '12: http://www.usenix.org/nsdi12 On behalf of the Hot-ICE '12 Program Committee, Olivier Bonaventure, Universite catholique de Louvain Ramana Kompella, Purdue University

1 0