- Test - lists.nanog.org

Long walk off a short PIER revisited [Was: Re: IPv6 Address Planning]
by Fergie (Paul Ferguson) 10 Aug '05

10 Aug '05

Perhaps it's time to revisit PIER? Hey, it's only been ten (10) years, but perhaps it's worth consideration? Remember this: http://www.merit.edu/mail.archives/nanog/1995-08/msg00239.html [and] http://www.isi.edu/div7/pier/papers.html I think my name is on a few of those papers... ;-) - ferg -- bmanning(a)vacation.karoshi.com wrote: On Wed, Aug 10, 2005 at 09:26:08PM +0200, Iljitsch van Beijnum wrote: > On 10-aug-2005, at 19:32, bmanning(a)vacation.karoshi.com wrote: > > > so renumbering out of a /56 into a /48 is harder than renumbering > > out of a /124 into a /112 how? > > Having a /60 or a /48 is better than a /56 or a /48 because: we are not talking better/worse, we are talking the issues with renumbering... and the only credible argument you make is... > > 1. Most people who are going to encounter the problem realize that a / > 60 isn't enough and go for the /48 immediately > 2. Going from a /60 to a /48 would happen earlier than from a /56 to > a /48 so there is less to renumber. less to renumber. which argues that folks should be given just the amount of space they need, not more. right? :) > > renumbering - regardless of version > > is hard... > > Not hard, inconvenient. inconvient/hard ... regardless of versioning (v4 or v6) it is not trival to renumber a network that is managable. > > primarly becuase application developers insist that > > the IP address is the nodes persistant identifier, > > Disagree. There are two issues: the DNS and access restrictions and > similar based on IP addresses. The DNS can be fixed with some > searching and replacing and/or dynamic DNS updates, but using literal > IP addresses, especially in filters and such, isn't easy to solve > because there are no reasonable alternatives in many cases. ok, you disagree. clearly we do not have the same understanding of global networks, end-system configuration and maintaince, and the demand for reliable, auditable logs. > > renumbering hosts is a breese in either > > version of predominate IP protocol, DHCP is your friend. > > That friend will kill all your sessions when you get a new address. Sniff. Tear. your DOA w/ IPv6 as well and IPv4 in a renumbering event. You want to maintain session awareness over a renumbering event? IPv6 is not going to help. You need HIP. > DHCP implementations in IPv6 aren't ready for prime time either. that statement could be made of so many applications. > > Or if you > > want less robust functionality and semantic overload, you can use > > the RA/ND stuff in IPv6. > > How is that less robust and does it imply a semantic overload? DHCP is a protocol that has a long interoperability history. RA/ND does not. DHCP has many fine host configuration features .. some of which are being added to the RA/ND suite. Hence my claim of less robust. Semantic overload... hum... I want my router to route. infrastructure services should come from service boxes... in much the same way i want the police to direct traffic, not do my produce shopping, then take the goods home and prepare my meals. The police should do police work, routers should route. YMMV of course. Some people LIKE running their router, RA/ND, DHCP, and DNS, NTP, and WEB server off a single platform. Or due to cost constraints they "bundle-up"... I'm of the opinion that functional seperation is a good thing in the provisioning of network services. > > - regardless, renumbering from one address > > range to another is painful - CIDR -might- be helpful, but > >artifical > > constraints e.g /64 only serve to confuse. > > I agree. All boundaries between different parts of the address must > be flexible. That includes the boundary at the end of the address. > But I guess we have to save something for IPv7. IPv7, IPv8, and IPv9 are all registered w/ the IANA. then IPX is a Novell trademark so i think the next step would have to be IPv11.. --bill -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Cisco crapaganda
by Chris Gilbert 10 Aug '05

10 Aug '05

Given the term "Crapaganda" I couldn't help but share this when I ran across it today: http://www.cisco.com/edu/peterpacket Enjoy :) Also, > Of course, in the end, Juniper is also vulnerable. ... Now I > believe that Open Source software techniques can solve this root > problem because many eyes can find more bugs. This doesn't just > mean *BSD and Linux. There are also systems like OSKit > http://www.cs.utah.edu/flux/oskit/ and RTAI http://www.rtai.org/ > that are more appropriate for building things like routers. But in some ways, aren't those Open Source software techniques also assisting Juniper, as JunOS is based in no small part on FreeBSD? Perhaps their hybrid of Open-Source adoption and proprietary development will take the benefits from both worlds and prove an effective method for maintaining a high level of software security. Also, what about DoD Orange Book certification? Can this kind of testing methodology be applied to routing systems as well, such as IOS? In recent years Microsoft has been releasing code for internal security audits to special customers such as large corporate partners and government. I wonder if infrastructure customers should, or could be getting similar treatment from Cisco in regards to IOS, for them to better protect their customers. (Government would apply here too.) -- Regards, Chris Gilbert IO Interactive A/S

3 2

fcc ruling on dsl providers' access to infrastructure
by Randy Bush 10 Aug '05

10 Aug '05

interesting that nanog is chattering so seriously about the calea thing (which does concern me), but seems to be unconcerned about another ruling that would seem to be a major anti-competitive change threatening the businesses of a few hundred members of this list <http://news.com.com/2061-10785_3-5820294.html>. or maybe i am misreading the ruling. randy

14 21

RE: Cisco crapaganda
by Maness, Drew 10 Aug '05

10 Aug '05

Sorry 2 years ago (2003) http://www.blackhat.com/html/bh-multi-media-archives.html#USA-2003 FX - More (Vulnerable) Embedded Systems Lynn also refered to a "Chinese Hacker" group that was reviewing pieces of stolen IOS code for the sole purpose of shovleing shell code into IOS. -----Original Message----- From: owner-nanog(a)merit.edu on behalf of Maness, Drew Sent: Wed 8/10/2005 10:11 AM To: Michael.Dillon(a)btradianz.com; nanog(a)merit.edu Cc: Subject: RE: Cisco crapaganda Lynn refered to FX from phenoelit's presentation at blackhat 3 years ago. Http://www.phenoelit.de -----Original Message----- From: owner-nanog(a)merit.edu on behalf of Michael.Dillon(a)btradianz.com Sent: Wed 8/10/2005 6:14 AM To: nanog(a)merit.edu Cc: Subject: Re: Cisco crapaganda > I, desperately, hope you are not referring to Raven Adler's > presentation at Defcon following Black Hat. No, I am referring to something that was published 3 years ago and describes substantially the same exploits and techniques as Lynn described except the 3 year old document has much more technical detail and offers a URL where source code for the exploits can be acquired. Maybe Lynn rediscovered this independently. Maybe he heard rumours of an exploit in blackhat communications and this guided him where to look. But if my memory serves me correctly, Lynn himself claimed that his work was based on the work of a blackhat. --Michael Dillon

1 0

RE: Cisco crapaganda
by Maness, Drew 10 Aug '05

10 Aug '05

Lynn refered to FX from phenoelit's presentation at blackhat 3 years ago. Http://www.phenoelit.de -----Original Message----- From: owner-nanog(a)merit.edu on behalf of Michael.Dillon(a)btradianz.com Sent: Wed 8/10/2005 6:14 AM To: nanog(a)merit.edu Cc: Subject: Re: Cisco crapaganda > I, desperately, hope you are not referring to Raven Adler's > presentation at Defcon following Black Hat. No, I am referring to something that was published 3 years ago and describes substantially the same exploits and techniques as Lynn described except the 3 year old document has much more technical detail and offers a URL where source code for the exploits can be acquired. Maybe Lynn rediscovered this independently. Maybe he heard rumours of an exploit in blackhat communications and this guided him where to look. But if my memory serves me correctly, Lynn himself claimed that his work was based on the work of a blackhat. --Michael Dillon

1 0

@Home's 119 domain names up for sale
by Fergie (Paul Ferguson) 10 Aug '05

10 Aug '05

I know this is horribly off-topic, but seeing a reference to @Home kind made me a little nostalgic. :-) [snip] Apparently former high-speed Internet provider Excite@Home once felt likewise. But At Home Liquidating Trust, successor to the once high-flying Internet darling Excite@Home, said Wednesday it is selling the former broadband company's 119 domain names. [snip] http://news.com.com/ExciteHomes+119+domain+names+up+for+sale/2100-1030_3-58… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

power strip with individually monitorable outlet current
by Mike Leber 10 Aug '05

10 Aug '05

There have been suggestions of good SNMP monitorable power strips here before, however I'm looking for a power strip with individually monitorable outlet current (via SNMP). I've searched google for quite a while and can't seem to separate out such a beast from all the remote power management strips that just monitor aggregate usage. I have an application where I need to record the variation in power consumption for individual devices over time. I need to monitor about 30 devices in 4 cabinets (8 devices per cabinet or so) in and have a budget of $4000. I'd like to be able to see current in milliamps or 10 milliamp increments. I'm looking for an off the shelf device. If anybody can help me I'd certainly appreciate it. +----------------- H U R R I C A N E - E L E C T R I C -----------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +-----------------------------------------------------------------------+

9 10

PAY YOUR BILLS
by John Public 10 Aug '05

10 Aug '05

PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS PAY YOUR BILLS ____________________________________________________ Start your day with Yahoo! - make it your home page http://www.yahoo.com/r/hs __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: power strip with individually monitorable outlet current
by Mike Leber 09 Aug '05

09 Aug '05

I talked to them yesterday and their technical support said they didn't, I just called them again to confirm and rephrased the question a few other ways and they still say they don't. Perhaps it's something they have that they don't call a power strip, what part number is what you had in mind? On Tue, 9 Aug 2005, Nate Duehr wrote: > www.servertech.com - some models have per port monitoring of current > draw. > > On Sun, Aug 07, 2005 at 11:42:42AM -0700, Mike Leber wrote: > > > > > > There have been suggestions of good SNMP monitorable power strips here > > before, however I'm looking for a power strip with individually > > monitorable outlet current (via SNMP). > > > > I've searched google for quite a while and can't seem to separate out such > > a beast from all the remote power management strips that just monitor > > aggregate usage. > > > > I have an application where I need to record the variation in power > > consumption for individual devices over time. I need to monitor about 30 > > devices in 4 cabinets (8 devices per cabinet or so) in and have a budget > > of $4000. I'd like to be able to see current in milliamps or 10 milliamp > > increments. I'm looking for an off the shelf device. > > > > If anybody can help me I'd certainly appreciate it. > > > > +----------------- H U R R I C A N E - E L E C T R I C -----------------+ > > | Mike Leber Direct Internet Connections Voice 510 580 4100 | > > | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | > > | mleber(a)he.net http://www.he.net | > > +-----------------------------------------------------------------------+ > > > > -- > Nate Duehr <nate(a)natetech.com> > +----------------- H U R R I C A N E - E L E C T R I C -----------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +-----------------------------------------------------------------------+

1 0

RE: IPv6 Address Planning
by Cody Lerum 09 Aug '05

09 Aug '05

Makes sense. However the PTP addresses need to be internally visible from an NMS perspective in our network. -C -----Original Message----- From: James [mailto:james@towardex.com] Sent: Tuesday, August 09, 2005 12:13 PM To: Cody Lerum Cc: nanog(a)merit.edu Subject: Re: IPv6 Address Planning On Tue, Aug 09, 2005 at 11:24:22AM -0600, Cody Lerum wrote: > > Currently we are in the process of planning our IPv6 addressing schema > for our network. We are a service provider with around 20 core > routers, and several hundred enterprise customers. These customers > currently connect back to our core via a separate VLANs or channelized > DS1/DS3/OC-X type interfaces. Thus currently lots of /30 IPv4 blocks. > > Our address allocation is 2001:1940::/32 > > Here is our current plan, but we are looking for suggestions from > people who have been down this road before. The plan is to break out a > /48 for our organization. Then break out the first /64 for loopbacks, > and the next /64 for point-to-point connections. The PTP /64 then > breaks out further into 1 /80 for core links, and 1 /80 for each of > our distribution sites. Within these /80's are individual /112's for > PTP links. What this will allow us to do is aggregate each sites PTP > connections into /80's within our IGP. The way we do it currently are as follows: Reserve a /48 for backbone pointopoints (eg. 2001:4830:ff::/48) in US, fe::/48 in EU. Reserve a /48 for loopbacks, and use /128s for each loopback out of that. As for point to point links, we currently use simple /64 subnets for each point to point (i.e. 2001:4830:ff:1500::/64, etc where ::1 and ::2 are routers on either side of the circuit). >From there, we also have a /48 allocated per each POP for transfer networks at that location for peering via pni and customer hand-offs. Each xfer net is broken off as /64 out of that /48. We currently do not perform any PTP link aggregation in our IGP, we simply ensure only passive-interfaces are announced to IGP, thus PTP links are not even present in the IGP table (only loopbacks and xfer nets/bgp next-hops are). It is not perfect but works well currently and scales just fine for us. <shameless plug> You may also find the ipv6-ops list helpful for v6 rollout discussions: http://lists.cluenet.de/mailman/listinfo/ipv6-ops </shameless plug> James -- James Jun Infrastructure and Technology Services TowardEX Technologies Office +1-617-459-4051 x179 | Mobile +1-978-394-2867 james(a)towardex.com | www.towardex.com

1 0