- NANOG - lists.nanog.org

RE: IPv6 network boundaries vs. IPv4
by John van Oppen 27 Aug '07

27 Aug '07

We did the same thing... It seems easiest from a management perspective to copy the ipv4 logical layer with v6. The only change on our side was the fixed prefix length which if anything was a nice change. We did run into a few devices (old layer 3 switches) that don't support ipv6 and on those we either did not deploy IPv6 or moved the routing off for both v4 and v6 to the nearest "core" router that could handle v6 for any vlans that required the v6 capability. John van Oppen Spectrum Networks LLC 206.973.8302 (Direct) http://spectrumnetworks.us -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Valdis.Kletnieks(a)vt.edu Sent: Monday, August 27, 2007 10:25 AM To: John Osmon Cc: nanog(a)merit.edu Subject: Re: IPv6 network boundaries vs. IPv4 On Sat, 25 Aug 2007 23:56:29 MDT, John Osmon said: > > Is anyone out there setting up routing boundaries differently for > IPv4 and IPv6? I'm setting up a network where it seems to make > sense to route IPv4, while bridging IPv6 -- but I can be talked > out of it rather easily. We decided to map our IPv6 subnets one-to-one to our IPv4, so each of our routed /22 to /27 subnets gets a /64 IPv6 prefix. This however was just due to the fact that our topology permitted that - your mileage may vary.

3 2

Operational Feedback Requested on Pending Standard
by Ted Seely 27 Aug '07

27 Aug '07

All, Below is an email sent to the IETF OPS Area mailing list soliciting feedback from operators regarding firewalls. We would also appreciate feedback from the Operators Mailing Lists. Please respond to the OPS Area mailing list if you have a position on the item below. You can subscribe to the Operations and Management Area mailing list at the URL below if you are not already subscribed. https://www.ietf.org/mailman/listinfo/ops-area On behalf of the OPS Area Directors and myself, thank you. Ted - With OPS Area WG Hat On -------------------------------------------------------------- During the final review phases of the review of http://www.ietf.org/internet-drafts/draft-ietf-midcom-mib-09.txt the issue described below surfaced. It is actually not completely new, it was discussed in the past in a form or another, and it is not necessarily specific to this document and MIB module only, but also to other MIB modules. We believe that input from network operators can help, and we solicit this input. The MIDCOM-MIB defines tables containing firewall rules, indexed by ifIndex. ifIndex values can change when interfaces are swapped or devices reboot, and this could lead to rules being applied to the wrong interface. How do you, network operators, prefer interfaces be identified? - Is ifIndex the preferred choice even though the indices can change on reboot? - Is ifName a better choice for identifying interfaces in rules, since it is set by the device and remains fairly stable across reboots and is guaranteed to be unique? - is ifAlias a better choice, since it can be set by operators, although it is not guaranteed to be unique? We would appreciate inputs and thank you for your cooperation.

2 1

IPv6 network boundaries vs. IPv4
by John Osmon 27 Aug '07

27 Aug '07

Is anyone out there setting up routing boundaries differently for IPv4 and IPv6? I'm setting up a network where it seems to make sense to route IPv4, while bridging IPv6 -- but I can be talked out of it rather easily. Years ago, I worked on a academic network where we had a mix of IPX, DECnet, Appletalk, and IP(v4). Not all of the routers actually routed each protocol -- DECnet wasn't routable, and I recall some routers that routed IPX, while bridging IP... This all made sense at the time -- there were IPX networks that needed to be split, while IP didn't need to be. DECnet was... DECnet -- and Appletalk was chatty, but useful. I keep hearing the mantra in my head of: "I want my routers to route, and my switches to switch." I agree wholeheartedly if there is only one protocol -- but with the mix of IPv4 and IPv6, are there any folks doing things differently? With a new protocol in the mix are the lessons of the last 10 (or so) years not as clear-cut?

7 7

Re: Cogent latency / congestion
by Paul Ferguson 27 Aug '07

27 Aug '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For what its worth: [snip] Internet service providers in the U.S. experienced a service slowdown Monday after fiber-optic cables near Cleveland were apparently sabotaged by gunfire. [snip] More: http://www.networkworld.com/news/2007/082107-gunplay-blamed-for-internet.ht ml - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFGyj7/q1pz9mNUZTMRAo/yAJ0X199ex+1fWEp6PW8fKwTkhJKvOwCeMQmA rD+mWO/IT94i9kt7u6Ls/q4= =rGFI -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

12 15

ICMP being dropped between Global Crossings and Onvoy
by Brian Raaen 27 Aug '07

27 Aug '07

I have a network (AS33234) I am trying to support that is downstream from Onvoy on one of their connections. Our monitoring equipment is located in AS4452. Our monitoring system is not able to ping their network through Onvoy. The block seems to be happening at either Global Crossings or Onvoy. We are able to reach them using any protocol other than an ICMP ping (We are able to traceroute). Does anyone else know about or see a similar block going on. I have attached part of a traceroute. 2 suwC6.gig3-1-4.qualitytech.com (216.154.207.145) [AS 20141] 0 msec 0 msec 4 msec 3 suw04-gig1-0-0.qualitytech.com (216.154.207.173) [AS 20141] 0 msec 0 msec 0 msec 4 gig6-2.suwangaeq01w.cr.deltacom.net (66.35.174.165) [AS 6983] 4 msec 0 msec 0 msec 5 * * * 6 pos5-0.atlngapk22w.cr.deltacom.net (66.35.174.101) [AS 6983] 0 msec 4 msec 0 msec 7 so-0-0-0.ar3.DAL1.gblx.net (64.208.169.141) [AS 3549] 4 msec 4 msec 4 msec 8 so1-0-0-622M.ar2.MIN1.gblx.net (67.17.71.34) [AS 3549] 44 msec 44 msec 44 msec 9 WBS-CONNECT-LLC-Minneapolis.ge-2-3-0.409.ar2.MIN1.gblx.net (64.215.81.82) [AS 3549] 44 msec 44 msec 44 msec 10 * * * 11 * * * 12 WikstromTel-7003.onvoy.net (137.192.32.30) [AS 5006] 52 msec 52 msec 56 msec -- Brian Raaen Network Engineer braaen(a)zcorum.com

1 0

Re: equinix dc2 contact
by Randy Bush 26 Aug '07

26 Aug '07

thanks! verio noc beat you to it. but thanks! randy

1 0

equinix dc2 contact
by Randy Bush 26 Aug '07

26 Aug '07

anyone have a phone contact number for equinix ashburn dc2? i am in tokyo and a box in dc2 needs an attitude adjustment. thanks. randy

1 0

Community input/questions for ISOI 3?
by Gadi Evron 26 Aug '07

26 Aug '07

Hi, like last time, we are looking for community input and questions for the Internet security operations community, to be discussed during ISOI 3. ISOI is happening this Monday and Tuesday, we will likely compile the responses in a few weeks. We will reply to people personally on issues which bother them, and compile a short text with answers to the community itself here on NANOG. We tried to do this last time around, and encountered a problem with classifying which material the presenters allow for public consumtion, and which is to remain private due to obvious concerns. This time around we ask them ahead of time. The current topics being discussed at ISOI 3 can be located on the schedule: http://isotf.org/isoi3.html We may be off though, so feel free to ask on any issue which you find to be operational. Thanks, we appreciate the community's participation. Gadi.

1 0

spammer from outer space? (routing error)
by Peter Dambier 25 Aug '07

25 Aug '07

I just caught this one: 2007-08-25 16:57:52 SMTP connection from [125.187.32.144]:45885 (TCP/IP connection count = 1) 2007-08-25 16:58:11 SMTP connection from [125.187.32.222]:52495 (TCP/IP connection count = 2) 2007-08-25 16:58:22 ident connection to 125.187.32.144 timed out 2007-08-25 16:58:25 no host name found for IP address 125.187.32.144 Traceroute says: traceroute to 125.187.32.144 (125.187.32.144), 30 hops max, 40 byte packets 1 krzach.peter-dambier.de (192.168.48.2) 1.112 ms 1.590 ms 1.774 ms 2 * * * 3 217.0.78.54 83.412 ms 83.446 ms 183.549 ms 4 217.239.40.33 183.582 ms 190.061 ms 207.031 ms 5 dt-gw.n54ny.ip.att.net (192.205.32.57) 207.000 ms * * 6 * * * 7 12.122.16.137 268.719 ms 275.778 ms 284.531 ms 8 cr1.cgcil.ip.att.net (12.122.1.190) 209.032 ms 217.048 ms 223.948 ms 9 12.122.17.130 229.927 ms 237.691 ms 245.808 ms 10 tbr1.sffca.ip.att.net (12.122.10.6) 252.838 ms 260.754 ms 269.676 ms 11 12.122.110.5 277.657 ms 576.902 ms * 12 * * * 13 * * * 14 203.255.234.221 357.076 ms 357.083 ms 372.057 ms 15 210.120.246.65 379.221 ms 395.135 ms 395.169 ms 16 210.120.117.6 410.197 ms 210.120.248.250 420.023 ms 427.029 ms 17 210.120.244.94 360.443 ms 360.451 ms 210.120.244.90 368.292 ms 18 210.120.104.146 389.240 ms 203.248.223.82 389.274 ms 746.508 ms 19 * * * 22 * * * 23 125.187.32.144(H!) 351.850 ms (H!) 359.870 ms (H!) 367.696 ms But whois keeps telling me: ReferralServer: whois://whois.apnic.net NetRange: 125.0.0.0 - 125.255.255.255 CIDR: 125.0.0.0/8 NetName: APNIC-125 NetHandle: NET-125-0-0-0-1 Parent: NetType: Allocated to APNIC Comment: This IP address range is not registered in the ARIN database. Comment: For details, refer to the APNIC Whois Database via Comment: WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl Comment: ** IMPORTANT NOTE: APNIC is the Regional Internet Registry Comment: for the Asia Pacific region. APNIC does not operate networks Comment: using this IP address range and is not able to investigate Comment: spam or abuse reports relating to these addresses. For more Comment: help, refer to http://www.apnic.net/info/faq/abuse RegDate: 2005-01-27 Updated: 2005-05-20 OrgTechHandle: AWC12-ARIN OrgTechName: APNIC Whois Contact OrgTechPhone: +61 7 3858 3100 OrgTechEmail: search-apnic-not-arin(a)apnic.net So I should never have seen a packet from them? Kind regards Peter and Karin -- Peter and Karin Dambier Cesidian Root - Radice Cesidiana Rimbacher Strasse 16 D-69509 Moerlenbach-Bonsweiher +49(6209)795-816 (Telekom) +49(6252)750-308 (VoIP: sipgate.de) mail: peter(a)peter-dambier.de mail: peter(a)echnaton.arl.pirates http://iason.site.voila.fr/ https://sourceforge.net/projects/iason/ http://www.cesidianroot.com/

6 6

3561 policy meltdown overnight?
by Jared Mauch 25 Aug '07

25 Aug '07

I'm curious if anyone else noticed the 3561 routing policy meltdown overnight. It was most obvious to me in the 10k+ line emails I got from my routing leak system, but i'm curious if others noticed this or any related outages as a result? - jared http://puck.nether.net/bgp/leakinfo.cgi?search=do&search_prefix=&search_asp… -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

2 2