I use a RouterBoard with RouterOS and afaik not the hardware nor the software are open -Jorge

On Jan 2, 2014, at 9:53 AM, Faisal Imtiaz <faisal@snappytelecom.net> wrote:

Have you looked at Mikrotik.com (Software) and Routerboard.com (Hardware)

On Thu, Jan 2, 2014 at 8:53 PM, Andrew Duey < andrew.duey@widerangebroadband.net> wrote:

I'm surprised nobody's mentioned vyatta.org or the new fork of VyOs. We are currently using the vyatta community edition and so far it's been good to to us. It depends on your hardware and how small of an ISP you are but it might be a great open source fit for you.

The orig. author has potentially set course for a world of hurt -- if the plan is to scrap robust packaged highly-validated gear having separate hardware forwarding planes and ASIC-driven filtering, to stick cheap x86 servers in the SP core and internet borders. Sure... anyone can install Vyatta on a x86 server, but assembly of all the pieces and full validation for a resilient platform comparable to carrier grade gear, for a mission critical network, should be a bit more involved than that. Next up.... how to build your own 10-Gigabit SFPs to avoid paying for expensive brand-name SFPs, by putting together some chips, wires, fiber, and tying it all together with a piece of duck tape.... just saying... :)

--Andrew Duey

-- -JH

On 1/3/2014 2:05 AM, Daniël W. Crompton wrote:

Good point Jimmy, there is a world of hurt involved, although it may be slightly less painless when you realize that the alternative is: "*the NSA [who] has modified the firmware of computers and network hardware—including systems shipped by Cisco, Dell, Hewlett-Packard, Huawei, and Juniper Networks—to give its operators both eyes and ears inside the offices the agency has targeted.*"[1]

Why would you think other platforms would be any safer? The NSA plants those bugs with interdiction operations. They could similarly install eavesdroppers in the USB/serial links of your KVM switches and terminal servers and capture your root/admin/console passwords. Dell, HP, Cisco, etc. were named because the leaked docs mention hardware-specific BIOS/firmware bugging such as ILO piggybacking in a Proliant. I think it's foolhardy believing they wouldn't have similar attacks for just about everything.

On 4 January 2014 08:34, Arnd Vehling <av@nethead.de> wrote:

On 04.01.2014 07:49, Darren Pilgrim wrote:

Dell, HP, Cisco, etc. were named because the leaked docs mention

...

hardware-specific BIOS/firmware bugging such as ILO piggybacking in a Proliant. I think it's foolhardy believing they wouldn't have similar attacks for just about everything.

Highly unlickely they have similiar attacks for everything. They for sure can make em if they see fit but they dont have backdoors to everything.

To my surprise I am seeing a theme fatalistic acceptance in this thread, it seems like some who have been kind enough to answer privately or publicly are of the opinion that either everything is already backdoored by the US designers and/or by the Chinese manufacturers. I doubt however that any of these people would hand over their root passwords to the US or Chinese government willingly. A number have mentioned that if you are targeted there is little you can do, and this is something that I agree with to a certain extent. This doesn't mean you leave the barndoor open. D. -- Daniël W. Crompton <daniel.crompton@gmail.com> <http://specialbrands.net/> <http://specialbrands.net/> http://specialbrands.net/ <http://twitter.com/webhat> <http://www.facebook.com/webhat><http://plancast.com/webhat><http://www.linkedin.com/in/redhat>

Arnd - the German Government is most likely a partner meaning overloading the NSA is pointless if you could. Todd On 1/5/2014 1:15 AM, Arnd Vehling wrote:

Hi,

On 04.01.2014 21:07, Daniël W. Crompton wrote:

...

To my surprise I am seeing a theme fatalistic acceptance in this thread,

thats not really suprising. Then most poeple dont understand the implications "this" has.

...

A number have mentioned that if you are targeted there is little you can do, and this is something that I agree with to a certain extent.

Here i agree too. But i think it should be in possible to overload them by mass-creating fake data and honey pots. They dont have endless resources especially when it comes to decrypting. So, if just 10% of the "aware persons" start firing up "NSA honeypots" they get a resource problem and will fail at selecting targets.

// Arnd

-- ------------- Personal Email - Disclaimers Apply

You actually buy brand-name SFP's? That's like buying the gold-plated HDMI Monster Cable at Best Buy at markup ... I just find the the companies that the vendors contract to make their OEM SFP's and buy direct. Same SFP from the same factory except one has a Cisco sticker. ;-) You can even get them with the correct vendor code, been doing this for years and there is no difference in failure rate or quality and we go through hundreds of SFPs. It is nice to have a solution provider if you're only looking at one unit, but if you're deploying a large amount then building and testing your own configuration really isn't that hard and will save you a lot of money. You can even contract an OEM appliance vendor to take care of the actual build for you and they'll usually provide 3-year replacement on the hardware. (I've found "Sourcecode" to be the best price-wise for smaller projects). As a bonus they'll slap whatever branding you want on the thing for that professional touch. Vyatta and now VyOS are important projects for networking. We really need to get away from locked down non-free hardware and software for critical infrastructure. It's natural that most of the people in this community (myself included) will be fans of companies like Cisco and Juniper and dismiss anything else, but that mindset for me change when I deployed 100+ whitebox units 3 years ago and saved nearly a million in the process. Juniper is a FreeBSD shop, and Cisco's new OS lines are based on Linux. Ciena is largely based on Linux as well. In poking around at these platforms recently one of the big things I'm noticing is that there is a lot less done in hardware than we traditionally saw, especially from Cisco. Having your networking in silicon is great when you have a 100 MHz CPU; Cisco even conditioned us to be terrified of anything being punted to CPU by under-sizing and over-pricing their CPUs for years. But when you have a modern server-grade platform, multi-Gigabit performance, even with significant levels of packet processing and small packet sizes, is a joke. So at least for the low end of the spectrum there is a huge savings for equal (often better) performance. As I mentioned before I haven't done much with 10-Gigabit, but I imagine with Intel-based cards on a modern PCIe bus that you can at least get entry-level performance. Sometimes the biggest push for 10G is avoiding a 2G or 4G port-channel. With the new Intel DPDK stuff, Intel is claiming 80M PPS performance on a standard Xeon platform: http://www.intel.com/content/www/us/en/intelligent-systems/intel-technology/... Eventually, DPDK support will likely start being included in projects like VyOS, perhaps in Linux in general. As for VyOS, the project is starting to get some momentum and is run by former Vyatta employees and even some people from UBNT. I think we'll see some good stuff from them in the future. The 1.0 release is solid from what I've seen (and even fixes some bugs Vyatta hasn't yet). On Fri, Jan 3, 2014 at 12:01 AM, Jimmy Hess <mysidia@gmail.com> wrote:

On Thu, Jan 2, 2014 at 8:53 PM, Andrew Duey < andrew.duey@widerangebroadband.net> wrote:

...

I'm surprised nobody's mentioned vyatta.org or the new fork of VyOs. We are currently using the vyatta community edition and so far it's been good to to us. It depends on your hardware and how small of an ISP you are but it might be a great open source fit for you.

The orig. author has potentially set course for a world of hurt -- if the plan is to scrap robust packaged highly-validated gear having separate hardware forwarding planes and ASIC-driven filtering, to stick cheap x86 servers in the SP core and internet borders.

Sure... anyone can install Vyatta on a x86 server, but assembly of all the pieces and full validation for a resilient platform comparable to carrier grade gear, for a mission critical network, should be a bit more involved than that.

Next up.... how to build your own 10-Gigabit SFPs to avoid paying for expensive brand-name SFPs, by putting together some chips, wires, fiber, and tying it all together with a piece of duck tape....

just saying... :)

...

--Andrew Duey

-- -JH

-- Ray Patrick Soucy Network Engineer University of Maine System T: 207-561-3526 F: 207-561-3531 MaineREN, Maine's Research and Education Network www.maineren.net

On (2014-01-03 07:48 -0500), Ray Soucy wrote:

Juniper is a FreeBSD shop, and Cisco's new OS lines are based on Linux. Ciena is largely based on Linux as well. In poking around at these platforms recently one of the big things I'm noticing is that there is a lot less done in hardware than we traditionally saw, especially from Cisco.

I'm not sure which platforms you refer to. But if we look at SP segment we're talking about JNPR M, MX, T, PTX or Cisco ASR9k, NCS6k, CRS-1. JNPR is indeed FreeBSD, but FreeBSD is used very sparsely, to boot box up and to run RPD, which is essentially router-control-plane-in-a-process, it runs all routing protocols and configures hardware. ASR9k, CRS-1 run IOS-XR on QNX and NCS6k on Linux and there at least Cisco capitalizes on OS scheduling, it's not single fat process on top of OS. All of these boxes do all packet pushing in NPU (ezchip, trio, ichip...) For IOS XE boxes, it's almost same as JNPR, except instead of single process single threaded RPD, IOSd is actually running several threads.

by under-sizing and over-pricing their CPUs for years. But when you have a modern server-grade platform, multi-Gigabit performance, even with significant levels of packet processing and small packet sizes, is a joke. So at least for the low end of the spectrum there is a huge savings for equal (often better) performance.

Low end has always been using COTS CPU, RISC, PPC etc, so not much has changed there. For low end, linux pc can be competitive in some applications.

With the new Intel DPDK stuff, Intel is claiming 80M PPS performance on a standard Xeon platform: http://www.intel.com/content/www/us/en/intelligent-systems/intel-technology/...

DPDK is super interesting and it shows Intel is looking at the NPU market, unfortunately these numbers have nothing to do with real-life application, lookup against million+ routes, ACLs, QoS etc. But maybe not in too distant future x86 Intel is usable as NPU, Intel seems to be looking NPU market demands when designing new x86 chips. Right now, if you need perfomance, you're going to have to buy something like bcom chip and then cumulusnetworks linux on top of it, it's as close to 'open source' as you're going to get with good performance. And this is more or less DC stuff, SP market needs more intelligent chips than those ASICs, and I don't think there anything 'open source' in the market place for NPU stuff. -- ++ytti

On (2014-01-04 12:08 +0100), Benno Overeinder wrote:

No hands-on experience with Cumulus Networks equipment, but from what I have heard I like their approach to open hardware/software for routing equipment. It is flexible what you want to configure and run (all open source software). For the hardware switching support they license their Switch HAL module.

I love the notion of COTS control-plane software, it has potential to fundamentally change the market dynamics. COTS ASICs (bcom the most prominient) and COTS NPU (ezchip, xelerated/marvell) have done lot of good to the market in terms of features/performance/price. Right now some of the big name vendors are running really archaic and naive control-planes, and it's hard for them internally to justify project to rebuild it all, because customers will largely accept even the shitty control-plane, because that is only thing you get with that hardware. Company doing only COTS control-plane can't get away with shitty software, it's their only product. And conversely, they can get away having many generation of incompatible operating systems, as older customers will keep on wanting+paying on the development of the older version while newer greenfield customers will want to start with the latest generation. This creates pressure on the established companies to have great control-plane, not some 20 year old TTM house of cards. -- ++ytti

On Friday, January 03, 2014 03:33:56 PM Saku Ytti wrote:

Right now, if you need perfomance, you're going to have to buy something like bcom chip and then cumulusnetworks linux on top of it, it's as close to 'open source' as you're going to get with good performance. And this is more or less DC stuff, SP market needs more intelligent chips than those ASICs, and I don't think there anything 'open source' in the market place for NPU stuff.

Indeed. Broadcom are making lots of interesting cheap and fast ASIC's, but they're data centre focused, or serve a specific platform feature set with Cisco/Juniper that has a number of restrictions, just to keep the costs down. Mark.

http://approvedoptics.com/ is a good starting point if you want correct vendor codes On Tue, Jan 7, 2014 at 8:57 AM, Vlade Ristevski <vristevs@ramapo.edu> wrote:

Sorry to get off topic, but is there a company that you can recommend? The price of the Cisco single mode GLC-LH-SMD= is killing me. I see a bunch of third party ones on Amazon and CDW but I'd to love to get my hands one that has the correct vendor code without going and trying them all.

On 1/3/2014 7:48 AM, Ray Soucy wrote:

...

You actually buy brand-name SFP's? That's like buying the gold-plated HDMI Monster Cable at Best Buy at markup ...

I just find the the companies that the vendors contract to make their OEM SFP's and buy direct. Same SFP from the same factory except one has a Cisco sticker. ;-)

You can even get them with the correct vendor code, been doing this for years and there is no difference in failure rate or quality and we go through hundreds of SFPs.

Vlad Network Manager

-- Ray Patrick Soucy Network Engineer University of Maine System T: 207-561-3526 F: 207-561-3531 MaineREN, Maine's Research and Education Network www.maineren.net

On (2014-01-08 13:56 -0500), Ray Soucy wrote:

Just to toss in a few more vendors so not to look biased:

Instead of suggesting names, I'm giving some suggestions want to ask for vendor when looking for new partner - DDM/DOM, should be included in each (<1USD price premium), min/max TX/RX in eeprom should match that of PDF specsheet - accountability - supplier knows what they've sold to you, and where they've sourced them, so if there is problem, they can easily state you which of your optics are affected - replacement - advance replacement for non-critical replacement - eeprommer - usable by field-tech without training. If they are 'x compatible' it only means that someone programmed the eeprom with 'x' data. That someone might as well be your field tech, as it reduces your spare cost and ensures you always have correct part. Verify software has codes for kit you need it for. - if you need part (like for example dwdm) when 1st party only support something like SR, make sure you get the eeprom saying something that still allows you to inventory it correctly for easing operations when it needs to be replaced - part numbers - product ordered with given partnumber should be same part, single source laser, microcontroller, casing etc. If some source/supplier is changed, part number is changed. (So you can rely on getting something you know to work, to avoid testing everything) - product change notification - if something is changed with 'compatible' part without part number change, you should be informed of what was changed and why - prices decrease rapidly, it's chore to keep renegotiating constantly, try to negotiate contract where your price changes in reflection to vendors supplies becoming cheaper And of course make sure they sell all the stuff you need, so you don't need to have many sources, fewer sources, larger volume, better prices and also less parts to track/test. Chances are if you're just using 1st party, there may be lot of interesting optics available which will allow you to engineer some problems lot cheaper than you've used to.

When all is said and done, my experience with third-party optics has been that they're identical to brand-name optics except for the sticker. In fact, it's pretty clear most of the time that they're often made by the same place.

-- ++ytti

On (2014-01-09 00:36 -0500), Brandon Ross wrote:

So, in other words, you should make higher demands of your 3rd party optics providers than any of the OEMs could meet? When was the last time your OEM lowered your pricing for you when their supplies got cheaper? And when was the last time they changed their part number when they changed the casing of an optic?

We have some contracts were price decreases automatically each year for next 5-6 years. Cisco sometimes changes P#, sometimes not, change is documented and explained in either case, you can track these in Cisco PCN Tool. It's everything down to rack screws. Specialized shop, doing professionally just optics are able to do this for you, brokers buying where they can get cheapest, have no idea what they sell to you. -- ++ytti

On Tuesday, January 07, 2014 05:12:38 PM Aled Morris wrote:

In Europe, http://www.flexoptix.net are recommended.

They also sell blank modules and give you a programmer too, so you can stock fewer spares and program them for whatever vendor you need in an outage/rapid deployment situation.

I'm sure they'd ship to the US.

Yep, would recommend them. Mark.