January 2011 - Test - lists.nanog.org

PPPOE vs DHCP
by Paul Stewart 28 Jan '11

28 Jan '11

Hey folks... I'm meeting with a customer tomorrow (service provider, rural telco) and we're pitching they move to a PPPOE platform most likely. But to be fair, I'm looking to draw up a comparison so they are "well informed" of the pros/cons. Has anyone done this? I came up with the following brief start: PPPOE vs DHCP PPPOE Pros ---------- Allows full authentication of customers (requires username/password) Allows control over customer connections (suspend accounts, create accounts etc) Easily assign static IP to customer (no MAC address or CPE information required) Assign public subnet to customer with ease (no manual routing required) IPv4/IPv6 fully supported on Juniper platform as required Usage tracking (GB transfer) from radius generated data PPPOE Cons ---------- Requires PPPOE termination router (Juniper ERX for example) Requires Radius server(s) to assign and track customer IP assignments/usage Customers require username/password to connect Customers require PPPOE client software or router to connect 8 bytes MTU overhead DHCP Pros --------- Simplistic - plug and play 90% of the time No MTU overhead, full 1500 MTU frame size DHCP Cons --------- No authentication occurs (anyone physically connected can use Internet generally) No user tracking without tracking customer CPE MAC addresses No usage tracking builtin to DHCP (GB transfer) There are several factors involved here. The first major thing is that we believe the customer wants to move towards caps on their customer usage (X amount of GB per month). Today, they are doing static IP assignments but the interesting thing is that the CPE they have control over today (Comtrend routers with DSL modem builtin). I know there's not always a good vs bad here but looking for opinions from folks who may have already done this comparison for a "boardroom discussion".... Thanks ;) Paul

9 19

Found: Who is responsible for no more IP addresses
by Hank Nussbacher 28 Jan '11

28 Jan '11

"World to run out of IP addresses soon, Internet expert says" http://news.xinhuanet.com/english2010/sci/2011-01/26/c_13708282.htm "Vint Cerf, who helped create IPv4 in 1977 and one of the founding fathers of the Web, told Australia's Sydney Morning Herald that IP addresses will be used up soon, perhaps within weeks. "I thought it was an experiment and I thought that 4.3 billion IPv4 addresses would be enough to do an experiment," Cerf was quoted as saying, adding it is his "fault" that "we were running out of the addresses."" Glad we cleared that up! :-) -Hank

24 31

overview of RAN solutions?
by Rogelio 27 Jan '11

27 Jan '11

I am wrapping my mind around the myriad of RAN solutions out there, and I would appreciate it if someone had a good overview of the subject or could direct me to new vendors worth investigating. So far, I see ones that are designed to (a) increase coverage, (b) increase capacity, or (c) do some combo of (a) and (b). Some solutions suck in the donor signal (antennas on top of roof) and then blow it back indoors on various frequencies. A good example of this is something like Axell, which doesn't appear to add much capacity, just stretch the existing uplink's capacity by amplifying the signal indoors. Other solutions (IP-RAN, E-RAN, etc) have an Internet / IP component and allow for all sorts of cool things (synchronization between units for soft handoff, etc). SpiderCloud seems to be a good play here. Then there are other niche plays that don't do everything, but seem to be good enough for various applications, like SMS texting. If I remember right, IPAccess did this sort of thing for schools (which is perfect for emergencies). Any others I should look into? I'm primarily interested in carrier-grade ones... -- Also on LinkedIn? Feel free to connect if you too are an open networker: scubacuda(a)gmail.com

1 0

best PCRF for pre-paid mobile solutions?
by Rogelio 27 Jan '11

27 Jan '11

I am researching some PCRF solutions for some work I am doing with non-US operators, and I am looking for features that work well in pre-paid mobile environments, particularly ones that want to cap or charge 3G and WiFi at different rates / levels. Any suggestions or contacts? -- Also on LinkedIn? Feel free to connect if you too are an open networker: scubacuda(a)gmail.com

1 0

Re: [arin-announce] ARIN Resource Certification Update
by Randy Bush 27 Jan '11

27 Jan '11

> Why does this stop the whole thing short? the devil is in the details and the trust. i am desperately open to other approaches. but work it out at the detailed level, not just a troll on nanog. i anxiously await your and danny's draft. randy

1 0

Re: [arin-announce] ARIN Resource Certification Update
by Osterweil, Eric 27 Jan '11

27 Jan '11

On 1/25/11 7:04 AM, "Roland Dobbins" <rdobbins(a)arbor.net> wrote: > > > On Jan 25, 2011, at 9:52 PM, Joe Abley wrote: > >> If the DNS was as unreliable as those words suggested, nobody would use it. > > I see evidence of this unreliability every day, so I must respectfully > disagree. > > ;> > >> The reality is that everybody uses it. > > The reality is that they don't really have a choice, now, do they? > > ;> I think it's actually correct, and backs up Danny's point: it is very useful to be able to use a system that is: deployed, understood, operationally viable, etc. The risk of designing from scratch is best described by the lead time many other architectural changes have/are facing in being deployed. I think the bottom line is that this infrastructure will allow a security solution to reach deployment _much_ sooner than a green-field design. Eric

2 1

Re: [arin-announce] ARIN Resource Certification Update
by Osterweil, Eric 27 Jan '11

27 Jan '11

Sorry to be Johnny-come-lately to this... On 1/24/11 6:31 PM, "Randy Bush" <randy(a)psg.com> wrote: >> Right, I've heard the circular dependency arguments. So, are you >> suggesting the RPKI isn't going to rely on DNS at all? > > correct. it need not. Maybe I am misunderstand something here... Are (for example) the rsync processes going to use hard coded IPs? Are the SIAs and AIAs referenced by IP? > >> I'm of the belief RPKI should NOT be on the critical path, but instead >> focus on Internet number resource certification - are you suggesting >> otherwise? > > <channeling steve kent> > see the word 'certification'? guess where that leads. pki. add > resources and stir. Sounds like a loose definition of pki. Does DNSSEC count as such a loosely defined pki? :-P > >>> if the latter, then you have the problem that the dns trust model is >>> not congruent with the routing and address trust model. >> That could be easily fixed with trivial tweaks and transitive trust/ >> delegation graphs that are, I suspect. > > not bloody likely. the folk who sign dns zones are not even in the same > building as the folk who deal with address space. in large isps, not > even in the same town. Why does this stop the whole thing short? I think the people who run any as-yet-to-be-developed-and-deployed system don't sit in any building at all... Yet, right? :) Tbqh, I think I might be missing something important (so, please forgive my ignorance), but I don't see how (for example) admins of the SMTP infrastructure have trouble getting their MX records right in DNS zones... How are getting certs in there so much worse? Eric

1 0

RE: Clearwire/Clear for branch office connectivity?
by Jason Roysdon - NANOG 27 Jan '11

27 Jan '11

As a Clear customer, some things that I would inform you of: Using RFC1918 in their backbone: Traceroute from my internal network out: $ traceroute 8.8.8.8 traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 40 byte packets 1 10.12.250.49 (10.12.250.49) 1.671 ms 1.467 ms 3.214 ms - my network 2 10.12.249.1 (10.12.249.1) 15.594 ms 15.530 ms 17.015 ms - my network 3 192.168.15.1 (192.168.15.1) 17.957 ms 17.882 ms 18.978 ms - Clear CPE router device 4 * * * 5 10.41.229.197 (10.41.229.197) 82.081 ms 83.805 ms 52.455 ms 6 (71.22.8.161) 72.237 ms 72.105 ms 73.546 ms 7 (71.22.8.253) 75.988 ms 75.915 ms 76.095 ms 8 xe-10-3-0.bar1.SanFrancisco1.Level3.net (4.53.132.13) 73.130 ms 75.894 ms 75.801 ms 9 ae-0-11.bar2.SanFrancisco1.Level3.net (4.69.140.146) 79.860 ms 79.785 ms 76.723 ms 10 ae-6-6.ebr2.SanJose1.Level3.net (4.69.140.154) 79.558 ms 86.145 ms 86.056 ms 11 ae-92-92.csw4.SanJose1.Level3.net (4.69.134.222) 88.848 ms ae-72-72.csw2.SanJose1.Level3.net (4.69.134.214) 79.919 ms ae-92-92.csw4.SanJose1.Level3.net (4.69.134.222) 87.548 ms 12 ae-2-79.edge2.SanJose1.Level3.net (4.68.18.79) 77.322 ms ae-1-69.edge2.SanJose1.Level3.net (4.68.18.15) 78.785 ms ae-4-99.edge2.SanJose1.Level3.net (4.68.18.207) 77.568 ms 13 YOU-TUBE-IN.edge2.SanJose1.Level3.net (4.79.40.178) 80.985 ms 79.992 ms 81.634 ms 14 72.14.232.138 (72.14.232.138) 77.333 ms 72.14.232.136 (72.14.232.136) 81.425 ms 72.14.232.138 (72.14.232.138) 81.579 ms 15 216.239.47.186 (216.239.47.186) 102.799 ms 216.239.49.198 (216.239.49.198) 98.672 ms 107.898 ms 16 216.239.43.228 (216.239.43.228) 99.203 ms 99.134 ms 101.426 ms 17 216.239.48.165 (216.239.48.165) 101.391 ms 216.239.48.137 (216.239.48.137) 101.234 ms 216.239.48.165 (216.239.48.165) 110.738 ms 18 209.85.254.150 (209.85.254.150) 103.835 ms 104.921 ms 209.85.254.146 (209.85.254.146) 110.847 ms 19 google-public-dns-a.google.com (8.8.8.8) 90.106 ms 97.549 ms 93.919 ms Hops 1-3 are mine. Hops 4-7 is Clear's backbone. Clear doesn't use PTR records all the time, see hops 6 & 7. Traceroute back to my Clear IP on my CPE router device: $ traceroute (address removed) traceroute to (address removed), 30 hops max, 60 byte packets 1 removed 1.812 ms 2.173 ms 2.087 ms 2 public IP, removed 2.731 ms 2.635 ms 2.591 ms 3 public IP, removed 2.549 ms 2.520 ms 2.467 ms 4 0.ge-2-0-1.xt1.sac1.alter.net (152.63.51.81) 5.194 ms 5.170 ms 5.384 ms 5 0.so-5-2-0.xl3.sjc7.alter.net (152.63.48.6) 50.991 ms 49.159 ms 49.088 ms 6 0.ae3.br1.sjc7.alter.net (152.63.51.38) 9.644 ms 0.ae3.br3.sjc7.alter.net (152.63.50.5) 9.394 ms 9.352 ms 7 xe-9-2-0.edge1.sanjose3.level3.net (4.68.62.109) 10.201 ms 10.146 ms 10.107 ms 8 vlan69.csw1.sanjose1.level3.net (4.68.18.62) 18.609 ms vlan99.csw4.SanJose1.Level3.net (4.68.18.254) 13.095 ms vlan89.csw3.SanJose1.Level3.net (4.68.18.190) 12.120 ms 9 ae-82-82.ebr2.sanjose1.level3.net (4.69.134.217) 10.507 ms ae-62-62.ebr2.sanjose1.level3.net (4.69.134.209) 9.397 ms 9.344 ms 10 ae-1-6.bar2.sanfrancisco1.level3.net (4.69.140.153) 10.429 ms 9.605 ms 9.767 ms 11 ae-0-11.bar1.sanfrancisco1.level3.net (4.69.140.145) 9.741 ms 10.291 ms 10.172 ms 12 clearwire-c.bar1.sanfrancisco1.level3.net (4.53.132.14) 11.604 ms 11.598 ms 11.523 ms 13 71.22.8.254 (71.22.8.254) 10.122 ms 10.046 ms 10.038 ms 14 71.22.8.162 (71.22.8.162) 12.713 ms 10.839 ms 11.142 ms 15 * * * 16 * * * 17 * * * Traceroute back to my Clear CPE router's default gateway: $ traceroute 50.8.128.1 traceroute to 50.8.128.1 (50.8.128.1), 30 hops max, 60 byte packets 1 removed 1.812 ms 2.173 ms 2.087 ms 2 public IP, removed 2.731 ms 2.635 ms 2.591 ms 3 public IP, removed 2.549 ms 2.520 ms 2.467 ms 4 0.ge-2-0-1.xt1.sac1.alter.net (152.63.51.81) 21.532 ms 21.529 ms 21.510 ms 5 0.so-5-2-0.xl3.sjc7.alter.net (152.63.48.6) 30.556 ms 32.337 ms 32.309 ms 6 0.ae3.br1.sjc7.alter.net (152.63.51.38) 32.298 ms 0.ae3.br3.sjc7.alter.net (152.63.50.5) 38.977 ms 0.ae3.br1.sjc7.alter.net (152.63.51.38) 40.915 ms 7 xe-8-1-0.edge1.sanjose3.level3.net (4.68.110.249) 27.102 ms 13.003 ms 21.180 ms 8 vlan79.csw2.SanJose1.Level3.net (4.68.18.126) 21.157 ms 18.735 ms vlan89.csw3.sanjose1.level3.net (4.68.18.190) 29.614 ms 9 ae-62-62.ebr2.sanjose1.level3.net (4.69.134.209) 29.598 ms 22.253 ms ae-72-72.ebr2.SanJose1.Level3.net (4.69.134.213) 34.313 ms 10 ae-1-6.bar2.sanfrancisco1.level3.net (4.69.140.153) 22.176 ms 22.859 ms 27.192 ms 11 ae-0-11.bar1.sanfrancisco1.level3.net (4.69.140.145) 27.140 ms 25.919 ms 25.114 ms 12 clearwire-c.bar1.sanfrancisco1.level3.net (4.53.132.14) 26.566 ms 26.525 ms 26.465 ms 13 71.22.8.254 (71.22.8.254) 24.857 ms 26.655 ms 26.201 ms 14 71.22.8.162 (71.22.8.162) 15.488 ms 17.219 ms 17.212 ms 15 50-8-128-1.sfo.clearwire-wmx.net (50.8.128.1) 17.194 ms 11.126 ms 11.075 ms Clear's new WiMax routers do not allow you to bridge or use your public IP address directly. They force the router to NAT. However, you can turn off all firewalling and do a one-to-one NAT to a single device (as I've done to my Linux router). It does pass protocols such as 41 (for IPv6 tunneling over IPv4). You can get a "static" IP on the CPE router by paying more (something in the range of $5 or $10/month). I've not had my non-static IP change yet (Using dynamic dns to remote back in). Think of Clear's tech support as lower than your home DSL provider's support levels. About all they can do is have you reboot your computer and reset your CPE router. Examples of less-than-helpful tech support: "If you log into your router - we don't support that and you cannot make any changes" (this is requires for the above disabling of their firewall and one-to-one NAT setup which is totally unsupported - or just to see the exact signal strength or get the MAC address to report to them so you don't have to move the device). "Our router is not grounded, so you must plug it directly into the [mains] otherwise it builds up static" (in response that it is never a power loss that has caused me problems, as I have it on a surge-protecting UPS with my home Linux router which never has a problem). Having to manually aim your CPE router means you'd want to have a professional do it and make sure it is not going to move. There are a number of places that sell outside mounting/housing equipment so you can aim and get the best signal. This is a low-end solution for low-end costs (think MetroPCS/Cricket from the pay-as-you-go cell phone market - except with a 2 year contract). I think it's a good backup solution for the SOHO because sometimes DSL/Cable does have issues, but I would not use it for a business primary solution. I'd been a relatively happy customer of Clear for the last year for the price ($29/mo) I pay. My experience of the last week is not so happy. I have a direct line of sight to their tower from my two story house (once you get through one sheet of drywall and the roof). Their tower is less than a mile away and I have 4-5 bars of service. Suddenly my service was horrible this last week, with constant loss of Internet access. Ping monitoring to their default gateway will continue to work, but not beyond. Ping monitoring to their default gateway from co-located hosts doesn't have problems at this time. Resetting CPE router device fixes it, but problems can resume within as little as 20 minutes. Current solution which has worked for the last 24 hours was to use their online map to find the next best tower: I have repositioned the CPE router to point at a different tower and now that tower is the only one my CPE router detects (previously my CPE router could see 3-4 towers as there are a few a few more miles away to the left and right of the tower I was using). Again I get a consistent 4-5 bars with this other tower, but now no more problems. My guess is that there is some sort of malfunction at the other tower. Originally I thought my CPE router was having a problem (which is leased from Clear and they were sending a new one, not to arrive for another 3-4 days), as the problem would not fix itself without resetting the CPE router and was instantly fixed after resetting it. However, as of now I've had 24+ hours without problems so I believe the problem is with the tower or was with Clear's network and not the CPE router (the CPE router had been getting reset 10+ times per day as the household has been having issues the last 7 days, and the only change yesterday was pointing to a new tower and not a power cycle). Check their online maps, service is very spotting with many holes. My residence shows as not getting service (showing signal is blocked 2-3 blocks away by other buildings), but as I have a two story and have it mounted at the top of my house it has a clear line of sight. Look at their support pages on how they say to move it all around your house to find the best room to install it in for signal. According to their support site, don't install it too close to anything (Wifi, or any other electrical device) as that will block service as well (this is not true as far as I have observed while monitoring signal strength with numbers from the CPE device). I'd never consider using their mobile service as it would be so unreliable as to where you could get service. They tried to get my local PD to switch from AT&T's wireless data service in the cars to Clear a few years back and the trails were so bad and spotty. I'd never consider using their VoIP service (even if it was free) as their latency jitter just doesn't cut it. Jason Roysdon > Since I'm not with Clearwire anymore (end of contract) I can say that > there are people in the core networking that do follow and respond the > this list. > > I can say that their backbone is solid and the people there really do > care about the network. > > If you have serious a backbone issue with Clearwire a message on this > list will result in a response.. > > -- > Joe Hamelin, W7COM, Tulalip, WA, 360-474-7474

1 0

Re: Future of the IPv6 CPE survey on RIPE Labs - Your Input Needed
by Scott Weeks 27 Jan '11

27 Jan '11

On 1/27/11 10:40 AM, Scott Weeks wrote: > --- frnkblk(a)iname.com wrote: > From: "Frank Bulk" <frnkblk(a)iname.com> > > Have you looked at D-Link's DIR-825? It has most of the things you're > ------------------------------------------- > > > > Ewww, yuck! "...this router utilizes dual active firewalls (SPI and NAT) to prevent potential attacks from across the Internet." > > ftp://ftp.dlink.com/Gateway/dir825/Manual/dir825_manual_110.zip --- joelja(a)bogus.com wrote: From: Joel Jaeggli <joelja(a)bogus.com> unlike a simpler device you can actually turn that off. in fact it has more knobs than you've likely seen in a consumer cpe... ----------------------------------- I just meant they were calling NAT an "active firewall" in the manual. I need a bath. I feel dirty now... >:-) scott

1 0

SP Sizing math?
by Thomas Magill 27 Jan '11

27 Jan '11

So keep in mind I don't have an SP background. I have a client who has this idea of getting into the SP business and I'm trying to help them realize, realistically, what kind of undertaking this will be. For a residential SP, what is a good reference for general guidelines on sizing. Such as, for 6,000 residential users, how bandwidth upstream would be required to be fairly assured your phone will not be blowing up with complaints? What amount of oversubscription is acceptable at what amount of bandwidth? Are customers just sold if you tell them 5 meg down, even though you have a 20:1 oversubscription? I have read in NANOG archives 100Mbps/1,000 users for a school campus environment; would residential be equivalent? Any input would be greatly appreciated. Thomas Magill Network Engineer Office: (858) 909-3777 Cell: (858) 869-9685 tmagill(a)providecommerce.com<mailto:tmagill@providecommerce.com> provide-commerce 4840 Eastgate Mall San Diego, CA 92121 ProFlowers<http://www.proflowers.com/> | redENVELOPE<http://www.redenvelope.com/> | Cherry Moon Farms<http://www.cherrymoonfarms.com/> | Shari's Berries<http://www.berries.com/>

1 0