- NANOG - lists.nanog.org

Cisco 7600
by Timothy Brown 27 Jan '04

27 Jan '04

I'm aware the Cisco 7600 series is really just an evolution/different way of orienting the chassis of the Catalyst 6500 line. I'm interested in talking to those of you who are doing production tasks in the backbone or core with the 7600, particularly if you've compared it to vendor J or can comment at length on MPLS, VRF, and uRPF features in the device. Please reply off-list. No sales droids please, this is a technical discussion. Tim

3 2

RE: in case nobody else noticed it, there was a mail worm released today
by Timo Janhunen 27 Jan '04

27 Jan '04

This lovely little worm will start beating on the door at www.sco.com come Feb 1/04. Interesting huh? At 09:01 PM 26/01/2004 -0500, Wojtek Zlobicki wrote: >The worm is being talked about on news.com and all the major virus vendors >already have advisories on their websites. The worm in my case masqueraded >as a Mailer Daemon bounce. Source email address appeared to be valid and >matching a domain of a website I visited recently (but have not for a long >time). Anyone know the worm generates the sending domain. > >-----Original Message----- >From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Paul >Vixie >Sent: Monday, January 26, 2004 8:52 PM >To: nanog(a)merit.edu >Subject: in case nobody else noticed it, there was a mail worm released >today > > >my copies (500 or so, before i filtered) are in a ~7MB gzip'd mailbox file >called http://sa.vix.com/~vixie/mailworm.mbox.gz (plz don't fetch that >unless you need it for comparison or analysis). there's a high degree of >splay in the smtp/tcp peer address, and the sender is prepared to try backup >MX's if the primary rejects it, though it appears to try the MX's in >priority order.

2 1

Re: Any 1U - 2U Ethernet switches that can handle 4K VLANs?
by sthaug＠nethelp.no 27 Jan '04

27 Jan '04

> > 3550 runs IOS. > > this is a benefit, especially in a switch? If your whole support organization is geared towards IOS, and unable to learn other CLIs, it may well be. Fortunately, not all support organizations are like that :-) Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

2 1

Re: in case nobody else ...
by J. Oquendo 27 Jan '04

27 Jan '04

> They rate of it is quite surprising. By the description, the trick / > method of infection does not seem all that different than past worms > viri. Makes me wonder how many people in a room would reach into their > purse/pocket on hearing, "Wallet inspector" Try and comprehend the typical home user, with no experience reading what appears to be an email from a friend or a relative. It happens. I had a friend who sent me a virus (unknowingly of course), that went to three different accounts that fall into the same mutt directory. When I inspected it, I gave the friend a call and notified them of the virus, and according to them, they only thing they received was a weird message from someone they knew. This was a fairly smart person, albeit comp illiterate. Someone working in the field (comp/networking) is almost always going to point out a flaw with someone not knowing, but the majority of those who get infected don't even know they're infected. Who do you blame them? I blame those whose OS coding is (excuse the term) crappy (security wise) in the sense it would allow 1) viruses to replicate as such, secondly I do put some blame on the provider for not filtering outbound data (silly pseudo spoofing). Just my two cents which obviously have declined with the economy =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ Quis custodiet ipsos custodes? - Juvenal J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net

1 0

Re: Outbound Route Optimization.
by Scott McGrath 26 Jan '04

26 Jan '04

This was one of the pipe dreams that RSVP was _supposed_ to solve in that you could set up a end to end path with precisely specified characteristics. problem is _all_ the devices in the path need to support RSVP. Now the snake oil salesmen are coming out with boxes which purport to monitor the all paths on the internet and will indvidually select the best path for your flow. The racket will be deafening when all these boxes start running scripted ICMP sweeps to find the "best path". The solution is simple buy adequate pipes and possibly partner with a content delivery network who peers with _all_ the major carriers so that your traffic will not need to transit the major public peering points. Scott C. McGrath

3 2

Re: Any 1U - 2U Ethernet switches that can handle 4K VLANs?
by sthaug＠nethelp.no 26 Jan '04

26 Jan '04

> Both the ISL _and_ the Dotq headers are stripped off at the trunk > interface so they _both_ change the packet size but neither alters the > payload. Obviously. But the fact that ISL adds 26 bytes more than 802.1q means that multiple levels of ISL encapsulation is somewhat less practical than multiple levels of 802.1q tags. Some of us *need* those multiple levels of 802.1q tags. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

Wireless MAN product experiences?
by Jeffrey Paul 26 Jan '04

26 Jan '04

We're looking to setup a point-to-point link between two buildings circa 1.5km apart. Optical, RF, whatever. This would be in the Detroit metro area (Southfield, actually) so snow is to be expected at least part of the year. License-free would be ideal. The devices, or at least the transcievers themselves if seperate, must be weatherproof/ruggedized for outdoor use (obviously). One endpoint will go on a one-story building, the other can either be placed inside our 10th floor suite (about 140' up) and go through a green-tinted glass window, or on the roof (250' up). 100mbps is ideal, although if it's significantly cheaper to drop to 10, that might be an option. I was thinking that 54mbit 802.11g might be a good price-performance mix, but I don't know of the other products available out there. Does anyone have experience with something like this? Should we try using WiFi and directional antennas, or is that insane? What sort of experience have you guys had with different vendors gear? Please reply offlist and I'll summarize my findings to the list afterward. Thanks, -j -- Jeffrey Paul - jeffreypaul(a)diamondcard.com - (877) 748-3467 Senior Network Administrator, Diamond Financial Products "An expert is a man who has made all the mistakes which can be made in a very narrow field." -- Niels Bohr

1 0

Re: Outbound Route Optimization
by Michael.Dillon＠radianz.com 26 Jan '04

26 Jan '04

>BGP is relatively good at determining the best path when you a major >carrier with connectivity to "everyone" (i.e. when traffic flows >"naturally"), in many locations, and you engineer your network so that you >have sufficient capacity to support the traffic flows. In other words, BGP really only works well when most networks are overbuilt so that there is a single uncongested best path through each network from every ingress to every egress and the paths within any given network's core are roughly similar in capacity. Nowadays there is a lot more variability both within networks and between different networks. How can a simple protocol provide optimal behavior between an MPLS network, an IP over ATM network, a network that is half GRE tunnels, and a network that has core links ranging from DS3 to OC48? I think BGP is another example where something that is "good enough" has risen to prominence in spite of the fact that it is not optimal. And another thing. How do we know this problem can ever be solved when we continue to use routing protocols which choose the *BEST* path. The best path is always a single path and, by definition, this is a single point of failure. How can we ever have a diverse and reliable network when its core routing paradigm is a single point of failure? Note that people have built IP networks that provide two diverse paths at all times using multicast http://www.simc-inc.org/archive9899/Jun01-1999/bach2/Default.htm and such things may also be possible with MPLS. But are any of the researchers seriously looking at how to provide a network in which all packets flow through two diverse paths to provide better reliability? --Michael Dillon

6 5

Any 1U - 2U Ethernet switches that can handle 4K VLANs?
by sthaug＠nethelp.no 26 Jan '04

26 Jan '04

Does anybody know of 1U - 2U form factor Ethernet switches that can handle 4K VLANs, or at a minimum 2000 VLANs? Note that we're specifically looking for the ability to handle this number of VLANs operating simultaneously, not only VLAN *IDs* in the full 4K range. (This rules out popular switches like the Cisco 3550 and 3750 series, which can only handle 1024 VLANs operating simultaneously.) The switches should have 12 - 24 Fast Ethernet ports. Some form of "Q in Q" or stackable VLANs, ie. the ability to handle more than one VLAN tag, is vital. Spanning tree is needed, but can be one common spanning tree for all VLANs (per-VLAN spanning tree is not needed). Other features that would be nice to have: - RSTP (802.w) and MST (802.1s). - A couple of GigE ports (GBIC or SFP based, presumably) for uplinks. - L3 (IP routing). - DC power. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

11 21

Re: Any 1U - 2U Ethernet switches that can handle 4K VLANs?
by sthaug＠nethelp.no 26 Jan '04

26 Jan '04

> > 1) Cisco ISL is much better than urgly 802.1q - first of all, it was > > designed many years before 802.1q. I am not even talking abiout those > > idiots, who designed 802.1q as a _spanning tree on the trunk level_, > > which > > made many configurations (which we used with ISL ain 199x years) > > impossble, > > and caused vendors to extend 802.1q. > > Is it April 1st? ISL changes the size of packets, does it not? So know > you have to deal with MTU issues. What happens when I want the biggest > MTU possible? I know it is not much a difference in size, but for some > people, size does matter. > > I am quite happy with dot1q. My gripe is with poor spanning-tree > implementations. I don't want a single spanning-tree for every vlan on > a trunk... I like standards, but I am happy with Rapid-PVST. Just my > feelings about the issue. I would never deploy ISL unless I had > something like a 1900 that did not do dot1q Amen. At my previous employer, we got rid of ISL on almost all trunks. I wouldn't dream of going back. The only thing I don't really like about 802.1q compared to ISL is the idea of "native" or "default" VLAN. I want links to be either access (untagged) or trunk (*all* packets tagged). Fortunately, reasonably new Cisco switches let me enforce that with "vlan dot1q tag native". Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0