- NANOG - lists.nanog.org

Re: Lightning Debates at NANOG 51
by Scott Weeks 07 Dec '10

07 Dec '10

--- tom(a)dyn.com wrote:From: Tom Daly <tom(a)dyn.com> > > Ethernet: 40GE vs. 100GE > people are debating which is better? really? I'm sure someone has an opinion... ---------------------------------------------------- On NANOG? Naahhhhhhh.... >;-) scott

1 0

IP6.ARPA Nameserver Change Completed
by Joe Abley 07 Dec '10

07 Dec '10

IP6.ARPA NAMESERVER CHANGE COMPLETED This is a courtesy notification of a change to the nameserver set for the IP6.ARPA zone. There is no expected impact on the functional operation of the DNS due to this change. There are no actions required by DNS server operators or end users. DETAIL The IP6.ARPA zone is used to provide reverse mapping (number to name) for IPv6, as described in RFC 3596. The servers which previously provided authoritative DNS service for the IP6.ARPA zone were as follows: TINNIE.ARIN.NET NS-SEC.RIPE.NET NS2.LACNIC.NET SEC1.APNIC.NET NS.ICANN.ORG As previously advised, processing began on Wednesday 2010-12-01 to change the nameserver set to the following, as described in RFC 5855: A.IP6-SERVERS.ARPA (operated by ARIN) B.IP6-SERVERS.ARPA (operated by ICANN) C.IP6-SERVERS.ARPA (operated by AfriNIC) D.IP6-SERVERS.ARPA (operated by LACNIC) E.IP6-SERVERS.ARPA (operated by APNIC) F.IP6-SERVERS.ARPA (operated by RIPE NCC) This change is now complete. Regards, Joe Abley Director DNS Operations ICANN

1 0

Darwin becomes home to first multicast mesh network
by Marshall Eubanks 07 Dec '10

07 Dec '10

Does anyone know if this is actually an IP multicast mesh network, and, if so, anything about its protocols and deployment experience ? Regards Marshall http://www.computerworld.com.au/article/370450/darwin_becomes_home_first_mu… Darwin has become home to the first multicast mesh network in Australia after the installation of an $8 million 109 camera CCTV self-healing wireless network. The project, set up to manage six square kilometres of Darwin's CBD, began after the NT Police, Fire and Emergency Services Department awarded the contract to Darwin-based security company, Security and Technology Services (STS). Managing 109 closed circuit TV cameras initially proved troublesome for the NT Police, which often experienced power outages resulting from lightning strikes as well as the transmission of high definition video streams from cameras to three police stations and a fourth remote storage facility. Adelaide based network company MIMP was chosen by STS to deliver a highly redundant, high performance 128-bit data encrypted wireless network to integrate Darwin’s central camera system.--

1 0

ipfix/netflow/sflow generator for Linux
by Thomas York 06 Dec '10

06 Dec '10

At my current place of work, we use all Linux routers. I need to do some IP accounting/reporting and am currently trying to use Scrutinizer. Scrutinizer can use netstream, jstream, ipfix, netflow, and sflow data without qualms. My only issue is that I can't seem to find any good software for Linux that works with multiple interfaces to generate the flow information. I've tried ndsad, nprobe, softflowd, host sflow, and ipcad without much luck. Most of the software only works on one interface (which is useless as I need to do accounting for numerous interfaces). I've had the best luck with ipcad. The only thing that seems to not work with it is that it doesn't correctly give the interface number in the flow information. It refers to all interfaces as interface 65535. I've tried the config option for ipcad to map an interface directly to an SNMP interface ID, but that option of the config file seems to be ignored. Ntop functionally does exactly what I need, but it's extremely buggy. It segfaults after a few minutes, regardless of Linux distro or Ntop version. So..any ideas on what I can do to get good flow information from our Linux routers?

8 11

How do you do rDNS for IPv6 ?
by John Levine 06 Dec '10

06 Dec '10

I've been pondering IPv6 setups, and I don't understand how IPv6 rDNS is supposed to work. It's clear enough how you look up any particular address, but it's not at all clear to me what you put into an rDNS zone and how you put it there. In IPv4 land, it is standard to assign matching forward and reverse DNS for every live IP, and a fair number of services treat requests from hosts without rDNS with added scepticism. For consumer networks, it's often something like 12-34-56-78.adsl.incompetent.net, with the numbers being the IP address forward or backwards. So if every customer gets a /64, what do you do? You can use a wildcard to give the same rDNS to all 2^64 addresses, but you can't do matching forward DNS, since a DNS response with 2^64 AAAA records would be, ah, a little unwieldy. When hosts self-configure their low 64 bits, do you install a suitable PTR and AAAA into your DNS? If so, how? Do you use DHCPv6 and have it install the DNS? Do you do something else? Signed, Confused

9 9

MPLS forwarding for L3VPN only (IOS)
by Manu Chao 06 Dec '10

06 Dec '10

I have only GRT and L3VPN traffic and would like to use MPLS forwarding only for L3VPN. Is it possible? Thanks & Best Regards, Manu

2 1

wikileaks unreachable
by Randy Bush 06 Dec '10

06 Dec '10

anyone know why https://www.wikileaks.org/ is not reachable? nations state level censors trying to close the barn door after the horse has left? randy

40 66

(wikileaks) Fwd: [funsec] And Google becomes a DNS..
by Gadi Evron 06 Dec '10

06 Dec '10

I withhold comment... "discuss amongst yourselves". Best, Gadi. -------- Original Message -------- Subject: [funsec] And Google becomes a DNS.. Date: Sun, 5 Dec 2010 17:34:50 +0200 From: Imri Goldberg <lorgandon(a)gmail.com> To: funsec <funsec(a)linuxbox.org> Found on reddit: http://i.imgur.com/Q5SVu.png -- Imri Goldberg -------------------------------------- http://plnnr.com/ - automatic trip planning http://www.algorithm.co.il/blogs/ -------------------------------------- -- insert signature here ----

3 3

Want to move to all 208V for server racks
by Jay Nakamura 06 Dec '10

06 Dec '10

I really want to move all newly installed internal and customer racks over to all 208v power instead of 120v. As far as I can remember, I can't remember any server/switch/router or any other equipment that didn't run on 208v AC. (Other than you may need a different cable) Anyone have any experience where some oddball equipment that couldn't do 208v and regret going 208v? We won't have any TDM or SONET equipment, all Ethernet switches, routers and servers. I have control over internal equipment but sometimes customers surprises you.

34 84

Google mail admin contact needed (STARTTLS capabilities issue)
by Brent Jones 06 Dec '10

06 Dec '10

There appears to be a widespread issue with Google inbound MX's yesterday/today and I am unable to reach sufficient levels of support from Google tickets or forums. The problems seems to be many, if not all inbound Google MX records for Gmail.com and Google Apps hosted domains are no longer reliably advertising TLS as being supported over port 25 via STARTTLS. It also appears TLS on connect over port 465 is also spotty at best, with some servers responding, and some not. Previously 465 was recommended by Google for mail clients to use, but seems to be experience issues the last day or so intermittently. This has been preventing opportunistic TLS from working over the last couple days for my personal Google apps domain, and verified with several other Google apps hosted domains. However, Postini inbound MX'es still show STARTTLS in the capabilities list after EHLO, so this seems to be only Google MX'es, not impacting those who use Postini. For example, below shows the same MX at Google responding with and without TLS. I attempted about a dozen times over a few minutes to the same MX until I got STARTTLS listed in the capabilities list, but the next attempt to the same MX would no longer show STARTTLS Any assistance on or off list would be appreciated. (08:17 PM Fri Dec 03)-(~) $ telnet alt1.gmail-smtp-in.l.google.com 25 Trying 209.85.229.27... Connected to alt1.gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP y73si4442013weq.155 ehlo domain.com 250-mx.google.com at your service, [64.124.180.7] 250-SIZE 35651584 250-8BITMIME 250 ENHANCEDSTATUSCODES (08:20 PM Fri Dec 03)-(~) $ telnet alt1.gmail-smtp-in.l.google.com 25 Trying 209.85.229.27... Connected to alt1.gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP j3si4484656wbc.99 ehlo domain.com 250-mx.google.com at your service, [64.124.180.7] 250-SIZE 35651584 250-8BITMIME 250-STARTTLS 250 ENHANCEDSTATUSCODES (08:22 PM Fri Dec 03)-(~) # telnet alt4.gmail-smtp-in.l.google.com 25 Trying 74.125.67.27... Connected to alt4.gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP g16si6002830ibb.2 ehlo domain.com 250-mx.google.com at your service, [64.124.180.7] 250-SIZE 35651584 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250 PIPELINING (08:26 PM Fri Dec 03)-(~) # telnet alt4.gmail-smtp-in.l.google.com 25 Trying 74.125.67.27... Connected to alt4.gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP e7si5973534ibb.84 ehlo domain.com 250-mx.google.com at your service, [64.124.180.7] 250-SIZE 35651584 250-8BITMIME 250-ENHANCEDSTATUSCODES 250 PIPELINING (08:28 PM Fri Dec 03)-(~) $ telnet ASPMX.L.GOOGLE.COM 25 Trying 74.125.91.27... Connected to ASPMX.L.GOOGLE.COM. Escape character is '^]'. 220 mx.google.com ESMTP n7si5304773qcu.37 ehlo domain.com 250-mx.google.com at your service, [64.124.180.7] 250-SIZE 35651584 250-8BITMIME 250 ENHANCEDSTATUSCODES STARTTLS 502 5.5.1 Unrecognized command. n7si5304773qcu.37 -- Brent Jones brent(a)servuhome.net

4 4