- Test - lists.nanog.org

RE: ipfix/netflow/sflow generator for Linux
by Thomas York 08 Dec '10

08 Dec '10

I just retested nprobe and it has the same issue as most of the other tools. It doesn't specify the InputInt and OutputInt properly. Yes, you can statically set it but that will drastically skew the data in this environment. I'm not against running multiple processes, I've just not found a product that runs using multiple processes that does what I need to. I just noticed the ntop version in EPEL is fairly old, so I'll try to compile the latest myself and see if it's more stable. Also, FYI to anyone who is interested in this, I've opened a support ticket with ipcad to fix the interface numbering issue. http://tinyurl.com/32pjyfa From: packetmonger(a)gmail.com [mailto:packetmonger@gmail.com] On Behalf Of Darren Bolding Sent: Monday, December 06, 2010 8:57 PM To: Thomas York Subject: Re: ipfix/netflow/sflow generator for Linux We've used nprobe with good success, passing the flows to ntop, nfsen etc. nProbe supports specifying the interface- so yes, you would have to run multiple processes, but I believe it would work. We went ahead and purchased the PF_RING driver as it significantly improved the capture performance of our systems. I'm assuming since you tried it, you really don't want to fire up a separate process for each interface? I'd love to hear what you thought about the various tools and what you end up deciding on. For us, we collect the data using nprobe and have had no problem getting ntop to stably analyze those flows when pointed to it. NFSEN is pretty damn cool also. We point various nprobe, netflow, sflow data at it with good effect. --D On Mon, Dec 6, 2010 at 11:15 AM, Thomas York <straterra(a)fuhell.com> wrote: At my current place of work, we use all Linux routers. I need to do some IP accounting/reporting and am currently trying to use Scrutinizer. Scrutinizer can use netstream, jstream, ipfix, netflow, and sflow data without qualms. My only issue is that I can't seem to find any good software for Linux that works with multiple interfaces to generate the flow information. I've tried ndsad, nprobe, softflowd, host sflow, and ipcad without much luck. Most of the software only works on one interface (which is useless as I need to do accounting for numerous interfaces). I've had the best luck with ipcad. The only thing that seems to not work with it is that it doesn't correctly give the interface number in the flow information. It refers to all interfaces as interface 65535. I've tried the config option for ipcad to map an interface directly to an SNMP interface ID, but that option of the config file seems to be ignored. Ntop functionally does exactly what I need, but it's extremely buggy. It segfaults after a few minutes, regardless of Linux distro or Ntop version. So..any ideas on what I can do to get good flow information from our Linux routers? -- -- Darren Bolding -- -- darren(a)bolding.org --

2 1

Re: A fascinating piece of spam
by Scott Weeks 08 Dec '10

08 Dec '10

From: "Scott Weeks" <surfer(a)mauigateway.com> From: Steven Bellovin <smb(a)cs.columbia.edu> Yup, same purported sender... ------------------------------------ >From what company? So we don't make the mistake of buying from them. ---------------------------------- Never mind, I got one too. www.bradleydentaloffice.com 8 ae1d0.mcr1.saltlake2-ut.us.xo.net (216.156.1.2) 9 ip65-46-63-46.z63-46-65.customer.algx.net (65.46.63.46) 10 206.130.126.61.west-datacenter.net (206.130.126.61) 11 68.169.38.135.static.westdc.net (68.169.38.135) Someone from Westhost here? <plonk> them please! scott

1 0

ARIN space not accepted
by Dustin Swinford 07 Dec '10

07 Dec '10

We have run into an issue with the 107.7.0.0/16 assigned to us several months ago. It appears that many sites have not yet accepted this space. I understand this is not a normal type post to NANOG, but hoped to get the word out to as many operators as possible. Does anyone know of a better way to get the word out to ask people to update their BOGONs/filters? Dustin Swinford | Sr. IP/Ethernet Engineer <http://www.deltacom.com/> Deltacom | Integrated Communications and Technology Solutions

11 11

ARIN receives 2 new /8 blocks
by Leslie Nobile 07 Dec '10

07 Dec '10

Hello- ARIN received the IPv4 address blocks 23.0.0.0/8 and 100.0.0.0/8 from the IANA on November 30, 2010. We will begin making allocations of /22 and shorter prefixes from these blocks in the near future in accordance with ARIN’s minimum allocation policy. Network operators may wish to adjust any filters in place accordingly. For informational purposes, a list of ARIN's currently administered IP address blocks can be found at: https://www.arin.net/knowledge/ip_blocks.html Regards, Leslie Nobile Director, Registration Services American Registry for Internet Numbers (ARIN)

1 0

Lightning Debates at NANOG 51
by Tom Daly 07 Dec '10

07 Dec '10

Folks, I've been tempted by the NANOG PC into trying to run some "Lightning Debates" at NANOG 51 in Miami. The idea, similar to lighting talks, is a 30 minute session, covering 3 debate topics, 10 minutes each. Each person would get 5 minutes to argue their side of the issue. Some ideas so far: UPS Systems: Battery vs. Flywheel Cooling: Raised floor vs. Underfloor Power: AC vs. DC Ethernet: 40GE vs. 100GE Optics: XFP vs. SFP+ Address Families: IPv4 vs. IPv6 I'm soliciting panelists, and ideas. Please let me know if you're interested in participating in what will hopefully be a unique and exciting session. Best, Tom -- Tom Daly http://dyn.com/

9 13

Re: Lightning Debates at NANOG 51
by Scott Weeks 07 Dec '10

07 Dec '10

--- tom(a)dyn.com wrote:From: Tom Daly <tom(a)dyn.com> > > Ethernet: 40GE vs. 100GE > people are debating which is better? really? I'm sure someone has an opinion... ---------------------------------------------------- On NANOG? Naahhhhhhh.... >;-) scott

1 0

IP6.ARPA Nameserver Change Completed
by Joe Abley 07 Dec '10

07 Dec '10

IP6.ARPA NAMESERVER CHANGE COMPLETED This is a courtesy notification of a change to the nameserver set for the IP6.ARPA zone. There is no expected impact on the functional operation of the DNS due to this change. There are no actions required by DNS server operators or end users. DETAIL The IP6.ARPA zone is used to provide reverse mapping (number to name) for IPv6, as described in RFC 3596. The servers which previously provided authoritative DNS service for the IP6.ARPA zone were as follows: TINNIE.ARIN.NET NS-SEC.RIPE.NET NS2.LACNIC.NET SEC1.APNIC.NET NS.ICANN.ORG As previously advised, processing began on Wednesday 2010-12-01 to change the nameserver set to the following, as described in RFC 5855: A.IP6-SERVERS.ARPA (operated by ARIN) B.IP6-SERVERS.ARPA (operated by ICANN) C.IP6-SERVERS.ARPA (operated by AfriNIC) D.IP6-SERVERS.ARPA (operated by LACNIC) E.IP6-SERVERS.ARPA (operated by APNIC) F.IP6-SERVERS.ARPA (operated by RIPE NCC) This change is now complete. Regards, Joe Abley Director DNS Operations ICANN

1 0

Darwin becomes home to first multicast mesh network
by Marshall Eubanks 07 Dec '10

07 Dec '10

Does anyone know if this is actually an IP multicast mesh network, and, if so, anything about its protocols and deployment experience ? Regards Marshall http://www.computerworld.com.au/article/370450/darwin_becomes_home_first_mu… Darwin has become home to the first multicast mesh network in Australia after the installation of an $8 million 109 camera CCTV self-healing wireless network. The project, set up to manage six square kilometres of Darwin's CBD, began after the NT Police, Fire and Emergency Services Department awarded the contract to Darwin-based security company, Security and Technology Services (STS). Managing 109 closed circuit TV cameras initially proved troublesome for the NT Police, which often experienced power outages resulting from lightning strikes as well as the transmission of high definition video streams from cameras to three police stations and a fourth remote storage facility. Adelaide based network company MIMP was chosen by STS to deliver a highly redundant, high performance 128-bit data encrypted wireless network to integrate Darwin’s central camera system.--

1 0

ipfix/netflow/sflow generator for Linux
by Thomas York 06 Dec '10

06 Dec '10

At my current place of work, we use all Linux routers. I need to do some IP accounting/reporting and am currently trying to use Scrutinizer. Scrutinizer can use netstream, jstream, ipfix, netflow, and sflow data without qualms. My only issue is that I can't seem to find any good software for Linux that works with multiple interfaces to generate the flow information. I've tried ndsad, nprobe, softflowd, host sflow, and ipcad without much luck. Most of the software only works on one interface (which is useless as I need to do accounting for numerous interfaces). I've had the best luck with ipcad. The only thing that seems to not work with it is that it doesn't correctly give the interface number in the flow information. It refers to all interfaces as interface 65535. I've tried the config option for ipcad to map an interface directly to an SNMP interface ID, but that option of the config file seems to be ignored. Ntop functionally does exactly what I need, but it's extremely buggy. It segfaults after a few minutes, regardless of Linux distro or Ntop version. So..any ideas on what I can do to get good flow information from our Linux routers?

8 11

How do you do rDNS for IPv6 ?
by John Levine 06 Dec '10

06 Dec '10

I've been pondering IPv6 setups, and I don't understand how IPv6 rDNS is supposed to work. It's clear enough how you look up any particular address, but it's not at all clear to me what you put into an rDNS zone and how you put it there. In IPv4 land, it is standard to assign matching forward and reverse DNS for every live IP, and a fair number of services treat requests from hosts without rDNS with added scepticism. For consumer networks, it's often something like 12-34-56-78.adsl.incompetent.net, with the numbers being the IP address forward or backwards. So if every customer gets a /64, what do you do? You can use a wildcard to give the same rDNS to all 2^64 addresses, but you can't do matching forward DNS, since a DNS response with 2^64 AAAA records would be, ah, a little unwieldy. When hosts self-configure their low 64 bits, do you install a suitable PTR and AAAA into your DNS? If so, how? Do you use DHCPv6 and have it install the DNS? Do you do something else? Signed, Confused

9 9