- Test - lists.nanog.org

Re: DDOS, IDS, RTBH, and Rate limiting
by freedman＠freedman.net 28 Jan '15

28 Jan '15

> > Cisco ASRs and MXs with inline jflow can do hundreds of K flows/second > > without affecting packet forwarding. > > Yes, i agree,those are good for netflow, but when they already exist in > network. > > Does it worth to buy ASR, if L3 switch already doing the job > (BGP/ACL/rate-limit/routing)? Not suggesting that anyone should change out their gear though per my other message, I've seen SPAN make things go wonky on almost every vendor that ISPs use for switching. > Well, if it is available, except hardware limitations, there is second > obstacle, software licensing cost. On latest JunOS, for example on EX2200, > you need to purchase license (EFL), and if am not wrong it is $3000 for > 48port units. > > So if only sFlow feature is on stake, it worth to think, to purchase license, > or to purchase server. Prices for JFlow license on MX, just for 5/10G is way > above cost of very decent server. I believe that smaller MXs can run it for free. Larger providers we've worked with often have magic cookies they can call in to get it enabled, but I understand you're talking about the smaller-provider (or at least ~ 10gig per POP across multiple POPs) case. We see a lot of Brocade for switching in hosting providers, which makes sFlow easy, of course. > > And with the right setup you can run FastNetMon or other tools in > > addition to generating flow that can be of use for other purposes > > as well... > > Technically there is ipt_NETFLOW, that can generate netflow on same box, > for statistical/telemetry purposes. But i am not sure it is possible to > run them together. At frac 10gig you can just open pcap on a 10gig interface on a Linux box getting a tap, of course. What we did was use myricom cards and the myri_snf drivers and take from the single-consumer ring buffers into large in-RAM ring buffers, and make those ring buffers available via LD_PRELOAD or cli tools to allow flow, snort, p0f, tcpdump, etc to all be run at the same time at 10gig. The key for that is not going through the kernel IP stack, though. > > But taps can be difficult or at least time consuming for people to > > put in at scale. Even, we've seen, for folks with 10G networks. > > Often because they can get 90% of what they need for 4 different > > business purposes from just flow :) > > About scaling, i guess it depends on proper deployment strategy and > sysadmins/developers capabilities. For example to deploy new ruleset > for my pcap-based "homemade" analyser to 150 probes across the country - > is just one click. Sounds cool. You should write up that use case. Hopefully you've secured the metadata/command push channel well enough :) > Best regards, > Denys Avi Freedman | Your flow has something to show you; can you see it? | CEO, CloudHelix | (avi at cloudhelix dot com) | my name one word on skype |

5 6

Cisco IOS stable/production safe versions?
by Nick Ellermann 28 Jan '15

28 Jan '15

I have a Cisco IOS specific question for the group and also specifically related to the 6500 platform. We have always been very conservative with our IOS version that we run in production, we are still running a pretty old safe harbor build of 12.2.x on SUP 720 3BXLs with BGP and OSFP routing. Any advice from fellow network operators that are running the 6500 platform in the core still for versions that are considered safe for production? We are stable, but I am really wanting access to features such as Netflow v9, etc. Thanks for any advice! Sincerely, Nick Ellermann - CTO & VP Cloud Services BroadAspect E: nellermann(a)broadaspect.com<mailto:nellermann@broadaspect.com> P: 703-297-4639 F: 703-996-4443 THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.

2 1

AT&T uVerse blocking SIP?
by Brad Bendy 28 Jan '15

28 Jan '15

Has anyone seen issues where a end user on uVerse trying to connect to either another provider or AT&T non uVerse (in this case DIA) is having SIP blocked? SIP leaving the uVerse network going to another uVerse DSL account is fine, but it appears soon as it leave the uVerse network all SIP traffic is blocked? It appears others have seen this problem, some say it's a modem issue, some say they are truly blocking it. Ive yet to call uVerse support yet as im guessing ill get no where. Thanks for any insight on this. -- This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. 1st Class Hosting, LLC. 1712 Pioneer Ave, Suite 1854, Cheyenne, WY 82001

5 7

Re: Facebook outage?
by Larry Sheldon 27 Jan '15

27 Jan '15

On 1/27/2015 09:02, Roy wrote: > > According to one joker, the crash was caused by too many pictures of the > Northeast blizzard :-) Cat-picture server went down. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

2 1

Facebook outage?
by Damien Burke 27 Jan '15

27 Jan '15

Facebook outage? Everyone panic! https://twitter.com/search?q=facebook&src=typd -Damien

14 18

Re: Facebook outage?
by Larry Sheldon 27 Jan '15

27 Jan '15

On 1/27/2015 00:47, Damien Burke wrote: > Facebook outage? Everyone panic! > > https://twitter.com/search?q=facebook&src=typd Let the record show that I noticed it quite a while ago, but did NOT go for first NANOG mention. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

3 3

Requesting Consolidated Communications (AS5742) contact
by Christopher Costa 26 Jan '15

26 Jan '15

Requesting to speak with Consolidated Communications (AS5742) regarding routing in Illinois region towards Gaikai (AS33353). Please contact me offline. Thank you, Chris Costa Gaikai ccosta(a)gaikai.com

1 0

REMINDER: Leap Second
by Jay Ashworth 26 Jan '15

26 Jan '15

This June 30th, 235959UTC will be followed immediately by 235960UTC. What will /your/ devices do? http://www.marketplace.org/topics/world/leap-second-deep-space-and-how-we-k… Cheers, -- jra -- Sent from my Android phone with K-9 Mail. Please excuse my brevity.

11 13

Re: Comcast Support (from NANOG Digest, Vol 84, Issue 24)
by Brzozowski, John 26 Jan '15

26 Jan '15

Sorry Ron, just replied with the same information. ========================================= John Jason Brzozowski Comcast Cable p) 484-962-0060 w) www.comcast6.net e) john_brzozowski(a)cable.comcast.com ========================================= -----Original Message----- From: Ron Broersma <ron(a)dren.mil> Date: Monday, January 26, 2015 at 13:15 To: Rafael de Oliveira Ribeiro <rafael.ribeiro(a)rnp.br> Cc: John Brzozowski <John_Brzozowski(a)Cable.Comcast.com>, NANOG <nanog(a)nanog.org> Subject: Re: Comcast Support (from NANOG Digest, Vol 84, Issue 24) > >> On Jan 26, 2015, at 8:00 AM, Rafael de Oliveira Ribeiro >><rafael.ribeiro(a)rnp.br> wrote: >> >> Care to share scenarios where the SRXs do not perform well with DHCPv6? >>Any specific model? > >As one example, there is no support for DHCPv6-relay in the SRX, so we >never use them for edge routers (in our enterprise networks). >—Ron >

2 1

Re: Comcast Support (from NANOG Digest, Vol 84, Issue 24)
by Rafael de Oliveira Ribeiro 26 Jan '15

26 Jan '15

Dear John, On 24/01/2015 10:00, nanog-request(a)nanog.org wrote: (...) > Date: Fri, 23 Jan 2015 17:14:11 +0000 > From: "Brzozowski, John" <John_Brzozowski(a)Cable.Comcast.com> > To: "nanog(a)nanog.org" <nanog(a)nanog.org> > Subject: Comcast Support (from NANOG Digest, Vol 84, Issue 23) > Message-ID: <D0E7E8E3.21D5AA%john_brzozowski(a)cable.comcast.com> > Content-Type: text/plain; charset="utf-8" (...) > For customers where you bring your own cable modem or have one of the above in bridge mode we have enabled IPv6 support for you as well. However, your router behind the modem must be running software and configured with IPv6 support. Specifically, your router needs to be support stateful DHCPv6 for IPv6 address and prefix acquisition. We have received a number of reports from customers that the Juniper SRX does not appear to properly support IPv6. We are working with Juniper and also recommend that you reach out to Juniper as well. (...) Care to share scenarios where the SRXs do not perform well with DHCPv6? Any specific model? Thanks in advance, -- Rafael de Oliveira Ribeiro DAERO - Gerencia de Operacoes RNP - Rede Nacional de Ensino e Pesquisa Tel.: +55 21 2102 9659 - iNOC: 1916*767

2 1