- Test - lists.nanog.org

Link local for P-t-P links? (Was: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?)
by Mike Jones 02 Dec '11

02 Dec '11

On 1 December 2011 00:55, Jimmy Hess <mysidia(a)gmail.com> wrote: > Please explain. What are the better ways that you would propose > of mitigating ND table overflows? > If you can show a rational alternative, then it would be persuasive as > a better option. > Link-Local? For "true" P-t-P links I guess you don't need any addresses on the interfaces (I don't on my 6in4 tunnels), but I assume most people are referring to ethernet type cross connects, so Link-Local addresses. As long as each device has at least 1 address assigned somewhere (loopback?) that it can use for management/packet generation purposes you don't need an address on every link like you used to do with IPv4. Now that there are plenty of addresses you don't need as many :) I suspect there are probably some practical issues with link-local on some kit and some network configurations due to lack of people doing it this way, but in theory there shouldn't be any reason that you couldn't use link-local for all your links then just have a /128 assigned to each routers loopback for management/packet generation purposes. This could remove overheads of worrying about address assignment for those links, you just need a single /128 per router. Depending on the network it might be better to statically set link locals rather than using automatic ones (fe80::1 and fe80::2 for 'upstream' and 'downstream' or whatever rules you currently use for deciding which end is 1 and which is 2) You could also do something similar for datacentres assigning blocks to customer servers, instead of configuring a /64 for each customer, or a /48 then giving customers blocks inside that to use, just configure a single /64 and give each customer a single address from that block with unassigned ones filtered, then route a /64 to them for any "extra addresses" they might want. Chances are if they need more than a couple of addresses they probably want them routed to them anyway rather than using ND for them all. The issue of dynamic assignments to end customers in a non-datacentre setting is a little more difficult, but I wonder how badly CPEs would break if you tried using DHCPv6 to give them back their link-local addresses, then DHCPv6-PD delegating by routing to their link local address, probably a lot worse than if you just used a /112 of global space. I don't think this area has too many issues though because DHCP ensures that the actual addresses on the links are all known, so this just needs to be used for filtering unknown addresses. Then there's just the question of what to do about the edge networks where SLAAC might be used and where you don't have such strict control over address assignment, i'll pass on that one for now. Link locals aren't as useful nearer to the edges, but for the backbones and datacentre networks they should be able to solve most of the biggest problems with ND attacks. The edge networks where just using link locals isn't really an option you can probably put a stateful firewall in quite easily, as these will be the edge default gateways that clients are sending their traffic directly to rather than needing to be done in the core. Although there really should be an option for users to open the firewall for inbound connections. Am I a complete idiot missing some obvious major issues with link locals, or am i just the only one not thinking IPv4-think? Opinions? :) - Mike

6 7

[NANOG-announce] NANOG54 (San Diego, Feb 5-8, 2012): Early Bird Registration Expiring on Sunday, 12/4
by Dave Temkin 01 Dec '11

01 Dec '11

Please note that the Early Bird registration for NANOG54 expires on Sunday, 12/4. Register now and save $75 off the regular registration fee! Also, as a reminder, the Call for Presentations is still open! Have something that you think is relevant to the NANOG community and would like to have the chance to present it? Please see http://www.nanog.org/meetings/nanog54/callforpresentations.html for more information. Looking forward to seeing you in sunny San Diego! -Dave (For the NANOG Program Committee) _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

MPLS based routing
by Meftah Tayeb 01 Dec '11

01 Dec '11

hello guys, if i want to label my routes in a cisco router i did run through ldp configuration step now i see that labels are distributed, but if i traceroute it from another router i didn't see the icmp arg for the mpls label did i miss anything? atached my configuration :) Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746 __________ Information from ESET NOD32 Antivirus, version of virus signature database 6678 (20111202) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

1 0

Re: bgp update destroying transit on redback routers ?
by Olivier Benghozi 01 Dec '11

01 Dec '11

Alexandre Snarskii <snar(a)snar.spb.ru> wrote: > AGGREGATOR is an optional transitive attribute of length 6. > The attribute contains the last AS number that formed the > aggregate route (encoded as 2 octets), followed by the IP > address of the BGP speaker that formed the aggregate route > (encoded as 4 octets). Usage of this attribute is described > in 5.1.7 > > And what to do with 4-byte AS-numbers then? That would explain the 8 bytes. Hi, we also have some issues with this here, the update message the Redback logged is: ffff ffff ffff ffff ffff ffff ffff ffff 0049 02 0000 002e 4001 01 00 4002 12 02 04 00000513 00000d1c 0000b611 0000b611 4003 04 50ef82c1 4006 00 c007 08 00 0000 0000 0000 00 16 ce7d a4 The prefix is 206.125.164.0/22, AS-PATH is 1299 3356 46609 46609 (Telia, Level3, and finally Hostlogistic with one prepend). The AGGREGATOR is full of 0. I guess this could be what bothers the Redback/Ericsson code. I see the same route by other sessions, and the aggregator looks OK, since the sh bgp says: 206.125.164.0/22 [...] 8218 4436 46609 46609 [...] Origin incomplete, localpref 100, med 100, weight 100, external, best aggregator: 206.125.165.242, AS 46609, atomic-aggregate So Hostlogistic route to Level3 is malformed (according to the RFC, the AGGREGATOR content is mandatory if the attribute is present), but their route to NLayer is OK. Or maybe a Level3 router has a problem? Anyway, our Redback/Ericsson routers are the problem now, since the other vendors don't throw away the BGP sessions... I've opened a case at Ericsson, still waiting for an answer :-/ regards, Olivier Benghozi Wifirst

2 1

Re: HP IPv6 RA Guard
by Ray Soucy 01 Dec '11

01 Dec '11

Comment can be appreciated but please remove the I2 WG address from responses unless it's something you want to blast to that community, I don't want them upset at me for filling their inbox with a 40 email NANOG thread (you know how this list can get). ;-) On Wed, Nov 30, 2011 at 9:52 PM, Brent Jones <brent(a)brentrjones.com> wrote: > > > On Wed, Nov 30, 2011 at 5:53 PM, Ray Soucy <rps(a)maine.edu> wrote: >> >> This is great news. >> >> I wonder if this is evidence that they plan to continue to develop the >> Procurve line and eventually abandon the 3Com line. Uncertainty of >> which line would win out has kept me (and others I'm sure) from >> wanting to invest in anything HP. >> > > > Some of us have chosen not to invest in anything HP for a long time > > > > -Brent Jones -- Ray Soucy Epic Communications Specialist Phone: +1 (207) 561-3526 Networkmaine, a Unit of the University of Maine System http://www.networkmaine.net/

1 0

Re: HP IPv6 RA Guard
by Ray Soucy 01 Dec '11

01 Dec '11

This is great news. I wonder if this is evidence that they plan to continue to develop the Procurve line and eventually abandon the 3Com line. Uncertainty of which line would win out has kept me (and others I'm sure) from wanting to invest in anything HP. On Wed, Nov 30, 2011 at 8:40 PM, Jason Mueller <jasmuell(a)indiana.edu> wrote: > All, > > I received HP code today that implements RA guard (K.15.07.0002). This is for the 5400, 8200, 3500 series switches. The feature blocks both RAs (ICMP type 134) and IPv6 redirects (ICMP type 137). > > Here is the CLI command syntax: > [no] ipv6 ra-guard ports <port-list> [log] > > This should be included in their next general release of K.15 series code. > > No word on my request for IPv6 DHCP snooping. I generally get an HP drafted version of special feature requests, when they accept them for development. I don't have any record of that, so I sent a gentle reminder to HP tonight. > > -Jason > -- Ray Soucy Epic Communications Specialist Phone: +1 (207) 561-3526 Networkmaine, a Unit of the University of Maine System http://www.networkmaine.net/

1 0

In need of a Microsoft Postmaster
by Mark Keymer 01 Dec '11

01 Dec '11

I am in great hopes that a Microsoft Postmaster could get in contact with me. This is dealing with a delisting of a banned IP "blocked using Blocklist 3, mail from IP banned" My client is e-mailing a vendor of theirs who's mail goes to "mail.messaging.microsoft.com" We have submitted a request to delist it but have not heard back from anyone for about 2 weeks now. Our client is up in arms and all that. There has been no know reasons for why the ban would have taken place. It is possible this is an old ban from before we had the IP space which we got 1-2 years ago. :( Sincerely, Mark Keymer CFO/COO Vivio Technologies

1 0

Re: Recent DNS attacks from China?
by Hal Murray 30 Nov '11

30 Nov '11

> I am wondering if anyone else is seeing a sudden increase in DNS attacks > emanating from chinese IP addresses? Over the past 24 hours we've seen a > sudden rash of chinese IPs attacking our DNS servers in the order of 5 to 10 > million PPS for periods of 5 to 10 mins, repeated every 20 to 30 minutes. > This anomalous traffic started roughly 24 hours ago, and while we've had > occasions of anomalous chinese traffic, never anything of this type. I don't know if it's related, but at about the same time USNO reported an attack on their NTP servers. I could easily imagine a piece of malware with a bug that does massive retransmits on both DNS and NTP. ----------- From: Rich <schmidt.rich(a)gmail.com> Newsgroups: comp.protocols.time.ntp Subject: NTP Denial of Service attack 29 November 2011 Date: Tue, 29 Nov 2011 12:44:44 -0800 (PST) Organization: http://groups.google.com NNTP-Posting-Host: 199.211.133.254 USNO is seeing an apparent coordinated denial of service attack on NTP originating with the following IPs: 220.117.53.67; 218.92.115.152; 114.40.28.224; 218.201.21.194. ---------- At 11 pm EST 29 Nov 2011 the Navy Cyber Defense Operations Command ordered USNO to take NTP servers in Washington, DC offline, and USNO complied. USNO serves more than 3 million clients. This is the first time in 17 years that we have ceased NTP operations. ---- NTP Service from USNO Washington was restored at 30.56 November 2011 UTC. No further information is available for dissemination at this time. -- These are my opinions, not necessarily my employer's. I hate spam.

2 1

IPv6 NPT and NAT for Linux
by Ray Soucy 30 Nov '11

30 Nov '11

For those who missed it, Linux is adding NAT for IPv6 to netfilter: http://www.spinics.net/lists/netfilter-devel/msg19979.html Along with tradition SNAT, and DNAT targets most of us are familiar with, a new NETMAP target is included that implements NPT (network prefix translation). I for one am happy to see this; despite not wanting to see people NAT IPv6 as the norm, having the NETMAP target will largely replace the use of SNAT and MASQUERADE for many deployments, while keeping those tools for the times when traditional NAT is desirable. -- Ray Soucy Epic Communications Specialist Phone: +1 (207) 561-3526 Networkmaine, a Unit of the University of Maine System http://www.networkmaine.net/

3 2

Re: Looking for a Tier 1 ISP Mentor for career advice.
by joshua sahala 30 Nov '11

30 Nov '11

tyler, some additional "soft" skills that will help you distinguish yourself from others: - learn to write well: take some creative writing classes in addition to technical writing. being able to efficiently write clear, concise, and effective documentation is a skill that is necessary, and i daresay, required, especially for senior-level staff. - learn how to present/speak: join the local toastermasters. grok tufte's 'visual display of quantitative information' (or something similar -- this goes back to writing effective and concise documentation) - in addition to business and finance, learn negotiation techniques. 'getting to yes' is a good book; there are many others - learn time/task/project management: you should be able to accurately guage how long things take, task interdepence, and how to structure a (simple) project. try a few different methods to find one that works for you, and then build and rebuild your home lab using your project plan. this is also a good time to practise documentation ;) - get involved: join/start local users groups, go to a conference or two, subscribe to/read mailing lists on topics which interest you, or which are relevant to something you are studying/playing with - to reiterate what others have said: learn to troubleshoot. learn to troubleshoot. learn to troubleshoot. - develop an efficient, comprehensive methodology, and stick to it (a checklist can be helpful) - learn to take notes as you work through your procedure (what you did, what was the result: this will aid in writing both root-cause reports and operational procedures -- more documentation practise) - as you gain experience, re-evaluate and optimise, but be consistent in your approach - be able to explain and justify your procedure(s); teaching and learning from others makes you both better. mentoring will be an extremely valuable skill to your hiring manager/team (and will better position you for leadership roles) - learn how to use $favourite_search_engine in order to find answers you might also consider getting a juniper j-series box (or running bird on a *nix box, or three). a ccnp will teach you cisco's way, but most provider networks are heterogenous, and the ability to understand a non-cisco device (and moreover, a non-cisco-style cli/config), will benefit you long-term (imho). above all, have fun with what you are doing. this industry can be a lot of fun, but it is also stressful, and if you aren't enjoying what you are learning/doing, it might be time to re-evaluate your focus/priorities. hth /joshua

1 0