- Test - lists.nanog.org

Update Spamhaus DROP list from Cisco CLI (TCL)
by Thomas Magill 25 Jan '11

25 Jan '11

Previous conversations made me decide this would be fun to do so I ignored all my real work today and made it happen. I built a TCL script that can be mapped to an alias ("alias exec updatedrop tclsh updatedrop.tcl") that will connect to the Spamhaus DROP list and route all of the prefixes to null0. It should alsbo be able to be mapped to a kron job, but I haven't tested that and I've heard there are issues with kron+tcl unless you tie it to an EEM event. It adds a name indicator (Spamhaus_SBLXXXXX) to all of the routes to show that they come from the DROP list. You can find the script at: http://tmagill.net/cisco_networking_ccie_studies/?p=83 There is also a script to remove all of the Spamhaus_SBLXXXXX null routes. If I were to redis these into BGP they could be propagated just like the CYMRU Bogons... I plan on doing that within the next week and start testing. Does anyone see that as a useful service to be offered? Thomas Magill Network Engineer Office: (858) 909-3777 Cell: (858) 869-9685 tmagill(a)providecommerce.com<mailto:tmagill@providecommerce.com> provide-commerce 4840 Eastgate Mall San Diego, CA 92121 ProFlowers<http://www.proflowers.com/> | redENVELOPE<http://www.redenvelope.com/> | Cherry Moon Farms<http://www.cherrymoonfarms.com/> | Shari's Berries<http://www.berries.com/>

5 5

Re: IPv6: numbering of point-to-point-links
by Lasse Jarlskov 25 Jan '11

25 Jan '11

Thank you all for your comments - it appears that there is no consensus on how this should be done. Thank you for the reference to this draft, Marco - and to Ron as well. Both RFC3627 and this draft appears to be stating that these issues a implementation-specific. E.g. whether an implementation will perform subnet-router-anycast on a small subnet, whether Neighbor-Discovery-messages are rate-limited etc. Does anyone have any information on how different vendors handle this - even in older software? /126 appears to be the middle path - which is reserving the subnet-router-anycast address while keeping the subnet as small as possible. This appears to address both issues - at least for Ethernet links. (one free address will hardly constitute a potential Neighbor Cache Exhaustion issue). Best regards, /Lasse -----Oprindelig meddelelse----- Fra: Marco Hogewoning [mailto:mch-nanog@xs4all.nl] Sendt: 24. januar 2011 14:11 Til: Lasse Jarlskov Cc: nanog(a)nanog.org Emne: Re: IPv6: numbering of point-to-point-links > While reading up on IPv6, I've seen numerous places that subnets are now > all /64. > > I have even read that subnets defined as /127 are considered harmful. RFC3627, with a lot of discussion in the IETF on this. See also https://datatracker.ietf.org/doc/draft-ietf-6man-prefixlen-p2p/ > However while implementing IPv6 in our network, I've encountered several > of our peering partners using /127 or /126 for point-to-point links. I personally don't any benefit in using /126 subnets. > What is the Best Current Practice for this - if there is any? > > Would you recommend me to use /64, /126 or /127? > > What are the pros and cons? >From an operational point of view there is a risk that be using /64 somebody can eat away a lot of memory by either scanning or even changing addresses. This is also described in the draft above... I would personally recommend to at least always assign the /64, even if you would decide to configure the /127. RFC 3627 has been around long enough that you will keep running into equipment or software that won't like the /127. In which case you can always revert back to /64. This will also allow you to use easy to remember addresses like ::1 and ::2, saving you the headache of a lot of binary counting. Grtx, Marco

2 1

bestpath as-path multipath-relax
by Zaid Ali 24 Jan '11

24 Jan '11

I am looking for some operational feedback of this undocumented feature, bgp bestpath as-path multipath-relax, for IOS. If you are using this for outbound load balancing I would like to hear your experiences. Also if you are running it across edges. Thanks, Zaid

1 0

The Conficker Working Group Lessons Learned Document
by freed0 24 Jan '11

24 Jan '11

http://www.confickerworkinggroup.org/wiki/pmwiki.php/ANY/LessonsLearned http://www.confickerworkinggroup.org/wiki/uploads/Conficker_Working_Group_L… The Conficker Working Group Lessons Learned Document Starting in late 2008, and continuing through June of 2010, a coalition of security researchers worked to resist an Internet borne attack carried out by malicious software known as Conficker. This coalition became known as “The Conficker Working Group”, and seemed to be successful in a number of ways, not the least of which was unprecedented cooperation between organizations and individuals around the world, in both the public and private sectors. In 2009, The Department of Homeland Security funded a project to develop and produce a “Lessons Learned” document that could serve as a permanent record of the events surrounding the creation and operation of the working group so that it could be used as an exemplar upon which similar groups in the future could build. This is the document. The Rendon Group conducted the research independently, and although a number of members of the Conficker Working Group were interviewed, and provided information to the authors, the report is the sole work product of the Rendon Group. The views and conclusions are not necessarily those of the Conficker Working Group, or any of its official or unofficial members. Nonetheless the Core Committee of the Conficker Working Group believes the report has substantial value and is pleased to provide access to the Rendon document via the Conficker Working Group Website. Rodney Joffe Chair Conficker Working Group Follow up questions can be directed to the Rendon Group at the address below, as well as the following members of the Conficker Working Group Core Committee: * The Rendon Group * Phone: +1 202-745-4900 * trginfo(a)rendon.com Conficker Working Group Core Committee: The ShadowServer Foundation * Andre' M. DiMino * Co-Founder and Director * Phone: +1 914-410-6480 * Email: adimino(a)shadowserver.org Neustar, Inc * Rodney Joffe * Senior Vice President * Phone: +1 202-533-2900 * Email: rodney.joffe(a)neustar.biz Verisign, Inc. * Ramses Martinez * Director of Information Security * Phone: +1 571-723-1874 * Email: ramartinez(a)verisign.com Arbor Networks * Kevin Whalen * kwhalen(a)arbor.net * Phone: +1 978-852-8432 Internet Software Consortium * Barry Greene * President * Phone: +1 650-423-1311 * Email: bgreene(a)isc.org

1 0

Verizon local CFA sanity check
by Christopher Pilkington 24 Jan '11

24 Jan '11

I'm writing a LOA/CFA doc for some DS1s to be delivered to us on a Verizon private OC12 ring, and I'm getting conflicting info (including from multiple people within Verizon) on how to address individual DS1s. For STS/DS3s, it's pretty obvious, just the STS number, i.e. <SCID>/OC12/<STS>/<CLLI_there>/<CLLI_here> Anyone know for certain how Verizon numbers DS1 channels on an OC on a CFA doc? For clarity, this is Verizon local, Manhattan. Thanks, -cjp

2 2

Re: Using IPv6 with prefixes shorter than a /64 on a LAN
by Chris Nicholls 24 Jan '11

24 Jan '11

On Monday, 24 January 2011 at K:59:59 -0200, Carlos Martinez-Cagnazzo wrote: > I am particularly wondering about possible NDP breakage. +1 We allocate /64 per PtP but only configure /127 for NDP and secrity concerns, I figure we can always change the mask if the space is set asside from the get go. ta -- Chris Nicholls Timico Network Operations chris(a)timico.net

1 0

anyone running GPS clocks in Southeastern Georgia?
by Robert E. Seastrom 24 Jan '11

24 Jan '11

It is unclear from this NOTAM whether this is an intentional perturbation of the satellite signals vs. a terrestrial transmitter (my money is on the latter), but it illustrates why one might want geographically dispersed time sources on one's network, as well as why the current trend towards decommissioning LORAN (and in the future, other navaids) in favor of reliance on a single source is a Bad Plan. I'd be curious to see what effects (if any) those who use GPS-disciplined NTP references in Southeastern Georgia see from this experiment. https://www.faasafety.gov/files/notices/2011/Jan/GPS_Flight_Advisory_CSFTL1… -r

21 27

National Squirrel Appreciation Day
by Jay Ashworth 22 Jan '11

22 Jan '11

The holiday is today, according to holidayinsights.com http://www.holidayinsights.com/moreholidays/January/squirrelappreciation.htm Did anyone ever do the scope-sight T-shirt? No, wait; that was a backhoe. Cheers, -- jra

5 4

World IPv6 Day
by Scott Howard 22 Jan '11

22 Jan '11

>From http://www.networkworld.com/news/2011/011211-world-ipv6-day.html Several of the Internet's most popular Web sites - including Facebook, Google and Yahoo - have agreed to participate in the first global-scale trial of IPv6, the long-anticipated upgrade to the Internet's main communications protocol known as IPv4. The trial — dubbed "World IPv6 Day" — requires participants to support native IPv6 traffic on their main Web sites on June 8, 2011. Leading content delivery networks Akamai and Limelight Networks also committed to the IPv6 trial, which is being sponsored by the Internet Society. [...] Scott.

5 4

new subscription management tools driven by LTE?
by Rogelio 22 Jan '11

22 Jan '11

With LTE picking up momentum, what type of new subscription management tools will operators need? (e.g. control complexities of billions of mobile data transactions, personalized billing, centralized control across various licensed and unlicensed bands, alerts when limits reached, etc.) Bridgewater is one that I have been looking at lately... http://www.bridgewatersystems.com/LTE.aspx ...but I would be curious as to what other companies are seeing out there.

1 0