March 1999 - Test - lists.nanog.org

Question about subnetting /24's
by Scott Gifford 19 Mar '99

19 Mar '99

OK, so this is probably somewhat of a stupid question. But I thought I knew this stuff, and so did the tech support guy I almost ended up in a screaming match with. :) Can anybody let me know if I'm missing something I should know by now? I have a /24 network I want to subnet into two /25's. For realism's sake, let's call the network 216.40.155.0/24 (mask 255.255.255.0) So I have two 126-host networks, namely 216.40.155.0/25 (mask 255.255.255.128) 216.40.155.128/25 (mask 255.255.255.128) The person with whom I was calmly discussing the matter said that this configuration didn't make any sense, because my first subnet had all zeroes in the last octet, so it was an all-zeroes subnet; and the second had all ones on the last octet, so it was an all-ones subnet. And that these subnets were reserved as the network subnet, and the broadcast subnet, much as all-zeroes and all-ones in the host portion indicate the network and broadcast addresses. I would have dismissed this out of hand, but our router wouldn't let us use this first network unless I enabled the "zero subnet enable" option. And with the second, the customer had to say it was an all-ones subnet or some such thing. This seemed to imply that maybe I was doing something weird. Both myself and the customer are using Bay Networks routers. Can anybody shed any light on this? Is this just something I've competely missed in everything I've learned about IP? Are my routers crazy? Is the tech support guy crazy? Is it just that I've finally gone crazy?... Oh, and while I'm on the subject, is there a cleaner way to delegate IN-ADDR.ARPA for subnets of a /24 than 128 seperate delegations, one for each individual IP address we've assigned? If anybody else is interested in this, let me know, and I'll summarize direct responses to the list. Thanks for any insight, suggestions, ideas, or referrals to a good psychiatrist in the Greater Flint area, ------Scott.

5 4

SUMMARY: Question about subnetting /24's
by Scott Gifford 19 Mar '99

19 Mar '99

I got several requests emailed to me personally from other network operators who also wanted this information, so I'm posting a summary back to the list. If you feel this information is beneath you, by all means stop reading right now! :) Basically, the reason why I had to go out of my way to enable the subnet where the network portion of the last octet was all-zeroes or all-ones is a relic from Ancient Times (read: about 18 months ago), when classful networking was everywhere, and RIPv1 walked its hallowed halls. RIPv1 does not send subnet information in its route announcements, so the subnet that contained the Class C network and broadcast address were off-limits. While many routers come this way by default (a situation which one respondant described as "abominable"), everyone seemed to be in agreement that any router that did not totally suck would let me turn this off. A few others added to this that they felt my Bay Networks router *did* totally suck. As proof that this isn't the case (at least not this time), the problem ended up being completely unrelated to the subnetting. But I was still curious. On a Cisco, the command is "ip subnet-zero" and "ip classless". On a Bay, the "Enable zero subnet" button in Site Manager does the trick. As backup ammo against future tech support incidents, several people pointed out RFC 1878 and 1519, which lays all this out. With regards to reverse DNS, several people pointed me to the advice in RFC 2137. It's just a few pages, and sums up the situation better than I could. Thanks to the numerous people who responded by private email, -------Scott.

1 0

Re: Question about subnetting /24's
by Brett_Watson＠enron.net 19 Mar '99

19 Mar '99

welcome to nanog, scott. while your question actually contained more technical, networking related material than most anything posted here, you'll get blasted for it none the less. see, most people here just magically aquired all this useful information and never had to ask anyone for help. now if you'd asked about the weather, or posted a note about how much you hate spam, or better yet why spam is ok, that seems to be relevant to nanog, or maybe michael dillon's physical build, or his karate belts, or... well you get the point. it's safe to post to nanog once you've read the charter, lurked for 12 months, absorbed each individual's variation of what's ok to post and what's not.... actually, forget it, buy a book. -brett

2 1

Re: Question about subnetting /24's
by Michael Dillon 19 Mar '99

19 Mar '99

On Thu, 18 Mar 1999, Steve Camas wrote: > > Please don't. This list isn't for primary school IP networking homework > > questions. > > So I guess this list is *actually* for self-righteous people to say mean > and nasty things to people who come looking for help. If this man walked > up to you at a conference and asked such a question, would you be this > rude? I think not. If you say, "yes", I am please to hear this as you > will not live long -- someone will beat you to death. Are you always this rude to people on public mailing lists? > Perhaps the 60 seconds spent looking up the address above would have been > better spent answering the man's question and *politely* telling him this > list is not the right place to ask such things. You want polite answers? Then pay me $150/hr and I'll give you polite answers. > Please see Patrick's (patrick(a)ianai.net) response for an example of how to > answer the question without being a jerk. Seems to me that Patrick's answer contained less useful information than mine which you carefully snipped off your reply. Here it is again: P.S. You might want to refer to some RFCs as well http://www.faqs.org/rfcs/rfc2072.html http://www.faqs.org/rfcs/rfc1812.html Note that I didn't just refer to "some RFC" or "RFC 1812 and 2072" but I actually took the time to dig up working URLs to the two RFCs. They talk about CIDR and state quite definitively that all-ones and all-zeroes subnets are allowed. P.P.S. You're probably right but if you can't make the customer's equipment work and you can't back up your claims with reference to a higher authority, then you gotta be crazy. Of course, what is allowed and what works are two different things. And if the customer's router will not work as defined in RFC1812 then it will help the guy immensely if he can point to the higher authority of the RFC so that the customer realizes quite definitively that it is the customer's equipment that is broke, not the ISP that is broke. At this point if our ISP is smart he will work around the problem maybe by giving the customer a couple of /26's or selling them a better router or... You better get used to jerks on mailing lists because there are *LOTS* of us out there, often providing useful technical info along with our rude comments. Maybe your worst nightmare is the class clown who grew up to be a geek but some people just snicker at our antics and go on to the next message. And that's the way life oughta be. -- Michael Dillon - E-mail: michael(a)memra.com Check the website for my Internet World articles - http://www.memra.com

2 1

Re: FEC (Fast Etherchannel) issues
by Danny McPherson 18 Mar '99

18 Mar '99

> > This looks kinda like the right place for this issue, apologies if not: Cisco NSP or the like probably would have been more appropriate. > True or False? > > FEC (Fast EtherChannel) is not suibtable for router to router trunking > because of the way FEC load balances Depends. > I've heard and read in various places (although nothing conclusive) that > since FEC uses the last portion of a MAC address and hashs it to determine > which 100 meg link a packet goes. This is to prevent packets from > arriving on the other end out of order. Only brand 'C' switches do the MAC hash thing, the routers do things with "microflows" (unless per-packet stuff is enabled). > This would seem to suggest that FEC wouldn't work between routers or > similar layouts because there is only one MAC address on either end, > therefor packets would always go over the same link. Yes, between a given set of routers .. if you have brand 'C' switches in the middle. > Anybody have concrete details on this issue? Does FEC actually determine > load balancing this say? is ther another way to configure this? Don't put switches in the middle? -danny

1 0

FEC (Fast Etherchannel) issues
by Tony Bourke 18 Mar '99

18 Mar '99

This looks kinda like the right place for this issue, apologies if not: True or False? FEC (Fast EtherChannel) is not suibtable for router to router trunking because of the way FEC load balances I've heard and read in various places (although nothing conclusive) that since FEC uses the last portion of a MAC address and hashs it to determine which 100 meg link a packet goes. This is to prevent packets from arriving on the other end out of order. This would seem to suggest that FEC wouldn't work between routers or similar layouts because there is only one MAC address on either end, therefor packets would always go over the same link. Anybody have concrete details on this issue? Does FEC actually determine load balancing this say? is ther another way to configure this? I'm not real fond of FEC myself, and would like substantiated evidence in an argument against it. Tony ---------------- ------ -- --- -- - - - - - - -> Tony Bourke tonyb(a)isi.net Senior Technical Account Manager 703.925.9871 Frontier GlobalCenter

2 1

How to never see dupes again (was: someone at ti.com - dups)
by Stephen Sprunk 18 Mar '99

18 Mar '99

Sick of misconfigured majordomos, incessant cross-posters, and occaisional operator error? Put in .procmailrc: # Use a cache of Message IDs received to avoid duplicate messages # (i.e. same message posted to two [or more] mailing lists will be # delivered only once [to first matching procmail rule.) :0 Wh:.msgid.cache.lock | formail -D 8192 .msgid.cache Stephen ObRandy: acc 101 d tcp any any eq smtp, acc 101 p ip any any | | Stephen Sprunk, K5SSS, CCIE #3723 :|: :|: NSA, Network Consulting Engineer :|||: :|||: 14875 Landmark Blvd #400; Dallas, TX .:|||||||:..:|||||||:. Pager: 800-365-4578 / 800-901-6078 C I S C O S Y S T E M S Email: ssprunk(a)cisco.com -----Original Message----- From: Jared Mauch <jared(a)puck.nether.net> To: nanog(a)merit.edu <nanog(a)merit.edu> Date: Wednesday, March 17, 1999 20:43 Subject: someone at ti.com = dups > > > figured i'd mention it, as your mailboxes are already aware. > > i've sent something to postmaster(a)merit.edu also, hopefully >they will squash asap. > > - jared > >-- >Jared Mauch | pgp key available via finger from jared(a)puck.nether.net >clue++; | http://puck.nether.net/~jared/ My statements are only mine.

5 4

summary: router/server serial console access aggregator
by Sanjay Dani 18 Mar '99

18 Mar '99

This is a summary of the private responses to my nanog query: >From: Sanjay Dani <sanjay(a)professionals.com> >Subject: semi-relevant: router/server serial console access aggregator >To: nanog(a)merit.edu >I am looking for recommendations on a small "footprint" >(1U) device that is directly accessible via ethernet/IP >and dial-in. It will be hosted in a remote data center >to access the consoles of several cisco routers and >UNIX servers remotely. > >I have a feeling somebody has built a cheap and reliable >linux/bsd/unix based device with sshd, ethernet port and >8 or 16 serial ports. Thanks to all of you who replied. I may not be able to reply to you personally. 18 suggested using variations of the Cisco 2509/11/14. 1U. Can use telnet with IP address based access lists. ssh support expected in 12.0T, out in a few weeks. *** Watch out for the 2500's sending a break on asynch ports on power cycle and halting Sun consoles *** 4 suggested other 1U servers without ssh such as WTI, Lantronix, and Shiva LAN Rovers with RADIUS auth 9 suggested using 1U or terminal servers such as Livingston Portmasters (7 out of 9). No ssh, but can use SecureID with RADIUS. 7 suggested "bulky" 2U or more bsdi/linux based PC's with cyclades or other cards or Sun boxes with magma SBUS or Digi SCSI cards 11 are _very_ interested in better solutions. I'v attached exceprts from some of the replies I got. I decided to not quote the name/email of the sender. Hope that is the right call here re. respecting privacy vs. attributing credits. PS. A local PC integrator we work with got the post forwarded by someone else on Nanog. He came back within a few minutes with a promise to deliver a 1U Intel/Linux box in the next three weeks, after doing some hardware engineering. That overall seems the best match for my own requirements. I have no financial interest in this integrator except I may get an evaluation piece, competitive pricing :), and the satisfaction of promoting somebody on the "good" side (freeware, custom hardware, reliability, functionality etc.) against the big guys (M$, Crisco etc.). Excerpt attached at the end. ----- I buy Livingston Portmaster 2E-30s (30 DB25 serial) for this purpose. I've bought several used for around $1000 from Network Hardware Resale in Santa Barbara, CA. These boxes are reliable--probably far more so than a PC-based solution--offer good port density in a relatively small footprint, and will run forever. There's no support for ssh, but you can use SecureID with RADIUS if necessary. ---- Most terminal servers will do what you need, except for the SSH bit. I have used Xyplex and Livingston terminal servers for this purpose and 16 port Xyplex terminal servers are/were available in a 1U height. ---- I'd be interested in the summary, but I've scoured the web for such a device and as far as I can see, nothing will have sshd AND 16 serial ports that isn't a full fledged bsd box with cyclades cards. We currently use livingston pm2e's with a modem in s0 and various devices off of the other ports (they are about 3-4U though). We have IP based filters on them and they work very well for what we need them for... http://www.ams.com/reseller/livingston-specials.html ---- Well, except for sshd and dialup, that's a terminal server, with reverse telnet. That wouldn't be to hard to do, except for the 1U requirement, with J. Random Linux box; the Boca BB1008 and 1016(?) cards work nicely. Finding something with both 1) enough serial ports, and 2) that small a formfactor is likely to be troublesome. --- The 2511-RJ version with 16 RJ45 jacks fans out more easily over several racks than the classic cisco 2511 with its 2 octopus cords. And yet as a REAL cisco router you can also have it on someone else's frame relay network globally as your OOB access when your own network is trashed. Beware the cisco pinning inheritted from DEC via Emulex. Pins 3+6 are paired in normal Cat-3/5 patch cords but that pairs xmit with receive data for cisco. That is why their console cords MUST be FLAT mod cordage. Cisco plan for 'rolled' wiring where pin 1 at one end is 8 at the other. We wire our own mod to rs232 adapters backwards to cisco's and so use straight through wiring. If you prefer to use round 4 pair cable rather than flat, bastard pin it straight through but DON'T nake 3+6 be a pair! Just use a pair each for 1+2, 3+4, 5+6, and 7+8. Tip color code on odd pin, and do them in THAT sequence by normal color code starting with wh/blu blu/wh on 1+2. That way any savvy person looking will spot that they are NOT a normal cat-5 ethernet/t1/whatever cable. If you need a spiffier router that even supports 100BaseT for running VLANs on a small cisco 19xx class switch, look at the 262x routers. The LARGE slot in there is the same as a 36xx router and can get you 32 octopussed async ports. 3 of those 32 port modules in a 3640 get you 96 ports with a slot left for MANY options from 2x10BaseT + 4xT1 to even a full HSSI for T3. Althouhg one of the ASYNC ports can be a modem in, so can the normal AUX port. These cisco async ports are also PPP ports for those CSU/DSUs etc that need such for SNMP remote management. OTOH, folks retiring PM2s use them. --- Might not be what you wanted, but check out: http://www.eng.auburn.edu/users/doug/console.html and more generally: http://www.stokely.com/unix.serial.port.resources/serial.switch.html --- Western Telematic makes a network accessible device that can be used for console aggregation. The product is the RSM-800, which WTI describes as a "Telnet & Dial-up Remote Port Manager." Take a look at the following URL for more information: <http://www.wti.com/rsm.htm> --- Check http://www.wti.com. They have a unit like the one you're looking for. They also make 1U power strips with a serial port for modem, a console port for dumbterm and an ethernet port for the LAN for in/out of band administration. --- I'm interested in what you find out. I'm currently building a Linux CD image to boot and run w/o hard drive or floppy on a PC device. I've found a 2U case I could put a PC motherboard. Add things like P/S, CDROM, CPU, RAM, NIC, then you'd have at least something that can run fairly stable (certainly can't trash it's hard drive). Mostly I'll be using cheap boxes of the MicroATX form factor. SSH will be a complication for a couple reasons, but I'm planning to put together a non-encrypted connection server that uses RIPEMD-160 to get into the box from remote, but without encryption (e.g. no one can open the door, but they can see you walk in if they are looking). ---- We use the Lantronix LRS16 - 1U, 16 serial ports (on RJ45), and ethernet. It's actually a full dial-in server, so you can attach a modem to one serial port and it'll give you dial-back/securid/whatever you require. I believe they also now do one which doesn't have all the dial-in bits, making it a bit cheaper. We pay UKP 1200 for them (about $1920), so they're not cheap, but they're reliable. Doesn't do ssh, despite several requests :( ---- Well, I've got nothing that small, but what we use is 2u in height. They're made by a company called Server Technologies (www.servertech.com) The box we have is the "Sentry". It's got 8 power ports which can be remotely cycled, 8 serial (up to 12 I believe), ethernet, and 2 "inbound" serial (one for modem and one for cisco aux port type stuff). The only bummer is the 8 serials are 6-conducter RJ11. Everything I've used before these has either been RJ45 or DB9. Once you get used to it tho, it's no big deal ---- Just stick an extra ethernet card in one of your existing administrative servers (or all of them!) and create a private RFC 1918 network. Firewall it off and attach any old terminal server that supports reverse telnet to that admin lan. Plug a modem and a terminal into two of its ports as well, and away you go. There may be lots of other admin uses for that second LAN too. I run secure NTP and DNS between my servers on it, do my backups over it, etc. I happened across a bunch of DECserver90TL's (little 8-port modular terminal servers) [and a DECserver900TM 32-port, but it needs a DEChub 900 backplane to attach to], and they work very well for this job (except for the fact that you have to re-configure them manually unless you have all of DEC's original PC-based config management tools). ---- cisco's old terminal server, the 2511 works nicely. 1U, with an octopus type assembly running out the back to a 16 port patch panel. The only problem I've come across is that, in the event of the 2511 being power cycled, it'll send something that looks like a break out on all the async lines. This tends to upset Suns, but there are ways around it. ---- We use 2511s. We have somewhere between 60-100 installed without any issues... --- I say, Yes.. I have something like this which I can sell today.. But, I am holding on to it. My 1U will be shipping soon.. with lots of good features (eg.. for this application we can have a pci internal modem card for remote dialin into the syste, if network connection from outside world is not available) etc. etc. etc.. There are few product highlights.. which are being further enhanced before we start shipping. http://www.tesys.com/enclosures/rackmount_telepro_101.shtml I can give 4 serial ports out of the box.. othes I will have to think of.. But, hey I have a spare PCI slots for expansion.. I may put it work and do something intelligent with it. - The stuff you see on my web page, it's ready. But, the extra pci expansion port and attachements are not ready yet. I have stopped the shipping of this 1U product, so I can incorporate the pci expansion card in there and make it more versatile. This PCI expansion card will let you plug another ethernet port (for firewalls), or ethernet pci card with multiple ethernet ports (small router), or even a combination of ehther and scsi card or a pci 8 or 16port multiport serial card as you mentioned... Yes, I do have certain things ready.. But, I am not ready with the expansion pci card yet. As I said aboe, I have designed a pci riser card, which is bit specific to this particular enclosure, but uses the same circuits etc.. as our 2U does. It will take another 2-3 weeks for me to get the first lot manufacturered. ---

1 0

Rover Version 4 Port for BSDI
by David Hares 18 Mar '99

18 Mar '99

Does anyone have a Rover version 4 port running on BSDI? The Merit sources don't compile under BSDI and I'm hoping not to duplicate work already done. A LINUX or generic BSD port might also help. Thanks, Dave ----- David L. Hares, Director of Network Engineering NetworkTwo Communications Group Phone: (734) 827-3620 650 KMS Place FAX : (734) 827-3690 Ann Arbor, MI 48108 (USA) Email: dhares(a)networktwo.net

4 3

The Return of RP Records?
by Jeff 18 Mar '99

18 Mar '99

Greetings. With the recent and only somewhat confirmed removal of POC information from the Internic Whois database, and the upcoming set of newcomers to the field, will we perhaps see a return or rise to popularity of RP dns records? Having your nameserver be able to dole out contact information for your domains, site, and hosts is a nice alternative to having no source of this information. Unfortunately, if your nameserver(s) are down when someone is trying to contact you, the effort is futile. The two biggest things that made whois useful in locating contact information were that EVERY domain in the Internic-controlled TLD's had contact information in Whois by requirement of Internic- and the database somewhat centralized. There were multiple whois servers with all the information, and you were usually able to obtain that information even if network connectivity to a site was down. As whois becomes less and less useful, we may find ourselves seeking sanity in RP records. Unfortunately, it would appear that this is a mediocre solution at best. file this one under thoughts, random. -jeff Jeff Godin Network Specialist Traverse Area District Library / Traverse Community Network jeff(a)tcnet.org - 616/932-8546 voice

5 5