January 2013 - Test - lists.nanog.org

Re: NANOG Digest, Vol 60, Issue 110
by Brzozowski, John 31 Jan '13

31 Jan '13

-----Original Message----- From: "nanog-request(a)nanog.org" <nanog-request(a)nanog.org> Reply-To: NANOG <nanog(a)nanog.org> Date: Wednesday, January 30, 2013 5:13 PM To: NANOG <nanog(a)nanog.org> Subject: NANOG Digest, Vol 60, Issue 110 >Message: 7 >Date: Thu, 31 Jan 2013 10:00:22 +1100 >From: Mark Andrews <marka(a)isc.org> >To: Michael Thomas <mike(a)mtcc.com> >Cc: NANOG list <nanog(a)nanog.org> >Subject: Re: "Programmers can't get IPv6 thus that is why they do not > have IPv6 in their applications".... >Message-ID: <20130130230022.E74BD2E9390C(a)drugs.dv.isc.org> > > >In message <51099C0F.5040507(a)mtcc.com>, Michael Thomas writes: >>On 01/30/2013 01:51 PM, Cutler James R wrote: >>> On Jan 30, 2013, at 12:43 PM, joel jaeggli <joelja(a)bogus.com> wrote: >>> >>>> As a product of having a motorola sb6121 and a netgear wndr3700 both >>>>of wh >>ich I bought at frys I have ipv6 in my house with dhcp pd curtesy of >>commcast >>. If it was any simpler somebody else would have had to install it. >>>> >>> Except that Apple Airport Extreme users must have one of the newer >>>hardware >> versions, that is my experience as well. >>> >>> And, even before Comcast and new AEBS, Hurricane Electric removed all >>>other >> excuses for claiming "no IPv6". >>"Remove excuses" != "Create incentive". There are an infinite number of >>things I can do to "remove excuses". Unless they're in my face (read: >>causing >>me headaches), they do not "create incentive". My using my or my >>company's >>software which doesn't work in my own environment (= work, home, phone, >>etc) >>"creates incentive". Lecturing me about how I can get a HE tunnel and >>that if >>I don't i'm ugly and my mother dresses me funny, otoh, just "creates >>vexation >>". >>Mike >> > >Just having IPv6 doesn't create incentives to make their code work >with IPv6. People just trundle along using IPv4. Turning off IPv4 >creates incentives. Reducing IPv4's capabilities creates incentives. >Being told this needs to work and be tested with IPv6 creates >incentives. [jjmb] turning off IPv4 is not realistic at this time and there are other ways to encourage the use and adoption of IPv6. Enabling by default, requesting upgrades for existing products that introduce support for IPv6. Enabling IPv6 alone is a significant statement especially when your business relies on the same. The absence of IPv6 or broken IPv6 when your business relies on it are no longer options. > >Broken networks get people to fix things. Unfortunately most >developers don't test with broken networks. If they did "Happy >Eyeballs" would not have happened. The applications would have >coped with only some address of a multi-homed server working. > >Mark >-- >Mark Andrews, ISC >1 Seymour St., Dundas Valley, NSW 2117, Australia >PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org > >

1 0

Re: NANOG Digest, Vol 60, Issue 107
by Brzozowski, John 31 Jan '13

31 Jan '13

See below. John -----Original Message----- From: "nanog-request(a)nanog.org" <nanog-request(a)nanog.org> Reply-To: NANOG <nanog(a)nanog.org> Date: Wednesday, January 30, 2013 11:18 AM To: NANOG <nanog(a)nanog.org> Subject: NANOG Digest, Vol 60, Issue 107 >Date: Wed, 30 Jan 2013 09:43:10 -0800 >From: joel jaeggli <joelja(a)bogus.com> >To: "Dobbins, Roland" <rdobbins(a)arbor.net>, NANOG list > <nanog(a)nanog.org> >Subject: Re: "Programmers can't get IPv6 thus that is why they do not > have IPv6 in their applications".... >Message-ID: <51095BAE.2020708(a)bogus.com> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >On 11/28/12 4:17 PM, Dobbins, Roland wrote: >>On Nov 29, 2012, at 3:04 AM, Tony Hain wrote: >> >>>Getting the cpe vendors to ship in quantity requires the ISP >>>engineering organizations to say in unison "we are deploying IPv6 and >>>will only recommend products that pass testing". >>Do you see any evidence of that occurring? I don't. [jjmb] I do, where I have control and/or influence over products we absolutely require this or the device (or software) does not get deployed or enabled. There are cases where we deploy software that supports IPv6 but it is disabled. This is largely to ensure that my customers are not adversely impacted or have a poor customer experience. I admit getting quality implementations is not a trivial exercise even where good specifications are available. I view this as part of my job as such we are looking at techniques to streamline this process. >> >>Also, a lot of broadband consumers and enterprise organizations buy and >>deploy their own CPE. Do you see a lot of IPv6 activity there? >As a product of having a motorola sb6121 and a netgear wndr3700 both of >which I bought at frys I have ipv6 in my house with dhcp pd curtesy of >commcast. If it was any simpler somebody else would have had to install >it. [jjmb] this is our goal simple and seamless. >> I don't, excepting an IPv6 RFP checkbox for enterprises, which >>doesn't have any formal requirements and is essentially meaningless >>because of that fact. [jjmb] an IPv6 check box on an RFP means almost nothing, IPv6 has never been a one check box item. The rubber meets the road when a company chooses to buy based on IPv6 functionality or better yet swaps products out due to lack of IPv6 functionality. >>>You claim to be looking for the economic incentive, but are looking >>>with such a short time horizon that all you see are the 'waste' >>>products vendors >>>are pushing to make a quick sale, knowing that you will eventually come >>>back for yet-another-hack to delay transition, and prop up your >>>expertise in a >>>legacy technology. >>No. >> >>What I am looking for is an economic incentive which will justify the >>[IMHO] wildly overoptimisitic claims which some are making in re >>ubiquitous end-to-end native IPv6 deployment. >> >>Otherwise, I believe it will be a much more gradual adoption curve, as >>you indicate. [jjmb] ubiquitous IPv6 deployment and use requires work, it is not going to happen automatically and will require effort. >> >>>The same thing happened with the SNA faithful 15 years ago, and history >>>shows what happened there. >>You attribute circumstances and motivations to me which do not apply. >> >>----------------------------------------------------------------------- >>Roland Dobbins <rdobbins(a)arbor.net> // <http://www.arbornetworks.com> >> >> Luck is the residue of opportunity and design. >> >> -- John Milton >> >> >> >

1 0

TOR fiber patch panels
by Chuck Anderson 31 Jan '13

31 Jan '13

I'm looking for better Top-Of-Rack fiber patch panels than the ones I've been using up to this point. I'm looking for something that is 1U, holds 12 to 24 strands of SC, ST, or LC, has fiber jumper management rings, and has a door that doesn't interfere with the U below (a server might be mounted immediately below the fiber patch panel). I prefer one that doesn't have a sliding mechanism, because I've had issues with fiber installers not installing those properly, causing fiber to be crunched and broken when the tray is slid out/in during patching. Of course, I would still like one that is easy to get your fingers into to install and remove fiber jumpers. Does such a thing exist? What are people's favorite fiber patch panels? Thanks.

4 3

OOB core router connectivity wish list
by Mikael Abrahamsson 31 Jan '13

31 Jan '13

I have together with some other people, collected a wish list for OOB support, mainly aimed for core routers. This is to replace the legacy serial port usually present on core routing equipment and to move/collapse all its functionality to an ethernet only port. Some equipment already have an mgmt ethernet port, but usually this can't do "everything", meaning today one has to have OOB ethernet *and* OOB serial which just brings more pain than before. I would like to post it here to solicit feedback on it. Feel free to use it to tell your vendor account teams you want this if you feel it useful. I've already sent it to one vendor. http://swm.pp.se/oob.txt Priorities: [P1] -> must have, otherwise not useful [P2] -> would be very useful, to most operators [P3] -> nice to have, useful to some >From the OOB ethernet port it should be possible to: [P1]: Powercycle the RP, switchfabrics and linecards (hard, as in they might be totally dead and I want to cut power to it via the back plane. Also useful for FPGA upgrades). [P1]: Connect to manage the RP(s) and linecards (equivalent of todays "connect" on GSR and ASR9k or connecting to RP serial port). [P2]: It should be possible to connect to the OOB from the RP as well (to diagnose OOB connectivity problems). [P2]: Upload software to the RP or otherwise make information available to the RP (for later re-install/turboboot for example). RP should have access to local storage on the OOB device to transfer configuration or software from the OOB device to the RP). [P2]: Read logs and other state of the components in the chassis (displays and LEDs) plus what kind of card is in each slot. [P1]: The OOB port should support (configurable), telnet, ssh and optionally [P3] https login (with a java applet or equivalent to give CLI access in the browser) with ACLs to limit wherefrom things can be done. OOB should support ssh key based logins to admin account. [P1]: The IP address of the OOB port should be set via DHCP/DHCPv6/SLAAC and should have both IPv4 and IPv6 support. If not both, then IPv6 only. [P1]: It should be possible to transfer data using tftp, ftp and scp (ftp client on the OOB device, scp being used to transfer data *to* the device (OOB being scp server). [P2]: OOB device should have tacacs and radius and [P1] local user/password database support for authentication. [P3] OOB should support ssh-key based authentication. [P3] Chassis should have a character display or LEDs with configurable blink pattern from OOB, to aid remote hands identification. [P3] OOB should have two USB ports, one to use to insert storage to transfer files to/from device. The other should be USB port that presents itself as ether USB serial port, or USB ethernet port, where the OOB device would have built in DHCP/DHCPv6 server to give IPv4v6 access to a laptop connected to the OOB so the onsite engineer can then use ssh/telnet to administrate the OOB. Optionally this port could be ethernet port (compare todays CON and AUX ports). [P2] OOB should have procedure to factory default its configuration, perhaps physical button that can be pressed and held for duration of time. The fact that this is done should be logged to the RP. [P3] OOB should have possibility to show power supply and environmental state. [P3] The factory default configuration should not include an empty or obvious login password. The factory-default login password should be the MAC address (without punctuation) of the OOB ethernet interface, which should be printed on the chassis next to the OOBE port. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

29 85

box against dos/ddos
by Piotr 31 Jan '13

31 Jan '13

Hi, I looking some box (vendor, model), which i can put out of the main/product network, which can analyze packets netflow,sflow,syslog from bgp router(s) and after discover some anomaly it can do some action, for example: - Box have bgp session with bgp router and advertise attacked ip prefix with some community. Bgp router set next-hop for this prefix to /dev/null Normal traffic via bgp router is about 1G/s in and 10G/s out What is worth of looking and what you suggest ? thanks for help, Piotr

7 7

HSRP vs VRRP for IPv6 on IOS-XE - rekindling an old flame
by -Hammer- 31 Jan '13

31 Jan '13

A while back I brought up a discussion about IPv6 and I mentioned having some HSRP issues. Not end of the world, just adjusting to IPv6. Several folks went offline to tell me that I should dump "legacy" HSRP and go to VRRP. While I never did find anyone who could explain how HSRP is a sunset feature in IOS, I did agree with a few folks to look into VRRP for IPv6. Well I'm just now getting around to it and there is literally nothing out there. I found a few older articles implying that it's not there yet and of course I found the usual docs about RAs and SLAC and whatnot. But nothing recent. So, for those who criticized me previously about using HSRP (or anyone else) instead of VRRP, do you have VRRP up and running on Cisco IOS-XE and if so how? Can anyone provide a link or a document explaining how this is accomplished? Sample configs? Usually if you can't find it on Google or CCO it's not promising. I'm also reaching out to our AS team for guidance on the subject. PS: I'm not taunting here. It's just that several folks made the effort to go offline with me and tell me how wrong I was with HSRP and that I need to progress to VRRP and I can't find a single doc on the subject now that I look. Were these folks mistaken or am I missing something? Any help would be appreciated. -- -Hammer- "I was a normal American nerd" -Jack Herer

6 12

Re: "Programmers can't get IPv6 thus that is why they do not have IPv6 in their applications"....
by David Barak 31 Jan '13

31 Jan '13

Comcast removed the "no IPv6" excuse? That removal somehow skipped my house in Washington DC where they installed (last October) a router which does not even support it (an Arrus voice gateway- the one where you can't turn of the crummy 2.4g wireless radio) and none of the folks I've spoken to on the phone can tell me when or if it will be coming. I look forward to Comcast giving me native v6 at home. David Barak

6 9

DDoS Attacks Cause of Game Servers
by Shahab Vahabzadeh 31 Jan '13

31 Jan '13

Hi everybody, Last two days I was under an interesting attack which comes from multiple sources to three of my ADSL users destination. The attack make router to ran out of CPU and we had to reload it to solve. I ask those three users and they said we are only game players and all of them were kids, I think they told the true, they told we are playing: http://intl.garena.com/ Attacks takes only 20 or 30 minutes and it happens only 4 times in two days. I could'nt capture any packet but this is out put of my "show ip accounting" that time: Source Destination Packets Bytes 212.180.138.90 128.141.119.209 117 5148 135.62.255.246 128.141.119.209 117 5148 46.136.27.13 128.141.119.209 117 5148 25.181.84.74 128.141.119.209 117 5148 108.0.207.17 128.141.119.209 117 5148 181.95.89.1 128.141.119.209 117 5148 36.161.28.42 128.141.119.209 117 5148 39.130.139.157 128.141.119.209 117 5148 139.81.4.106 128.141.119.209 117 5148 3.229.28.78 128.141.119.209 117 5148 115.28.11.208 128.141.119.209 117 5148 206.42.151.199 128.141.119.209 117 5148 213.221.149.41 128.141.119.209 117 5148 81.203.234.196 128.140.109.209 117 5148 43.134.71.94 128.141.119.209 117 5148 157.69.74.39 128.141.119.209 117 5148 16.206.47.71 128.141.119.209 117 5148 77.25.17.243 128.141.119.209 117 5148 If you have any information in this field and you can help me to find who is behind this, please share. Thanks -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator Cell Phone: +1 (415) 871 0742 PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90

6 7

Juniper MX10 and dual stack BGP
by Christopher Rogers 31 Jan '13

31 Jan '13

Does anyone have any sort of performance numbers for the jnpr MX10 series running dual stack ipv4/ipv6? I'm specifically interested in how many BGP prefixes it can handle in dual stacked mode. I've got an environment currently taking 4 full ipv4 tables and a smattering of prefixes coming from a public peering exchange, and I'm curious what will happen if we move to dual stack... thanks! -chris

4 3

Will wholesale-only muni actually bring the boys to your yard?
by Jay Ashworth 31 Jan '13

31 Jan '13

----- Original Message ----- > From: "Jean-Francois Mezei" <jfmezei_nanog(a)vaxination.ca> > It is in fact important for a government (municipal, state/privince or > federal) to stay at a last mile layer 2 service with no retail > offering. Wholesale only. > > Not only is the last mile competitively neutral because it is not > involved in retail, but it them invites competition by allowing many > service providers to provide retail services over the last mile > network. This, Jean-Francois, is the assertion I hear relatively frequently. It rings true to me, in general, and I would go that way... but there is a sting in that tail: Can I reasonably expect that Road Runner will in fact be technically equipped and inclined to meet me to get my residents as subscribers? Especially if they're already built HFC in much to all of my municipality? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

9 17