March 2009 - Test - lists.nanog.org

AT&T Wireless Data Contact
by James Ribar 16 Mar '09

16 Mar '09

Hi, Our half or dozen or so iPhone users are experiencing issues with accessing our corporate website and email services. I spoke to AT&T's support who after a few minutes told me it wasn't an ATT problem and forwarded me to Apple who said it was an issue with the website and were unable to help. I have verified that the website and email in question work just fine when connecting from other networks, ruling out in my book an issue on our end. As far as I can tell the issue seems to be with AT&T's DNS servers which are not resolving our domains properly. Accessing services by IP address works fine. In an effort to avoid being bounced back and forth on the phone all day between AT&T and Apple, is there anyone that can contact me off list who is able to help with this issue or point me in the right direction? Thanks, James

1 0

Netflow on SUP720-3BXL
by Andy Bierlair 16 Mar '09

16 Mar '09

I’m trying to run netflow on one of our Cisco core routers (SUP720-3BXL), but I think I am hitting some limitations because of this: %EARL_NETFLOW-SP-4-TCAM_THRLD: Netflow TCAM threshold exceeded, TCAM Utilization [99%] The setup of netflow looks like this: ip flow-cache entries 524288 mls aging fast time 5 threshold 32 mls aging long 300 mls aging normal 60 mls netflow usage notify 80 300 mls flow ip full no mls flow ipv6 mls nde sender version 5 no mls verify ip checksum no mls acl tcam share-global ip flow-export source Loopback0 ip flow-export version 5 origin-as ip flow-export destination <ip> <port> Then I have this enabled on all border interfaces/vlans (peering / transit / other core routers) that are of interest for my stats: ip route-cache flow Some more details about the problem: #sh mls netflow table-contention detailed Earl in Module 5 Detailed Netflow CAM (TCAM and ICAM) Utilization ================================================ TCAM Utilization : 100% ICAM Utilization : 13% Netflow TCAM count : 262033 Netflow ICAM count : 17 Netflow Creation Failures : 4822220 Netflow CAM aliases : 1 #sh mls netflow table-contention aggregate Earl in Module 5 Aggregate Netflow CAM Contention Information ============================================= Netflow Creation Failures : 130003616 Netflow Hash Aliases : 4 I understand that the TCAM is full, but what can I do against it? This is a busy core router: Aggregated traffic: 7-8 GBIT/s Packets per Second: 1.0 - 1.2 Million I wouldn't mind analyzing only every 10th or 100th flow, which seems to be a common practice. Any good piece of advice is welcome. Thanks! - Andy

4 3

Dynamic IP log retention = 0?
by Brett Charbeneau 16 Mar '09

16 Mar '09

I've been nudging an operator at Covad about a handful of hosts from his DHCP pool that have been attacking - relentlessly port scanning - our assets. I've been informed by this individual that there's "no way" to determine which customer had that address at the times I list in my logs - even though these logs are sent within 48 hours of the incidents. The operator advised that I block the specific IP's that are attacking us at my perimeter. When I mentioned the fact that blocking individual addresses will only be as effective as the length of lease for that DHCP pool I get the email equivalent of a shrug. "Well, maybe you want to ban our entire /15 at your perimeter..." I'm reluctant to ban over 65,000 hosts as my staff have colleagues all over the continental US with whom they communicate regularly. I realize these are tough times and that large ISP's may trim abuse team budgets before other things, but to have NO MECHANISM to audit who has what address at any given time kinda blows my mind. Does one have to get to the level of a subpoena before abuse teams pull out the tools they need to make such a determination? Or am I naive enough to think port scans are as important to them as they are to me on the receiving end? -- ******************************************************************** Brett Charbeneau, GSEC Gold, GCIH Gold Network Administrator Williamsburg Regional Library 7770 Croaker Road Williamsburg, VA 23188-7064 (757)259-4044 www.wrl.org (757)259-4079 (fax) brett(a)wrl.org ********************************************************************

34 57

Re: Netflow on SUP720-3BXL
by Andy Bierlair 15 Mar '09

15 Mar '09

yes ip cef, this is enabled: IP fast switching is enabled IP fast switching on the same interface is disabled IP Flow switching is enabled IP CEF switching is enabled IP Flow switching turbo vector IP Flow CEF switching turbo vector and so on... - Andy On Sun, Mar 15, 2009 at 3:08 AM, Bill Blackford <BBlackford(a)nwresd.k12.or.us> wrote: > > just a shot in the dark. Do you have 'ip cef' in global config? > > -b > ________________________________________ > From: Andy Bierlair [globichen(a)gmail.com] > Sent: Saturday, March 14, 2009 6:55 PM > To: nanog(a)nanog.org > Subject: Netflow on SUP720-3BXL > > I’m trying to run netflow on one of our Cisco core routers (SUP720-3BXL), > but I think I am hitting some limitations because of this: > > > > %EARL_NETFLOW-SP-4-TCAM_THRLD: Netflow TCAM threshold exceeded, TCAM > Utilization [99%] > > > > The setup of netflow looks like this: > > > > ip flow-cache entries 524288 > > mls aging fast time 5 threshold 32 > > mls aging long 300 > > mls aging normal 60 > > mls netflow usage notify 80 300 > > mls flow ip full > > no mls flow ipv6 > > mls nde sender version 5 > > no mls verify ip checksum > > no mls acl tcam share-global > > > > ip flow-export source Loopback0 > > ip flow-export version 5 origin-as > > ip flow-export destination <ip> <port> > > > > Then I have this enabled on all border interfaces/vlans (peering / transit / > other core routers) that are of interest for my stats: > > > > ip route-cache flow > > > > Some more details about the problem: > > > > #sh mls netflow table-contention detailed Earl in Module 5 Detailed Netflow > CAM (TCAM and ICAM) Utilization > ================================================ > > TCAM Utilization : 100% > > ICAM Utilization : 13% > > Netflow TCAM count : 262033 > > Netflow ICAM count : 17 > > Netflow Creation Failures : 4822220 > > Netflow CAM aliases : 1 > > > > > > #sh mls netflow table-contention aggregate Earl in Module 5 Aggregate > Netflow CAM Contention Information > ============================================= > > Netflow Creation Failures : 130003616 > > Netflow Hash Aliases : 4 > > > > > > I understand that the TCAM is full, but what can I do against it? This is a > busy core router: > > > > Aggregated traffic: 7-8 GBIT/s > > Packets per Second: 1.0 - 1.2 Million > > > > I wouldn't mind analyzing only every 10th or 100th flow, which seems to be a > common practice. > > > > Any good piece of advice is welcome. > > > > Thanks! > > > > - > Andy

2 1

Re: Sprint latency
by devang patel 15 Mar '09

15 Mar '09

I found this in my trace route: 1 if-13-0-0-818.mcore4.pdi-paloalto.as6453.net (66.198.97.18) 4 msec if-9-0-0.mcore4.pdi-paloalto.as6453.net (216.6.33.6) 0 msec if-13-0-0-818.mcore4.pdi-paloalto.as6453.net (66.198.97.18) 0 msec 2 sl-st20-pa-15-0.sprintlink.net (144.223.243.21) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 4 msec 0 msec 0 msec 3 sl-crs1-sj-0-14-0-1.sprintlink.net (144.232.8.109) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 8 msec 8 msec 8 msec 4 sl-crs1-stk-0-0-0-2.sprintlink.net (144.232.20.98) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 8 msec 8 msec 8 msec 5 sl-crs1-kc-0-6-3-0.sprintlink.net (144.232.8.170) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 56 msec 56 msec 56 msec 6 sl-bb21-nsh-10-0-0.sprintlink.net (144.232.18.113) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 76 msec 80 msec 80 msec 7 sl-crs1-atl-0-10-0-0.sprintlink.net (144.232.20.224) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 84 msec 84 msec 84 msec 8 sl-crs1-mia-0-8-0-2.sprintlink.net (144.232.18.221) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 92 msec 92 msec 92 msec 9 sl-crs1-mia-0-0-0-1.sprintlink.net (144.232.2.189) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 92 msec 92 msec 92 msec 10 sl-gw10-mia-11-0-0.sprintlink.net (144.232.28.65) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 92 msec 92 msec 96 msec 11 sl-racsa-211948-0.sprintlink.net (144.224.115.118) [AS 1239 <http://ws.arin.net/whois/?queryinput=1239>] 244 msec 248 msec 248 msec 12 200.122.191.182 [AS 3790] [MPLS: Label 49 Exp 0] 260 msec 256 msec 252 msec 13 200.122.191.142 [AS 3790] 248 msec 244 msec 240 msec thanks, Devang Patel On Sat, Mar 14, 2009 at 10:00 PM, Taylor Neill <taylor(a)dec0de.org> wrote: > Boston -> phoenix ~25% packet loss > > > On Sat, Mar 14, 2009 at 11:53 PM, devang patel <devangnp(a)gmail.com> wrote: > >> Hello, >> >> Any one is facing any latency in network passing trough sprint network, we >> have remote site and having trouble with accessing application from data >> centers. >> >> 7 200.122.150.22 0 msec 0 msec 4 msec >> >> *8 144.224.115.113 260 msec 276 msec 284 msec* >> >> * 9 144.232.2.244 276 msec 280 msec 292 msec* >> >> *10 144.232.2.204 292 msec 304 msec 300 msec* >> >> 11 144.223.162.42 120 msec 120 msec 120 msec >> thanks, >> Devang Patel >> > > > > -- > Taylor > 647.287.8632 >

1 0

Sprint latency
by devang patel 14 Mar '09

14 Mar '09

Hello, Any one is facing any latency in network passing trough sprint network, we have remote site and having trouble with accessing application from data centers. 7 200.122.150.22 0 msec 0 msec 4 msec *8 144.224.115.113 260 msec 276 msec 284 msec* * 9 144.232.2.244 276 msec 280 msec 292 msec* *10 144.232.2.204 292 msec 304 msec 300 msec* 11 144.223.162.42 120 msec 120 msec 120 msec thanks, Devang Patel

1 0

AT&T Security Contact
by Jeff Wheelhouse 14 Mar '09

14 Mar '09

Hi All, One of our customers has forwarded us a rambling, disjointed threat from someone sending from abuse(a)sbcglobal.net who claims to be "the Security Manager for AT&T Internet Services Security Center, its subsidiaries and affiliates" who won't provide a name or personal contact information but who promises to (and I quote) "DNS Block" some of the customer's IP's (in our allocation) over a problem AT&T has with one of the customer's customers. After reading the message, I checked the situation myself and the problem complained about appears to have been resolved some time ago, if it ever existed at all. Also, the IP's in question are not, as far as I know, DNS servers; I am quite sure they are shared hosting IP's, so I don't know what AT&T is proposing to do, exactly, but it sounds like a threat to interfere with a bunch of innocent people's web sites for what appear to be bogus reasons. They have ignored multiple confirmed-delivery-I've-seen-the-logs attempts to respond by our customer, our customer's customer, and myself. Could I please get someone from AT&T to contact me off-list about this before it turns into a "thing?" Thanks! Jeff

1 0

Zombie Nation [Was: Re: Dynamic IP log retention = 0?]
by Paul Ferguson 14 Mar '09

14 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Sat, Mar 14, 2009 at 12:42 AM, Joe Greco <jgreco(a)ns.sol.net> wrote: > > I have worked for large ISP's, I understand corporate budgets and > politics, and I'm smart enough to understand that "corporate budgets and > politics" do not define what is acceptable within the framework of the > Internet. Were "corporate budgets and politics" to define that, we'd be > likely to see a balkanized, spam-riddled > ghost-of-what-used-to-be-the-Internet where the potential for making a > buck defines what is right and what is wrong. > As opposed to the spambot-infested, zombified Internet we have now? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) wj8DBQFJu2FKq1pz9mNUZTMRAvxJAJ9GNeEvWPyjMVyME6t6ZZWJ0Qr5hACgscPg r5qQGjqvhx4DUv+YSQnBe5A= =DEXn -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/

1 0

SBC NOC contact
by William Pitcock 14 Mar '09

14 Mar '09

Hello, Does anyone here have an SBC/AT&T NOC contact that goes to an actual human being? Their NOC handle email, support(a)swbell.net bounces with the following message: | Dear SBC Yahoo! Member, | | Our Support Request site has recently changed. | Please submit your question or comment via our new online form available at | http://help.sbcglobal.net/techquestions.php. | | Thank you for contacting SBC Yahoo! Technical Support. Which is especially funny because I don't do business with SBC at all. Also, their website leads us to a "we don't take emails anymore" message. But I digress, their nameservers are out of sync, causing problems with reverse DNS suddenly going away for some SBC IPs in our logs. Appears to be an issue with ns1.pbi.net... So yeah, if someone knows somebody who could fix that, that would be fantastic. -- William Pitcock SystemInPlace - Simple Hosting Solutions 1-866-519-6149

2 1

Re: wires mess thread
by Gadi Evron 13 Mar '09

13 Mar '09

This came across my RSS feed today from gizmodo: http://www.reddit.com/r/technology/comments/845v3/this_data_center_has_got_…

1 0