- NANOG - lists.nanog.org

VSNL buys Tyco submarine cable network for $130m
by Suresh Ramasubramanian 04 Nov '04

04 Nov '04

Rather obvious sequence of events ... * VSNL as India's former government owned monopoly telco, got exclusive rights on the FLAG cable landing in India, and kept a tight hold on it, only agreeing to sell at the most 10% of available capacity, at rather rates (add to it refusing to let its downstreams - most ISPs in India, back then, peer locally at vsnl, and so forcing all local traffic through expensive international links). * VSNL was privatized, taken over by the Tata Group .. still kept their hold on FLAG's cable landing in India. * VSNL's arch rival Reliance went one up on them and bought FLAG telecom * So, now VSNL goes and buys Tyco - another large submarine cable provider srs http://www.hinduonnet.com/thehindu/holnus/001200411020354.htm VSNL acquires Tyco for $130 mn New Delhi, Nov. 2. (PTI): Tatas-owned Videsh Sanchar Nigam Ltd on Monday decided to acquire Tyco Global Network, submarine cable system, for 130 million dollars. The acquisition, which is subject to government approval in the United States, India and other countries, would give VSNL control over a network spanning 60,000 km and three continents. "The agreement is a major step forward in our ongoing drive to offer our enterprise and carrier customers seamless, end-to-end telecommunications solutions that circle the globe," N Srinath, Director (Operations) of VSNL, said. "This coupled with the submarine cable we plan to launch shortly connecting India with Singapore," he said, adding that this will give customers a new choice in global data services. "Furthermore, the timing of this transaction is well suited to our international expansion plans," Srinath said.

2 2

POLL: SPs' IPv6 (tunnel) deployment requirements
by Pekka Savola 03 Nov '04

03 Nov '04

Hi, (To avoid a lot of spamming on nanog, please send the replies to me off-list and I can summarize, or only to v6ops(a)ops.ietf.org if you think it deserves wider attention.) IPv6 Operations WG at IETF is considering requirements and scenarios for v6-in-[udp]v4 solutions, especially as would be deployed by ISPs. Unfortunately, there has been rather low amount of feedback from the operators, and we'll need more to find solutions that are actually close to what the operators want.. so, I'm trying here.. Please respond within a week or so. A couple of questions (no need to answer to all if you don't want to): 1. have you yet made plans how to deploy IPv6 towards (home) customers? a/ If yes, have you planned to use (only) dual-stack? b/ If yes, have you planned to use some form of tunneling? c/ If yes, using both as appropriate? [[ The rest are relevant only with 1.b) or 1.c) ]] 2. are you currently using L2TP or some other infrastructure for IPv4? a/ Is that adaptable to IPv6 (e.g., by adding v6 support to PPP)? b/ If yes, would it be a sufficient solution for your needs. If not, please elaborate? 3. in case L2TP is not done towards v4 customers now, have you planned or would you be interested in deploying v6 tunneling towards customers? a/ for free? (added value, competitional advantage, etc.) b/ for a fee? 4. what would be your requirements for 3)? Please elaborate a bit. For example, are some (which ones?) of the following relevant: - need to be used for own customers only - authentication based on IP addresses or similar - must it be capable to offer service to non-customers or roaming own customers through some registration process? - capability for doing prefix delegation to the customers - must work through a NAT (e.g., non-upgraded CPE) - should be possible to deploy multiple boxes easily - should be capable of v4-in-v6 tunneling also 5. any other comments or questions? - shoot! ... The two existing requirements documents, for two slightly different problem spaces (first for "easy set-up within your access network", the second "registered, more complicated mode for more extensive use"), are the following: http://www.v6ops.euro6ix.net/ietf/draft-suryanarayanan-v6ops-zeroconf-reqs-… http://www.ietf.org/internet-drafts/draft-ietf-v6ops-assisted-tunneling-req… For a lengthier document describing BB ISP IPv6 deployment options, see: http://www.ietf.org/internet-drafts/draft-asadullah-v6ops-bb-deployment-sce… Feedback on these is also welcome, of course! -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

2 1

(OT) Verizon NOC contact needed
by Rich Sena 02 Nov '04

02 Nov '04

Please contact me off list... -- Richard Sena The MITRE Corporation e: rsena(a)mitre.org Principal Engineer 202 Burlington Road v: +1-781-271-3712 Dept: R10N; MS K112 Bedford, MA 01730-1420 f: +1-781-271-2600

1 0

Re: Network Monitoring System - Recommendations?
by Alexei Roudnev 02 Nov '04

02 Nov '04

Nagios is one of the best systems (and widely used). CCR is part of snmpstat (but separate installation tar), see http://snmpstat.sf.net ----- Original Message ----- From: J Sparacio To: Joe Shen Cc: Alexei Roudnev ; Jon Lyons ; Andy Dills ; Charlie Khanna - NextWeb ; nanog(a)merit.edu Sent: Monday, November 01, 2004 9:54 PM Subject: Re: Network Monitoring System - Recommendations? There's a cool one that's open source called Nagios. www.nagios.org. We (local ISP) just started using it network wide, and it rocks. On Mon, 2004-11-01 at 20:53, Joe Shen wrote: Hi, I googled with "CCR" but it seems nothing useful in 5 pages. Would you please do me a favor to give the URL of that tool ? I tried to set up MRTG monitoring Unishpere BRAS 1400 and M160, but I failed with data collection because wrong OID used ( CPU, mem, tempreture, BW etc ) :-( regards --- Alexei Roudnev <alex(a)relcom.net> wrote: > > > > > I read document of these tools and find they work > with > > Cisco products. But, how about Juniper M160 or > M320, > > Unishpere's BRAS products? Where can I find > Juniper's > > OID on its tempreture, chassis, CPU, bandwidth ? > Does > They use standart MIB2 and a little of Cisco > specific MIB's. As I already > said, it is a good tool to view and monitor traffic, > utilisation, errors, > and use additional tiool to deep monitor vendor > specific parameters. We use > 'snmpstat' to monitor routers, switches, ports and > interfaces (and bgp) and > cricket to watch few additional parameters (to > configure alerts, we use > aliases and mhonarc mail archives with auto > expiration - for alerts, > warnings, reports and audits, and for 'root' and > 'oracle' e-mail. > > > anyone have a running configuration for M160 or > > Unishpere's BRAS products? > CCR can work with anything which (1) allow telnet or > ssh, and (2) can 'write > net' config (in any syntax). > You can use encrypted password file (using > passphrase) if you want. Using > SNMP was rejected, because it is absolutely > device-specific, impossible in > many cases, and we never saw it as a security > problem, because all devices > are restricted to allow ssh or telnet from 2 or 3 > servers only, because > passwords are encrypted, and because automated > config reading and web access > aree much more important vs very abstract > possibility of hacking (in > reality, problem can come from insiders, not from > hackers, so no extra > accounst are allowed on monitoring server). > > You can get configuratuion (initialize tftp > transfer) using some snmp > (WRITE) variable and pre-configured tftp parameters, > but it works on a very > few Cisco devices only. > > As I said, CCR uses 3 methods: > - password file encrypted by public key > - password file encrypted by 3des passphrase; > - explicit password. > > In all cases, problem is with root user only - root > can alway decrypt > password or interseipt web session. User, who have > permission to edit CCR > config and know passphrase, can (in theory) see > passwords as well. Other > users can not, even if they know passphrase - they > can only initiate config > reading. > > Network admins do not know enable passwords, if they > do not need it - they > use passphrase > > To have automated config reading, any of first 2 > methods can be used > (passphrase must be written into special file, if > method 2 is used, > root-only readable). For manual reading, any methgod > can be used, without > any file with passphrase. > > In reality, it is not serious security problem > because all devices can be > accessed from a very few servers only, and because > we can use 'ssh' instead > of 'telnet' (CCR can be configured or select > ssh/telnet automatically). You > can, in turn, play with security level , but it > (again) does not work on > generic case (any cisco device) and is very tricky. > > For Juniper or other device - you can try to program > 'expect' script, or use > 'snmp' initiated transfer - all other things will > work. > > > > > > > On configuration bankup, rancid use telnet (ssh). > But, > > I take this a not-secure methode as it has to code > > password in login script. Is there any tool to get > > configuration file from read-only SNMP cumminity? > > > > > > Joe > > > > > > > > --- Jon Lyons <jlyons30(a)yahoo.com> wrote: > > > > > > > > > Checkout http://perfparse.sourceforge.net/ lets > you > > > graph the data from the nagios plugins... > > > > > > --- Alexei Roudnev <alex(a)relcom.net> wrote: > > > > > > > > > > > I generated config for 'snmpstatd' > automatically, > > > > from user;'s database (it > > > > was simple; all I need was Router, Interface, > > > > User-name, number for this > > > > user, priority). > > > > > > > > For automated config backups, I use CCR (fully > web > > > > based Cisco > > > > configuration -> CVS system). > > > > > > > > > > > > ----- Original Message ----- > > > > From: "Andy Dills" <andy(a)xecu.net> > > > > To: "Charlie Khanna - NextWeb" > > > <charlie(a)nextweb.net> > > > > Cc: <nanog(a)merit.edu> > > > > Sent: Thursday, October 28, 2004 11:46 AM > > > > Subject: Re: Network Monitoring System - > > > > Recommendations? > > > > > > > > > > > > > > > > > > On Thu, 28 Oct 2004, Charlie Khanna - > NextWeb > > > > wrote: > > > > > > > > > > > Hi - I was interested in finding out what > > > > software applications other > > > > ISPs > > > > > > are using for network monitoring? For > > > example: > > > > > > > > > > > > > > > > > > > > > > > > 1) Overall network health - uptime > > > reports > > > > > > > > > > http://www.nagios.org > > > > > > > > > > > 2) Backup router config > automatically > > > > > > > > > > http://www.shrubbery.net/rancid/ > > > > > > > > > > > 3) Bandwidth reporting (or > integration > > > > with an MRTG-type app) > > > > > > > > > > http://cricket.sourceforge.net/ > > > > > > > > > > > 4) SNMP trap support (BGP/OSPF > session > > > > drops - emails out) > > > > > > > > > > http://www.snmptt.org/ > > > > > http://www.nagios.org > > > > > > > > > > > 5) Database back end (port info into > or > > > > over to other apps) > > > > > > > > > > > > I'm just looking for something well > rounded > > > for > > > > a small ISP. I've heard > > > > > > about OpenNMS and other apps but I'd like > to > > > get > > > > everyone's feedback. > > > > > > Thanks! > > > > > > > > > > Nothing all in one place, that I'm aware of. > But > > > > with a little work, you > > > > > could probably integrate it all into nagios. > > > After > > > > all, you can make the > > > > > host names or descriptions URLs that link to > > > > bandwidth and error graphs or > > > > > other tools. > > > > > > > > > > Andy > > > > > > > > > > --- > > > > > Andy Dills > > > > > Xecunet, Inc. > > > > > www.xecu.net > > > > > 301-682-9972 > > > > > --- > > > > > > > > > > > > > > > > > > > > > > > __________________________________ > > > Do you Yahoo!? > > > Yahoo! Mail Address AutoComplete - You start. We > > > finish. > > > http://promotions.yahoo.com/new_mail > > > > > > > __________________________________________________ > > Do You Yahoo!? > > Log on to Messenger with your mobile phone! > > http://sg.messenger.yahoo.com > > __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

1 0

why upload with adsl is faster than 100M ethernet ?
by Joe Shen 02 Nov '04

02 Nov '04

Hi, I met a question with upload speed and network access speed. One of our customer lease two lines from us. One is 2Mbps ADSL line the other is 100Mbps fiber ethernet link. The customer needs to upload files to server in Japan usually. Now, the customer complaint that the upload speed of ADSL is much slower than fiber link. For a 5MB file, it takes 420 seconds with fiber link to finish uploading while the time for ADSL is 170 seconds. There is no difference in routing path between ADSL far end and fiber ethernet far end other than the access method. ( from the first acess router ). We measured the latency between our core router and customer's computer, and find there is no packet loss between with both line while latency on ADSL is 0.3ms higher than fiber ethernet. And, no link along the path inside our network is over burdened. That is, bottleneck locates somewhere outside our network. And there is asymetric route between our network and Japan server. But, why TCP throughput experience so much difference between ADSL acess and fiber link access? Thanks. Joe __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

12 20

IPv6 support for com/net zones on October 19, 2004
by Matt Larson 01 Nov '04

01 Nov '04

VeriSign will add support for accessing the com/net zones using IPv6 transport on October 19, 2004. On that day, AAAA records for a.gtld-servers.net and b.gtld-servers.net will be added to the root and gtld-servers.net zones. We do not anticipate any problems resulting from this change, but because these zones are widely used and closely watched, we want to let the Internet community know about the changes in advance. Matt -- Matt Larson <mlarson(a)verisign.com> VeriSign Naming and Directory Services

12 20

Finding information about metro private line service in downtown SF
by Bill Garrison 01 Nov '04

01 Nov '04

Hello, I am investigating the options for linking up a new office to our (coincidentally) close datacenter in downtown San Francisco. Both locations are SOMA and within about 10 minutes walking of each other. Calling SBC provided me with a rather clueless person telling me all about ATM, Frame Relay and other options I don't want. To his credit, I believe I may have been defining what I want incorrectly. Since both areas are well within the same LATA (do people say that anymore?) I am simply looking for some sort of private line service be it fiber or copper. Who are the providers local to the area? Is there any way of finding what is in the ground around me? (I know UPN Networks is in between our offices so I am confident there is fiber or copper all around us.) What are the easiest options for this sort of thing? What kind of pricing might we be looking at? To give some perspective, we push a significant amount of bandwidth through our datacenter such that if the costs work out we would prefer a private line into our datacenter (for many reasons including cost, internet speed in the office, ability to have a backend entrance to our network for "offsite" backups, etc.). We would also then just setup a DSL line or T1 for emergencies/failover.[1] Please reply offlist, thanks for any insight, Bill [1]: Our alternative is too just get a T1 with a DSL for manual failover but piping into our datacenter would provide a substantial number of benefits. (this is a small office with about 10 people all of whom can handle cold-swapping to DSL if ever needed...)

8 9

Abuse Ticketing Systems
by James Baldwin 29 Oct '04

29 Oct '04

Are there any particularly useful ticketing systems for handling the sorts and volume of complaints an abuse desk sees? Currently my company has deployed Remedy internally and while it is particularly useful in managing work requests and our noc's incident response, it seems to be completely unsuited for our abuse desk needs. I've been recommended to Abacus and would be interested in anyone's experience with it. If someone has had a painless and successful experience using Remedy to handle abuse desk ticketing I'd love to hear a little about the overall engineering of the system to handle it. --- James Baldwin

15 24

RE: [Insight?] OutPut Drops Cisco 7206VXR
by Gyorfy, Shawn 29 Oct '04

29 Oct '04

Well, we took out the 'service-policy output map' on the FE which took the interface from WFQ to FIFO. There hasn't been an output drop in 5hrs. Thanks, shawn -----Original Message----- From: Gyorfy, Shawn Sent: Friday, October 29, 2004 9:13 AM To: 'Majid Farid'; Church, Chuck; jkreger(a)lwolenczak.net Subject: RE: [Insight?] OutPut Drops Cisco 7206VXR The other side is an extreme summit 48 port switch. We took of Auto negotiate and hard set it to 100 Full. We swapped the Extreme, adjusted the buffers on the 7206, stopped using the FE on the board and used a card. I see a lot if discussion about FIFO and WFQ - that's the only thing we didn't do. I can't try it right now - I looked at different routers (1700s, 2600, and 3600s), and they have FIFO. buffers small permanent 420 buffers small max-free 534 buffers small min-free 79 buffers middle permanent 437 buffers middle max-free 558 buffers middle min-free 84 buffers big permanent 93 buffers big max-free 133 buffers big min-free 28 buffers verybig permanent 16 buffers verybig max-free 24 buffers verybig min-free 5 buffers large permanent 0 buffers large max-free 0 buffers large min-free 0 buffers huge permanent 0 buffers huge max-free 0 buffers huge min-free 0 -----Original Message----- From: Majid Farid [mailto:MajidFarid@telecomottawa.com] Sent: Tuesday, October 26, 2004 10:09 PM To: Church, Chuck; Gyorfy, Shawn; jkreger(a)lwolenczak.net Cc: nanog(a)merit.edu Subject: RE: [Insight?] OutPut Drops Cisco 7206VXR What is the other side set to? Is it FIFO or WFQ? Majid Farid ISP Specialist Telecom Ottawa Limited. majidfarid(a)telecomottawa.com [P] 613.225.4631 ext 7220 [F] 613.225.0636 -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Church, Chuck Sent: Tuesday, October 26, 2004 7:18 PM To: Gyorfy, Shawn; jkreger(a)lwolenczak.net Cc: nanog(a)merit.edu Subject: RE: [Insight?] OutPut Drops Cisco 7206VXR Isn't weighted fair queueing generally a bad idea on a LAN interface? Chuck Church Lead Design Engineer CCIE #8776, MCNE, MCSE Netco Government Services - Design & Implementation Team 1210 N. Parker Rd. Greenville, SC 29609 Home office: 864-335-9473 Cell: 703-819-3495 cchurch(a)netcogov.com PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4371A48D -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Gyorfy, Shawn Sent: Tuesday, October 26, 2004 10:49 AM To: 'jkreger(a)lwolenczak.net' Cc: nanog(a)merit.edu Subject: RE: [Insight?] OutPut Drops Cisco 7206VXR Yeah - we have traffic shaping: policy-map Outbound-Transmission-To-Core (We have 10) class Expedited-Forwarding-To-Core priority percent 50 class Hanover_13364_14025_37272-TS-To-Core shape average 1536000 192000 15000 class Queller_3266_3268_30989-TS-To-Core shape average 700000 87500 15000 . . . (10) FastEthernet0/0 is up, line protocol is up Hardware is DEC21140A, address is 0001.636e.1c00 (bia 0001.636e.1c00) Description: Connected to Extreme Summit48 Internet address is MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 12/255, rxload 3/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, 100BaseTX/FX ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:21, output 00:00:00, output hang never Last clearing of "show interface" counters 00:37:12 Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 5397 Queueing strategy: weighted fair Output queue: 0/1000/64/0 (size/max total/threshold/drops) Conversations 0/82/256 (active/max active/max total) Reserved Conversations 0/0 (allocated/max allocated) Available Bandwidth 25000 kilobits/sec 5 minute input rate 1505000 bits/sec, 979 packets/sec 5 minute output rate 5084000 bits/sec, 1590 packets/sec 2028319 packets input, 434456929 bytes Received 3 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog 0 input packets with dribble condition detected 3453733 packets output, 1359654191 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out Serial2/0 is up, line protocol is up Hardware is M1T-T3+ pa Description: ny-0200 V#51HFGL605916 (DS3 to 39 Broadway POP) Internet address is MTU 4470 bytes, BW 44210 Kbit, DLY 200 usec, reliability 255/255, txload 8/255, rxload 29/255 Encapsulation PPP, LCP Open Open: CDPCP, IPCP, crc 16, loopback not set Keepalive set (10 sec) Restart-Delay is 0 secs Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters 00:37:49 Input queue: 1/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: weighted fair Output queue: 0/1000/64/0 (size/max total/threshold/drops) Conversations 0/10/256 (active/max active/max total) Reserved Conversations 0/0 (allocated/max allocated) Available Bandwidth 11052 kilobits/sec 5 minute input rate 5029000 bits/sec, 1584 packets/sec 5 minute output rate 1437000 bits/sec, 966 packets/sec 3460149 packets input, 1351120603 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 parity 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 2005303 packets output, 418156501 bytes, 0 underruns 0 output errors, 0 applique, 0 interface resets 0 output buffer failures, 0 output buffers swapped out 0 carrier transitions rxLOS inactive, rxLOF inactive, rxAIS inactive txAIS inactive, rxRAI inactive, txRAI inactive -----Original Message----- From: jkreger(a)lwolenczak.net [mailto:jkreger@lwolenczak.net] Sent: Tuesday, October 26, 2004 10:55 AM To: Gyorfy, Shawn Subject: Re: [Insight?] OutPut Drops Cisco 7206VXR Do you have any rate limiting on the Ethernet interface? The bus error.. I would say let cisco just replace your gear... that dosen't sound good. How is the bandwidth usage soo different? That dosen't sound right.... -Justin On Tue, 26 Oct 2004, Gyorfy, Shawn wrote: > > What's up all, > > I have a question, maybe some have experienced this before- let me paint the > picture for you first - We are running VoIP- customer's are experiencing > static. > > I have a DS3 going for a Cisco 10k router to a Cisco 7206VXR M2T-T3+ pa > Interface. As of right now, the current usage is about 5.5Mbps with an > input rate of about 1425pps and output rate of 756. > > The Fast Ethernet is connected to an Extreme Switch. The FastE's usage > right now is about 20Mbps with an input rate of 868pps and an output of > 1541pps. > > On the FastE - we are seeing Output drops. They were at a constant > interval, when we were running IOS c7200-p-mz.123-9a. As per cisco, we > upgraded the IOS to c7200-p-mz.123-10 because of a possible buffer leak. > Rather than just upgrading the IOS on the current box, we swapped it out to > a new box and still recv output drops and Now the puppy decides to reboot > every 15 minutes returning a, "System returned to ROM by bus error at PC > 0x60132C44, address 0xE16E2CD at 13:38:47 UTC Tue Oct 26 2004" > > Questions: (a) What would be causing the output errors - can't the > processor and memory handle that? > (b) what is that bus error? > > > Thanks all, > > shawn. > > > > > >

1 0

35th Anniversary of the Internet
by Scott Weeks 29 Oct '04

29 Oct '04

Any NANOG folks here at UCLA's 35th Anniversary of the Internet symposium? If so, let's get together. It'd be fun. scott

1 0