- NANOG - lists.nanog.org

Re: Broadband Router Comparisons
by Seth Mos 24 Dec '15

24 Dec '15

Smallnetbuilder.com has quite a few models of routers tested, which is decent. I've bugged them about ipv6 testing before but not too much progress there. Powerconsumption is not listed either, which can be as expensive as the router itself at 21 cents per kWh. Regards, Seth -------- Oorspronkelijk bericht -------- Van: Lorell Hathcock <lorell(a)hathcock.org> Datum: 24-12-2015 03:49 (GMT+01:00) Aan: nanog(a)nanog.org Onderwerp: Broadband Router Comparisons All: Not all consumer grade customer premises equipment is created equally. But end customers sure think it is. I have retirement aged customers buying the crappiest routers and then blaming my cable network for all their connection woes. The real problem is that there were plenty of problems on the cable network to deal with, so it was impossible to tell between a problem that a customer was having with their CPE versus a real problem in my network. Much of that has been cleared up on my side now, but customers were used to blaming us for everything so that they don't even consider that their equipment could be to blame. I want to be able to point out a third party list of all (most) broadband routers that rates them by performance. Or that rates them by crappiness that I can send them to so they can look up their own router and determine if other users have had problems with that router and what can be done to fix it. So far my search has been in vain. Any thoughts? Thanks in advance. Lorell Hathcock Sent from my iPad

1 0

MACsec to edge hosts
by Lyndon Nerenberg 23 Dec '15

23 Dec '15

Are any of you pushing MACsec (802.1AE) out from your switches to the edge hosts? Vs. just running it on the network cross-connect fabric? We have a scenario where, if we could MACsec encrypt those (switch <-> host) links, we could eliminate a lot of application level TLS. But searching for a list of PHYs that support this turned up a very thin set of chips, with most of them being several years old now. Are people even using MACsec in anything other than an "encrypt cross connects between the cages" context? I would be very interested in chatting with anyone who has tried pushing this out from their switches to the connected hosts. --lyndon

2 1

How to update IPv6 geolocation data? Google sites blocked.
by David Sotnick 22 Dec '15

22 Dec '15

Hello, and Season's Greetings! We recently lit up a new IPv6-connected location and expanded our ARIN-allocated /48 network to a /44 network to accommodate the additional location (and future locations). However, since moving our small satellite office off our primary /48 and onto their own /48 as part of our /44 network, the users at that office are receiving messages from e.g. YouTube that the "user has not made this content available in your country". How does one go about updating this v6 geolocation data? This is impacting a bunch of our users. Thanks! -David

2 1

Atlantic City
by Daniel Corbe 22 Dec '15

22 Dec '15

Can someone quote me a price off-list for 300Mbit (preferably on a GigE) in Atlantic City somewhere?

2 1

Re: Nat
by Mike Hammett 22 Dec '15

22 Dec '15

There's nothing that can really be done about it now and I certainly wasn't able to participate when these things were decided. However, keeping back 64 bits for the host was a stupid move from the beginning. We're reserving 64 bits for what's currently a 48 bit number. You can use every single MAC address whereas IPS are lost to subnetting and other such things. I could have seen maybe holding back 56 bits for the host if for some reason we need to replace the current system of MAC addresses at some point before IPv6 is replaced. There may be address space to support it, but is there nimble boundary space for it? The idea that there's a possible need for more than 4 bits worth of subnets in a home is simply ludicrous and we have people advocating 16 bits worth of subnets. How does that compare to the entire IPv4 Internet? There is little that can be done about much of this now, but at least we can label some of these past decisions as ridiculous and hopefully a lesson for next time. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com ----- Original Message ----- From: "Daniel Corbe" <corbe(a)corbe.net> To: "Mike Hammett" <nanog(a)ics-il.net> Cc: "Mark Andrews" <marka(a)isc.org>, "North American Network Operators' Group" <nanog(a)nanog.org> Sent: Saturday, December 19, 2015 10:55:03 AM Subject: Re: Nat Hi. > On Dec 19, 2015, at 11:41 AM, Mike Hammett <nanog(a)ics-il.net> wrote: > > "A single /64 has never been enough and it is time to grind that > myth into the ground. ISP's that say a single /64 is enough are > clueless." > > > > LLLLOOOOOOLLLLL > > > A 100 gallon fuel tank is fine for most forms of transportation most people think of. For some reason we built IPv6 like a fighter jet requiring everyone have 10,000 gallon fuel tanks... for what purpose remains to be seen, if ever. > > You’re being deliberately flippant. There are technical reasons why a single /64 is not enough for an end user. A lot of it has to do with the way auto configuration works. The lower 64 bits of the IP address are essentially host entropy. EUI-64 (for example) is a 64 bit number derived from the mac address of the NIC. The requirement for the host portion of the address to be 64 bits long isn’t likely to change. Which means a /64 is the smallest possible prefix that can be assigned to an end user and it limits said end user to a single subnet. Handing out a /56 or a /48 allows the customer premise equipment to have multiple networks behind it. It’s a good practice and there’s certainly enough address space available to support it.

7 9

Looking for VPS providers with BGP session
by Philippe Bonvin 22 Dec '15

22 Dec '15

Hello, I'm looking for providers around the world who are able to provide VPS with a BGP session but it seems to be rather difficult to find. I have already found a few with WHT/bgp.he.net/google but a little help would be appreciated. Does anyone have contact or know people who can offer such services ? If yes, please contact me off list. Our budget is quite low: around 50$/month/node +/- 50$ depending the transit providers for a server with 1-2 CPU cores, 20 Go SSD or SAS and 1-2 Go RAM. I'll be happy to share my provider list we use with anyone who needs it. Thanks for your help, Philippe [EDSI-Tech Sarl]<http://www.edsi-tech.com> Philippe Bonvin, Directeur EDSI-Tech S?rl<http://www.edsi-tech.com> EPFL Innovation Park, Batiment C, 1015 Lausanne, Suisse | T?l?phone: +41 (0) 21 566 14 15 Savoie Technolac, 17 Avenue du Lac L?man, 73375 Le Bourget-du-Lac, France | T?l?phone: +33 (0)4 86 15 44 78

7 6

Re: Nat
by Scott Weeks 21 Dec '15

21 Dec '15

--- jared(a)puck.nether.net wrote: From: Jared Mauch <jared(a)puck.nether.net> I'd love to hear from people on what they perceive and the real barriers they have seen with regards to IPv6 in your environment. ------------------------------------------------------- In the enterprise; managers that don't (and don't want to) understand and say things like "present a business plan and we might consider it. In the mean time I need everyone to focus on <insert short-term need here>." The things a netgeek has to put up with when (s)he doesn't want to move. scott

1 0

RE: Nat
by Scott Weeks 21 Dec '15

21 Dec '15

--- chuckchurch(a)gmail.com wrote: From: "Chuck Church" <chuckchurch(a)gmail.com> but I'm just having a hard time believing Joe Sixpack will be applying business networking principals such as micro-segmenting to a home network with 3 to 7 devices on it. If anything, these complexities we keep ---------------------------------------- Won't the devices themselves begin to do that based on minimal or no input from Joe? scott

5 5

[CVE-2015-7755] Backdoor in Juniper/ScreenOS
by Stephane Bortzmeyer 21 Dec '15

21 Dec '15

http://forums.juniper.net/t5/Security-Incident-Response/Important-Announcem… https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat=SIRT_1… Should we blame Juniper for letting a git repository open to "unauthorized code" or should we congratulate them for their frankness (few corporations would have admitted the problem)?

7 9

reliably detecting the presence of a bridge?
by Dave Taht 19 Dec '15

19 Dec '15

I am curious if there is some sort of igmp or other form of message that would reliably detect if a switch had a bridge on it. How could deviceA detect deviceC was a bridge in this case? deviceA -> ethernet switch -> deviceB ethernet switch -> deviceC with bridged wifi and ethernet question came up in the context of: http://lists.alioth.debian.org/pipermail/babel-users/2015-December/002231.h… -- Dave Täht Let's go make home routers and wifi faster! With better software! https://www.gofundme.com/savewifi

12 16