- NANOG - lists.nanog.org

Mitigating human error in the SP
by Chadwick Sorrell 04 Feb '10

04 Feb '10

Hello NANOG, Long time listener, first time caller. A recent organizational change at my company has put someone in charge who is determined to make things perfect. We are a service provider, not an enterprise company, and our business is doing provisioning work during the day. We recently experienced an outage when an engineer, troubleshooting a failed turn-up, changed the ethertype on the wrong port losing both management and customer data on said device. This isn't a common occurrence, and the engineer in question has a pristine track record. This outage, of a high profile customer, triggered upper management to react by calling a meeting just days after. Put bluntly, we've been told "Human errors are unacceptable, and they will be completely eliminated. One is too many." I am asking the respectable NANOG engineers.... What measures have you taken to mitigate human mistakes? Have they been successful? Any other comments on the subject would be appreciated, we would like to come to our next meeting armed and dangerous. Thanks! Chad

19 26

RE: ip address management
by Carlos Vicente 04 Feb '10

04 Feb '10

Please take a look at the Network Documentation Tool: http://netdot.uoregon.edu It's more than just IPAM, but it was designed with IPv6 in mind. BTW, I just gave a lighting talk at the I2 Joint Techs meeting in Salt Lake City this morning: http://www.internet2.edu/presentations/jt2010feb/20100203-vincente.pdf Feedback welcome. Regards, Carlos Vicente University of Oregon

1 0

Fwd: [Geowanking] model of the internet - need data
by Randy Fischer 03 Feb '10

03 Feb '10

Hello, longtime lurker here, an acquaintance is looking for lat/long data and I thought this group might not object to this request. (if you do, it's my fault, not that of Anselm). -Randy Fischer ---------- Forwarded message ---------- From: Anselm Hook Date: Wed, Feb 3, 2010 at 1:14 PM Subject: [Geowanking] model of the internet - need data Hi folks, I'm looking for a map of the Internet. A friend wants to project this onto a spinny globe. I've found several pictoral representations but I'm looking a raw data-set that geographically locates major routers and servers. In an ideal world I'd get a database that indicates { ip address, amount of traffic, longitude, latitude, connected to other ip addresses } and then I could draw my own picture. Databases I have seen do not include longitude and latitude which I something I would need. Any leads? I suppose even just given IP addresses I could guess longitude and latitude location... which wouldn't be ideal but perhaps would be acceptable. Here's what I've seen so far, http://www.opte.org/ -> I'll try reach out to these folks since they seem to have the best data and are nearby. http://www.technologyreview.com/Infotech/18944/?a=f http://www.chrisharrison.net/projects/InternetMap/ Thanks for any input! - @anselm @wherecamp

3 2

[NANOG] Contacts @ China Unicom and China Telecom
by Justin Ream 03 Feb '10

03 Feb '10

Hi All - Does anyone have peering contacts for China Unicom and China Telecom? Finding that the ones for Any2 in peeringdb.com are no good. Will take replies offlist, thanks! -justin

2 1

Datacenter for DR in northwestern NJ/NY
by Matt Sprague 03 Feb '10

03 Feb '10

Hello NANOG! Does anyone know of some strong datacenters in northwestern NJ, or north of Westchester NY without getting too far away from NYC? I'm looking for a DR colo solution for a site that is in NYC; this needs to be at least 50m away from NYC, but I'm trying to keep it not too much further than that for convenience. I'm also trying to keep this to top level providers as there may be compliance requirements. Thanks in advance for any responses. -- Matt Sprague ReadyTechs, LLC msprague(a)readytechs.com<mailto:msprague@readytechs.com> 973-455-0606 x1204 (voice) http://www.readytechs.com/

8 7

BGP FlowSpec (RFC 5575) route injector
by Thomas Mangin 03 Feb '10

03 Feb '10

Hi, I juste added some preliminary support for FlowSpec (RFC5575) to my BGP route injector http://bgp.exa.org.uk/ As I am not aware of any other project allowing to inject flow route into a network, I am taking the liberty to plug it here. You can access the SVN repository at: http:/svn.exa.org.uk/bgp/trunk/ the code is under a 3-clauses BSD licence. More information about the installation are available on the wiki. I performed basic testing by rate-limiting one of my coworkers mail and web flows - seems to work - for the rest, it may not do what it should. If you are interested, have any questions, or are missing a feature, or just find any bugs, please, just let me know. Changing the configuration and sighuping the application perform send the peers the correct update messages to change the peer RIB. Or just enable graceful-restart and restart the application if you do not care about the number of update :p More information: - http://www.terena.org/activities/tf-ngn/tf-ngn17/uze-flowspec.pdf - http://resources.nznog.org/2006/Friday-240306/DavidLambert-BGPFlowSpecifica… - http://uknof.org/uknof15/Mangin-NakedBGP.pdf (another shameless selfplug - BGP overview - 3 slides on FlowSpec) Thomas -- Exa Networks Limited - http://www.exa-networks.co.uk/ Company No. 04922037 - VAT no. 829 1565 09 27-29 Mill Field Road, BD16 1PY, UK Phone: +44 (0) 845 145 1234 - Fax: +44 (0) 1274 567646 --------- neighbor 82.219.123.221 { [....] flow { route { match { source 10.0.0.1/32; destination 192.168.0.1/32; port =80; destination-port =3128 >8080&<8088; source-port >1024; protocol tcp; # protocol [ tcp udp ]; # packet-length >200&<300 >400&<500; # fragment not-a-fragment; # fragment [ first-fragment last-fragment ]; # icmp-type [ unreachable echo-request echo-reply ]; # icmp-code [ host-unreachable network-unreachable ]; # tcp-flags [ urgent rst ]; # dscp [ 10 20 ]; } then { discard; # rate-limit 9600; # redirect 65500:12345; # redirect 1.2.3.4:5678; } } } } thomas.mangin(a)m7i-4.u3.tcw.uk> show configuration logical-routers trap protocols bgp local-as 30740; group flow { type external; multihop; local-preference 100; local-address 82.219.123.221; import no-export; export deny-all; peer-as 65500; neighbor 82.219.131.242 { traceoptions { file bgp; flag all; } family inet { unicast; flow { no-validate everything; } } family inet6 { unicast; } } } thomas.mangin(a)m7i-4.u3.tcw.uk> show configuration logical-routers trap policy-options policy-statement everything then accept; # env PYTHONPATH=~/source/bgp/lib/ python daemon/bgpd etc/bgp/m7i-service.txt 033 12:28:13 Supervisor/ performing reload 033 12:28:13 Supervisor/ New Peer 82.219.123.221 033 12:28:14 82.219.123.221/ 30740 -> OPEN version=4 asn=65500 hold_time=180 router_id=82.219.131.242 capabilities=[Graceful Restart Flags 0x8 Time 5 IPv4/flow-ipv4=0x80 IPv4/unicast=0x80 IPv6/unicast=0x80, Multiprotocol IPv4 unicast IPv6 unicast IPv4 flow-ipv4] 033 12:28:15 82.219.123.221/ 30740 <- OPEN version=4 asn=30740 hold_time=90 router_id=82.219.123.221 capabilities=[Cisco Route Refresh (unparsed), Multiprotocol IPv4 unicast IPv6 unicast IPv4 flow-ipv4, Route Refresh (unparsed)] 033 12:28:16 82.219.123.221/ 30740 -> KEEPALIVE 033 12:28:17 82.219.123.221/ 30740 <- KEEPALIVE announcing IPv6 unicast 2a02:b80:0:6:50::1/128 next-hop 2a02:b80::90:0:52e:0:1 med 100 announcing IPv4 flow-ipv4 destination 192.168.0.1/32,source 10.0.0.1/32,protocol =TCP,port =80,destination-port =3128 >8080&<8088,source-port >1024 extended community [ 0x80 0x6 0x0 0x0 0x0 0x0 0x0 0x0 ] announcing IPv4 unicast 82.219.4.100/32 next-hop 82.219.4.101 med 100 033 12:28:17 82.219.123.221/ 30740 -> UPDATE (3) 033 12:28:17 82.219.123.221/ 30740 <- KEEPALIVE thomas.mangin(a)m7i-4.u3.tcw.uk> show route logical-router trap table inetflow.0 extensive inetflow.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden) 192.168.0.1,10.0.0.1,proto=6,port=80,dstport=3128,>8080&<8088,srcport>1024/256 (1 entry, 0 announced) *BGP Preference: 170/-101 Next hop type: Fictitious Next-hop reference count: 1 State: <Active Ext> Peer AS: 65500 Age: 1:13 Task: BGP_65500_30740.82.219.131.242+32319 AS path: 65500 I Communities: no-export traffic-rate:0:0 Localpref: 100 Router ID: 82.219.131.242

1 0

Research Project: Internet capacity during pandemic events
by haska＠ualberta.ca 03 Feb '10

03 Feb '10

Hello everyone, My name is Mike Haska, and I am a graduate student at the University of Alberta. I am conducting research into Internet capacity issues during pandemic events. In order to analyze certain aspects of this topic, I need to get in touch with representatives from the major Internet service providers in Canada - some of whom, I am hoping, are members of this distribution. Specifically, I am looking to get in touch with individuals who are familiar with the structure of their network and with any pandemic contingency plans that are in place within their organization. If you think you may be able to assist, or if you know of anyone who could, please contact me at (haska at ualberta.ca) and I will provide further information on all aspects of this study. To put your mind at ease - I'm not fishing around for sensitive information or your root passwords; I'm looking for an overview of your policies and your responses to hypothetical scenarios. Your confidentiality is assured and you are welcome to preview all the questions to be asked before you commit to participating in any way. I feel this topic has important implications to network operators in Canada, so any support you can offer to this research project is greatly appreciated. Best regards, -Mike

4 3

Re: Fiber Cut in CA?
by charles＠knownelement.com 03 Feb '10

03 Feb '10

That is one long protect path. Yikes. Sent via BlackBerry from T-Mobile

8 7

RE: Datacenter for DR in northwestern NJ/NY
by Ray Sanders 02 Feb '10

02 Feb '10

Datapipe has a facility in N.J... Not sure if they are 50mi from NYC Mobile email powered by the force... ---- Original Message ---- From: "Matt Sprague" <msprague(a)readytechs.com> Date: 2/2/10 2:19 pm To: "nanog(a)nanog.org" <nanog(a)nanog.org> Subj: Datacenter for DR in northwestern NJ/NY Hello NANOG! Does anyone know of some strong datacenters in northwestern NJ, or north of Westchester NY without getting too far away from NYC? I'm looking for a DR colo solution for a site that is in NYC; this needs to be at least 50m away from NYC, but I'm trying to keep it not too much further than that for convenience. I'm also trying to keep this to top level providers as there may be compliance requirements. Thanks in advance for any responses. -- Matt Sprague ReadyTechs, LLC msprague(a)readytechs.com<mailto:msprague@readytechs.com> 973-455-0606 x1204 (voice) http://www.readytechs.com/

3 2

Re: NREN Network Design
by Tarig Y. Adam 02 Feb '10

02 Feb '10

Hi Stephane thanks, your scheme is very expressive.And sorry for forgetting to send this message to my own list (afnog). regarding the subject the next hop of default route of our customers are ISP routers then SUIN routers. Is this a normal situation??? Normal0falsefalsefalseEN-USX-NONEAR-SAMicrosoftInternetExplorer4 /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin;} --------------------------------- Eng. Tarig Yassin Adam Sudanese Universities' Information Network (SUIN) T: +249925659149 ----- Original Message ----- From: Stephane Bortzmeyer <bortzmeyer(a)nic.fr> To: Tarig Yassin Adam <tarig(a)suin.edu.sd> Cc: Phil Regnauld <regnauld(a)nsrc.org> , <afnog(a)afnog.org> Date: Tuesday, February 2 2010 11:40 AM Subject: Re: NREN Network Design On Mon, Feb 01, 2010 at 10:04:07PM -0500, Tarig Yassin Adam <tarig(a)suin.edu.sd> wrote a message of 597 lines which said: > hi phil [And thanks for forwarding this discussion where it belongs. It is sad that a discussion on an african NREN was first carried to a North America list.] > We already applied to AfriNIC, they allocated to us /18 ipv4 we're > using two ISPs to connect to our customers and the same time we're > using these ISPs for the Internet. And you use BGP? You have your own AS? > The ISP using tunnel layer 3. I am sorry, I cannot parse this sentence. > For customer sites to reach our NOC they need next hop to the ISP > routers which we do not have a control. The way I understand it (you are really short on details), the universities are your customers and there is always an ISP between NREN and UNI: +---------+ | | +---------+ | NREN |---------| ISP 1 |------- UNI 1 +---------+ +---------+ | | \ +--------+ | \ | ISP 2 | +-----------+ \ +--------+-------| Internet | +--------+ | | +-----------+ | UNI 2 | | | | | +------+ +-------+ +--------+ |UNI 3 | | UNI 4 | +------+ +-------+ Is my schema OK? If no, please provide yours. If yes, I wonder, what service provides the NREN if no connectivity? If you just provide Internet servers (HTTP, XMPP, etc), there is no need to "tunnel" anything over the ISP.

1 0