- NANOG - lists.nanog.org

Re: ISP best practices
by Cody Appleby 21 May '09

21 May '09

Have to agree on PowerDNS and PowerAdmin. Very easy to setup, Pretty secure out of the box and management is a breeze! ./cwa On Thu, 21 May 2009 16:29:57 +0100, Ben Cooper <ben(a)hns.net> wrote: > I've deployed PowerDNS before, along with PowerAdmin > (https://www.poweradmin.org/trac/) Very easy to set up and manage. > > Ben > > For system or network support, please email support(a)hns.net > > Curtis Maurand wrote: >> >> Check out www.powerdns.com as an alternative to bind. Its faster, more >> secure, does IPV6 and easier to maintain. >> >> Curtis >> >> Philip Lavine wrote: >>> To all, >>> >>> I am sure this has been asked 10 to the 1 millionth power times, >>> however may be the rules have changed. I am looking to set up a really >>> small ISP with a few /24's. I want to host DNS as well. Is there any >>> whitepapers/howtos/best practices on setting up multihomed BGP and DNS >>> with BIND so I don't blow up the Internet. >>> >>> Thx >>> >>> Philip >>> >>> >>> >>> >>> >> >> >> >>

1 0

NPE-G2 vs. Sup720-3BXL
by David Storandt 21 May '09

21 May '09

We're stuck in an engineering pickle, so some experience from this crew would be useful in tie-breaking... We operate a business-grade FTTx ISP with ~75 customers and 800Mbps of Internet traffic, currently using 6509/Sup2s for core routing and port aggregation. The MSFC2s are under stress from 3x full route feeds, pared down to 85% to fit the TCAM tables. One system has a FlexWAN with an OC3 card and it's crushing the CPU on the MSFC2. System tuning (stable IOS and esp. disabling SPD) helped a lot but still doesn't have the power to pull through. Hardware upgrades are needed... We need true full routes and more CPU horsepower for crunching BGP (+12 smaller peers + ISIS). OC3 interfaces are going to be mandatory, one each at two locations. Oh yeah, we're still a larger startup without endless pockets. Power, rack space, and SmartNet are not concerns at any location (on-site cold spares). We may need an upstream OC12 in the future but that's a ways out and not a concern here. Our engineering team has settled on three $20k/node options: - Sup720-3BXLs with PS and fan upgrades - Sup2s as switches + ISIS + statics and no BGP, push BGP edge routing off to NPE-G2s across a 2-3Gbps port-channel - Sup2s as switches + ISIS + statics and no BGP, push BGP edge routing off to a 12008 with E3 engines across a 2-3Gbps port-channel. Ideas and constructive opinions welcome, especially software and stability-related. Many thanks, -Dave

13 15

Temporary mail queue services?
by Mike Lyon 21 May '09

21 May '09

Hello All, Does anyone know of a service that you can sign up for to add as a secondary MX to act as a mail queue if your primary MX isn't available? I'm going to be doing a mail migration and I need a service to point my MX record to that isn't my mail provider. I'll spare the details as to why it needs to be different provider. Any insight would be greatly appreciated. Thank You, Mike

5 4

IPv6 iperf testing
by Steve Bertrand 21 May '09

21 May '09

Hi all, I have a very quick selfish question... Is there anyone here who can provide me with an IPv6-listening iperf for a short time, so I can do some testing through my infrastructure and over my transit links? Max bandwidth 60Mb for short bursts (if I'm lucky). Steve

1 1

Re: Temporary mail queue services?
by Brielle Bruns 20 May '09

20 May '09

DNSPark does - they're one of my favorite companies and have an actual live support contact. (No, I don't work for them). I also personally do backup MX stuff, depending on if its personal or business, and how much email you need spooled. Brielle (On her crackberry) ------Original Message------ From: Mike Lyon To: NANOG Subject: Temporary mail queue services? Sent: May 20, 2009 1:18 PM Hello All, Does anyone know of a service that you can sign up for to add as a secondary MX to act as a mail queue if your primary MX isn't available? I'm going to be doing a mail migration and I need a service to point my MX record to that isn't my mail provider. I'll spare the details as to why it needs to be different provider. Any insight would be greatly appreciated. Thank You, Mike -- Brielle Bruns http://www.sosdg.org / http://www.ahbl.org

1 0

partial routes for AS701 and AS3365
by Zaid Ali 20 May '09

20 May '09

Anyone here doing partial routes with AS701 and AS3356? If so can you tell me how many routes you are receiving? Thanks, Zaid

1 0

MX problems
by Polar Humenn 20 May '09

20 May '09

I'm in Syracuse NY, and I'm having problems getting sendmail to get to MX servers, with the errors of "No Route to Host" or "Connection timed Out". Apparently this is been happening for over 5 days. I can send mail within Syracuse University, but as soon as I venture out nothing. Traceroute seems to loose it after about the 9 or 10th hop. It seems that I can get to almost any website, but tracerouting or pinging these MX servers is not happening. Is there anything going on, or at least something that started 5-7 days ago? I find the same problem from within Syracuse Univeristy to my RoadRunner account at home (which does not pass through the university routers). I only noticed it from the university since thats where I usually send my email through. Like I would no have been able to post to this list >From my home machine: > traceroute s0.nanog.org traceroute to s0.nanog.org (198.108.95.20), 30 hops max, 60 byte packets 1 192.168.99.1 (192.168.99.1) 0.211 ms 0.257 ms 0.302 ms 2 10.217.224.1 (10.217.224.1) 13.754 ms 13.855 ms 14.291 ms 3 gig2-2.syrcnysyr-rtr01.nyroc.rr.com (24.92.231.138) 18.442 ms 22.701 ms 26.908 ms 4 gig1-1-0.syrcnyflk-rtr02.nyroc.rr.com (24.92.231.54) 31.279 ms 31.454 ms 31.591 ms 5 ge-4-3-0.albynywav-rtr03.nyroc.rr.com (24.24.7.53) 37.429 ms 37.604 ms 37.779 ms 6 ae-5-0.cr0.nyc30.tbone.rr.com (66.109.6.74) 41.329 ms 18.241 ms 22.192 ms 7 ae-1-0.pr0.nyc20.tbone.rr.com (66.109.6.163) 27.472 ms 19.542 ms 23.419 ms 8 te1-4.mpd01.jfk05.atlas.cogentco.com (154.54.13.185) 28.070 ms 32.824 ms 35.822 ms 9 te9-3.ccr01.jfk02.atlas.cogentco.com (154.54.3.165) 40.796 ms 40.549 ms te2-4.ccr01.jfk02.atlas.cogentco.com (154.54.6.49) 40.958 ms 10 te2-4.mpd01.bos01.atlas.cogentco.com (154.54.5.249) 48.704 ms 47.549 ms 48.468 ms 11 te2-2.ccr01.ord01.atlas.cogentco.com (154.54.6.154) 57.836 ms te8-8.mpd01.ord01.atlas.cogentco.com (154.54.24.54) 58.063 ms te2-2.mpd01.ord01.atlas.cogentco.com (154.54.6.18) 46.700 ms 12 vl3488.mpd01.ord03.atlas.cogentco.com (154.54.5.26) 56.905 ms te3-4.mpd01.ord03.atlas.cogentco.com (154.54.6.206) 56.144 ms vl3488.mpd01.ord03.atlas.cogentco.com (154.54.5.26) 45.245 ms 13 Merit.demarc.cogentco.com (38.112.7.10) 44.512 ms Merit.demarc.cogentco.com (66.28.21.234) 38.385 ms Merit.demarc.cogentco.com (38.112.7.10) 40.305 ms 14 tenge0-0-0-0x76.aa2.mich.net (198.108.23.10) 43.637 ms 42.601 ms 43.902 ms 15 198.108.22.186 (198.108.22.186) 48.455 ms 51.436 ms 44.070 ms 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * Any ideas? Cheers, -Dr Polar

8 10

RE: MX problems
by Skywing 19 May '09

19 May '09

Firewalling based on a static port number is now DPI? - S -----Original Message----- From: Warren Bailey <wbailey(a)gci.com> Sent: Tuesday, May 19, 2009 16:25 To: gmclean(a)xilogix.net <gmclean(a)xilogix.net>; polar.humenn(a)gmail.com <polar.humenn(a)gmail.com> Cc: nanog(a)nanog.org <nanog(a)nanog.org> Subject: Re: MX problems Or... His provider is using dpi to drop packets destined for non provider mx servers. This would certainly reduce spam from compromised hosts. ----- Original Message ----- From: Gregory McLean <gmclean(a)xilogix.net> To: Polar Humenn <polar.humenn(a)gmail.com> Cc: nanog(a)nanog.org <nanog(a)nanog.org> Sent: Tue May 19 15:19:23 2009 Subject: Re: MX problems On Tue, 2009-05-19 at 19:02 -0400, Polar Humenn wrote: > >From my mail log. Geez, I can't even get to Cornell, which is just down the > friggin road! (Yeah, I know, but really). > What is going on? > > May 19 18:58:26 greene postfix/smtp[5895]: connect to > mailin-01.mx.AOL.COM[205.188.159.57]: > No route to host (port 25) > May 19 18:58:27 greene postfix/smtp[5904]: connect to > penguin.cs.cornell.edu[128.84.96.11]: > No route to host (port 25) > May 19 18:58:27 greene postfix/smtp[5899]: connect to > mx.vgs.untd.com[64.136.52.37]: > No route to host (port 25) > May 19 18:58:27 greene postfix/smtp[5919]: connect to > incoming3.american.edu[147.9.1.250]: > No route to host (port 25) > May 19 18:58:30 greene postfix/smtp[5904]: connect to > iago.cs.cornell.edu[128.84.96.10]: > No route to host (port 25) > May 19 18:58:30 greene postfix/smtp[5904]: 0992D8DDE: to=< > simeon(a)cs.cornell.edu>, relay=none, delay=371744, status=deferred (connect > to iago.cs.cornell.edu[128.84.96.10]: No route to host) > May 19 18:58:30 greene postfix/smtp[5919]: connect to > incoming2.american.edu[147.9.1.249]: > No route to host (port 25) > May 19 18:58:30 greene postfix/smtp[5919]: 5F6AC8C0E: to=<drshow(a)wamu.org>, > relay=none, delay=116954, status=deferred (connect to > incoming2.american.edu[147.9.1.249]: > No route to host) > May 19 18:58:33 greene postfix/smtp[5901]: connect to > cisbec.net.s6a1.psmtp.com[64.18.5.10]: No route to host (port 25) > May 19 18:58:33 greene postfix/smtp[5913]: connect to > smtp-mx6.mac.com[17.148.20.69]: > No route to host (port 25) > May 19 18:58:35 greene postfix/smtp[5895]: connect to > mailin-01.mx.AOL.COM[205.188.156.248]: > No route to host (port 25) > May 19 18:58:36 greene postfix/smtp[5899]: connect to > mx.dca.untd.com[64.136.44.37]: > No route to host (port 25) > May 19 18:58:36 greene postfix/smtp[5899]: D3A158876: to=<becward(a)JUNO.COM>, > relay=none, delay=183359, status=deferred (connect to > mx.dca.untd.com[64.136.44.37]: > No route to host) > May 19 18:58:42 greene postfix/smtp[5901]: connect to > cisbec.net.s6a2.psmtp.com[64.18.5.11]: No route to host (port 25) > May 19 18:58:45 greene postfix/smtp[5901]: connect to > cisbec.net.s6b1.psmtp.com[64.18.5.13]: No route to host (port 25) > May 19 18:58:45 greene postfix/smtp[5910]: connect to > hrndva-smtpin01.mail.rr.com[71.74.56.243]: No route to host (port 25) > May 19 18:58:48 greene postfix/smtp[5901]: connect to > cisbec.net.s6b2.psmtp.com[64.18.5.14]: No route to host (port 25) > May 19 18:58:48 greene postfix/smtp[5901]: 0992D8DDE: to=< > arahant1(a)cisbec.net>, relay=none, delay=371762, status=deferred (connect to > cisbec.net.s6b2.psmtp.com[64.18.5.14]: No route to host) > I smell a port blocking going on... Or a mis config on a firewall. (A firewall/router set to reject with icmp-host-prohibited) That would be my guess.

1 0

Re: MX problems
by Warren Bailey 19 May '09

19 May '09

Or... His provider is using dpi to drop packets destined for non provider mx servers. This would certainly reduce spam from compromised hosts. ----- Original Message ----- From: Gregory McLean <gmclean(a)xilogix.net> To: Polar Humenn <polar.humenn(a)gmail.com> Cc: nanog(a)nanog.org <nanog(a)nanog.org> Sent: Tue May 19 15:19:23 2009 Subject: Re: MX problems On Tue, 2009-05-19 at 19:02 -0400, Polar Humenn wrote: > >From my mail log. Geez, I can't even get to Cornell, which is just down the > friggin road! (Yeah, I know, but really). > What is going on? > > May 19 18:58:26 greene postfix/smtp[5895]: connect to > mailin-01.mx.AOL.COM[205.188.159.57]: > No route to host (port 25) > May 19 18:58:27 greene postfix/smtp[5904]: connect to > penguin.cs.cornell.edu[128.84.96.11]: > No route to host (port 25) > May 19 18:58:27 greene postfix/smtp[5899]: connect to > mx.vgs.untd.com[64.136.52.37]: > No route to host (port 25) > May 19 18:58:27 greene postfix/smtp[5919]: connect to > incoming3.american.edu[147.9.1.250]: > No route to host (port 25) > May 19 18:58:30 greene postfix/smtp[5904]: connect to > iago.cs.cornell.edu[128.84.96.10]: > No route to host (port 25) > May 19 18:58:30 greene postfix/smtp[5904]: 0992D8DDE: to=< > simeon(a)cs.cornell.edu>, relay=none, delay=371744, status=deferred (connect > to iago.cs.cornell.edu[128.84.96.10]: No route to host) > May 19 18:58:30 greene postfix/smtp[5919]: connect to > incoming2.american.edu[147.9.1.249]: > No route to host (port 25) > May 19 18:58:30 greene postfix/smtp[5919]: 5F6AC8C0E: to=<drshow(a)wamu.org>, > relay=none, delay=116954, status=deferred (connect to > incoming2.american.edu[147.9.1.249]: > No route to host) > May 19 18:58:33 greene postfix/smtp[5901]: connect to > cisbec.net.s6a1.psmtp.com[64.18.5.10]: No route to host (port 25) > May 19 18:58:33 greene postfix/smtp[5913]: connect to > smtp-mx6.mac.com[17.148.20.69]: > No route to host (port 25) > May 19 18:58:35 greene postfix/smtp[5895]: connect to > mailin-01.mx.AOL.COM[205.188.156.248]: > No route to host (port 25) > May 19 18:58:36 greene postfix/smtp[5899]: connect to > mx.dca.untd.com[64.136.44.37]: > No route to host (port 25) > May 19 18:58:36 greene postfix/smtp[5899]: D3A158876: to=<becward(a)JUNO.COM>, > relay=none, delay=183359, status=deferred (connect to > mx.dca.untd.com[64.136.44.37]: > No route to host) > May 19 18:58:42 greene postfix/smtp[5901]: connect to > cisbec.net.s6a2.psmtp.com[64.18.5.11]: No route to host (port 25) > May 19 18:58:45 greene postfix/smtp[5901]: connect to > cisbec.net.s6b1.psmtp.com[64.18.5.13]: No route to host (port 25) > May 19 18:58:45 greene postfix/smtp[5910]: connect to > hrndva-smtpin01.mail.rr.com[71.74.56.243]: No route to host (port 25) > May 19 18:58:48 greene postfix/smtp[5901]: connect to > cisbec.net.s6b2.psmtp.com[64.18.5.14]: No route to host (port 25) > May 19 18:58:48 greene postfix/smtp[5901]: 0992D8DDE: to=< > arahant1(a)cisbec.net>, relay=none, delay=371762, status=deferred (connect to > cisbec.net.s6b2.psmtp.com[64.18.5.14]: No route to host) > I smell a port blocking going on... Or a mis config on a firewall. (A firewall/router set to reject with icmp-host-prohibited) That would be my guess.

1 0

Fore ATM PCI cards
by Joe Greco 19 May '09

19 May '09

I've poked around trying to figure out how not to just dump these in the trash. isp-equipment seems to be dead, etc. They're obscure and NANOG's about the only group I would think of where ATM guys might still hang out. :-) Free to a good home: a small supply of Fore ATM OC3 fiber and copper cards, mostly PCA-200. Looks like about a dozen, more fiber than copper. Replies to me only. If you know of anyone who'd be interested, let me know. ... JG -- Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net "We call it the 'one bite at the apple' rule. Give me one chance [and] then I won't contact you again." - Direct Marketing Ass'n position on e-mail spam(CNN) With 24 million small businesses in the US alone, that's way too many apples.

1 1