September 2011 - Test - lists.nanog.org

NAT444 or ?
by Serge Vautour 14 Sep '11

14 Sep '11

Hello, Things I understand: IPv6 is the long term solution to IPv4 exhaustion. For IPv6 to work correctly, most of the IPv4 content has to be on IPv6. That's not there yet. IPv6 deployment to end users is not trivial (end user support, CPE support, etc...). Translation techniques are generally evil. IPv6->IPv4 still requires 1 IPv4 IP per end user or else you're doing NAT. IPv4->IPv6 (1-1) doesn't solve our main problem of giving users access to the IPv4 Internet. I expect like most companies we're faced with having to extend the life of IPv4 since our users will continue to want access to the IPv4 content. Doing that by giving them an IPv6 address is not very feasible yet for many reasons. NAT444 seems like the only solution available while we slowly transition over to IPv6 over the next 20 years. Based on the this RFC, NAT444 breaks a lot of applications! http://tools.ietf.org/html/draft-donley-nat444-impacts-01 Has anyone deployed NAT444? Can folks share their experiences? Does it really break this many apps? What other options do we have? Thanks, Serge

25 65

Transit pricing?
by Jay Ashworth 13 Sep '11

13 Sep '11

Anyone mind telling me, off list and not for attribution, what they're paying for straight or blended transit in a colo datacenter? Trying to evaluate a quote. /mbps, GigE fiber access. Cheers, -- jr 'Shhhh, James :-)' a -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

1 0

Twitter
by Morgan Miskell 13 Sep '11

13 Sep '11

Anyone from twitter on the list? If so, can you drop me an email so that I can get some assistance with a routing issue? -- Morgan A. Miskell CaroNet Data Centers 704-643-8330 x206 ---------------------------------------------------------------------------- The information contained in this e-mail is confidential and is intended only for the named recipient(s). If you are not the intended recipient you must not copy, distribute, or take any action or reliance on it. If you have received this e-mail in error, please notify the sender. Any unauthorized disclosure of the information contained in this e-mail is strictly prohibited. ----------------------------------------------------------------------------

1 0

Soliciting your opinions on routing research: A routing policies survey
by Sharon Goldberg 13 Sep '11

13 Sep '11

Hi NANOG, 27 ops have already responded to our routing policies survey; we're hoping to gather more responses before the week is over. We're collecting information about how you configure routing policies in your network to improve the models we use in our research on routing and security. We'll also share the aggregated results with the NANOG list. The survey is anonymous and should take under 5 minutes to complete. Feel free to answer all our questions, or just a few: http://www.cs.toronto.edu/~phillipa/measurement/opsurvey/survey.php We’d also be grateful if you could forward the survey to ops at other organizations who may not be reading NANOG. Thanks all of you that have responded so far! Phillipa Gill (U of Toronto), Michael Schapira (Princeton), Sharon Goldberg (Boston University)

1 0

BGP Communities for H.E. and Deltacom?
by Graham Wooden 13 Sep '11

13 Sep '11

Hi there, Any one know what are the acceptable BGP communities are for H.E. and Deltacom? At one of our POPs we¹re using an aggregate provider and I need to help them to fix some prefixes that I am announcing from another POP (ie. Lower the metric so only use the backhaul for failure of the other side). I was hoping that they would be listed on the One Step¹s bgp community listing. Any links to such documents for both HE and Deltacom would be great and would be much appreciated. Thank you, -graham

1 0

NANOG Nomination Dates
by Patrick W. Gilmore 13 Sep '11

13 Sep '11

Everyone, I would like to remind everyone about some important dates that are coming up: * September 12, 2011 begins the nomination process for Program Committee Candidates. * September 13, 2011 the nomination process for the Board closes. As a reminder, the Program Committee is a group of sixteen individuals from the NANOG community who together are responsible for the solicitation and selection of material for NANOG meeting programs. Per the NewNOG bylaws, eligible candidates each will serve a two-year term. To be eligible to be appointed as a member of the Program Committee, an individual must have attended one NANOG conference within the prior calendar year (12 months) and be a member in good standing. Broad technical knowledge of Internet operations and familiarity with NANOG meetings are useful attributes. Having constructive opinions and ideas about how NANOG meetings might be improved is of high value. A willingness to recruit presentations for each meeting is required. Please send nominations to nominations(a)nanog.org. If you are nominating another person, please provide that person's name and email address. If you are nominating yourself, please provide a Statement of Intent and a Biography, each with a suggested limit of 150 words. For samples, please see the 2010 candidate lists, <http://www.nanog.org/governance/elections/2010elections/>. As always, if you have a questions, please email nominations(a)nanog.org. Thank you for your support, and your participation in the community. -- TTFN, patrick

1 0

Re: vyatta for bgp
by Robert Bays 13 Sep '11

13 Sep '11

> On Sep 13, 2011, at 2:45 AM, Roland Dobbins wrote: > This contradicts my experience - I've repeatedly witnessed only a few mb/sec of 64-byte packets making software-based routers fall over, including just last month. It's easy to get 6Mpps using Vyatta or most other software based routers on modern server grade hardware. If both your link and hardware capacity don't exceed the maximum load the bad guys can throw at you, then you are doomed to failure regardless without upstream cooperation. In the case of an enterprise, neither of those two things are always guaranteed. Software based routers work great for many use cases, it just depends on what you are looking for. And sometimes they are the only option, for example as services migrate into the cloud. Software based routers are only going to get better. Roland, if you are in the Bay Area I invite you to drop by Vyatta HQ in Belmont and I will show you a demo of our next generation software which is doing an 5x increase in throughput over our last generation on the same off the shelf Intel X86 processors. We expect that number to only increase over the short term. Lot's of CPU horsepower solves a multitude of woes. The one thing I do agree with you on is… > One can and should test the specific performance envelope of any prospective infrastructure purchase, of course. cheers, robert.

1 0

Re: EV SSL Certs
by Coy Hile 13 Sep '11

13 Sep '11

> > On Sun, Sep 11, 2011 at 9:08 PM, Christopher Morrow > <morrowc.lists(a)gmail.com> wrote: > >> what's the real benefit of an EV cert? (to the service owner, not the >> CA, the CA benefit is pretty clearly $$) > > The benefit is to the end user. > They see a green address bar with the company's name displayed. > > Yeah, company's name displayed -- individuals cannot apply for EVSSL certs. > > > With normal certs, the end user doesn't see a green address bar, and > instead of the company's > name displayed "(unknown)" is displayed and > "This web site does not supply ownership information." is displayed. > > If you ask me, hiding the company's name even when present on a non-EVSSL > cert is tantamount to saying "Only EV-SSL certs are really trusted anyways". > > So maybe instead of these shenanigans browser makers should have just > started displaying a "don't trust this site" warning for any non-EVSSL cert. > As an academic aside, exactly what would one set on his (internal) root CA so that internally-trusted certs signed by that CA would show up as EV certs?

3 3

Why are we still using the CA model? (Re: Microsoft deems all DigiNotar certificates untrustworthy, releases updates)
by Mike Jones 12 Sep '11

12 Sep '11

On 11 September 2011 16:55, Bjørn Mork <bjorn(a)mork.no> wrote: > You can rewrite that: Trust is the CA business. Trust has a price. If > the CA is not trusted, the price increases. > > Yes, they may end up out of business because of that price jump, but you > should not neglect the fact that trust is for sale here. > The CA model is fundamentally flawed in the fact that you have CAs whose sole "trustworthiness" is the fact that they paid for an audit (for Microsoft, lower requirements for others), they then issue intermediate certificates to other companies (many web hosts and other minor companies have them) whose sole "trustworthiness" is the fact that they paid for an intermediate certificate, all of those companies/organisations/people are then considered trustworthy enough to confirm the identity of my web server despite the fact that none of them have any connection at all to me or my website. There is already a chain of trust down the DNS tree, if that is compromised then my SSL is already compromised (if they control my domain, they can "verify" they are me and get a certificate), what happened to RFC4398 and other such proposals? EV certificates have a different status and probably still need the CA model, however with "standard" SSL certificates the only validation done these days is checking someone has control over the domain. DNSSEC deployment is advanced enough now to do that automatically at the client. We just need browsers to start checking for certificates in DNS when making a HTTPS connection (and if one is found do client side DNSSEC validation - I don't trust my ISPs DNS servers to validate something like that, considering they are the ones likely to be intercepting my connections in the first place!). It will take a while to get updated browsers rolled out to enough users for it do be practical to start using DNS based self-signed certificated instead of CA-Signed certificates, so why don't any browsers have support yet? are any of them working on it? - Mike

19 30

Re: [NANOG-announce] NANOG 53 draft agenda available
by David Meyer 12 Sep '11

12 Sep '11

Sure. NANOG support can you update please? Thanks, Dave On Mon, Sep 12, 2011 at 2:40 PM, Aaron Hughes <aaronh(a)bind.com> wrote: > David, > > I am also running the Peering Track (which will be good for IXs and such to know to contact me ahead of time). Can you please add 'Aaron Hughes, CTO 6connect' to the Peering Track as well? > > Thanks! > > Cheers, > Aaron > > On Mon, Sep 12, 2011 at 02:28:03PM -0700, David Meyer wrote: >> Please see http://www.nanog.org/meetings/nanog53/agenda.html. >> >> Note that the Loews room block expires on 09/23/2011. Note also that >> the standard registration fee runs through 10/04/2011. >> >> Looking forward to seeing you in Philadelphia. >> >> Thanks, >> >> Dave >> >> (for the NANOG PC) >> >> -- >> NANOG-announce mailing list >> NANOG-announce(a)nanog.org >> https://mailman.nanog.org/mailman/listinfo/nanog-announce > > -- > > Aaron Hughes > aaronh(a)bind.com > +1-831-824-4161 > Key fingerprint = AD 67 37 60 7D 73 C5 B7 33 18 3F 36 C3 1C C6 B8 > http://www.bind.com/ > _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0