November 2004 - Test - lists.nanog.org

PathControl vs. Internap(hardware)
by Dave Temkin 04 Nov '04

04 Nov '04

Has anyone done any comparisons recently? I know that RouteScience changed their model of not providing the hardware anymore, but I was overall satisfied with their product when I had it before. Has anyone stacked the Internap (former NetVMG/Sockeye) soft against the PathControl software? What were your impressions if so? Thanks, -Dave

2 1

VSNL buys Tyco submarine cable network for $130m
by Suresh Ramasubramanian 03 Nov '04

03 Nov '04

Rather obvious sequence of events ... * VSNL as India's former government owned monopoly telco, got exclusive rights on the FLAG cable landing in India, and kept a tight hold on it, only agreeing to sell at the most 10% of available capacity, at rather rates (add to it refusing to let its downstreams - most ISPs in India, back then, peer locally at vsnl, and so forcing all local traffic through expensive international links). * VSNL was privatized, taken over by the Tata Group .. still kept their hold on FLAG's cable landing in India. * VSNL's arch rival Reliance went one up on them and bought FLAG telecom * So, now VSNL goes and buys Tyco - another large submarine cable provider srs http://www.hinduonnet.com/thehindu/holnus/001200411020354.htm VSNL acquires Tyco for $130 mn New Delhi, Nov. 2. (PTI): Tatas-owned Videsh Sanchar Nigam Ltd on Monday decided to acquire Tyco Global Network, submarine cable system, for 130 million dollars. The acquisition, which is subject to government approval in the United States, India and other countries, would give VSNL control over a network spanning 60,000 km and three continents. "The agreement is a major step forward in our ongoing drive to offer our enterprise and carrier customers seamless, end-to-end telecommunications solutions that circle the globe," N Srinath, Director (Operations) of VSNL, said. "This coupled with the submarine cable we plan to launch shortly connecting India with Singapore," he said, adding that this will give customers a new choice in global data services. "Furthermore, the timing of this transaction is well suited to our international expansion plans," Srinath said.

2 2

POLL: SPs' IPv6 (tunnel) deployment requirements
by Pekka Savola 03 Nov '04

03 Nov '04

Hi, (To avoid a lot of spamming on nanog, please send the replies to me off-list and I can summarize, or only to v6ops(a)ops.ietf.org if you think it deserves wider attention.) IPv6 Operations WG at IETF is considering requirements and scenarios for v6-in-[udp]v4 solutions, especially as would be deployed by ISPs. Unfortunately, there has been rather low amount of feedback from the operators, and we'll need more to find solutions that are actually close to what the operators want.. so, I'm trying here.. Please respond within a week or so. A couple of questions (no need to answer to all if you don't want to): 1. have you yet made plans how to deploy IPv6 towards (home) customers? a/ If yes, have you planned to use (only) dual-stack? b/ If yes, have you planned to use some form of tunneling? c/ If yes, using both as appropriate? [[ The rest are relevant only with 1.b) or 1.c) ]] 2. are you currently using L2TP or some other infrastructure for IPv4? a/ Is that adaptable to IPv6 (e.g., by adding v6 support to PPP)? b/ If yes, would it be a sufficient solution for your needs. If not, please elaborate? 3. in case L2TP is not done towards v4 customers now, have you planned or would you be interested in deploying v6 tunneling towards customers? a/ for free? (added value, competitional advantage, etc.) b/ for a fee? 4. what would be your requirements for 3)? Please elaborate a bit. For example, are some (which ones?) of the following relevant: - need to be used for own customers only - authentication based on IP addresses or similar - must it be capable to offer service to non-customers or roaming own customers through some registration process? - capability for doing prefix delegation to the customers - must work through a NAT (e.g., non-upgraded CPE) - should be possible to deploy multiple boxes easily - should be capable of v4-in-v6 tunneling also 5. any other comments or questions? - shoot! ... The two existing requirements documents, for two slightly different problem spaces (first for "easy set-up within your access network", the second "registered, more complicated mode for more extensive use"), are the following: http://www.v6ops.euro6ix.net/ietf/draft-suryanarayanan-v6ops-zeroconf-reqs-… http://www.ietf.org/internet-drafts/draft-ietf-v6ops-assisted-tunneling-req… For a lengthier document describing BB ISP IPv6 deployment options, see: http://www.ietf.org/internet-drafts/draft-asadullah-v6ops-bb-deployment-sce… Feedback on these is also welcome, of course! -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

2 1

(OT) Verizon NOC contact needed
by Rich Sena 02 Nov '04

02 Nov '04

Please contact me off list... -- Richard Sena The MITRE Corporation e: rsena(a)mitre.org Principal Engineer 202 Burlington Road v: +1-781-271-3712 Dept: R10N; MS K112 Bedford, MA 01730-1420 f: +1-781-271-2600

1 0

Re: Network Monitoring System - Recommendations?
by Alexei Roudnev 02 Nov '04

02 Nov '04

Nagios is one of the best systems (and widely used). CCR is part of snmpstat (but separate installation tar), see http://snmpstat.sf.net ----- Original Message ----- From: J Sparacio To: Joe Shen Cc: Alexei Roudnev ; Jon Lyons ; Andy Dills ; Charlie Khanna - NextWeb ; nanog(a)merit.edu Sent: Monday, November 01, 2004 9:54 PM Subject: Re: Network Monitoring System - Recommendations? There's a cool one that's open source called Nagios. www.nagios.org. We (local ISP) just started using it network wide, and it rocks. On Mon, 2004-11-01 at 20:53, Joe Shen wrote: Hi, I googled with "CCR" but it seems nothing useful in 5 pages. Would you please do me a favor to give the URL of that tool ? I tried to set up MRTG monitoring Unishpere BRAS 1400 and M160, but I failed with data collection because wrong OID used ( CPU, mem, tempreture, BW etc ) :-( regards --- Alexei Roudnev <alex(a)relcom.net> wrote: > > > > > I read document of these tools and find they work > with > > Cisco products. But, how about Juniper M160 or > M320, > > Unishpere's BRAS products? Where can I find > Juniper's > > OID on its tempreture, chassis, CPU, bandwidth ? > Does > They use standart MIB2 and a little of Cisco > specific MIB's. As I already > said, it is a good tool to view and monitor traffic, > utilisation, errors, > and use additional tiool to deep monitor vendor > specific parameters. We use > 'snmpstat' to monitor routers, switches, ports and > interfaces (and bgp) and > cricket to watch few additional parameters (to > configure alerts, we use > aliases and mhonarc mail archives with auto > expiration - for alerts, > warnings, reports and audits, and for 'root' and > 'oracle' e-mail. > > > anyone have a running configuration for M160 or > > Unishpere's BRAS products? > CCR can work with anything which (1) allow telnet or > ssh, and (2) can 'write > net' config (in any syntax). > You can use encrypted password file (using > passphrase) if you want. Using > SNMP was rejected, because it is absolutely > device-specific, impossible in > many cases, and we never saw it as a security > problem, because all devices > are restricted to allow ssh or telnet from 2 or 3 > servers only, because > passwords are encrypted, and because automated > config reading and web access > aree much more important vs very abstract > possibility of hacking (in > reality, problem can come from insiders, not from > hackers, so no extra > accounst are allowed on monitoring server). > > You can get configuratuion (initialize tftp > transfer) using some snmp > (WRITE) variable and pre-configured tftp parameters, > but it works on a very > few Cisco devices only. > > As I said, CCR uses 3 methods: > - password file encrypted by public key > - password file encrypted by 3des passphrase; > - explicit password. > > In all cases, problem is with root user only - root > can alway decrypt > password or interseipt web session. User, who have > permission to edit CCR > config and know passphrase, can (in theory) see > passwords as well. Other > users can not, even if they know passphrase - they > can only initiate config > reading. > > Network admins do not know enable passwords, if they > do not need it - they > use passphrase > > To have automated config reading, any of first 2 > methods can be used > (passphrase must be written into special file, if > method 2 is used, > root-only readable). For manual reading, any methgod > can be used, without > any file with passphrase. > > In reality, it is not serious security problem > because all devices can be > accessed from a very few servers only, and because > we can use 'ssh' instead > of 'telnet' (CCR can be configured or select > ssh/telnet automatically). You > can, in turn, play with security level , but it > (again) does not work on > generic case (any cisco device) and is very tricky. > > For Juniper or other device - you can try to program > 'expect' script, or use > 'snmp' initiated transfer - all other things will > work. > > > > > > > On configuration bankup, rancid use telnet (ssh). > But, > > I take this a not-secure methode as it has to code > > password in login script. Is there any tool to get > > configuration file from read-only SNMP cumminity? > > > > > > Joe > > > > > > > > --- Jon Lyons <jlyons30(a)yahoo.com> wrote: > > > > > > > > > Checkout http://perfparse.sourceforge.net/ lets > you > > > graph the data from the nagios plugins... > > > > > > --- Alexei Roudnev <alex(a)relcom.net> wrote: > > > > > > > > > > > I generated config for 'snmpstatd' > automatically, > > > > from user;'s database (it > > > > was simple; all I need was Router, Interface, > > > > User-name, number for this > > > > user, priority). > > > > > > > > For automated config backups, I use CCR (fully > web > > > > based Cisco > > > > configuration -> CVS system). > > > > > > > > > > > > ----- Original Message ----- > > > > From: "Andy Dills" <andy(a)xecu.net> > > > > To: "Charlie Khanna - NextWeb" > > > <charlie(a)nextweb.net> > > > > Cc: <nanog(a)merit.edu> > > > > Sent: Thursday, October 28, 2004 11:46 AM > > > > Subject: Re: Network Monitoring System - > > > > Recommendations? > > > > > > > > > > > > > > > > > > On Thu, 28 Oct 2004, Charlie Khanna - > NextWeb > > > > wrote: > > > > > > > > > > > Hi - I was interested in finding out what > > > > software applications other > > > > ISPs > > > > > > are using for network monitoring? For > > > example: > > > > > > > > > > > > > > > > > > > > > > > > 1) Overall network health - uptime > > > reports > > > > > > > > > > http://www.nagios.org > > > > > > > > > > > 2) Backup router config > automatically > > > > > > > > > > http://www.shrubbery.net/rancid/ > > > > > > > > > > > 3) Bandwidth reporting (or > integration > > > > with an MRTG-type app) > > > > > > > > > > http://cricket.sourceforge.net/ > > > > > > > > > > > 4) SNMP trap support (BGP/OSPF > session > > > > drops - emails out) > > > > > > > > > > http://www.snmptt.org/ > > > > > http://www.nagios.org > > > > > > > > > > > 5) Database back end (port info into > or > > > > over to other apps) > > > > > > > > > > > > I'm just looking for something well > rounded > > > for > > > > a small ISP. I've heard > > > > > > about OpenNMS and other apps but I'd like > to > > > get > > > > everyone's feedback. > > > > > > Thanks! > > > > > > > > > > Nothing all in one place, that I'm aware of. > But > > > > with a little work, you > > > > > could probably integrate it all into nagios. > > > After > > > > all, you can make the > > > > > host names or descriptions URLs that link to > > > > bandwidth and error graphs or > > > > > other tools. > > > > > > > > > > Andy > > > > > > > > > > --- > > > > > Andy Dills > > > > > Xecunet, Inc. > > > > > www.xecu.net > > > > > 301-682-9972 > > > > > --- > > > > > > > > > > > > > > > > > > > > > > > __________________________________ > > > Do you Yahoo!? > > > Yahoo! Mail Address AutoComplete - You start. We > > > finish. > > > http://promotions.yahoo.com/new_mail > > > > > > > __________________________________________________ > > Do You Yahoo!? > > Log on to Messenger with your mobile phone! > > http://sg.messenger.yahoo.com > > __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

1 0

why upload with adsl is faster than 100M ethernet ?
by Joe Shen 01 Nov '04

01 Nov '04

Hi, I met a question with upload speed and network access speed. One of our customer lease two lines from us. One is 2Mbps ADSL line the other is 100Mbps fiber ethernet link. The customer needs to upload files to server in Japan usually. Now, the customer complaint that the upload speed of ADSL is much slower than fiber link. For a 5MB file, it takes 420 seconds with fiber link to finish uploading while the time for ADSL is 170 seconds. There is no difference in routing path between ADSL far end and fiber ethernet far end other than the access method. ( from the first acess router ). We measured the latency between our core router and customer's computer, and find there is no packet loss between with both line while latency on ADSL is 0.3ms higher than fiber ethernet. And, no link along the path inside our network is over burdened. That is, bottleneck locates somewhere outside our network. And there is asymetric route between our network and Japan server. But, why TCP throughput experience so much difference between ADSL acess and fiber link access? Thanks. Joe __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

12 20

IPv6 support for com/net zones on October 19, 2004
by Matt Larson 01 Nov '04

01 Nov '04

VeriSign will add support for accessing the com/net zones using IPv6 transport on October 19, 2004. On that day, AAAA records for a.gtld-servers.net and b.gtld-servers.net will be added to the root and gtld-servers.net zones. We do not anticipate any problems resulting from this change, but because these zones are widely used and closely watched, we want to let the Internet community know about the changes in advance. Matt -- Matt Larson <mlarson(a)verisign.com> VeriSign Naming and Directory Services

12 20

Finding information about metro private line service in downtown SF
by Bill Garrison 01 Nov '04

01 Nov '04

Hello, I am investigating the options for linking up a new office to our (coincidentally) close datacenter in downtown San Francisco. Both locations are SOMA and within about 10 minutes walking of each other. Calling SBC provided me with a rather clueless person telling me all about ATM, Frame Relay and other options I don't want. To his credit, I believe I may have been defining what I want incorrectly. Since both areas are well within the same LATA (do people say that anymore?) I am simply looking for some sort of private line service be it fiber or copper. Who are the providers local to the area? Is there any way of finding what is in the ground around me? (I know UPN Networks is in between our offices so I am confident there is fiber or copper all around us.) What are the easiest options for this sort of thing? What kind of pricing might we be looking at? To give some perspective, we push a significant amount of bandwidth through our datacenter such that if the costs work out we would prefer a private line into our datacenter (for many reasons including cost, internet speed in the office, ability to have a backend entrance to our network for "offsite" backups, etc.). We would also then just setup a DSL line or T1 for emergencies/failover.[1] Please reply offlist, thanks for any insight, Bill [1]: Our alternative is too just get a T1 with a DSL for manual failover but piping into our datacenter would provide a substantial number of benefits. (this is a small office with about 10 people all of whom can handle cold-swapping to DSL if ever needed...)

8 9