April 2010 - Test - lists.nanog.org

Re: Rate of growth on IPv6 not fast enough?
by Roger Marquis 21 Apr '10

21 Apr '10

Jack Bates wrote: > If you mean, "do we still need protocols similar to uPNP" the answer is > yes. Of course, uPNP is designed with a SPI in mind. However, we > simplify a lot of problems when we remove address mangling from the > equation. Let's not forget why UPNP is what it is and why it should go away. UPNP was Microsoft's answer to Sun's JINI. It was never intended to provide security. All MS wanted do with UPNP was derail a competing vendor's (vastly superior) technology. Not particularly different than MS' recent efforts around OOXML. Roger Marquis

1 0

Juniper firewalls - SSG or SRX
by Jeffrey Negro 21 Apr '10

21 Apr '10

Has anyone on Nanog had any hands on experience with the lower end of the new SRX series Junipers? We're looking to purchase two new firewalls, and I'm debating going with SSG series or to make the jump to the SRX line. Any input, especially about the learning curve jumping from ScreenOS to JunOS would be greatly appreciated. Thank you in advance. Jeffrey

11 12

BGP-add-path analyser
by Olivier Bonaventure 21 Apr '10

21 Apr '10

Hello, The IDR working group of the IETF has worked during the last years on the development of BGP extensions that allow a BGP router to advertise several paths towards the same prefix over a BGP session. This feature, usually called add-apths, is being implemented by router vendors and network operators are considering its deployment. To allow network operators to better understand the possible impact of BGP add-path in their network, we have enhanced a BGP simulator to support this feature and developped an analyser on top of this simulator. Based on a model of the network that can be developped with the IGP topology, the iBGP sessions and the routes received over eBGP sessions, the analyser computes metrics such as : - Number of messages exchanged (eBGP, iBGP, withdraws, updates) during an event - Control plane convergence time (time between first and last BGP message) of an event - Number of paths in Adj-Rib-Ins - Availability of path diversity (at least two different nexthops) for fast convergence - Path optimality for Hot Potato Routing (IGP costs to the nexthops) The simulator supports the different add-path selection modes that are discussed with the IETF. We have used the tool on the Abilene network whose configuration is publically available and you can find the results at http://inl.info.ucl.ac.be/softwares/add-paths-analyser-work-progress The simulator and the analyser tool were written by Virginie Van den Schrieck. They are both publically available : http://inl.info.ucl.ac.be/softwares/simbgp-addpaths-support http://inl.info.ucl.ac.be/softwares/add-paths-analyser-work-progress Feel free to contact Virginie for additional information or if you would like to use the analyser on your network. Best regards, Olivier Bonaventure

1 0

Re: Rate of growth on IPv6 not fast enough?
by Franck Martin 21 Apr '10

21 Apr '10

Why don't they use IPv6 instead of uPnP? They control the consumer box (and PS3, XBOX, .... are not cheap boxes) and they control the gaming servers. Look at the feature back to my mac., it opens when possible an IPv6 over IPv4 toredo tunnel, so that apple servers can easily contact back the desktop. If not possible it falls back to NAT traversal with IPv4... http://www.appleinsider.com/articles/08/08/19/apples_secret_back_to_my_mac_… http://collison.ie/blog/2008/12/leopard-and-back-to-my-mac-tunnels ----- Original Message ----- From: "Chris Adams" <cmadams(a)hiwaay.net> To: nanog(a)nanog.org Sent: Wednesday, 21 April, 2010 2:39:35 PM Subject: Re: Rate of growth on IPv6 not fast enough? Once upon a time, Mikael Abrahamsson <swmike(a)swm.pp.se> said: > Windows XP SP2 and later has the concept of different "zones" (or > whatever it's called) where it'll allow things from the local subnet > but not from > outside of it, if you tell it so. I know people who configure their > network printers without default gw to handle their spotty security. That still requires someone to configure a printer, while most just plug it in and let it DHCP. Also, I needed to update the firmware on a network printer once, and it had to have a gateway because it downloaded the firmware directly. Heck, I have filled up a 5 port switch in my entertainment center now with TiVo, Xbox, Blu-Ray, and TV (plus back-haul); all of those use the Internet and so should have the protection of a firewall at the gateway (and of course the Xbox requires UPnP for some games). The TiVo, Blu-Ray, and possibly TV run Linux, which may be somewhat safer, but Linux has had (and will have) bugs too. -- Chris Adams <cmadams(a)hiwaay.net> Systems and Network Administrator - HiWAAY Internet Services I don't speak for anybody but myself - that's enough trouble.

2 1

Re: Rate of growth on IPv6 not fast enough?
by Roger Marquis 20 Apr '10

20 Apr '10

Jack Bates wrote: > Disable the uPNP (some routers lack it, and yes, it breaks and microsoft > will tell you to get uPNP capable NAT routers or get a new ISP). Thing is, neither of these cheap CPE has UPNP enabled, which leads me to question whether claims regarding large numbers of serverless multi-user game users are accurate. I disable UPNP as standard practice since it is cannot be enabled securely, at least not on cheap CPE. > Your argument has nothing to do with this part of the thread and > discussion of why implementing NAT at a larger scale is bad. I guess it > might have something to do in other tangents of supporting NAT66. I should have been clearer, apologies. WRT LSN, there is no reason individual users couldn't upgrade to a static IP for their insecurely designed multi-user games, and no reason to suspect John Levine's ISP is not representative with 0.16% of its users requesting upgrades. Roger Marquis

2 1

Re: Rate of growth on IPv6 not fast enough?
by Roger Marquis 20 Apr '10

20 Apr '10

Owen DeLong wrote: > The hardware cost of supporting LSN is trivial. The management/maintenance > costs and the customer experience -> dissatisfaction -> support calls -> > employee costs will not be so trivial. Interesting opinion but not backed up by experience. By contrast John Levine wrote: > My small telco-owned ISP NATs all of its DSL users, but you can get your > own IP on request. They have about 5000 users and I think they said I was > the eighth to ask for a private IP. I have to say that it took several > months to realize I was behind a NAT I'd bet good money John's experience is a better predictor of what will begin occurring when the supply of IPv4 addresses runs low. Then as now few consumers are likely to notice or care. Interesting how the artificial roadblocks to NAT66 are both delaying the transition to IPv6 and increasing the demand for NAT in both protocols. Nicely illustrates the risk when customer demand (for NAT) is ignored. That said the underlying issue is still about choice. We (i.e., the IETF) should be giving consumers the _option_ of NAT in IPv6 so they aren't required to use it in IPv4. IMO, Roger Marquis

6 6

Seeking Amazon EC2 abuse contact
by Erik L 20 Apr '10

20 Apr '10

Could someone from Amazon EC2 please contact me off-list regarding an abuse issue from one of their IPs? Alternatively, could someone please send me the contact details of someone there? E-mailing the abuse e-mail listed in WHOIS per their instructions, including all pertinent data, results in an auto-reply indicating to use a form on their site. Submitting the form results in "There has been an error while submitting your data. Please try again later." Calling their supposed NOC (as per WHOIS) results in "You have reached the legal department at Amazon...please leave a message". Thanks -- Erik Caneris Inc. Tel: 647-723-6365 Fax: 647-723-5365 Toll-free: 1-888-444-8843 www.caneris.com

6 7

Anyone got access to Cisco Call Manager >= 7.1(3b)SU1 ?
by Simon Lockhart 20 Apr '10

20 Apr '10

All (and apologies for the slight off-topic-ness), I need to get hold of a config file for a Cisco 9971 handset that has been generated by Cisco Call Manager (or, rather Cisco Unified Communications Manager) release 7.1(3b)SU1 or higher. Does anyone have access to such a system and would be prepared to generate a handset config file for me? If so, please respond to me off-list and I'll let you know exactly what I'm after... Many thanks, Simon

1 0

Intrado Service
by Joe Wood 20 Apr '10

20 Apr '10

Hello. Can someone at Intrado contact me sometime soon? Your voicemails are not being returned, as with your emails. I'd love to give you money, but without details, I can't <sigh>. Joe <schmoe at gmail.com>

1 0

IPV4 and IPV6 question
by jbfixurpc＠gmail.com 20 Apr '10

20 Apr '10

Greetings, <flame_suit_on> This may seem like a stupid question, but in IPV4 there are a few "reserved" bits which I've not seen used, but perhaps I am behind the times. With regard to these, what if one was to use such to delegate a second venue of IP space? In otherwords flip a bit in the flags reserved < http://www.networksorcery.com/enp/protocol/ip.htm#Flags > and now its considered IPV4.2 ... Would that not give a second range of IP address space to use? Granted there would be a ton of upgrades/updates to enable such, but sounds a little bit simplier than an IPV6 upgrade, maybe? I am on the fence regarding IPV6 as there have been many logical arguments pro and con regarding its deployment. I still have to wonder about these "reserved" bits, that seem never to be used, why not use them? Again perhaps I am behind the times and all of the bits are being used. Just my 2 cents. </flame_suit_on> Kind regards -Joe

2 1