- Test - lists.nanog.org

Redundant Data Center Architectures
by Stefan Fouant 29 Oct '09

29 Oct '09

I'm wondering what are the growing trends in connecting Data Centers for redundancy in DR/COOP environments. I imagine VPLS has a big play here, but I'm willing to bet there are all sorts of weirdness that such environments can create, such as the effect it may have on DR elections, etc. Also, what are your experiences in replication of storage over WAN links? Are people tending towards iSCSI or do trends indicate that FCoE or FCoIP may become the preferred mechanism? Any experience with WAN acceleration in such environments? Thanks in advance! -- Stefan Fouant

9 12

ALTDB Problems
by Renato Frederick 28 Oct '09

28 Oct '09

Hello I'm having some problems to send a new record to ALTDB by using mail. Old records work OK and I can update. Someone here at nanog is having same issues? Is there any ALTDB admins here? Thanks!

4 5

looking for optonline/cablevision contact
by andrew young 28 Oct '09

28 Oct '09

ive been having a mailing issue with optonline/cablevision for several weeks now and normal business tech support is giving me the run around. can someone from optonline/cablevision contact me off thread so i can try to get this simple thing resolved. -- ---------------------------------------- Andrew Young Webair Internet Development, Inc. Phone: 1 866 WEBAIR 1 x143 http://www.webair.com Shift hours: Tues-Friday 12PM-8PM, Sat 9AM-5PM

1 0

ISP with CSC/CoC?
by Luan Nguyen 28 Oct '09

28 Oct '09

Hello, I am studying for the CCIE Service Provider and ran across a few CSC/CoC scenarios. I am wondering if any major ISP uses/offers this kind of service? Thanks. ----------------------------- Luan Nguyen Chesapeake NetCraftsmen, LLC. http://www.netcraftsmen.net ----------------------------- __________ Information from ESET NOD32 Antivirus, version of virus signature database 4551 (20091028) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

1 0

IPv6 could change things - Was: DMCA takedowns of networks
by Michael Dillon 28 Oct '09

28 Oct '09

> Not sure how much I believe of the article and its lack of detail and > chopped quotes...but did HE really disconnect an entire downstream network > over a DMCA notice, or did they null route a /32 that was used by a customer > to host hundreds of virtual web sites? Since the tools at a network operator's disposal are ACLs which make it easy to block traffic to a /32 without the need for deep packet inspection, one would expect that this regularly causes collateral damage if that /32 is a web server hosting hundreds of virtual websites. But, when IPv6 is a bit more common, there is no need for virtual hosters to share a single IP address between several sites. They may as well use a unique IPv6 address for every single site, even if they are all on the same server. The side effect of this is that it makes the network operator's tool sharper, and able to knock down single sites with a /32 ACL. For a hosting provider, I would think that this strengthens the business case for IPv6. --Michael Dillon

11 11

Re: IPv6 could change things - Was: DMCA takedowns of networks
by William Pitcock 27 Oct '09

27 Oct '09

To expand on this from a programmers perspective, usually at the kernel/network stack level, a "patricia" radix-style trie is used for fast ipv6 lookups. The benefit of the patricia trie being that if you only have a difference keylength of 8 bits (/120) then the ip lookup only takes 8 steps in a worst-case scenario. The same concept applies to ipv4 cidr as well, but it is less obvious. William ------Original Message------ From: Adrian Chadd To: Jeroen Massar Cc: North American Network Operators Group Subject: Re: IPv6 could change things - Was: DMCA takedowns of networks Sent: Oct 27, 2009 10:39 AM On Tue, Oct 27, 2009, Jeroen Massar wrote: > But yes, the network stack itself is a different question, then again, > you can just route a /64 into the loopback device and let your apache > listen there... (which also allows you to do easy-failover as you can > move that complete /64 to a different box ;) Funny you should mention that. A couple of tricks I've seen: * instead of a linked list and O(n) searching of interface aliases, use some kind of tree to map local IP -> interface. * hacks to do a "bind to all damned IP addresses and let userspace sort it out". I've done the former for a few thousand aliases with no degredation in performance. The hacks available for freebsd-4.x for the Web Polygraph software did something similar. 2c, Adrian -- William Pitcock SystemInPlace - Simple Hosting Solutions 1-866-519-6149

1 0

DMCA takedowns of networks
by William Allen Simpson 27 Oct '09

27 Oct '09

http://www.huffingtonpost.com/2009/10/23/chamber-of-commerce-stron_n_332087… Hurricane Electric obeyed the Chamber's letter and shut down the spoof site. But in the process, they shut down hundreds of other sites maintained by May First / People Link, the Yes Men's direct provider (Hurricane Electric is its "upstream" provider). What's going on? Since when are we required to take down an entire customer's net for one of their subscriber's so-called infringement? Heck, it takes years to agree around here to take down a peering to an obviously criminal enterprise network.... My first inclination would be to return the request (rejected), saying it was sent to the wrong provider.

22 35

Re: DMCA takedowns of networks
by William Pitcock 27 Oct '09

27 Oct '09

Mayfirst / Peoplelink did not get any notice that service would be turned down prior to it happening. Hurricane has had a really bad history of handling copyright complaints. The situation for example resulting in mayfirst's circuit being turned down had nothing at all to do with copyright and was instead a trademark violation dispute. IANAL, but trademark issues are not copyright issues nor are they handled via the dmca. Therefore what hurricane did in this instance is really unacceptable. It should be emphasized that the dmca does not require turning down service - only sending the takedown notice along to an appropriate contact. See also: common-carrier immunity concept. I don't know about you, but hurricanes actions in this instance has made me reevaluate the use of their products in future projects. (this post definitely does not reflect the opinions of my employer.) William ------Original Message------ From: Jack Bates To: Richard A Steenbergen Cc: North American Network Operators Group Subject: Re: DMCA takedowns of networks Sent: Oct 26, 2009 1:44 PM Richard A Steenbergen wrote: > had no liability in the matter. Of course Hurricane is well within their > rights not to serve any customer that they please, but the customer is > also well within their rights to find another provider who better > respects the rights of free speech on the Internet (if the above is what > actually happened). > I'm sure HE respects the rights of free speech just fine. That being said, a notice was delivered, customer may not have replied with the appropriate legal notice, and so HE honored it's obligation to maintain safe harbor. One would have to be an idiot to jeopardize their company by rolling the dice in an effort to protect free speech (which may not legally be free speech). Courts determine what is free speech. ISPs just try to stay the hell out of the way. Jack -- William Pitcock SystemInPlace - Simple Hosting Solutions 1-866-519-6149

1 0

ISP/VPN's to China?
by ChrisSerafin 27 Oct '09

27 Oct '09

I have a client in the US looking to connect up an office in China and I'm wondering what type of connections are avilable and wether IPSEC VPNs can be established through the 'Great firewall of China'. I talked to a China Telcom rep in the US that says that the network congestion even in China makes VPN's difficult. From their website, I see that the majority of the country is using xDSL, or 2MB dedicated lines. Can anyone shed any light on this topic? Thanks! chris(a)chrisserafin.com

11 19

Alcatel-Lucent VPN Firewall Brick
by Jay Nakamura 26 Oct '09

26 Oct '09

Hello all, Looking for input on Alcatel-Lucent VPN Firewall Brick. I can look up spec and other published information but, as always, the devil is in the detail and you just never know what wall you run into until you actually try it so I wanted to see if anyone has used this and can point out good/bad things about this device. Our other option is Cisco IOS router right now. Are there better options than these two? If there is a better forum to post this question, my apologies. Please direct me to the right place. :) Our goal : We want to provide managed firewall/VPN for Colo/DIA customers. Our specific requirements are - Able to provide VRF/virtual router per customer since address range can overlap between customers. - Able to do client based VPN to the inside network. It could be IPSec or SSL. It has to support Vista/Win7-x64 - Able to do site to site VPN with various devices.(Cisco, - Can rate limit traffic in and out. - Control NAT per customer instance. - Stateful firewall per customer instance. - Good logging Thanks!

4 4