October 2010 - Test - lists.nanog.org

2010.10.05 NANOG50 Tuesday afternoon notes
by Matthew Petach 05 Oct '10

05 Oct '10

I've posted the Tuesday afternoon notes at http://kestrel3.netflight.com/2010.10.05-NANOG50-afternoon-notes.txt and now I'm dashing to the social, because they're turning out the lights on me in the hall here. ^_^;; Matt

2 1

ILNP and DNS (from 2010.10.04 NANOG50 day 1 morning notes)
by Michael Sinatra 05 Oct '10

05 Oct '10

> Michael Sinatra, UCB; what are thoughts around best practices for > auth DNS server in ILNP world, and how do you handle updates for > locator values to the auth servers when a link changes? > A: you need > DNSsec to be running, you make updates, you check authenticity of the > update, etc. How will other networks know about the changes. The initial answer to my question didn't quite get the point of the question, so I followed up. I think ILNP is very interesting because it attempts to create a true I/L split via naming semantics. However, it relies on DNS to do this. Somewhere, there has to be an authoritative DNS server(s) that have the prefix list and preferences for the site. (In ILNP, each host can have its own list of preferred prefixes in the form of L64 records, or they can defer to a site-wide L64 RRset with the LP record.) I acknowledge that this requires a secure dynamic update mechanism (presumably with the border routers doing the updates), and it requires very low ttls to improve convergence. Where this becomes interesting from an operational perspective is when I think about how to address authoritative DNS servers in an ILNP world. The DNS server itself has to be reachable, and the prefix list for the DNS server must be updated when the network topology changes. Hence the question: How should I provision authoritative DNS servers, given that the prefix information is provided via DNS--including the prefix information for the DNS servers themselves--leading to a chicken-and-egg problem. In addition, I would assume that I need something similar to glue records (instead of A or AAAA glue, I need L64 or LP glue). I think one answer would be to have all of my authoritative servers in someone else's network, where they could maintain all of the L64 records completely independent of my DNS infrastructure. With the DNS servers in my network, I don't think there's an answer to the chicken-and-egg problem. Of course, if one of their upstreams dies, my DNS may suffer if I can't withdraw my partner's network's prefixes from the L64 record for my DNS server. This blends into Danny's comment about routing relying on DNS and DNS relying on routing, and to Dave's comment on the binding between the identity and locator being a critical (and difficult) component of the I/L split. I realize that the distinction between operations and protocol development in this discussion may be subject to interpretation, but I also think it's important to understand the operational implications of developing protocols early on. michael

4 6

RE: Level3 filter updates
by powerzone7＠gmail.com 05 Oct '10

05 Oct '10

Level 3 updates their filters every night. I used to work @ level3

2 1

Re: A New TransAtlantic Cable System
by Frank A. Coluccio 05 Oct '10

05 Oct '10

Hi All. It appears we're discussing theoretical limits of silica-based glass here. The Press Release assertion talks about what a trader might experience. Hm. I would ask Rob Beck to clarify this point and inform whether the stated objective in the release accounts for the many o-e and e-o conversions on the overland part of the end-to-end trader connection, including the handoffs that occur in the NY and London metros. I know that terrestrially, i.e., here in the US, some brokerage firms and large banks (is there any longer a distinction between those two today?:) have used their clout to secure links that are virtually entirely optical in nature on routes that are under a thousand miles, but this is not an option on a submarine system that's intrinsically populated with electronics, never mind the tail sections that assume multiple service providers getting into the act. Rob? Anyone? FAC --- Valdis.Kletnieks(a)vt.edu wrote: From: Valdis.Kletnieks(a)vt.edu To: Heath Jones <hj1980(a)gmail.com> Cc: nanog(a)nanog.org Subject: Re: A New TransAtlantic Cable System Date: Fri, 01 Oct 2010 10:08:50 -0400 On Fri, 01 Oct 2010 15:01:25 BST, Heath Jones said: > > http://finance.yahoo.com/news/Hibernia-Atlantic-to-bw-3184701710.html ?x=0&.v=1 > Sales spam - but still - very close to minimum possible latency! > 3471 miles @ 186,282 miles/s * 1.5 in glass * 2 round trip = 55.9ms. My first thought is that they've found a way to cheat on the 1.5. If you can make it work at 1.4, you get down to 52.2ms - but get it *too* low and all your photons leak out the sides. Hmm.. Unless you have a magic core that runs at 1.1 and a *cladding* that's up around 2.0?

10 14

2010.10.05 NANOG50 Tuesday morning notes
by Matthew Petach 05 Oct '10

05 Oct '10

Notes from NANOG50 day 2 (Tuesday) morning session are now posted at http://kestrel3.netflight.com/2010.10.05-NANOG50-morning-notes.txt Again, apologies for misspelled names, typos, etc. I'm dashing to lunch now, but can fix things when I get back. ^_^;; Matt

1 0

Level3 filter updates
by Florin Veres 05 Oct '10

05 Oct '10

Hey guys, Anyone knows how often does Level3 update their filters? I have a prefix in Europe which has a route-obj from Sunday, it's accepted in Level3 Europe from Monday, but in the US it's still not accepted. Thanks, Florin

3 2

re: Anyone can share the Network card experience
by Nick Olsen 05 Oct '10

05 Oct '10

IMHO, Nothing beats a good intel NIC. I'm a big fan of the intel pro/1000GT. In terms of performance, I think it is more determined by the card chipset. Nick Olsen Network Operations (877) 804-3001 x106 ---------------------------------------- From: "Deric Kwok" <deric.kwok2000(a)gmail.com> Sent: Tuesday, October 05, 2010 10:01 AM To: "nanog list" <nanog(a)nanog.org> Subject: Anyone can share the Network card experience Hi Anyone can share the Network card experience ls onborad PCI Expresscard better or Plug in slot PCI Express card good? How are their performance in Gig transfer rate? Thank you so much

2 1

Rough cost for monitoring
by Eric Gauthier 05 Oct '10

05 Oct '10

Heya, I'm trying to quickly pull together some very rough budget numbers for purchasing a full monitoring system (network, server, security, facilities). Is there a source for rough unit costs? If not, does anyone have recent RFI pricing that they'd be willing to share? Eric :0

3 2

do you use SPF TXT RRs? (RFC4408)
by Greg Whynott 05 Oct '10

05 Oct '10

A partner had a security audit done on their site. The report said they were at risk of a DoS due to the fact they didn't have a SPF record. I commented to his team that the SPF idea has yet to see anything near mass deployment and of the millions of emails leaving our environment yearly, I doubt any of them have ever been dropped due to us not having an SPF record in our DNS. When a client's email doesn't arrive somewhere, we will hear about it quickly, and its investigated/reported upon. I'm not opposed to putting one in our DNS, and probably will now - for completeness/best practice sake.. how many of you are using SPF records? Do you have an opinion on their use/non use of? take care, greg

15 22

Re: A New TransAtlantic Cable System
by Heath Jones 05 Oct '10

05 Oct '10

>> What's that quote again...? >> Oh, that's it: "The more you know, the more you know you don't." >> It feels very appropriate now :) > I was wondering for quite some time if there was a scientific term for that > effect, since many of us seem to run into the opposite quite often. It turns > out that it's the Dunning-Kruger effect: > http://en.wikipedia.org/wiki/Dunning-Kruger_effect Ignorant bliss! :)

1 0