- NANOG - lists.nanog.org

firewall recommendations?
by Matt Hess 22 Mar '06

22 Mar '06

I'm looking for a firewall that has a very high packet throughput rate, can handle minimal stun tasks, do server load balancing for http etc., handle many-to-one as well as bi-directional NAT and just plain works with high reliability/redundancy. Suggestions off list would be wonderful. Thanks.

2 1

Re: Network graphics tools
by Roger Marquis 22 Mar '06

22 Mar '06

John Kinsella wrote: > Not sure how preferring things like rectangles stops you from > using Visio, but *shrug* Probably has more to do with the other features of Visio. Hidden metadata, slow VBS, fragile registry dependencies, ... all of which engineers tend to discover before an important deadline. > Not trying to start a Visio religious war, just saying there's a reason > enterprises use it. Like most things enterprises use it because that's what they know. Managers also believe they "can't get fired for buying IBM". They will likely continue believing this until another manager comes along who knows open-source and how to use it for a better ROI. -- Roger Marquis Roble Systems Consulting http://www.roble.com/

1 0

Re: Final report: national diversity assurance initiative
by Frank Coluccio 22 Mar '06

22 Mar '06

It may be ridiculous and incredible, as you suggest, but, in an ironic way it also opens the door to a discussion on nationalizing the 'Net's backbone infrastructure ;-) ---------------- Christian Kuhtz <christian(a)kuhtz.com> wrote: "Due to the cost structures for these projects, the telecommunications carriers believe that funding for the scoping effort and the implementation of an automated solution would need to come from the Federal government or some other external source prior to project implementation." .. and not afraid to ask for handouts either to fix their own backoffice challenges.. In a word: ridiculous, and flat out incredible. On Mar 21, 2006, at 2:17 PM, Sean Donelan wrote: > > > ATIS has issued its final reports about its circuit national > diversiety > assurance initiative. > > "The NDAI report confirmed our suspicions that diversity > assurance is > not for the meek," Malphrus added. "It is expensive and requires > commitment by the customer to work closely with carriers in > performing > due diligence. Until the problem is solved, circuit route diversity > should not be promoted as a general customer best practice." > > Press release: > http://www.atis.org/PRESS/pressreleases2006/031506.htm > > Report: > http://www.atis.org/ndai/ >

3 2

Only inbound traffic in sFlow export. Why?
by Nikolay Pavlov 21 Mar '06

21 Mar '06

Hi, folks. I have a strange issue on my core router Foundry BigIron 8000 with sFlow export. I see only inbound traffic on sFlow samples: host 206.53.60.34 is in my network (Also i did this test with other hosts). # sflowtool -p 3000 -t | tcpdump -nr - dst host 206.53.60.34 reading from file -, link-type EN10MB (Ethernet) 15:04:53.000000 IP 82.128.3.52.45013 > 206.53.60.34.80: . ack 24619974 win 17520 <nop,nop,timestamp 36603788 4211256578> 15:04:54.000000 IP 24.174.11.206.3373 > 206.53.60.34.80: P 1199114572:1199115084(512) ack 1789266672 win 64240 <nop,nop,timestamp 532058 4211258399> 15:04:58.000000 IP 85.104.28.86.1351 > 206.53.60.34.80: . ack 79673712 win 62788 15:04:58.000000 IP 81.208.106.73.57498 > 206.53.60.34.80: . ack 1730139818 win 17520 15:04:59.000000 IP 65.69.142.208.62916 > 206.53.60.34.80: . ack 3847022661 win 65535 15:04:59.000000 IP 61.68.133.228.3536 > 206.53.60.34.80: . ack 1335280708 win 8760 15:05:00.000000 IP 213.189.177.40.3402 > 206.53.60.34.80: . ack 3962404067 win 16153 15:05:01.000000 IP 82.169.132.243.22872 > 206.53.60.34.80: P 2078249237:2078249560(323) ack 2864397975 win 63592 ^Ctcpdump: pcap_loop: error reading dump file: Interrupted system call # sflowtool -p 3000 -t | tcpdump -nr - src host 206.53.60.34 reading from file -, link-type EN10MB (Ethernet) ^Ctcpdump: pcap_loop: error reading dump file: Interrupted system call Here is output from "sh sflow" command: ----------------------------------------------------------------------- telnet@Core# sh sflow sFlow services are enabled. sFlow agent IP address: xxx.xxx.xxx.xxx Collector IP xxx.xxx.xxx.xxx, UDP 3000 Polling interval is 20 seconds. Configured default sampling rate: 1 per 512 packets. Actual default sampling rate: 1 per 512 packets. 24941397 UDP packets exported 191579929 sFlow samples collected. sFlow ports: ethe 1/1 to 1/7 ethe 2/1 to 2/16 ethe 4/1 to 4/16 ethe 5/1 to 5/48 ethe 7/1 to 7/48 ----------------------------------------------------------------------- When i export flows from my border router (BigIron 8000 too) i see traffic in both directions: # sflowtool -t | tcpdump -nr - dst host 206.53.60.34 reading from file -, link-type EN10MB (Ethernet) 15:18:16.000000 IP 195.93.21.70.44620 > 206.53.60.34.80: P 4216426397:4216426900(503) ack 558911682 win 17520 15:18:16.000000 IP 209.76.82.237.4104 > 206.53.60.34.80: . ack 3051999951 win 65535 15:18:17.000000 IP 203.115.128.74.19487 > 206.53.60.34.80: . ack 649200153 win 65160 <nop,nop,timestamp 2010587857 4212863075> 15:18:17.000000 IP 65.151.66.148.2627 > 206.53.60.34.80: P 3261276588:3261276827(239) ack 3084905371 win 8760 15:18:18.000000 IP 64.228.129.114.1347 > 206.53.60.34.80: . ack 1942222805 win 16248 15:18:18.000000 IP 151.49.83.233.2195 > 206.53.60.34.80: . ack 2258415398 win 17520 15:18:18.000000 IP 62.6.113.207.1428 > 206.53.60.34.80: . ack 1739059353 win 8576 15:18:18.000000 IP 209.76.82.237.4104 > 206.53.60.34.80: . ack 55448 win 65535 ^Ctcpdump: pcap_loop: error reading dump file: Interrupted system call # sflowtool -t | tcpdump -nr - src host 206.53.60.34 reading from file -, link-type EN10MB (Ethernet) 15:18:23.000000 IP 206.53.60.34.80 > 84.139.177.56.63643: P 1273730257:1273731004(747) ack 1482625539 win 65535 15:18:23.000000 IP 206.53.60.34.80 > 70.89.28.201.26236: . 2888886127:2888887533(1406) ack 2658889069 win 65535 15:18:23.000000 IP 206.53.60.34.80 > 151.49.83.233.2195: . 2258616474:2258617934(1460) ack 1038346190 win 65535 15:18:23.000000 IP 206.53.60.34.80 > 202.146.253.4.39746: . 1025657670:1025659106(1436) ack 3576198457 win 33028 15:18:24.000000 IP 206.53.60.34.80 > 82.137.200.17.4237: . 614361912:614363360(1448) ack 2805195025 win 33304 <nop,nop,timestamp 4212877595 134434989> 15:18:24.000000 IP 206.53.60.34.80 > 207.200.116.199.33158: . 2934088899:2934090359(1460) ack 4225450683 win 32850 ^Ctcpdump: pcap_loop: error reading dump file: Interrupted system call ----------------------------------------------------------------------- telnet@Border# sh sflow sFlow services are enabled. sFlow agent IP address: xxx.xxx.xxx.xxx Collector IP xxx.xxx.xxx.xxx, UDP 6343 Polling interval is 20 seconds. Configured default sampling rate: 1 per 512 packets. Actual default sampling rate: 1 per 512 packets. 565929 UDP packets exported 2883745 sFlow samples collected. sFlow ports: ethe 1/1 to 1/4 ethe 4/1 to 4/16 ----------------------------------------------------------------------- -- ============================================================================ = Best regards, Nikolay Pavlov. <<<--------------------------------------- = ============================================================================

1 0

Final report: national diversity assurance initiative
by Sean Donelan 21 Mar '06

21 Mar '06

ATIS has issued its final reports about its circuit national diversiety assurance initiative. "The NDAI report confirmed our suspicions that diversity assurance is not for the meek," Malphrus added. "It is expensive and requires commitment by the customer to work closely with carriers in performing due diligence. Until the problem is solved, circuit route diversity should not be promoted as a general customer best practice." Press release: http://www.atis.org/PRESS/pressreleases2006/031506.htm Report: http://www.atis.org/ndai/

2 1

TLD strings currently in use
by John L Crain 21 Mar '06

21 Mar '06

Hi folks, I hope you consider this operational and on Topic:) We have been receiving some reports of rejection of TLD strings at the ISP level. Some of this may be due to length limitations set in peoples software, there may also be other causes. We want to make sure that there is a place where people can go and pick up a current list of the strings that are in the root zone. (Without having to parse the zone file itself). To this end the IANA is maintaining a list that can be downloaded from the following information page http://icann.org/topics/TLD-acceptance/ If you have questions please feel free to use the e-mail listed on the above URL. John Crain CTO ICANN

1 0

Re: [c-nsp] Which IOS do *you* use?
by Robert Boyle 21 Mar '06

21 Mar '06

At 05:29 PM 3/20/2006, you wrote: > I've got a customer running a few 3660s with 12.2.29 on them. We >went back to 12.2.29 because we saw all sorts of evil stuff with 12.3.16 >on our test box - we'd drop all BGP sessions and end up with half a >dozen obviously foreign prefixes listed as directly connected. The 12.2 >train shows none of this sort of stuff. > > I touch BGP on 3660s, 7200s, and 7500s and this is a common theme - >the customers I have are sticking to the 12.2 train. Is anyone seeing >different trends than this? I'd be curious to know if there are certain >12.3 versions that act better than others, etc. We run mostly on 7200s. 12.3 definitely still has some bugs. Esp. with odd things like directly connected routes and networks disappearing from the routing table when using CEF - at least until you globally disable and re-enable CEF. However, there are some scenarios where we have to use the 12.3 train. We run 12.2(20 something) wherever possible. We have some customers running super new gear with 12.4T. Craziness I say! I'm not directly involved with those clients at all, but I certainly wouldn't want to run that in production yet. :) -Robert Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Well done is better than well said." - Benjamin Franklin

3 3

Re: [c-nsp] Which IOS do *you* use?
by Robert Boyle 21 Mar '06

21 Mar '06

Sorry folks, I'm up too late. I replied to the wrong list! Have a good night everyone. -Robert Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Well done is better than well said." - Benjamin Franklin

1 0

RE: TDS - AS
by Wallace Keith 20 Mar '06

20 Mar '06

Thanks for the correction :). Being rather self centered at times, it's the only prefix I care about. -----Original Message----- From: Arnold Nipper [mailto:arnold@nipper.de] Sent: Monday, March 20, 2006 5:25 PM To: Wallace Keith Cc: Arnold Nipper Subject: Re: TDS - AS On 20.03.2006 23:16 Wallace Keith wrote > > Is anyone else having issues getting to AS 4181? Seems like my route > to them was withdrawn around 20:05 z. (64.35.192.0/20) (and yes, I > DID open a ticket) > There are a lot of prefixes from AS 4181, but not that particular ... Not *your* route to them is withdrawn but *their* prefix ... gw001#sh ip bg 64.35.192.0/20 % Network not in table gw001#sh ip bg 64.35.192.0 BGP routing table entry for 64.0.0.0/4, version 247378 Paths: (3 available, best #3, table Default-IP-Routing-Table) Advertised to update-groups: 3 13101 3356 7911 22637 80.81.196.131 from 80.81.196.131 (213.178.64.92) Origin IGP, metric 0, localpref 100, valid, external Community: 3356:3 3356:86 3356:575 3356:666 3356:2006 7911:777 7911:7705 13101:90 13101:1500 13101:2010 12731 3356 7911 22637 80.81.196.130 from 80.81.196.178 (80.81.196.157) Origin IGP, metric 0, localpref 100, valid, internal 12731 3356 7911 22637 80.81.196.130 from 80.81.196.130 (213.128.128.8) Origin IGP, localpref 100, valid, external, best Community: 3356:3 3356:86 3356:575 3356:666 3356:2006 7911:777 7911:7705 gw001#tra 64.35.192.1 Type escape sequence to abort. Tracing the route to cntcnhedg02.network.tds.net (64.35.192.1) 1 br1.frankfurt1.iphh.net (80.81.196.130) 0 msec 4 msec 0 msec 2 62.67.36.157 [AS 3356] 4 msec 0 msec 4 msec 3 ae-0-54.bbr2.Frankfurt1.Level3.net (4.68.118.98) [AS 3356] 0 msec 204 msec 40 msec 4 ae-0-0.bbr1.Washington1.Level3.net (64.159.0.229) [AS 3356] !N as-3-0.bbr2.Washington1.Level3.net (4.68.128.206) [AS 3356] !N !N Regards, Arnold -- Arnold Nipper / nIPper consulting, Sandhausen, Germany email: arnold(a)nipper.de phone: +49 6224 9259 299 mobile: +49 172 2650958 fax: +49 6224 9259 333

2 1

TDS - AS
by Wallace Keith 20 Mar '06

20 Mar '06

Is anyone else having issues getting to AS 4181? Seems like my route to them was withdrawn around 20:05 z. (64.35.192.0/20) (and yes, I DID open a ticket) -Keith

1 0