- Test - lists.nanog.org

100G - Whitebox
by Mike Hammett 04 Dec '17

04 Dec '17

I first sent to an IX-specific mailing list, but as I have yet to see the message hit the list, I figured I would post it here as well. We've had multiple requests for 100G interfaces (instead of Nx10G) and no one seems to care about the 40G interfaces we have available. Looking at cost effective options brings us to whitebox switches. Obviously there's a wide range of hardware vendors and there are a few OSes available as well. Cumulus seems to be the market leader, while IPinFusion seems to be the most feature-rich. We're not doing any automation on the switches at this time, so it would still need decent manual configuration. It wouldn't need a Cisco-centric CLI as we're quite comfortable managing standard Linux-type config files. We're not going all-in on some overlay either given that we wouldn't be replacing our entire infrastructure, only supplementing it where we need 100G. I know that LINX has gone IPinfusion. What OS would be appropriate for our usage? I'm not finding many good comparisons of the OSes out there. I'm assuming any of them would work, but there may be gotchas that a "cheapest that meets requirements" doesn't quite unveil. Any particular hardware platforms to go towards or avoid? Broadcom Tomahawk seems to be quite popular with varying control planes. LINX went Edgecore, which was on my list given my experience with other Accton brands. Fiberstore has a switch where they actually publish the pricing vs. a bunch of mystery. Thoughts? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

10 12

Alternatives to ISE?
by Christopher J. Wolff 04 Dec '17

04 Dec '17

I've about reached my limit with the dumpster fire that is Cisco's Identity Service Engine. Are there any reliable alternatives that do endpoint classification, central web auth, and .1x auth? Thanks in advance, Christopher

7 7

BGP next-hop self benefits
by craig washington 04 Dec '17

04 Dec '17

Hello everyone, Question, what are the true benefits to using the next-hop self feature, doesn't matter what vendor. Most information I see is just to make sure you have reach-ability for external routes via IBGP, but what if all your IBGP knows the eBGP links? Is there a added benefit to using next hop self in this situation? Any feedback is much appreciated, either for the question specifically or whatever else you got 😊, L3VPN's or underlying technology that has to have that. Thanks

4 3

Contact info, AS4766 Korea Telecom
by Igor Krneta 04 Dec '17

04 Dec '17

Hi, is there anyone from Korea Telecom on this list ? Trying to contact anyone in NOC, it seems that they blacklisted our complete AS (198252) and they are not responding to e-mail. Our customer support is overwhelmed with complaints about non reachable servers hosted in their network. Any help is appreciated. Sincerely, Igor Krneta Elta Kabel d.o.o.

1 0

Re: OSPF Monitoring Tool
by Scott Weeks 03 Dec '17

03 Dec '17

--- mmethw2003(a)gmail.com wrote: From: Methsri Wickramarathna <mmethw2003(a)gmail.com> Is anyone knows about a Monitoring tool for OSPF ?? -------------------------------------- Use SNMP and any graphing tool (such as Cacti, if you don't need to scale to a large size) Some SNMP OIDs: ospfNbrHelloSuppressed 1.3.6.1.2.1.14.10.1.11 ospfNbrState 1.3.6.1.2.1.14.10.1.6 ospfAreaLsaCount 1.3.6.1.2.1.14.2.1.7 ospfLsdbAdvertisement 1.3.6.1.2.1.14.4.1.8 and whatever else you want to monitor. scott

1 0

Re: Incoming SMTP in the year 2017 and absence of DKIM (fwd)
by John R. Levine 02 Dec '17

02 Dec '17

In article <6134b4a7-9da8-2935-e9f6-e4374b3fdba4(a)spamtrap.tnetconsulting.net>, Grant Taylor via NANOG <gtaylor(a)tnetconsulting.net> wrote: >> https://datatracker.ietf.org/doc/draft-levine-dkim-conditional/ >The only way that I can think of is for the originating mail server to >DKIM sign the message twice, 1st with the classic DKIM-Signature w/o the >!fs tag, and 2nd with a DKIM-Signature that includes the !fs tag with a >value of of the recipient's domain. >Is this what you were intending? A list of DKIM-Signatures linked via >!fs tags? Yup, with the chain typically having no more than one or two links, since legit forwarding of the kind that might break DKIM is pretty rare more than two deep. >If I do understand correctly, I think that it's intriguing. I'm not >aware of anything else that would work quite the same way. That was the plan. I thought it was pretty clever, but like I said, the large mail systems that developed ARC wanted to put the control with the recipients, not the senders. R's, John

1 0

OSPF Monitoring Tool
by Methsri Wickramarathna 02 Dec '17

02 Dec '17

Hi Guys, Is anyone knows about a Monitoring tool for OSPF ?? ~~( ŊëŌ )~~

3 2

Incoming SMTP in the year 2017 and absence of DKIM
by Eric Kuhnke 02 Dec '17

02 Dec '17

For those who operate public facing SMTPd that receive a large volume of incoming traffic, and accordingly, a lot of spam... How much weight do you put on an incoming message, in terms of adding additional score towards a possible value of spam, for total absence of DKIM signature?

18 53

aggregate6 - a fast versatile prefix list compressor
by Job Snijders 01 Dec '17

01 Dec '17

Dear NANOG, I re-implemented the venerable 'aggregate' tool (by Joe Abley & co) in python under the name of 'aggregate6'. The 'aggregate6' tool is faster and also has IPv6 support. https://github.com/job/aggregate6 Installation is can be done through 'pip', or your operating system's package manager (if they carry the 'aggregate6' tool). $ pip install aggregate6 Example use: $ echo 10.0.0.0/16 10.0.0.0/24 2000::/4 3000::/4 | aggregate6 10.0.0.0/16 2000::/3 Note that 'aggregate6' can also be imported as module in your own python project: >>> import from aggregate6 import aggregate >>> aggregate(["10.0.0.0/8", "10.0.0.0/24"]) ['10.0.0.0/8'] >>> Related to the above example, NTT uses 'aggregate6' as library in their network automation toolchain to help compress firewall rules. When using a dump from the IPv4 Default-Free Zone, it appears that 'aggregate6' can deaggregate that list ~ 50 times faster than 'aggregate'. However the tradeoff is that 'aggregate6' uses a bit more memory. Aggregate6 has been tested with pypy, python2 and python3; and can be used both from the command line or as python module. Aggregate6 is published under the 2-Clause BSD license. Kind regards, Job

5 7

ccTLDs - Become a Registrar
by Ryan Finnesey 01 Dec '17

01 Dec '17

I was wonder if anyone within the group has done this research and might be able to save me a bit of time. I am in the process of putting together a new Registrar and we would like complete ccTLD coverage. I know for example CIRA (.ca) has a Canadian Presence Requirement and we have formed a Canadian Corporation to meet this requirement. I am hoping to find what other TLD operators may have similar requirements. Cheers Ryan

7 8