- Test - lists.nanog.org

6PE command for IOS and XR
by Vikas Sharma 27 Apr '11

27 Apr '11

Hi, I was trying command "mpls ipv6 source-interface <>" on SRE3 code, look like there is no command like that on SRE. This command is important for locally generated packets. Have someone used this command? Also what is the command on XR 4.0.1 to achieve the same? Regards, Vikas

2 2

IPv6 Prefix announcing
by Nick Olsen 26 Apr '11

26 Apr '11

Greetings NANOG, I've always been under the impression its best practice to only announce prefixes of a /24 and above when it comes to IPv4 and BGP. I was wondering if something similar had been agreed upon regarding IPv6. And if That's the case, What's the magic number? /32? /48? /64? Nick Olsen Network Operations (855) FLSPEED x106

9 8

Multi-site, multi-path to Internet - customer question - off topic ?
by Steve Benoit 26 Apr '11

26 Apr '11

Good day I have a question from a customer point of view. We currently have a multi-site WAN with all our Internet connectivity at one site consisting of 3 ISP type connections, full BGP, including our own ASN with IPv4 and v6 addressing space. All up and running. I am now looking to add Internet connectivity from a second site on our WAN for fail over in the event of a site 1 failure. My initial thoughts are towards another full BGP session at site 2, and perhaps something like Cisco's Global Site Selector, or F5's GTM to direct traffic. I'm thinking of phasing this in over a couple of years since the "server" folks will not have full hot fail-over at that site for that period. Of course, in a failure situation, the site will be expected to be live and operational immediately. Any suggestions on where I should start looking ? Any good white papers or case studies you have seen? And technologies we should look at or stay away from ? Thanks Steve Benoit

1 0

best of breed nowadays in DPI space?
by Rogelio 26 Apr '11

26 Apr '11

I have been recently researching DPI for several projects I am working on, and I recently came across this "shoot out" between several vendors in 2009 http://www.internetevolution.com/document.asp?doc_id=178633&page_number=1 Procera (at that time) emerged "the winner" for its ability to process P2P traffic (out of 15 participants), and I was wondering what new players, features, or products others might point me to. I am looking for something that does reporting *and* DPI in a distributed environment. That means, I might have several DPI gateways around the country that need to roll up their reporting into one main one. (I also have some other requirements as far as measuring churn reduction and cellular offloading, but I'm not sure that any of the DPI solutions can really do that well.) If anyone has any good contacts in this space, please let me know and I might discuss with them in more detail these opportunities that I'm looking for. -- Also on LinkedIn? Feel free to connect if you too are an open networker: scubacuda(a)gmail.com

1 3

Ongoing ASN and IP Space Hijacks: Update (TimeWarner/Level3/Tiscali)
by Ronald F. Guilmette 25 Apr '11

25 Apr '11

Eleven days ago, I reported here the following highly probable hijacks: AS8143 AS29987 AS11756 AS47024 AS27906 198.23.32.0/20 - NET-198-23-32-0-1 198.57.64.0/20 - NET-198-57-64-0-1 199.88.32.0/20 - NET-199-88-32-0-1 199.192.16.0/20 - NET-199-192-16-0-1 199.196.192.0/19 - NET-199-196-192-0-1 200.107.216.0/21 - GT-AGSA1-LACNIC 204.147.240.0/20 - NET-204-147-240-0-1 207.22.224.0/19 - (NET-207-22-192-0-1 Routing to a few of the above IP blocks has now been terminated, however at present I find that several of them are still very much alive and well, in particular: 199.88.32.0/20 - NET-199-88-32-0-1 199.196.192.0/19 - NET-199-196-192-0-1 200.107.216.0/21 - GT-AGSA1-LACNIC 204.147.240.0/20 - NET-204-147-240-0-1 As I previously mentioned, these are being used by high-end snowshoe spamming operations. Simple question: Does anybody give a damn? Regards, rfg P.S. Routing for the still-live hijacked blocks is as follows: 199.88.32.0/20 hijacked via AS29987 (hijacked ASN) via AS3257 (tiscali.net) 199.196.192.0/19 hijacked via AS8143 (hijacked ASN) via AS19844 (gorack.com) via AS4323/TimeWarner & AS3356/Level3 200.107.216.0/21 hijacked via AS8143 (hijacked ASN) via AS19844 (gorack.com) via AS4323/TimeWarner & AS3356/Level3 204.147.240.0/20 hijacked via AS47024 (hijacked ASN) via AS3257 (tiscali.net) P.P.S. As I also mentioned previously, GoRack seems to have some non-trivial connection to another South Florida company, Joytel Wireless, which itself was caught red-handed performing a sizable number of rather brazen IP block hijackings back in October: http://mailman.nanog.org/pipermail/nanog/2010-October/025997.html Given that Joytel/GoRack are clearly not at all bashful about what they are up to, it seems to me that it is incumbant upon TimeWarner and Level3 to take some action here. Otherwise, these hijackings are obviously just going to go on and on and on. As for Tiscali, and its obvious part in all this... well... if anyone is aware of any concious entity @ Tiscali who might actually give a damn about anything other than short-term profits, please do let me know. The people I've talked to, and the evidence above all indicates that Tiscali is, quite simply, ready, willing, and able to whore itself out to just about anybody.

2 2

riverbed steelhead
by harbor235 25 Apr '11

25 Apr '11

Anyone out there have experience with Riverbed Steelhead products? Do they improve TCP performance over WAN links? is it worth the price? mike

8 8

Outage Management/Log Book
by Payam Poursaied 25 Apr '11

25 Apr '11

Hi all May I have your recommendation regarding any outage management software and NOC log book(preferably open source) . I want to get fresh ideas about available software in this area. The below scenario may explain what I am looking for: One of the sites gets down, monitoring team would log it. Technical staffs follow it, they find there is something wrong in the site. Someone gets to the site and find there is a power failure. Make it correct. Monitoring team again see that site UP and update their log book put the recovery time and the reason (i.e. power failure) One of the simplest report from this system would be downtime per site/per reason. The ability to record group outage - manually or automatically based on network topology - (i.e. failure of a core router in a city which would be caused several sites failure) would be also useful. Best Regards Payam Poursaied

4 4

"supporting IPv6" <--- what it means exactly?
by Rogelio 24 Apr '11

24 Apr '11

Is there any clear understanding of what "supporting IPv6" means? I recently was told by a vendor that they "supported IPv6", and then when I went to go configure an IPv6 address, it was, of course, IPv4. I asked how they supported that, and they said that they "supported it" because they could "pass IPv6" traffic. Well...duh!

9 9

Anyone still maintaining altdb.net?
by Bret Palsson 24 Apr '11

24 Apr '11

I submitted my objects April 11. the mtrner object needs to be created by the db-admin. I realize this is a volunteer thing. Could I help out or could the people that are helping out look at adding my record? I need to setup some peering relationships. I'd prefer to support open communities rather than paying and am willing to help out if need be. Thanks, Bret Below are the objects that were submitted: mntner: MAINT-JIVE descr: Jive Communications, Inc. admin-c: BEP7-ARIN tech-c: BEP7-ARIN upd-to: routing(a)getjive.com mnt-nfy: routing(a)getjive.com auth: CRYPT-PW jiCdjGQviTmYo mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB aut-num: AS6643 as-name: JIVE descr: Jive Communications, Inc. admin-c: BEP7-ARIN tech-c: BEP7-ARIN mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB as-set: AS-JIVE descr: Jive Communications, Inc. admin-c: BEP7-ARIN tech-c: BEP7-ARIN mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB route: 199.36.248.0/24 descr: Jive Communications, Inc. origin: AS6643 mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB route: 199.36.249.0/24 descr: Jive Communications, Inc. origin: AS6643 mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB route: 199.36.250.0/24 descr: Jive Communications, Inc. origin: AS6643 mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB route: 199.36.251.0/24 descr: Jive Communications, Inc. origin: AS6643 mnt-by: MAINT-JIVE changed: routing(a)getjive.com 20110411 source: ALTDB

9 10

Cisco Firewall ASP Drop
by Joe Renwick 24 Apr '11

24 Apr '11

So my firewall seems to be dropping an oddly large number of packets on the INSIDE interface: asa1(config)# sh int RACK Interface GigabitEthernet0/1 "RACK", is up, line protocol is up Hardware is i82546GB rev03, BW 1000 Mbps Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps) MAC address 0024.14d0.4521, MTU 1500 IP address 64.22.76.97, subnet mask 255.255.255.240 28128158809 packets input, 162066888025865 bytes, 4 no buffer Received 186502879 broadcasts, 0 runts, 0 giants 5089 input errors, 0 CRC, 0 frame, 5089 overrun, 0 ignored, 0 abort 0 L2 decode drops 27235942172 packets output, 18181322825213 bytes, 237 underruns 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops input queue (curr/max packets): hardware (1/33) output queue (curr/max packets): hardware (0/511) Traffic Statistics for "RACK": 144406450470 packets input, 159422361828279 bytes 103754084999 packets output, 16098663171295 bytes 6934615576 packets dropped 1 minute input rate 2056 pkts/sec, 2053935 bytes/sec 1 minute output rate 1678 pkts/sec, 418581 bytes/sec 1 minute drop rate, 270 pkts/sec 5 minute input rate 2519 pkts/sec, 2676286 bytes/sec 5 minute output rate 1887 pkts/sec, 469578 bytes/sec 5 minute drop rate, 283 pkts/sec Looking at ASP drop data they are most coming from "TCP packet SEQ past window (tcp-seq-past-win)": asa1(config)# sh asp drop Frame drop: Invalid TCP Length (invalid-tcp-hdr-length) 31 No valid adjacency (no-adjacency) 88 No route to host (no-route) 1728 Flow is denied by configured rule (acl-drop) 203110 Flow denied due to resource limitation (unable-to-create-flow) 556419 First TCP packet not SYN (tcp-not-syn) 4080584 Bad TCP flags (bad-tcp-flags) 38 Bad option length in TCP (tcp-bad-option-len) 54 TCP data exceeded MSS (tcp-mss-exceeded) 910 TCP failed 3 way handshake (tcp-3whs-failed) 724043 TCP RST/FIN out of order (tcp-rstfin-ooo) 21011574 TCP SEQ in SYN/SYNACK invalid (tcp-seq-syn-diff) 19758 TCP SYNACK on established conn (tcp-synack-ooo) 6 TCP packet SEQ past window (tcp-seq-past-win) 156938345 TCP invalid ACK (tcp-invalid-ack) 15360 TCP ACK in 3 way handshake invalid (tcp-discarded-ooo) 9 TCP Out-of-Order packet buffer full (tcp-buffer-full) 41 TCP Out-of-Order packet buffer timeout (tcp-buffer-timeout) 343 TCP RST/SYN in window (tcp-rst-syn-in-win) 13323 TCP DUP and has been ACKed (tcp-acked) 379384 TCP packet failed PAWS test (tcp-paws-fail) 84304 IP option drop (invalid-ip-option) 12 ICMP Error Inspect no existing conn (inspect-icmp-error-no-existing-conn) 16 DNS Inspect invalid packet (inspect-dns-invalid-pak) 53 DNS Inspect invalid domain label (inspect-dns-invalid-domain-label) 50 DNS Inspect packet too long (inspect-dns-pak-too-long) 5353783 DNS Inspect id not matched (inspect-dns-id-not-matched) 5275 Anybody seen this before? Would be nice to see if there is a command to show offending packets but I cannot seem to find it. Thanks for the time. Cheers, -- Joe Renwick IP Network Consultant, CCIE #16465 GO NETFORWARD! Direct: 619-800-2055, Emergency Support: 800-719-0504 Is your network moving you forward?

1 0