May 2014 - Test - lists.nanog.org

NAT (PAT) log
by Pavel Dimow 08 May '14

08 May '14

Hello, as we are running out of ipv4 addresses we started to think of dual stack deployment in our network and that means we will soon need to have some NAT in place (NAT44).However I am curios to find how do you manage NAT logs? Considering the fact that we will need to use overload for pools I don't see any good solution how to track ip address leases. Any ideas?

2 1

Re: US patent 5473599
by Henning Brauer 08 May '14

08 May '14

* Eygene Ryabinkin <rea(a)grid.kiae.ru> [2014-05-08 11:12]: > Henning, > Thu, May 08, 2014 at 09:35:00AM +0200, Henning Brauer wrote: > > * Blake Dunlap <ikiris(a)gmail.com> [2014-05-08 03:19]: > > > Except for that whole mac address thing, that crashes networks... > > this lie doesn't get any more true by repeating them over and over. > So, you insist that VRRP and CARP instances with the same VRID/VHID in > the same L2 segment will coexist peacefully? I had seen problems with > such setup, so if you can enlighten me how to overcome them (rather > than saying "you must choose different VRID/VHID") -- it will be very > good. you shouldn't see issues but log spam. I haven't seen anotehr issue and I haven't seen a single report claiming otherwise over the last 10 years either, minus the mentioned cisco 3600 "don't bother checking the version number field before parsing on" screwup. -- Henning Brauer, hb(a)bsws.de, henning(a)openbsd.org BS Web Services GmbH, AG Hamburg HRB 128289, http://bsws.de Full-Service ISP - Secure Hosting, Mail and DNS Services Dedicated Servers, Rootservers, VMs/PVS, Application Hosting

3 4

Does Telus traffic shape their DSL or Fibre subscribers at all?
by Landon 08 May '14

08 May '14

Hello, Before I go chasing this down does Telus traffic shape their DSL or Fibre subscribers? Customer using 50Mbps fiber gets excellent speeds on speedtest.net but looks like http and ssh (scp) transfers are capped at 1MBps (not 1Mbps) for non-popular hosts but uncapped for popular hosts. Just a hunch. Thank you for reading. -- Landon Stewart <LandonStewart(a)Gmail.com>

2 1

AWS Outage
by Blair Trosper 07 May '14

07 May '14

Can someone from AWS contact me off-list? You have an entire availability zone completely offline at us-east-1 that hasn't been detected, and it's been down for 20 minutes.

1 0

Residential CPE suggestions
by Deepak Jain 07 May '14

07 May '14

Any recommendation for a residential CPE that supports dual SFP uplinks (WAN) with either a routing protocol or a resilient Ethernet solution? Ideally, LAN port should be 100/1000 CAT5. I've looking at Mikrotik, Draytek and others. Looking something in a lower three-digit price point. Otherwise I might have to do a pair of media converters on a copper switch/router that can do it (ugly!). Thanks in advance! DJ

8 9

Reviewers needed: How Internet Peering Improves Security
by wbn 07 May '14

07 May '14

Hi fellow NANOGers - I recently spent some time with peering coordinators at industry events (NANOG, EPF, AFPIF, UKNOF, etc.) where I asked “How does Internet Peering affect Internet Security?” The result of this exercise is a white paper, currently in its draft 4-page form, entitled “How Internet Peering Improves Security.” What I need now are a handful of people that are interested in this subject and willing to let me talk through the draft in order to solicit direct feedback. If interested, please send email to wbn(a)DrPeering.net with subject: "Review How Internet Peering Improves Security" and I will reach out to schedule some time. Thanks in advance - Bill PS - Here is the abstract to help you decide if you are interested in helping me document this for the community, and yes, as usual, I will be happy to share the resulting white paper with anyone interested. How Internet Peering Improves Security William B. Norton <wbn(a)DrPeering.net> Abstract Denial-of-Service attacks continue to flood the Internet at increasing scale. They attack specific targets, while, as a side affect, disrupt any traffic that traverses the network attack paths. During these attacks, impacted Internet users may experience intermittent problems, such as video freeze frames, garbled audio during phone or Skype calls, or error messages indicating that their Internet cloud service is unavailable. The ubiquitous and open nature of the Internet is both its value and its downfall. All one needs for access to cloud storage systems (DropBox, Box.net, etc.) is an Internet connection. This also means that attackers need only a few thousand broadband computers, infected with viruses and taken over as zombies, to exploit this open Internet ecosystem and overwhelm even the most robust Internet services. The attacks are not predictable in time, scope, or scale, and the impacts are far reaching, well beyond the source and destinations of the attacks. For these reason, the commodity Internet may not suitable for a subset of Internet applications. For example, some enterprise mission-critical applications require consistency simply unavailable from today’s Internet Transit services. There is however a well-known interconnection approach that improves this situation: an interconnection technique call “Internet Peering.“ This paper will introduce Internet Peering and discuss how Internet security is improved simply by using this common interconnection technique.

2 1

Anternet
by Larry Sheldon 07 May '14

07 May '14

Offered for your amusement--no followup. http://kottke.org/14/04/the-anternet -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

11 10

Re: US patent 5473599
by Johnny Eriksson 07 May '14

07 May '14

Jared Mauch <jared(a)puck.nether.net> wrote: > > Your point being? > > That the "BSD" community sometimes doesn't play well with others, > and certainly won't fess up when they make a mistake and cause > collateral damage. The "BSD" community is larger than OpenBSD, and larger than Theo's ego, much to said persons disappointment. There are other BSDs out there. > - Jared --Johnny

1 0

RE:Getting pretty close to default IPv4 route maximum for 6500/7600 routers.
by Darin 06 May '14

06 May '14

And since those puppies are going to need a reload after adjustment make sure your not exposed to the component decay issue for cards manufactured between 2005-2010 or you could have a interesting night. We've hit that issue on three different 7600 chassis. Darin -----Original Message----- From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of Drew Weaver Sent: Tuesday, May 06, 2014 10:39 AM To: 'nanog(a)nanog.org' Subject: Getting pretty close to default IPv4 route maximum for 6500/7600 routers. Hi all, I am wondering if maybe we should make some kind of concerted effort to remind folks about the IPv4 routing table inching closer and closer to the 512K route mark. We are at about 94/95% right now of 512K. For most of us, the 512K route mark is arbitrary but for a lot of folks who may still be running 6500/7600 or other routers which are by default configured to crash and burn after 512K routes; it may be a valuable public service. Even if you don't have this scenario in your network today; chances are you connect to someone who connects to someone who connects to someone (etc...) that does. In case anyone wants to check on a 6500, you can run: show platform hardware capacity pfc and then look under L3 Forwarding Resources. Just something to think about before it becomes a story the community talks about for the next decade. -Drew

2 1

linkedin.com abuse admins around?
by goemon＠anime.net 06 May '14

06 May '14

If there is anyone from linkedin.com abuse around please let me know. I've been trying for 2 months to get an abuse issue resolved. -Dan

4 3