February 2010 - Test - lists.nanog.org

Re: Need clued XO abuse contact
by Mike 04 Feb '10

04 Feb '10

Just had a great interaction with Jim in XO's abuse department, who was able to immediately understand the issue and appears on his way to 'address the problem' as I write this. Way to go XO, and thanks to whomever forwarded along my original query, much appreicated....

1 0

[NANOG-announce] NANOG 48 coming up soon
by David Meyer 04 Feb '10

04 Feb '10

Folks, NANOG 48 is less than 3 weeks away. Data Foundry and Giganews are serving as co-hosts for the meeting, February 21-24, in the great city of Austin, Texas. The Program Committee has a stimulating agenda planned and recently added more presentations to an already packed agenda: http://www.nanog.org/meetings/nanog48/agenda.php Register now and take advantage of the current rate, which increases $75 this Monday, February 8. Also, the special group rate at the Austin Hilton expires this Friday, February 5, so make your reservation soon. If your company would like to have a sponsor presence at the meeting, there are still some opportunities available. For additional meeting information and all related links, please see: http://www.nanog.org/meetings/nanog48/index.php We look forward to seeing you there. David Meyer (on behalf of the Program Committee) _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Re: How polluted is 1/8?
by Joel M Snyder 04 Feb '10

04 Feb '10

> Having this data is useful, but I can't help to think it would be > more useful if it were compared with 27/8, or other networks. Is > this slightly worse, or significantly worse than other networks? I have only anecdotal information regarding 45/8. 45/8 is assigned to Interop, and as such it is brought up-and-down as Interop's shows move in and out of convention centers. Starting at least 5 years ago, it has proved impractical to start announcing 45/8, since this causes immediate and massive amounts of traffic to flow into the show network. The last time that I know that the full 45/8 was announced, traffic settled down to about a full T3's worth of bandwidth before the network engineers started announcing smaller /16 chunks as actually needed. Even /16 has proved impractical while the network is being built-out, before the show, because the build-out site typically has T1-ish bandwidth---again, saturated with a /16 being announced. This information is very different from the RIPE Labs experiment which I think showed that certain "obvious" addresses (1.1.1.1 seemed to be the kicker in my short reading of their report) were being mis-used heavily. But I suspect that 27/8 would have similar issues to 45/8. However, it is not clear to me that this is different from any other /8. In other words, for those that have a /8, they probably DO have to put up with a T3-worth of garbage flowing their way before they move the first useful packet. However, you don't get a /8 unless a T3 is small potatoes to you, hence... jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

6 7

RE: google contact? why is google hosting/supporting/encouragingspammers?
by David Hubbard 04 Feb '10

04 Feb '10

From: David Ford [mailto:david@blue-labs.org] > > I feel fairly sure in saying that most mailing list software, > newsgroup software, and communication software in general, > will allow you to preemptively add people to your address > book, subscription lists, etc. Every router and switch out > there allows forged packets through them, should we lambast > the hardware manufacturers even though numerous > accompanying handbooks recommend good practice > configurations? > > Google has been very quick to deal with issues of spammers > every time I have brought it up. > > > On 02/04/10 02:56, Jim Mercer wrote: > > "here, have some free guns. oh, by the way, its probably > > bad if you go around shooting people, so don't do that." > > > > it is starting too look to me like google is quite happy to > > host spammers. > > > > or, at best, doesn't care if spammers use them to host > > their services. I've found gmail is the current favored account amongst forum spammers; I have to assume they are doing nothing about abuse complaints because I find it quite unlikely that the forums I operate just happen to be the first ones that get abused by accounts signed up with gmail addresses. I report each one to their abuse address, probably goes to bit bucket. gmail is probably still 'beta' though so it's ok to let spammers use that too. David

2 1

Mitigating human error in the SP
by Chadwick Sorrell 04 Feb '10

04 Feb '10

Hello NANOG, Long time listener, first time caller. A recent organizational change at my company has put someone in charge who is determined to make things perfect. We are a service provider, not an enterprise company, and our business is doing provisioning work during the day. We recently experienced an outage when an engineer, troubleshooting a failed turn-up, changed the ethertype on the wrong port losing both management and customer data on said device. This isn't a common occurrence, and the engineer in question has a pristine track record. This outage, of a high profile customer, triggered upper management to react by calling a meeting just days after. Put bluntly, we've been told "Human errors are unacceptable, and they will be completely eliminated. One is too many." I am asking the respectable NANOG engineers.... What measures have you taken to mitigate human mistakes? Have they been successful? Any other comments on the subject would be appreciated, we would like to come to our next meeting armed and dangerous. Thanks! Chad

19 26

RE: ip address management
by Carlos Vicente 03 Feb '10

03 Feb '10

Please take a look at the Network Documentation Tool: http://netdot.uoregon.edu It's more than just IPAM, but it was designed with IPv6 in mind. BTW, I just gave a lighting talk at the I2 Joint Techs meeting in Salt Lake City this morning: http://www.internet2.edu/presentations/jt2010feb/20100203-vincente.pdf Feedback welcome. Regards, Carlos Vicente University of Oregon

1 0

Fwd: [Geowanking] model of the internet - need data
by Randy Fischer 03 Feb '10

03 Feb '10

Hello, longtime lurker here, an acquaintance is looking for lat/long data and I thought this group might not object to this request. (if you do, it's my fault, not that of Anselm). -Randy Fischer ---------- Forwarded message ---------- From: Anselm Hook Date: Wed, Feb 3, 2010 at 1:14 PM Subject: [Geowanking] model of the internet - need data Hi folks, I'm looking for a map of the Internet. A friend wants to project this onto a spinny globe. I've found several pictoral representations but I'm looking a raw data-set that geographically locates major routers and servers. In an ideal world I'd get a database that indicates { ip address, amount of traffic, longitude, latitude, connected to other ip addresses } and then I could draw my own picture. Databases I have seen do not include longitude and latitude which I something I would need. Any leads? I suppose even just given IP addresses I could guess longitude and latitude location... which wouldn't be ideal but perhaps would be acceptable. Here's what I've seen so far, http://www.opte.org/ -> I'll try reach out to these folks since they seem to have the best data and are nearby. http://www.technologyreview.com/Infotech/18944/?a=f http://www.chrisharrison.net/projects/InternetMap/ Thanks for any input! - @anselm @wherecamp

3 2

[NANOG] Contacts @ China Unicom and China Telecom
by Justin Ream 03 Feb '10

03 Feb '10

Hi All - Does anyone have peering contacts for China Unicom and China Telecom? Finding that the ones for Any2 in peeringdb.com are no good. Will take replies offlist, thanks! -justin

2 1

Datacenter for DR in northwestern NJ/NY
by Matt Sprague 03 Feb '10

03 Feb '10

Hello NANOG! Does anyone know of some strong datacenters in northwestern NJ, or north of Westchester NY without getting too far away from NYC? I'm looking for a DR colo solution for a site that is in NYC; this needs to be at least 50m away from NYC, but I'm trying to keep it not too much further than that for convenience. I'm also trying to keep this to top level providers as there may be compliance requirements. Thanks in advance for any responses. -- Matt Sprague ReadyTechs, LLC msprague(a)readytechs.com<mailto:msprague@readytechs.com> 973-455-0606 x1204 (voice) http://www.readytechs.com/

8 7

BGP FlowSpec (RFC 5575) route injector
by Thomas Mangin 03 Feb '10

03 Feb '10

Hi, I juste added some preliminary support for FlowSpec (RFC5575) to my BGP route injector http://bgp.exa.org.uk/ As I am not aware of any other project allowing to inject flow route into a network, I am taking the liberty to plug it here. You can access the SVN repository at: http:/svn.exa.org.uk/bgp/trunk/ the code is under a 3-clauses BSD licence. More information about the installation are available on the wiki. I performed basic testing by rate-limiting one of my coworkers mail and web flows - seems to work - for the rest, it may not do what it should. If you are interested, have any questions, or are missing a feature, or just find any bugs, please, just let me know. Changing the configuration and sighuping the application perform send the peers the correct update messages to change the peer RIB. Or just enable graceful-restart and restart the application if you do not care about the number of update :p More information: - http://www.terena.org/activities/tf-ngn/tf-ngn17/uze-flowspec.pdf - http://resources.nznog.org/2006/Friday-240306/DavidLambert-BGPFlowSpecifica… - http://uknof.org/uknof15/Mangin-NakedBGP.pdf (another shameless selfplug - BGP overview - 3 slides on FlowSpec) Thomas -- Exa Networks Limited - http://www.exa-networks.co.uk/ Company No. 04922037 - VAT no. 829 1565 09 27-29 Mill Field Road, BD16 1PY, UK Phone: +44 (0) 845 145 1234 - Fax: +44 (0) 1274 567646 --------- neighbor 82.219.123.221 { [....] flow { route { match { source 10.0.0.1/32; destination 192.168.0.1/32; port =80; destination-port =3128 >8080&<8088; source-port >1024; protocol tcp; # protocol [ tcp udp ]; # packet-length >200&<300 >400&<500; # fragment not-a-fragment; # fragment [ first-fragment last-fragment ]; # icmp-type [ unreachable echo-request echo-reply ]; # icmp-code [ host-unreachable network-unreachable ]; # tcp-flags [ urgent rst ]; # dscp [ 10 20 ]; } then { discard; # rate-limit 9600; # redirect 65500:12345; # redirect 1.2.3.4:5678; } } } } thomas.mangin(a)m7i-4.u3.tcw.uk> show configuration logical-routers trap protocols bgp local-as 30740; group flow { type external; multihop; local-preference 100; local-address 82.219.123.221; import no-export; export deny-all; peer-as 65500; neighbor 82.219.131.242 { traceoptions { file bgp; flag all; } family inet { unicast; flow { no-validate everything; } } family inet6 { unicast; } } } thomas.mangin(a)m7i-4.u3.tcw.uk> show configuration logical-routers trap policy-options policy-statement everything then accept; # env PYTHONPATH=~/source/bgp/lib/ python daemon/bgpd etc/bgp/m7i-service.txt 033 12:28:13 Supervisor/ performing reload 033 12:28:13 Supervisor/ New Peer 82.219.123.221 033 12:28:14 82.219.123.221/ 30740 -> OPEN version=4 asn=65500 hold_time=180 router_id=82.219.131.242 capabilities=[Graceful Restart Flags 0x8 Time 5 IPv4/flow-ipv4=0x80 IPv4/unicast=0x80 IPv6/unicast=0x80, Multiprotocol IPv4 unicast IPv6 unicast IPv4 flow-ipv4] 033 12:28:15 82.219.123.221/ 30740 <- OPEN version=4 asn=30740 hold_time=90 router_id=82.219.123.221 capabilities=[Cisco Route Refresh (unparsed), Multiprotocol IPv4 unicast IPv6 unicast IPv4 flow-ipv4, Route Refresh (unparsed)] 033 12:28:16 82.219.123.221/ 30740 -> KEEPALIVE 033 12:28:17 82.219.123.221/ 30740 <- KEEPALIVE announcing IPv6 unicast 2a02:b80:0:6:50::1/128 next-hop 2a02:b80::90:0:52e:0:1 med 100 announcing IPv4 flow-ipv4 destination 192.168.0.1/32,source 10.0.0.1/32,protocol =TCP,port =80,destination-port =3128 >8080&<8088,source-port >1024 extended community [ 0x80 0x6 0x0 0x0 0x0 0x0 0x0 0x0 ] announcing IPv4 unicast 82.219.4.100/32 next-hop 82.219.4.101 med 100 033 12:28:17 82.219.123.221/ 30740 -> UPDATE (3) 033 12:28:17 82.219.123.221/ 30740 <- KEEPALIVE thomas.mangin(a)m7i-4.u3.tcw.uk> show route logical-router trap table inetflow.0 extensive inetflow.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden) 192.168.0.1,10.0.0.1,proto=6,port=80,dstport=3128,>8080&<8088,srcport>1024/256 (1 entry, 0 announced) *BGP Preference: 170/-101 Next hop type: Fictitious Next-hop reference count: 1 State: <Active Ext> Peer AS: 65500 Age: 1:13 Task: BGP_65500_30740.82.219.131.242+32319 AS path: 65500 I Communities: no-export traffic-rate:0:0 Localpref: 100 Router ID: 82.219.131.242

1 0