- NANOG - lists.nanog.org

MCI NOC
by Marcelo Manta 11 Mar '98

11 Mar '98

Is anyone from MCI NOC here ? The RNP (Brazilian Research Network - AS1916) is 4 hours down (until now) and MCI didn't solve the problem yet. The support numbers have voice mailboxes full and trouble(a)mci.net didn't answer yet. -- Marcelo Manta SAGA PGP fingerprint = E3B8 ACAF 2461 E7E5 B838 01D1 3CF4 325E

3 2

Re[2]: ios images ?
by Dustin Goodwin 11 Mar '98

11 Mar '98

And the risk you take is that if your network melts TAC says your running CAA code what did you expect? BTW ISL over faste is supported in 11.2 mainline. Unfortunately HSRP on ISL is 11.3. - Dustin - ______________________________ Reply Separator _________________________________ Subject: Re: ios images ? Author: "Alex P. Rudnev" <alex(a)Relcom.EU.net> at sb-entsmtp Date: 3/11/98 8:46 PM OK. Try to get PA-E3 cards support or ISL by fast ethernet at I/O board with any IOS except 11.1(17.3)CAA ... They incorporate new equipment into 11.1(...)CAA first, not into 11.2(xx)P. On Wed, 11 Mar 1998, Dustin Goodwin wrote: > Date: Wed, 11 Mar 98 10:57:09 -0500 > From: Dustin Goodwin <dustin_goodwin(a)smb.com> > To: nanog(a)merit.edu, stuartb(a)grasshopper.paradox.net.au > Subject: Re: ios images ? > > > 11.2(12) or higher is suppose to go GD. 11.1 and 11.3 are in serious > question as far as ever reaching GD status. If you want full support > from Cisco TAC run a GD version and run the mainline. Don't run P > train or a none GD release. This will limit your in terms of hardware. > For instance the RSP4 is a 11.2P feature not 11.2 feature. That is the > safest most conservative position to take. Of course it is the least > fun in terms of new software features and new hardware. But no one > ever got fired for running a GD mainline release. > > - Dustin - > > > ______________________________ Reply Separator _________________________________ > Subject: ios images ? > Author: Stuart Bryant <stuartb(a)grasshopper.paradox.net.au> at sb-entsmtp > Date: 3/11/98 9:53 AM > > > hi, > were looking at various ios images to use so we can standardise across > the network. were looking at ios version 11.2(9)P or 11.2(10)P > > does anyone have any warstories to share about these ? good points/bad > points ? things i should be watch out for ? > > regards, > > stuart bryant stuartb(a)paradox.net.au cabinet maker/plumber > paradox digital ph +61 8 9201 9201 f +61 8 9201 9200 > founding member: fellowship of beer. > i used to bite (tm) > > > > Aleksei Roudnev, Network Operations Center, Relcom, Moscow (+7 095) 194-19-95 (Network Operations Center Hot Line),(+7 095) 239-10-10, N 13729 (pager) (+7 095) 196-72-12 (Support), (+7 095) 194-33-28 (Fax)

2 1

Re: ip flow-export
by prue＠ISI.EDU 11 Mar '98

11 Mar '98

As I reported in a recent note, I have a program that looks for illicit transit traffic over a given port based on source/destination AS, by analyzing netflow data. Walt Prue

1 0

Re: HELP: Traffic data Location
by Vern Paxson 11 Mar '98

11 Mar '98

> I would like to ask where I can find the database in which recording the > traffic data in the real network (e.g., Lan or Wan, VBR video etc.) One place to look is the Internet Traffic Archive: http://www.acm.org/sigcomm/ITA/ - Vern

1 0

Re: ios images ?
by Dustin Goodwin 11 Mar '98

11 Mar '98

11.2(12) or higher is suppose to go GD. 11.1 and 11.3 are in serious question as far as ever reaching GD status. If you want full support from Cisco TAC run a GD version and run the mainline. Don't run P train or a none GD release. This will limit your in terms of hardware. For instance the RSP4 is a 11.2P feature not 11.2 feature. That is the safest most conservative position to take. Of course it is the least fun in terms of new software features and new hardware. But no one ever got fired for running a GD mainline release. - Dustin - ______________________________ Reply Separator _________________________________ Subject: ios images ? Author: Stuart Bryant <stuartb(a)grasshopper.paradox.net.au> at sb-entsmtp Date: 3/11/98 9:53 AM hi, were looking at various ios images to use so we can standardise across the network. were looking at ios version 11.2(9)P or 11.2(10)P does anyone have any warstories to share about these ? good points/bad points ? things i should be watch out for ? regards, stuart bryant stuartb(a)paradox.net.au cabinet maker/plumber paradox digital ph +61 8 9201 9201 f +61 8 9201 9200 founding member: fellowship of beer. i used to bite (tm)

2 1

Re: BGP Confederation config problem...
by Richard Parker 11 Mar '98

11 Mar '98

Andy McConnell wrote: >:-) I tried this already, but the match metric only works with IGRP >route-maps, not BGP :-) Sigh... I'll try again. Given my understanding of the limitations and/or design considerations in Cisco's implementation of BGP confederations that prohibit your configuration from working as discussed so far... a) in a confederation the neighbor sub-ASes aren't considered part of the AS_path, b) the MED can't have it's value adjusted relatively, c) "match metric" doesn't work with BGP route-maps, and d) the MED from neighboring sub-ASes is ignored anyway, ... then, perhaps a solution to the problem is to use two route-maps. One route-map to "increment" the community on updates that are sent within the confederation and another to set the local preference and MED based on the community. The community attribute is used because it can be matched against, the local preference attribute is used because it is considered in the decision process when Cisco's BGP implementation routes inside a confederation, and the MED attribute is used so that the external neighbors of the confederation members choose to send data into the confederation at the point closest to the ultimate destination. This configuration might look something like the following: neighbor a.b.c.d send-community neighbor a.b.c.d route-map INC-COMMUNITY out neighbor a.b.c.d route-map SET-PREF-MED in ! route-map INC-COMMUNITY permit 1 match community-list 1 set community 2 route-map INC-COMMUNITY permit 2 match community-list 2 set community 3 ... route-map INC-COMMUNITY permit <n> match community-list <n> set community <n+1> route-map INC-COMMUNITY permit <n+1> match community-list <n+1> set community 1 ! route-map SET-PREF-MED permit 1 match community-list 1 set metric 1 set local-preference 99 route-map SET-PREF-MED permit 2 match community-list 2 set metric 2 set local-preference 98 ... route-map SET-PREF-MED permit <n> match community-list <n> set metric <n> set local-preference <100-n> route-map SET-PREF-MED permit <n+1> match community-list <n+1> ! ip community-list 1 permit 1 ip community-list 2 permit 2 ... ip community-list <n> permit <n> ip community-list <n+1> permit internet You will note the the INC-COMMUNITY route-map matches a range of community values, and "increments" the community. The final condition sets the community to 1 for routes that are newly introduced into the confederation. The SET-PREF-MED route-map matches the same range of community values and sets the MED and local preference accordingly. The final condition permits all other routes and leaves the attributes unchanged. Also, while you would want to apply both the INC-COMMUNITY output route-map and the SET-PREF-MED input filter to the neighbors in other sub-ASes, for internal neighbors you would only want to apply the SET-PREF-MED input route-map. You would apply neither filter to neighbors in ASes outside of the confederation. To be honest, even if this configuration works, it might well be more trouble than it is worth. -Richard

2 1

HELP: Traffic data Location
by Zhang Peng 11 Mar '98

11 Mar '98

Hi, I would like to ask where I can find the database in which recording the traffic data in the real network (e.g., Lan or Wan, VBR video etc.) I am doing some simulation study based on the emperical data which is greatly important for my research on traffic modeling. I have read some papers from BellLab, MIT and IBM, however I am not sure the detailed location and I can download with the anonymous user. Anyone can help me? Thanks, Zhang Peng

1 0

re: ip flow-export
by Steve Rubin 11 Mar '98

11 Mar '98

I've written a tool that will take the output of cfdcollect and feed it to mrtg. It's pretty ugly, but it seems to work :). I'll make it available for ftp if anyone wants it. -- Steve Rubin email: ser(a)tch.org "Dude, Jay Leno's chin Killed Kenny!" pager: pageser(a)tch.org / 408-994-6219

2 1

re: ip flow-export
by Steve Rubin 11 Mar '98

11 Mar '98

>I've written a tool that will take the output of cfdcollect and feed >it to mrtg. It's pretty ugly, but it seems to work :). I'll make it >available for ftp if anyone wants it. About 10 people have emailed me so far... ftp://ftp.tch.org/pub/cftomrtg.c -- Steve Rubin email: ser(a)tch.org "Dude, Jay Leno's chin Killed Kenny!" pager: pageser(a)tch.org

1 0

Provider communications, is it time yet?
by Sean Donelan 11 Mar '98

11 Mar '98

Has your management received enough shocks to system to make talking about provider communications worthwhile yet? Or are they still in a state of denial? Or have the shocks not been big enough to be noticed? The last couple of months have seen many of the same types of outages over and over again, yet provider communications during these outages seems minimal, or even non-existent. Having an outage lists is a nice thing for your sales people to say, but if no information is given during an outage, what was the point of setting up the list? Hint: in the absence of pro-active notifications, more and more people are going to start their own active monitoring, i.e. your most critical machines are going to get pinged to death by more and more people checking if those critical machines are up. I wonder what Netscape's current ping rate is? Acts of God and other natural disasters seem to get modest reporting. But anything else seems to be treated like a tree falling in the forest, if I don't say anything maybe no one will notice it fell down. That works great, sometimes. But it also means we have no way to collect reliable data on how well the "Internet" is doing. Which means every once in a while an acorn falls out of a tree, and hits chicken little reporter on the head, and we end up with stories on TV how the sky is falling. Then we get called into our management's office to explain what we plan on doing about the sky falling. Overall, most of us, I hope, understand the sky is not falling. But as an industry we have no data to back that up. If one provider goes off the air for eight hours, they may have shot a big hole in their 99.9% reliability. But what does that mean for the Internet as a whole? How much customer traffic was affected? Do we even know how much customer traffic exists on the Internet as a whole? The so-called denominator problem. In other words when one provider carrying 10% or 90% of the Internet traffic has problems, does it affect the total amount of Internet traffic, or is a substantial portion of the traffic re-routed around the damaged provider? I've actually been a bit surprised just how little my total traffic volume has been effected even when major providers or exchange points go off the air for periods of time. Maybe we've achieved TYMNET/TELENET nirvana, and any useful site on the net is connected to all of the IRCs :-). Q: What's the worst thing that can happen to a backbone? A: Go down, and no one notice. Fiber cuts, operator errors, software bugs, etc are normal network events. For the Internet, the unusual thing is supposed to be when a single event has a disruptive affect on more than just that one system. With only modest pre-planning, and good communications between providers, the Internet continues flapping on its merry way through most of these events. The myth of the nuclear bomb and the Internet is somewhat true, the net will keep working, but routing is going to be sub-optimal at the node which gets nuked. The problem is as an industry we don't seem to have a good grasp of exactly what is the root cause of most the problems. Sure, you can say fiber cuts are the number one cause of Internet outages, but how do you know? Maybe its power failures, or configuration errors, or any number of other things. And my biggest question, why do single events seem to have such a widespread effect on the Internet? Is it a design error, or an assembly error? Second hint: if you only have two name servers, and they are both on the same subnet, your life is going to suck when that subnet gets nuked. Spring planting and backhoe season is just around the corner, do you have a second fiber strand? Ok, what's this got to do with provider communications? Q: Find the value of the Internet traffic denominator, so then statements like 40% of the Internet traffic make sense. A: Get all Internet providers to give KC? the inbytes/outbytes of their network cloud for anonymization and consolidation. Q: What are the top three causes of Internet outages? Nanog did the top three problems, but not the causes. A: Show me your trouble tickets.... Ok, how to normalize the data? Q: Do you want active pinging or provider pro-active notification? A: Software is Internet law. Develop an Internet (not single-point) status board for providers that don't cooperate. A software message system for providers that do cooperate, i.e. spin control. Decentralize, and provider control. Q: How good are the alternate paths in the Internet? A: Unfortunately we don't get to find out until the disaster. Q: Who reports Internet outages first? CNN or the provider? A: CNN seems to still be reporting them first. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0