July 2010 - Test - lists.nanog.org

[Bruce Hoffman] Thank-you for your recent participation.
by Robert E. Seastrom 15 Jul '10

15 Jul '10

Amusingly, this was sent to me *after* I replied to abuse@internap complaining about getting spammed. Anyone else getting spam from this joker? Has he been doing nanog mailing list or arin database harvesting? Anyone know who his boss is? -r

7 9

Root Zone DNSSEC Deployment Technical Status Update
by Joe Abley 14 Jul '10

14 Jul '10

Root Zone DNSSEC Deployment Technical Status Update 2010-07-14 This is the eleventh of a series of technical status updates intended to inform a technical audience on progress in signing the root zone of the DNS. RESOURCES Details of the project, including documentation published to date, can be found at <http://www.root-dnssec.org/>. We'd like to hear from you. If you have feedback for us, please send it to rootsign(a)icann.org. KSK CEREMONY 2 COMPLETE The second KSK ceremony for the root zone was completed this week in El Segundo, CA, USA. The Ceremony Administrator was Mehmet Akcin. The second production Key Signing Request (KSR) generated by VeriSign has now been processed by ICANN using the root zone KSK generated in KSK Ceremony 1, and the resulting Signed Key Response (SKR) has been accepted by VeriSign. This SKR contains signatures for Q4 2010, for use between 2010-10-01 and 2010-12-31. Audit materials relating to both the first and second ceremonies will be published today at <http://www.iana.org/dnssec/>. FULL PRODUCTION SIGNED ROOT ZONE The transition from Deliberately-Unvalidatable Root Zone (DURZ) to production signed root zone is scheduled take place on 2010-07-15 within a maintenance window which begins at 1930 UTC and ends at 2330 UTC. This is the usual window for the generation and distribution of root zones with SOA serials ending in 01. PLANNED DEPLOYMENT SCHEDULE Already completed: 2010-01-27: L starts to serve DURZ 2010-02-10: A starts to serve DURZ 2010-03-03: M, I start to serve DURZ 2010-03-24: D, K, E start to serve DURZ 2010-04-14: B, H, C, G, F start to serve DURZ 2010-05-05: J starts to serve DURZ 2010-06-16: First Key Signing Key (KSK) Ceremony 2010-07-12: Second Key Signing Key (KSK) Ceremony To come: 2010-07-15: Distribution of validatable, production, signed root zone; publication of root zone trust anchor (Please note that this schedule is tentative and subject to change based on testing results or other unforeseen factors.)

1 0

OER/PfR with BGP for inbound load sharing
by Dylan Ebner 14 Jul '10

14 Jul '10

Does anyone have any experience with using OER for inbound load sharing? I am looking to see if people are generaly satisfied with it's abilities or if I should look for other options to balance my inbound traffic. I have two connections (one 50Mb and one 25Mb) with partial BGP routes across two routers that I would like to move from an active/standby model to a more active/active model. Our organization moves very little information out of our forward facing precessence servers so outbound balancing is not as important. Almost 80% of our inbound traffic is VPN as well so using application discovery isn't that important either. Some specific questions I have are: Is OER aware of traffic-shape or bandwidth contstraints that are applied to an interface? Does OER simply add prepending for my advertised routes to my upstreams or does it actually prepend AS from inbound providers to move specific traffic from an AS to one of my underutilized connections? Does OER have to ability to control inbound traffic on a subnet level within the same AS? We receive a ton of data from a few AS numbers, so simply moving a single AS to a different connection may not be extremely effective. Thanks. Dylan Ebner

2 1

Receive Digest
by Yasir Munir Abbasi 14 Jul '10

14 Jul '10

Dear, I always receive digest with volume number, where number of email correspondence shown. That is very grim for reading. Is there any possibility I can receive individual email correspondence. Thanks Yasir Munir Abbasi Senior Network Engineer Ciklum Pakistan 2nd floor, Software Technology Park II, Evacuee Trust Plaza F-5/1, Islamabad Tel + 92 51 2826114 Fax +92 51 2870756 Mob +92 333 5605512 EMail: yamu(a)ciklum.net<mailto:yamu@ciklum.net>

2 2

Re: Vyatta as a BRAS
by khatfield＠socllc.net 13 Jul '10

13 Jul '10

In that case you are entirely accurate. If you were to use Vyatta (linux-based) systems for this then you would likely need additional infrastructure to firewall or zone it to ensure it can't be hit directly. Depending on what all it has running and the configuration it could be firewalled off locally but you're right it wouldn't withstand like 'hardware-accelerated' as stated before. Sorry for the confusion :) ------Original Message------ From: Dobbins, Roland To: NANOG list Subject: Re: Vyatta as a BRAS Sent: Jul 13, 2010 1:37 PM On Jul 14, 2010, at 1:29 AM, <khatfield(a)socllc.net> wrote: > We were talking about routing though. I was talking about packeting the boxes directly, apologies for being unclear - that's what I meant when I said that the era of software-based edge boxes is long past. ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)arbor.net> // <http://www.arbornetworks.com> Injustice is relatively easy to bear; what stings is justice. -- H.L. Mencken

2 1

Re: Vyatta as a BRAS
by khatfield＠socllc.net 13 Jul '10

13 Jul '10

Routing. We can route that. If it were targeting the box itself it would depend if the attack were getting through. Certainly iptables can't handle something like that but pf does well with high PPS rates. If it were all 'DROP' traffic then likely higher. If it were hitting the box directly and getting past the firewall, yes it would be substantially lower. We were talking about routing though. ------Original Message------ From: Dobbins, Roland To: NANOG list Subject: Re: Vyatta as a BRAS Sent: Jul 13, 2010 12:56 PM On Jul 14, 2010, at 12:39 AM, <khatfield(a)socllc.net> <khatfield(a)socllc.net> wrote: > I haven't done real world testing with Vyatta but we consistently pass 750KPPS+ without the slightest hiccup on our FreeBSD routing systems. 750kpps packeting the box itself? Also, note that kpps is a small amount of traffic, compared to what even very small botnets can dish out. ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)arbor.net> // <http://www.arbornetworks.com> Injustice is relatively easy to bear; what stings is justice. -- H.L. Mencken

2 1

Route reflector/server appliance for access router aggregation
by Eric Morin 13 Jul '10

13 Jul '10

Hi I working on a solution to offload my current internet facing, and soon to be backbone, routers from terminating IBGP sessions from aggregation network routers. I currently have 4948s (pizza box version of the cat4500) in place, mostly bridging traffic, but some routing (OSPF, couple dozen SVIs with HSRP). The 4948s surpasses all solution requirements (I think) except when it comes to scaling the number of BGP sessions to 80-100. The obvious solution is to replace with a much larger platform (ASR1k, etc), which I am consider as an option but capital is the killer. A more economical idea is to pair the 4948s with a route reflector or server. I am looking for recommendations on platforms that I should consider. I have seen the presentation from NANOG48 on open source route server applications (Thanks!), and I am considering a home grown solution, but I want to also consider any other commercial appliances that we can drop in (with some lab work of course) and buy support services on. I looked at a Vyatta appliance (2500 looks good, but single power supply is disappointing). At each PoP I would plan on having two reflectors/servers clustered, each paired with one 4948. I have 7206 NPE-G2s coming out of service in the future that could perhaps be used, but the timing wont work. If anyone has a recommendation on a platform, or general criticism of the idea, please advise. Feedback, positive or negative, is always welcome. Thanks in advance Eric RR Morin

4 3

Haiti - Bahama Fiber optic
by Marshall Eubanks 13 Jul '10

13 Jul '10

Does anyone know if the BDSNi fiber from Port-au-Prince, Haiti, to the Bahamas has been restored to service after the Earthquake ? Regards Marshall

2 1

Hunter Newby / ISOC-NY Round 2 - Weds 7pm at NYU - poll for questions
by Joly MacFie 12 Jul '10

12 Jul '10

The Internet Society's New York Chapter (ISOC-NY) held a meeting with Hunter Newby, CEO of Allied Fiber, on Jun 28 2010. This was an interesting and wide ranging roundtable discussion on AF's plans to encircle the entire USA with a dark fiber ring with carrier neutral access at any point. As the meeting was held at short notice, regrettably our two associates with the greatest expertise in such matters Frank Coluccio and NYC Community Fiber's Lou Klepner were not able to be present. After I posted the audio on the ISOC-NY NoticeBoard AF requested that it be taken down pending review - not surprising as the discussion shot off on multiple tangents, mainly on the history of networking. It has now been decided, rather than attempt a coherent edit of 2+ hours of audio, to videotape a follow-up meeting commencing with a more formal presentation. Both Frank and Lou have promised to attend. This meeting will take place on Weds 14 July 2010 at NYU (7pm) – if interested in attending please RSVP to president(a)isoc-ny.org What we'd like to do is to get to the nitty gritty of the AF dark fiber model and it's possible application to the communities it is passing, and to ferret out any catches that are being glossed over. Newby has said he's trying to make an emulatable model - the more we can define it, the better for everyone. Hunter Newby has asked that we advise of him of any technical or other detailed questions in advance, to ensure that he has the answers on tap. Read up some background on http://www.telecomramblings.com/2010/06/industry-spotlight-allied-fibers-hu… I'd like to get those questions to him by end of day Tuesday. j -- --------------------------------------------------------------- Joly MacFie 218 565 9365 Skype:punkcast WWWhatsup NYC - http://wwwhatsup.com http://pinstand.com - http://punkcast.com Secretary - ISOC-NY - http://isoc-ny.org ---------------------------------------------------------------

1 0

Stratogent CoLo/DC Info
by Stefan Molnar 12 Jul '10

12 Jul '10

Anyoneone know anything about Stratogent ( www.stratogent.com )? They look to me as a Internap reseller with SaaS direction. I am being asked to have a meeting with them from one of my VP level guys. Thanks

2 1