- Test - lists.nanog.org

Fwd: Connectivity status for Egypt (update from Egypt)
by Marshall Eubanks 02 Feb '11

02 Feb '11

Begin forwarded message: > From: "Ahmed Maged (amaged)" <amaged(a)cisco.com> > Date: February 2, 2011 11:03:23 AM EST > To: <tme(a)americafree.tv> > Subject: FW: Connectivity status for Egypt (update from Egypt) > > Please forward to nanog. > > -----Original Message----- > From: nanog-owner(a)nanog.org [mailto:nanog-owner@nanog.org] > Sent: Wednesday, February 02, 2011 04:50 PM W. Europe Standard Time > To: Ahmed Maged (amaged) > Subject: Re: Connectivity status for Egypt (update from Egypt) > > You are not allowed to post to this mailing list, and your message has > been automatically rejected. If you think that your messages are > being rejected in error, contact the mailing list owner at > nanog-owner(a)nanog.org. > > > > From: "Ahmed Maged (amaged)" <amaged(a)cisco.com> > Date: February 2, 2011 10:51:08 AM EST > To: "Marshall Eubanks" <tme(a)americafree.tv>, "Jim Cowie" <cowie(a)renesys.com> > Cc: <nanog(a)nanog.org> > Subject: Re: Connectivity status for Egypt (update from Egypt) > > > Hi Guys, > > I read most of the thread and I'll try to confirm what I can. > > Obviously, we are back online and yes it was decided by the government to > take the country offline. > > They first started blocking twitter and rate limited/blocked facebook but > later they just decided, everything must go. > > Two days ago, Google and Twitter came up with a way to help people tweet > using land lines. > > Some international WAN links are functioning and that's because of how the > switch was killed. International links go to the same place in either Cairo > or Alexandria (Telco Exchange). > > We do have a couple of IXs, but there is just no real interesting local > traffic, everyone wants facebook and twitter. Which is all international > > Everyone just stayed home because of Army imposed Curfew so the internet and > business was just on PAUSE and still is. > > Mobile phones were also off for two days but later they were brought back. > > The reason why they decided to do that is because the whole protest was > organized on Facebook initially, people agreed to go to Tahrir square > (liberation square) downtown together and a lot followed the groups > invitation. > > Later on, people joined despite all the attempts to block the internet and > communication. > > Some consider this act as a crime because they cut the tongues of people > this way and the government sees it as a step to stop the demonstrations. > > Huge businesses will be affected, one small example is international call > centers. > > You will all see clearly that we have bad bad aggregation, if you can > analyze this and write a note about it, I'll be able to pass it to the right > people when we get life back in order. > > In case things go bad again, we will really need international dial up so if > you can help setting this up, it will be appreciated. > > I have to go now to stand in front of my building to protect it (as > everyone) because thugs and thieves were let loose on the streets (by the > government). > > Regards, > Ahmed Maged > > > From: Marshall Eubanks <tme(a)americafree.tv> > > Date: Wed, 2 Feb 2011 08:25:42 -0500 > > To: Jim Cowie <cowie(a)renesys.com> > > Cc: <nanog(a)nanog.org> > > Subject: Re: Connectivity status for Egypt > > > > > > On Feb 2, 2011, at 6:23 AM, Jim Cowie wrote: > > > >> > >> > >> On Wed, Feb 2, 2011 at 6:17 AM, Teo Ruiz <teoruiz(a)gmail.com> wrote: > >> On Tue, Feb 1, 2011 at 21:30, Marshall Eubanks <tme(a)americafree.tv> wrote: > >>> On Jan 31, 2011, at 5:14 PM, Marshall Eubanks wrote: > >>> > >>>> As an update, BGP for Noor.net has been withdrawn. Even the Egyptian stock > >>>> exchange - egyptse.com - now appears to be off the Internet. > >>> > >>> I have been told that the Egyptian Prime Minister has publicly announced > >>> that the Internet would be restored soon, but at present neither my > >> > >> Looks like it's coming back: http://stat.ripe.net/egypt > >> > >> ~2500 prefixes being announced now. > >> -- > >> teo - http://www.teoruiz.com > >> > >> "Res publica non dominetur" > >> > >> Yes, confirmed from 09:29 UTC. Basically all major providers are back, full > >> status quo ante (modulo reagg), major sites are up. > >> > >> http://www.renesys.com/blog/2011/02/egypt-returns-to-the-internet.shtml > > > > It's not just BGP - DNS (based on the samples I have been testing) seems to be > > fully back too. > > > > Regards > > Marshall > > > >> > >> Good thoughts go out to the guys in the EG NOCs this morning. Nanog wants > >> to hear your war stories some day over a cup of tea. > >> > >> --jim > >> > > > > > > > > >

1 0

netflow analysis for jitter and packet loss?
by Shacolby Jackson 02 Feb '11

02 Feb '11

What tools are people most happy with? Specifically I'm hoping to mirror a port and later see if I can detect any inbound jitter or possibly even out of order udp datagrams. At first glance it doesn't look like ntop or plixer can provide that level of detail. Any suggestions? -shac

4 3

RE: Connectivity to Brazil
by Matt Disuko 02 Feb '11

02 Feb '11

Algar looking Glass: http://lg.ctbc.com.br/lg/ I found the response from the GC engineer. It won't mean much cut&pasted verbatim and out of context, so I'll just summarize. Basically, I was seeing vastly different response times to given hosts in the same subnet on CTBC's network. My source ip was the same. Traceroute revealed to me the packets taking different paths, after hitting a particular GLBX router. The GC engineer said CTBC is a customer that hangs off of this particular router, and that traffic was hitting an interface and hair-pinning back out to the customer's segment. He pointed to possible congestion on CTBCs switching fabric as the cause for the varied response times (conceivable) and different routes (um...ok maybe some kind of load-balancing at play). I managed to call CTBC (Algar) and confirmed they were experiencing congestion issues and they had a scheduled circuit capacity upgrade with GLBX in a few weeks. As a network admin, i find it sometimes sadly humorous how we can poke and prod at a problem, go through various carrier support channels and scratch our heads for hours/days when all it would normally take is a RO userid on a couple routers in the path to figure things out. that's not too much to ask, right? ;) -matt > CC: vinny(a)abellohome.net; nanog(a)nanog.org > From: the76posse(a)gmail.com > Subject: Re: Connectivity to Brazil > Date: Wed, 2 Feb 2011 08:07:14 -0500 > To: gourmetcisco(a)hotmail.com > > That thread detail would be very interesting to me. Thanks for the heads up. > > Sent from my iPhone > > On Feb 2, 2011, at 7:14 AM, Matt Disuko <gourmetcisco(a)hotmail.com> wrote: > > > Very interesting. I have had similar issues with connectivity to my Brazil office, and oddly enough it involved GBLX and CTBC (now called Algar Telecom). I also vastly divergent paths to a couple hosts in the same subnet. I ended up communicating with GBLX via email (who were actually really great in corresponding with me)...the engineer pointed to some sort of link capacity issue...i'll dig up the thread... > > > > > Date: Wed, 2 Feb 2011 01:21:09 -0500 > > > From: vinny(a)abellohome.net > > > Subject: Re: Connectivity to Brazil > > > To: the76posse(a)gmail.com > > > CC: nanog(a)nanog.org > > > > > > We saw similar issues with IKE through Global Crossing (as odd as that sounds) out of the NYC market at the same time. We routed around them and problem solved. Still scratching our heads on that one... In my experiences, GLBX has numerous odd issues to the point where it's become a bad joke anytime something breaks with connectivity... we blame them. It's kind of not funny though because it's almost always true. Taking them out of the equation usually fixes the problem. One of our customers who is frequently affected by GBLX problems jumps to the (often correct) conclusion that they are causing problems. :-/ > > > > > > -Vinny > > > > > > On Feb 1, 2011, at 3:57 PM, Steve Danelli wrote: > > > > > > > Thanks for the response. > > > > > > > > Ike had worked great up until Monday. The provider did a local test and our box saw the Ike packets so it appears to lie somewhere upstream. (GLBX may be a good guess) > > > > > > > > Also - the paths are stable and we are sourcing from the same ip - very strange behaivor. Hope someone from GLBX or CTBC (or someone who had experienced an issue like this) can assist > > > > > > > > > > > > Thanks to all for their feedback so far. > > > > > > > > SD > > > > > > > > On Feb 1, 2011, at 3:19 PM, Valdis.Kletnieks(a)vt.edu wrote: > > > > > > > >> On Tue, 01 Feb 2011 08:54:47 EST, Steve Danelli said: > > > >> > > > >>> Some carrier, somewhere between us and the service provider is selectively > > > >>> dropping the IKE packets originating from our VPN gateway and destined for > > > >>> our Brazil gateway. Other traffic is able to pass, as are the IKE packets coming > > > >>> back from Brazil to us. This is effectively preventing us from establishing > > > >>> the IPSEC tunnel between our gateways. > > > >> > > > >> Has IKE been known to work to that location before? Or is this something new? > > > >> My first guess is some chucklehead banana-eater at the service provider either > > > >> fat-fingered the firewall config, or semi-intentionally blocked it because it > > > >> was "traffic on a protocol/port number they didn't understand so it must be > > > >> evil". > > > >> > > > >>> Also something else is awry, for two given hosts on the same subnet (x.y.z.52 > > > >>> and x.y.z.53), they take two wildly divergent paths: > > > >> > > > >>> Anyone have any insight on to what may be occurring? > > > >> > > > >> The paths appear to diverge at 67.16.142.238. I wonder if that's gear trying > > > >> to do some load-balancing across 2 paths, and it's using the source IP as a > > > >> major part of the selector function ("route to round-robin interface source-IP > > > >> mod N" or similar?). > > > >> > > > >> The other possibility is your two traceroutes happened to catch a routing flap in > > > >> progress (obviously not the case if the two routes are remaining stable). > > > >> > > > >> Sorry I can't be more helpful than that... > > > > > > > > > >

1 0

Connectivity status for Egypt
by Danny O'Brien 02 Feb '11

02 Feb '11

Around 2236 UCT, we lost all Internet connectivity with our contacts in Egypt, and I'm hearing reports of (in declining order of confirmability): 1) Internet connectivity loss on major (broadband) ISPs 2) No SMS 4) Intermittent connectivity with smaller (dialup?) ISPs 5) No mobile service in major cities -- Cairo, Alexandria The working assumption here is that the Egyptian government has made the decision to shut down all external, and perhaps internal electronic communication as a reaction to the ongoing protests in that country. If anyone can provide more details as to what they're seeing, the extent, plus times and dates, it would be very useful. In moments like this there are often many unconfirmed rumors: I'm seeking concrete reliable confirmation which I can pass onto the press and those working to bring some communications back up (if you have a ham radio license, there is some very early work to provide emergency connectivity. Info at: http://pastebin.com/fHHBqZ7Q ) Thank you, -- dobrien(a)cpj.org Danny O'Brien, Committee to Protect Journalists gpg key: http://www.spesh.com/danny/crypto/dannyobrien-key20091106.txt

37 63

Bovespa
by Philip Lavine 02 Feb '11

02 Feb '11

1. Does anyone know where the Bovespa is located and if colocation is a possibility at that datacenter/s. 2. What is a good Internet (DS3? or ethernet) carrier in Sao Paolo thank you Philip

3 2

Re: quietly....
by Brandon Butterworth 02 Feb '11

02 Feb '11

> Example: if you give administrators the option of putting a router > address in a DHCP option, they will do so and some fraction of the > time, this will be the wrong address and things don't work. They cause themselves a problem then they fix it. > If you let routers announce their presence, then it's virtually > impossible that something goes wrong s/impossible/certain > because routers know who they are It doesn't mean they're right. If I choose DHCP I've made the choice to define how this network works. I then want it to carry on like that, not depend on others not screwing up too. > A clear win. Of course it does mean that people <gasp> have to > learn something new when adopting IPv6. It means all administrators now have to guard against trivial errors by all end users. Lot larger fail surface It's not about dislike of new, it's dislike of pointless risk brandon

1 0

DHCP server fail-over and accounting
by Joe 02 Feb '11

02 Feb '11

hi, we plan to implement DHCP server farm in our network. Currently , there are there problems burning my head. could anybody do some help? 1. How to set up DHCP server farm with high availability? It's required to set up DHCP server with 99.999% available. To our experience, this needs to set up DHCP server on two sites and syncronize their content in real time. Beside this , we hope there should be as less modification as possible on edge router when one DHCP server is down. should anycast architecture helpful ? or should we just set up two dhcp servers on two sites and sync. with ISC DHCPD? is there any other method for fail-over and high availability? 2. How to set up accouting and authentication with DHCP? Regulation and content based pricing is demanded. So, we plan to authenticate customer and accouting on their usage. In previous list post, someone said Juniper could do radius before DHCP. Does this mean Juniper could authenticate user with radius (username/password) before DHCP ? Is there anyway to collect user traffic under DHCP ? 3. Someone said PPPOE is not good for customer looking for long time online , DHCP is an good option. But, to my understanding DHCP is just good for those looking for easy-transfer to IPv6 , because pppoe could also make user on line as long as possible. Is there any reference on DHCP server consideration on 4-to-6 migration? Joe

3 2

Re: Future of the IPv6 CPE survey on RIPE Labs - Your Input Needed
by Chris Conn 02 Feb '11

02 Feb '11

> On 27/01/11 08:17 -0600, Jack Bates wrote: >> On 1/27/2011 12:57 AM, Frank Bulk wrote: >>> Have you looked at D-Link's DIR-825? It has most of the things you're >>> looking for. The DIR-655 is a more affordable option. >>> >> Haven't had the chance to look at that one. Will check it out. >> >>> In regards to (2), is it even possible to do DHCPv6-PD on with a SLAAC WAN? >>> >> It had better be, as IOS 12.2 SRE only supports SLAAC + DHCPv6-PD. >> Most of the Cisco documentation I've seen, says that is their >> beautiful layout. No more proxyarp/nd. Instead, assign a /64 to each >> subinterface, perform SLAAC, then hand out prefixes via DHCPv6-PD if >> someone needs a prefix. > > The DIR-825(Rev B) running firmware 2.05NA does. From the status screen: > > IPv6 Connection Type : Autoconfiguration (SLAAC/DHCPv6) > Network Status : Connected > > WAN IPv6 Address : 2610:b8:0:234:218:e7ff:fef8:66dc/64 > IPv6 Default Gateway : fe80::c67d:4fff:fed6:5401 > LAN IPv6 Address : 2610:b8:100f:1:218:e7ff:fef8:66db/64 > LAN IPv6 Link-Local Address : fe80::218:e7ff:fef8:66db/64 > Primary IPv6 DNS Server : 2610:b8:0:3:215:c5ff:fef3:f9c8 > Secondary IPv6 DNS Server : 2610:b8:0:3:215:c5ff:feee:9448 > DHCP-PD : Enabled > IPv6 network assigned > by DHCP-PD : 2610:b8:100f::/48 > > The latest firmware has fairly good support, but is lacking configurable v6 > firewall settings. I haven't done any firewall testing yet, but I'd imagine > all incoming v6 connections are blocked. > > The Emulator hasn't been updated yet to reflect the options in the new > firmware, but this should give you an idea of what the configuration looks > like: > > http://www.support.dlink.com/emulators/dir825_revB/203NA/adv_link_local.html > > The DIR-615 should have similar support, but I haven't upgraded it yet. Hello, As for the DIR-615, it should, but it doesn't...At least, the E3/E4 revisions I had. I contacted D-LINK support and was able to get a beta build that seems promising. But DHCP-PD over PPPoE works relatively well, minus a couple of little "features". I am hoping to have that hammered out soon, as the 615 is a capable little sub-50$ home CPE. But D-Link engineering seems receptive to my observations. I have to check the state of the firewalling in it too ;) Chris

4 5

A top-down RPKI model a threat to human freedom? (was Re: Level 3's IRR Database)
by Martin Millnert 02 Feb '11

02 Feb '11

Here be dragons, On Sun, Jan 30, 2011 at 12:39 PM, Carlos Martinez-Cagnazzo <carlosm3011(a)gmail.com> wrote: > The solution to this problem (theoretical at least) already exist in > the form of RPKI. Any top-down RPKI model is intrinsically flawed. Deploying an overlay of single-point(s) of failure on top of a well-functional distributed system such as the Internet does not seem like a solution to much. The Internet works reasonably well only because it is reasonably distributed. I acknowledge that: 1) there are occasionally routing problems, 2) that IPv4 will deteriorate further very rapidly as it runs out and second-hand markets pick up, 3) that spammers run BGP and abuse, seemingly primarily, the non-RIR IRR-dbs. The answer to these issues is not by default RPKI IMO. For example, how about: 1, fix them - are there any problems that hasn't been fixed or were seriously hard to fix? Enumerate and let's go specific; let's not deploy a tank to push in a screw. 2, IPv6? 3, improve/remove non-RIR IRR-dbs It should be fairly obvious, by most recently what's going on in Egypt, why allowing a government to control the Internet is a Really Bad Idea. While it is true that governments are more or less in control of the *geographic area* they govern, as is evident in Egypt, there is a serious and big difference between the ease of removing a prefix from the Internet today in a country and how easy it will be in the fully network-deployed RPKI case, because of the hierarchical model (send your tanks to the RIR office(s) instead of every single country). Yes, governments exploit capabilities given to them by technological means ("we do it just because we can" is a standing motto). A top-down RPKI model would be a severely negative development of the resilience of the Internet, especially for freedom-aspiring people (approximately equal to humankind?), who need to avert government suppression. If we are to go down this path, at the very least it must stay architecturally/technologically *impossible* for a entity from country A to via-the-hierarchical-trust-model block a prefix assigned to some entity in country B, that is assigned by B's RIR and in full accordance with the RIR policies and in no breach of any contract. If not, we're doing humanity a disservice. One that I have no doubt would simply spawn/grow further overlay-networks to counter the problem. Cheers, Martin > > On Sun, Jan 30, 2011 at 6:23 AM, Andrew Alston <aa(a)tenet.ac.za> wrote: >> Hi All, >> >> I've just noticed that Level 3 is allowing people to register space in its IRR database that A.) is not assigned to the people registering it and B.) is not assigned via/to Level 3. >> >> So, I have two queries >> >> A.) Are only customers of Level 3 allowed to use this database >> B.) Can someone from Level 3 please clarify if there are any plans to lock this down slightly >> >> At this point, it would seem that if you are a customer of level 3's, you can register any space you feel like in there, and announce anything you feel like once the filters propagate, which in my opinion completely nullifies the point of IRR in the first place. >> >> Though I think this also raises the question about IRR databases in general. Would it not be far more sane to have each RIR run a single instance each which talk to each other, which can be verified against IP address assignments, and scrap the distributed IRR systems that allow for issues like this to occur? >> >> (In the mean time I've emailed the relevant people to try and get the entries falsely registered in that database removed, and will wait and see if I get a response). >> >> >> Andrew Alston >> TENET - Chief Technology Officer >> Phone: +27 21 763 7181 >> >> > > > > -- > -- > ========================= > Carlos M. Martinez-Cagnazzo > http://www.labs.lacnic.net > ========================= > >

12 30

Re: ipv4's last graph
by Scott Weeks 01 Feb '11

01 Feb '11

--- townsley(a)cisco.com wrote: From: Mark Townsley <townsley(a)cisco.com> On Feb 1, 2011, at 9:11 PM, Geoff Huston wrote: > On 01/02/2011, at 7:02 PM, Randy Bush wrote: >> graphs any more. might we have one last one for the turnstiles? :-)/2 >> >> and would you mind doing the curves now for each of the five rirs? >> gotta give us all something to repeat endlessly on lists and in presos. > > but of course. > > http://www.potaroo.net/tools/ipv4/rir.jpg I can almost hear the cutting and pasting going on across the globe with this. ------------------------------------------------------- Yes... :-) I did my share of cut-n-paste over here in an effort to pull folks' head out of their...uhhh...the sand. scott

1 0