- Test - lists.nanog.org

Need provider suggestions - BGP transit over GRE tunnel
by Robert Johnson 28 Jan '11

28 Jan '11

My organization is planning to become multihomed in the near future. Currently we have redundant (router and physical path) links to a single AS where we get our transit, and speak BGP to them using a private ASN. This configuration has not been meeting our reliability requirements, so we will be getting our own ASN from ARIN, and moving from PA to PI IP space. Our new provider will be used for backup purposes only. We would like to minimize the monthly cost of this connection; to do this, we are planning to use a VZ business FIOS connection with symmetrical bandwidth to establish a GRE tunnel to a datacenter somewhere, and bring up a BGP session over that tunnel. I'd like to know if there are providers that offer such a service on a regular basis, and if so, if anyone is doing this and has words of wisdom. Thanks in advance.

3 2

Re: [arin-announce] ARIN Resource Certification Update
by Samuel Weiler 28 Jan '11

28 Jan '11

[moderation seems slow; resending from subscribed address instead] On Mon, 24 Jan 2011, Danny McPherson wrote: > I suspect I've sufficiently chummed the waters, I'll kick back and absorb > all the reasons this is a whack idea :) Short summary: it's not entirely whack, but no one has yet put forward a working data model. The scheme in Bill Manning's INET'98 paper might have worked for classFUL addresses, but not CIDR. I think there may have been similar problems with Lutz Donnerhacke and Wouter Wijngaards' scheme(s) from 2008. Joe Abley's problem statement on this list gets to one of the issues. Your answer to him of "New prefix-based RRs? And perhaps even a new .arpa or in-addr.arpa subdomain" is a bit short on details. I challenge you to work out the details. Once we have something concrete, then we can pick apart why it won't work, tweak, and repeat. -- Sam

1 0

Egypt Telecom AS isolation
by exploit dev 28 Jan '11

28 Jan '11

Hi to all, I try with BGPlay to show something related to BGP Traffic for some prefix of as8452. If you are interested check: http://extraexploit.blogspot.com/2011/01/egypt-telecom-as-isolation-bgplay-… -- http://extraexploit.blogspot.com

1 0

.com DNSSEC operational message
by Matt Larson 28 Jan '11

28 Jan '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Over the next several weeks, Verisign will deploy DNSSEC in the .com zone. This message contains operational information related to the deployment that might be of interest to the Internet operational community. The .com DNSSEC deployment consists of the following major milestones: February 26, 2011: The .com registry system will allow ICANN-accredited registrars to submit DS records for domains under .com. These DS records will not be published in the .com zone until the .com zone is actually signed. February 28, 2011: A deliberately unvalidatable .com zone will be published. Any DS records for .com that have been submitted by registrars will be published in the deliberately unvalidatable zone. March 31, 2011: The .com key material will have been unobscured over the course of the preceding several days and the .com zone will now be usable for DNSSEC validation. DS records for .com should appear in the root zone on this day. If you have any questions or comments, please send email to info(a)verisign-grs.com or reply to this message. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (Darwin) iQEVAwUBTULLoNdGiUJktOYBAQLgewgAkGWNabyhkidMp5Y/58yDl90td1PFd7X7 Q3rQNAeWOrbJFrMuLoBbmKpfk68c4MjIYzCTKwdER84Jj4MRxbNiDgsMpk3+Br5R qM3NdskB9AwZ90foPU4MPDw8IvBK7SsOHltsf5eyLGbKkoNPBzcDiK3woSTX2XbR xTwOlAHTMdF1IP5o3ytca3a4BwqeRmrErAJGDVlWvbK3KPeV9iDWa+jCkoFTcDD8 6p3syOjimnaJnagRPnm5HodeNb9gH2SVZqKHczKBsapxL5wga2MIAowdmBwzL1Wi DuUzTg5eWx7tG0F112lAyHDCFhil7KLHllree/dqXyyic7paV0e1uA== =bGtT -----END PGP SIGNATURE-----

1 0

PPPOE vs DHCP
by Paul Stewart 28 Jan '11

28 Jan '11

Hey folks... I'm meeting with a customer tomorrow (service provider, rural telco) and we're pitching they move to a PPPOE platform most likely. But to be fair, I'm looking to draw up a comparison so they are "well informed" of the pros/cons. Has anyone done this? I came up with the following brief start: PPPOE vs DHCP PPPOE Pros ---------- Allows full authentication of customers (requires username/password) Allows control over customer connections (suspend accounts, create accounts etc) Easily assign static IP to customer (no MAC address or CPE information required) Assign public subnet to customer with ease (no manual routing required) IPv4/IPv6 fully supported on Juniper platform as required Usage tracking (GB transfer) from radius generated data PPPOE Cons ---------- Requires PPPOE termination router (Juniper ERX for example) Requires Radius server(s) to assign and track customer IP assignments/usage Customers require username/password to connect Customers require PPPOE client software or router to connect 8 bytes MTU overhead DHCP Pros --------- Simplistic - plug and play 90% of the time No MTU overhead, full 1500 MTU frame size DHCP Cons --------- No authentication occurs (anyone physically connected can use Internet generally) No user tracking without tracking customer CPE MAC addresses No usage tracking builtin to DHCP (GB transfer) There are several factors involved here. The first major thing is that we believe the customer wants to move towards caps on their customer usage (X amount of GB per month). Today, they are doing static IP assignments but the interesting thing is that the CPE they have control over today (Comtrend routers with DSL modem builtin). I know there's not always a good vs bad here but looking for opinions from folks who may have already done this comparison for a "boardroom discussion".... Thanks ;) Paul

9 19

Found: Who is responsible for no more IP addresses
by Hank Nussbacher 28 Jan '11

28 Jan '11

"World to run out of IP addresses soon, Internet expert says" http://news.xinhuanet.com/english2010/sci/2011-01/26/c_13708282.htm "Vint Cerf, who helped create IPv4 in 1977 and one of the founding fathers of the Web, told Australia's Sydney Morning Herald that IP addresses will be used up soon, perhaps within weeks. "I thought it was an experiment and I thought that 4.3 billion IPv4 addresses would be enough to do an experiment," Cerf was quoted as saying, adding it is his "fault" that "we were running out of the addresses."" Glad we cleared that up! :-) -Hank

24 31

overview of RAN solutions?
by Rogelio 28 Jan '11

28 Jan '11

I am wrapping my mind around the myriad of RAN solutions out there, and I would appreciate it if someone had a good overview of the subject or could direct me to new vendors worth investigating. So far, I see ones that are designed to (a) increase coverage, (b) increase capacity, or (c) do some combo of (a) and (b). Some solutions suck in the donor signal (antennas on top of roof) and then blow it back indoors on various frequencies. A good example of this is something like Axell, which doesn't appear to add much capacity, just stretch the existing uplink's capacity by amplifying the signal indoors. Other solutions (IP-RAN, E-RAN, etc) have an Internet / IP component and allow for all sorts of cool things (synchronization between units for soft handoff, etc). SpiderCloud seems to be a good play here. Then there are other niche plays that don't do everything, but seem to be good enough for various applications, like SMS texting. If I remember right, IPAccess did this sort of thing for schools (which is perfect for emergencies). Any others I should look into? I'm primarily interested in carrier-grade ones... -- Also on LinkedIn? Feel free to connect if you too are an open networker: scubacuda(a)gmail.com

1 0

best PCRF for pre-paid mobile solutions?
by Rogelio 28 Jan '11

28 Jan '11

I am researching some PCRF solutions for some work I am doing with non-US operators, and I am looking for features that work well in pre-paid mobile environments, particularly ones that want to cap or charge 3G and WiFi at different rates / levels. Any suggestions or contacts? -- Also on LinkedIn? Feel free to connect if you too are an open networker: scubacuda(a)gmail.com

1 0

Re: [arin-announce] ARIN Resource Certification Update
by Randy Bush 28 Jan '11

28 Jan '11

> Why does this stop the whole thing short? the devil is in the details and the trust. i am desperately open to other approaches. but work it out at the detailed level, not just a troll on nanog. i anxiously await your and danny's draft. randy

1 0

Re: [arin-announce] ARIN Resource Certification Update
by Osterweil, Eric 28 Jan '11

28 Jan '11

On 1/25/11 7:04 AM, "Roland Dobbins" <rdobbins(a)arbor.net> wrote: > > > On Jan 25, 2011, at 9:52 PM, Joe Abley wrote: > >> If the DNS was as unreliable as those words suggested, nobody would use it. > > I see evidence of this unreliability every day, so I must respectfully > disagree. > > ;> > >> The reality is that everybody uses it. > > The reality is that they don't really have a choice, now, do they? > > ;> I think it's actually correct, and backs up Danny's point: it is very useful to be able to use a system that is: deployed, understood, operationally viable, etc. The risk of designing from scratch is best described by the lead time many other architectural changes have/are facing in being deployed. I think the bottom line is that this infrastructure will allow a security solution to reach deployment _much_ sooner than a green-field design. Eric

2 1