- NANOG - lists.nanog.org

Unwanted dial-outs
by Dave Garber 22 Mar '02

22 Mar '02

I have a question that I hope someone here can help me with. I have a client who is running a Windows 2k Advanced Server with 7 Windows 2k pro clients. They're setup with Sygate Office Network on the server for internet dial-out sharing. The problem we're having is unwanted calls made to the ISP (which is on a LD line... it's temporary until they move into their permanent office at which time they will be going with a broadband solution) randomly during the day by ALL of the 7 clients! The trigger event is to this domain - blackhole-1.iana.org. None of the clients are running any type of internet application when this occurs and I haven't been able to figure out what blackhole-1.iana.org is? What is triggering this event and why? Has anyone heard of this before? Any input is greatly appreciated! Dave Garber CompuHelp Unlimited/The Computer Cafe 724.776.5860

2 1

Question re. SSH
by Steve Sobol 22 Mar '02

22 Mar '02

Apologies in advance for any operational content this may contain. I have a customer who wants to get a static ip with his dialup. He uses SSH extensively and plans to do X11 forwarding, and if he gets disconnected and redials and gets another IP the previous sessions would be inaccessible. I can do static IP but I want to try to save the guy a couple bucks. :) Would a static IP be required to make sure he doesn't lose those X11 sessions after a disconnect? Asking here because I figure my chances of getting an accurate answer are better here than on any of the other mailing lists I read. TIA. SJS -- Steve Sobol, Proud Native of the Great Frozen City of Cleveland, Ohio http://www.Cleveland.OH.US/ http://www.TravelCleveland.com/ http://www.LakeCountyOhio.org/ (Where the Snow is Cold but our Hearts Aren't!) CTO, JustThe.net LLC, Mentor On The Lake, Lake County, OH http://JustThe.net/

4 3

Re: Network Outage
by blitz 22 Mar '02

22 Mar '02

Well, I used to be a contractor for MCI/WCOM, so I know all the numbers to call and the names of people to ask for. They as a rule are very mysterious about anything outage related. The first rule to get better service, is always say OK to intrusive testing. I've had jacks go bad, and the bridge point isn't a wholesome indicator and the fault can be 2 inches away. Besides, I was hard down, all zeros, so it didn't matter. After some arm twisting at Bell Canada, they confirmed it wasn't on their side of the ditch, so I started calling people I know here. The usual characters at the WCOM NOC were calling and leaving useless messages on my answering machine, but I called Sardinia, and got them to check outbound, towards Canada, and they said the T3 looked wholesome, but he couldn't access it at T1 level. I did however, find my Ticket appended to some others, so I knew it had to be at a bigger pipe than my T1. I know where they can check at T1 level, at 3DE, (the old MFS site, where I used to work) so I called, and a girl I worked with told me they had a DS3 cross-connect cable failure earlier, and it was repaired. I called over to the transport desk, and they confirmed the circuit was outbound twords Canada. I put two and two together and when I called the NOC back (they hadn't called my pager as instructed when the cut was cleared) they said the problem had been cleared and the circuit restored. Turns out, the NYC stuff was independent of the Canada problem, (which was my top priority) and the NYC stuff cleared on its own about 15 mins after I talked to Sardinia. Never got a positive cause on that one, but its gone, so its ok by me. Theyre stretched so thin on manpower now, and rumors are flying theres to be another round of layoffs next week, groan. Anyway, all the circuits are back and wholesome, so Im happy...back up at 4:10pm At 19:59 3/21/02 -0500, you wrote: >What did you end up getting from them. I lost some ccts out of 60 Hudson >and they would not cough up to a problem, only hour later during a co-op >test did the problem "clear on its own". Any details you can provide would >be great. > > >----- Original Message ----- >From: "blitz" <blitz(a)macronet.net> >To: <nanog(a)merit.edu> >Sent: Thursday, March 21, 2002 3:00 PM >Subject: Network Outage > > > > > > Good day, > > There has been a MCI/Worldcom outage near the Sardinia, NY switching >site. > > I have been in contact with them since around 12:00 EST and they are > > presently trying to localize the problem. > > I've lost a couple international circuits to Canada, and some to NYC. I > > don't know if anyone else is experiencing similar problems. > > > > This is just a heads up for the list (and my first post..hello all) > > > > Marc Blitz > >

1 0

RE: Survey on IBGP persistent route oscillation problem
by Yu Ning 22 Mar '02

22 Mar '02

Hi Jac, I try to find a suitable bgp mib/oid for nearly one week, but failed. I have to say bgp v4 mib provide little help on this issue, neither cisco proprietary mib. So I have to turn to the "primitive" method. I use nc batch file ( netcat 1.1 for NT running in dos shell ) to read the "sh ip b s | inc table" output from each router, then a homemade perl script to analysis the router output and extract the table counter value, at last the perl script was called by mrtg as an external script. All the three parts are very small, and working well together for months. I've added some download link in the page (http://performance.cn.net:2003/) you can have them as your wish :-) regards, Yu Ning ______________________________________ (Mr.) Yu Ning, Chief Engineer ChinaNET (AS4134) Senior Support Internet Dep. DCBU, China Telecom Beijing, P.R.China +86-10-62072357 Personal Page-> http://navidog.126.com ______________________________________ |-----Original Message----- |From: Jac Kloots [mailto:Jac.Kloots@surfnet.nl] |Sent: Thursday, March 21, 2002 10:08 PM |To: Yu Ning |Subject: RE: Survey on IBGP persistent route oscillation problem | | | | |Yu Ning, | |I took a look at your page and was wondering how you read the BGP table |version? do you use a snmpget command or do you have to login to |the router? | |If you use SNMP for this value, which OID is it you're using? | |Regards, | |Jac | |> Hi, |> |> We have a similar situation (RR + always-compare-MED off), and |the BGP table |> version keeps changing at 1K/min (http://performance.cn.net:2003/) I |> suspect some |> route meet the criteria of IDR-oscillation draft. But in real world, it's |> very hard to pick |> up the pattern depicted in the draft from a huge log of debug |bgp output. |> |> After several sample from the huge bgp log, I have the following |questions: |> |> 1. How many time do our operator really find and affected by the problem |> depicted |> in draft-ietf-idr-route-oscillation-01.txt £¿ |> |> 2. From my experience, most flapping seems to be oscillation route which |> escaped the |> eBGP damping protection. And for this, we need adjust damping |> parameters from |> RIPE 220 to make up. |> |> 3. Anyone see oscillation been magnified when injected into RR (cluster |> structure) ? |> |> |> 4. What's the typical bgp table change rate within your network ? From my |> observation at |> the major global looking glass, should be below 0.5K/min with some |> accidental surge. |> |> |> |> regards, |> |> Yu Ning |> ______________________________________ |> |> (Mr.) Yu Ning, Chief Engineer |> ChinaNET (AS4134) Senior Support |> Internet Dep. DCBU, China Telecom |> Beijing, P.R.China +86-10-62072357 |> Personal Page-> http://navidog.126.com |> ______________________________________ |> |> |-----Original Message----- |> |From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On |> |Behalf Of Susan Hares |> |Sent: Wednesday, March 20, 2002 8:23 PM |> |To: nanog(a)merit.edu |> |Subject: Survey on IBGP persistent route oscillation problem |> | |> | |> | |> | |> | |> |IBGP and Persistent Route Oscillation |> | |> |The Draft BGP Persistent Route Oscillation draft describes route |> |oscillation occurring in networks today. This draft can be |obtained at: |> | |> ||http://www.ietf.org/internet-drafts/draft-ietf-idr-route-oscillati |on-01.txt |> | |> |In order to evaluate how significant a problem the route |oscillation is, I |> |would like to get input from network operators. If you could |take a few |> |moments and fill out this survey, it would help in determining the |> |severity |> |of the problems. Any information solicited by this survey will remain |> |private. Summaries of this information will be sent to this |list and the |> |IDR working list. |> | |> | |> |Sue Hares |> |IDR co-chair |> | |> |> |> | |-- |Jac Kloots |Network Services |SURFnet bv | |

1 0

SNMP and BGP
by Adam Spann 21 Mar '02

21 Mar '02

Hi Guys and Ladies, I was wondering if anyone had worked out how to SNMP poll a cisco router for BGP information. I know that Cisco has support for this but I can't work out the SNMP path to actually reach the BGP Mib portion. I am looking to obtain the number of route prefixes recieved for a given BGP Peer. I can currently do this using some perl. But I would like to move to SNMP if possible. If anyone has any pointers, and ideally the actual MIB path to at least reach the BGP Mib I would be greatful. Kind Regards, Adam Spann Network Operations Engineer Email: spanna(a)au.psi.net Phone: 61 2 8304 9300 Fax: 61 2 9317 5856 631-637 Gardners Road Mascot NSW 2020 Web: www.au.psi.net

3 2

Change management procedures
by Greg Maxwell 21 Mar '02

21 Mar '02

I'm interested in knowing if any service providers or commercial data-centers have any publicly available information on what change management systems and methodologies they use with their engineering staff on production systems. I've discussed this directly with a couple of operators and I'm now interested in getting a larger outlook. More specifically, I'm interested in knowing how often blocking-type (i.e. group consent before change) change management is used vs logging type (i.e. recording the change during/after the fact so the change can be reverted, and for root cause analysis). Also, for blocking type change management, I'd like to know how people deal with process latency, emergency changes, approval group selection, etc (if indeed anyone uses consent to manage top-tier staff, I haven't found anyone so far that does). Thanks for any information.

2 1

Network Outage
by blitz 21 Mar '02

21 Mar '02

Good day, There has been a MCI/Worldcom outage near the Sardinia, NY switching site. I have been in contact with them since around 12:00 EST and they are presently trying to localize the problem. I've lost a couple international circuits to Canada, and some to NYC. I don't know if anyone else is experiencing similar problems. This is just a heads up for the list (and my first post..hello all) Marc Blitz

1 0

Re: Survey on IBGP persistent route oscillation problem
by Danny McPherson 21 Mar '02

21 Mar '02

> Beside, you have to run the command on a router that might hit the > problem .... it depends a lot on your peering locations and partners. > If you run Cisco commands on wrong router, you would not see any > problem and may get in wrong conclusion !! This is why you have to read the draft and understand where the problem _could occur. > Does not fix, but it would lower updates thus help to identify > update loops. I see these as entirely orthogonal -- but, OK. -danny

1 0

Re: Survey on IBGP persistent route oscillation problem
by Danny McPherson 21 Mar '02

21 Mar '02

> We have a similar situation (RR + always-compare-MED off), and the BGP table > version keeps changing at 1K/min (http://performance.cn.net:2003/) I > suspect some > route meet the criteria of IDR-oscillation draft. But in real world, it's > very hard to pick > up the pattern depicted in the draft from a huge log of debug bgp output. It's actually quite trivial to identify. Have a look at: http://www.cisco.com/warp/public/770/fn12942.html Juniper syntax would result in the same.. > 1. How many time do our operator really find and affected by the > problem depicted in draft-ietf-idr-route-oscillation-01.txt I know of more than a few, and would bet that if additional folks took the time to look, they'd realize it was occurring as well. > 2. From my experience, most flapping seems to be oscillation route > which escaped the eBGP damping protection. And for this, we need > adjust damping parameters from RIPE 220 to make up. Nope. Dampening doesn't resolve this because it occurs intrA-domain. > 3. Anyone see oscillation been magnified when injected > into RR (cluster structure) ? Not sure I understand what you mean by "magnified"? Have a look at the Cisco FN, it's useful in understanding and identifying the problem. -danny

2 1

Internet Exchange Questions
by Jon Bennett 21 Mar '02

21 Mar '02

I am a business school student studying the state of the telecom sector and specifically the Internet infrastructure. I am currently trying to understand the role the IX such as PAIX, Equinix, Telehouse, etc.. will play in the future where the number of service providers is drastically reduced relative to the environment they were created in. I think PAIX is a good example of this. MFN announced today that they were selling off PAIX. I would be interested in hearing thoughts on why anyone would want to buy PAIX and if there is a way to continue to make money selling cross connects in the future. Jon Bennett --------------------------------- Do You Yahoo!? Yahoo! Sports - live college hoops coverage

19 29