May 2013 - Test - lists.nanog.org

Big day for IPv6 - 1% native penetration
by Tomas Podermanski 06 Jan '16

06 Jan '16

Hi, It seems that today is a "big day" for IPv6. It is the very first time when native IPv6 on google statistics (http://www.google.com/intl/en/ipv6/statistics.html) reached 1%. Some might say it is tremendous success after 16 years of deploying IPv6 :-) T.

87 261

How are you doing DHCPv6 ?
by Randy Carpenter 02 Apr '15

02 Apr '15

I am wondering how people out there are using DHCPv6 to handle assigning prefixes to end users. We have a requirement for it to be a redundant server that is centrally located. DHCPv6 will be relayed from each customer access segment. We have been looking at using ISC dhcpd, as that is what we use for v4. However, it currently does not support any redundancy. It also does not do very much useful logging for DHCPv6 requests. Certainly not enough to keep track of users and devices. So, my questions are: How are you doing DHCPv6 with Prefix Delegation? What software are you using? When DHCPv6 with Prefix Delegation seems to be about the only way to deploy IPv6 to end users in a generic device-agnostic fashion, I am wondering why it is so difficult to find a working solution. thanks, -Randy -- | Randy Carpenter | Vice President - IT Services | Red Hat Certified Engineer | First Network Group, Inc. | (800)578-6381, Opt. 1 ----

13 37

Generating IPv6 list with filtergen.level3.net
by Smith, Courtney 28 Mar '15

28 Mar '15

Anyone out there know how to generate a IPv6 list Level3's filtergen? I tried Google but didn't find anything. () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments

4 4

Blocking private AS
by Thomas Magill 27 Nov '13

27 Nov '13

I am thinking about implementing a filter to block all traffic with private AS numbers in the path. I see quite a few in my table though so I am concerned I might block some legitimate traffic. In some cases, these are just prefixes with the private appended to the end but a few have the private as a transit. Is this a good idea or would I likely be blocking too much legitimate traffic? The filter I am using currently shows the following: BGP table version is 5462394, local router ID is 209.112.253.4 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path * i58.68.109.0/24 x.x.x.x 0 100 0 6130 9498 10201 65534 i *> y.y.y.y 0 6130 9498 10201 65534 i * i68.115.224.0/24 x.x.x.x 0 100 0 6130 19151 20115 65011 i *> y.y.y.y 0 6130 19151 20115 65011 i * 85.112.22.0/24 y.y.y.y 0 6130 6939 23148 64532 64532 64532 64532 64532 64532 64532 64532 64532 i *> 93.189.194.0/24 y.y.y.y 0 6130 3549 39386 39386 39386 25233 65000 47146 i * i x.x.x.x 0 100 0 6130 3549 39386 39386 39386 25233 65000 47146 i *> 96.60.243.0/24 y.y.y.y 0 6130 2828 4181 65528 i * i x.x.x.x 0 100 0 6130 2828 4181 65528 i * i96.61.232.0/24 x.x.x.x 0 100 0 6130 2828 4181 65527 i *> y.y.y.y 0 6130 2828 4181 65527 i * i96.61.233.0/24 x.x.x.x 0 100 0 6130 2828 4181 65527 i *> y.y.y.y 0 6130 2828 4181 65527 i * i96.61.234.0/24 x.x.x.x 0 100 0 6130 2828 4181 65527 i *> y.y.y.y 0 6130 2828 4181 65527 i *> 148.207.2.0/24 y.y.y.y 0 6130 2828 3257 16531 13579 65090 i * i x.x.x.x 0 100 0 6130 2828 3257 16531 13579 65090 i *> 148.207.40.0/24 y.y.y.y 0 6130 2828 3257 16531 13579 65090 i * i x.x.x.x 0 100 0 6130 2828 3257 16531 13579 65090 i *> 148.207.97.0/24 y.y.y.y 0 6130 2828 3257 16531 13579 65090 i * i x.x.x.x 0 100 0 6130 2828 3257 16531 13579 65090 i * 170.34.100.0/24 y.y.y.y 0 6130 19151 20115 65011 ? * 170.34.104.0/24 y.y.y.y 0 6130 19151 20115 65011 ? * 170.34.113.0/24 y.y.y.y 0 6130 19151 20115 65011 ? * i174.35.1.0/24 x.x.x.x 0 100 0 6130 16467 64565 i * i174.47.199.0/24 x.x.x.x 0 100 0 6130 2828 4323 15065 65123 i *> y.y.y.y 0 6130 2828 4323 15065 65123 i * i192.109.61.0 x.x.x.x 0 100 0 6130 19151 20115 65011 i *> y.y.y.y 0 6130 19151 20115 65011 i *> 196.216.249.0 y.y.y.y 0 6130 2828 3257 8513 8513 8513 36881 65000 36896 37062 i * i x.x.x.x 0 100 0 6130 2828 3257 8513 8513 8513 36881 65000 36896 37062 i Network Next Hop Metric LocPrf Weight Path *> 209.172.69.128/30 y.y.y.y 0 6130 16467 64565 i * i x.x.x.x 0 100 0 6130 16467 64565 i *> 213.146.161.0 y.y.y.y 0 6130 2828 174 64679 48493 i * i x.x.x.x 0 100 0 6130 2828 174 64679 48493 i Thomas Magill Network Engineer Office: (858) 909-3777 Cell: (858) 869-9685 mailto:tmagill@providecommerce.com <mailto:tmagill@providecommerce.com> provide-commerce 4840 Eastgate Mall San Diego, CA 92121 ProFlowers <http://www.proflowers.com/> | redENVELOPE <http://www.redenvelope.com/> | Cherry Moon Farms <http://www.cherrymoonfarms.com/> | Shari's Berries <http://www.berries.com/>

3 2

Network topology
by Colin Alston 15 Nov '13

15 Nov '13

Hi all I'm considering trying to come up with some means to automatically detect a networks topology and draw pretty pictures. This is somewhat boring though if a network isn't well arranged with VLANs and q-tag trunk routers and so on (It will just look like a big cloud of junk connected off an assumed switch). Is there any kind of cunning trick to detect standard layer2 switches along a path without stuff like STP?

9 12

NFSen plugin - ddd
by Andrew Jones 29 Oct '13

29 Oct '13

Hi All, Does anyone have a copy of the DDoS detection plugin for NFSen called ddd that they could send to me? According to a blog article [1] I read, it used to be available at [2]. It's not there, and I haven't had any luck trying to track it down the usual ways. If anyone is able to provide a copy, I'd appreciate it. Thanks, Jonesy [1] http://www.ccieflyer.com/2010-01-JasonRowley.php [2] http://www.synacknetworks.com/ddd/ddd.zip

3 3

Re: Open Resolver Problems
by Jay Ashworth 13 Jul '13

13 Jul '13

----- Original Message ----- > From: "Roland Dobbins" <rdobbins(a)arbor.net> > On Apr 1, 2013, at 11:18 PM, Patrick W. Gilmore wrote: > > Of course, since users shouldn't be using off-net name servers > > anyway, this isn't really a problem! :) > > ;> > > It's easy enough to construct ACLs to restrict the broadband consumer > access networks from doing so. Additional egress filtering would catch > any reflected attacks, per your previous comments. So, how would Patrick's caveat affect me, whose recursive resolver *is on my Linux laptop*? Would not that recursor be making queries he advocates blocking? Or don't I remember DNS well enough? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

16 27

What are y'all doing for CALEA compliance?
by Ben Bartsch 05 Jul '13

05 Jul '13

What are you RENs out there doing for CALEA compliance? Is there actually any teeth to the law? Our systems guys have tried a product called 'Open CALEA' but the router and the server simply can't keep up with mirroring from a 10Gbps connection into a 1Gbps link. I'm no legal expert either....any lawyers on this list? Thanks for all the great advice. This is a great community! -ben

6 10

peeringdb accuracy research
by Job Snijders 13 Jun '13

13 Jun '13

Dear fellow networkers, I need your help! For the good of PeeringDB I am researching the accuracy of the current PeeringDB data set. We plan to compare three sources of information: peeringdb itself, publicly available listings from IXP operators ... and the ultimate source of truth: user submitted information, e.g. your "show bgp sum". Why? I'd rather trust 10 sightings in the wild than one entry in PeeringDB! :-) What can you do? ---------------- We've created a webapp where you can copy + paste the output from your routers' show ip bgp sum / show bgp sum / show ipv6 bgp sum. The webapp extracts the ASN and remote IP for the sessions and store those after your confirmation. Go to the following URL and submit your BGP data now! https://research.peeringdb.com/ If you prefer, you can also submit the data in CSV format [2]. What data are we using, exactly? -------------------------------- Only the following tuples of information are used: (remote_ASN, remote_IP) All other data is purged from the data set: I don't care if you are even exchanging prefixes or how many, nor does it matter what your own ASN is. The _only_ thing that matters is that you confirm that you have a BGP session up and running with a certain remote IP and ASN. You can submit such confirmations by copying + pasting your routers' bgp summaries. Please submit your BGP summaries from all your IXP facing routers! So when will I hear back about this? ------------------------------------ I will present the findings at the upcoming NANOG meeting in New Orleans [1]. Given that the NANOG meeting is approaching rapidly, I urge you to submit your data sooner rather than later. :-) Kind regards, Job Snijders [1] - CSV format should be formatted like column 1: ASN, column 2: remote IP, separated by a comma. example: "5580,195.69.144.229" [2] - http://www.nanog.org/meetings/abstract?id=2140

2 2

[NANOG 58] Final agenda posted and late registration - See you in New Orleans!
by David Temkin 07 Jun '13

07 Jun '13

All- The final agenda for NANOG 58 has been posted at: http://www.nanog.org/meetings/nanog58/agenda Also of note, Standard Registration ends on May 30 - the price will then go up $75. We encourage you to register now and lock in the few remaining hotel rooms at http://www.nanog.org/meetings/nanog58/registration This meeting will follow the new Monday-Wednesday format of tutorials beginning Monday morning, a Newcomers Lunch, and then General Sessions beginning in the early afternoon. The program will conclude with the Peering Track and then a social on Wednesday night. Looking forward to seeing everyone in The Big Easy! Regards, -Dave Temkin Chair, NANOG Program Committee

3 2