- NANOG - lists.nanog.org

Looking for an Akamai contact, strange DoS traffic sourcing from Akamai sources
by Tom Beecher 21 Jan '11

21 Jan '11

I'm looking for an Akamai contact to try and address a strange situation. We have multiple sites across the country that aggregate 56k dialup customers. Different sites are randomly experiencing inbound traffic spikes that are overwhelming the uplinks to our carriers, causing DoS situations. These spikes far exceed the bandwidth that could possibly be used by the number of dialup customers connected. We've been able to trace the source of the traffic to Akamai boxes, but so far have been unable to reach anyone at Akamai to discuss the situation. We're attempting to get payload information, but the traffic volume is making it slow going setting up packet captures at these sites remotely. Thanks in advance, Tom -- Thomas Beecher II Senior Network Administrator LocalNet Corp. CoreComm Internet Services tbeecher at localnet.com

4 7

Re: Verizon FiOS Distribution Switch
by GP Wooden 21 Jan '11

21 Jan '11

Not that this is a requirement, but good practice none the less with this setup... Turn off cdp on the port facing the LEC... -graham ----- Reply message ----- From: "Chris Burwell" <cburwell(a)gmail.com> Date: Wed, Jan 19, 2011 2:56 pm Subject: Verizon FiOS Distribution Switch To: "NANOG" <nanog(a)nanog.org> I have a question about a Verizon FiOS business connection with an ethernet hand off and I am hoping that someone out there has done the same thing. We have a FiOS business connection coming into our building. This includes an Ethernet hand off into the usual Actiontec router as well as a block of 13 public IP addresses. The Actiontec router needs to remain in place with its current Public IP address. We have some devices from a vendor plugged into it for Internet access, as well as numerous cable boxes across the building that get their guide information through the coax interface on the router. What we want to do is take the ethernet hand off out of the WAN (RJ-45) interface on the Actiontec router and plug it into a hardened Cisco switch such as a 2950. Our goal here is to use the Cisco switch as a Internet distribution switch since we will have numerous test devices that will need to have a direct connection to the Internet. Our preference is also not to have all of the traffic from these other devices traverse the Actiontec router. I have a few concerns with this setup: Some articles I have read indicate that the hand off from the Verizon ONT may not be a direct Ethernet hand off so the interface it connects to may require a different config (Dialer or something). I am also concerned about any issues if the ONT or some down stream Verizon device may cause if it sees multiple MAC addresses coming across our link. We're not trying to cheat the system or anything, just to modify the Verizon setup to better suit our needs. Any advice or tips would be helpful. - Chris

3 2

Securing Border Routers
by Brandon Kim 20 Jan '11

20 Jan '11

Gents: What measures do you take to protect your border routers? Our routers are running BGP so I'm interested if there is any way to secure them without interfering with BGP? Is it normal to put a firewall in front of the border routers? I'm concerned about DDOS attacks mainly....although we haven't had any, I don't welcome them..... Brandon

7 7

RE: Authentication using Microsoft 2008 Active directory for Cisco RADIUS login
by Michael Ruiz 20 Jan '11

20 Jan '11

>Can you post your config on the router? >Also, this may be better to post over at cisco-nsp. >B I decided to move away from RADIUS via Active Directory and turn up a Ubuntu TACACS+ server. Now it works. HAHA. Now it is time to create the template files. M.A.R

1 0

Good MPLS/VPLS book?
by Michael Helmeste 20 Jan '11

20 Jan '11

Does anyone have a favorite book or resource discussing MPLS and all associated Lego blocks (e.g. LDP, TE, VPLS, martini, mBGP et. al.)? I understand the basics of what MPLS is and how you create a circuit from A to B but I'm afraid it still escapes me when trying to figure out how someone would, say, create a multicast capable VPN with 5 edge points. Any pointers to a good way to reduce my level of ignorance on this subject would be appreciated. Vendor literature doesn't bother me as long as the concepts are there. Regards, Michael H.

10 12

WAAS CIFS Optimisation
by Manu Chao 20 Jan '11

20 Jan '11

AFAIK, WAAS is not able to optimise CIFS when SMB signing or digital signatures are enabled (default!). Is it correct? Do i need to disable default Microsoft SMB signature to get optimal CIFS optimisation? Thanks for any feedback or recommandation Manu

3 2

United Airlines Technical Contact
by Nathan Charles 20 Jan '11

20 Jan '11

Does anybody have a technical contact for United Airlines? I can't seem to get in touch with any of the phone numbers or email addresses listed in whois. Regards, Nathan Charles

1 0

United Airlines Technical Contact
by Nathan Charles 20 Jan '11

20 Jan '11

Does anybody have a technical contact for United Airlines? I can't seem to get in touch with any of the phone numbers or email addresses listed in whois. Regards, Nathan Charles

1 0

Is anyone Using Talari Networks WAN Optimizer?
by Holmes,David A 19 Jan '11

19 Jan '11

Talari management apparently has experience at the old Routescience BGP load-balancer startup, so this warrants a closer look. Has anyone used their products?

2 1

Verizon FiOS Distribution Switch
by Chris Burwell 19 Jan '11

19 Jan '11

I have a question about a Verizon FiOS business connection with an ethernet hand off and I am hoping that someone out there has done the same thing. We have a FiOS business connection coming into our building. This includes an Ethernet hand off into the usual Actiontec router as well as a block of 13 public IP addresses. The Actiontec router needs to remain in place with its current Public IP address. We have some devices from a vendor plugged into it for Internet access, as well as numerous cable boxes across the building that get their guide information through the coax interface on the router. What we want to do is take the ethernet hand off out of the WAN (RJ-45) interface on the Actiontec router and plug it into a hardened Cisco switch such as a 2950. Our goal here is to use the Cisco switch as a Internet distribution switch since we will have numerous test devices that will need to have a direct connection to the Internet. Our preference is also not to have all of the traffic from these other devices traverse the Actiontec router. I have a few concerns with this setup: Some articles I have read indicate that the hand off from the Verizon ONT may not be a direct Ethernet hand off so the interface it connects to may require a different config (Dialer or something). I am also concerned about any issues if the ONT or some down stream Verizon device may cause if it sees multiple MAC addresses coming across our link. We're not trying to cheat the system or anything, just to modify the Verizon setup to better suit our needs. Any advice or tips would be helpful. - Chris

2 1