January 2012 - Test - lists.nanog.org

Re: IP KVM suggestions
by Chris Hunt 01 Feb '12

01 Feb '12

On 1/30/2012 11:05 AM, nanog-request(a)nanog.org wrote: > ------------------------------ > > Message: 8 > Date: Mon, 30 Jan 2012 12:09:16 -0600 > From: "Express Web Systems" <mailinglists(a)expresswebsystems.com> > To: "'NANOG'" <nanog(a)nanog.org> > Subject: RE: IP KVM suggestions > Message-ID: <033601ccdf7a$481d0f90$d8572eb0$@com> > Content-Type: text/plain; charset="us-ascii" > >> > I have a need for a small, portable, web based IP kvm with decent >> > features that doesn't break the bank. Preferably something that >> > supports ISO mounting from http or ftp and USB connectivity. Would >> > also prefer something browser independent. Small plugin like the >> > Raritan devices would be acceptable too. It will be used internally for >> > Remote access while building devices pre deployment to customers. Any >> > suggestions? >> > >> > Thanks! >> > >> > Blake > Lantronix Spider is a small, portable, affordable and web enabled IP KVM. > Supports ISO mounting and has USB connections. > > http://www.lantronix.com/it-management/kvm-over-ip/securelinx-spider.html > > It is a single server unit. So if you want to connect many servers at the > same time, it might not be the best option as the price quickly escalates. > However, if you buy one and just move it from server to server (which is > what I got from your email), then it is a pretty good fit. Java based web > interface, not the greatest, but it works. > > For multiple server access from a single unit, look at the Dell 2161DS > (rebranded Avocent units) line. They are abundant on ebay, and relatively > inexpensive, and can expand to up to 128 servers (via add on PEM modules - > the unit has 16 ports and you connect a PEM to one of the ports and you can > connect up to 8 servers to the PEM 16 x 8 = 128). The 2161DS-2 also supports > ISO mounting when using USB dongles (the 2161DS does not). Java based client > software... Dell isn't supporting the 2161DS software any more apparently > and won't install natively on Windows 7, I have it running on Windows7, but it has to be "Run As Administrator" > but the software can be installed > on an XP machine and then copied, this also works for linux, etc. > > Tom Walsh > If security is a concern, then you will probably want to only use the 2161-DS behind a VPN, if at all. The session authentication is fairly weak and supports no ACLs. It does support lock-out on multiple bad authentication attempts though. -Chris

2 1

non-congested comcast peers?
by Shacolby Jackson 31 Jan '12

31 Jan '12

Are there any providers that Comcast doesn't regularly run hot? Seems like no matter who I deliver through at some magical point in the evening they start spiking jitter and a little loss. Almost like everyone hits PLAY on netflix at the same time. -shac

4 3

Re: Megaupload.com seized
by Steven Bellovin 31 Jan '12

31 Jan '12

On Jan 19, 2012, at 6:44 PM, james(a)smithwaysecurity.com wrote: > You guys serous, when did the order come in to sezie the domain? http://arstechnica.com/tech-policy/news/2012/01/why-the-feds-smashed-megaup… has a good analysis; also see http://online.wsj.com/article_email/SB1000142405297020461650457717106061194… (which seems to be outside their paywall). What differentiates this from many of the earlier domain name seizures is that this is based on a grand jury indictment, not just an administrative decision by Immigration and Customs Enforcement. It may be heavy-handed or questionable, per the Ars Technica analysis, but as a matter of process it's about as good as you'll get. > > Sent from my HTC > > ----- Reply message ----- > From: "Ryan Gelobter" <ryan.g(a)atwgpc.net> > To: "NANOG" <nanog(a)nanog.org> > Subject: Megaupload.com seized > Date: Thu, Jan 19, 2012 6:41 pm > > > The megaupload.com domain was seized today, has anyone noticed significant > drops in network traffic as a result? > > http://www.scribd.com/doc/78786408/Mega-Indictment > http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar… --Steve Bellovin, https://www.cs.columbia.edu/~smb

37 67

Route Optimization Software / Appliance
by Babak Pasdar 31 Jan '12

31 Jan '12

Hello Group, I was wondering if anyone could share their experience with any route optimization approaches, methodologies or platforms, either open source or commercial (Internap FCP), that can actively adjust BGP parameters based on latency and number of layer 3 hops to a network rather than AS hops. We have upstreams all over the country and we would like to automate optimization to take the best egress path. Thank you for your feedback in advance. Best Regards, Babak -- Babak Pasdar President & CEO | Certified Ethical Hacker Bat Blue Corporation | Integrity . Privacy . Availability . Performance (p) 212.461.3322 x3005 | (f) 212.584.9999 | (w) www.BatBlue.com Bat Blue is proud to be the Official WiFi Provider for ESPN's X Games Bat Blue's AS: 25885 | BGP Policy | Peering Policy Receive Bat Blue's Daily Security Intelligence Report Bat Blue's Legal Notice

8 9

Route Management Best Practices
by Joe Marr 31 Jan '12

31 Jan '12

My network has grown large enough that maintaining my prefix announcements to the rest of the world has become increasingly difficult. I currently use static routes and tags on my edge routers to inject route into BGP. The tags correspond to communities that reflect how the routes are announced per region. I would love to heat from others on how they handle this.

3 6

RE: Hijacked Network Ranges - paging Cogent and GBLX/L3
by Manish Karir 31 Jan '12

31 Jan '12

You can take a closer look at the aspaths (lengths) to various global locations by looking at the following: http://bgptables.merit.edu/prefix.php?z=&z=&prefixcw=208.110.48.0/20&view=a… http://bgptables.merit.edu/prefix.php?z=&z=&prefixcw=63.246.112.0/20&view=a… http://bgptables.merit.edu/prefix.php?z=&z=&prefixcw=68.66.112.0/20&view=al… Hope that helps. -manish > Message: 7 > Date: Tue, 31 Jan 2012 22:06:03 +0200 > From: Ido Szargel <ido(a)oasis-tech.net> > To: "Schiller, Heather A" <heather.schiller(a)verizon.com>, Kelvin > Williams <kwilliams(a)altuscgi.com>, "nanog(a)nanog.org" <nanog(a)nanog.org> > Subject: RE: Hijacked Network Ranges - paging Cogent and GBLX/L3 > Message-ID: > <7A848D4888ADA94B8A46A17296740133B38D3E5473(a)DEXTER.oasis-tech.local> > Content-Type: text/plain; charset="us-ascii" > > I would go at first by advertising your prefixes as a /24 as well, just > randomly checked 2 different locations and the as-path to 11325 is shorter > than to 33611 > This seems to be the case for customers of Tiscali and L3, so this will > probably get most of your traffic back to you... > > Regards, > Ido >> >> -----Original Message----- >> From: Kelvin Williams [mailto:kwilliams@altuscgi.com] >> Sent: Tuesday, January 31, 2012 1:01 PM >> To: nanog(a)nanog.org >> Subject: Hijacked Network Ranges >> >> Greetings all. >> >> We've been in a 12+ hour ordeal requesting that AS19181 (Cavecreek Internet >> Exchange) immediately filter out network blocks that are being advertised by >> ASAS33611 (SBJ Media, LLC) who provided to them a forged LOA. >> >> The routes for networks: 208.110.48.0/20, 63.246.112.0/20, and >> 68.66.112.0/20 are registered in various IRRs all as having an origin AS >> 11325 (ours), and are directly allocated to us. >> >> The malicious hijacking is being announced as /24s therefore making route >> selection pick them. >> >> Our customers and services have been impaired. Does anyone have any >> contacts for anyone at Cavecreek that would actually take a look at ARINs >> WHOIS, and IRRs so the networks can be restored and our services back in >> operation? >> >> Additionally, does anyone have any suggestion for mitigating in the interim? >> Since we can't announce as /25s and IRRs are apparently a pipe dream. >> >> -- >> Kelvin Williams >> Sr. Service Delivery Engineer >> Broadband & Carrier Services >> Altus Communications Group, Inc. >> > > "If you only have a hammer, you tend to see every problem as a nail." -- > Abraham Maslow

1 0

MD5?
by Brian Stengel 31 Jan '12

31 Jan '12

We have a potential customer that is asking for us to enable MD5 authentication on a TCP connection between two BGP peers? Is this still common practice today? Any potential problems or gotchas to keep in mind? Thanks! -- Brian Stengel KINBER Director of Operations bstengel(a)kinber.org 412.254.3481 Skype: brian_stengel KINBER - Keystone Initiative for Network Based Education and Research - www.kinber.org PennREN - Pennsylvania's Research and Education Network

17 22

using ULA for 'hidden' v6 devices?
by Justin M. Streiner 31 Jan '12

31 Jan '12

Is anyone using ULA (RFC 4193) address space for v6 infrastructure that does not need to be exposed to the outside world? I understand the concept of having fc00::/8 being doled out by the RIRs never went anywhere, and using space out of fd00::/8 can be a bit of a crap-shoot because of the likelihood of many organizations that do so not following the algorithm for picking a /48 that is outlined in the RFC. There would appear to be reasonable arguments for and against using ULA. I'm just curious about what people are doing in practice. jms

19 42

Re: Hijacked Network Ranges
by John Schneider 31 Jan '12

31 Jan '12

If you both announce a /24, the BGP route selection process should begin to return some of the traffic to these prefixes back to your AS. Also, if you begin to advertise your prefixes as /24s and as a result, they try to advertise /25s, I would venture a guess that their /25s would get blocked entirely, effectively returning traffic to those prefixes to you. that would be best-case scenario until you can get someone at AS36111 to listen to you. Best of Luck to you >Upstream requirements. Additionally, I don't believe it would do us any >good. If they're announcing /24 now, why would they not announce a /25.

1 0

IPv6 BGP MIBs
by chip 31 Jan '12

31 Jan '12

Hi all, Can anyone point me to ongoing discussion about IPv6 BGP SNMP MIBs going on in the IETF? As I understand it RFC 4293 was somewhat abandoned by most vendors. Cisco has a new BGPV4-2 Mib but that still doesn't address all the needs. While I can try and push all my vendors to come up with a MIB that has parity with IPv4 I assume our standards bodies are working towards that goal as well. I can't seem to locate where these discussions are happening within the IETF...or if they even are. Any pointers or education for my ignorance is appreciated. Thanks all, --chip -- Just my $.02, your mileage may vary, batteries not included, etc....

3 2