- NANOG - lists.nanog.org

ADMIN: List FAQ/Monthly Post.
by NANOG Mail List Committee 17 Mar '09

17 Mar '09

This 100-line document contains 62% of what you need to know to avoid annoying 10,000 people in your email to the NANOG list. It also contains pointers to another 23%. Please take 5 minutes to read it before you post [again]. General Information =================== About NANOG: http://www.nanog.org/about/ NANOG News: http://www.nanog.org/ NANOG lists and AUP: http://www.nanog.org/mailinglist/ NANOG List FAQ: http://www.nanog.org/mailinglist/listfaqs/ To Subscribe or Unsubscribe from the list: http://mailman.nanog.org/mailman/listinfo/nanog To contact the list's admins: admins(a)nanog.org Posting Policy ============== The NANOG list has over 10,000 subscribers so it is very easy for a thread to have scores of posts while being off-topic and only of interest to only a small proportion of subscribers. Please consider before each post if your email will be of interest to the majority of members or might alternatively be emailed directly the people of interest or posted to another forum. Please read the FAQ and AUP policy before posting for more details. Especially the following are discouraged: * Is a certain site down? Other Outages not affecting half the Internet. Please use http://downforeveryoneorjustme.com/ or a similar site. Please post to the Outages mailing list: http://wiki.outages.org * Spam Please use SPAM-L - http://www.claws-and-paws.com/spam-l * Contacting People * http://puck.nether.net/netops/ * Please try other methods of contacting sites before you post to NANOG. Saying something like "I tried calling 213-555-3333 but no answer" shows you _have_ tried alternative methods first. * Political Issues * Topics such as ICANN policy, Government Policy or Law changes that do not have short term Operational impact should be avoided. * Operation topics with more specific lists * DNS - http://lists.oarci.net/mailman/listinfo/dns-operations * Email - http://www.mailop.org/ * NANOG Mailing list policy Please use the nanog-futures list or contact admins(a)nanog.org Please also avoid ================= * Sending posts to the list relevant to only one or two people on this list, such as tests or traceroutes in response to another post for comparison to those originally posted. * Jokes, Puns, amusing observations, spelling corrections. Other NANOG related lists ========================= * NANOG-futures - for discussion of the evolution of NANOG, including organizational structure, policies and procedures, and agendas for NANOG meetings. Such topics aren't appropriate for the main NANOG mailing list. http://mailman.nanog.org/mailman/listinfo/nanog-futures * nanog-attendee - For discussion of venue-specific issues relevant to attendees of the current NANOG physical meeting. http://mailman.nanog.org/mailman/listinfo/nanog-attendee * nanog-announce - For announcements of NANOG meetings an other Important NANOG related announcements. Low traffic and all posts are also sent to main list. http://mailman.nanog.org/mailman/listinfo/nanog-announce Other Mailing Lists =================== Information about related lists: http://www.nanog.org/mailinglist/listfaqs/otherlists.php

1 0

Pro-actively publishing IRR data
by Steve Bertrand 16 Mar '09

16 Mar '09

I'm still working on trying to get my primary provider to BGP peer with us, but in the meantime, I'd like to pro-actively publish our objects and route policy to the IRR. My primary provider is currently advertising our IPv4 routes for us from their AS. Are there any potential dangers of publishing our information before we use it that I may be overlooking? Steve

2 2

AT&T Wireless Data Contact
by James Ribar 16 Mar '09

16 Mar '09

Hi, Our half or dozen or so iPhone users are experiencing issues with accessing our corporate website and email services. I spoke to AT&T's support who after a few minutes told me it wasn't an ATT problem and forwarded me to Apple who said it was an issue with the website and were unable to help. I have verified that the website and email in question work just fine when connecting from other networks, ruling out in my book an issue on our end. As far as I can tell the issue seems to be with AT&T's DNS servers which are not resolving our domains properly. Accessing services by IP address works fine. In an effort to avoid being bounced back and forth on the phone all day between AT&T and Apple, is there anyone that can contact me off list who is able to help with this issue or point me in the right direction? Thanks, James

1 0

Netflow on SUP720-3BXL
by Andy Bierlair 16 Mar '09

16 Mar '09

I’m trying to run netflow on one of our Cisco core routers (SUP720-3BXL), but I think I am hitting some limitations because of this: %EARL_NETFLOW-SP-4-TCAM_THRLD: Netflow TCAM threshold exceeded, TCAM Utilization [99%] The setup of netflow looks like this: ip flow-cache entries 524288 mls aging fast time 5 threshold 32 mls aging long 300 mls aging normal 60 mls netflow usage notify 80 300 mls flow ip full no mls flow ipv6 mls nde sender version 5 no mls verify ip checksum no mls acl tcam share-global ip flow-export source Loopback0 ip flow-export version 5 origin-as ip flow-export destination <ip> <port> Then I have this enabled on all border interfaces/vlans (peering / transit / other core routers) that are of interest for my stats: ip route-cache flow Some more details about the problem: #sh mls netflow table-contention detailed Earl in Module 5 Detailed Netflow CAM (TCAM and ICAM) Utilization ================================================ TCAM Utilization : 100% ICAM Utilization : 13% Netflow TCAM count : 262033 Netflow ICAM count : 17 Netflow Creation Failures : 4822220 Netflow CAM aliases : 1 #sh mls netflow table-contention aggregate Earl in Module 5 Aggregate Netflow CAM Contention Information ============================================= Netflow Creation Failures : 130003616 Netflow Hash Aliases : 4 I understand that the TCAM is full, but what can I do against it? This is a busy core router: Aggregated traffic: 7-8 GBIT/s Packets per Second: 1.0 - 1.2 Million I wouldn't mind analyzing only every 10th or 100th flow, which seems to be a common practice. Any good piece of advice is welcome. Thanks! - Andy

4 3

Dynamic IP log retention = 0?
by Brett Charbeneau 16 Mar '09

16 Mar '09

I've been nudging an operator at Covad about a handful of hosts from his DHCP pool that have been attacking - relentlessly port scanning - our assets. I've been informed by this individual that there's "no way" to determine which customer had that address at the times I list in my logs - even though these logs are sent within 48 hours of the incidents. The operator advised that I block the specific IP's that are attacking us at my perimeter. When I mentioned the fact that blocking individual addresses will only be as effective as the length of lease for that DHCP pool I get the email equivalent of a shrug. "Well, maybe you want to ban our entire /15 at your perimeter..." I'm reluctant to ban over 65,000 hosts as my staff have colleagues all over the continental US with whom they communicate regularly. I realize these are tough times and that large ISP's may trim abuse team budgets before other things, but to have NO MECHANISM to audit who has what address at any given time kinda blows my mind. Does one have to get to the level of a subpoena before abuse teams pull out the tools they need to make such a determination? Or am I naive enough to think port scans are as important to them as they are to me on the receiving end? -- ******************************************************************** Brett Charbeneau, GSEC Gold, GCIH Gold Network Administrator Williamsburg Regional Library 7770 Croaker Road Williamsburg, VA 23188-7064 (757)259-4044 www.wrl.org (757)259-4079 (fax) brett(a)wrl.org ********************************************************************

34 57

Re: Netflow on SUP720-3BXL
by Andy Bierlair 15 Mar '09

15 Mar '09

yes ip cef, this is enabled: IP fast switching is enabled IP fast switching on the same interface is disabled IP Flow switching is enabled IP CEF switching is enabled IP Flow switching turbo vector IP Flow CEF switching turbo vector and so on... - Andy On Sun, Mar 15, 2009 at 3:08 AM, Bill Blackford <BBlackford(a)nwresd.k12.or.us> wrote: > > just a shot in the dark. Do you have 'ip cef' in global config? > > -b > ________________________________________ > From: Andy Bierlair [globichen(a)gmail.com] > Sent: Saturday, March 14, 2009 6:55 PM > To: nanog(a)nanog.org > Subject: Netflow on SUP720-3BXL > > I’m trying to run netflow on one of our Cisco core routers (SUP720-3BXL), > but I think I am hitting some limitations because of this: > > > > %EARL_NETFLOW-SP-4-TCAM_THRLD: Netflow TCAM threshold exceeded, TCAM > Utilization [99%] > > > > The setup of netflow looks like this: > > > > ip flow-cache entries 524288 > > mls aging fast time 5 threshold 32 > > mls aging long 300 > > mls aging normal 60 > > mls netflow usage notify 80 300 > > mls flow ip full > > no mls flow ipv6 > > mls nde sender version 5 > > no mls verify ip checksum > > no mls acl tcam share-global > > > > ip flow-export source Loopback0 > > ip flow-export version 5 origin-as > > ip flow-export destination <ip> <port> > > > > Then I have this enabled on all border interfaces/vlans (peering / transit / > other core routers) that are of interest for my stats: > > > > ip route-cache flow > > > > Some more details about the problem: > > > > #sh mls netflow table-contention detailed Earl in Module 5 Detailed Netflow > CAM (TCAM and ICAM) Utilization > ================================================ > > TCAM Utilization : 100% > > ICAM Utilization : 13% > > Netflow TCAM count : 262033 > > Netflow ICAM count : 17 > > Netflow Creation Failures : 4822220 > > Netflow CAM aliases : 1 > > > > > > #sh mls netflow table-contention aggregate Earl in Module 5 Aggregate > Netflow CAM Contention Information > ============================================= > > Netflow Creation Failures : 130003616 > > Netflow Hash Aliases : 4 > > > > > > I understand that the TCAM is full, but what can I do against it? This is a > busy core router: > > > > Aggregated traffic: 7-8 GBIT/s > > Packets per Second: 1.0 - 1.2 Million > > > > I wouldn't mind analyzing only every 10th or 100th flow, which seems to be a > common practice. > > > > Any good piece of advice is welcome. > > > > Thanks! > > > > - > Andy

2 1

Re: Sprint latency
by devang patel 15 Mar '09

15 Mar '09

I found this in my trace route: 1 if-13-0-0-818.mcore4.pdi-paloalto.as6453.net (66.198.97.18) 4 msec if-9-0-0.mcore4.pdi-paloalto.as6453.net (216.6.33.6) 0 msec if-13-0-0-818.mcore4.pdi-paloalto.as6453.net (66.198.97.18) 0 msec 2 sl-st20-pa-15-0.sprintlink.net (144.223.243.21) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 4 msec 0 msec 0 msec 3 sl-crs1-sj-0-14-0-1.sprintlink.net (144.232.8.109) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 8 msec 8 msec 8 msec 4 sl-crs1-stk-0-0-0-2.sprintlink.net (144.232.20.98) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 8 msec 8 msec 8 msec 5 sl-crs1-kc-0-6-3-0.sprintlink.net (144.232.8.170) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 56 msec 56 msec 56 msec 6 sl-bb21-nsh-10-0-0.sprintlink.net (144.232.18.113) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 76 msec 80 msec 80 msec 7 sl-crs1-atl-0-10-0-0.sprintlink.net (144.232.20.224) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 84 msec 84 msec 84 msec 8 sl-crs1-mia-0-8-0-2.sprintlink.net (144.232.18.221) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 92 msec 92 msec 92 msec 9 sl-crs1-mia-0-0-0-1.sprintlink.net (144.232.2.189) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 92 msec 92 msec 92 msec 10 sl-gw10-mia-11-0-0.sprintlink.net (144.232.28.65) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 92 msec 92 msec 96 msec 11 sl-racsa-211948-0.sprintlink.net (144.224.115.118) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 244 msec 248 msec 248 msec 12 200.122.191.182 [AS 3790] [MPLS: Label 49 Exp 0] 260 msec 256 msec 252 msec 13 200.122.191.142 [AS 3790] 248 msec 244 msec 240 msec thanks, Devang Patel On Sat, Mar 14, 2009 at 10:00 PM, Taylor Neill <taylor(a)dec0de.org> wrote: > Boston -> phoenix ~25% packet loss > > > On Sat, Mar 14, 2009 at 11:53 PM, devang patel <devangnp(a)gmail.com> wrote: > >> Hello, >> >> Any one is facing any latency in network passing trough sprint network, we >> have remote site and having trouble with accessing application from data >> centers. >> >> 7 200.122.150.22 0 msec 0 msec 4 msec >> >> *8 144.224.115.113 260 msec 276 msec 284 msec* >> >> * 9 144.232.2.244 276 msec 280 msec 292 msec* >> >> *10 144.232.2.204 292 msec 304 msec 300 msec* >> >> 11 144.223.162.42 120 msec 120 msec 120 msec >> thanks, >> Devang Patel >> > > > > -- > Taylor > 647.287.8632 >

1 0

Sprint latency
by devang patel 15 Mar '09

15 Mar '09

Hello, Any one is facing any latency in network passing trough sprint network, we have remote site and having trouble with accessing application from data centers. 7 200.122.150.22 0 msec 0 msec 4 msec *8 144.224.115.113 260 msec 276 msec 284 msec* * 9 144.232.2.244 276 msec 280 msec 292 msec* *10 144.232.2.204 292 msec 304 msec 300 msec* 11 144.223.162.42 120 msec 120 msec 120 msec thanks, Devang Patel

1 0

AT&T Security Contact
by Jeff Wheelhouse 14 Mar '09

14 Mar '09

Hi All, One of our customers has forwarded us a rambling, disjointed threat from someone sending from abuse(a)sbcglobal.net who claims to be "the Security Manager for AT&T Internet Services Security Center, its subsidiaries and affiliates" who won't provide a name or personal contact information but who promises to (and I quote) "DNS Block" some of the customer's IP's (in our allocation) over a problem AT&T has with one of the customer's customers. After reading the message, I checked the situation myself and the problem complained about appears to have been resolved some time ago, if it ever existed at all. Also, the IP's in question are not, as far as I know, DNS servers; I am quite sure they are shared hosting IP's, so I don't know what AT&T is proposing to do, exactly, but it sounds like a threat to interfere with a bunch of innocent people's web sites for what appear to be bogus reasons. They have ignored multiple confirmed-delivery-I've-seen-the-logs attempts to respond by our customer, our customer's customer, and myself. Could I please get someone from AT&T to contact me off-list about this before it turns into a "thing?" Thanks! Jeff

1 0

Zombie Nation [Was: Re: Dynamic IP log retention = 0?]
by Paul Ferguson 14 Mar '09

14 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Sat, Mar 14, 2009 at 12:42 AM, Joe Greco <jgreco(a)ns.sol.net> wrote: > > I have worked for large ISP's, I understand corporate budgets and > politics, and I'm smart enough to understand that "corporate budgets and > politics" do not define what is acceptable within the framework of the > Internet. Were "corporate budgets and politics" to define that, we'd be > likely to see a balkanized, spam-riddled > ghost-of-what-used-to-be-the-Internet where the potential for making a > buck defines what is right and what is wrong. > As opposed to the spambot-infested, zombified Internet we have now? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) wj8DBQFJu2FKq1pz9mNUZTMRAvxJAJ9GNeEvWPyjMVyME6t6ZZWJ0Qr5hACgscPg r5qQGjqvhx4DUv+YSQnBe5A= =DEXn -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/

1 0