April 2011 - Test - lists.nanog.org

best of breed nowadays in DPI space?
by Rogelio 26 Apr '11

26 Apr '11

I have been recently researching DPI for several projects I am working on, and I recently came across this "shoot out" between several vendors in 2009 http://www.internetevolution.com/document.asp?doc_id=178633&page_number=1 Procera (at that time) emerged "the winner" for its ability to process P2P traffic (out of 15 participants), and I was wondering what new players, features, or products others might point me to. I am looking for something that does reporting *and* DPI in a distributed environment. That means, I might have several DPI gateways around the country that need to roll up their reporting into one main one. (I also have some other requirements as far as measuring churn reduction and cellular offloading, but I'm not sure that any of the DPI solutions can really do that well.) If anyone has any good contacts in this space, please let me know and I might discuss with them in more detail these opportunities that I'm looking for. -- Also on LinkedIn? Feel free to connect if you too are an open networker: scubacuda(a)gmail.com

1 3

Ongoing ASN and IP Space Hijacks: Update (TimeWarner/Level3/Tiscali)
by Ronald F. Guilmette 25 Apr '11

25 Apr '11

Eleven days ago, I reported here the following highly probable hijacks: AS8143 AS29987 AS11756 AS47024 AS27906 198.23.32.0/20 - NET-198-23-32-0-1 198.57.64.0/20 - NET-198-57-64-0-1 199.88.32.0/20 - NET-199-88-32-0-1 199.192.16.0/20 - NET-199-192-16-0-1 199.196.192.0/19 - NET-199-196-192-0-1 200.107.216.0/21 - GT-AGSA1-LACNIC 204.147.240.0/20 - NET-204-147-240-0-1 207.22.224.0/19 - (NET-207-22-192-0-1 Routing to a few of the above IP blocks has now been terminated, however at present I find that several of them are still very much alive and well, in particular: 199.88.32.0/20 - NET-199-88-32-0-1 199.196.192.0/19 - NET-199-196-192-0-1 200.107.216.0/21 - GT-AGSA1-LACNIC 204.147.240.0/20 - NET-204-147-240-0-1 As I previously mentioned, these are being used by high-end snowshoe spamming operations. Simple question: Does anybody give a damn? Regards, rfg P.S. Routing for the still-live hijacked blocks is as follows: 199.88.32.0/20 hijacked via AS29987 (hijacked ASN) via AS3257 (tiscali.net) 199.196.192.0/19 hijacked via AS8143 (hijacked ASN) via AS19844 (gorack.com) via AS4323/TimeWarner & AS3356/Level3 200.107.216.0/21 hijacked via AS8143 (hijacked ASN) via AS19844 (gorack.com) via AS4323/TimeWarner & AS3356/Level3 204.147.240.0/20 hijacked via AS47024 (hijacked ASN) via AS3257 (tiscali.net) P.P.S. As I also mentioned previously, GoRack seems to have some non-trivial connection to another South Florida company, Joytel Wireless, which itself was caught red-handed performing a sizable number of rather brazen IP block hijackings back in October: http://mailman.nanog.org/pipermail/nanog/2010-October/025997.html Given that Joytel/GoRack are clearly not at all bashful about what they are up to, it seems to me that it is incumbant upon TimeWarner and Level3 to take some action here. Otherwise, these hijackings are obviously just going to go on and on and on. As for Tiscali, and its obvious part in all this... well... if anyone is aware of any concious entity @ Tiscali who might actually give a damn about anything other than short-term profits, please do let me know. The people I've talked to, and the evidence above all indicates that Tiscali is, quite simply, ready, willing, and able to whore itself out to just about anybody.

2 2

riverbed steelhead
by harbor235 25 Apr '11

25 Apr '11

Anyone out there have experience with Riverbed Steelhead products? Do they improve TCP performance over WAN links? is it worth the price? mike

8 8

Outage Management/Log Book
by Payam Poursaied 25 Apr '11

25 Apr '11

Hi all May I have your recommendation regarding any outage management software and NOC log book(preferably open source) . I want to get fresh ideas about available software in this area. The below scenario may explain what I am looking for: One of the sites gets down, monitoring team would log it. Technical staffs follow it, they find there is something wrong in the site. Someone gets to the site and find there is a power failure. Make it correct. Monitoring team again see that site UP and update their log book put the recovery time and the reason (i.e. power failure) One of the simplest report from this system would be downtime per site/per reason. The ability to record group outage - manually or automatically based on network topology - (i.e. failure of a core router in a city which would be caused several sites failure) would be also useful. Best Regards Payam Poursaied

4 4

"supporting IPv6" <--- what it means exactly?
by Rogelio 24 Apr '11

24 Apr '11

Is there any clear understanding of what "supporting IPv6" means? I recently was told by a vendor that they "supported IPv6", and then when I went to go configure an IPv6 address, it was, of course, IPv4. I asked how they supported that, and they said that they "supported it" because they could "pass IPv6" traffic. Well...duh!

9 9

Anyone still maintaining altdb.net?
by Bret Palsson 24 Apr '11

24 Apr '11

I submitted my objects April 11. the mtrner object needs to be created by the db-admin. I realize this is a volunteer thing. Could I help out or could the people that are helping out look at adding my record? I need to setup some peering relationships. I'd prefer to support open communities rather than paying and am willing to help out if need be. Thanks, Bret Below are the objects that were submitted: mntner: MAINT-JIVE descr: Jive Communications, Inc. admin-c: BEP7-ARIN tech-c: BEP7-ARIN upd-to: routing(a)getjive.com mnt-nfy: routing(a)getjive.com auth: CRYPT-PW jiCdjGQviTmYo mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB aut-num: AS6643 as-name: JIVE descr: Jive Communications, Inc. admin-c: BEP7-ARIN tech-c: BEP7-ARIN mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB as-set: AS-JIVE descr: Jive Communications, Inc. admin-c: BEP7-ARIN tech-c: BEP7-ARIN mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB route: 199.36.248.0/24 descr: Jive Communications, Inc. origin: AS6643 mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB route: 199.36.249.0/24 descr: Jive Communications, Inc. origin: AS6643 mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB route: 199.36.250.0/24 descr: Jive Communications, Inc. origin: AS6643 mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB route: 199.36.251.0/24 descr: Jive Communications, Inc. origin: AS6643 mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB

9 10

Cisco Firewall ASP Drop
by Joe Renwick 23 Apr '11

23 Apr '11

So my firewall seems to be dropping an oddly large number of packets on the INSIDE interface: asa1(config)# sh int RACK Interface GigabitEthernet0/1 "RACK", is up, line protocol is up Hardware is i82546GB rev03, BW 1000 Mbps Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps) MAC address 0024.14d0.4521, MTU 1500 IP address 64.22.76.97, subnet mask 255.255.255.240 28128158809 packets input, 162066888025865 bytes, 4 no buffer Received 186502879 broadcasts, 0 runts, 0 giants 5089 input errors, 0 CRC, 0 frame, 5089 overrun, 0 ignored, 0 abort 0 L2 decode drops 27235942172 packets output, 18181322825213 bytes, 237 underruns 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops input queue (curr/max packets): hardware (1/33) output queue (curr/max packets): hardware (0/511) Traffic Statistics for "RACK": 144406450470 packets input, 159422361828279 bytes 103754084999 packets output, 16098663171295 bytes 6934615576 packets dropped 1 minute input rate 2056 pkts/sec, 2053935 bytes/sec 1 minute output rate 1678 pkts/sec, 418581 bytes/sec 1 minute drop rate, 270 pkts/sec 5 minute input rate 2519 pkts/sec, 2676286 bytes/sec 5 minute output rate 1887 pkts/sec, 469578 bytes/sec 5 minute drop rate, 283 pkts/sec Looking at ASP drop data they are most coming from "TCP packet SEQ past window (tcp-seq-past-win)": asa1(config)# sh asp drop Frame drop: Invalid TCP Length (invalid-tcp-hdr-length) 31 No valid adjacency (no-adjacency) 88 No route to host (no-route) 1728 Flow is denied by configured rule (acl-drop) 203110 Flow denied due to resource limitation (unable-to-create-flow) 556419 First TCP packet not SYN (tcp-not-syn) 4080584 Bad TCP flags (bad-tcp-flags) 38 Bad option length in TCP (tcp-bad-option-len) 54 TCP data exceeded MSS (tcp-mss-exceeded) 910 TCP failed 3 way handshake (tcp-3whs-failed) 724043 TCP RST/FIN out of order (tcp-rstfin-ooo) 21011574 TCP SEQ in SYN/SYNACK invalid (tcp-seq-syn-diff) 19758 TCP SYNACK on established conn (tcp-synack-ooo) 6 TCP packet SEQ past window (tcp-seq-past-win) 156938345 TCP invalid ACK (tcp-invalid-ack) 15360 TCP ACK in 3 way handshake invalid (tcp-discarded-ooo) 9 TCP Out-of-Order packet buffer full (tcp-buffer-full) 41 TCP Out-of-Order packet buffer timeout (tcp-buffer-timeout) 343 TCP RST/SYN in window (tcp-rst-syn-in-win) 13323 TCP DUP and has been ACKed (tcp-acked) 379384 TCP packet failed PAWS test (tcp-paws-fail) 84304 IP option drop (invalid-ip-option) 12 ICMP Error Inspect no existing conn (inspect-icmp-error-no-existing-conn) 16 DNS Inspect invalid packet (inspect-dns-invalid-pak) 53 DNS Inspect invalid domain label (inspect-dns-invalid-domain-label) 50 DNS Inspect packet too long (inspect-dns-pak-too-long) 5353783 DNS Inspect id not matched (inspect-dns-id-not-matched) 5275 Anybody seen this before? Would be nice to see if there is a command to show offending packets but I cannot seem to find it. Thanks for the time. Cheers, -- Joe Renwick IP Network Consultant, CCIE #16465 GO NETFORWARD! Direct: 619-800-2055, Emergency Support: 800-719-0504 Is your network moving you forward?

1 0

Re: "supporting IPv6" <--- what it means exactly?
by jkrejci＠usinternet.com 23 Apr '11

23 Apr '11

http://www.ipv6ready.org/?page=phase-2-about You can check phase1 as well. There is a pretty good searchable table of certified ipv6 there as well. Feel free to buy these products and even let the vendor know you chose their product over others because of their ipv6 support which was clearly identifiable. ------Original Message------ From: Jared Mauch To: Rogelio Cc: nanog(a)nanog.org Subject: Re: "supporting IPv6" <--- what it means exactly? Sent: Apr 23, 2011 9:14 AM On Apr 23, 2011, at 7:45 AM, Rogelio wrote: > Is there any clear understanding of what "supporting IPv6" means? > > I recently was told by a vendor that they "supported IPv6", and then when I went to go configure an IPv6 address, it was, of course, IPv4. I asked how they supported that, and they said that they "supported it" because they could "pass IPv6" traffic. Look for things like: * IPv6 NDP support (RA, ND, NS, etc) * IPv6 native transport to the control-plane + in-band management * Support for IPv6 on bundled interfaces (with RA, ND, NS working) These are the types of things you need to look for. Some of these items depend on what your use case is. Some places you may want to talk about RA-Guard, others may not matter as much. Same for DHCPv6. I don't need this in my core network, but at the edge it's possibly important depending on the device(s). - Jared Sent via BlackBerry from T-Mobile

1 0

Voice Peering?
by Santino Codispoti 23 Apr '11

23 Apr '11

I know a few years ago some Vo/IP peering points where started. Are they still around today? I am looking for a solution to hand-off outbound voice calls to mobile operators

6 6

BGP Update Report
by cidr-report＠potaroo.net 22 Apr '11

22 Apr '11

BGP Update Report Interval: 14-Apr-11 -to- 21-Apr-11 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS19743 31254 1.4% 4464.9 -- 2 - AS9829 20367 0.9% 20.2 -- BSNL-NIB National Internet Backbone 3 - AS17974 19362 0.9% 10.6 -- TELKOMNET-AS2-AP PT Telekomunikasi Indonesia 4 - AS11492 19099 0.9% 15.0 -- CABLEONE - CABLE ONE, INC. 5 - AS16586 17967 0.8% 58.0 -- CLEARWIRE - Clearwire US LLC 6 - AS32528 17918 0.8% 2239.8 -- ABBOTT Abbot Labs 7 - AS6389 15224 0.7% 4.2 -- BELLSOUTH-NET-BLK - BellSouth.net Inc. 8 - AS35931 13544 0.6% 2257.3 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 9 - AS44609 12775 0.6% 4258.3 -- FNA Fars News Agency Cultural Arts Institute 10 - AS8452 12329 0.6% 14.6 -- TE-AS TE-AS 11 - AS14420 12223 0.6% 18.4 -- CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP 12 - AS45595 11814 0.6% 32.5 -- PKTELECOM-AS-PK Pakistan Telecom Company Limited 13 - AS20115 11671 0.5% 7.4 -- CHARTER-NET-HKY-NC - Charter Communications 14 - AS7491 11527 0.5% 125.3 -- PI-PH-AS-AP PI-PHILIPINES 15 - AS7545 11205 0.5% 8.3 -- TPG-INTERNET-AP TPG Internet Pty Ltd 16 - AS4323 10876 0.5% 4.1 -- TWTC - tw telecom holdings, inc. 17 - AS8151 10834 0.5% 8.6 -- Uninet S.A. de C.V. 18 - AS28573 10339 0.5% 6.6 -- NET Servicos de Comunicao S.A. 19 - AS17224 9487 0.4% 169.4 -- ATT-CERFNET-BLOCK - AT&T Enhanced Network Services 20 - AS27738 9133 0.4% 26.9 -- Ecuadortelecom S.A. TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS19743 31254 1.4% 4464.9 -- 2 - AS44609 12775 0.6% 4258.3 -- FNA Fars News Agency Cultural Arts Institute 3 - AS35931 13544 0.6% 2257.3 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 4 - AS32528 17918 0.8% 2239.8 -- ABBOTT Abbot Labs 5 - AS49600 1519 0.1% 1519.0 -- LASEDA La Seda de Barcelona, S.A 6 - AS52280 1442 0.1% 1442.0 -- INTERNEXA Chile S.A. 7 - AS32949 1434 0.1% 717.0 -- UNITED-REFRIGERATION - UNITED REFRIGERATION INC 8 - AS20132 874 0.0% 437.0 -- DSC-AS - Dundee Securities Corporation 9 - AS3 408 0.0% 735.0 -- SL-NET-ASN SL-NET s.c. 10 - AS50364 403 0.0% 403.0 -- INPRIME InPrime Ltd 11 - AS48349 395 0.0% 395.0 -- SICE-IT-AS JSC "Siberian Interbank Currency Exchange - Information Technologies" 12 - AS52000 761 0.0% 380.5 -- ALDAN-3-AS LTD "ALDAN-3" 13 - AS11843 700 0.0% 350.0 -- BARNES - Barnes Distribution 14 - AS52126 337 0.0% 337.0 -- IXTERM-AS ixTerm Ltd. 15 - AS46167 325 0.0% 325.0 -- LANDSERVICESUSA - Land Services USA, Inc 16 - AS33362 3680 0.2% 306.7 -- WIKTEL-NET - Wikstrom Telephone Company, Incorporated 17 - AS38757 569 0.0% 284.5 -- ICONPLN-ID-AP PT. Indonesia Comnets Plus 18 - AS31662 569 0.0% 284.5 -- KNSURSELVA aurax connecta AG 19 - AS36059 284 0.0% 284.0 -- MEDMANAGEMENT-LLC - MedManagement, LLC 20 - AS45310 267 0.0% 267.0 -- PISHON-SMARTNET-AS-ID SMARTNET - Broadband Internet Service. TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 221.121.96.0/19 9147 0.4% AS7491 -- PI-PH-AS-AP PI-PHILIPINES 2 - 130.36.34.0/24 8943 0.3% AS32528 -- ABBOTT Abbot Labs 3 - 130.36.35.0/24 8943 0.3% AS32528 -- ABBOTT Abbot Labs 4 - 63.211.68.0/22 7754 0.3% AS35931 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 5 - 178.22.72.0/21 6429 0.2% AS44609 -- FNA Fars News Agency Cultural Arts Institute 6 - 178.22.79.0/24 6326 0.2% AS44609 -- FNA Fars News Agency Cultural Arts Institute 7 - 65.122.196.0/24 6261 0.2% AS19743 -- 8 - 198.140.43.0/24 5352 0.2% AS35931 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 9 - 72.164.144.0/24 5001 0.2% AS19743 -- 10 - 65.162.204.0/24 4999 0.2% AS19743 -- 11 - 66.238.91.0/24 4997 0.2% AS19743 -- 12 - 65.163.182.0/24 4996 0.2% AS19743 -- 13 - 66.89.98.0/24 4996 0.2% AS19743 -- 14 - 202.92.235.0/24 3908 0.1% AS9498 -- BBIL-AP BHARTI Airtel Ltd. 15 - 68.65.152.0/22 3673 0.1% AS11915 -- TELWEST-NETWORK-SVCS-STATIC - TEL WEST COMMUNICATIONS LLC 16 - 202.153.174.0/24 3518 0.1% AS17408 -- ABOVE-AS-AP AboveNet Communications Taiwan 17 - 213.55.75.0/24 2790 0.1% AS24757 -- EthioNet-AS 18 - 213.55.74.0/24 2788 0.1% AS24757 -- EthioNet-AS 19 - 208.54.82.0/24 2734 0.1% AS701 -- UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 20 - 213.55.64.0/24 2521 0.1% AS24757 -- EthioNet-AS Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0