February 2011 - Test - lists.nanog.org

Re: quietly....
by Daniel Hagerty 02 Feb '11

02 Feb '11

Matt Addison <matt.addison(a)lists.evilgeni.us> writes: > I'll admit right now that I don't know nearly enough about the IETF process, > but it looks like there have been 2 separate attempts at this: > draft-lee-dnsop-resolver-wellknown-ipv6addr - ID, expired > draft-ohta-preconfigured-dns - ID, expired > > Until one of those is revived (or a similar draft is written), and makes it > through IETF to reach RFC status, and there are assigned addresses from > IANA, there are no well known addresses for anyone hardcode. Several microsoft OSes will automatically use fec0:0:0:ffff::1, 2, and 3 if there is a nameserver there.

1 0

Re: quietly....
by Tim Franklin 02 Feb '11

02 Feb '11

> So, when I take my laptop from Home to work, to the airport, to some > random cyber cafe I should have to manually alter my DNS servers > assuming I can find someone in the location who can tell me what they > are ?? Or let me guess, I should hardcode some public DNS servers > which I can hopefully reach from where I am, hopefully is not down or > having issues and hopefully I don't have poor latency to? You could always run your own recursive server on your laptop, instead of a stub, and remove your dependancy on anyone but the roots. *ducks* Regards, Tim.

2 1

Fwd: Connectivity status for Egypt (update from Egypt)
by Marshall Eubanks 02 Feb '11

02 Feb '11

Begin forwarded message: > From: "Ahmed Maged (amaged)" <amaged(a)cisco.com> > Date: February 2, 2011 11:03:23 AM EST > To: <tme(a)americafree.tv> > Subject: FW: Connectivity status for Egypt (update from Egypt) > > Please forward to nanog. > > -----Original Message----- > From: nanog-owner(a)nanog.org [mailto:nanog-owner@nanog.org] > Sent: Wednesday, February 02, 2011 04:50 PM W. Europe Standard Time > To: Ahmed Maged (amaged) > Subject: Re: Connectivity status for Egypt (update from Egypt) > > You are not allowed to post to this mailing list, and your message has > been automatically rejected. If you think that your messages are > being rejected in error, contact the mailing list owner at > nanog-owner(a)nanog.org. > > > > From: "Ahmed Maged (amaged)" <amaged(a)cisco.com> > Date: February 2, 2011 10:51:08 AM EST > To: "Marshall Eubanks" <tme(a)americafree.tv>, "Jim Cowie" <cowie(a)renesys.com> > Cc: <nanog(a)nanog.org> > Subject: Re: Connectivity status for Egypt (update from Egypt) > > > Hi Guys, > > I read most of the thread and I'll try to confirm what I can. > > Obviously, we are back online and yes it was decided by the government to > take the country offline. > > They first started blocking twitter and rate limited/blocked facebook but > later they just decided, everything must go. > > Two days ago, Google and Twitter came up with a way to help people tweet > using land lines. > > Some international WAN links are functioning and that's because of how the > switch was killed. International links go to the same place in either Cairo > or Alexandria (Telco Exchange). > > We do have a couple of IXs, but there is just no real interesting local > traffic, everyone wants facebook and twitter. Which is all international > > Everyone just stayed home because of Army imposed Curfew so the internet and > business was just on PAUSE and still is. > > Mobile phones were also off for two days but later they were brought back. > > The reason why they decided to do that is because the whole protest was > organized on Facebook initially, people agreed to go to Tahrir square > (liberation square) downtown together and a lot followed the groups > invitation. > > Later on, people joined despite all the attempts to block the internet and > communication. > > Some consider this act as a crime because they cut the tongues of people > this way and the government sees it as a step to stop the demonstrations. > > Huge businesses will be affected, one small example is international call > centers. > > You will all see clearly that we have bad bad aggregation, if you can > analyze this and write a note about it, I'll be able to pass it to the right > people when we get life back in order. > > In case things go bad again, we will really need international dial up so if > you can help setting this up, it will be appreciated. > > I have to go now to stand in front of my building to protect it (as > everyone) because thugs and thieves were let loose on the streets (by the > government). > > Regards, > Ahmed Maged > > > From: Marshall Eubanks <tme(a)americafree.tv> > > Date: Wed, 2 Feb 2011 08:25:42 -0500 > > To: Jim Cowie <cowie(a)renesys.com> > > Cc: <nanog(a)nanog.org> > > Subject: Re: Connectivity status for Egypt > > > > > > On Feb 2, 2011, at 6:23 AM, Jim Cowie wrote: > > > >> > >> > >> On Wed, Feb 2, 2011 at 6:17 AM, Teo Ruiz <teoruiz(a)gmail.com> wrote: > >> On Tue, Feb 1, 2011 at 21:30, Marshall Eubanks <tme(a)americafree.tv> wrote: > >>> On Jan 31, 2011, at 5:14 PM, Marshall Eubanks wrote: > >>> > >>>> As an update, BGP for Noor.net has been withdrawn. Even the Egyptian stock > >>>> exchange - egyptse.com - now appears to be off the Internet. > >>> > >>> I have been told that the Egyptian Prime Minister has publicly announced > >>> that the Internet would be restored soon, but at present neither my > >> > >> Looks like it's coming back: http://stat.ripe.net/egypt > >> > >> ~2500 prefixes being announced now. > >> -- > >> teo - http://www.teoruiz.com > >> > >> "Res publica non dominetur" > >> > >> Yes, confirmed from 09:29 UTC. Basically all major providers are back, full > >> status quo ante (modulo reagg), major sites are up. > >> > >> http://www.renesys.com/blog/2011/02/egypt-returns-to-the-internet.shtml > > > > It's not just BGP - DNS (based on the samples I have been testing) seems to be > > fully back too. > > > > Regards > > Marshall > > > >> > >> Good thoughts go out to the guys in the EG NOCs this morning. Nanog wants > >> to hear your war stories some day over a cup of tea. > >> > >> --jim > >> > > > > > > > > >

1 0

netflow analysis for jitter and packet loss?
by Shacolby Jackson 02 Feb '11

02 Feb '11

What tools are people most happy with? Specifically I'm hoping to mirror a port and later see if I can detect any inbound jitter or possibly even out of order udp datagrams. At first glance it doesn't look like ntop or plixer can provide that level of detail. Any suggestions? -shac

4 3

RE: Connectivity to Brazil
by Matt Disuko 02 Feb '11

02 Feb '11

Algar looking Glass: http://lg.ctbc.com.br/lg/ I found the response from the GC engineer. It won't mean much cut&pasted verbatim and out of context, so I'll just summarize. Basically, I was seeing vastly different response times to given hosts in the same subnet on CTBC's network. My source ip was the same. Traceroute revealed to me the packets taking different paths, after hitting a particular GLBX router. The GC engineer said CTBC is a customer that hangs off of this particular router, and that traffic was hitting an interface and hair-pinning back out to the customer's segment. He pointed to possible congestion on CTBCs switching fabric as the cause for the varied response times (conceivable) and different routes (um...ok maybe some kind of load-balancing at play). I managed to call CTBC (Algar) and confirmed they were experiencing congestion issues and they had a scheduled circuit capacity upgrade with GLBX in a few weeks. As a network admin, i find it sometimes sadly humorous how we can poke and prod at a problem, go through various carrier support channels and scratch our heads for hours/days when all it would normally take is a RO userid on a couple routers in the path to figure things out. that's not too much to ask, right? ;) -matt > CC: vinny(a)abellohome.net; nanog(a)nanog.org > From: the76posse(a)gmail.com > Subject: Re: Connectivity to Brazil > Date: Wed, 2 Feb 2011 08:07:14 -0500 > To: gourmetcisco(a)hotmail.com > > That thread detail would be very interesting to me. Thanks for the heads up. > > Sent from my iPhone > > On Feb 2, 2011, at 7:14 AM, Matt Disuko <gourmetcisco(a)hotmail.com> wrote: > > > Very interesting. I have had similar issues with connectivity to my Brazil office, and oddly enough it involved GBLX and CTBC (now called Algar Telecom). I also vastly divergent paths to a couple hosts in the same subnet. I ended up communicating with GBLX via email (who were actually really great in corresponding with me)...the engineer pointed to some sort of link capacity issue...i'll dig up the thread... > > > > > Date: Wed, 2 Feb 2011 01:21:09 -0500 > > > From: vinny(a)abellohome.net > > > Subject: Re: Connectivity to Brazil > > > To: the76posse(a)gmail.com > > > CC: nanog(a)nanog.org > > > > > > We saw similar issues with IKE through Global Crossing (as odd as that sounds) out of the NYC market at the same time. We routed around them and problem solved. Still scratching our heads on that one... In my experiences, GLBX has numerous odd issues to the point where it's become a bad joke anytime something breaks with connectivity... we blame them. It's kind of not funny though because it's almost always true. Taking them out of the equation usually fixes the problem. One of our customers who is frequently affected by GBLX problems jumps to the (often correct) conclusion that they are causing problems. :-/ > > > > > > -Vinny > > > > > > On Feb 1, 2011, at 3:57 PM, Steve Danelli wrote: > > > > > > > Thanks for the response. > > > > > > > > Ike had worked great up until Monday. The provider did a local test and our box saw the Ike packets so it appears to lie somewhere upstream. (GLBX may be a good guess) > > > > > > > > Also - the paths are stable and we are sourcing from the same ip - very strange behaivor. Hope someone from GLBX or CTBC (or someone who had experienced an issue like this) can assist > > > > > > > > > > > > Thanks to all for their feedback so far. > > > > > > > > SD > > > > > > > > On Feb 1, 2011, at 3:19 PM, Valdis.Kletnieks(a)vt.edu wrote: > > > > > > > >> On Tue, 01 Feb 2011 08:54:47 EST, Steve Danelli said: > > > >> > > > >>> Some carrier, somewhere between us and the service provider is selectively > > > >>> dropping the IKE packets originating from our VPN gateway and destined for > > > >>> our Brazil gateway. Other traffic is able to pass, as are the IKE packets coming > > > >>> back from Brazil to us. This is effectively preventing us from establishing > > > >>> the IPSEC tunnel between our gateways. > > > >> > > > >> Has IKE been known to work to that location before? Or is this something new? > > > >> My first guess is some chucklehead banana-eater at the service provider either > > > >> fat-fingered the firewall config, or semi-intentionally blocked it because it > > > >> was "traffic on a protocol/port number they didn't understand so it must be > > > >> evil". > > > >> > > > >>> Also something else is awry, for two given hosts on the same subnet (x.y.z.52 > > > >>> and x.y.z.53), they take two wildly divergent paths: > > > >> > > > >>> Anyone have any insight on to what may be occurring? > > > >> > > > >> The paths appear to diverge at 67.16.142.238. I wonder if that's gear trying > > > >> to do some load-balancing across 2 paths, and it's using the source IP as a > > > >> major part of the selector function ("route to round-robin interface source-IP > > > >> mod N" or similar?). > > > >> > > > >> The other possibility is your two traceroutes happened to catch a routing flap in > > > >> progress (obviously not the case if the two routes are remaining stable). > > > >> > > > >> Sorry I can't be more helpful than that... > > > > > > > > > >

1 0

Connectivity status for Egypt
by Danny O'Brien 02 Feb '11

02 Feb '11

Around 2236 UCT, we lost all Internet connectivity with our contacts in Egypt, and I'm hearing reports of (in declining order of confirmability): 1) Internet connectivity loss on major (broadband) ISPs 2) No SMS 4) Intermittent connectivity with smaller (dialup?) ISPs 5) No mobile service in major cities -- Cairo, Alexandria The working assumption here is that the Egyptian government has made the decision to shut down all external, and perhaps internal electronic communication as a reaction to the ongoing protests in that country. If anyone can provide more details as to what they're seeing, the extent, plus times and dates, it would be very useful. In moments like this there are often many unconfirmed rumors: I'm seeking concrete reliable confirmation which I can pass onto the press and those working to bring some communications back up (if you have a ham radio license, there is some very early work to provide emergency connectivity. Info at: http://pastebin.com/fHHBqZ7Q ) Thank you, -- dobrien(a)cpj.org Danny O'Brien, Committee to Protect Journalists gpg key: http://www.spesh.com/danny/crypto/dannyobrien-key20091106.txt

37 63

Bovespa
by Philip Lavine 02 Feb '11

02 Feb '11

1. Does anyone know where the Bovespa is located and if colocation is a possibility at that datacenter/s. 2. What is a good Internet (DS3? or ethernet) carrier in Sao Paolo thank you Philip

3 2

Re: quietly....
by Brandon Butterworth 02 Feb '11

02 Feb '11

> Example: if you give administrators the option of putting a router > address in a DHCP option, they will do so and some fraction of the > time, this will be the wrong address and things don't work. They cause themselves a problem then they fix it. > If you let routers announce their presence, then it's virtually > impossible that something goes wrong s/impossible/certain > because routers know who they are It doesn't mean they're right. If I choose DHCP I've made the choice to define how this network works. I then want it to carry on like that, not depend on others not screwing up too. > A clear win. Of course it does mean that people <gasp> have to > learn something new when adopting IPv6. It means all administrators now have to guard against trivial errors by all end users. Lot larger fail surface It's not about dislike of new, it's dislike of pointless risk brandon

1 0

DHCP server fail-over and accounting
by Joe 02 Feb '11

02 Feb '11

hi, we plan to implement DHCP server farm in our network. Currently , there are there problems burning my head. could anybody do some help? 1. How to set up DHCP server farm with high availability? It's required to set up DHCP server with 99.999% available. To our experience, this needs to set up DHCP server on two sites and syncronize their content in real time. Beside this , we hope there should be as less modification as possible on edge router when one DHCP server is down. should anycast architecture helpful ? or should we just set up two dhcp servers on two sites and sync. with ISC DHCPD? is there any other method for fail-over and high availability? 2. How to set up accouting and authentication with DHCP? Regulation and content based pricing is demanded. So, we plan to authenticate customer and accouting on their usage. In previous list post, someone said Juniper could do radius before DHCP. Does this mean Juniper could authenticate user with radius (username/password) before DHCP ? Is there anyway to collect user traffic under DHCP ? 3. Someone said PPPOE is not good for customer looking for long time online , DHCP is an good option. But, to my understanding DHCP is just good for those looking for easy-transfer to IPv6 , because pppoe could also make user on line as long as possible. Is there any reference on DHCP server consideration on 4-to-6 migration? Joe

3 2

Re: Future of the IPv6 CPE survey on RIPE Labs - Your Input Needed
by Chris Conn 02 Feb '11

02 Feb '11

> On 27/01/11 08:17 -0600, Jack Bates wrote: >> On 1/27/2011 12:57 AM, Frank Bulk wrote: >>> Have you looked at D-Link's DIR-825? It has most of the things you're >>> looking for. The DIR-655 is a more affordable option. >>> >> Haven't had the chance to look at that one. Will check it out. >> >>> In regards to (2), is it even possible to do DHCPv6-PD on with a SLAAC WAN? >>> >> It had better be, as IOS 12.2 SRE only supports SLAAC + DHCPv6-PD. >> Most of the Cisco documentation I've seen, says that is their >> beautiful layout. No more proxyarp/nd. Instead, assign a /64 to each >> subinterface, perform SLAAC, then hand out prefixes via DHCPv6-PD if >> someone needs a prefix. > > The DIR-825(Rev B) running firmware 2.05NA does. From the status screen: > > IPv6 Connection Type : Autoconfiguration (SLAAC/DHCPv6) > Network Status : Connected > > WAN IPv6 Address : 2610:b8:0:234:218:e7ff:fef8:66dc/64 > IPv6 Default Gateway : fe80::c67d:4fff:fed6:5401 > LAN IPv6 Address : 2610:b8:100f:1:218:e7ff:fef8:66db/64 > LAN IPv6 Link-Local Address : fe80::218:e7ff:fef8:66db/64 > Primary IPv6 DNS Server : 2610:b8:0:3:215:c5ff:fef3:f9c8 > Secondary IPv6 DNS Server : 2610:b8:0:3:215:c5ff:feee:9448 > DHCP-PD : Enabled > IPv6 network assigned > by DHCP-PD : 2610:b8:100f::/48 > > The latest firmware has fairly good support, but is lacking configurable v6 > firewall settings. I haven't done any firewall testing yet, but I'd imagine > all incoming v6 connections are blocked. > > The Emulator hasn't been updated yet to reflect the options in the new > firmware, but this should give you an idea of what the configuration looks > like: > > http://www.support.dlink.com/emulators/dir825_revB/203NA/adv_link_local.html > > The DIR-615 should have similar support, but I haven't upgraded it yet. Hello, As for the DIR-615, it should, but it doesn't...At least, the E3/E4 revisions I had. I contacted D-LINK support and was able to get a beta build that seems promising. But DHCP-PD over PPPoE works relatively well, minus a couple of little "features". I am hoping to have that hammered out soon, as the 615 is a capable little sub-50$ home CPE. But D-Link engineering seems receptive to my observations. I have to check the state of the firewalling in it too ;) Chris

4 5