- Test - lists.nanog.org

Looking for some Quagga experience to discuss 32 bit ASN + community issue with
by Eric Germann 02 Dec '16

02 Dec '16

Good evening, I’m looking for someone who’s familiar with Quagga and is using 32 bit ASN’s. Trying to do some work with communities with it and having no success. If you have some experience and would like to chat, email me off list or reply on-list if the demand is there. Basically trying to advertise 4 byte ASN’s + communities, and then pick them off elsewhere in a private network. Can’t get the config right for the route map to import them on the “receiving” side. Help much appreciated. Thanks EKG

3 4

OT - Looking for a EU based equipment vendor
by Chris Boyd 02 Dec '16

02 Dec '16

Sorry for the noise, but I need to find a company similar to ServerMonkey.com or Teksavers.com that’s based in France or Switzerland. My google-fu seems to be weak on this. Thanks! —Chris

1 0

ATT Wireless
by Mark Stevens 02 Dec '16

02 Dec '16

Good Morning, If anyone from ATT wireless that is on this list, it would be appreciated if you could contact me offline concerning OCN routing problems with your network. Thanks Mark Stevens

1 0

Re: Death of the Internet, Film at 11
by Ronald F. Guilmette 02 Dec '16

02 Dec '16

Laszlo Hanyecz wrote: >What does BCP38 have to do with this? Your're right. That's not specifically related to *this* attack. Nobody needs to spoof anything when you've got a zillion fire hoses just lying around where any 13 year old can command them from the TRS 80 in his mom's basement. (I've seen different estimates today. One said there's about a half million of these things, but I think I saw where Dyn itself put the number of unique IPs in the attack at something like ten million.) I just threw out BCP 38 as an example of something *very* minimal that the collective Internet, if it had any brains, would have made de rigueur for everyone ten+ years ago. BCP 38 is something that I personally view as a "no brainer", that is already widely accepted as being necessary, and yet is a critical security step that some (many?) are still resisting. So, it's like "Well, if the Internet-at-large can't even do *this* simple and relatively non-controversial thing, then we haven't got a prayer in hell of ever seeing a world-wide determined push to find and neutralize all of these bloody damn stupid CCTV things. And when the day comes when somebody figures out how to remotely pop a default config Windoze XP box... boy oh boy, will *that* be a fun day... NOT! Because we're not ready. Nobody's ready. Except maybe DoD, and I'm not even taking bets on that one." I didn't intend to focus on BCP 38. Everybody knows that's only one thing, designed to deal with just one part of the overall problem. The overall problem, in my view, is the whole mindset which says "Oh, we just connect the wires. Everything else is somebody else's problem." Ok, so this mailing list is a list of network operators. Swell. Every network operator who can do so, please raise your hand if you have *recently* scanned you own network and if you can -honestly- attest that you have taken all necessary steps to insure that none of the numerous specific types of CCVT thingies that Krebs and others identified weeks or months ago as being fundamentally insecure can emit a single packet out onto the public Internet. And, cue the crickets... Recent events, like the Krebs DDoS and the even bigger OVH DDoS, and today's events make it perfectly clear to even the most blithering of blithering idiots that network operators, en mass, have to start scanning their own networks for insecurities. And you'd all better get on that, not next fiscal year or even next quarter, but right effing now, because the next major event is right around the corner. And remember, *you* may not be scanning your networks for easily pop'able boxes, but as we should all be crystal clear on by now, that *does not* mean that nobody else is doing so. Regards, rfg P.S. The old saying is that idle hands are the devil's playground. In the context of the various post-invasion insurgancies, etc., in Iraq, is is often mentioned that it was a somewhat less than a brilliant move for the U.S. to have disbanded the Iraq army, thereby leaving large numbers of trained young men on the streets with no jobs and nothing to do. To all of the network operators who think that (or argue that) it will be too expensive to hire professionals to come in an do the work to scan your networks for known vulnerabilities, I have a simple suggestion. Go down to your local high school, find the schmuck who teaches the kids about computers, and ask him for the name of his most clever student. Then hire that student and put him to work, scanning your network. As in Iraq, it will be *much* better to have capable young men inside the tent, pissing out, rather than the other way around.

55 165

Re: Avalanche botnet takedown
by Scott Weeks 01 Dec '16

01 Dec '16

--- rfg(a)tristatelogic.com wrote: From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> The Internet, viewed as an organism, quite clearly has, at present, numerous autoimmune diseases. It is attacking itself. And its immune system, such as it is, clearly ain't working. There's going to come a day of reckoning when it will no longer be possible to paper over this sad and self-evident fact. (And no, I'm *not* talking about the fabled "Digital Pearl Harbor". I'm talking instead about the Internet equivalent of the meteor that wiped out the dinosaurs.) --------------------------------------------------- What is your suggestion to keep the sky from falling? scott

3 2

10G switch drops traffic for a split second
by TJ Trout 01 Dec '16

01 Dec '16

I recently upgraded my core network from 1G to 10G and after the upgrade I have noticed that my 10G switch during peak traffic (1500mbps, 100,000pps) seems to be dropping traffic for a split second across all ports and all vlans. I immediately replaced the switch with a different brand/model and the problem persists. Sometimes traffic drops to zero, others it drops to 50%, problem is very random but seems to occur with much more frequency during high PPS (pushing high traffic / iperf does not induce problem) Could this be MTU? I've tried flow control, hard code duplex, stp on/off etc I'm at a loss any ideas? TJ Trout Volt Broadband

9 13

Brocade MLXe Selective FIB Population
by Graham Johnston 30 Nov '16

30 Nov '16

Does anybody have information on how to selective populate the IPv4 FIB on a Brocade MLXe? Graham Johnston Network Planner Westman Communications Group 204.717.2829 johnstong(a)westmancom.com<mailto:johnstong@westmancom.com> P think green; don't print this email.

2 1

BFD on back-to-back connected BGP-speakers
by Hugo Slabbert 29 Nov '16

29 Nov '16

Good morning, nanog, Is there any/sufficient benefit in adding BFD onto BGP sessions between directly-connected routers? If we have intermediate L2 devices such that we can't reliably detect link failures BFD can help us quickly detect peers going away even when link remains up, but what about sessions with: - eBGP with peering to interface addresses (not loopback) - no multi-hop - direct back-to-back connections (no intermediate devices except patch panels) Possible failure scenarios where I could see this helping would be fat fingering (filters implemented on one or the other side drops traffic from the peer) or e.g. something catastrophic that causes the control plane to go away without any last gasp to the peer. Or is adding BFD into the mix in this type of setup getting into increasing effort/complexity (an additional protocol) for dimishing returns? -- Hugo Slabbert | email, xmpp/jabber: hugo(a)slabnet.com pgp key: B178313E | also on Signal

4 3

Re: 10G switch drops traffic for a split second
by John Kristoff 29 Nov '16

29 Nov '16

On Tue, 29 Nov 2016 09:06:00 +0000 TJ Trout <tj(a)pcguys.us> wrote: > Could this be MTU? I've tried flow control, hard code duplex, stp on/off etc > I'm at a loss any ideas? This sounds like a common problem that certain data center environments run into with 10 Gb/s and higher loads. In a nutshell, a simple throw money at it solution to the problem is to use a switch with larger buffers. Nonetheless, there are plenty of good sources of material about the phenomenon, such as: <http://fasterdata.es.net/network-tuning/router-switch-buffer-size-issues/> <https://people.ucsc.edu/~warner/buffer.html> John

1 0

Accepting a Virtualized Functions (VNFs) into Corporate IT
by Kasper Adel 29 Nov '16

29 Nov '16

Hi, Vendor X wants you to run their VNF (Router, Firewall or Whatever) and they refuse to give you root access, or any means necessary to do 'maintenance' kind of work, whether its applying security updates, or any other similar type of task that is needed for you to integrate the Linux VM into your IT eco-system. Would this be an acceptable offering in today's IT from different type of Enterprises (Minux the Googles, Facebooks...etc) ? Thanks

9 10