- Test - lists.nanog.org

VPLS PE Redundancy with Supervisor Engine 2T
by Sander Steffann 22 Mar '13

22 Mar '13

Hi, We're trying to implement VPLS PE Redundancy with Supervisor Engine 2T (VSS) as described in http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/white_pape… and constantly failing. It seems so simple: set up a VSS, use LACP or PAgP port-channels to the distribution switches and do VPLS on the VSS. It just doesn't seem to work. Using WS-X6908-10G-2TXL line cards already gives less problems than with WS-X6704-10GE line cards, but still it fails to work very often. I sometimes wonder if I am going mad or if this setup has never actually been tested... So: has anybody ever set up a network like this, or am I really beta testing for Cisco now? Cheers, Sander Steffann

1 1

GeoDNS
by kg9020 22 Mar '13

22 Mar '13

Hello Have you tried https://github.com/blblack/gdnsd you can view usage at http://www.youtube.com/watch?v=WF75IGx9svM art On Mar 21, 2013, at 7:00 AM, nanog-request(a)nanog.org wrote: > Send NANOG mailing list submissions to > nanog(a)nanog.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://mailman.nanog.org/mailman/listinfo/nanog > or, via email, send a message with subject or body 'help' to > nanog-request(a)nanog.org > > You can reach the person managing the list at > nanog-owner(a)nanog.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of NANOG digest..." > > > Today's Topics: > > 1. Re: Why are there no GeoDNS solutions anywhere in sight? > (Constantine A. Murenin) > 2. Re: routing table go boom (Randy Bush) > 3. 2012 internet census (Randy Bush) > 4. Re: Why are there no GeoDNS solutions anywhere in sight? > (Simon Lyall) > 5. Re: Why are there no GeoDNS solutions anywhere in sight? > (bmanning(a)vacation.karoshi.com) > 6. Cisco password implementation trubs: weakened strength? > (jamie rishaw) > 7. Re: Cisco password implementation trubs: weakened strength? > (Nick Hilliard) > 8. Re: Cisco password implementation trubs: weakened strength? > (Jimmy Hess) > 9. Re: Why are there no GeoDNS solutions anywhere in sight? > (Masataka Ohta) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 21 Mar 2013 00:23:02 -0700 > From: "Constantine A. Murenin" <mureninc(a)gmail.com> > To: Masataka Ohta <mohta(a)necom830.hpcl.titech.ac.jp> > Cc: nanog(a)nanog.org > Subject: Re: Why are there no GeoDNS solutions anywhere in sight? > Message-ID: > <CAPKkNb4g++KaXmJ9Y5N-0J2Dt+P7Yn_xMvxcr7viThh4rf6rMQ(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > On 20 March 2013 21:29, Masataka Ohta <mohta(a)necom830.hpcl.titech.ac.jp> wrote: >> Constantine A. Murenin wrote: >> >>> Why even stop there: all modern browsers usually know the exact >>> location of the user, often with street-level accuracy. >> >> If you think mobile, they don't, especially because "often" is >> not at all "enough times". > > Are you suggesting that geolocation is inaccurate enough to misplace > Europe with Asia? > >>> Why is there no way to do any of this? >> >> Because it is impractical to assume an IP address can be mapped >> uniquely to a geolocation. > > Why is it impractical? If I have a server in Germany and in Quebec, > why would it be impractical to have the logic in place such that > European visitors would be contacting the server in Germany, and > visitors from US/Canada -- the one in Quebec? > > C. > > > > ------------------------------ > > Message: 2 > Date: Thu, 21 Mar 2013 09:23:08 +0200 > From: Randy Bush <randy(a)psg.com> > To: Jared Mauch <jared(a)puck.nether.net> > Cc: nanog(a)nanog.org > Subject: Re: routing table go boom > Message-ID: <m2sj3pb4ir.wl%randy(a)psg.com> > Content-Type: text/plain; charset=US-ASCII > >> I certainly think there's a lot that can be done at middle-layers, eg: tunnels >> to a few different providers. I can be on a Comcast CM and ATT DSL link and >> establish a link to a tunnel destination in Chicago that is low-latency for me >> and the bits will all flow that way. >> >> The last mile loop problem though? > > sweden and japan, among others, have some experiences (good and > mediocre) in this area > > randy > > > > ------------------------------ > > Message: 3 > Date: Thu, 21 Mar 2013 10:24:51 +0200 > From: Randy Bush <randy(a)psg.com> > To: North American Network Operators' Group <nanog(a)nanog.org> > Subject: 2012 internet census > Message-ID: <m2ppytb1nw.wl%randy(a)psg.com> > Content-Type: text/plain; charset=US-ASCII > > nice piece of work > > http://internetcensus2012.bitbucket.org/paper.html > > as cristel says, better coverage than atlas and no need for user > credits! :) > > randy > > > > ------------------------------ > > Message: 4 > Date: Thu, 21 Mar 2013 21:26:46 +1300 (NZDT) > From: Simon Lyall <simon(a)darkmere.gen.nz> > To: nanog(a)nanog.org > Subject: Re: Why are there no GeoDNS solutions anywhere in sight? > Message-ID: > <alpine.DEB.2.00.1303212112110.28564(a)green.darkmere.gen.nz> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > On Thu, 21 Mar 2013, Constantine A. Murenin wrote: >> Why is it impractical? If I have a server in Germany and in Quebec, >> why would it be impractical to have the logic in place such that >> European visitors would be contacting the server in Germany, and >> visitors from US/Canada -- the one in Quebec? > > But what if the server in Quebec is a little VPS on a 10Mb/s link while > the one in Germany is a rack of servers on a 10Gb/s link? > > What if I just want the server in Quebec to serve people from Canada and > the one in Germany serves the rest of the world? > > What if it is 4am in Quebec but 9am in Germany? (it is right now) > > What if I have half a dozen pops worldwide? > > What if I have 20? 200? 2000? > > What is closer to a user in New Zealand, A Pop in Japan, Singapore or LA? > > The main thing with GSLB is: > > The little guys don't need it, > The medium sized sites outsource, > The big guys roll their own. > > Personally I outsource and it works very well. > > -- > Simon Lyall | Very Busy | Web: http://www.darkmere.gen.nz/ > "To stay awake all night adds a day to your life" - Stilgar | eMT. > > > > > ------------------------------ > > Message: 5 > Date: Thu, 21 Mar 2013 08:41:40 +0000 > From: bmanning(a)vacation.karoshi.com > To: "Constantine A. Murenin" <mureninc(a)gmail.com> > Cc: nanog(a)nanog.org > Subject: Re: Why are there no GeoDNS solutions anywhere in sight? > Message-ID: <20130321084140.GB432(a)vacation.karoshi.com.> > Content-Type: text/plain; charset=us-ascii > > On Thu, Mar 21, 2013 at 12:23:02AM -0700, Constantine A. Murenin wrote: >> On 20 March 2013 21:29, Masataka Ohta <mohta(a)necom830.hpcl.titech.ac.jp> wrote: >>> Constantine A. Murenin wrote: >>> >>>> Why even stop there: all modern browsers usually know the exact >>>> location of the user, often with street-level accuracy. >>> >>> If you think mobile, they don't, especially because "often" is >>> not at all "enough times". >> >> Are you suggesting that geolocation is inaccurate enough to misplace >> Europe with Asia? > > > last month, while in western australia, geoloc pegged me in utah. > this morning, geoloc pegged me in Kansas, while resident in Maryland. > > >>>> Why is there no way to do any of this? >>> >>> Because it is impractical to assume an IP address can be mapped >>> uniquely to a geolocation. >> >> Why is it impractical? If I have a server in Germany and in Quebec, >> why would it be impractical to have the logic in place such that >> European visitors would be contacting the server in Germany, and >> visitors from US/Canada -- the one in Quebec? >> >> C. > > secure dynamic update works. waht is TWC's incentive to allow clients to update > tjheir reverse DNS delegations, esp when clients are leaving them for T-Mobile? > > > your sugesting the cretion and deployment of something that already exists > in the LOC RR. Your rational is that LOC isn't used. If thats the case, > why would your proposal be any more successful? > > /bill > > > > ------------------------------ > > Message: 6 > Date: Thu, 21 Mar 2013 05:10:36 -0500 > From: jamie rishaw <j(a)arpa.com> > To: NANOG <nanog(a)nanog.org> > Subject: Cisco password implementation trubs: weakened strength? > Message-ID: > <CABL6YZQFf9_e9va0J15kdz1np-Jv-jeZ1Vi9LPnNewGKwMzDNg(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > warning: I'm tired and this email is terse. > warning: for huge nerds only. > disclaimer: although I've worked with actual rocket scientists(hi Roger), > I'm. not one myself..nor am I a crypto mathnerd > > apparently, Cisco is changing its password schemas. > > old: pbkdf2 by 1k, salted > vs > New: (type 4) unsalted sha256 > .. > discuss.? > > there is a cert and Cisco sa on this.. but I'm wondering if anyone has any > opinions, yea or nay.? > > -j. > > > ------------------------------ > > Message: 7 > Date: Thu, 21 Mar 2013 10:57:02 +0000 > From: Nick Hilliard <nick(a)foobar.org> > To: nanog(a)nanog.org > Subject: Re: Cisco password implementation trubs: weakened strength? > Message-ID: <514AE77E.10705(a)foobar.org> > Content-Type: text/plain; charset=ISO-8859-1 > > On 21/03/2013 10:10, jamie rishaw wrote: >> apparently, Cisco is changing its password schemas. >> >> old: pbkdf2 by 1k, salted >> vs >> New: (type 4) unsalted sha256 >> .. >> discuss.? > > security advisory: > >> http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-… > > which states: > >> Because of the issues discussed in this Security Response, Cisco is >> taking the following actions for future Cisco IOS and Cisco IOS XE >> releases: >> >> Type 4 passwords will be deprecated: Future Cisco IOS and Cisco IOS XE >> releases will not generate Type 4 passwords. However, to maintain >> backward compatibility, existing Type 4 passwords will be parsed and >> accepted. Customers will need to manually remove the existing Type 4 >> passwords from their configuration. > > Kudos to Cisco - this was the right thing to do. > > Nick > > > > > ------------------------------ > > Message: 8 > Date: Thu, 21 Mar 2013 06:22:52 -0500 > From: Jimmy Hess <mysidia(a)gmail.com> > To: jamie rishaw <j(a)arpa.com> > Cc: NANOG <nanog(a)nanog.org> > Subject: Re: Cisco password implementation trubs: weakened strength? > Message-ID: > <CAAAwwbVxUHr4v4O3_qqJHbXDTTaY0D0juMCNNbYOVGdzZS6ciA(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > On 3/21/13, jamie rishaw <j(a)arpa.com> wrote: >> New: (type 4) unsalted sha256 > > Good for them; DES Crypt and MD5 crypt are dead... however, I hope > they have misspoken then... because that move would make no > sense... moving to simple unsalted SHA256 as the new hash type would > definitely increase the performance of potential password cracking > attempts against passwords stored at rest, instead of addressing the > massive increase in cheap computing power (which will necessitate all > software vendors who are concerned about stored password security, > stop using older crypt algorithms yesterday). > > In other words; they would be moving to a weaker hashing algorithm if > selecting unsalted SHA -- more hashes per second of SHA256 could be > computed per second on equivalent GPU than hashes per second of MD5 > Crypt. > > PBKDF2 at 10k rounds is stronger than MD5 crypt (more time required > for a password cracker); Bcrypt stronger than PBKDF2 with appropriate > work factor selected (more time _and_ larger amounts of memory space > required thwarting GPUs); etc. > > > Also, on what platform have they already used anything stronger than Unix crypt? > > As far as I knew, Cisco were always using; 'type 7' password blobs > vigenere based symmetric encryption with a factory-defined key, type > 6 symmetric encrypted storage (with des/aes key obscured from view), > or type 5 basic unix crypt or Poul-Henning Kamp's MD5 crypt algorithm > used in FreeBSD. > > >> I'm. not one myself..nor am I a crypto mathnerd >> apparently, Cisco is changing its password schemas. >> old: pbkdf2 by 1k, salted >> vs >> New: (type 4) unsalted sha256 >> .. >> discuss.? >> >> there is a cert and Cisco sa on this.. but I'm wondering if anyone has any >> opinions, yea or nay.? > > -- > -JH > > > > ------------------------------ > > Message: 9 > Date: Thu, 21 Mar 2013 20:36:36 +0900 > From: Masataka Ohta <mohta(a)necom830.hpcl.titech.ac.jp> > To: "Constantine A. Murenin" <mureninc(a)gmail.com> > Cc: nanog(a)nanog.org > Subject: Re: Why are there no GeoDNS solutions anywhere in sight? > Message-ID: <514AF0C4.7000200(a)necom830.hpcl.titech.ac.jp> > Content-Type: text/plain; charset=ISO-2022-JP > > Constantine A. Murenin wrote: > >> Are you suggesting that geolocation is inaccurate enough to misplace >> Europe with Asia? > > Yes, of course. > > Think mobile. > > Masataka Ohta > > > > End of NANOG Digest, Vol 62, Issue 67 > *************************************

2 1

2012 internet census
by Randy Bush 21 Mar '13

21 Mar '13

nice piece of work http://internetcensus2012.bitbucket.org/paper.html as cristel says, better coverage than atlas and no need for user credits! :) randy

2 1

Fwd: Re: Why are there no GeoDNS solutions anywhere in sight?
by Masataka Ohta 21 Mar '13

21 Mar '13

Arturo Servin wrote: > Just go to an IETF meeting and you will be placed all around the globe. > It is a corner case, but it shows some deficiencies in the current approach. It should also be noted that network addresses for NANOG meetings may also be located somewhere in , though not world wide, USA or CANADA. Masataka Ohta

1 0

Cisco password implementation trubs: weakened strength?
by jamie rishaw 21 Mar '13

21 Mar '13

warning: I'm tired and this email is terse. warning: for huge nerds only. disclaimer: although I've worked with actual rocket scientists(hi Roger), I'm. not one myself..nor am I a crypto mathnerd apparently, Cisco is changing its password schemas. old: pbkdf2 by 1k, salted vs New: (type 4) unsalted sha256 .. discuss.? there is a cert and Cisco sa on this.. but I'm wondering if anyone has any opinions, yea or nay.? -j.

4 3

NYC sales contacts for AS209 and AS2914
by Jason Lixfeld 20 Mar '13

20 Mar '13

The contacts I have seem to all bounce. If anyone from NTT or CenturyLink is lurking who can quote on wholesale IPT out of 60 Hudson, please ping me. Thanks.

1 0

ILNP FTW ... Was Re: [c-nsp] DNS amplification
by cb.list6 20 Mar '13

20 Mar '13

On Mar 19, 2013 8:26 PM, "David Conrad" <drc(a)virtualized.org> wrote: > > Leo, > > On Mar 19, 2013, at 11:57 AM, Leo Bicknell <bicknell(a)ufp.org> wrote: > > In a message written on Tue, Mar 19, 2013 at 11:33:33AM -0700, David Conrad wrote: > >> LISP doesn't replace BGP. It merely adds a layer of indirection so you don't have to propagate identity information along with routing topology, allowing much greater aggregation. > > The problem with LISP is that when the complexity of the entire > > system is taken into account it is not signficantly more efficient > > than the current system. > > When was the last time you (as a network operator) cared about the efficiency of the entire system? > > LISP (and similar) system are inherently more complex because they're adding a new element to the network -- TANSTAAFL. The point is that the complexity is added at the edge where it is easy/cheap (per node or site). Yes, entire system complexity goes up. However from the perspective of the core where life is fast/expensive, complexity goes down since identity is separated from location. > As I see it, that is the fundamental problem with LISP. It wants edge investment to solve a core problem. I don't carry full routes in my core, but LISP wants me to do something to solve a problem I don't have. And, that something looks a lot like an ATM SVC (dynamic tunnels ?) That said, IMHO, ILNP is a lot more interesting in the locator / id split space.... As well as general evolution of internet architecture. LISP just has had better marketing and simpler code. Ya know, this problem would also largely be solved if everyone just switched to ipv6 and stopped using those disjointed tiny v4 blocks. Oh, but that would break Skype. Nevermind. CB > > A LISP network is a similar model, with LISP nodes caching rather than linecards. > > You're comparing the equivalent of a DNS lookup with a FIB lookup. Yes, there is a performance hit when you do the mapping of identity to location (TANSTAAFL), however this is at the edge in the millisecond DRAM-stored connection initiation world, not in the core in the nanosecond SRAM-stored packet forwarding world. > > Regards, > -drc > >

1 0

Call for Papers: Energy-Efficient HPC & Communication workshop (E2HPC2) 2013. Deadline: March 29th, 2013
by Javier Garcia Blas 19 Mar '13

19 Mar '13

Apologies for multiple posting. ===================================================================== The first Energy-Efficient High Performance Computing & Communication workshop will be co-located with EuroMPI 2013 in Madrid. Energy-awareness is now a main topic for HPC systems. The goal of this workshop is to discuss latest researches on the impact and possibles leverages of communications for such systems. E2HPC2 solicits original and non-published or under-review articles on the field of energy-aware communication in HPC environment. This workshop is co-located with EuroMPI as MPI is the main communication interface in those environments. http://www.irit.fr/~Georges.Da-Costa/e2hpc2.html E2HPC will be held on Tuesday 17th of September 2013. Submission of full papers: March 29th, 2013 Program Chair : Georges Da Costa Topics ------ Relevant topics for the conference include, but are not limited to the following: * Energy efficient MPI implementation * Performance/Energy tradeoffs in MPI programs * Energy evaluation and models of HPC applications and communication library * Energy-Aware large scale HPC runtime * Return of experience on complex applications from an energy/power point of view Time-line --------- * Submission of full papers: March 29th, 2013 * Author notification: May 11th, 2013 * Camera Ready papers due: June 15th, 2013 * Workshop: September 17th, 2013 Program Committee ----------------- * Georges Da Costa IRIT/Toulouse III * Jesus Carretero Universidad Carlos III de Madrid * Emmanuel Jeannot INRIA * Jean-Marc Pierson IRIT * Lars Dittmann Technical University of Denmark, Department of Photonics Engineering * Anne-CÃ©cile Orgerie CNRS * Ariel Oleksiak Poznan Supercomputing and Networking Center * Manuel F. Dolz Depto. de IngenierÃa y Ciencia de los Computadores, Universitat Jaume I * Laurent Lefevre INRIA * Julius Åœilinskas Vilnius University * Francisco Almeida La Laguna University * Davide Careglio Universitat PolitÃšcnica de Catalunya Submission ---------- Contributors are invited to submit a full paper as a PDF document not exceeding 6 pages in English. The title page should contain an abstract of at most 100 words and five specific, topical keywords. The paper must be formatted according to double-column ACM ICPS proceedings style. The usage of LaTeX for preparation of the contribution as well as the submission in camera ready format is strongly recommended. Style files can be found at http://www.acm.org/publications/icps-instructions/. Selected and presented during the workshop papers will be published in the digital library of ACM. All contributions will be fully peer reviewed by the program committee. Papers shall be submitted electronically via Easychair, see https://www.easychair.org/conferences/?conf=e2hpc22013.

1 0

Metasolv / Business Objects
by James Wininger 19 Mar '13

19 Mar '13

Anyone on the list have experience with Metasolv and or Business Objects (SAP)? We have Metasolv and are using it today, but its reporting mechanism seems to be an afterthought. To that end Business Objects (from SAP) seems the be "the solution", but from what I have seen so far I am less than impressed. Can anyone offer some insight? -- Jim Wininger jwininger(a)ifncom.net

1 0

using ARIN IP space outside of ARIN region
by Andy Litzinger 19 Mar '13

19 Mar '13

We're looking at building into a DC in Europe this year and I wanted to run a few questions by the community and make sure I'm not too far off course. We currently have v4 space from ARIN and operate a multihomed datacenter in the US. This thread from September 2012, though the reverse of my situation, makes it seem like I should be able to work with ARIN to satisfy all of our v4 and v6 needs regardless of where in the world I plan to advertise the space. Obviously this would be really convenient for us since we already have a relationship with ARIN. http://mailman.nanog.org/pipermail/nanog/2012-September/052137.html So my questions are: * Is it ok/recommended to advertise v4 ARIN space (say a /23) to my upstream ISPs in Europe? * Is it ok/recommended to advertise v6 ARIN space to my upstream ISPs in Europe? (I suspect we'll get a /44 block to carve up since we fit in the "more than one but less than 12 sites" category) * Should I use a single AS for both North America and European data centers? It will be the same small team managing them today but it's not like the sites are linked together to form any kind of transit network. Also, is there a European version of RADB with which I should plan to register my prefixes? thanks! - andy

8 7