March 2014 - Test - lists.nanog.org

Outgoing traffic problem on Citrix Netscaler Load Balancer
by Anil KARADAG 02 Apr '14

02 Apr '14

Hi, I setup a netscaler load balancer for sip traffic on Amazon EC2. Clients packets are arrived to the backend servers over to the load balancer but any responses cannot be arrived to clients. I see the responses on the load balancer. I think there is a config problem for that but I don't know and did not find any solution for that. How can I fix the outbound traffic issue. thanks Bu e-posta mesaj? ve ekleri g?nderildi?i ki?i ya da kuruma ?zeldir ve gizlidir. Ayr?ca hukuken de gizli olabilir. Hi?bir ?ekilde ???nc? ki?ilere a??klanamaz ve yay?nlanamaz. E?er mesaj?n g?nderildi?i al?c? de?ilseniz bu elektronik postan?n i?eri?ini a??klaman?z, kopyalaman?z, y?nlendirmeniz ve kullanman?z kesinlikle yasakt?r ve bu elektronik postay? ve eklerini derhal silmeniz gerekmektedir. NETA? TELEKOM?N?KASYON A.?. bu mesaj?n i?erdi?i bilgilerin do?rulu?u veya eksiksiz oldu?u konusunda herhangi bir garanti vermemektedir. Bu nedenle bu bilgilerin ne ?ekilde olursa olsun i?eri?inden, iletilmesinden, al?nmas?ndan, saklanmas?ndan ve kullan?lmas?ndan sorumlu de?ildir. Bu mesajdaki g?r??ler g?nderen ki?iye ait olup, NETA? TELEKOM?N?KASYON A.?.'nin g?r??lerini yans?tmayabilir. ------------------------------------------------------- This e-mail and its attachments are private and confidential and intended for the exclusive use of the individual or entity to whom it is addressed. It may also be legally confidential. Any disclosure, distribution or other dissemination of this message to any third party is strictly prohibited. If you are not the intended recipient you are hereby notified that any dissemination, forwarding, copying or use of any of the information is strictly prohibited, and the e-mail should immediately be deleted. NETA? TELEKOM?N?KASYON A.?. makes no warranty as to the accuracy or completeness of any information contained in this message and hereby excludes any liability of any kind for the information contained therein or for the transmission, reception, storage or use of such information in any way whatsoever. The opinions expressed in this message are those of the sender and may not necessarily reflect the opinions of NETA? TELEKOM?N?KASYON A.?.

5 10

3356 leaking routes out 3549 lately?
by David Hubbard 31 Mar '14

31 Mar '14

Has anyone had issues with Level 3 leaking advertisements out their Global Crossing AS3356 for customers of 3549, but not accepting the traffic back? We've been encountering this more and more recently, bgpmon always detects it, and all we ever get from them is there's nothing wrong. Today it affected CloudFlare's ability to talk to us. It seems to happen mostly with Europe and Asian peering points. Typically lasts five to ten minutes which makes me think someone working on merging the two networks is doing some 'no one will notice this' changes in the middle of the night. David

5 4

misunderstanding scale (was: Ipv4 end, its fake.)
by TJ 31 Mar '14

31 Mar '14

Millions of IPs don't matter in the face of X billions of people, and XX-XXX billions of devices - and this is just the near term estimate. (And don't forget utilization efficiency - Millions of IPs is not millions of customers served.) Do IPv6. /TJ On Mar 22, 2014 3:09 AM, "Bryan Socha" <bryan(a)digitalocean.com> wrote: > > As someone growing in the end of ipv4, its all fake. Sure, the rirs will > run out, but that's boring. Don't believe the fake auction sites. > Fair price of IP at the end is $1 for bad Rep $2 for barely used, $3 for no > spam and $4 for legacy. Stop the inflation. Millions of IPS exist, > there is no shortage and don't lie for rirs with IPS left.

70 316

Re: why IPv6 isn't ready for prime time, SMTP edition
by Larry Sheldon 31 Mar '14

31 Mar '14

On 3/30/2014 11:17 PM, Patrick W. Gilmore wrote: > On Mar 30, 2014, at 16:40 , Måns Nilsson <mansaxel(a)besserwisser.org> wrote: >> Subject: Re: why IPv6 isn't ready for prime time, SMTP edition Date: Sat, Mar 29, 2014 at 11:06:11AM -0400 Quoting Patrick W. Gilmore (patrick(a)ianai.net) >>>> On Mar 29, 2014, at 3:15, Måns Nilsson <mansaxel(a)besserwisser.org> wrote: >>>> Quoting John R. Levine (johnl(a)iecc.com) >>>>>> Ergo, ad hominem. Please quit doing that. >>>>>> As a side note I happen to run my own mail server without spam filters >>>>>> -- it works for me. I might not be the norm, but then again, is there [snip] > However, I think you'll find your definition of "undue" and most of the rest of the Internet's is vastly different. > Seems like I got chased off of NANOG for less, in years gone by....... -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Can I borrow some MTA address traces?
by John R. Levine 30 Mar '14

30 Mar '14

As noted about a zillion messages ago, one of the concerns about IPv6 mail is whether DNSBLs will be workable, with one of the questions being whether the lookups will blow away DNS caches. As far as I can tell, there is basically no research on DNS cache behavior other than a few very old papers that said for normal loads, a reasonable sized cache is big enough to work. For the DNSBL stuff I'm doing some simulations, which need data to drive the lookups. The data is really simple, a sequence of pairs: [ IP address, timestamp ] IPv4 traces are currently more useful than IPv6, since v6 doesn't have the botnet traffic that makes the DNSBL lookups interesting. Traces from medium sized systems, say a million connections a day, would be great. If you consider the IP addresses confidential you can hash them, although real ones would be better so I can test tweaks that treat known high volume senders (gmail etc.) differently. Thanks. Regards, John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. http://jl.ly PS: I hope it's OK if we take a break from reinventing patented anti-spam techniques that have failed repeatedly before to talk about something else.

1 0

Re: why IPv6 isn't ready for prime time, SMTP edition
by Larry Sheldon 30 Mar '14

30 Mar '14

On 3/29/2014 12:59 PM, Jimmy Hess wrote: > *Postage schemes as proposed with end users email clients 'attaching > postage' simply not workable Not in IPv4. Not in IPv6. Not in IPng > Not in any conceivable future version of IP. And I insist that we are all wasting our time trying to make SMTP and its supporting protocols (and their kin under IPX/SPC, Sperrylink, UUCP, et alia) are not at the transport layer and nothing at the transport layer is responsible for nor rich with solutions for their problems. IF the overriding problem is due to an inability to identify and authenticate the identification of the sender, then let us work on establishing a protocol for identifying the sender and authenticating the identification of the sender and permitting the receiver to accept or deny acceptance of traffic by reference to that identification. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

4 3

Re: Cisco Security Advisory
by Scott Weeks 29 Mar '14

29 Mar '14

--- rdrake(a)direcpath.com wrote: From: Robert Drake <rdrake(a)direcpath.com> because seeing 5 advisories at once is like a giant line break in NANOG discussions, so it's harder to tune it out and skip the emails :) They could Bcc: all the lists they are sending to in one set of emails so the message-id is the same, then you could filter duplicates at least. Or they could do the summary email like you guys want, whichever makes people happy. :) ------------------------------------------------------------ You got 5 (actually 6 this time) perhaps because you're only on NANOG. I got over 30 this time and once when there were 9 vulnerabilities I got almost 50 emails from cisco. scott

3 2

Re: Cisco Security Advisory
by Larry Sheldon 29 Mar '14

29 Mar '14

On 3/29/2014 12:43 AM, Mark Tinka wrote: > But clearly, this is one of those issues where you have a > good amount of folk on either side of the fence. I wonder what the ratio of "I don't want that info here" (for various values of "here") to "Geeeeeez! WHY didn't somebody tell me" is. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Re: Cisco Security Advisory
by Scott Weeks 29 Mar '14

29 Mar '14

On 3/27/2014 7:44 PM, Alexander Neilson wrote: > I wonder if they should be invited to only post a single message with > the titles and links to the alerts so that people can follow it up. ---------------------------------------------------------- If a person is on multiple of *NOG mailing lists a lot of these're received. For example, I got well over 30 of them this round. It'd be nice to get something brief like this: ---------------------------------------------- The Semiannual Cisco IOS Software Security Advisory has been released. For information please goto this URL: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar14.html Advisory titles: - Session Initiation Protocol Denial of Service Vulnerability - Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks Denial of Service Vulnerability - Internet Key Exchange Version 2 Denial of Service Vulnerability - Network Address Translation Vulnerabilities - SSL VPN Denial of Service Vulnerability - Crafted IPv6 Packet Denial of Service Vulnerability ----------------------------------------------- Not everyone uses cisco and not everyone needs to see every vulnerability detail email multiple times. Imagine if all vendors started doing what cisco is doing. :-( scott

2 1

Re: ARIN board accountability to network operators (was: RE: [arin-ppml] [arin-discuss] Term Limit Proposal)
by Randy Bush 28 Mar '14

28 Mar '14

john, i think your attemt to move the discussion to the arin ppml list exemplifies one core of the problem. this is not about address policy, but arin thinks of itelf as a regulator not a registry. contrast with the ripe community and the ncc, which is not nirvana but is a hell of a lot better. among other key differences, the ncc is engaged with the community through technical and business working groups. e.g. the database working group covers what you think of as whois and the routing registry. the wg developed the darned irr definition and continues to evolve it. consequence? the irr is actively used in two regions in the world, europe and japan (which likes anything ocd:-). the routing wg works with the ops to develop routing technology such as route flap damping. there is a reason that serious ops attend ripe meetings. yes, a whole lot of folk with enable are engaged. for years there has been a wg on the global layer nine issues. the dns wg deals with reverse delegation, root server ops, etc. and guess what, all the dns heavy techs and ops are engaged. there is a wg for discussing what services the ncc offers. the recent simplification and opening of services to legacy and PI holders happened in the ncc services wg, it was about services not addressing policy. and this is aside from daniel's global measurement empire. not sure it is a registry's job to do this, but it is a serious contribution to the internet. the ncc is engaged with its community on the subhects that actually interest operators and affect our daily lives. there is nothing of interest at an arin meeting, a bunch of junior wannabe regulators and vigilantes making an embarrassing mess. i've even taken to skipping nanog, if ras talks i can watch the recording. all the cool kids will be in warsaw. ops vote with our feet. randy

12 19