- NANOG - lists.nanog.org

Savvis broken link / underperforming between DC and Atlanta?
by Lorell Hathcock 11 Nov '11

11 Nov '11

Any one else seeing this? This was done yesterday from Hawaii. tracert speedtest.saas.infor.com 3 5 ms 5 ms 4 ms ip64-75-240-210.aloha.net [64.75.240.210] 4 5 ms 5 ms 5 ms hnl-edge-02.inet.qwest.net [67.129.94.69] 5 * * * Request timed out. 6 56 ms 56 ms 56 ms 63-235-40-18.dia.static.qwest.net [63.235.40.18] 7 58 ms 58 ms 59 ms cr1-tenge-0-3-5-0.sanfrancisco.savvis.net [204.70.200.198] 8 138 ms 138 ms 138 ms cr1-bundle-pos2.Washington.savvis.net [204.70.200.90] 9 135 ms 136 ms 136 ms hr1-tengig-2-0-0.sterling2dc2.savvis.net [204.70.197.74] 10 139 ms 136 ms 137 ms 165.193.78.106 11 * * * Request timed out. 12 * * * Request timed out. 13 * * * Request timed out. But from Houston it was fine yesterday. It took a different route. Today I have the same problem from Houston. tracert speedtest.saas.infor.com 4 2 ms 2 ms 2 ms te4-1.3509.ccr01.iah02.atlas.cogentco.com [66.28.6.21] 5 3 ms 2 ms 2 ms te0-2-0-4.ccr21.iah01.atlas.cogentco.com [154.54.3.149] 6 9 ms 10 ms 8 ms te0-1-0-5.ccr21.dfw01.atlas.cogentco.com [154.54.2.225] 7 8 ms 8 ms 8 ms te7-3.mpd01.dfw03.atlas.cogentco.com [154.54.6.66] 8 15 ms 8 ms 12 ms aer1-ge-4-2.dallasequinix.savvis.net [208.175.175.5] 9 17 ms 8 ms 15 ms 204.70.207.182 10 10 ms 9 ms 10 ms cr1-tengig0-7-5-0.Dallas.savvis.net [204.70.200.170] 11 37 ms 37 ms 37 ms cr1-tengig-0-7-0-0.Washington.savvis.net [204.70.196.105] 12 36 ms 36 ms 36 ms hr1-tengig-2-0-0.sterling2dc2.savvis.net [204.70.197.74] 13 37 ms 36 ms 37 ms 165.193.78.106 14 * * * Request timed out. 15 * * * Request timed out. 16 * * * Request timed out. This the end IP address is in Rackspace in Atlanta I am told. Known issues out there? Any de-peering going on? Or is this just a firewall or private IP space that is not responding to traceroute information requests? Thanks for any help, Lorell Hathcock

1 0

Location of Akamai Edge servers in Hong Kong
by Harris Hui 11 Nov '11

11 Nov '11

Hi, Does anybody know where is the Akamai Edge servers located in Hong Kong? Which ISPs they are using? Are they peering with HKIX? Please advise. Thanks Harris

2 1

TwTelecom engineer offlist
by Eric Germann 10 Nov '11

10 Nov '11

Anyone with twtelecom who can contact me off list about a possible congestion issue at one of your handoffs? Thanks EKG

1 0

Encrypted RPC and firewalling
by Lasse Birnbaum Jensen 10 Nov '11

10 Nov '11

hi all I would like to know how you guys handle encypted rpc across firewalls. We utilize an ASA platform and the DCERPC inspection cant handle encrypted RPC (which is standard in most windows 2008 and default in all communication in exchange 2010). Ciscos says: disable encryption or create "allow any" rules. Do you limit the RPC port range on the windows systems and make "holes" in the firewall for these or do you disable RPC encryption ? Please share your knowledge in this area. Best regards Lasse Birnbaum Jensen Network administrator, IT-Service University of Southern Denmark Email: lasse(a)sdu.dk

3 2

Anyone seen this kind of problem? SIP traffic not getting to destination but traceroute does
by Jay Nakamura 10 Nov '11

10 Nov '11

We ran into a strange situation yesterday that I am still trying to figure out. We have many VoIP customers but yesterday suddenly select few of them couldn't reach the SIP provider's network from our network. I could traceroute to the SIP providers server from the affected clients' IP just fine. I confirmed that the SIP traffic was leaving our network out the interface to the upstream provider and the SIP provider says they couldn't see the SIP traffic come into their border router. SIP traffic coming from SIP provider to the affected customer came through fine. It's just Us -> SIP server was a problem. I thought there may be some strange BGP issue going on but we had other customers within the same /24 as the affected customers and they were connecting fine. The traffic at the time traversed Our network -> Qwest/century link -> Level 3 -> SIP provider I changed the routing around so it would go through our other upstream, AT&T, and it started working. With AT&T, the route was Our network -> AT&T -> Level 3 -> SIP provider So my questions is, is it possible there is some kind of filter at Qwest or Level 3 that is dropping traffic only for udp 5060 for select few IPs? That's the only explanation I can come up with other than the whole Juniper BGP issue 2 days ago left something in between in a strange state? I read the post about XO doing filtering on transit traffic, I haven't seen anyone say Level 3 or Qwest is doing the same.

10 12

Performance Issues - PTR Records
by Matt Chung 09 Nov '11

09 Nov '11

I work for a regional ISP and very recently there has been an influx of calls reporting "slowness" when accessing certain websites (i.e google.com/voice/b) via HTTP. After performing a tcpdump and analyzing the session, I have been able to pinpoint the latency at the application layer. After the tcp session has been established, it takes up to 15-20 seconds before the application begins sending data. The root of the problem was that the PTR record for our customer(s) address does not exist. As soon as the record is created, latency from the application is eliminated. This is analogous to latency when accessing a server over SSH when no PTR is available. A seperate packet capture from another customer exhibiting similar performance behavior showed many TCP retransmissions. At first glance, I assumed this was network related however this correlates with the application not responding and inducing retransmissions at the TCP layer (different symptoms, same problem). Historically, there was no compelling reason to create PTR records for our CPE however more and more applications seem to be dependent on it. Although we will be assigning a record for each address, my question is why is the application (specifically HTTP) dependent on a reverse record ? What is the purpose? Hope this is helpful as well -- -Matt Chung

26 39

Logs Bank
by joshua.klubi＠gmail.com 09 Nov '11

09 Nov '11

Hi, If I may ask, is there any OSS that can serve as a log bank or log server, where it aggregate logs from different sources , and the logs can be accessed using the web from any location on the network and can do graphical presentations based on.the frequency or content os the logs. Thank you Joshua -- Sent from my Nokia N9

9 9

where was my white knight....
by bmanning＠vacation.karoshi.com 09 Nov '11

09 Nov '11

how would a sidr-enabled routing infrastructure have fared in yesterdays routing circus? /bill

11 25

comments due 2dec2011
by bmanning＠vacation.karoshi.com 08 Nov '11

08 Nov '11

http://www.nist.gov/itl/cloud/index.cfm /bill

1 0

Re: where was my white knight....
by Christopher Morrow 08 Nov '11

08 Nov '11

On Tue, Nov 8, 2011 at 1:14 PM, <bmanning(a)vacation.karoshi.com> wrote: > > that was/is kindof orthoginal to the question... would the sidr plan > for routing security have been a help in this event? nice to know > unsecured IPv6 took some of the load when the unsecured IPv4 path > failed. > if all routing goes boom, would secure routing have saved you? no... all routing went boom. > the answer seems to be NO, it would not have helped and would have actually > contributed to network instability with large numbers of validation requests > sent to the sidr/ca nodes. I think actually it wouldn't have caused more validation requests, the routers have (in some form of the plan) a cache from their local cache, they use this for origin validation... there's not a requirement to refresh up the entire chain. (I think). -chris > > /bill > > On Tue, Nov 08, 2011 at 10:01:04AM -0800, Mike Leber wrote: >> >> We saw an increase in IPv6 traffic which correlated time wise with the >> onset of this IPv4 incident. >> >> Happy eyeballs in action, automatically shifting what it could. >> >> Mike. >> >> On 11/8/11 2:56 AM, bmanning(a)vacation.karoshi.com wrote: >> >how would a sidr-enabled routing infrastructure have fared in yesterdays >> >routing circus? >> > >> >/bill >> > > >

4 4