- Test - lists.nanog.org

internet peering conferences in Asia Pacific
by Krishnan Subramanian 14 Feb '14

14 Feb '14

Does anyone know what is the equivalent or similar conference / organization for Internet operators in Asia Pacific? Thanks, Krishnan

11 13

Re: ARIN Wants Your Feedback
by Randy Bush 14 Feb '14

14 Feb '14

the survey questions are highly biased toward arin's view of itself. just one example. you ask how well arin serves it's members and customers. you do not ask how well it serves the internet community, the internet, or society in general. and that particular bias in viewpoint is at the core of arin's failure. randy

5 5

Question on Route-Set for Arin DB
by Joseph Jenkins 14 Feb '14

14 Feb '14

So the Routing Database is something that I am just learning about and trying to find out if I need to create a Route-set or not. I just created my MNTNER ID and I also created the Route Objects for my two /24s that were given to my by my carriers. Do I need a route-set or aut-num object created? Still trying to get my head wrapped around the need for this. I read through this tutorial: http://www.nanog.org/meetings/nanog51/presentations/Sunday/NANOG51.Talk34.N… and didn't get a really clear idea as to if I needed these. TIA, Joe

4 3

Wide BGP Communities update (-04) - input solicited
by Jeffrey Haas 13 Feb '14

13 Feb '14

The authors of the Wide BGP Communities Internet-draft would like to solicit your feedback on the current version of the draft. The intended purpose of the feature is to provide for next-generation BGP communities. Why "next-generation"? A few motivations: - BGP Path Attribute code space is limited. We want to stop burning new code points for such features when the underlying "mark a route" behavior is the same. - Each time we add something with new encoding, we get deployment lag from needing new code to handle it. - While it's done the job for a number of years, existing communities force operators to go through a lot of convoluted policy to do anything from very common things to subtle things. The accompanying use case document will be updated soon, but not prior to the upcoming IETF. Most of our attention the last few weeks has been on getting the details of the encoding right. In recognition to a very common use case desired here, note Section 5. A wide community is being registered with no further semantics than "here's a list of AS numbers". This permits the desired AS4:AS4 semantic. -- Jeff ----- Forwarded message from internet-drafts(a)ietf.org ----- Date: Thu, 13 Feb 2014 12:55:54 -0800 From: internet-drafts(a)ietf.org To: i-d-announce(a)ietf.org Subject: I-D Action: draft-raszuk-wide-bgp-communities-04.txt A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : Wide BGP Communities Attribute Authors : Robert Raszuk Jeffrey Haas Andrew Lange Shane Amante Bruno Decraene Paul Jakma Richard A Steenbergen Filename : draft-raszuk-wide-bgp-communities-04.txt Pages : 24 Date : 2014-02-13 Abstract: Route tagging plays an important role in external BGP [RFC4271] relations, in communicating various routing policies between peers. It is also a very common best practice among operators to propagate various additional information about routes intra-domain. The most common tool used today to attach various information about routes is through the use of BGP communities [RFC1997]. Such information is important to allow BGP speakers to perform some mutually agreed actions without the need to maintain a separate offline database for each tuple of prefix and associated set of action entries. This document defines a new encoding which will enhance and simplify what can be accomplished today with the use of BGP communities. The most important addition this specification makes over currently defined BGP communities is the ability to specify, carry as well as use for execution an operator's defined set of parameters. It also provides an extensible platform for any new community encoding needs in the future. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-raszuk-wide-bgp-communities/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-raszuk-wide-bgp-communities-04 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-raszuk-wide-bgp-communities-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ I-D-Announce mailing list I-D-Announce(a)ietf.org https://www.ietf.org/mailman/listinfo/i-d-announce Internet-Draft directories: http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt ----- End forwarded message -----

1 0

Tail-F NCS? (Or similar network configuration management.)
by Tim Durack 13 Feb '14

13 Feb '14

Looking for real-world experience with Tail-f NCS (or similar network configuration management.) Not looking for rancid, we have a homebrew config collection that works well. Looking for something significantly better than I can write myself. Not looking for sales either, I have people for that :-) On/off list is fine. -- Tim:>

1 0

7206 VXR NPE-G1 throughput
by Vlade Ristevski 13 Feb '14

13 Feb '14

We are looking to double the bandwidth on one of our circuits from 300Mbps to 600Mbps. We currently use a Cisco 7206VXR with an NPE-G1 card. These seem like very popular routers so I'm hoping a few people on this list have them deployed. If you or a customer have these deployed, how much bandwidth have you seen them handle? This will be handling dorm traffic at a college so it's mostly download. The 7206 handles our 300 Mbps circuit just fine, but we are moving it to our 600Mbps circuit. At peak we've seen the following numbers for that circuit: 30 second input rate 559982000 bits/sec, 55809 packets/sec 30 second output rate 55429000 bits/sec, 32598 packets/sec 267756984712 packets input, 333325152556755 bytes, 0 no buffer This is the interface that connects to our provider. As you can see its almost all download traffic. Our ASR1002 handles it without a sweat but I'm a little skeptical of whether the 7206 will hold up. Answers on and off list are appreciated. Thanks, -- Vlad

16 35

SIP on FTTH systems
by Jean-Francois Mezei 13 Feb '14

13 Feb '14

Quick question: I am thinking in a possible wholesale FTTH environment operated by a telco where the end user is connected to ISP-X via PPPoE. ONTs have built-in ATAs that can provide POTS service to a house and do SIP/VoIP over the fibre with QoS system to ensure VoIP traffic gets through. In a scenario where the data PPPoE connection is done by an external router, what are the options to operate the VoIP service so that - VoIP still uses the special lane on the GPON with QoS - VoIP gets IP from ISP-X and traffic flow via ISP-X so that telco is not involved in routing such traffic or allocating an IP address ? Is the only option to program the ONT to establish its own PPPoE session to the ISP that carries only SIP traffic (and can such a setup make use of the special "lane" reserved for VoIP traffic ? on the gPON system ?) What other scenarios exist ? In normal incumbent-only FTTH systems, does the OLT provision a special IP to the ATA via DHCP and intercepts that traffic to hand off to a local SIP server and never touches the internet ? In the USA, do CLECs have access to homes served only by FTTH ? If so, how it is accomplisehd ?

9 55

Blocking of domain strings in iptables
by Anurag Bhatia 12 Feb '14

12 Feb '14

Hello everyone I am trying to figure out the way to drop a domain name DNS resolution before it hits application server. I do not want to do domain to IP mapping and block destination IP (and source IP blocking is also not an option). I can see that a string like this: iptables -A INPUT -p udp -m udp --dport 53 -m string --string "domain" --algo kmp --to 65535 -j DROP this can block "domain" which includes domain.com/domain.net and everything in that pattern. I tried using hexadecimal string for value like domaincom (hexa equivalent) and firewall doesn't pics that at all. The only other option which I found to be working nicely is u32 based string as something suggested on DNS amplification blog post here - http://dnsamplificationattacks.blogspot.in/2013/12/domain-dnsamplificationa… A string like this as suggested on above link works exactly for that domain iptables --insert INPUT -p udp --dport 53 -m u32 --u32 "0x28&0xFFDFDFDF=0x17444e53 && 0x2c&0xDFDFDFDF=0x414d504c && 0x30&0xDFDFDFDF=0x49464943 && 0x34&0xDFDFDFDF=0x4154494f && 0x38&0xDFDFDFDF=0x4e415454 && 0x3c&0xDFDFDFDF=0x41434b53 && 0x40&0xFFDFDFFF=0x02434300" -j DROP -m comment --comment "DROP DNS Q dnsamplificationattacks.cc" but here I am not sure how to create such string out and script them for automation. Can someone suggest a way out for this within IPTables or may be some other open source firewall? Thanks. -- Anurag Bhatia anuragbhatia.com Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter<https://twitter.com/anurag_bhatia> Skype: anuragbhatia.com PGP Key Fingerprint: 3115 677D 2E94 B696 651B 870C C06D D524 245E 58E2

8 9

NANOG60 notes
by Matthew Petach 12 Feb '14

12 Feb '14

I've been pinged by a few people who had to travel midway through NANOG due to weather if I would be posting notes up; yes, though it looks like cluepon.net isn't writeable, so for now I'm putting them up on my home box, but when cluepon.net is writeable again, I'll copy them over there. For now: http://kestrel3.netflight.com/2014.02.10-NANOG60-day1-morning.txt http://kestrel3.netflight.com/2014.02.10-NANOG60-day1-afternoon.txt http://kestrel3.netflight.com/2014.02.11-NANOG60-day2-morning.txt http://kestrel3.netflight.com/2014.02.11-NANOG60-day2-afternoon.txt http://kestrel3.netflight.com/2014.02.12-NANOG60-day3-morning.txt Sorry about the weather! Matt

1 0

DNS/NTP <censured>, a solution !
by Thomas Mangin 12 Feb '14

12 Feb '14

Hello, Because : - Exa has been under attack way too much these last weeks - We hate to have to deal with it Because: - Andrisoft seems cool but does not do FlowSpec - Arbor is known for its price (and features) - I am from Yorkshire (How much do you pay me to find bugs in your shinny application ?) Because: - We can ... - And people can not be bothered to fix the problem at source ! I have been working on making our internal tool ( Thank you Daniel ) something which can be built on and released to the community. The repository is here: https://github.com/Exa-Networks/exaddos The code is not even one week old but it can : - use SNMP to monitor your EBGP interfaces - parse IPFIX to find your top speakers - provide you the data in an HORRIBLE web page ( but all the rendering is client side, so feel free to fix that !) Now I would love some help ... I am NOT a web designer who find Javascript easy (I can handle jquery and basic stuff but nice CSS is not my cup of tea), so it will not look nice unless someone else make it so. I can provide the underlying data via JSON in whatever way one may need to allow : - graphing of links - allow to drill down on top speakers to find proto / ports information - "one click" get rid of that DDOS for <IP> <proto> I did some of this stuff with ExaProxy so I am not totally useless but god knows it is not my strength ! So any help would be welcome, so I can go back on coding on BGP and not DDOS. Thomas PS: I created a G+ community ExaDDOS .. I will try to add a mailing list later on.

1 0