January 2011 - Test - lists.nanog.org

Strange L2 failure
by Jack Bates 10 Feb '11

10 Feb '11

Has anyone seen issues with IOS where certain MACs fail? 54:52:00 (kvm) fails out an old 10mbit port on a 7206 running 12.2 SRE. I've never seen anything like this. DHCP worked, ARP worked, and arp debugging showed responses for arp to the MAC, however, tcpdump on the host system showed no unicast or arp responses coming from the router, while the switch management ip and other stuff on the local segment communicated fine with the vm. This broke for IPv6 as well. I changed the vm's MAC to 54:51:00, 50:52:00 and still failed. Changed it to 40:52:00 and it works for both v4 and v6. Was there a change which would cause certain hardware to not accept a MAC starting with 50: or higher? Jack

4 5

Using IPv6 with prefixes shorter than a /64 on a LAN
by Carlos Martinez-Cagnazzo 09 Feb '11

09 Feb '11

The subject says it all... anyone with experience with a setup like this ? I am particularly wondering about possible NDP breakage. cheers! Carlos -- -- ========================= Carlos M. Martinez-Cagnazzo http://www.labs.lacnic.net =========================

51 145

5.7/5.8 GHz 802.11n dual polarity MIMO through office building glass, 1.5 km distance
by Anonymous List User 03 Feb '11

03 Feb '11

For architectural and building management reasons we cannot mount our antennas in a rooftop or outdoor location at either end. The distance between two buildings is 1.5 km, and the fresnel zone is clear. Antennas need to be located indoors at both ends and will be placed on small speaker stand tripod pointing at windows. This has been done successfully before with 2.4 GHz 802.11g equipment and a link from an office in the Westin to a nearby apartment building, but I am unsure of what effect glass will have on 5 GHz. Has anyone tried this? The goal of this link is to achieve a 10 Mbps+ full duple bridge to a building which is only serviced by ADSL2+ Telus service in a Western Canadian city. Telus' upstream speed offering do not exceed 1 Mbps. Equipment. These have been used successfully for MCS13/MCS14 50 Mbps+ bridges at 11 km distance between towers. http://ubnt.com/nanobridge http://www.ubnt.com/downloads/nb5_datasheet.pdf

13 13

Verizon acquiring Terremark
by Ryan Finnesey 02 Feb '11

02 Feb '11

With Verizon acquiring Terremark does the group fell the NAPs will change from being carrier-neutral environments to pro Verizon? Has Verizon acquired carrier-neutral centers in the past? Cheers Ryan

11 14

Connectivity status for Egypt
by Danny O'Brien 02 Feb '11

02 Feb '11

Around 2236 UCT, we lost all Internet connectivity with our contacts in Egypt, and I'm hearing reports of (in declining order of confirmability): 1) Internet connectivity loss on major (broadband) ISPs 2) No SMS 4) Intermittent connectivity with smaller (dialup?) ISPs 5) No mobile service in major cities -- Cairo, Alexandria The working assumption here is that the Egyptian government has made the decision to shut down all external, and perhaps internal electronic communication as a reaction to the ongoing protests in that country. If anyone can provide more details as to what they're seeing, the extent, plus times and dates, it would be very useful. In moments like this there are often many unconfirmed rumors: I'm seeking concrete reliable confirmation which I can pass onto the press and those working to bring some communications back up (if you have a ham radio license, there is some very early work to provide emergency connectivity. Info at: http://pastebin.com/fHHBqZ7Q ) Thank you, -- dobrien(a)cpj.org Danny O'Brien, Committee to Protect Journalists gpg key: http://www.spesh.com/danny/crypto/dannyobrien-key20091106.txt

37 63

Re: Future of the IPv6 CPE survey on RIPE Labs - Your Input Needed
by Chris Conn 02 Feb '11

02 Feb '11

> On 27/01/11 08:17 -0600, Jack Bates wrote: >> On 1/27/2011 12:57 AM, Frank Bulk wrote: >>> Have you looked at D-Link's DIR-825? It has most of the things you're >>> looking for. The DIR-655 is a more affordable option. >>> >> Haven't had the chance to look at that one. Will check it out. >> >>> In regards to (2), is it even possible to do DHCPv6-PD on with a SLAAC WAN? >>> >> It had better be, as IOS 12.2 SRE only supports SLAAC + DHCPv6-PD. >> Most of the Cisco documentation I've seen, says that is their >> beautiful layout. No more proxyarp/nd. Instead, assign a /64 to each >> subinterface, perform SLAAC, then hand out prefixes via DHCPv6-PD if >> someone needs a prefix. > > The DIR-825(Rev B) running firmware 2.05NA does. From the status screen: > > IPv6 Connection Type : Autoconfiguration (SLAAC/DHCPv6) > Network Status : Connected > > WAN IPv6 Address : 2610:b8:0:234:218:e7ff:fef8:66dc/64 > IPv6 Default Gateway : fe80::c67d:4fff:fed6:5401 > LAN IPv6 Address : 2610:b8:100f:1:218:e7ff:fef8:66db/64 > LAN IPv6 Link-Local Address : fe80::218:e7ff:fef8:66db/64 > Primary IPv6 DNS Server : 2610:b8:0:3:215:c5ff:fef3:f9c8 > Secondary IPv6 DNS Server : 2610:b8:0:3:215:c5ff:feee:9448 > DHCP-PD : Enabled > IPv6 network assigned > by DHCP-PD : 2610:b8:100f::/48 > > The latest firmware has fairly good support, but is lacking configurable v6 > firewall settings. I haven't done any firewall testing yet, but I'd imagine > all incoming v6 connections are blocked. > > The Emulator hasn't been updated yet to reflect the options in the new > firmware, but this should give you an idea of what the configuration looks > like: > > http://www.support.dlink.com/emulators/dir825_revB/203NA/adv_link_local.html > > The DIR-615 should have similar support, but I haven't upgraded it yet. Hello, As for the DIR-615, it should, but it doesn't...At least, the E3/E4 revisions I had. I contacted D-LINK support and was able to get a beta build that seems promising. But DHCP-PD over PPPoE works relatively well, minus a couple of little "features". I am hoping to have that hammered out soon, as the 615 is a capable little sub-50$ home CPE. But D-Link engineering seems receptive to my observations. I have to check the state of the firewalling in it too ;) Chris

4 5

A top-down RPKI model a threat to human freedom? (was Re: Level 3's IRR Database)
by Martin Millnert 02 Feb '11

02 Feb '11

Here be dragons, On Sun, Jan 30, 2011 at 12:39 PM, Carlos Martinez-Cagnazzo <carlosm3011(a)gmail.com> wrote: > The solution to this problem (theoretical at least) already exist in > the form of RPKI. Any top-down RPKI model is intrinsically flawed. Deploying an overlay of single-point(s) of failure on top of a well-functional distributed system such as the Internet does not seem like a solution to much. The Internet works reasonably well only because it is reasonably distributed. I acknowledge that: 1) there are occasionally routing problems, 2) that IPv4 will deteriorate further very rapidly as it runs out and second-hand markets pick up, 3) that spammers run BGP and abuse, seemingly primarily, the non-RIR IRR-dbs. The answer to these issues is not by default RPKI IMO. For example, how about: 1, fix them - are there any problems that hasn't been fixed or were seriously hard to fix? Enumerate and let's go specific; let's not deploy a tank to push in a screw. 2, IPv6? 3, improve/remove non-RIR IRR-dbs It should be fairly obvious, by most recently what's going on in Egypt, why allowing a government to control the Internet is a Really Bad Idea. While it is true that governments are more or less in control of the *geographic area* they govern, as is evident in Egypt, there is a serious and big difference between the ease of removing a prefix from the Internet today in a country and how easy it will be in the fully network-deployed RPKI case, because of the hierarchical model (send your tanks to the RIR office(s) instead of every single country). Yes, governments exploit capabilities given to them by technological means ("we do it just because we can" is a standing motto). A top-down RPKI model would be a severely negative development of the resilience of the Internet, especially for freedom-aspiring people (approximately equal to humankind?), who need to avert government suppression. If we are to go down this path, at the very least it must stay architecturally/technologically *impossible* for a entity from country A to via-the-hierarchical-trust-model block a prefix assigned to some entity in country B, that is assigned by B's RIR and in full accordance with the RIR policies and in no breach of any contract. If not, we're doing humanity a disservice. One that I have no doubt would simply spawn/grow further overlay-networks to counter the problem. Cheers, Martin > > On Sun, Jan 30, 2011 at 6:23 AM, Andrew Alston <aa(a)tenet.ac.za> wrote: >> Hi All, >> >> I've just noticed that Level 3 is allowing people to register space in its IRR database that A.) is not assigned to the people registering it and B.) is not assigned via/to Level 3. >> >> So, I have two queries >> >> A.) Are only customers of Level 3 allowed to use this database >> B.) Can someone from Level 3 please clarify if there are any plans to lock this down slightly >> >> At this point, it would seem that if you are a customer of level 3's, you can register any space you feel like in there, and announce anything you feel like once the filters propagate, which in my opinion completely nullifies the point of IRR in the first place. >> >> Though I think this also raises the question about IRR databases in general. Would it not be far more sane to have each RIR run a single instance each which talk to each other, which can be verified against IP address assignments, and scrap the distributed IRR systems that allow for issues like this to occur? >> >> (In the mean time I've emailed the relevant people to try and get the entries falsely registered in that database removed, and will wait and see if I get a response). >> >> >> Andrew Alston >> TENET - Chief Technology Officer >> Phone: +27 21 763 7181 >> >> > > > > -- > -- > ========================= > Carlos M. Martinez-Cagnazzo > http://www.labs.lacnic.net > ========================= > >

12 30

2011.01.31 NANOG51 day 1 afternoon session notes
by Matthew Petach 01 Feb '11

01 Feb '11

I've posted my notes from the afternoon sessions, including the lighting talks, at http://kestrel3.netflight.com/2011.01.31-NANOG51-afternoon-notes.txt for those are are following along remotely, or catching up after a good round of meetings at the bar. :) Have fun at the beer and gear--sorry I can't take any notes on the IPv6 deployment experiences panel--I'm sure it would have been interesting reading, given the amount of attention v6 has been getting on the list recently. ^_^ Matt

2 1

IPv6: numbering of point-to-point-links
by Lasse Jarlskov 01 Feb '11

01 Feb '11

Hi all. While reading up on IPv6, I've seen numerous places that subnets are now all /64. I have even read that subnets defined as /127 are considered harmful. However while implementing IPv6 in our network, I've encountered several of our peering partners using /127 or /126 for point-to-point links. What is the Best Current Practice for this - if there is any? Would you recommend me to use /64, /126 or /127? What are the pros and cons? -- Best regards, Lasse Jarlskov Systems architect - IP Telenor DK

16 19

Collos in Memphis, TN and Louisville, KY?
by Graham Wooden 01 Feb '11

01 Feb '11

Hi folks, Can anyone recommend any collo's in both Memphis TN and Louisville, KY? Preferably in their respective downtown areas? Thanks mucho, -graham

3 3