November 2017 - Test - lists.nanog.org

Juniper QFX5100 VLAN flood input filter doesn't work
by Stanislaw 07 Nov '17

07 Nov '17

Hello, list (again), I've been trying to use VLAN BUM traffic filter on QFX5100. The configuration on the test VLAN was quite trivial: Model: qfx5100-48s-6q Junos: 17.2R2.8 # show vlans Testvlan vlan-id 4030; forwarding-options { filter { input Testvlan-ingress; } flood { input Testvlan-flood; } } I connected two linux hosts to the test VLAN: # show interfaces ge-0/0/42 unit 0 { family ethernet-switching { vlan { members Testvlan; } } } # show interfaces ge-0/0/43 unit 0 { family ethernet-switching { vlan { members Testvlan; } } } The firewall filter wwas quite simple: # show firewall family ethernet-switching filter Testvlan-ingress term accept { then accept; } The flood input filter I was trying to use. According to the documentation, only Broadcast, Unknown unicast and Multicast (BUM) traffic goes here. The regular unicast traffic should be left intact by it. # show firewall family ethernet-switching filter Testvlan-flood term allow_arp { from { ether-type arp; } then accept; } term allow_ipv6_ns { from { destination-mac-address { 33:33:ff:00:00:00/24; } ether-type 0x86dd; } then accept; } term discard_all { then discard; } I started hosts to ping (and snif) each other.. And I saw only ARP requests/responses. "show ethernet-switching table" displayed that both hosts MAC were successfully learned, thus traffic between them should be considered as regular unicast. However, the last term in Testvlan-flood filter was blocking it. If I replace it with "accept" - traffic begins to flow. Are any Juniper QFX gurus here? I would really appreciate some advice.

1 0

Re: Network nerd poker night 11/8 in Seattle
by Miles Fidelman 07 Nov '17

07 Nov '17

Doesn't anybody play real poker any more? You know, 5 card draw, 7 card stud. Oh for a good game of high-stakes 7 card high-low stud. Miles Fidelman -------- Original message --------From: Gordon Cook <cook(a)cookreport.com> Date: 11/7/17 2:08 PM (GMT-07:00) To: Avi Freedman <freedman(a)freedman.net> Cc: "nanog(a)nanog.org list" <nanog(a)nanog.org> Subject: Re: Network nerd poker night 11/8 in Seattle Hi Avi long time no talk regards Gordon > On Nov 7, 2017, at 3:22 PM, Avi Freedman <freedman(a)freedman.net> wrote: > > > If there are any network+poker nerds in the Seattle area tomorrow, we have 5 seats left at a network nerd poker night I'm hosting tomorrow night. > > Attendees are from cloud, content provider, hosting, infra services, travel, and SaaS analytics industries. > > We'll have food, drinks, a training session, and will be running ~3 single-table No Limit Texas Hold'em tournaments. > > If there's time/interest afterwards I may also initiate anyone interested into the wonders of Pot Limit Omaha. > > Prizes will be Bose head sets, to avoid corporate gift issues with playing for or awarding $. > > It's at the W Hotel in Bellevue, at 6pm tomorrow night. > > The focus is poker, socializing, and free-form network tech, business, and policy nerd discussions. Travel and gadget geeking allowed as well. Kentik is sponsoring the space, tables, and professional dealers, and we'll have a < 5 minute sponsor presentation. > > RSVP / info @ https://www.greenvelope.com/viewer/?ActivityCode=.public:ab155c3532ca4bd5ad… > > If it overflows we'll cut off RSVPs at the URL and/or let people know by email. > > We're also going to organize to do another in Seattle in Feb and larger ones in NY and the Bay area in Q1, so if you have interest or ideas for format or quick content topics we could cover, please let me know. One thing we're considering is adding a table for heads-up battles - participants to decide if they want to add peering as part of the stakes. > > Thanks, > > Avi >

1 0

Juniper MX80 strange dst MAC address behavior
by Stanislaw 07 Nov '17

07 Nov '17

Today I was investigating strange unknown unicast traffic in LAN of IX which I operate. It was about 200 kbps of constant unknown unicast load. Unknown unicast is a rare ocasion in IX LAN as participants MAC addresses are almost persistent. I added a server in the vlan and started sniffing: all the unicast was coming from one participant MAC. One of the frames: XX:XX:XX:XX:ee:98 > 5e:5c:ab:31:c0:cb, ethertype IPv4 (0x0800), length 1434: XX.XX.16.30.80 > XX.XX.76.137.41934: Flags [.], seq 1619512599:1619513967, ack 3595347045, win 235, options [nop,nop,TS val 3650267181 ecr 1841068329], length 1368: HTTP Okay, destination MAC 5e:5c:ab:31:c0:cb isn't really in switches FDB table. I looked up the routing table and figured out that router announcing the bestpath for XX.XX.76.137 has MAC 5e:5e:ab:31:c0:cb. So customers sent a frame to: 5e:*5c*:ab:31:c0:cb The right address should be : 5e:*5e*:ab:31:c0:cb I tried next packet in dump, the same story: customer sends to: *90*:c6:9a:*e5*:2f:c1 right mac is : *b0*:c6:9a:*e4*:2f:c1 I converted differencing bytes to binary representation: 90: 10010000 b0: 10110000 e5: 11100101 e4: 11100100 I guess all the unknown unicast frames MAC addresses were having the same slightly difference from the right ones. So the router in general works fine (it has several gigabits of traffic in the IX) but sometimes it changes one or two bits in frame's destination MAC address. My guess it is caused by a large ARP table on customer's router. The router may have some tricky lookup algorithm preceding constant calculating speed over accuracy. I called their NOC, they said it is Juniper MX80 and also confirmed that it has more than 4k ARPs. Have anybody encountered with that kind of issue?

3 2

Network nerd poker night 11/8 in Seattle
by freedman＠freedman.net 07 Nov '17

07 Nov '17

If there are any network+poker nerds in the Seattle area tomorrow, we have 5 seats left at a network nerd poker night I'm hosting tomorrow night. Attendees are from cloud, content provider, hosting, infra services, travel, and SaaS analytics industries. We'll have food, drinks, a training session, and will be running ~3 single-table No Limit Texas Hold'em tournaments. If there's time/interest afterwards I may also initiate anyone interested into the wonders of Pot Limit Omaha. Prizes will be Bose head sets, to avoid corporate gift issues with playing for or awarding $. It's at the W Hotel in Bellevue, at 6pm tomorrow night. The focus is poker, socializing, and free-form network tech, business, and policy nerd discussions. Travel and gadget geeking allowed as well. Kentik is sponsoring the space, tables, and professional dealers, and we'll have a < 5 minute sponsor presentation. RSVP / info @ https://www.greenvelope.com/viewer/?ActivityCode=.public:ab155c3532ca4bd5ad… If it overflows we'll cut off RSVPs at the URL and/or let people know by email. We're also going to organize to do another in Seattle in Feb and larger ones in NY and the Bay area in Q1, so if you have interest or ideas for format or quick content topics we could cover, please let me know. One thing we're considering is adding a table for heads-up battles - participants to decide if they want to add peering as part of the stakes. Thanks, Avi

3 2

GO DADDY Person?
by Ilissa Miller 07 Nov '17

07 Nov '17

Is there a GoDaddy person on this list? There is a domain that has been created that is 100% a bot and need to flag it immediately. Already contacted GoDaddy directly but it is still active. Please contact me off list Thanks!

2 1

media are reporting "major Internet outage"
by Miles Fidelman 07 Nov '17

07 Nov '17

Folks, It seems like various media outlets are reporting a "major Internet outage" - some going so far as to call it an "attack." A few headlines that crossed Facebook today: "Major internet outage hits the U.S." (Mashable via AOL News) "Widespread Comcast internet outage across U.S. includes Massachusetts customers" (WHDH, Channel 7 News, Boston) A couple of more detailed sources reported that issues at L3 were effecting Comcast, specifically. Kind of interesting that there's been no mention here on nanog, nor have I personally noticed any issues (as a user or a hosting provider). Tempest in a teapot? Miles Fidelman -- In theory, there is no difference between theory and practice. In practice, there is. .... Yogi Berra

6 5

Re: media are reporting "major Internet outage"
by Scott Weeks 07 Nov '17

07 Nov '17

--- cb.list6(a)gmail.com wrote: From: Ca By <cb.list6(a)gmail.com> Outages go outage list https://puck.nether.net/pipermail/outages/2017-November/010952.html --------------------------------------- Be sure to use outages-discussion(a)outages.org for this one as outages(a)outages.org is just for reporting the initial problem. The list had a *major* "me too" blow up on this one. scott

2 1

someone from easydns here? dns3.easydns.org. 2620:49:3::10 unreachable from AS8560 and 6939
by Thomas Mieslinger 07 Nov '17

07 Nov '17

Hi, can someone operating easydns nameserver check whether 2620:49:3::10 is answering? I create a atlas measurement https://atlas.ripe.net/measurements/10137819 and I can see that some AS still can reach 2620:49:3::10 but many many timeouts. For me, it stops working after 2a00:dd80:9:3::2 (AS42210) Cheers Thomas

1 0

Need a contact at GoDaddy NOC
by Serge Malev 06 Nov '17

06 Nov '17

Hi. Could anyone from GoDaddy NOC, please, get in touch with me off list? One of our IP addresses is being blocked from accessing an address hosting some websites at Godaddy. Even GoDaddy's support and SSO sites are blocked. Using a different IP address for outbound Source NAT makes things work. But we would like to figure out what caused blocking in the first place to make sure we stop it happening in the future. Thank you.

1 0

Are there inexpensive DWDM products?
by LF OD 03 Nov '17

03 Nov '17

We have several buildings and a couple data centers spread around the city and interconnected via dark fiber. It's a very simple setup - no ROADM, no real ring, no extended layer-2 or layer-3 via the optical gear. Pretty much we just mux/demux a channel for each building so that each building sees the two data centers directly even though the fiber span may wind through a couple buildings along the way. In some cases, the distance is short enough to use colored optics in the network gear, but mostly the distances are just long enough to warrant transponder cards. All that being said, a lot of the gear is approaching end of life (support in some cases). I'm not an optical guru but I can muddle my way through with Cisco ONS and I'm aware that Ciena and Fujitsu also have similar products. We really don't have budget for a large optical refresh effort. However, we've saved some money here and there in the routing/switching arena by leveraging Arista and even Cumulus. I'm wondering if there are smaller players in the optical arena that have a good quality/price value? Again, we don't need sophisticated features... we primarily have 2-to-4 1Gb and 10Gb ports required per site, then we mux those onto a wavelength and extend it to the two data centers. Most buildings are set up the same way, each on a different wavelength so the don't even see each other... only the data centers. If you guys know of any optical gear that you can vouch for (and which costs less than a small house), we would greatly appreciate it. Thanks LFOD

12 13