May 2011 - Test - lists.nanog.org

RE: Experience with Open Source load balancers?
by Welch, Bryan 17 May '11

17 May '11

Ø I have had great success with ha proxy http://haproxy.1wt.eu/ -Randy Can you elaborate on your config? On Mon, May 16, 2011 at 7:15 PM, Welch, Bryan <Bryan.Welch(a)arrisi.com<mailto:Bryan.Welch@arrisi.com>> wrote: Greetings all. I've been tasked with comparing the use of open source load balancing software against commercially available off the shelf hardware such as F5, which is what we currently use. We use the load balancers for traditional load balancing, full proxy for http/ssl traffic, ssl termination and certificate management, ssl and http header manipulation, nat, high availability of the physical hardware and stateful failover of the tcp sessions. These units will be placed at the customer prem supporting our applications and services and we'll need to support them accordingly. Now my "knee jerk" reaction to this is that it's a really bad idea. It is the heart and soul of our data center network after all. However, once I started to think about it I realized that I hadn't had any real experience with this solution beyond tinkering with it at home and reading about it in years past. Can anyone offer any operational insight and real world experiences with these solutions? TIA, replies off list are welcomed. Regards, Bryan

1 0

1000BaseT Ethernet keepalives (Ethertype 0x9000)
by Manu Chao 16 May '11

16 May '11

I am curious to understand how copper Ethernet keepalive are used and work between a host or router and a switch? Cisco default keepalive is 10 seconds with 3 or 5 retries, does this mean 30s or 50s to detect copper link failure?? I may miss something, thanks for your help. The link failure detection doesn't occur with optical links because hardware detection (Rx < Rx_min) is much more real time than keepalive timeout expiration. R/ Manu

1 0

Root Zone DNSSEC KSK Ceremony 5
by Joe Abley 16 May '11

16 May '11

KSK CEREMONY 5 The fifth KSK ceremony for the root zone took place in Culpeper, VA, USA on Wednesday 2011-05-11. The Ceremony Administrator was Mehmet Akcin. The ceremony was completed successfully. Video from Ceremony 5 was recorded for audit purposes. Video and associated audit materials will be published in 1 to 2 weeks, and will be available as usual by following the "KSK Ceremony Materials" link at <https://www.iana.org/dnssec/>. Ceremony 5 included processing of a Key Signing Request (KSR) generated by VeriSign, and the resulting Signed Key Response (SKR) contains signatures for Q3 2011. CONTACT INFORMATION We'd like to hear from you. If you have feedback for us, please send it to rootsign(a)icann.org.

1 0

Re: GoDaddy abuse contact
by Chris 16 May '11

16 May '11

The best abuse contact response I ever got was an under 3 hour reply to a lesser known domain provider who revoked the domain for the Facebook scam. It was hilarious and I don't think even GoDaddy responded within 3 days or so. A part of me wants to say we should look out for people while another part wants to chalk it up to survival of the fittest. I just looked, it's still up and running. -- --C "The dumber people think you are, the more surprised they're going to be when you kill them." - Sir William Clayton

1 0

reporting Swiss Money Report?
by Eugen Leitl 16 May '11

16 May '11

The notorious fax spammer (Swiss Money Report, European Money Report, etc; Altanus Ltd.) is currently residing in 91.223.119/24 (91.223.119.174), which is registered to Traian Zoran Tariceanu, First Media Service Ltd. The contacts at @fmsss.info bounce. What is the proper channel for reporting these people? Thanks! Regards, Eugen Leitl

2 1

Interested in input on tunnels as an IPv6 transition technology
by Karl Auer 16 May '11

16 May '11

Hullo all. I'm working on a talk, and would be interested to know what people think is good about tunnels as an IPv6 transition technology, and what people think is bad about tunnels. It would probably be best to let me know off-list :-) but I'm happy to summarise back to the list. Any references you have to useful papers, articles, discussions etc would also be appreciated. I'm looking for both general problems and advantages, but also advantages and disadvantages specific to particular tunnel types. It would also be helpful to know from what perspective particular things are good or bad, in so far as it isn't obvious. A carrier has a different perspective than, say, a home user, who will have a different perspective again to an enterprise user. Many thanks in advance for your input. Regards, K. PS: Note the all-important words "as an IPv6 transition technology"... -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/kauer/ +61-428-957160 (mob) GPG fingerprint: DA41 51B1 1481 16E1 F7E2 B2E9 3007 14ED 5736 F687 Old fingerprint: B386 7819 B227 2961 8301 C5A9 2EBC 754B CD97 0156

6 5

GoDaddy abuse contact
by Chris 15 May '11

15 May '11

Does anyone have a better abuse contact for GoDaddy? I'm trying to get one of those "paste Javascript in your browser address bar" scams on Facebook shutdown before too many idiots fall for it. -- --C "The dumber people think you are, the more surprised they're going to be when you kill them." - Sir William Clayton

4 3

Backbone operators see IPv6 connectivity demand up, but little traffic
by Eugen Leitl 15 May '11

15 May '11

http://searchtelecom.techtarget.com/news/2240035722/Backbone-operators-see-… Backbone operators see IPv6 connectivity demand up, but little traffic Internet backbone and wholesale carriers are anecdotally reporting a rapid rise in demand from their service provider customers for IPv6 connectivity—an apparent prelude to the full-scale arrival of the IPv6 Internet as World IPv6 Day looms on the horizon. We've seen a tremendous increase in IPv6 traffic. Granted, though, it still comes nowhere near our traffic on v4. Reid Fishler, director, Hurricane Electric Backbone operators, however, acknowledge that the amount of IPv6 traffic still pales in comparison to that of its predecessor, IPv4, and that it's still too early to tell how quickly it will grow. Hurricane Electric, which claims to operate the world's largest IPv6-native Internet backbone, has established three dual-stack (both IPv4 and IPv6) points of presence (POPs) at carrier hotels since March. Citing growing demand from operators for European peering points with IPv6 Internet connectivity, the wholesale provider connected its backbone to the Equinix Paris Exchange last week. When Hurricane Electric offered native dual-stack services to carriers two years ago, few accepted them, according to Reid Fishler, director of carrier sales and purchasing at Hurricane Electric. Customers were confused or disinterested, but now "the vast majority" of service providers that are buying wholesale access at these Internet peering points are opting for dual-stack—and in rare cases, IPv6-only connections, he said. "We've seen a tremendous increase in IPv6 traffic. Granted, though, it still comes nowhere near our traffic on v4," Fishler said. "But look at any one of these [Internet] exchange fabrics and compare v6 traffic to v4 traffic. Up until a year ago, you couldn't even rate [the amount of IPv6 traffic], and now you're starting to see it [on the Internet], and you definitely see a lot of the traffic coming in from China and Asia as v6 traffic now." Hurricane Electric also established dual-stack POPs in Internet exchange point Telehouse Paris Voltaire and VegasNAP in Las Vegas in March. Late last year, demand for IPv6 Internet connectivity prompted Hurricane Electric's POP expansions into peering points Comfluent, in Denver; Equinix Singapore Exchange; and the Northwest Access Exchange in Portland, Ore. More on IPv6 connectivity Get a telecom network architect's view on how to convert IPv4 to IPv6. Learn why your telecom IPv6 transition plan must include more than upgrading your routers. Find out how to make the IPv4 to IPv6 transition work. If you can get your kids to eat their veggies, you can sell enterprises on IPv6 migration plans. Shawn Morris, manager of IP development at NTT America, said IPv6 Internet traffic is still "a tiny fraction" of all Internet traffic, but NTT America has seen a steady increase of demand for and questions about IPv6 connectivity from its carrier customers over the past few years. A large portion of the demand is coming from service providers in Latin America, which have been slower to adopt IPv6 than carriers in other regions, Morris said. Demand for dual-stack peering at public Internet exchanges and at private peering points has also increased, said Morris, who oversees network architecture, hardware and software. "I wouldn't say it's at parity with IPv6, but it's definitely trending in that direction," he said. "That's a big change. In ‘03 and ‘04, we went native [with IPv6 on our backbone] and were ready to peer with any of our peers, but it took a good six to seven years before we really saw an increase in demand." More requests for IPv6 connectivity, but traffic barely materializing NTT America could not provide any data regarding IPv6 Internet traffic levels. But in its search for a new network monitoring platform, one of its requirements was more granular visibility into levels of IPv4 and IPv6 traffic, Morris said. "We don't have any hard statistics ... but we definitely keep seeing more customers adding v6 onto their connections and an increase in the v6 routing table," he said. "But we're also expecting, to be honest, quite a bit of growth in the IPv4 routing table as people start to split up the address space in the run-out. So, we're planning for a large amount of growth in both tables." Order requests for IPv6 connectivity have doubled every year for the past three years at Global Crossing, according to Anthony Christie, the backbone operator's chief technical and information officer. But that hasn't translated yet into any significant amount of IPv6 Internet traffic on Global Crossing's network, he said. "The traffic that we're seeing would need to increase 100 times the current levels in order for it to be a meaningful percentage in total traffic," Christie said. "The content, addresses and infrastructure associated with [IPv4] is not yet exhausted, so you wouldn't necessarily expect a switch to flick because someone has decided to order a v6 port on our network." The American Registry of Internet Numbers (ARIN)—the Regional Internet Registry (RIR) for the United States, Canada and much of the Caribbean—has seen similar rates of growth in requests for IPv6 address space blocs, according to John Curran, president and CEO of ARIN. In 2008, ARIN received 250 requests for IPv6 address blocs from ISPs and hosting providers; in 2009, that rose to just above 400. Last year, ARIN received 700 requests. Within the first quarter of 2011, it has received 500 requests for IPv6 address blocs and expects that to total 1,500 by the end of the year, Curran said. "We've seen, for the last three years, the requests for IPv6 address space double," Curran said. "But that may not result in traffic." Internet backbone provider Level 3 Communications, which recently announced its intention to buy Global Crossing, has seen similar IPv6 connectivity and traffic trends. "Level 3 has witnessed growth in the number of IPv6 routes that are being advertised, but IPv6 routes still account for a very small portion of all Internet routes," said Mark Taylor, vice president of content and media at Level 3. "Likewise, even as IPv6 Internet traffic is on the rise, it is still small relative to the growth in address announcements." What will spur growth of the IPv6 Internet? Backbone operators don't doubt that the IPv6 Internet will grow—but how rapidly or under what conditions is anyone's guess. Hurricane Electric's Fishler said he expects rapid growth will be spurred by consumer demand for a "killer application" that only functions on the IPv6 Internet. "If some large Internet-addressable service ... comes out and it needs to have 10,000 servers or whatever it needs, that next thing is going to [require] v6," he said. "That next product, whatever it'll be, will be IPv6 primarily and IPv4 secondarily ... and that's when we're going to see IPv6 take off, and that's when customers and service providers are going to be taken aback [if they can't] do it natively." Morris, of NTT America, didn't rule out the IPv6 killer app theory but predicted more conservative, steady growth of the IPv6 Internet. "We're going to see a more gradual increase in IPv6 traffic as time goes on, unless something comes along that's a killer app that's only available on IPv6," he said. "I honestly don't know what that would be ... but something like that might spurn a really quick uptake in IPv6. But what I think we're going to see is more and more organic growth."

2 1

Network Equipment Discussion (HP and L2/10G)
by Deepak Jain 14 May '11

14 May '11

Go figure, an actual thread about networking equipment on NANOG. :) So reading Cisco's announcement, I go look at HP's higher end switching/routing line and I see some pretty beefy looking gear. A12500 and others. Does anyone have any experience with this thing -- is it white labeled from someone else? Second question -- Does anyone know of a Cascade-style box (old days) for 10G aggregation? What I mean is I need about a number of ports of 10G (pluggable *colored* optics) with just normal L2 stuff (VLANs/dot1q) and I'd like to LACP/Port-channel that back to a pair of 10G ports on a router. The wrinkle here is that I can't use a normal enterprise 10G switch because of the need for DWDM optics (ideally 80km style). For this application, buffers and such are not an issue. Any suggestions? Thanks in advance, DJ

3 2

Clearing DF bits...
by Warren Kumari 14 May '11

14 May '11

Hi there all, Years ago it used to be a somewhat common practice to clear the DF bit on packets, either on all packets, or just on those that that you were going to shove through a tunnel (I think the netscreen command was something like "set vpn foo df-bit clear", cisco had something funky with policy routing IIRC,etc). This was done both to deal with multiple encapsulations and for the folk that block all ICMP for "security reasons". Is this practice still common / do you know of anyone still doing it? W

2 1