- Test - lists.nanog.org

Re: v6 subnet size for DSL & leased line customers
by Scott Weeks 20 Dec '07

20 Dec '07

--- randy(a)psg.com wrote:-------- > I work on a network with 100K+ DSL folks and 200+ leased line > customers, plus some other stuff. The leased line customers are > increasing dramatically. I should plan for a /64 for every DSL > customer and a /48 for every leased line customer I expect over the > next 5-7 years? why not a /56 by default for both, and give them an opportunity to justify more? a /64 is a bit old-think unless you are having cost issues getting your space from above. ------------------------------------------- Honestly, the space is so big for each block size I don't see why not pick the middle between the two and have all blocks be the same size. Either type of customer here in Hawaii probably won't get close to using that many addresses. Would I get any other benefit from all blocks being the same size? scott

1 0

Re: Using RIR info to determine geographic location...
by Paul Ferguson 20 Dec '07

20 Dec '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Drew Weaver <drew.weaver(a)thenap.com> wrote: >Is this becoming a more common or less common practice as we slide >ourselves into the last week of 2007? The reason I am wondering is we have >noticed some 'issues' recently where correct info in the RIR causes very >inefficient and sometimes annoying interaction with some of the world's >largest online applications (such as Google) lets say for example that a >customer in India purchases dedicated server or Co-Location hosting at a >HSP in the United States [very common]. So the RIR shows that the customer >is in India, so when the customer interacts with any google applications >google automatically directs this traffic to google.in (or the India >version of whichever app).... > Welcome to my world. :-) In pursuing investigations of criminal activity on the net, we generally have to revert to good old fashioned elbow-grease (and using your noodle) instead of automated geo-location tools for exactly this reason -- they are more & more irrelevant for determining the real location of an endpoint. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHadd+q1pz9mNUZTMRAiJ8AJ44SViYTXi6ee5GNLwnzEIZ5VfphQCg6ik7 ABYpXO+8bMDjoRQFMaB8rFs= =ZvFM -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Using RIR info to determine geographic location...
by Drew Weaver 20 Dec '07

20 Dec '07

Is this becoming a more common or less common practice as we slide ourselves into the last week of 2007? The reason I am wondering is we have noticed some 'issues' recently where correct info in the RIR causes very inefficient and sometimes annoying interaction with some of the world's largest online applications (such as Google) lets say for example that a customer in India purchases dedicated server or Co-Location hosting at a HSP in the United States [very common]. So the RIR shows that the customer is in India, so when the customer interacts with any google applications google automatically directs this traffic to google.in (or the India version of whichever app).... More unfortunate than this fact, is the fact that it appears that services and application providers such as google are caching RIR data for an "unknown" amount of time. Which means that if a service provider SWIPs an allocation to a customer (lets use the same example... again in India) (say a /24) to a user, and then that user subsequently returns that allocation and the service provider re-allocates in smaller blocks to different customers in say /29, /28.. et cetera... the problems related to this issue are compounded (30 customers being affected, instead of one...) by this caching... Obviously providing RIR information is the responsibility of service providers (it is even ARIN's policy) has anyone else in the community ran into issues such as this and found solutions or workarounds? Happy holidays to all on NANOG :D Thanks, -Drew

1 0

Quick Update
by Betty J. Burke 19 Dec '07

19 Dec '07

Hello Everyone: First, on behalf of Merit Network, we wish all a safe and wonderful holiday season. As 2007 draws to a close, we hope you agree, much progress has been achieved. We still have more to do and look forward to a great start this February in San Jose for NANOG42. Taking just a moment, we want to pass along a few updates regarding the next meeting. The Program Committee is doing a great job. The agenda looks very exciting and is expected to be posted very shortly. Thanks to many! We have a number of sponsors and encourage others to consider the remaining opportunities. If interested, please see http://www.nanog.org/contribute.html. Lastly, do not forget to register early! Please note the following date reminders: Registration rates increase Thursday, January 17, 2008 Hotel group rate expires Monday, January 28, 2008 Again, best wishes and we look forward to seeing all in San Jose this February. Betty Burke Merit NANOG Project Manager NANOG SC Member

1 0

Re: European ISP enables IPv6 for all?
by Iljitsch van Beijnum 19 Dec '07

19 Dec '07

On 19 dec 2007, at 16:16, Jay R. Ashworth wrote: >> I'd say that the huge address space makes life impossible for >> scanning >> worms. >> That doesn't mean that there can be no successful scanning at all >> with >> IPv6, but it needs to be highly targeted if you want results the same >> year, so just pumping random numbers in the destination address field >> like SQL slammer did so successfully doesn't cut it in IPv6. > Just so we're all thinking about it; the issue isn't the size of the > address space, it's the sparseness of populated addresses. That won't > *necessarily* always be true. Well, if you can scan the whole space (at 15 kpps 80 hours for the entire IPv4 space although with random generation it's going to take longer than that) sparseness isn't a huge issue. If you can't scan the whole space (at 15 kpps 7.1 x 10^26 years for the entire IPv6 space) then sparseness becomes a consideration. But I still don't see how random scanning is going to do you much good: either so few IPv6 hosts are vulnerable that scanning for them isn't worth the time, or so many that if you can scrape some IPv6 addresses from the web you can infect those and they'll infect all the networks they connect to (scanning a LAN locally is easy).

2 1

Re: European ISP enables IPv6 for all?
by Henry Linneweh 19 Dec '07

19 Dec '07

I was able to reach the japanse link which provided me with http://www.ipv6.org/howtos.html and http://www.wide.ad.jp/ -Henry ----- Original Message ---- From: Steven Haigh <netwiz(a)crc.id.au> To: Jeroen Massar <jeroen(a)unfix.org> Cc: Vassili Tchersky <vt(a)phear.org>; Alain Durand <alain_durand(a)cable.comcast.com>; nanog(a)merit.edu Sent: Tuesday, December 18, 2007 1:39:01 AM Subject: Re: European ISP enables IPv6 for all? On Tue, Dec 18, 2007 at 10:09:16AM +0100, Jeroen Massar wrote: > Vassili Tchersky wrote: > [..] > > > XS4All (Netherlands) is providing the same service if I correctly remember. > > They used to have a product called "PowerDSL", which did IPv6 over > PPPv6, but apparently due to changes in the infra they had to drop this. > XS4all does still, since about 2001 or so, provide a tunnelbroker to > their own users. Every user can simply go to the service.xs4all.nl site, > and view/modify their tunnel + subnet configuration there. Only static > tunnels are supported though (at least this is afaik). It's kind of interesting that from 2001ish to current day and there is still only a handful of service providers worldwide that seem to offer *any* kind of support for IPv6. After all the propaganda, is there actually any other major deployments in the IPv6 space? >From the ipv6.org web site, I see "Most of today's internet uses IPv4, which is now nearly twenty years old." - read as it works well! " IPv4 has been remarkably resilient in spite of its age, but it is beginning to have problems." - Really? Every network I know using IPv4 still works as designed. "Most importantly, there is a growing shortage of IPv4 addresses, which are needed by all new machines added to the Internet." - I'm sure there's a lot more ways around this - and I'm sure the NANOG archives have a lot of thought food there. "It also adds many improvements to IPv4 in areas such as routing and network autoconfiguration." - I would really love to know what these are that DHCP etc doesn't already do. I tried to check out the FAQ at http://faq.v6.wide.ad.jp/ but it wasn't reachable - maybe it needs IPv6 connectivity? As for routing 'improvements', doesn't more address space just give us more routes to handle? "IPv6 is expected to gradually replace IPv4, with the two coexisting for a number of years during a transition period." - so this 'transition period' has been, what, 7 years so far? I'm still predicting that it'll be at least another 10 years before IPv6 amounts to much... On a side note, does anyone currently have issues getting new address space where it's operationally required? I don't know anyone first hand who has yet to come across this issue... -- Steven Haigh Email: netwiz(a)crc.id.au Web: http://www.crc.id.au Phone: (03) 9001 6090 - 0412 935 897 C:\WINDOWS C:\WINDOWS\GO C:\PC\CRAWL

1 0

VSNL CANTAT-3 Optical Submarine Cable
by Martin Hannigan 18 Dec '07

18 Dec '07

Dear Colleagues: I've had multiple conversations with operators concerning the status of CANTAT-3, a submarine cable that runs from Pennant Point , Halifax, Canada, to the area of Sylt, DE and branches to locations along the route: http://upload.wikimedia.org/wikipedia/commons/3/3b/CANTAT-3-route.png 1. Pennant Point , Nova Scotia Canada 2. Vestmannaeyjar, Iceland 3. Tjørnuvík, Faroe Islands 4. Red car, England, UK 5. Blaabjerg, Denmark 6. Sylt, Germany Does anyone have formal or published indication from VSNL that confirms a decommissioning and states an actual date? I've heard this from several highly reliable sources and I'd like to find out "when" if at all. I have checked Google. I'd be very happy to receive any information formally, off line, or otherwise and summarize back to the list. Best, Marty

4 5

Re: European ISP enables IPv6 for all?
by Paul Ferguson 18 Dec '07

18 Dec '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Christopher Morrow" <morrowc.lists(a)gmail.com> wrote: >On Dec 17, 2007 9:59 PM, Paul Ferguson <fergdawg(a)netzero.net> wrote: > >> And in fact, "threat propagation" in a v6 world may actually >> be worse than expected, and naivet� may actually contribute to >> a larger-scale attack, given the statistical possibility of >> potentially more victims. > > >naivete because folks believe the 'v6 is more secure' propoganda? or >some other reason? Yes. :-) >> Address space size, and proximity, may well be red herrings in >> this discussion. > >can you expand on this some? Someone else mentioned "self-infliction" in this thread, and that's spot on. Over the course of the past year or more, we've seen less & less "scanning & self-propagating" malware, and more & more self-infliction, either by being duped via social engineering or just by drive-by infections/compromises. As it stands, now -- and unless the pendulum swings the other way -- the whole "...v6 address space is larger, thus it is much harder to scan and thus propagation of worms is much harder..." train of thought is completely misguided. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHZ+v6q1pz9mNUZTMRAviAAKC1z/Q0m1xzFmSkah5WL8xrbD/cEgCfaKgi xQHKSq8Tx8D5JEv6ObrGVoQ= =mdeP -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

RE: VSNL CANTAT-3 Optical Submarine Cable
by Neil J. McRae 18 Dec '07

18 Dec '07

So in a former life I experienced first hand this cable between 97 and 99 and it had quite a few issues and outages some that lasted a significant period of time. One of which was a failure in the Iceland region caused by a boat of some description. Id need to boot up my old sparc to untar the mail backup to be sure though. Its was a great cable for cheap links for EU to US voice but for Internet the additional C.70ms from PP to NYC made it suboptimal however in the late nineties bandwidth was still relatively pricey most trafic EU to US was paid all by the EU SPs and Cantat3 was cheap and had less half circuit type issues than other TAT cables. Regards, Neil -----Original Message----- From: Martin Hannigan <hannigan(a)gmail.com> Sent: 18 December 2007 15:47 To: neil(a)domino.org Cc: Rod Beck <rod.beck(a)hiberniaatlantic.com>; nanog(a)nanog.org Subject: Re: VSNL CANTAT-3 Optical Submarine Cable On Dec 18, 2007 8:11 AM, Neil J. McRae <neil(a)domino.org> wrote: > > How about VSNL CANTAT-3? Any idea what's going on here? > > Its a very old cable which I'm sure must have passed its service life by > now. It was frequenty affected by issues near iceland. (trawlers IIRC > etc). > It's just approaching 15 years old and I think for '94 that this is the expected lifespan. In January of '06 there was a major outage on Cantat-3 that took a very long time to repair. This is why most people can even recall the name. Check the nanog archives if you are interested in the discussion that took place here. There is a major fishing ground north of the cantat route off of Iceland and south of Hornsfjordur , but the cable does not run through it as far as I know, a little to East, and the "big" outage was situated in the North Sea, southwest of Bergen, Norway. I'm not sure about other outages. I have found some interesting stuff in some NOC archives though. Best, Martin

1 0

Re: European ISP enables IPv6 for all?
by Paul Ferguson 18 Dec '07

18 Dec '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Steven M. Bellovin" <smb(a)cs.columbia.edu> wrote: [re: v6 mythos] >In a slightly more realistic vein, a huge address space makes life >harder for scanning worms. As Angelos Keromytis, Bill Cheswick, and I >have pointed out, "harder" is by no means equivalent to "impossible", >but the myth, new as it is, still propagates. And in fact, "threat propagation" in a v6 world may actually be worse than expected, and naivet� may actually contribute to a larger-scale attack, given the statistical possibility of potentially more victims. Address space size, and proximity, may well be red herrings in this discussion. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHZ2Gnq1pz9mNUZTMRAmLzAKCqRr4IkAbiXBsUUmH9kdeX1yaSkQCeOduE Dcyed9X7c3XpEC9L2SXvChI= =gHY7 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1