April 2009 - Test - lists.nanog.org

Re: Do we still need Gi Firewall for 3G/UMTS/HSPA network ?
by Mike Tancsa 16 Apr '09

16 Apr '09

At 12:19 AM 4/10/2009, Rubens Kuhl wrote: >On shared media like radio access, every unwanted packet means less >performance you will get out of the network. >This can be done by NAT, >stateful filtering with public IPs or stateless filtering with public >IPs; the advantage of doing NAT is making it easier for the end-point >software to know that (two ways: noticing your local IP address is >from RFC1918 space, or connecting to a server that tells your IP in >order to compare it to the local address). > >As such, GPRS, EDGE, EVDO, HSPA, LTE and Mobile WiMAX services have >good reasons to use NAT, and most do. Speaking of unwanted traffic, I was quite surprised how much unwanted traffic I see on my RFC 1918 space thats given out by one of the Canadian telcos-- i.e. this is behind the giant natting firewalls.... Blocking all inbound traffic and logging to pflog (pcap format) Its full of cruft like this 0[i7]# tcpdump -nr /var/log/pflog | head -2 reading from file /var/log/pflog, link-type PFLOG (OpenBSD pflog file) 16:01:09.899554 IP 10.141.184.158.2167 > 10.141.81.113.445: Flags [S], seq 2743613661, win 53760, options [mss 1360,nop,wscale 3,nop,nop,TS[|tcp]> 16:01:10.439516 IP 10.141.184.158.2167 > 10.141.81.113.445: Flags [S], seq 2743613661, win 53760, options [mss 1360,nop,wscale 3,nop,nop,TS[|tcp]> Looking at the pflogs for the last 3 days of just port 445 and 135 scans traffic as well as the odd ping packet 1[i7]# cat pflo* | tcpdump -nr - -w /tmp/scan.pcap port 445 or port 135 or icmp reading from file -, link-type PFLOG (OpenBSD pflog file) tcpdump: pcap_loop: bogus savefile header 1[i7]# tcpstat -r /tmp/scan.pcap -a Bytes/sec = 0.4 B Bytes/minute = 26.2 B Bytes/hour = 1.5 KB Bytes/day = 36.8 KB Bytes/month = 1.1 MB 0[i7]# Hmmm... considering some plans start at 1MB per month.... ---Mike

1 0

RE: Do we still need Gi Firewall for 3G/UMTS/HSPA network ?
by Skywing 16 Apr '09

16 Apr '09

Verizon filters unsolicited inbound traffic for their EVDO customers in my experience. - S -----Original Message----- From: Roland Dobbins <rdobbins(a)cisco.com> Sent: Thursday, April 09, 2009 09:32 To: NANOG list <nanog(a)nanog.org> Subject: Re: Do we still need Gi Firewall for 3G/UMTS/HSPA network ? On Apr 9, 2009, at 11:48 PM, Lee, Steven (NSG Malaysia) wrote: > Please share your thought and thanks in advance :) No, IMHO. Most broadband operators don't insert firewalls inline in front of their subscribers, and wireless broadband is no different. The infrastructure itself must be protected via iACLs, the various vendor-specific control-plane protection mechanisms, and so forth, but inserting additional state in the middle of everything doesn't buy anything, and introduces additional constraints and concerns. ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)cisco.com> // +852.9133.2844 mobile Our dreams are still big; it's just the future that got small. -- Jason Scott

4 3

Re: Looking for AT&T / Verizon / Sprint WWAN service impressions - on or off-list replies welcome
by Alexander Harrowell 16 Apr '09

16 Apr '09

On Thursday 16 April 2009 03:08:52 Eddie wrote: > > Also interested in similar information on impressions of similar EMEA > > WWAN service providers, particularly Vodaphone and T-Mobile, if anyone > > has experiences with these. > I regularly use 3UK (Hutchison)'s data service. £10 gets you 15GB of xfer a month, but you need to either sign a contract or else pay £50 for the hardware, which as with most UMTS operators is a Huawei E220 USB dongle. That particular device currently supports radio air interfaces from GSM up to HSPA 7.2Mbit/s. There is support for the E220 in current Linux kernels. However, 3UK (and most of the other operators) ship it with a Windows client program installed on the USB device that autoruns when you connect it to a computer. This provides a "pretty" interface to it. Unfortunately, it also means that unless you activate the device at once, under Linux it gets detected as a USB mass storage device not a tty. You can get around this if you connect it before booting; I think there is a modprobe or similar operation that has to happen, so there is almost certainly a command-line workaround. If it is working correctly you should be able to see three new ttys in /dev/USB. You can then use whatever program you like to dial up, or just run wvdial. In my experience 3UK works reasonably well; they advertise maximum speeds of 3.6Mbit/s downlink, but I've seen higher in practice. The uplink seems to max out at 600-700Kbit/s, which is considerably better than my DSL line. IPs are dynamic, and things like Skype pass through without trouble. I have successfully SSHd into a linux box both from a PC over the modem and using PuTTY from a Nokia E71. Warnings: 3UK's DNS could be better, when I am using their service from a PC I usually set up OpenDNS. On the move, you may encounter problems with the step- down between UMTS and GPRS; 3 gets its backup GPRS national roaming from Orange and you can easily lose a connection between the two. T-Mobile UK was the first UK operator to provide open slather Internet service; they offer a higher level of "unlimited" for a price, which includes not blocking VoIP and a static IP. Otherwise expect similar to 3, as they are beginning to share their radio access networks. Vodafone probably has more coverage than anyone else, but their Internet service may not be to your taste. When they started doing pure 'net, they had a restriction on Web pages over 200KB and pushed everything else through a Novarra box to compress it, which broke a lot of things; I once got a header in my blog server logs that mentioned an XMS, a Novarra, a squid proxy and something from 724 Networks. -------------------------------------------------------

1 0

Mailing list
by energy Duwety Daka 16 Apr '09

16 Apr '09

May you please add me to the mailing list.

1 0

ADMIN: List FAQ/Monthly Post.
by NANOG Mail List Committee 15 Apr '09

15 Apr '09

This 100-line document contains 62% of what you need to know to avoid annoying 10,000 people in your email to the NANOG list. It also contains pointers to another 23%. Please take 5 minutes to read it before you post [again]. General Information =================== About NANOG: http://www.nanog.org/about/ NANOG News: http://www.nanog.org/ NANOG lists and AUP: http://www.nanog.org/mailinglist/ NANOG List FAQ: http://www.nanog.org/mailinglist/listfaqs/ To Subscribe or Unsubscribe from the list: http://mailman.nanog.org/mailman/listinfo/nanog To contact the list's admins: admins(a)nanog.org Posting Policy ============== The NANOG list has over 10,000 subscribers so it is very easy for a thread to have scores of posts while being off-topic and only of interest to only a small proportion of subscribers. Please consider before each post if your email will be of interest to the majority of members or might alternatively be emailed directly the people of interest or posted to another forum. Please read the FAQ and AUP policy before posting for more details. Especially the following are discouraged: * Is a certain site down? Other Outages not affecting half the Internet. Please use http://downforeveryoneorjustme.com/ or a similar site. Please post to the Outages mailing list: http://wiki.outages.org * Spam Please use SPAM-L - http://www.claws-and-paws.com/spam-l * Contacting People * http://puck.nether.net/netops/ * Please try other methods of contacting sites before you post to NANOG. Saying something like "I tried calling 213-555-3333 but no answer" shows you _have_ tried alternative methods first. * Political Issues * Topics such as ICANN policy, Government Policy or Law changes that do not have short term Operational impact should be avoided. * Operation topics with more specific lists * DNS - http://lists.oarci.net/mailman/listinfo/dns-operations * Email - http://www.mailop.org/ * NANOG Mailing list policy Please use the nanog-futures list or contact admins(a)nanog.org Please also avoid ================= * Sending posts to the list relevant to only one or two people on this list, such as tests or traceroutes in response to another post for comparison to those originally posted. * Jokes, Puns, amusing observations, spelling corrections. Other NANOG related lists ========================= * NANOG-futures - for discussion of the evolution of NANOG, including organizational structure, policies and procedures, and agendas for NANOG meetings. Such topics aren't appropriate for the main NANOG mailing list. http://mailman.nanog.org/mailman/listinfo/nanog-futures * nanog-attendee - For discussion of venue-specific issues relevant to attendees of the current NANOG physical meeting. http://mailman.nanog.org/mailman/listinfo/nanog-attendee * nanog-announce - For announcements of NANOG meetings an other Important NANOG related announcements. Low traffic and all posts are also sent to main list. http://mailman.nanog.org/mailman/listinfo/nanog-announce Other Mailing Lists =================== Information about related lists: http://www.nanog.org/mailinglist/listfaqs/otherlists.php

1 0

Re: Diversity - was: Fiber cut in SF area
by joel.mercado＠verizon.net 15 Apr '09

15 Apr '09

Hopefully none of these customers had service and protect ckts that went down... I would be pissed as a ceo if that happen to my company. Hopefully level3's new service offering is 100@percent redundant as stated The new service offerings include: - Protected Wavelengths: Level 3 now provides automatic protection-switching to a dedicated diversely routed wavelength in the event of a network failure. The protection switch, fully automated and managed by Level 3, happens at switching speeds approaching SONET restoration times. The single interface to the customer requires no additional capital cost for customer optical ports, and the diverse restoration path is fixed and fully known to the customer. These features allow customers to achieve fast restoration with predictable performance in their network without adding significant cost and routing complexity. - ------Original Message------ From: Wallace Keith To: nanog(a)nanog.org Subject: Diversity - was: Fiber cut in SF area Sent: Apr 14, 2009 7:06 PM -----Original Message----- From: Roy [mailto:r.engehausen@gmail.com] Sent: Tuesday, April 14, 2009 6:43 PM To: Gino Villarini Cc: nanog(a)nanog.org Subject: Re: Fiber cut in SF area Gino Villarini wrote: > Here in my area most of business outfits that require maximum > availability of Internet or WAN conenctions have implemented dual > connections from dual providers, most with a fiber/copper main and a > fixed wireless backup. This trend goes from banks to Mcdonalds > > > Gino A. Villarini > gav(a)aeronetpr.com > Aeronet Wireless Broadband Corp. > tel 787.273.4143 fax 787.273.4145 > > >A large company in the affected area had a T3 supplied by AT&T and a >wireless link to another ISP that was fed by two metro-ethernet links by >companies other than AT&T. >All three uplinks were lost. So much for having backups, This just goes to emphasize that when creating a diversity or backup scenario, you need to get full disclosure from Provider B that they do not use Provider A's facilities, including shared sheath, duct, etc in any way. Also, there is the need to avoid the same telco buildings, regen huts, etc. and in some cases, entire cities. Any telecom/datacom manager who has done their homework should be able to map out their paths back to critical diverse infrastructure. -Keith Sent on the Now Network� from my Sprint® BlackBerry

14 20

Re: Looking for AT&T / Verizon / Sprint WWAN service impressions- onor off-list replies welcome
by joel.mercado＠verizon.net 15 Apr '09

15 Apr '09

I am 100 percent with you on this. Some techs arrive to our data center with no tools and they have the same response I just thought it was a simple install. I know they have different levels for techs but you should not have to wait another couple of days to complete a install. They should send another tech same day but that's not the case. ------Original Message------ From: Charles Wyble To: Crooks, Sam Cc: nanog(a)nanog.org Subject: Re: Looking for AT&T / Verizon / Sprint WWAN service impressions- onor off-list replies welcome Sent: Apr 15, 2009 7:56 PM What is it about the bloody telcos. You want to spend money, but yet you can't reach the right people to get your questions answered or schedule the service. Gah. I experienced this recently, trying to have some inside wiring work done at my house. They rolled a tech, but then he claimed he "wasn't prepared" to do the work. What exactly was he prepared to do, on an inside wiring call? It took multiple calls / disconnects to SBC to get to the right dept and have a tech deployed who was actually prepared to install the jack. Do these places take courses on anti sustainability? It's amazing they are still in business. Crooks, Sam wrote: > > After much hassle and several false starts and disconnects in getting in > touch with the right department in Sprint, I spoke to a woman in > technical support in the group that supports 3G data cards. > > She said: > > - public IP addresses are used > - static IP available for $3/mo additional > - maximum 3G data plan is 5GB/mo of data transfer, retail reate, $60/mo > (which is typically cheaper than your typical ADSL/IDSL or ISDN service > cost) > > > Sam Crooks > > Sent on the Now Network� from my Sprint® BlackBerry

1 0

Re: Looking for AT&T / Verizon / Sprint WWAN service impressions - on or off-list replies welcome
by Seth Mattinen 15 Apr '09

15 Apr '09

Charles Wyble wrote: > > > Crooks, Sam wrote: >> I'm considering use of AT&T / Verizon / Sprint WWAN services and the >> Cisco 3G router interface cards/integrated module in C880 routers for >> primary or backup WAN network connectivity for routers. >> > > I haven't used the integrated cards with cisco gear. However I do have > 300+ cards deployed throughout the United States (EVDO USB modems on > Linux boxes). > > >> I'm looking for information from users of these services on the >> following: >> - addressing - Do these WWAN services use dynamic, PPPoE or static IP >> assignment typically? Any of the 3? All? >> - is static IP assignment available? > > We have static IP assignment for our Verizon cards. Sprint cards aren't > static. > I received an offlist response indicating Sprint now offers static. ~Seth

3 2

tcptraceroute, traceroute and IP addresses [was]Re: Level3 funkiness
by Scott Weeks 15 Apr '09

15 Apr '09

> # traceroute level3.net When diagnosing things like this try using the IP address and tcptraceroute or some similar tool. NOT plain old traceroute and a DNS name. Especially when writing to a list with participants as technically involved as those on NANOG. scott

2 1

Level3 funkiness
by J. Oquendo 15 Apr '09

15 Apr '09

Anyone else experience sporadic funkiness via Level3? I can't even reach the main website from who knows how many networks I've tried. Also friends and former colleagues have tried to reach the site to no avail. One of my machines on AT&T: # traceroute level3.net traceroute to level3.net (63.211.236.36), 30 hops max, 40 byte packets 4 cr1.n54ny.ip.att.net (12.122.105.58) 11.285 ms 21.702 ms 21.477 ms 5 ggr2.n54ny.ip.att.net (12.122.131.141) 12.712 ms 10.194 ms 16.393 ms 6 so-8-0-0.car3.NewYork1.Level3.net (4.68.127.149) 9.975 ms 10.019 ms 10.833 ms 7 vlan79.csw2.NewYork1.Level3.net (4.68.16.126) 10.162 ms 10.189 ms 14.474 ms 8 ae-71-71.ebr1.NewYork1.Level3.net (4.69.134.69) 15.763 ms 11.166 ms 9.725 ms 9 ae-3-3.ebr4.Washington1.Level3.net (4.69.132.93) 16.139 ms 30.616 ms 16.275 ms 10 ae-64-64.csw1.Washington1.Level3.net (4.69.134.178) 15.684 ms ae-74-74.csw2.Washington1.Level3.net (4.69.134.182) 21.870 ms ae-84-84.csw3.Washington1.Level3.net (4.69.134.186) 28.729 ms 11 ae-92-92.ebr2.Washington1.Level3.net (4.69.134.157) 17.035 ms ae-62-62.ebr2.Washington1.Level3.net (4.69.134.145) 17.041 ms ae-72-72.ebr2.Washington1.Level3.net (4.69.134.149) 21.940 ms 12 ae-2-2.ebr2.Chicago2.Level3.net (4.69.132.69) 31.671 ms 42.407 ms 45.774 ms 13 ae-1-100.ebr1.Chicago2.Level3.net (4.69.132.113) 31.922 ms 32.115 ms 38.135 ms 14 ae-3.ebr2.Denver1.Level3.net (4.69.132.61) 75.265 ms 67.528 ms 67.937 ms 15 ge-9-0.hsa1.Denver1.Level3.net (4.68.107.35) 62.587 ms !H ge-9-1.hsa1.Denver1.Level3.net (4.68.107.99) 62.543 ms !H ge-9-2.hsa1.Denver1.Level3.net (4.68.107.163) 75.797 ms !H (From Texas through Above.net) $ traceroute level3.net|tail -n 1 traceroute to level3.net (63.211.236.36), 64 hops max, 40 byte packets 11 ge-6-2.hsa1.Denver1.Level3.net (4.68.107.131) 21.473 ms !H * ge-6-0.hsa1.Denver1.Level3.net (4.68.107.3) 21.547 ms !H Confirmed it can't be reached from Travelers Ins, The Hartford, none of my connections. Anyone else seeing issues? I'm seeing drop off from clients going through their Atlanta interconnects with Charter and two other providers, which I can't make sense of. I DO KNOW they experienced some sort of issue with a TDM switch or so they said... Very broad statements: "We know teh interwebs are down please stand by" I know websites are one thing, but the chances of the website going down, a TDM switch being wacky and now clients traversing their networks complaining all at once seems a little out of the ordinary. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

13 18