September 2009 - Test - lists.nanog.org

IPSEC-VRF MIB
by Bailey Stephen 10 Sep '09

10 Sep '09

Hey all, I am looking to monitor the number of active IPSEC tunnels terminating in a given VRF via SNMP I can use the following command on the device (Cisco 3845 - 12.4(22)T).... Vpn#show crypto mib ipsec flowmib global vrf test-vrf vrf test-vrf Active Tunnels: 2 ... Is there anyway I can get this ActiveTunnels value via SNMP and MIBs? I can do an SNMP walk and get the GlobalActiveTunnels, but I need the number of active tunnels in a VRF Any help would be appreciated Cheers Stephen Bailey FUJITSU Fujitsu Services Limited, Registered in England no 96056, Registered Office 22 Baker Street, London, W1U 3BW This e-mail is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may be privileged. Fujitsu Services does not guarantee that this e-mail has not been intercepted and amended or that it is virus-free.

2 2

Re: Repeated Blacklisting / IP reputation
by Dave Martin 10 Sep '09

10 Sep '09

On Wed, Sep 09, 2009 at 04:13:18PM -0700, Jay Hennigan wrote: > JC Dill wrote: > As for a role account, there is "postmaster". I would think that the > best hope in the real world, rather than an autoresponder would be an > RFC that clearly defines text accompanying an SMTP rejection notice > triggered by a blocklist, detailing the blocklist and contact for > removal. Perhaps encouraging those who code MTAs and DNSBL hooks into > them to include such in the configuration files would be a good start. That would be very useful. Many of those small lists return 'Unknown user' rather than an actual blacklist message. A url where one could get reason (meaning headers) for the block would be even better. If they don't admit that it's a block, it's hard to do much more than tell the user to contact the recipient via some other channel and have *them* contact their support system. -- Dave ----- Nobody believed that I could build a space station here. So I built it anyway. It sank into the vortex. So I built another one. It sank into the vortex. The third station burned down, fell over then sank into the vortex. The fourth station just vanished. And the fifth station, THAT stayed!

1 0

Traffic Shaping on ISPs
by Jake Vargas 10 Sep '09

10 Sep '09

Hi Nanog, We have recently introduced a MMORPG (online game) to the Internet. We currently are receiving many complaints from UK (and a few EU) customers of sudden traffic loss or slowness which makes the game unplayable. The complaints come through like clockwork from 6:00PM to 11:59PM (GMT). Our chief complaint customers originate from British Telecom who equate to an aggregate estimate of 200Mbps during said hours. Is there any advice, known traffic shaping bucket or predictive traffic shaping of sorts that could be impeding our customers use over our ports TCP/7000-7500? Would our traffic be considered P2P traffic and throttled once inside their ASN (or even outside)? Understandably ISPs would want to protect the precious bandwidth and IP services. We are based in US but I am at a wits end on route shifting over our major ISP connections and finding no resolution. Is there anyone who has experienced cross-the-pond issues such as this and had had luck in finding a resolution or at least an answer? (Maybe a form to fill out for cut-through allowance/whitelist for our prefix and port range, if such a thing existed?). Much obliged, Jake

3 3

RFC 1149 put into practice
by JC Dill 09 Sep '09

09 Sep '09

http://news.yahoo.com/s/nm/20090909/od_nm/us_safrica_pigeon_2 JOHANNESBURG (Reuters) – A South African information technology company on Wednesday proved it was faster for them to transmit data with a carrier pigeon than to send it using Telkom , the country's leading internet service provider. Internet speed and connectivity in Africa's largest economy are poor because of a bandwidth shortage. It is also expensive. Local news agency SAPA reported the 11-month-old pigeon, Winston, took one hour and eight minutes to fly the 80 km (50 miles) from Unlimited IT's offices near Pietermaritzburg to the coastal city of Durban with a data card was strapped to his leg. Including downloading, the transfer took two hours, six minutes and 57 seconds -- the time it took for only four percent of the data to be transferred using a Telkom line. SAPA said Unlimited IT performed the stunt after becoming frustrated with slow internet transmission times. The company has 11 call-centers around the country and regularly sends data to its other branches. Telkom could not immediately be reached for comment. Internet speed is expected to improve once a new 17,000 km underwater fiber optic cable linking southern and East Africa to other networks becomes operational before South Africa hosts the soccer World Cup next year. Local service providers are currently negotiating deals for more bandwidth.

1 0

Re: Repeated Blacklisting / IP reputation
by John Curran 09 Sep '09

09 Sep '09

On Sep 8, 2009, at 5:20 PM, Joe Provo wrote: > > On Tue, Sep 08, 2009 at 01:43:39PM -0400, John Curran wrote: > [snip] >> Could some folks from the appropriate networks explain why >> this is such a problem and/or suggest additional steps that >> ARIN or the receipts should be taking to avoid this situation? > > RSS feed of whois churn? Tighter whois:irr coupling headed toward > the ripe model such that irr-oriented tools can be applied to the > problem? Joe - The RSS feed for "as-issued" blocks exists today, so RBL & private list operators can practice good hygiene as desired: Announcement: <https://www.arin.net/announcements/2009/20090622_daily_report.html > Feed: <http://lists.arin.net/pipermail/arin-issued/rss.xml> Note that this is post-issuance, not as reclaimed/recovered because we do allow non-payment blocks to be recovered by coming current on payment, and thus it's not safe to presume that they're always issued to a new organization. With respect to moving towards tighter whois:IRR coupling, is there community desire for such in this region, and does that address this problem? e.g. Are blocks reissued in the RIPE region "cleaner" due to the tighter Whois:IRR linkage? Thanks! /John John Curran President and CEO ARIN

1 0

Datacenter recommendations - China and Latin America
by Michael K. Smith - Adhost 09 Sep '09

09 Sep '09

Hello Everyone: Does anyone have any recommendations for data centers in China (PRC) and Latin America? The Latin America site doesn't have to be in any particular country within the region, although facilities with good network connectivity are obviously preferred. Regards, Mike -- Michael K. Smith - CISSP, GISP Chief Technical Officer - Adhost Internet LLC mksmith(a)adhost.com w: +1 (206) 404-9500 f: +1 (206) 404-9050 PGP: B49A DDF5 8611 27F3 08B9 84BB E61E 38C0 (Key ID: 0x9A96777D)

5 12

Re: Repeated Blacklisting / IP reputation
by dlr＠bungi.com 09 Sep '09

09 Sep '09

[In the message entitled "Re: Repeated Blacklisting / IP reputation" on Sep 8, 14:34, Joe Greco writes:] > > there is a fundamental disconnect here. the IP space is neutral. > > it has no bias toward or against social behaviours. its a tool. > > the actual/real target here are the people who are using these tools > > to be antisocial. blacklisting IP space is always reactive and > > should only beused in emergency and as a -TEMPORARY- expedient. > > > > IMHO of course., YMMV. > > > If people were given an option to "block this IP for 30 minutes, 24 hours, > 30 days, 12 months, 5 years, or forever" - I wonder how many people would > just shrug and click "forever." > > This may lead to the discovery of another fundamental disconnect - or two. > IP address space is neutral, but the operators of the space either permit, or deny, the social behaviour which comes from these spaces. For what it's worth, I just completed a study of about 5 years of data on spam. I looked at 100,000,000 IP addresses which had sent me spam. The median duration of sending was 300 days. There was a pronounced peak at 2-3 years of about 30%. The vast majority was more than 30 days. "forever" is pretty close to right, based on current behaviour. --

1 0

Cable and Wireless Antigua
by Ken Gilmour 08 Sep '09

08 Sep '09

Hi there, I have gone through all normal channels to try to get through to someone in Cable and Wireless Antigua (LIME). It seems difficult to get a fast response through normal channels (it can take up to 48 hours some times to get a response to a "network down" situation). Is there any senior admins who deal directly with the transit end on NANOG? I am having some difficulty getting a security issue dealt with. Thanks! Ken

1 0

Colt outages?
by Eric Brunner-Williams 08 Sep '09

08 Sep '09

Anyone have news on this? I understand Colt has fixed London and are working on Dublin, Bruxelles and Geneva... but that's all I have.

2 1

Re: Repeated Blacklisting / IP reputation
by O'Reirdan, Michael 08 Sep '09

08 Sep '09

MAAWG is has no size limitations as to members. Yes we do have a $4000 supporter membership. This has not proved a barrier to many organisations. Mike O'Reirdan Chairman, MAAWG ----- Original Message ----- From: Benjamin Billon <bbillon-ml(a)splio.fr> To: nanog(a)nanog.org <nanog(a)nanog.org> Sent: Tue Sep 08 17:17:58 2009 Subject: Re: Repeated Blacklisting / IP reputation ISPs can be invited and there are specific meetings for them (closed to other members). There're also whitepapers for ISP (and others). But I agree, hoping ALL the ISPs join MAAWG or even hear about it is utopian. -- Benjamin William Astle a écrit : > J.D. Falk wrote: >> Seth Mattinen wrote: >> >>> I was always under the impression that smaller orgs were not allowed to >>> join the MAAWG club. >> >> I've heard that, too, but have no idea where it comes from. It's not >> true; there's no size requirement or anything like that. >> >> http://www.maawg.org/ has the membership application and other info. >> > > The $4000/year minimum membership fee is a non-starter for small > organizations who are already strapped for operating cash as it is. > This is probably where the perception comes from. >

2 1