March 2010 - Test - lists.nanog.org

Cisco Unified Computing System
by Claudia de Luna 23 Mar '10

23 Mar '10

Hello, Does anyone have any hands on experience with Cisco's Unified Computing System? Knowing some of the issues it purports to address the solution seems compelling but the devil is in the details. I generally lean towards the "best of breed" approach and am wary of any solution that claims to do many things (often poorly) vs. one thing very well. I'm particularly interested in the hooks that the system is supposed to have for 3rd party tools. In my experience Cisco has not led the way in network management and a large part of this solution is the management system to provision end to end services. Any experience with this solution would be most welcome, on or off list. Thank You, Claudia

1 0

NSP-SEC
by Guillaume FORTAINE 23 Mar '10

23 Mar '10

Misses, Misters, I would want to inform you that the security of the Internet, that is discussed in the NSP-SEC mailing-list [0] by a selected group of vendors (Cisco, Juniper & Arbor) [1] and operations contacts of the big ISPs [2] : 1) applies the "Security through Obscurity" paradigm that has been proven inefficient [3]. To quote [4] : "Please do not Forward, CC, or BCC this E-mail outside of the nsp-security community. Confidentiality is essential for effective Internet security counter-measures." First question : Why was I able to find this mail on the Internet if it should be kept secret ? 2) includes [5] a) Spammers (Rodney Joffe) [6] [7] b) Freelancers (Gadi Evron) [8] [9] Second question : Do you still ask yourself why the Internet is so insecure ? [10] Best Regards, Guillaume FORTAINE [0] http://puck.nether.net/mailman/listinfo/nsp-security [1] http://www.confickerworkinggroup.org/wiki/pmwiki.php/SP/ServiceProviders [2] http://docs.google.com/viewer?url=http://www.cisco.com/web/ME/exposaudi2009… [3] http://en.wikipedia.org/wiki/Security_through_obscurity [4] http://lists.ausnog.net/pipermail/ausnog/2007-April/000397.html [5] http://www.google.com/search?hl=en&source=hp&q="nsp-sec"+site:mailman.nanog.org&aq=f&aqi=&aql=&oq=&gs_rfai=&esrch=FT1 [6] http://mailman.nanog.org/pipermail/nanog/2008-October/004724.html [7] http://www.iadl.org/RodneyJoffe/rodneyjoffe.html [8] http://mailman.nanog.org/pipermail/nanog/2009-November/015354.html [9] http://il.linkedin.com/in/gadievron [10] http://caislab.kaist.ac.kr/77ddos/

26 48

Network Naming Conventions
by Paul Stewart 22 Mar '10

22 Mar '10

Hi Folks... With many changes going on this year in our network, I figured it's a good time to revisit our naming conventions used in our networks. Today, we use the following example: Core1-rtr-to-ge1-1-1-vl20.nexicom.net Core box #1, rtr=router, to=location, ge1-1-1=interface, vl20=vlan etc etc.... Going forward, I'd like to examine a better method to identify the devices.... does anyone have published standards on what they use or that of other networks and maybe even why they chose those methods? The core of the network is fairly easy for us to look at different changes where you have interfaces, subinterfaces, locations etc. to deal with. But what do folks do for "aggregation devices" such as dial-up shelves, BAS devices etc? Finally, we have a fair amount of gear (that we own) at customer premises that act as either a managed device or a demarcation point .... how to you name those today? Open ended questions obviously - looking for many ideas. ;) Paul ---------------------------------------------------------------------------- "The information transmitted is intended only for the person or entity to which it is addressed and contains confidential and/or privileged material. If you received this in error, please contact the sender immediately and then destroy this transmission, including all attachments, without copying, distributing or disclosing same. Thank you."

29 35

OpenLDAP and Active Directory
by Andrews Carl 448 22 Mar '10

22 Mar '10

Please forgive me if this is an inappropriate place to make this requests. I need to setup an OpenLDAP server for proxy authentication to Microsoft Active Directory. From what I have been able to determine this is completely possible but I am missing something. I have the O'Reilly LDAP book but it was written several years prior to the current OpenLDAP version and there has been a major rewrite of the software. Can anyone help me or point me to somewhere I can get assistance? I have tried one consulting firm and that was a stellar failure. I've tried many different searches but a search for 'active directory, openldap, authentication, proxy, pass-through' either gives information for Squid or all go back to the same OpenLDAP Administrators guide from which I am missing something. Thanks! Carl

4 3

Shutting Down a Network and Selling off Assets
by Shane Ronan 22 Mar '10

22 Mar '10

Hello everyone, This might be slightly off topic, but I am shutting down a large network, and selling off the assets. Information is @ www.ronan-online/forsale.html I will be adding items to the list as they come offline, as well as the location of each asset. Email me with any questions or offers. Shane Ronan

3 3

Re: NSP-SEC
by James Bensley 22 Mar '10

22 Mar '10

On 21 March 2010 23:10, <John.Herbert(a)usc-bt.com> wrote: > Hey James,m > > Well, I'm sure that the 140,000,000 is a FUD figure extrapolated by an AV vendor rather than an actual audit (:-), but you make a fair point. > > That said, I did start wondering how an "Internet User" is defined in the stats you pointed to. Assuming that Internet User means an Internet connection (?), do we assume that there is only one bot per computer (bearing in mind that if you're susceptible to one, there's a good chance you have succumbed to more than one); or that there's only one computer per user (progressively less common in a domestic setting, and see the previous point again also); and we are probably ignoring the possibility of bots in commercial environments (bots couldn' t possibly penetrate the workplace, right?). All of the above I'd wager could skew the statistics to something more reasonable. > > In conclusion: blah blah blah statistics. Can't win :) > > Have a good weekend :) > > j. > Yes and what about virtual machines, servers, data centers? There are going to be (obviously) far more machines online than there are people so I guess the figure can be greatly skewed but I can see from other peoples posts that it could also be accurate. Scary! -- Regards, James ;)

1 0

ISC DHCP server failover
by Summers, William 21 Mar '10

21 Mar '10

Greetings Nanog members, I am wondering if anyone has implemented the failover features of ISC DHCP? And if so, how successful has failover been in your environment? Many thanks, William Summers Network Administrator Information Technology Services Deerfield Academy

8 10

RE: NANOG Digest, Vol 26, Issue 106
by Scott Holwerda 20 Mar '10

20 Mar '10

4** Sent from my Windows Mobile® phone. -----Original Message----- From: nanog-request(a)nanog.org <nanog-request(a)nanog.org> Sent: Saturday, March 20, 2010 8:00 AM To: nanog(a)nanog.org <nanog(a)nanog.org> Subject: NANOG Digest, Vol 26, Issue 106 Send NANOG mailing list submissions to nanog(a)nanog.org To subscribe or unsubscribe via the World Wide Web, visit https://mailman.nanog.org/mailman/listinfo/nanog or, via email, send a message with subject or body 'help' to nanog-request(a)nanog.org You can reach the person managing the list at nanog-owner(a)nanog.org When replying, please edit your Subject line so it is more specific than "Re: Contents of NANOG digest..." Today's Topics: 1. Re: ISC DHCP server failover (Mike) 2. Re: CRS-3 (Steve Meuse) 3. Re: CRS-3 (jim deleskie) 4. Re: ISC DHCP server failover (sthaug(a)nethelp.no) 5. Help with a 3561 debug (Jess Kitchen) ---------------------------------------------------------------------- Message: 1 Date: Fri, 19 Mar 2010 17:10:04 -0700 From: Mike <mike-nanog(a)tiedyenetworks.com> Subject: Re: ISC DHCP server failover To: "David W. Hankins" <David_Hankins(a)isc.org> Cc: nanog(a)nanog.org Message-ID: <4BA4125C.2090309(a)tiedyenetworks.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed David W. Hankins wrote: > On Wed, Mar 17, 2010 at 09:22:06AM -0500, Dan White wrote: > >> The servers stop balancing their addresses, and one server starts to >> exhibit 'peer holds all free leases' in its logs, in which case we need to >> restart the dhcpd process(es) to force a rebalance. >> > > If restarting one or both dhcpd processes corrects a pool balancing > problem, then I suspect what you're looking at is a bug where the > servers would fail to schedule a reconnection if the failover socket > is lost in a particular way. Because the protocol also uses a message > exchange inside the TCP channel to determine if the socket is up > (rather than just TCP keepalives) this can sometimes happen even > without a network outage during load spikes or other brief hiccups on > <long explanation snipped> With all due respect and acknowledgment of the tremendous contributions of ISC and you yourself Mr. Hankins, I have to comment that failover in isc-dhcp is broken by design because it requires the amount of handholding and operator thinking in the event of a failure that you explained to us at length is required. Failure needs to be handled automatically and without any intervention at all, otherwise you might as well not have it and I think most network operators would agree. I am certainly not prepared to develop proof of concept code or go the full route of developing such a server myself, however, I belive firmly that a failover implementation in dhcp could be designed as a counterpoint to the current implementation that is reliable, simple, scalable and requiring no special procedures once a 'break' occurs. The method used by isc-dhcpd, I think, creates the problem of the potential for unreliable failover because it's not designed for the 'right' problem. But there are example implementations - such as vrrp/carp - that would form the basis of trustworthy dhcp failover protocol. Your key issues are a) broadcast discovery packets, which every listening host on the lan segment (such as 1 or more slaves) can easily respond to, and b) unicast frames from relay agents and others, which could easily be handled by a virtual mac/shared ip address by a group of slaves. This means that redundancy of more than 2 hosts is already possible. The last pieces are protocol for servers to join and leave the pool of hosts serving dhcp, a master election protocol that pre-determines the order of slaves to fail over to in order to avoid the half-brain syndrome, a sanity checking protocol to ensure the elected master is sane and kicking (eg: the slaves all hit the master with, what else, dhcp requests), and a well defined group database update protocol over the network so that leases hit some fixed storage somewhere, sometime. Just my $0.02 worth. Mike- ------------------------------ Message: 2 Date: Fri, 19 Mar 2010 21:30:20 -0400 From: Steve Meuse <smeuse(a)mara.org> Subject: Re: CRS-3 To: Paul Ferguson <fergdawgster(a)gmail.com> Cc: "nanog(a)nanog.org list" <nanog(a)nanog.org> Message-ID: <20100320013020.GA1574(a)mara.org> Content-Type: text/plain; charset=us-ascii Paul Ferguson expunged (fergdawgster(a)gmail.com) > -----BEGIN PGP SIGNED MESSAGE----- > > > > Anyone have any idea how much a fully configured CRS-3 would cost? Or > > how much power it would consume? Or how much heat it would generate? > > > > Admittedly, my information on these topics comes from NPR these days. :-) > > They said it costs ~US$90k, and that AT&T was in trails. $90k is the price of the special lift jack you need to move them around :) -Steve ------------------------------ Message: 3 Date: Fri, 19 Mar 2010 22:37:48 -0300 From: jim deleskie <deleskie(a)gmail.com> Subject: Re: CRS-3 To: Steve Meuse <smeuse(a)mara.org> Cc: "nanog(a)nanog.org list" <nanog(a)nanog.org> Message-ID: <ffcec29f1003191837n5b177b0exbeede90529eefbda(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Thats funny, not sure if Cisco sells one or not but back in the day, I worked @ Avici, and we did in fact have a special jack used to move the chassis around :) -jim On Fri, Mar 19, 2010 at 10:30 PM, Steve Meuse <smeuse(a)mara.org> wrote: > Paul Ferguson expunged (fergdawgster(a)gmail.com) > >> -----BEGIN PGP SIGNED MESSAGE----- >> > >> > Anyone have any idea how much a fully configured CRS-3 would cost? ?Or >> > how much power it would consume? ?Or how much heat it would generate? >> > >> >> Admittedly, my information on these topics comes from NPR these days. :-) >> >> They said ?it costs ~US$90k, and that AT&T was in trails. > > $90k is the price of the special lift jack you need to move them around :) > > -Steve > > > > ------------------------------ Message: 4 Date: Sat, 20 Mar 2010 09:43:41 +0100 (CET) From: sthaug(a)nethelp.no Subject: Re: ISC DHCP server failover To: mike-nanog(a)tiedyenetworks.com Cc: nanog(a)nanog.org Message-ID: <20100320.094341.74713325.sthaug(a)nethelp.no> Content-Type: Text/Plain; charset=us-ascii > With all due respect and acknowledgment of the tremendous contributions > of ISC and you yourself Mr. Hankins, I have to comment that failover in > isc-dhcp is broken by design because it requires the amount of > handholding and operator thinking in the event of a failure that you > explained to us at length is required. Failure needs to be handled > automatically and without any intervention at all, otherwise you might > as well not have it and I think most network operators would agree. Note that this method of handling failover is inherent in the original DHCP failover design. See http://tools.ietf.org/id/draft-ietf-dhc-failover-12.txt Specifically, quoting from the above draft, "While this technique works in some domains, having the only server to which a DHCP client can communicate voluntarily shut itself down seems like something worth avoiding. The failover protocol will operate correctly while both servers are unable to communicate, whether they are both running or not. At some point there may be resource contention, and if one of the servers is actually down, then the operator can inform the operational server and the operational server will be able to use all of the failed server's resources." I certainly cannot speak for "most network operators". However, I will note that I have been aware of this behavior of the IDC DHCP server as long as I have been running it in failover mode. > I am certainly not prepared to develop proof of concept code or go the > full route of developing such a server myself, however, I belive firmly > that a failover implementation in dhcp could be designed as a > counterpoint to the current implementation that is reliable, simple, > scalable and requiring no special procedures once a 'break' occurs. And which implements failover protocol in the IETF draft? Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no ------------------------------ Message: 5 Date: Sat, 20 Mar 2010 11:27:44 +0000 (GMT) From: Jess Kitchen <jess.kitchen(a)adjacentnetworks.net> Subject: Help with a 3561 debug To: nanog(a)nanog.org Message-ID: <alpine.BSF.2.00.1003201122110.72001(a)beaujolais.extremis.net> Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII Hello, If anyone is single homed via Savvis AS3561 that could spare a minute to help with a couple of mtr/tcptraceroute/iperfs that would be great- trying to drill down a peculiar and intermittent issue that has been occurring since some time Thursday (packets indescriminately dropped on the floor but only on particular paths) Please mail offlist, thanks -- Jess Kitchen <jess.kitchen(a)adjacentnetworks.net> ------------------------------ _______________________________________________ NANOG mailing list NANOG(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog End of NANOG Digest, Vol 26, Issue 106 **************************************

1 0

IPtv solutions
by Rashed Alwarrag 20 Mar '10

20 Mar '10

Dear Nanog I am interested in IPtv solutions so Can anybody advice me what is the best IPTv products/solutions that is Widely deployed in most of the Service provider and if they have courses available ? Thanks a lot Rashed Alwarrag Applied Technologies

1 0

IPtv solutions
by Rashed Alwarrag 20 Mar '10

20 Mar '10

Dear Nanog I am interested in IPtv solutions so Can anybody advice me what is the best IPTv products/solutions that is wildly deployed in most of the Service provider and if they have courses available ? Thanks a lot Rashed Alwarrag Applied Technologies

1 0