November 2014 - Test - lists.nanog.org

Multi-port RFC2544/EtherSAM loopback appliance
by Jason Lixfeld 25 May '17

25 May '17

Group, I'm looking for options and opinions on a cost effective, multi-port (6'ish port SFP/SFP+) RFC2544/EtherSAM rack appliance that can act as the remote/loopback for our field installers' portable RFC2544/EtherSAM enabled Exfo test sets. I came across XenaNetworks XenaCompact which looks like it would fit the bill, but I'm sure there are others (save Ixia, Exfo and Fluke, which I'm pretty much excluding by default because I imagine they are likely completely out to lunch on price relative to the extremely simplified feature set we require). Thanks in advance.

5 4

Recommendations, Colo Reno, Albuquerque, Phoenix, Las Vegas
by Eric A Louie 21 Jun '16

21 Jun '16

Does anyone have recommendations for Colocation space in any of those 4 cities? thanks Eric

4 3

Public DNS64
by Tim Durack 01 Jun '16

01 Jun '16

Anyone know of a reliable public DNS64 service? Would be cool if Google added a Public DNS64 service, then I could point the NAT64 prefix at appropriately placed boxes in my network. Why? Other people are better than me at running DNS resolvers :-) -- Tim:>

10 21

common checks performed when passing on an IPv4 PA allocation from one end-customer to another
by Martin T 23 Feb '16

23 Feb '16

Hi, when one end-customer has been using for example /24 IPv4 allocation for a while and returns this(for example changes an ISP) to LIR, then are there some good practices before handing out this same /24 to a new customer? I guess LIR should: 1) remove all the DNS PTR records, classless of classful delegations 2) check if some of the IP addresses are in DNSBL(maybe the previous customer was a spammer). Example with 93.184.216.0/24: $ for ip in {0..255}.216.184.93;\ > do for addr in \ > cbl.abuseat.org \ > dnsbl.inps.de \ > no-more-funn.moensted.dk \ > dnsbl.sorbs.net \ > bl.spamcannibal.org \ > bl.spamcop.net \ > psbl.surriel.com \ > dnsrbl.swinog.ch; \ > do dig @8.8.8.8 "$ip"."$addr" +short | grep -q "^127.0.0." && \ > echo "DNSBL-Alarm: $ip is listed on $addr"; done; done $ Anything else? regards, Martin

2 4

Big day for IPv6 - 1% native penetration
by Tomas Podermanski 06 Jan '16

06 Jan '16

Hi, It seems that today is a "big day" for IPv6. It is the very first time when native IPv6 on google statistics (http://www.google.com/intl/en/ipv6/statistics.html) reached 1%. Some might say it is tremendous success after 16 years of deploying IPv6 :-) T.

87 261

VZW - fixed wireless services?
by Ryan Finnesey 20 Jun '15

20 Jun '15

Does anyone know if Verizon is using its LTE network to offer fixed wireless services? I know Sprint was working on WiMAX hardware with cisco but I assume that was canceled when Sprint started moving to LTE. Cheers Ryan

3 4

How are you doing DHCPv6 ?
by Randy Carpenter 02 Apr '15

02 Apr '15

I am wondering how people out there are using DHCPv6 to handle assigning prefixes to end users. We have a requirement for it to be a redundant server that is centrally located. DHCPv6 will be relayed from each customer access segment. We have been looking at using ISC dhcpd, as that is what we use for v4. However, it currently does not support any redundancy. It also does not do very much useful logging for DHCPv6 requests. Certainly not enough to keep track of users and devices. So, my questions are: How are you doing DHCPv6 with Prefix Delegation? What software are you using? When DHCPv6 with Prefix Delegation seems to be about the only way to deploy IPv6 to end users in a generic device-agnostic fashion, I am wondering why it is so difficult to find a working solution. thanks, -Randy -- | Randy Carpenter | Vice President - IT Services | Red Hat Certified Engineer | First Network Group, Inc. | (800)578-6381, Opt. 1 ----

13 37

Generating IPv6 list with filtergen.level3.net
by Smith, Courtney 28 Mar '15

28 Mar '15

Anyone out there know how to generate a IPv6 list Level3's filtergen? I tried Google but didn't find anything. () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments

4 4

New BCOPs in Progress
by Chris Grundemann 25 Mar '15

25 Mar '15

Hail NANOGers! As most of you hopefully know, NANOG now has a BCOP Ad Hoc Committee and we are pushing forward with new BCOPs! http://nanog.org/governance/bcop We currently have three BCOPs in active development: eBGP configuration, shepherd Bill Armstrong Public Peering Exchange update, shepherd Shawn Hsiao Ethernet OAM, shepherd Mark Calkins All three of these nascent BCOPs will be presented in the BCOP Track on Monday: http://nanog.org/meetings/abstract?id=2348 We have also collected a list of Appeals (BCOPs that need to be written): http://bcop.nanog.org/index.php/Appeals If you would like to help out with any of these BCOPs (or others yet to be identified) please join the BCOP mailing list and reach out to the shepherd (if applicable of course): http://mailman.nanog.org/mailman/listinfo/bcop Our committee is brand new and we are still finding and smoothing wrinkles, etc. We would love your help in any capacity. As a BCOP shepherd or SME or just to point out potential pit falls or room for improvement, with the process, the wiki, a BCOP or anything at all really. This is a bottom-up, community led effort and it will only succeed with your help - join us in creating what I believe will be a vital and long-lasting institution! Cheers, ~Chris -- @ChrisGrundemann http://chrisgrundemann.com

6 10

Re: DDOS, IDS, RTBH, and Rate limiting
by freedman＠freedman.net 28 Jan '15

28 Jan '15

> > Cisco ASRs and MXs with inline jflow can do hundreds of K flows/second > > without affecting packet forwarding. > > Yes, i agree,those are good for netflow, but when they already exist in > network. > > Does it worth to buy ASR, if L3 switch already doing the job > (BGP/ACL/rate-limit/routing)? Not suggesting that anyone should change out their gear though per my other message, I've seen SPAN make things go wonky on almost every vendor that ISPs use for switching. > Well, if it is available, except hardware limitations, there is second > obstacle, software licensing cost. On latest JunOS, for example on EX2200, > you need to purchase license (EFL), and if am not wrong it is $3000 for > 48port units. > > So if only sFlow feature is on stake, it worth to think, to purchase license, > or to purchase server. Prices for JFlow license on MX, just for 5/10G is way > above cost of very decent server. I believe that smaller MXs can run it for free. Larger providers we've worked with often have magic cookies they can call in to get it enabled, but I understand you're talking about the smaller-provider (or at least ~ 10gig per POP across multiple POPs) case. We see a lot of Brocade for switching in hosting providers, which makes sFlow easy, of course. > > And with the right setup you can run FastNetMon or other tools in > > addition to generating flow that can be of use for other purposes > > as well... > > Technically there is ipt_NETFLOW, that can generate netflow on same box, > for statistical/telemetry purposes. But i am not sure it is possible to > run them together. At frac 10gig you can just open pcap on a 10gig interface on a Linux box getting a tap, of course. What we did was use myricom cards and the myri_snf drivers and take from the single-consumer ring buffers into large in-RAM ring buffers, and make those ring buffers available via LD_PRELOAD or cli tools to allow flow, snort, p0f, tcpdump, etc to all be run at the same time at 10gig. The key for that is not going through the kernel IP stack, though. > > But taps can be difficult or at least time consuming for people to > > put in at scale. Even, we've seen, for folks with 10G networks. > > Often because they can get 90% of what they need for 4 different > > business purposes from just flow :) > > About scaling, i guess it depends on proper deployment strategy and > sysadmins/developers capabilities. For example to deploy new ruleset > for my pcap-based "homemade" analyser to 150 probes across the country - > is just one click. Sounds cool. You should write up that use case. Hopefully you've secured the metadata/command push channel well enough :) > Best regards, > Denys Avi Freedman | Your flow has something to show you; can you see it? | CEO, CloudHelix | (avi at cloudhelix dot com) | my name one word on skype |

5 6