January 2008 - Test - lists.nanog.org

Sicily to Egypt undersea cable disruption
by Sean Donelan 30 Jan '08

30 Jan '08

If its not one cable, its another cable. http://www.guardian.co.uk/technology/2008/jan/30/asia.internet.outage Huge swathes of the Middle East and Asia have been left without internet access after a vital undersea cable was damaged. A fault in the pipeline, which runs between Sicily and Egypt, has dramatically reduced access in countries including Saudi Arabia, Dubai and India, leaving millions of workers struggling to get online.

1 0

Anyone (else)still have a Extreme Black Diamond deployed?
by Drew Weaver 30 Jan '08

30 Jan '08

This is slightly technical (not really, but slightly)... I am looking for folks willing to help me determine whether or not newer versions of the firmware have "slightly closer to functional" SNMP support please contact me off-list if you are interested. I've tried asking extreme directly, but they're honestly not sure. I'm mainly interested in whether or not you can pass a value to OID: RFC1213-MIB::atIfIndex when issuing a snmpwalk as you are able to when polling a Cisco, Foundry switch (at least the ones I have) For example: snmpwalk -v1 -c com host OID: RFC1213-MIB::atIfIndex.20399 (should return all IP addresses which are attached to Vlan 20399 ;-) TIA as always, -Drew

2 1

Worst Offenders/Active Attackers blacklists
by Tomas L. Byrnes 29 Jan '08

29 Jan '08

There are a number of public network attacker threat feeds available, the most well know of which, AFAIK, is the Internet Storm Center's DShield system. I know a few network operators, including at least one on this list, also run private versions of the DShield system. Are there many others? Do any or most network operators have some sort of private current block list that gets pushed out to routers and or firewalls/traffic shapers in real time? I'm the CTO and founder of ThreatSTOP (www.threatstop.com) and we're currently propagating the DShield, and some other, block lists for use in firewalls. I'm interested in gathering additional threat information, and serving additional communities. Is there any interest in a collaborative platform where anonymized candidates for blocking would be submitted by a trusted group, and then propagated out to the whole group? I'd be happy to collect responses anonymously and submit a summary back to the list, if people don't want to open this up on the list.

10 15

Re: IPv6 questions
by snort bsd 29 Jan '08

29 Jan '08

It does make sense though. Say one megabits interface with 20 VLANs. In that scenario, every VLAN, usually has own link-local address. It is more practical than "multiple interfaces with same link-local address." I found this on Juniper router and now assume it is Juniper specific implementation. Thanks all ----- Original Message ---- From: Scott Morris <swm(a)emanon.com> To: Erik Nordmark <erik.nordmark(a)sun.com>; snort bsd <snortbsd(a)yahoo.com.au> Cc: nanog(a)merit.edu; juniper-nsp <juniper-nsp(a)puck.nether.net> Sent: Tuesday, 29 January, 2008 12:36:55 PM Subject: RE: IPv6 questions And unless you are on only certain particular devices (e.g. L3 switches) then the end device won't necessarily have any relevant clue what VLAN it's on. I have never seen/heard of an RFC for it either and would certainly wonder "WHY?". :) Scott -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Erik Nordmark Sent: Tuesday, January 29, 2008 1:44 PM To: snort bsd Cc: nanog(a)merit.edu; juniper-nsp Subject: Re: IPv6 questions snort bsd wrote: > Never mind > > it is the VLAN number. But which RFC define this? I've never seen an IPv6 RFC specify to put the VLAN number in the link-local address. Thus this must be an (odd) choice made by some implementation. Perhaps the implementation somehow requires that all the link-local addresses for all its (sub)interfaces be unique, even though the RFCs assume that the implementation should be able to deal with multiple interfaces with same same link-local address. Erik > Thanks all > > Dave > > ----- Original Message ---- > From: snort bsd <snortbsd(a)yahoo.com.au> > To: nanog(a)merit.edu; juniper-nsp <juniper-nsp(a)puck.nether.net> > Sent: Monday, 28 January, 2008 3:05:59 PM > Subject: IPv6 questions > > > Hi All: > > With link-local IPv6 address, the converting from MAC-48 to EDU-64 > address format (FF FE stuffing). How does the VLAN tags affect the > conversion? > > With the rule of FF FE stuffing, I can see clearly work on the ptp > interfaces. But on those Ethernet based VLANs, it doesn't seem to > follow that pattern: > > Current address: 00:90:69:4a:b9:5d, Hardware address: > 00:90:69:4a:b9:5d > > well, i assume the link-local should be fe80::290:69ff:fe4a:b95d/64. > actually, it shows: > > Destination: fe80::/64, Local: fe80::290:6903:94a:b95d > > how does the router get this 03 09 instead of ff fe? > > Thanks all > > > > > > > > > Make the switch to the world's best email. Get the new Yahoo!7 > Mail now. www.yahoo7.com.au/worldsbestemail > > > > > > > > Make the switch to the world's best email. Get the new Yahoo!7 > Mail now. www.yahoo7.com.au/worldsbestemail > > Make the switch to the world's best email. Get the new Yahoo!7 Mail now. www.yahoo7.com.au/worldsbestemail

1 0

Re: IPv6 questions
by snort bsd 29 Jan '08

29 Jan '08

Never mind it is the VLAN number. But which RFC define this? Thanks all Dave ----- Original Message ---- From: snort bsd <snortbsd(a)yahoo.com.au> To: nanog(a)merit.edu; juniper-nsp <juniper-nsp(a)puck.nether.net> Sent: Monday, 28 January, 2008 3:05:59 PM Subject: IPv6 questions Hi All: With link-local IPv6 address, the converting from MAC-48 to EDU-64 address format (FF FE stuffing). How does the VLAN tags affect the conversion? With the rule of FF FE stuffing, I can see clearly work on the ptp interfaces. But on those Ethernet based VLANs, it doesn't seem to follow that pattern: Current address: 00:90:69:4a:b9:5d, Hardware address: 00:90:69:4a:b9:5d well, i assume the link-local should be fe80::290:69ff:fe4a:b95d/64. actually, it shows: Destination: fe80::/64, Local: fe80::290:6903:94a:b95d how does the router get this 03 09 instead of ff fe? Thanks all Make the switch to the world's best email. Get the new Yahoo!7 Mail now. www.yahoo7.com.au/worldsbestemail Make the switch to the world's best email. Get the new Yahoo!7 Mail now. www.yahoo7.com.au/worldsbestemail

3 2

Quality Technologies?
by Mike Lyon 29 Jan '08

29 Jan '08

Anyone ever heard of these peeps? http://www.qualitytech.com/ Feedback on any of their services? -Mike

2 1

IPv6 questions
by snort bsd 28 Jan '08

28 Jan '08

Hi All: With link-local IPv6 address, the converting from MAC-48 to EDU-64 address format (FF FE stuffing). How does the VLAN tags affect the conversion? With the rule of FF FE stuffing, I can see clearly work on the ptp interfaces. But on those Ethernet based VLANs, it doesn't seem to follow that pattern: Current address: 00:90:69:4a:b9:5d, Hardware address: 00:90:69:4a:b9:5d well, i assume the link-local should be fe80::290:69ff:fe4a:b95d/64. actually, it shows: Destination: fe80::/64, Local: fe80::290:6903:94a:b95d how does the router get this 03 09 instead of ff fe? Thanks all Make the switch to the world's best email. Get the new Yahoo!7 Mail now. www.yahoo7.com.au/worldsbestemail

1 0

NANOG 42, Feb. 17-20, San Jose
by Carol Wadsworth 28 Jan '08

28 Jan '08

Reminder - if you are planning to attend NANOG 42 in San Jose, Feb. 17-20, and need overnight accommodations, the special group room rate at the Fairmont expires later today. For all meeting details, please see www.nanog.org.

1 0

Re: EU Official: IP Is Personal
by fred＠cisco.com 28 Jan '08

28 Jan '08

>I dunno. I think I have a pretty good guess of who 192.159.10.227 is, or >at least who it was as of 14:35 -0800 today. Well, let me ask you you think 171.70.120.60 is. I'll give you a hint; at this instant, there are 72 of us. Here's another question. Whom would you suspect 171.71.241.89 is? At this point in time, I am in Barcelona; if I were home, that would be my address as you would see it, but my address as I would see it would be in 10.32.244.216/29. There might be several hundred people you would see using 171.71.241.89; One of the big issues with the Tsinghua SAVA proposal in the IETF is specifically the confusion of the application layer with the IP layer. They propose to embed personal identity into the IP address, and in that there are a number of issues. Internet Address != application layer identification. What we can do with IP addresses is conclude that the user of the machine with an address is likely to be one of its usual users. We can't say that with 100% certainty, because there are any number of ways people can get "unusual" access. But even so, if one can show a pattern of usage, the usual suspects can probably figure out which of them, or what other "unusual" user, might have done this or that. That is the model forensic analysts follow. And the address is personal information to the extent that it limits the set of usual suspects to a set that includes you or I.

14 21

Re: Lessons from the AU model
by Tom Vest 27 Jan '08

27 Jan '08

On Jan 21, 2008, at 6:50 AM, Roderick Beck wrote: > I didn't find that very convincing. Overspending on infrastructure > does not force prices up or raise long term costs. > > Excess capacity leads to prices falling in telecom and every other > market. > > Basic economics. Maybe we should go a little more basic still... In the absence of competition (and esp. in the presence of risk of empowering competitive entrants), supply has no general/necessary effect on prices at all. So excess capacity of a product that is completely monopolized (or priced by cartel fiat, ala OPEC or SC) is largely irrelevant. On the other hand, in the specific case of Internet access (retail or wholesale level), prices have a huge impact on demand -- that's called "price elasticity". Given the absence of any mechanism to reveal "natural" prices or "actual" demand, how does one know whether/how much "excess capacity" there is anyway? > I'm sure the Americans are experiencing excess capacity right now > in housing ... :) American construction / real estate investors and speculators are certainly experiencing excess capacity in the most extreme way, but that's because the fully loaded price of housing has gone up a great deal (and/or, the actual price point is finally being discovered/ revealed) -- at least for the credit-challenged market segment that was the primary engine of demand behind the recent boom. For them especially, lending terms have deteriorated tremendously. Now general interest rates are falling again, but credit requirements are tightening so much that, for many in that group, credit will not be available "at any price". If that seems counterintuitive, think Japan between c. 1993-2005: huge "excess capacity" in real estate, inflation-adjusted interest rates at zero or below, and yet (or perhaps "as a consequence") no one buys, because the banks refuse to lend... Come to think of it, our sector has been struggling with its own roughly similar terms-of-exchange crisis since about 2004-2005... arguably driven by very similar prior circumstances as well... worth investigating a bit further perhaps... TV > Sent wirelessly via BlackBerry from T-Mobile. > > -----Original Message----- > From: Tom Vest <tvest(a)eyeconomics.com> > > Date: Mon, 21 Jan 2008 01:10:16 > To:Geoff Huston <gih(a)apnic.net> > Cc:Matthew Moyle-Croft <mmc(a)internode.com.au>, Randy Bush > <randy(a)psg.com>, Andy Davidson <andy(a)nosignal.org>, > Andrew Odlyzko <odlyzko(a)dtc.umn.edu>, nanog(a)merit.edu > Subject: Re: Lessons from the AU model > > > > > > On Jan 20, 2008, at 11:14 PM, Geoff Huston wrote: > >> >> Matthew Moyle-Croft wrote: >>>> >>>> Southern Cross cost some US $1B to construct about a decade ago >>> RFS was Nov 2001. They full paid the debt from a US$1.3B cost of >>> construction in Oct 2005. >>> (see http://www.southerncrosscables.com/public/News/newsdetail.cfm? >>> StoryID=14) >>> So, they're making some VERY decent money out of the duopoly with >>> AJC. >> >> Yes, that exercise managed to weather the slump in prices a couple >> of years back when supply far exceeded demand, and then exploit >> their excellent technical position when demand picked up and >> translate that position into good revenue streams that appear to be >> well above initial construction and ongoing operational costs. >> >> I don't believe AJC has had a similar story, but others may know >> more here. >> >>> Hence why Telstra's building their OWN cable to Hawaii. It's >>> cheaper to build than buy! >> >> My comment is that its generally more complicated than that, and >> from a sufficiently distanced view overspending on infrastructure >> forces up prices as much as underspending. The only real revenue >> stream to fund this infrastructure comes from this pool of 24M folk >> living at the bum end of the Pacific Ocean. Paying for a large >> number of underutilized cable projects does have a higher total >> recurrent cost than would be the case of there were efficient >> sharing of a smaller number of cable projects, and ultimately its >> consumers who fund this inefficiency in supply. So sometimes >> competition provides natural incentives for cost efficient >> investments, that ultimately benefit consumers, and sometimes >> competition gets it wrong and over-invests because the actors >> cannot resolve their individual requirements in ways that result in >> efficient sharing of common venture infrastructure investments, and >> in such cases the consumer ends up paying for the inefficiency in >> infrastructure investment. So sometimes it is cheaper to lease than >> construct, and sometimes its not. > > For anyone who has the opportunity and inclination to truly > monopolize an isolated market, the "best" price to sell critical > inputs to a potential competitor is certainly (infinity) -- and if > the input is fungible, then *everyone* is a potential competitor. > Sure your market grows less/more slowly, and your near-term revenues > are lower -- but you have an untroubled eternity of guaranteed > revenue/profit to console you. Building new facilities, even > terrifically expensive and completely redundant ones, will cost less > than (infinity) -- so of course this makes perfect (if utterly crazy) > sense. > > (and yes, since oceans are not the only features that impose large > multipliers on facilities construction costs, this is still a fairly > common situation in the world) > > However, it's not just "consumers" who are paying the price; it's > also every other producer in the economy. So if the bottleneck > exploiter is not generating as much or more jobs, innovations, > private investments, taxes, and other returns to the general economy, > compared to the amount that were foregone (never created) by every > other productive endeavor in the market, then it's the economy as a > whole, present and future, that's paying the price. > >> Here endth the Nanog lesson in economics from me ( :-) ) >> >> My only point in entering this thread was to make the observations >> that the lessons from the AU model may not be very generic - small >> isolated communities often have a unique set of constraints for >> investments in communications systems and that often results in >> different industry structures, different relationships between the >> actors and often results in different pricing structures in the >> consumer market. I'm not sure that I'd be confident in generalizing >> this particular history into anything more generic that would apply >> to other communities in other parts of the world. > > (My anti-fatalist rant) > > This all seems pretty straightforward -- except of course that you, > we, and presumably the A-Cs and other fairly observant people can > make similar observations, and perhaps even arrive at similar/shared > conclusions. Given that, and the potentially extreme/enduring costs > (i.e., for everyone but the bottleneck exploiter) borne by everyone > who happens to get stuck in the wrong kind of market, shouldn't we > look for other, more practical lesson(s) as well? > > TV

12 24