April 2011 - Test - lists.nanog.org

MySQL Madness
by Joe Renwick 29 Apr '11

29 Apr '11

So I am seeing some interesting behavior of TCP during a MySQL connect over the network. The following packets capture shows the packet flow: asa1# sh capture debug-in 8 packets captured 1: 21:49:13.461554 8.25.42.100.32929 > 74.81.76.195.3306: S 4107544000:4107544000(0) win 65535 <mss 1380,nop,wscale 3,sackOK,timestamp 2065216038 0> 2: 21:49:13.462073 74.81.76.195.3306 > 8.25.42.100.32929: S 2601320299:2601320299(0) ack 4107544001 win 5792 <mss 1460,sackOK,timestamp 2581054349 2065216038,nop,wscale 7> 3: 21:49:13.462210 74.81.76.195.3306 > 8.25.42.100.32929: P 2601320300:2601320363(63) ack 4107544001 win 46 <nop,nop,timestamp 2581054349 2065216038> 4: 21:49:13.519061 8.25.42.100.32929 > 74.81.76.195.3306: . ack 2601320300 win 8208 <nop,nop,timestamp 2065216096 2581054349> 5: 21:49:14.135384 8.25.42.100.32929 > 74.81.76.195.3306: P 4107544001:4107544003(2) ack 2601320300 win 8208 <nop,nop,timestamp 2065216712 2581054349> 6: 21:49:14.135521 74.81.76.195.3306 > 8.25.42.100.32929: . ack 4107544003 win 46 <nop,nop,timestamp 2581055023 2065216712> 7: 21:49:16.461981 74.81.76.195.3306 > 8.25.42.100.32929: P 2601320300:2601320363(63) ack 4107544003 win 46 <nop,nop,timestamp 2581057349 2065216712> 8: 21:49:16.618147 8.25.42.100.32929 > 74.81.76.195.3306: . ack 2601320363 win 8208 <nop,nop,timestamp 2065219195 2581057349> 8 packets shown Packet "1" is Syn from MySQL client to Server Packet "2" is Syn/Ack from Server Packet "3" is a TCP Push! ??? HERE IS WHERE I AM CONFUSED Packet "4" is the Ack from the client completing the 3-way hand shake. My firewall is dropping packet "3" as it is not happy there is a push going on before it sees the completed handshake. Anybody run across this? Is the a MySQL option for a faster connection? Finally the firewall is a Cisco ASA and the "TCP Normalization" feature is dropping the packet. Specifically is the "tcp-3whs-failed" rule that is being offended. I cannot seem to figure out a way to turn this off? Thanks for the help. Cheers, -- Joe Renwick IP Network Consultant, CCIE #16465 GO NETFORWARD! Direct: 619-800-2055, Emergency Support: 800-719-0504 Is your network moving you forward?

4 3

Root Zone DNSSEC KSK Ceremony 5
by Joe Abley 28 Apr '11

28 Apr '11

KSK CEREMONY 5 The fifth KSK ceremony for the root zone will take place in Culpeper, VA, USA on Wednesday 2011-05-11. The ceremony is scheduled to begin at 1300 local time (1700 UTC) and is expected to end by 1600 local time (2000 UTC). Video from Ceremony 5 will be recorded for audit purposes. Video and associated audit materials will be published 1 to 2 weeks after the ceremony, and will be available as usual by following the "KSK Ceremony Materials" link at <https://www.iana.org/dnssec/>. ICANN will operate a separate camera whose video will not be retained for audit purposes, but which will instead be streamed live in order to provide remote observers an opportunity to watch the ceremony. The live stream will be provided on a best-effort basis. The live video stream will be available at <http://dns.icann.org/ksk/stream/>. Ceremony 5 will include processing of a Key Signing Request (KSR) generated by VeriSign, and the resulting Signed Key Response (SKR) will contain signatures for Q3 2011. CONTACT INFORMATION We'd like to hear from you. If you have feedback for us, please send it to rootsign(a)icann.org.

2 1

New IPv6 survey released on labs.ripe.net
by Marco Hogewoning 27 Apr '11

27 Apr '11

Hi There, We just released a new version of the IPv6 CPE survey. After lots of feedback on the previous editions, we are now doing a "proper" survey. Based on the responses we receive in this survey we will be able to compile a new edition of our matrix and provide some more statistical background on what is happening in the market. Remember we are totally depending on your feedback to continue this work. The more responses we receive, the easier it gets for us to provide regular updates on which CPE are available on the market and how good they are. So if you have an IPv6 capable router or modem in your house, or you are busy testing them. Please take the time to fill out the survey and help other people to find the device that fits their need. Please see https://labs.ripe.net/Members/marco/ipv6-cpe-survey-please-participate for further details and a link to the survey. Thanks, MarcoH

6 5

Re: riverbed steelhead
by Elijah Savage 27 Apr '11

27 Apr '11

>Anyone out there have experience with Riverbed Steelhead products? >Do they improve TCP performance over WAN links? is it worth the price? >mike ----------------------- James and Eric have done outstanding contributing here. I just wanted to add a tad bit of information leaving out the name brands. Our environment has a large number of these deployed and we have seen business and end user acceptance. From a business perspective, it could be a cost deferral tool within your toolset. Meaning if you are in an environment, which is sensitive to MRC (monthly recurring cost), implementing this technology can help you defer this cost. For example, I had a remote site that was at 95% of a full ds3 in capacity 6 hours of an 8-hour business day, after implementing this technology I was amazed at what we found. This sites utilization was reduced to 40% capacity max, not to mention the reduction we observed at the datacenter headend. We were preparing to increase capacity at this site, that was going to require swapping the WAN device as well as an increase in the MRC for this site and ongoing operational expense. Introduction of WAN optimization was significantly lower in these categories versus the upgrades. On the end user side due to the physical location/latency of this site a few applications was prone to suffer, the developers agreed to fix this would possibly require rewriting of the apps. Nothing more than the introduction of this technology was done and the support calls into the support center went from 100's per month to zero for a few of these applications. One thing that was important to me WAS MAPI encryption and the fact it was reversed engineered. Meaning if Microsoft at some point changed the way MAPI worked in a patch or upgrade you would end up with broken MAPI support and possibly a long runway to fixing it. The other company from my understanding (do not quote me on this YET) is collaborating and possibly working with Microsoft to license such support. I don't think you could go wrong with either brand/company but understanding your environments traffic patterns and its application usage would go a long way in guiding you towards the product for your environment. Good luck

1 0

gmail dropping mesages
by Bill Blackford 27 Apr '11

27 Apr '11

I've recently observed gmail dropping messages or not forwarding all messages/posts from the nanog list. This is rather annoying. Has anyone else experienced this? Does anyone have any insight as to why? Thanks, -b -- Bill Blackford Network Engineer Logged into reality and abusing my sudo privileges.....

10 13

Barracuda Networks is at it again: Any Suggestions as to an Alternative?
by John Palmer (NANOG Acct) 27 Apr '11

27 Apr '11

OK, its been a year since my Barracuda subscription expired. The unit still stops some spam. I figured that I would go and see what they would do if I tried to renew my subscription EXACTLY one year after it expired. Would their renewal website say "Oh, you are at your anniversary date", and renew me for a year? No such luck: They want me to PAY FOR AN ENTIRE YEAR for which I did NOT receive service and then for the current (upcoming year). Sorry - I don't allow myself to be ripped off like that. Sorry Barracuda - you get no money from me and I'll tell everyone I know about this policy of yours. I posted an article about this unscrupulous practice on my blog last year at http://www.john-palmer.net/wordpress/?p=46 My question is - does anyone have any suggestions for another e-mail appliance like the Barracuda Spam Firewall that doesn't try to charge their customers for time not used. I should be able to shut off the unit for a year or whatever and simply renew from the point that I re-activate the unit instead of having to pay for back-years that I didn't use. Thanks

28 29

SIXXS contact
by Andrew Kirch 27 Apr '11

27 Apr '11

would someone at SIXXS please contact me off-list regarding an account issue?

11 17

6PE command for IOS and XR
by Vikas Sharma 27 Apr '11

27 Apr '11

Hi, I was trying command "mpls ipv6 source-interface <>" on SRE3 code, look like there is no command like that on SRE. This command is important for locally generated packets. Have someone used this command? Also what is the command on XR 4.0.1 to achieve the same? Regards, Vikas

2 2

IPv6 Prefix announcing
by Nick Olsen 26 Apr '11

26 Apr '11

Greetings NANOG, I've always been under the impression its best practice to only announce prefixes of a /24 and above when it comes to IPv4 and BGP. I was wondering if something similar had been agreed upon regarding IPv6. And if That's the case, What's the magic number? /32? /48? /64? Nick Olsen Network Operations (855) FLSPEED x106

9 8

Multi-site, multi-path to Internet - customer question - off topic ?
by Steve Benoit 26 Apr '11

26 Apr '11

Good day I have a question from a customer point of view. We currently have a multi-site WAN with all our Internet connectivity at one site consisting of 3 ISP type connections, full BGP, including our own ASN with IPv4 and v6 addressing space. All up and running. I am now looking to add Internet connectivity from a second site on our WAN for fail over in the event of a site 1 failure. My initial thoughts are towards another full BGP session at site 2, and perhaps something like Cisco's Global Site Selector, or F5's GTM to direct traffic. I'm thinking of phasing this in over a couple of years since the "server" folks will not have full hot fail-over at that site for that period. Of course, in a failure situation, the site will be expected to be live and operational immediately. Any suggestions on where I should start looking ? Any good white papers or case studies you have seen? And technologies we should look at or stay away from ? Thanks Steve Benoit

1 0