- Test - lists.nanog.org

RE: VoIP over IPsec
by Charles Youse 17 Feb '03

17 Feb '03

So do you suppose that in my scenario, I'd be better off leaving the VoIP out of the encrypted tunnels and use a separate [cleartext] path for them? I'm worried about the security implications, not because I feel there is a huge security risk but because I'm sure the topic will be brought up. (Communicating over one provider's backbone provides little opportunity for third parties to snoop packets between points, of course.) Has the issue of VoIP security ever been addressed? I suppose I should really do my homework. C. -----Original Message----- From: Stephen Sprunk [mailto:stephen@sprunk.org] Sent: Monday, February 17, 2003 1:22 PM To: Charlie Clemmer Cc: nanog(a)merit.edu Subject: Re: VoIP over IPsec Thus spake "Charlie Clemmer" <cclemmer(a)nexgennetworks.com> > Stephen, I know this is outside of Charles' original inquiry, but I'm not > familiar with this "qos pre-classify" feature. Since we would be encrypting > voice traffic ... at what point would you classify it? If I classify it > before it goes into the tunnel and gets encrypted, would that > classification last once it's encrypted? If we try to classify after it's > been encrypted, how can we tell it's voice traffic? It seems to me that > jitter from both the actual encryption process as well as that associated > with basic serialization would be the potential death of VoIP in this > scenario, but I'm not sure mechanisms available to help resolve that risk. In the default IOS code path, encryption happens before QOS (and after GRE). Modern IOS versions copy the DSCP when encapsulating/ encrypting packets, so DSCP-based QOS will still work, but IP- and port-based QOS will not. More importantly, encryption is slow; even hardware encryption is significantly slower than the rest of the forwarding process. It's also FIFO by default, meaning that large data packets can get stuck ahead of your VoIP packets, causing jitter. 'qos pre-classify' adds a second QOS stage before encryption, which allows you to classify packets in their unencrypted state and, more importantly, adds PQ capability to the encryption stage. For more information: http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fqos _c/fqcprt1/qcfvpn.htm S Stephen Sprunk "God does not play dice." --Albert Einstein CCIE #3723 "God is an inveterate gambler, and He throws the K5SSS dice at every possible opportunity." --Stephen Hawking

1 0

IPv6 learning resources
by Michael.Dillon＠radianz.com 17 Feb '03

17 Feb '03

> Can someone give me a good pointer as to places to start learning more about > ipv6? The presentations at the Madrid IPv6 summit in 2002 were particularly good as an introduction and overview. Their available here in PDF format: http://www.ipv6-es.com/02/in/i-docs.htm Last year I trolled the web looking for IPv6 learning resources that we could use internally so I read through a lot of papers and presentations. This set from Spain really stood out from the rest because the authors clearly understand their topic and take pains to explain it clearly. Of course, they can't cover as much detail as a book, but it's nice to get that kind of overview before diving into the details. My rule of thumb for IPv6 books is not to read anything published in the 20th century. Some things have changed since IPng was first defined and the newer books will lead you down fewer dead ends. Since Microsoft is likely to play a major role in triggering commercial use of IPv6, it's always a good idea to keep up to date on their latest views. Since they are working very closely with Cisco, you can expect that Cicso's views on IPv6 will be closely aligned with MS. If you weren't at the last NANOG then check out what Cisco has to say http://www.nanog.org/mtg-0302/ppt/hain.pdf and Microsoft's IPv6 website at http://www.microsoft.com/windowsserver2003/technologies/ipv6/default.mspx If you're responsible for a backbone network then you'll probably be particularly interested in 6PE versus dual-stack backbone. In fact, that would be an interesting topic for some discussion on the list. --Michael Dillon

3 2

New IPv6 block allocated to RIPE NCC
by leo vegoda 17 Feb '03

17 Feb '03

Dear Colleagues, The RIPE NCC received the IPv6 address range 2001:1400::/23 from the IANA in February 2003. You may wish to adjust any filters you have in place accordingly. More information on the IP space administered by the RIPE NCC can be found on our web site at: <http://www.ripe.net/ripe/docs/smallest-alloc-sizes.html> Kind regards, -- leo vegoda RIPE NCC Registration Services

1 0

OC3 to DS3 mux ?
by joe mcguckin 16 Feb '03

16 Feb '03

Can someone recommend a vendor for an OC3 to DS3 DACS or mux? I need a small one with capacity for a single OC3. Thanks, Joe

3 2

Cisco ONS CLI
by Simon Lockhart 16 Feb '03

16 Feb '03

I know there's quite a large community of people who use the Cisco ONS kit (stuff like the 15454), so thought I'd see if there was interest in a command line interface for the boxes - something a bit like Cisco IOS type stuff, not like TL1 - for those people who can't use, or don't like, the java interface. I've been working on it for a while now, and have a fair amount of the simple stuff implemented, e.g.: THDO-0> show nodes Node Name Type Version --------- ---- ------- 111NY-0 Cisco ONS 15454 03.30-002E-16.22 THDO-1 Cisco ONS 15454 03.30-002E-16.22 [snip] THDO-0> show interface brief Interface Description Speed Con AdmnStatus OperStatus --------- ----------- ----- --- ---------- ---------- [snip] sonet_5/1 to THLS1 OC48 Y ADMIN_UP OPER_UP sonet_6/1 to THDO-TFM4-0 OC48 Y ADMIN_UP OPER_UP sonet_13/1 to TVC1 OC48 Y ADMIN_UP OPER_UP [snip] THDO-0> sh sdcc topology Src Node Interface Dest Node Interface Speed -------- --------- --------- --------- ----- 111NY-0 sonet_12/1 THLS-0 sonet_6/1 OC48 THDO-1 sonet_5/1 MH-0 sonet_5/1 OC48 [snip] THDO-0> sh alarm Feb 12 18:03:23: STS-5-25: %NSA-NR-AIS-P: Alarm Indication Signal - Path Feb 12 18:04:26: STS-5-37: %NSA-NR-AIS-P: Alarm Indication Signal - Path Feb 16 21:46:23: SYNC-NE: %NSA-NA-SSM-ST3: Stratum 3 Traceable [snip] ...and basic interface manipulation, loopbacks, enable, disable, etc. So, anyway, I was just wondering if there was an interest in something like this, which means I should spend some time packaging it up into something that could be released into the wild, or not. Definitely very alpha quality code at the moment, I've managed to cause 15454 nodes to reboot during testing, etc, so don't get your hopes up yet, but I do currently use the code for basic management of my 10 node SONET cloud. Let me know... Simon -- Simon Lockhart | Tel: +44 (0)1628 407720 (BBC ext 37720) Technology Manager | Fax: +44 (0)1628 407701 (BBC ext 37701) BBC Internet Services | Email: Simon.Lockhart(a)bbc.co.uk BBC Technology, Maiden House, Vanwall Road, Maidenhead. SL6 4UB. UK

1 0

IPv6 Peering Request
by Jeffrey Wheat 16 Feb '03

16 Feb '03

Is there anyone that would be interested in providing a tunnel to the 6bone for us? We are in Charlotte, NC and would prefer to establish a tunnel with someone close by. We'd be doing this via a cisco router so brokers are no an option for us. We are AS8175. Thanks in advance, Jeff --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.449 / Virus Database: 251 - Release Date: 1/27/2003

6 8

RE: IPv6 Peering Request
by Irwin Lazar 16 Feb '03

16 Feb '03

I have a collection of links to info about IPv6 at: www.itprc.com/tcp_ip.htm http://www.ipv6forum.org/ is probably the best starting place. irwin > -----Original Message----- > From: Scott Granados [mailto:scott@wworks.net] > Sent: Sunday, February 16, 2003 4:38 PM > To: Mike Leber; Nicolas DEFFAYET > Cc: Jeffrey Wheat; nanog(a)merit.edu > Subject: Re: IPv6 Peering Request > > > > Can someone give me a good pointer as to places to start > learning more about > ipv6? > > > ----- Original Message ----- > From: "Mike Leber" <mleber(a)he.net> > To: "Nicolas DEFFAYET" <nicolas.deffayet(a)ndsoftware.net> > Cc: "Jeffrey Wheat" <jeff(a)cetlink.net>; <nanog(a)merit.edu> > Sent: Saturday, February 15, 2003 2:47 PM > Subject: Re: IPv6 Peering Request > > > > > > > > All the IPv6 routers in our network are cisco. > > > > We host about 1500 IPv6 over IPv4 tunnels via our tunnel broker. > > > > Many of the tunnel broker users are running cisco routers. > > > > Yes I was going too fast and missed his comment (it didn't parse) > > otherwise I would have pointed out that if he is running a > cisco with an > > IOS that supports IPv6 he can run IPv6 in tunnels over IPv4. > > > > For example: > > > > interface Tunnel1 > > description An IPv6 tunnel peer > > no ip address > > ipv6 address <IPv6-address-for-your-side>/127 > > ipv6 enable > > tunnel source <IPv4-address-on-your-router> > > tunnel destination <IPv4-address-on-peer's-router> > > tunnel mode ipv6ip > > > > Mike. > > > > On 15 Feb 2003, Nicolas DEFFAYET wrote: > > > > > On Sat, 2003-02-15 at 02:39, Mike Leber wrote: > > > > We operate a free IPv6 tunnel broker at http://tunnelbroker.com > > > > > > Jeffrey Wheat said: "so brokers are no an option for us". > > > > > > > On Fri, 14 Feb 2003, Jeffrey Wheat wrote: > > > > > > > > > > > > > > Is there anyone that would be interested in providing a tunnel > > > > > to the 6bone for us? We are in Charlotte, NC and would prefer > > > > > to establish a tunnel with someone close by. We'd be > doing this > > > > > via a cisco router so brokers are no an option for us. We are > > > > > AS8175. > > > > > > -- > > > Nicolas DEFFAYET, NDSoftware > > > NDSoftware NOC: http://noc.ndsoftwarenet.com/ > > > FNIX6: http://www.fnix6.net/ > > > EuroNOG: http://www.euronog.org/ > > > > > > > +----------------- H U R R I C A N E - E L E C T R I C > -----------------+ > > | Mike Leber Direct Internet Connections Voice > 510 580 4100 | > > | Hurricane Electric Web Hosting Colocation Fax > 510 580 4151 | > > | mleber(a)he.net > http://www.he.net | > > > +------------------------------------------------------------- > ----------+ > > > > > > > >

1 0

"Selfish Routing"
by Pete Kruckenberg 16 Feb '03

16 Feb '03

http://www.scienceblog.com/community/article1018.html --- "The Internet is 'fault-tolerant,' so there are always many routes a message can take. A packet of data traveling from New York to San Francisco might go by way of Chicago or Dallas, or might even hop from New York to Columbus to Miami to Omaha to Denver to San Francisco. "Routers have many ways to decide. Sometimes they send out test packets and time them. Sometimes routers exchange information about the condition of the network in their vicinities. But if routers choose the route that looks the least congested, they are doing selfish routing. As soon as that route clogs up, the routers change their strategies and choose other, previously neglected routes. "Roughgarden has a suggestion that wouldn't be expensive to implement. Before deciding which way to send information, he says, routers should consider not only which route seems the least congested, but also should take into account the effect that adding its own new messages will have on the route it has chosen. That would be, he says, 'just a bit altruistic' in that some routers would end up choosing routes that were not necessarily the fastest, but the average time for all users would decrease." --- This might be easier to understand if it was more technical, but I'm only aware of a lot of disabled features on my routers that are supposed to in theory do some of these things. Abstractions and analogies aside, is this really a problem, and is it really worth solving? Sounds like a lot of additional complexity for the supposed benefits. Pete.

8 10

lft traceroute
by Rodney Joffe 15 Feb '03

15 Feb '03

I have been asked by some folks for the link to the lft traceroute I used this morning in my presentation. It is available at http://www.mainnerve.com/lft/ -- Rodney Joffe CenterGate Research Group, LLC. http://www.centergate.com "Technology so advanced, even we don't understand it!"(R)

3 2

Multicast / UUnet
by Ejay Hire 15 Feb '03

15 Feb '03

Anyone clueful about multicast at UUnet on-list? I'm getting the telephone equivalent of blank stares when I call in. I'm trying to find out if multicast services are offered and how much $ We already have a ds-3 w/ uu. Thanks, Ejay

2 1