September 2010 - Test - lists.nanog.org

Re: Transporting QinQ across a Layer 2 link locked at 1518 octets AND across a Layer 3 link
by Nick Olsen 13 Sep '10

13 Sep '10

Only input I can give is on EOIP tunnels and MTU. Scenario is we had 1 remote router running, Tunneled back to our network using EOIP so that the remote network could use our ip space. Don't remember how I figured it out, But I was using the MTU of 1458 (On the EOIP interface). Everything was great, But weird things started happening. Certain sites wouldn't load, MSN.com....etc it was strange. Jacking it back up to 1500 flat fixed it. Nick Olsen Network Operations (877) 804-3001 x106 ---------------------------------------- From: "Francois Menard" <francois(a)menards.ca> Sent: Sunday, September 12, 2010 10:13 PM To: "Francois Menard" <francois(a)menards.ca> Subject: Re: Transporting QinQ across a Layer 2 link locked at 1518 octets AND across a Layer 3 link Oops two typos - sunday evening casualties. On 2010-09-12, at 10:06 PM, Francois Menard wrote: > Folks, > > Question #1: > > Is it possible for me to put an MPLS router on both ends of a circuit leased from a transport service provider which does not support QinQ (i.e. packets of 1526 bytes), and which requires us to tag traffic onto a well specified set of VLANs (i.e. if we want two VLANs, the service provider tells us which two VLANs to use). > > I was thinking of lowering the MTU size on my MPLS router such that I could do QinQ over VPLS, over MPLS, over Ethernet transport locked at @ 1514 octets. > > I would imagine that my effective IPv4 payload would be reduced to something like (not taking into account CRC removed in the Ethernet driver) > > 1514 minus 8 bytes for MPLS label minus 4 bytes for VPLS control word minus 4 bytes for VLAN tag #1 minus 4 bytes for VLAN tag #2 = > 1514 -8 -4 -4 -4 -4 = 1490 octets > > So if I set my MTU on my MPLS router at 1490 octets and send QinQ over VPLS over , wouldn't that allow for all of the above mentioned overhead to pile-up without exceeding the 1514 octets size allowed by my transport provider ? > So if I set my MTU on my MPLS router at 1490 octets and send QinQ over VPLS over MPLS over Ethernet, wouldn't that allow for all of the above mentioned overhead to pile-up without exceeding the 1514 octets size allowed by my transport provider ? > Question #2: > > I have another link, which is restricted by the transport service provider, which is an MPLS-VPN service, and which does not support QinQ, nor supports layer 2 bridging. > > An option available to me is to use an EoIP tunnel on a Mikrotik RouterOS router, which maps Ethernet over GRE over IP, causing some 28 octets of overhead. This is proprietary to Mikrotik. > > So in this case, assuming that I want to do something as dangerous as: > > QinQ over VPLS over MPLS over Ethernet over EoIP (over GRE, over IP) > > And accordingly set my MTU to: > > 1480 (from above) minus 28 octets (Ethernet over GRE over IP) = 1452 octets > 1490 (from above) minus 28 octets (Ethernet over GRE over IP) = 1462 octets > So if I set my MTU on my MPLS router at 1452 octets, wouldn't that allow for all of the above mentioned overhead to be successfully transported across an IP layer 3 circuit, effectively ending up with > 1462 octets > QinQ over MPLS over Ethernet over IP ? > > What are the consequences of setting the MTU as low as 1452 octets? What applications end-up breaking ? > 1462 octets > -=Francois=- > > > >

1 0

POS to Ethernet Converter
by Alan Bryant 13 Sep '10

13 Sep '10

I did a quick google search for a converter but either I'm not understanding, or I'm not searching for the right thing. We currently have a POS OC-3 that I would like to be able to convert it to Ethernet, if possible. Do such devices exist? -- Alan Bryant | Systems Administrator Gtek Computers & Wireless, LLC. alan(a)gtekcommunications.com | www.gtek.biz O 361-777-1400 | F 361-777-1405

12 11

Transporting QinQ across a Layer 2 link locked at 1518 octets AND across a Layer 3 link
by Francois Menard 12 Sep '10

12 Sep '10

Folks, Question #1: Is it possible for me to put an MPLS router on both ends of a circuit leased from a transport service provider which does not support QinQ (i.e. packets of 1526 bytes), and which requires us to tag traffic onto a well specified set of VLANs (i.e. if we want two VLANs, the service provider tells us which two VLANs to use). I was thinking of lowering the MTU size on my MPLS router such that I could do QinQ over VPLS, over MPLS, over Ethernet transport locked at @ 1514 octets. I would imagine that my effective IPv4 payload would be reduced to something like (not taking into account CRC removed in the Ethernet driver) 1514 minus 8 bytes for MPLS label minus 4 bytes for VPLS control word minus 4 bytes for VLAN tag #1 minus 4 bytes for VLAN tag #2 = 1514 -8 -4 -4 -4 -4 = 1490 octets So if I set my MTU on my MPLS router at 1490 octets and send QinQ over VPLS over , wouldn't that allow for all of the above mentioned overhead to pile-up without exceeding the 1514 octets size allowed by my transport provider ? Question #2: I have another link, which is restricted by the transport service provider, which is an MPLS-VPN service, and which does not support QinQ, nor supports layer 2 bridging. An option available to me is to use an EoIP tunnel on a Mikrotik RouterOS router, which maps Ethernet over GRE over IP, causing some 28 octets of overhead. This is proprietary to Mikrotik. So in this case, assuming that I want to do something as dangerous as: QinQ over VPLS over MPLS over Ethernet over EoIP (over GRE, over IP) And accordingly set my MTU to: 1480 (from above) minus 28 octets (Ethernet over GRE over IP) = 1452 octets So if I set my MTU on my MPLS router at 1452 octets, wouldn't that allow for all of the above mentioned overhead to be successfully transported across an IP layer 3 circuit, effectively ending up with QinQ over MPLS over Ethernet over IP ? What are the consequences of setting the MTU as low as 1452 octets? What applications end-up breaking ? -=Francois=-

1 1

List of Teredo servers and teredo relays
by Fernando Gont 12 Sep '10

12 Sep '10

Hi, Does any body maintain a list of Teredo servers and Teredo relays? Thanks! Kind regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

8 9

UK key roll-over - may need to flush name server caches
by Sean Donelan 12 Sep '10

12 Sep '10

If you are experiencing DNSSEC lookup validation failures for domains under the .UK TLD, you may (engineering-speak for almost definitely) need to flush your name server caches. http://www.nominet.org.uk/registrars/systems/serviceannouncements/ DNSSEC validation issue Due to a failure of a Hardware Security Module (HSM), as a matter of precaution, we failed over to our backup signing system this afternoon. As the backup system did not use the exact same Zone Signing Keys (ZSK), there is the possibility of validation failures. To make sure validators use the correct zone signing keys, caches might need to be flushed.

1 0

Re: Convenience or slippery slope... or something else?
by Jon Lewis 11 Sep '10

11 Sep '10

On Fri, 10 Sep 2010, Reese wrote: > A friend brought this to my attention: > > http://ipq.co/ > > He saw it at http://news.ycombinator.com/item?id=1678324 > > I'm not sure whether to shriek in joy or in pain. Will data from > this service - if it is a worthy service - propagate properly? > Play nicely with or break other people's toys? Is it a gimmick? How's it going to break anything? I just created one... tentententen.ipq.co. 86400 IN A 10.10.10.10 so...now I can use tentententen.ipq.co as a name that resolves to 10.10.10.10...assuming I trust ipq.co to keep that A record and not delete or change it at some point. Other than the fact that you can't change it[1], how is this any different (other than being less useful) or scarier than DynDNS? 1. EMAIL ADDRESS optional, but will allow you to update the record later (once we implement it) ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

4 3

Re: List of Teredo servers and teredo relays
by khatfield＠socllc.net 11 Sep '10

11 Sep '10

Thanks for the explanation. And Owen: thanks, I just thought most networks/facilities (colo/private) should be close to ipv6 now days. At least capable, maybe not configured. I think I was just making an assumption so thanks for the info. ------Original Message------ From: Jeff Kell To: Kevin Hatfield Cc: NANOG Subject: Re: List of Teredo servers and teredo relays Sent: Sep 11, 2010 3:22 PM On 9/11/2010 3:29 PM, khatfield(a)socllc.net wrote: > I may be missing the point here completely but to me Teredo just seems like a glorified hack/workaround for a bigger problem. Isn't is better (yes less cost-effective) to just upgrade equipment? > > I really don't see the advantage here. Maybe someone can explain away my ignorance to the concept? > Teredo is a "last-ditch" solution, but unfortunately in the Microsoft world, and acceptable and preferable solution over IPv4. Pure speculation, but the IPv6 efforts of many (looking at current MacOS, Windows, and a growing segment of PDAs/phones) are making tremendous effort to obtain "some" form of IPv6 connectivity. This makes sense if there were (a) only IPv6 connectivity at the client endpoint, or (b) only IPv6 connectivity at the service endpoint. That would insure things would work if either case were true. What is currently "breaking" things is the preference of IPv6 over IPv4. If you're running a default Win2K8 active directory, it's publishing all of it's goodies for login in IPv6 form complete with AAAA address records. If your network isn't end-to-end IPv6 compliant, but some Win7 client across the hall (on another subnet) has found *any* IPv6 connectivity (6to4, Teredo, doesn't matter how good/bad/ugly/slow), it is going to try to communicate with the domain controller over that IPv6 connection. I have seen this in action, and stacks of trouble tickets of slow / intermittent / no connectivity with the domain. As it currently stands, if you're not 100% end-to-end IPv6 ready with compliant transport, these "preferences" break or cripple things. Of course, this all may be by IPv6 design (make it so horribly painful not to accomodate to push you to provide better alternatives) :-) Jeff

2 1

Re: List of Teredo servers and teredo relays
by khatfield＠socllc.net 11 Sep '10

11 Sep '10

I may be missing the point here completely but to me Teredo just seems like a glorified hack/workaround for a bigger problem. Isn't is better (yes less cost-effective) to just upgrade equipment? I really don't see the advantage here. Maybe someone can explain away my ignorance to the concept? ------Original Message------ From: Antonio Querubin To: Fernando Gont Cc: NANOG Subject: Re: List of Teredo servers and teredo relays Sent: Sep 10, 2010 6:11 PM On Fri, 10 Sep 2010, Fernando Gont wrote: > Does any body maintain a list of Teredo servers and Teredo relays? A list of public Teredo servers might be useful. But a list of public relays - not so much. If you google around you'll eventually stumble across the following public servers: teredo.ipv6.microsoft.com teredo.remlab.net teredo2.remlab.net debian-miredo.progsoc.org teredo.ginzado.ne.jp teredo.iks-jena.de The first is the default for Windows. The second is the initial default for most Miredo installs. The fourth is supposedly the default for the Debian Miredo package. You can get an idea of where some public relays might be at: http://www.bgpmon.net/teredo.php But there may be a bunch of others not listed. The relay used varies on a per-connection basis. It'll generally be the closest relay to the non-teredo host. Antonio Querubin 808-545-5282 x3003 e-mail/xmpp: tony(a)lava.net

3 2

Re: Convenience or slippery slope... or something else?
by Christopher Morrow 11 Sep '10

11 Sep '10

On Fri, Sep 10, 2010 at 1:05 PM, Reese <reese(a)inkworkswell.com> wrote: > A friend brought this to my attention: > > http://ipq.co/ as an aside: <https://www.nic.co/> note the cert in used for the NIC's website... surely the .CO ccTLD could use a real cert? -chris

1 1

BGP Update Report
by cidr-report＠potaroo.net 10 Sep '10

10 Sep '10

BGP Update Report Interval: 02-Sep-10 -to- 09-Sep-10 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS8151 31195 2.6% 4.3 -- Uninet S.A. de C.V. 2 - AS35567 29787 2.5% 286.4 -- DASTO-BOSNIA-AS DASTO semtel d.o.o. 3 - AS3464 21780 1.8% 1815.0 -- 4 - AS32528 17666 1.5% 2944.3 -- ABBOTT Abbot Labs 5 - AS13880 17346 1.5% 2478.0 -- 6 - AS9829 17122 1.4% 60.3 -- BSNL-NIB National Internet Backbone 7 - AS5536 16891 1.4% 155.0 -- Internet-Egypt 8 - AS6298 15283 1.3% 17.5 -- 9 - AS23700 12043 1.0% 25.1 -- BM-AS-ID PT. Broadband Multimedia, Tbk 10 - AS3816 8729 0.7% 24.5 -- COLOMBIA TELECOMUNICACIONES S.A. ESP 11 - AS17974 8434 0.7% 9.0 -- TELKOMNET-AS2-AP PT Telekomunikasi Indonesia 12 - AS35931 8381 0.7% 2793.7 -- 13 - AS16718 8160 0.7% 582.9 -- 14 - AS7552 7871 0.7% 13.6 -- VIETEL-AS-AP Vietel Corporation 15 - AS21017 7458 0.6% 128.6 -- VSI-AS VSI AS 16 - AS45464 7093 0.6% 236.4 -- NEXTWEB-AS-AP Room 201, TGU Bldg 17 - AS36129 6965 0.6% 3482.5 -- 18 - AS8452 6838 0.6% 7.1 -- TE-AS TE-AS 19 - AS39435 6322 0.5% 119.3 -- EVOLGOGRAD-AS CJSC "ER-Telecom Company" Vologograd Autonomous System 20 - AS45951 5939 0.5% 144.9 -- AUGERE-AS-AP Augere Wireless Broadband Bangladesh Limited TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS36129 6965 0.6% 3482.5 -- 2 - AS32528 17666 1.5% 2944.3 -- ABBOTT Abbot Labs 3 - AS35931 8381 0.7% 2793.7 -- 4 - AS13880 17346 1.5% 2478.0 -- 5 - AS3464 21780 1.8% 1815.0 -- 6 - AS17029 1148 0.1% 1148.0 -- 7 - AS1959 2209 0.2% 736.3 -- 8 - AS15984 728 0.1% 728.0 -- The Joint-Stock Commercial Bank CentroCredit. 9 - AS11613 728 0.1% 728.0 -- 10 - AS2 667 0.1% 177.0 -- UPOU-LB-AS-AP University of the Philippines - Open University Los Banos Campus 11 - AS16718 8160 0.7% 582.9 -- 12 - AS18163 2241 0.2% 560.2 -- JINJU18163-AS-KR jinju national university 13 - AS11384 556 0.1% 556.0 -- 14 - AS16861 480 0.0% 480.0 -- 15 - AS32211 2324 0.2% 464.8 -- 16 - AS21530 452 0.0% 452.0 -- 17 - AS37204 3934 0.3% 393.4 -- TELONE 18 - AS35894 348 0.0% 348.0 -- 19 - AS15384 696 0.1% 348.0 -- CD CONTACT DIRECT AS 15384 20 - AS31403 343 0.0% 343.0 -- INVA-AS IN.VA.'s Autonomous System TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 129.66.128.0/17 10864 0.9% AS3464 -- 2 - 129.66.0.0/17 10863 0.9% AS3464 -- 3 - 130.36.34.0/24 8829 0.7% AS32528 -- ABBOTT Abbot Labs 4 - 130.36.35.0/24 8826 0.7% AS32528 -- ABBOTT Abbot Labs 5 - 190.65.228.0/22 5477 0.4% AS3816 -- COLOMBIA TELECOMUNICACIONES S.A. ESP 6 - 63.211.68.0/22 4877 0.4% AS35931 -- 7 - 195.39.181.0/24 4274 0.3% AS1 -- AS6755 -- ASN - TURNET AS9155 -- QNET QualityNet AS number 8 - 8.8.178.0/24 3694 0.3% AS36129 -- 9 - 95.32.192.0/18 3605 0.3% AS21017 -- VSI-AS VSI AS 10 - 216.126.136.0/22 3517 0.3% AS6316 -- 11 - 95.32.128.0/18 3508 0.3% AS21017 -- VSI-AS VSI AS 12 - 198.140.43.0/24 3482 0.3% AS35931 -- 13 - 213.196.76.0/24 3479 0.3% AS35567 -- DASTO-BOSNIA-AS DASTO semtel d.o.o. 14 - 213.196.78.0/24 3479 0.3% AS35567 -- DASTO-BOSNIA-AS DASTO semtel d.o.o. 15 - 213.196.79.0/24 3479 0.3% AS35567 -- DASTO-BOSNIA-AS DASTO semtel d.o.o. 16 - 213.196.77.0/24 3479 0.3% AS35567 -- DASTO-BOSNIA-AS DASTO semtel d.o.o. 17 - 213.196.72.0/24 3473 0.3% AS35567 -- DASTO-BOSNIA-AS DASTO semtel d.o.o. 18 - 213.196.75.0/24 3473 0.3% AS35567 -- DASTO-BOSNIA-AS DASTO semtel d.o.o. 19 - 213.196.74.0/24 3473 0.3% AS35567 -- DASTO-BOSNIA-AS DASTO semtel d.o.o. 20 - 213.196.73.0/24 3473 0.3% AS35567 -- DASTO-BOSNIA-AS DASTO semtel d.o.o. Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0