February 2010 - Test - lists.nanog.org

BGP FlowSpec (RFC 5575) route injector
by Thomas Mangin 03 Feb '10

03 Feb '10

Hi, I juste added some preliminary support for FlowSpec (RFC5575) to my BGP route injector http://bgp.exa.org.uk/ As I am not aware of any other project allowing to inject flow route into a network, I am taking the liberty to plug it here. You can access the SVN repository at: http:/svn.exa.org.uk/bgp/trunk/ the code is under a 3-clauses BSD licence. More information about the installation are available on the wiki. I performed basic testing by rate-limiting one of my coworkers mail and web flows - seems to work - for the rest, it may not do what it should. If you are interested, have any questions, or are missing a feature, or just find any bugs, please, just let me know. Changing the configuration and sighuping the application perform send the peers the correct update messages to change the peer RIB. Or just enable graceful-restart and restart the application if you do not care about the number of update :p More information: - http://www.terena.org/activities/tf-ngn/tf-ngn17/uze-flowspec.pdf - http://resources.nznog.org/2006/Friday-240306/DavidLambert-BGPFlowSpecifica… - http://uknof.org/uknof15/Mangin-NakedBGP.pdf (another shameless selfplug - BGP overview - 3 slides on FlowSpec) Thomas -- Exa Networks Limited - http://www.exa-networks.co.uk/ Company No. 04922037 - VAT no. 829 1565 09 27-29 Mill Field Road, BD16 1PY, UK Phone: +44 (0) 845 145 1234 - Fax: +44 (0) 1274 567646 --------- neighbor 82.219.123.221 { [....] flow { route { match { source 10.0.0.1/32; destination 192.168.0.1/32; port =80; destination-port =3128 >8080&<8088; source-port >1024; protocol tcp; # protocol [ tcp udp ]; # packet-length >200&<300 >400&<500; # fragment not-a-fragment; # fragment [ first-fragment last-fragment ]; # icmp-type [ unreachable echo-request echo-reply ]; # icmp-code [ host-unreachable network-unreachable ]; # tcp-flags [ urgent rst ]; # dscp [ 10 20 ]; } then { discard; # rate-limit 9600; # redirect 65500:12345; # redirect 1.2.3.4:5678; } } } } thomas.mangin(a)m7i-4.u3.tcw.uk> show configuration logical-routers trap protocols bgp local-as 30740; group flow { type external; multihop; local-preference 100; local-address 82.219.123.221; import no-export; export deny-all; peer-as 65500; neighbor 82.219.131.242 { traceoptions { file bgp; flag all; } family inet { unicast; flow { no-validate everything; } } family inet6 { unicast; } } } thomas.mangin(a)m7i-4.u3.tcw.uk> show configuration logical-routers trap policy-options policy-statement everything then accept; # env PYTHONPATH=~/source/bgp/lib/ python daemon/bgpd etc/bgp/m7i-service.txt 033 12:28:13 Supervisor/ performing reload 033 12:28:13 Supervisor/ New Peer 82.219.123.221 033 12:28:14 82.219.123.221/ 30740 -> OPEN version=4 asn=65500 hold_time=180 router_id=82.219.131.242 capabilities=[Graceful Restart Flags 0x8 Time 5 IPv4/flow-ipv4=0x80 IPv4/unicast=0x80 IPv6/unicast=0x80, Multiprotocol IPv4 unicast IPv6 unicast IPv4 flow-ipv4] 033 12:28:15 82.219.123.221/ 30740 <- OPEN version=4 asn=30740 hold_time=90 router_id=82.219.123.221 capabilities=[Cisco Route Refresh (unparsed), Multiprotocol IPv4 unicast IPv6 unicast IPv4 flow-ipv4, Route Refresh (unparsed)] 033 12:28:16 82.219.123.221/ 30740 -> KEEPALIVE 033 12:28:17 82.219.123.221/ 30740 <- KEEPALIVE announcing IPv6 unicast 2a02:b80:0:6:50::1/128 next-hop 2a02:b80::90:0:52e:0:1 med 100 announcing IPv4 flow-ipv4 destination 192.168.0.1/32,source 10.0.0.1/32,protocol =TCP,port =80,destination-port =3128 >8080&<8088,source-port >1024 extended community [ 0x80 0x6 0x0 0x0 0x0 0x0 0x0 0x0 ] announcing IPv4 unicast 82.219.4.100/32 next-hop 82.219.4.101 med 100 033 12:28:17 82.219.123.221/ 30740 -> UPDATE (3) 033 12:28:17 82.219.123.221/ 30740 <- KEEPALIVE thomas.mangin(a)m7i-4.u3.tcw.uk> show route logical-router trap table inetflow.0 extensive inetflow.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden) 192.168.0.1,10.0.0.1,proto=6,port=80,dstport=3128,>8080&<8088,srcport>1024/256 (1 entry, 0 announced) *BGP Preference: 170/-101 Next hop type: Fictitious Next-hop reference count: 1 State: <Active Ext> Peer AS: 65500 Age: 1:13 Task: BGP_65500_30740.82.219.131.242+32319 AS path: 65500 I Communities: no-export traffic-rate:0:0 Localpref: 100 Router ID: 82.219.131.242

1 0

Research Project: Internet capacity during pandemic events
by haska＠ualberta.ca 03 Feb '10

03 Feb '10

Hello everyone, My name is Mike Haska, and I am a graduate student at the University of Alberta. I am conducting research into Internet capacity issues during pandemic events. In order to analyze certain aspects of this topic, I need to get in touch with representatives from the major Internet service providers in Canada - some of whom, I am hoping, are members of this distribution. Specifically, I am looking to get in touch with individuals who are familiar with the structure of their network and with any pandemic contingency plans that are in place within their organization. If you think you may be able to assist, or if you know of anyone who could, please contact me at (haska at ualberta.ca) and I will provide further information on all aspects of this study. To put your mind at ease - I'm not fishing around for sensitive information or your root passwords; I'm looking for an overview of your policies and your responses to hypothetical scenarios. Your confidentiality is assured and you are welcome to preview all the questions to be asked before you commit to participating in any way. I feel this topic has important implications to network operators in Canada, so any support you can offer to this research project is greatly appreciated. Best regards, -Mike

4 3

Re: Fiber Cut in CA?
by charles＠knownelement.com 03 Feb '10

03 Feb '10

That is one long protect path. Yikes. Sent via BlackBerry from T-Mobile

8 7

RE: Datacenter for DR in northwestern NJ/NY
by Ray Sanders 02 Feb '10

02 Feb '10

Datapipe has a facility in N.J... Not sure if they are 50mi from NYC Mobile email powered by the force... ---- Original Message ---- From: "Matt Sprague" <msprague(a)readytechs.com> Date: 2/2/10 2:19 pm To: "nanog(a)nanog.org" <nanog(a)nanog.org> Subj: Datacenter for DR in northwestern NJ/NY Hello NANOG! Does anyone know of some strong datacenters in northwestern NJ, or north of Westchester NY without getting too far away from NYC? I'm looking for a DR colo solution for a site that is in NYC; this needs to be at least 50m away from NYC, but I'm trying to keep it not too much further than that for convenience. I'm also trying to keep this to top level providers as there may be compliance requirements. Thanks in advance for any responses. -- Matt Sprague ReadyTechs, LLC msprague(a)readytechs.com<mailto:msprague@readytechs.com> 973-455-0606 x1204 (voice) http://www.readytechs.com/

3 2

Re: NREN Network Design
by Tarig Y. Adam 02 Feb '10

02 Feb '10

Hi Stephane thanks, your scheme is very expressive.And sorry for forgetting to send this message to my own list (afnog). regarding the subject the next hop of default route of our customers are ISP routers then SUIN routers. Is this a normal situation??? Normal0falsefalsefalseEN-USX-NONEAR-SAMicrosoftInternetExplorer4 /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin;} --------------------------------- Eng. Tarig Yassin Adam Sudanese Universities' Information Network (SUIN) T: +249925659149 ----- Original Message ----- From: Stephane Bortzmeyer <bortzmeyer(a)nic.fr> To: Tarig Yassin Adam <tarig(a)suin.edu.sd> Cc: Phil Regnauld <regnauld(a)nsrc.org> , <afnog(a)afnog.org> Date: Tuesday, February 2 2010 11:40 AM Subject: Re: NREN Network Design On Mon, Feb 01, 2010 at 10:04:07PM -0500, Tarig Yassin Adam <tarig(a)suin.edu.sd> wrote a message of 597 lines which said: > hi phil [And thanks for forwarding this discussion where it belongs. It is sad that a discussion on an african NREN was first carried to a North America list.] > We already applied to AfriNIC, they allocated to us /18 ipv4 we're > using two ISPs to connect to our customers and the same time we're > using these ISPs for the Internet. And you use BGP? You have your own AS? > The ISP using tunnel layer 3. I am sorry, I cannot parse this sentence. > For customer sites to reach our NOC they need next hop to the ISP > routers which we do not have a control. The way I understand it (you are really short on details), the universities are your customers and there is always an ISP between NREN and UNI: +---------+ | | +---------+ | NREN |---------| ISP 1 |------- UNI 1 +---------+ +---------+ | | \ +--------+ | \ | ISP 2 | +-----------+ \ +--------+-------| Internet | +--------+ | | +-----------+ | UNI 2 | | | | | +------+ +-------+ +--------+ |UNI 3 | | UNI 4 | +------+ +-------+ Is my schema OK? If no, please provide yours. If yes, I wonder, what service provides the NREN if no connectivity? If you just provide Internet servers (HTTP, XMPP, etc), there is no need to "tunnel" anything over the ISP.

1 0

[NANOG] NREN Network Design
by Tarig Yassin Adam 02 Feb '10

02 Feb '10

I'm try to redesign the Sudanese NREN (National Research & Education Network). we provide end to end service,to our customers. Our network is build over local ISPs. But the problem of the current design that each time we need to go back to the ISP to change our Infrastructure IP addresses, when the situation need this.How can solve this? I heard about something called Virtual Network Environment which give us the full control of ISP routers, is it the best solution? What about others NRENs.Thanks Normal0falsefalsefalseEN-USX-NONEAR-SAMicrosoftInternetExplorer4 /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin;} --------------------------------- Eng. Tarig Yassin Adam Sudanese Universities' Information Network (SUIN) T: +249925659149 E: tarig(a)sustech.edu

4 3

Re: Mitigating human error in the SP
by Chadwick Sorrell 02 Feb '10

02 Feb '10

On Tue, Feb 2, 2010 at 12:45 PM, James Downs <james.downs(a)egontech.com> wrote: > > On Feb 2, 2010, at 9:33 AM, Jared Mauch wrote: > > We have solved 98% of this with standard configurations and templates. > > To deviate from this requires management approval/exception approval after > an evaluation of the business risks. > > I would also point Chad to this book: http://bit.ly/cShEIo (Amazon Link to > Visual Ops). > It's very useful to have your management read it. You may or may not be > able to or want to use a full ITIL process, but understanding how these > policies and procedures can/should work, and using the ones that apply makes > sense. > Change control, tracking, and configuration management are going to be key > to avoiding mistakes, and being able to rapidly repair when one is made. > Unfortunately, most management that demands No Tolerance, Zero Error from > operations won't read the book. > Good luck.. I'd bet most of the people on this list have been there one time > or another. > Cheers, > -j Interesting book, maybe I'll bring that to the next meeting. Thanks for the heads up on that.

1 0

Threading the senderbase reputation needle
by Drew Weaver 02 Feb '10

02 Feb '10

Howdy, Has anyone come up with a reverse DNS 'pattern' that one can employ that will prevent Senderbase from assigning a poor reputation to an entire /24 because they saw an email they didn't like from a single IP address? We're an infrastructure provider, which means that we lease servers, etc to customers and everything we do uses static IPs. Our current 'default (before the customer changes it)' is a x.x.x.x.static.domain.com, apparently Senderbase cannot look up CIDR boundaries in the RIR database (even though we spend a lot of time making sure that we publish the CIDR information) so they just assume that each 'offender' owns the entire /24 and they also consider any 'email' from the static.domain.com domain to be the 'same offender' (which is completely silly). The other little annoyance about their system is that we assign CIDR blocks to users (almost always a /29) these CIDRs include IP addresses like the gateway address, the broadcast address, the network address, etc and the users may only use 2-3 of the IPs in the /29, but they expect us or the user to set a 'custom looking' reverse DNS on all of the IPs in the range. Originally, we were not putting any reverse DNS on our IPs until the customer requested it (or did it themselves via our system) but then we ran into problems with some RBLs that require reverse DNS on all IPs, and other RBLs that require matching forward and reverse DNS on all IPs. I've contacted Senderbase for advice on what specifically we need to do but they've been vague at best and I have even asked them for examples of companies who 'meet their specifications' but I wasn't given any. I'm considering doing something like customerXXXXX.static.domain.com but then I can see other problems with that also. Any advice? -Drew

4 5

Unix Sysadmin/Net Eng in the Toronto Area?
by Carlos Kamtha 02 Feb '10

02 Feb '10

Greetings, I am looking for an experienced Freebsd/linux/cisco/juniper person. If you live in Toronto or the GTA and are interested please drop me a line offlist. Cheers, Carlos.

1 0

Re: Mitigating human error in the SP
by gb10hkzo-nanog＠yahoo.co.uk 02 Feb '10

02 Feb '10

>>Otherwise, as Suresh notes, the only way to eliminate human error completely is >>to eliminate the presence of humans in the activity. and,hence by reference..... >> Automated config deployment / provisioning. That's the funniest thing I've read all day... ;-) A little pessimistic rant.... ;-) Who writes the scripts that you use, who writes the software that you use ? There will always be at least one human somewhere, and where there's a human writing software tools, there's scope for bugs and unexpected issues. Whether inadvertent or not, they will always be there. If the excrement is going to hit the proverbial fan, try as you might to stop it, it will happen. Nothing in the IT / ISP / Telco world is ever going to be perfect, far too complex with many dependencies. Yes you might play in your perfect little labs until the cows come home ..... but there always has been and always will be an element of risk when you start making changes in production. Face it, unless you follow the rigorous change control and development practices that they use for avionics or other high-risk environments, you are always going to be left with some element of risk. How much risk your company is prepared to take is something for the men in black (suits) to decide because it correlates directly with how much $$$ they are prepared to throw your way to help you mitigate the risk .....;-) That's my 2 <insert_currency> over ...... thanks for listening (or not !).... ;-)

3 2