- Test - lists.nanog.org

Whacky Weekend: Is Internet Access a Human Right?
by Jay Ashworth 12 Jan '12

12 Jan '12

Vint Cerf says no: http://j.mp/wwL9Ip But I wonder to what degree that's dependent on how much our governments make Internet access the most practical/only practical way to interact with them. Understand: I'm not saying that FiOS should be a human right. But as a society, America's recognized for decades that you gotta have a telephone, and subsidized local/lifeline service to that extent; that sort of subsidy applies to cellular phones now as well. Thoughts? Cheers, -- jr 'yes, I know I'm early...' a -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

20 32

So... my colo was just bought.
by Jay Ashworth 11 Jan '12

11 Jan '12

By Knology. Should I be scared? My experiences with Knology have been fairly thin, but uniformly negative, for at least the last 5 years. But I know that the plural of 'anecdote' is not 'data'. That said, I'm accepting all anecdotes. :-) Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

9 13

IPv6 RA vs DHCPv6 - The chosen one?
by Ravi Duggal 11 Jan '12

11 Jan '12

Hi, IPv6 devices (routers and hosts) can obtain configuration information about default routers, on-link prefixes and addresses from Router Advertisements as defined in Neighbor Discovery. I have been told that in some deployments, there is a strong desire not to use Router Advertisements at all and to perform all configuration via DHCPv6. There are thus similar IETF standards to get everything that you can get from RAs, by using DHCPv6 instead. As a result of this we see new proposals in IETF that try to do similar things by either extending RA mechanisms or by introducing new options in DHCPv6. We thus have draft-droms-dhc-dhcpv6-default-router-00 that extends DHCPv6 to do what RA does. And now, we have draft-bcd-6man-ntp-server-ra-opt-00.txt that extends RA to advertise the NTP information that is currently done via DHCPv6. My question is, that which then is the more preferred option for the operators? Do they prefer extending RA so that the new information loaded on top of the RA messages gets known in the single shot when routers do neighbor discovery. Or do they prefer all the extra information to be learnt via DHCPv6? What are the pros and cons in each approach and when would people favor one over the other? I can see some advantages with the loading information to RA since then one is not dependent on the DHCPv6 server. However, the latter provides its own benefits. Regards, Ravi D.

42 144

Comcast DNSSEC
by Jeremy Bresley 11 Jan '12

11 Jan '12

Hadn't seen this mentioned yet. http://blog.comcast.com/2012/01/comcast-completes-dnssec-deployment.html Comcast has signed all their managed domains, as well as deployed DNSSEC resolvers for their customers. And they're encouraging others to make the jump to DNSSEC now as well, especially e-comm/banking sites. Nice work guys, any of the Comcast guys on the list want to give us an idea how much work is involved in this from a large-scale service provider perspective to do it? Any big caveats you encountered that people should watch out for? Jeremy "TheBrez" Bresley brez(a)brezworks.com

6 5

BOF at NANOG 54 - IPV4 runout, doing more with less.
by Joel jaeggli 11 Jan '12

11 Jan '12

Greetings, The BOF topic that I proposed during the recent thread: Re: Sad IPv4 story? Got approved, I'm still looking for 1-2 additional speakers to round out the agenda. To recap: * IPV4 run-out means new entrants will from the outset deploy techniques the present operators consider undesirable. * IPV6 should be appearing as part and parcel of new greenfield projects I would think. * On the vendor side CGN hardware is becoming a mature product space. * Datacenter/ICP operators confront a similar set of problems both supporting outgoing connections for large pools and incoming termination. I you have thoughts on any or all of these subjects your fellow NANOG participants are likely to be a receptive audience. In particular I think our colleagues running access networks would be potentially interested in thoughtful commentary on some of the following: * Port constrained or determistic nat mappings e.g. draft-donley-behave-deterministic-cgn-00 * What the near term state of residential/small business cpe are, and what if anything they're still missing to be suitable for ipv6 deployment. * What scaling properties pitfalls have been encountered with big stateful translation systems either nat44 or nat64. If you like a formal slot on the agenda, please reach out to me. If you simply have an interest in this area let me know and we'll see if we can fit your topic in the plan. Thanks joel

1 0

"PPPoE Intermediate Agent or TR101" in Huawei MA5600
by Shahab Vahabzadeh 10 Jan '12

10 Jan '12

Hi Everybody, I have lots of Huawei MA5600 in my pop sites and my "display version" output is "VERSION: MA5600V300R003C05". Can any body help me to know how I can enable "PPPoE Intermediate Agent or TR101" in these DSLAM's? Or let me know if this version of DSLAM support this feature or not? I want to have port attributes too when users send to NAS and from that to Radius. Thanks -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90

2 1

Re: SSL Certificates
by Henry Yen 10 Jan '12

10 Jan '12

verisign, who used to own geotrust (who owns rapidssl) was sold to symantec last year. or some similar swapping of chain links. anyway, for some, the symantec umbrella might be a polarizing factor. On Fri, Jan 06, 2012 at 09:08:28AM -0600, graham(a)g-rock.net wrote: > We use rapidssl. Seems to be ok across the board. No reports otherwise. > > ----- Reply message ----- > From: "Michael Carey" <mcarey(a)kinber.org> > Date: Fri, Jan 6, 2012 8:15 am > Subject: SSL Certificates > To: <nanog(a)nanog.org> > > Looking for a recommendation on who to buy affordable and reputable SSL > certificates from? Symantec, Thawte, and Comodo are the names that come to > mind, just wondering if there are others folks use. -- Henry Yen Aegis Information Systems, Inc. Senior Systems Programmer Hicksville, New York

1 0

AWS VPC Network Outage (US East)
by Van Wolfe 10 Jan '12

10 Jan '12

Is anyone else having issues with VPN access into a dedicated VPC (AWS US East)? We are unable to access our VM's across our tunnel. AWS alluded to a service wide network outage. Thank you, /Van

4 5

shell access to BGP router, CALEA tips??
by N Rauhauser 09 Jan '12

09 Jan '12

Ladies & Gentlemen, I wanted to check something on an IP address block this morning and, much to my surprise, I don't have access to a single router that has a full table in it - first time since 1999 this is the case. I see route views is still happily serving up shells, but I'm curious to know if there are any other viewpoints available. I am probably going to script something for this particular problem, so I want boxes that have shell access, not graphical looking glass type stuff. I am also plunged into the world of lawful intercept after a long absence. Other than providing muddled responses ten minutes before the deadline on obvious MPAA/RIAA trolls I haven't had to do a subpoena response since 2005 and I've not installed anything that needed to meet requirements since 2009. Is there a good write up somewhere on the current state of affairs? Neal Rauhauser

3 2

Misreporting abuse, it's not actually helpful: root@fireslayer.maxihost.com.br
by Christopher Morrow 09 Jan '12

09 Jan '12

[ABUSE] Attack comming from IP 90.185.110.92 to 189.1.164.138 So... FireSlayer, did you get a cold? or perhaps have too much to drink? sending reports of what looks like CoD4: 16:36:58.728250 IP 90.185.110.92.27005 > 189.1.172.238.28960: UDP, length 14 16:36:58.741473 IP 90.185.110.92.27005 > 189.1.169.243.28922: UDP, length 14 16:36:58.754083 IP 90.185.110.92.27005 > 189.1.164.56.28947: UDP, length 14 server traffic to your customers is cool, it's not so cool if you send the reports to the wrong origin asn... AS15169 doesn't actually originate 90.185.110.0/24, it looks to me like: AS39554 | 90.185.110.0 | FULLRATE Fullrate A/S probably does though... I'm not sure what math tricks you may have tried, but 39554 is in no way like 15169. Could you take some time to disable your report generation canon and fix it before re-enabling it? I'm not the only person getting mis-fired reports, if you want to help everyone please turn off the canon. thnx! -chris (note, we've asked privately, you don't seem to respond/listen, perhaps publicly noting this will get: 1) your attention 2) you to stop the insanity)

4 3