- NANOG - lists.nanog.org

Re: New Office, New Network. Questions.
by Scott Weeks 11 Jul '16

11 Jul '16

--- bill(a)herrin.us wrote: From: William Herrin <bill(a)herrin.us> > Also, can I use "VRRP" to load balance traffic to > our DNS look-up "recursor"? No. VRRP is a failover system. It has nothing to do with load balancing. ------------------------------------------------ I have seen this before: rtr1 and rtr2 have two vrrp groups. rtr1 is set for primary on, say, .1 and rtr2 primary for .2. Then, the dfg of all odd IP addresses (or some selection process like that) is .1 and all even IP addresses have a dfg of .2. There're endless variations, but the idea is the same. And you still get the vrrp failover when one router gets pissed off and walks away. scott

1 0

New Office, New Network. Questions.
by Nikolai Petrov 11 Jul '16

11 Jul '16

Hello NANOG, I am Nikolai and I am a Network Administrator in a Russian middle-sized company. We do not have a large list with Networks in Russia so I am using the American list. I hope you can help me with some problems that I have. We are moving to our new offices in two months and I have access to the building already. My task is to set up the entire network for the company. The previous administrator has left the company and I thought of taking the chance to remove some "technical debt" and make everything from scratch again. I am alone in the network administration and about one month ago I got an intern to help me but she is a student so she doesn't know much. I was told to move the networks this week and I have spent a lot of time thinking about how I should do it. I am sitting here with an initial plan but I have some questions that I did not manage to find complete information about. I would like your help if you can give it. I summarized my questins below and no matter how much I looked I could not find a lot of inromation and I am still confused. 1. Currently we do not have IPv6 in our network but I have seen the ISP is giving us a "/56 Block" which from what I understand is a couple hundred "/64 Subnets". I think you can only have /64 subnets in IPv6. In our IPv4 setup we have 32 addresses, four of which I will use for NAT and the remaining needed for online services and servers. In IPv6 we have a lot of addresses but I am not sure whether I should give an address of the ISP to every device. I found that there is an organization that can help avoid collisions in private IPs: https://www.sixxs.net/tools/grh/ula/ . From what I can tell it is just a registry, but I am thinking of registering the ranges there and then use these subnets and NAT them to the IPv6 address of the router. However, I noticed something strange. The WAN port of our router gets a /64 IPv6 address which is not in our IPv6. Should I use this for NAT or one of "our" addresses? 2. The previous administrator did some bad job in some parts of the network. We have an internal router protocol to move traffic between routers, but in some cases he used NAT instead of adding these subnets to the router protocol. Everything works and all things that have to be reached are reachable, however I think this is bad and we should use the router protocol for all parts of the network. I have found two protocols in our router that are good and support IPv6 and they are OSPF and BGP. I did not manage to have BGP work and it is slow so I am thinking of OSPF. Do uou think it is a good choice for IPv6 and IPv4? If I have two separate paths of 1 Gb/s, will I transfer files at 2 Gb/s? 3. In our old network we use "VRRP" which from what I know is a system for routers to shae IPs and load balance or "failover" the traffic. I have seen that IPv6 has a built-in system which is similar and has something like priorities, etc. What happens if I have two routers with same priority? Whic is used as default gateway? Is it load balancing? Also, can I use "VRRP" to load balance traffic to our DNS look-up "recursor"? Thank you for your answers, Nikolai.

4 3

IPv6 deployment excuses
by Mike Jones 11 Jul '16

11 Jul '16

Hi, I am in contact with a couple of network operators trying to prod them to deploy IPv6, I figured that 10 minutes to send a couple of emails was worth the effort to make them "see a customer demand" (now none of them can use the excuse that nobody has asked for it!), but the replies I got were less than impressive to say the least. I was wondering if you guys could summarise your experiences with people who make excuses for not deploying IPv6? I regularly see a specific person saying "we can't deploy it because X" followed by you guys "correcting them" and telling them how to deploy it without the problems they claim they will have, but that is only a small snapshot of the people who bother to post about their ignorance in public. I suspect there is also a lot of selection-bias in the NANOG membership base but you deal with a lot of enterprise networks off of this list so probably have broader experience than the NANOG archives. Can we have a thread summarising the most common excuses you've heard, and if they are actual problems blocking IPv6 deployment or just down to ignorance? Perhaps this could be the basis for an FAQ type page that I can point people to when they say they don't know how to deploy IPv6 on their networks? :) - Mike Jones

27 65

Leap Second planned for 2016
by Andrew Gallo 10 Jul '16

10 Jul '16

Looks like we'll have another second in 2016: http://www.space.com/33361-leap-second-2016-atomic-clocks.html Time to start preparing

18 22

Bitcoin mining reward halved
by John Levine 09 Jul '16

09 Jul '16

At about 16:46 UTC block 420001 showed up on the Bitcoin blockchain, so the mining reward per block dropped from 25 to 12.5 btc. Depending on whom you believe, nothing will change, or most of the miners will go offline, or something else. My blockchain client saw 420002 was over 25 minutes after 420001 ago, and over 10,000 waiting transactions, so perhaps the second theory is correct. Anyone here tracking bitcoin P2P traffic? R's, John

7 6

L3 over OTN vs pure IP/MPLS
by Manuel Marín 09 Jul '16

09 Jul '16

Dear Nanog community We are currently experimenting TCP degradation issues in some metro markets where there are multiple POPs and the IP packets have to pass multiple L3 access devices (routers) before reaching the core router. The more L3 hops that it goes through the more degradation we see in the Internet service. L3 routers have the capacity in terms of pps and BW and we are using just a small percentage of that capacity but anyway the service is degraded (No CRC/Input errors in the links). A couple of vendors are recommending using OTN or MPLS-TP to backhaul the connections from the access to the core but obviously deploying OTN means a considerable amount of capex. The flexibility and simplicity of the L3 based access network is great but given the performance issues we are experimenting I would appreciate if you can share your experience/recommendation with either OTN or MPLS-TP. Does it really make sense to use a OTN/Photonic layer to backhaul the L3 connections in a metro network? Your input is greatly appreciated Thanks and have a great day

2 1

DNS resolving issues with AT&T Customer Resolvers
by Mark Keymer 09 Jul '16

09 Jul '16

Hi all, I have a client bridgecatalog.com and it seems like customers with AT&T are unable to resolve his Domain. Maybe I am just overlooking something here but it seems like all should be working. Looking at outside tool things look ok too. http://dnscheck.pingdom.com/?domain=bridgecatalog.com (except the SOA hostmaster(a)solarek.com e-mailing issues I see now) Other domains seem to work fine. So it isn't just everything is down. One of the end-users I was working with currently has an ip of 99.7.225.25. Power cycling the modem did not change thing. I also flushed DNS. If I change to google's open resolvers things work fine. But not with default resolvers to client. Anyone at AT&T that could check that the resolver's your clients are using are able to resolve. (Home / SMB connections, etc) I am not sure the best way to go about trying to look into this issue if other have suggestion I would also appreciate it. Sincerely, -- Mark Keymer

3 4

An open letter to security researchers and practitioners
by Jeremy Gillula 08 Jul '16

08 Jul '16

An open letter to security researchers and practitioners: We need you to take a stand to protect security researchers who report defects in browsers, before it's too late. Earlier this month, the World Wide Web Consortium's Encrypted Media Extensions (EME) spec progressed to Draft Recommendation phase. This is a controversial standard for transmitting DRM-encumbered videos, and it marks the very first time that the W3C has attempted to standardize a DRM system. This means that for the first time, W3C standards for browsers will fall under laws like the DMCA (and its international equivalents, which the US Trade Representative has spread all over the world). These laws allow companies to threaten security researchers who disclose vulnerabilities in DRM systems, on the grounds that these disclosures make it easier to figure out how to bypass the DRM. Last summer, the Copyright Office heard from security researchers about the effect that DRM has on their work; those filings detail showstopper bugs in consumer devices, cars, agricultural equipment, medical implants, and voting machines that researchers felt they couldn't readily publish about, lest they face punitive lawsuits from the companies they embarrassed. EFF has asked the W3C to take a minimal step to insulate their stakeholders from the legal fallout from the inclusion of DRM in their standards. Our proposal asks the W3C to bind its members to legal promises not to use the DMCA or laws like it against security researchers or implementers. https://www.eff.org/deeplinks/2016/06/w3c-eme-and-eff-frequently-asked-ques… So far, the W3C executive has failed to act on this proposal, despite diverse support from a number of W3C members. We are hosting an open letter from security, privacy and technology experts to the W3C's director, Tim Berners-Lee; and its CEO, Jeff Jaffe, asking them to make any further work on EME contingent on adopting rules to protect the open web from these bad laws. https://www.eff.org/deeplinks/2016/03/security-researchers-tell-w3c-protect… Will you sign this letter? Some of security's leading lights have already put their names to it. We can't afford to make widely used tools like browsers off-limits to security research and disclosure, especially not as HTML5 is being positioned as a UI environment to replace apps as the primary way of interacting with sensors, actuators, embedded systems and the whole Internet of Things. If you're willing to sign on, please send an email to cory(a)eff.org with your country of residence and your institutional affiliation (if any). Thank you, Cory Doctorow Apollo 1201 Project Electronic Frontier Foundation

1 0

Re: L3 over OTN vs pure IP/MPLS
by McDonald Richards 08 Jul '16

08 Jul '16

This sounds like somebody is trying to sell you equipment. Can you elaborate on the degradation you're experiencing? Are you sure you're utilizing all your link bandwidth effectively and packets are not being stuck in large buffers or crammed into a starving forwarding class? On Thu, Jul 7, 2016 at 7:43 PM, Manuel Marín <mmg(a)transtelco.net> wrote: > Dear Nanog community > > We are currently experimenting TCP degradation issues in some metro markets > where there are multiple POPs and the IP packets have to pass multiple L3 > access devices (routers) before reaching the core router. The more L3 hops > that it goes through the more degradation we see in the Internet service. > L3 routers have the capacity in terms of pps and BW and we are using just a > small percentage of that capacity but anyway the service is degraded (No > CRC/Input errors in the links). A couple of vendors are recommending using > OTN or MPLS-TP to backhaul the connections from the access to the core but > obviously deploying OTN means a considerable amount of capex. The > flexibility and simplicity of the L3 based access network is great but > given the performance issues we are experimenting I would appreciate if you > can share your experience/recommendation with either OTN or MPLS-TP. Does > it really make sense to use a OTN/Photonic layer to backhaul the L3 > connections in a metro network? > > Your input is greatly appreciated > > Thanks and have a great day >

1 0

www.RT.com bad dns record
by Ca By 08 Jul '16

08 Jul '16

Anyone have a contact at www.rt.com that can encourage them to to delete their bad aaaa ? Some users on some devices fail to reach www.rt.com due to this dns failure. I know about various work arounds, looking for RT.com to fix this by deleting the bad aaaa record. Shared from ISC Dig for iOS ; <<>> DiG 9.10.4 <<>> @fe80::4c60:deff:fee6:b019 @192.168.1.1 www.rt.com aaaa +sit +dnssec +noqr +multiline ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4367 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 512 ;; QUESTION SECTION: ;www.rt.com. IN AAAA ;; ANSWER SECTION: www.rt.com. 10 IN AAAA ::ffff:37.48.108.112 ;; Query time: 298 msec ;; SERVER: 192.168.1.1#53(192.168.1.1) ;; WHEN: Wed Jul 06 20:19:34 PDT 2016 ;; MSG SIZE rcvd: 67

7 10