Hi!

...

Are this Blacklistservers since x-mas down. We receive in the last days many errors from this servers...

...

Exemple enclosed Anonymsed. Greeting Xaver

Dec 31 10:12:37 linux-1ij2 named[14306]: too many timeouts resolving 'XXX.cn-kr.blackholes.us/A' (in 'cn-kr.blackholes.us'?): disabling EDNS Dec 31 10:12:37 linux-1ij2 named[14306]: too many timeouts resolving 'XXX.korea.blackholes.us/A' (in 'korea.blackholes.us'?): disabling EDNS Dec 31 10:12:37 linux-1ij2 named[14306]: too many timeouts resolving 'XXX.china.blackholes.us/A' (in 'china.blackholes.us'?): disabling EDNS Dec 31 10:12:38 linux-1ij2 named[14306]: too many timeouts resolving

Is your queuery volume not too high so they simply blocked your servers? blackholes.us has been non-existent for over a year. Their netblocks were re-allocated and the new owners were getting extremely upset over

On Thu, 31 Dec 2009 12:28:41 +0100 (CET) Raymond Dijkxhoorn <raymond@prolocation.net> wrote: people trying to resolve yyy.blackholes.us against their servers. Looks like it now returns NXDOMAIN. Can't help you with spamhaus... -- John

On Fri, Jan 01, 2010 at 09:44:13PM +0000, Paul Vixie wrote:

Jason Bertoch <jason@i6ix.com> writes:

...

...

Dec 31 10:12:37 linux-1ij2 named[14306]: too many timeouts resolving 'XXX.YYY.ZZZ/A' (in 'YYY.ZZZ'?): disabling EDNS

Do you have a firewall in front of this server that limits DNS packets to 512 bytes?

statistically speaking, yes, most people have that. which is damnfoolery, but well supported by the vendors, who think either that udp/53 datagrams larger than 512 octets are amplification attacks, or that udp packets having no port numbers because they are fragments lacking any udp port information, are evil and dangerous. sadly, noone has yet been fired for buying devices that implement this kind of overspecification. hopefully that will change after the DNS root zone is signed and udp/53 responses start to generally include DNSSEC signatures, pushing most of them way over the 512 octet limit.

it's going to be another game of chicken -- will the people who build and/or deploy such crapware lose their jobs, or will ICANN back down from DNSSEC? -- Paul Vixie KI6YSY

well, having been pushing vendors for a while on this, expect at least Checkpoint and Cisco to have corrected solutions fielded soon - and RedHat has fixed their DNSMASQ code since it was pointed out to them that thier defaults were based on flawed assumptions. Not a lost cause - but the inertia of the installed base is huge and it will take more than the last six months of work to make a dent. It would help if the BIND EDNS0 negotiation would not fall back to the 512 byte limit - perhaps you could talk with the ISC developers about that. --bill

On 1/1/10 4:44 PM, Paul Vixie wrote: ...

it's going to be another game of chicken -- will the people who build and/or deploy such crapware lose their jobs, or will ICANN back down from DNSSEC?

Either (a) a large cohort of entries is added to the root before [pick predicate condition of choice, and signing the root is a common one] "foo", or (b) a number of smaller cohorts of entries are added to the root after [pick predicate condition of choice, and signing the root is a common one] "bar". Security and stability is the last shibboleth in ICANN rhetoric, offered frequently absurdly, e.g., [1], and is one of three fictions [2] which, together with the trademarks issue, constitute the "four overarching issues" which presently prevents the Draft Applicant Guidebook from being final, and therefore, from applications being submitted, and the evaluation system from being exercised under load. Should "ICANN back down from DNSSEC", the rational for not starting the application rat race would be reduced to trademarks [3]. ICANN appears to be avoiding that for all of 2010 and 2011. Should "ICANN [not] back down from DNSSEC", the least refutable (by the non-technical community) rational for delay remains controlling, at some cost to businesses that do not invest in issue advocacy at ICANN, and so do not matter in the slightest even if they "go dark". Eric [1] http://forum.icann.org/lists/draft-eoi-model/msg00000.html [2] The Four Overarching Issues are (1) Intellectual Property and Trademark Protection, (2) Economic Analysis, (3) Security and Stability and (4) Malicious Conduct. [3] OK, there is another biggie out there, the idiots at CRAI proposed that we junk the registry-registrar separation _and_ let every moron cereal and/or soap trademark portfolio manager suff their brands into the IANA root. The separation issue is really big, as it is a stalking horse for 15 U.S.C. § 1–7. The marks-in-the-root issue should give one pause, not for sizeof(footprint) reasons, but because it is unavoidable that strings in the IANA root will become private property, and because as a string generator, trademarks are an infinite string source.

On Fri, 1 Jan 2010, Mike wrote:

I am looking at the possibility of leasing a ~70 mile run of fiber. I don't have access to any mid point section for regeneration purposes, and so I am wondering what the chances that a 120km rated SFP would be able to light the path and provide stable connectivity. There are a lot of unknowns including # of splices, condition of the cable, or the actual dispersion index or other properties (until we actually get closer to leasing it). Its spare telco fibers in the same cable binder they are using interoffice transport, but there are regen huts along the way so it works for them but may not for us, and 'finding out' is potentially expensive. How would someone experienced go about determining the feasibillity of this concept and what options might there be? Replies online or off would be appreciated.

The first thing you need to do is test the fiber with an OTDR. If you don't have one, you can probably contract a local cabling company to test it for you. How do you plan to drive transport over the fiber? GE? 10G? >10G? CWDM? DWDM? To drive a signal that far without a regen somewhere in the middle, your best bet might be something in the xWDM space, and then you can provision labmdas for GE, 10G, etc... There are boxes out there (Ciena, Infinera, Cisco ONS, etc) that can do this. How do you plan to handle responses to fiber cuts, signal degradation, someone at $telco unplugging the wrong jumper, etc? jms

On 1/2/10 2:58 AM, "Mikael Abrahamsson" <swmike@swm.pp.se> wrote:

On Fri, 1 Jan 2010, Justin M. Streiner wrote:

...

The first thing you need to do is test the fiber with an OTDR. If you don't have one, you can probably contract a local cabling company to test it for you.

Why would you want an OTDR report on the fiber, when an attenuation report is probably more accurate? OTDR is good for locating WHERE a problem is, but if you're seeing .2 dB/km attenuation end-to-end, there is little reason to break out the OTDR.

If I was of the opinion that the telco in the original message would act upon output data to clean up fibers/jumpers/splices, then the OTDR is the way to go because you can show them exactly where the issues are in the entire length of fiber. If the telco isn't going to make any modifications then an optical power meter would probably be sufficient. Either you can hit the distance in your loss budget or not. Mike

On 02/01/2010 18:37, Justin M. Streiner wrote:

I'm a big believer in running my own tests when possible, and not just relying on $provider's word. It also allows me to verify what their engineering reports tell me about the condition of a span.

+1 There's nothing like having hard data to shove in front of the noses of connectivity providers (whether colo / cross-connect or metro dark fibre providers) when unexplained problems suddenly start happening for no apparent reason. "This is what it was like before and this is what it's like now, and this ledge here shows that the problem is on a segment that you manage. Please explain". Nick

On Fri, Jan 01, 2010 at 02:52:33PM -0800, Mike wrote:

I am looking at the possibility of leasing a ~70 mile run of fiber. I don't have access to any mid point section for regeneration purposes, and so I am wondering what the chances that a 120km rated SFP would be able to light the path and provide stable connectivity. There are a lot of unknowns including # of splices, condition of the cable, or the actual dispersion index or other properties (until we actually get closer to leasing it). Its spare telco fibers in the same cable binder they are using interoffice transport, but there are regen huts along the way so it works for them but may not for us, and 'finding out' is potentially expensive. How would someone experienced go about determining the feasibillity of this concept and what options might there be? Replies online or off would be appreciated.

That shouldn't be too difficult, especially at only 1G (though pesonally I can't imagine why you would bother leasing dark fiber for that :P). There are several ways you could do it, including 120km+ rated SFPs (iirc there have been 200km SFPs out for a while too), an external optical amplifier (ideally you'd want to amp in the middle, but with a single channel you should be fine w/pre-amp), and a digital FEC wrapper to extend the receive sensitivity. Remember that the distance spec on optics is mostly a rough guideline, so depending on the fiber conditions and number of splices/panels along the way you could potentially expect to get the entire distance out of a "standard" 100km optic. -- Richard A Steenbergen <ras@e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

On 1/1/2010 5:52 PM, Mike wrote:

I am looking at the possibility of leasing a ~70 mile run of fiber. I don't have access to any mid point section for regeneration purposes, and so I am wondering what the chances that a 120km rated SFP would be able to light the path and provide stable connectivity. There are a lot of unknowns including # of splices, condition of the cable, or the actual dispersion index or other properties (until we actually get closer to leasing it). Its spare telco fibers in the same cable binder they are using interoffice transport, but there are regen huts along the way so it works for them but may not for us, and 'finding out' is potentially expensive. How would someone experienced go about determining the feasibillity of this concept and what options might there be? Replies online or off would be appreciated.

Thanks.

Pardon my ignorance in this area but is too much to ask for OTDR data before signing contracts? In addition to data on the make of the fiber if you wanted to do xWDM in the future. NDAs shall be signed of course....

On 02.01.2010 02:10, William Herrin wrote:

On Fri, Jan 1, 2010 at 7:24 PM, ML <ml@kenweb.org> wrote:

...

Pardon my ignorance in this area but is too much to ask for OTDR data before signing contracts? In addition to data on the make of the fiber if you wanted to do xWDM in the future.

Yes, it's too much to ask. They won't splice your path until you sign the contracts and you can't get useful OTDR and loss readings until the fiber is spliced.

In my experience the fiber splice/patch-teams have quite accurate estimations on the overall attenuation of unprovisioned paths. They know the distance (0.25dB/km for G.652 @ 1550nm), the number of connectors (0.35dB per plug average here) and splices (0.1dB/spice). YMMV though. We add +20% safety, include an escape clause wherever possible and cross our fingers. With regards to suggested EDFA amplification tricks and similar: If the requirement is not > 150km@1G or 80km@10G/DWDM then I personally strongly disencourage the use of optical amps. 200km / 41dB 1G SFPs are available with costs way below dual EDFAs plus spare, and the chance for the untrained to get eye damages in the process of implementation is far less. So put some laser googles at around 400 USD/each to the purchase list. If one decides to do so then add a post-amplifier on each *end* of the fiber link to increase the signal before hitting the receiver, and do not pump in star-wars class laser power at the beginning ;) . Cheers, -- Rene Avi next layer Telekommunikationsdienstleistungs- und Beratungs GmbH Mariahilfer Guertel 37/7 | A-1150 Wien | FB 257486g | HG Wien tel: +43 664 31764 00 | fax: +43 517649 | web: www.nextlayer.at my layers: Fiber/Metro | D/CWDM | Cisco | Juniper | I/BGP | MPLS

On 02.01.2010 13:22, Richard A Steenbergen wrote:

On Sat, Jan 02, 2010 at 12:35:15PM +0100, Rene Avi wrote:

...

With regards to suggested EDFA amplification tricks and similar: If the requirement is not > 150km@1G or 80km@10G/DWDM then I personally strongly disencourage the use of optical amps. 200km / 41dB 1G SFPs are available with costs way below dual EDFAs plus spare, and the chance for the untrained to get eye damages in the process of implementation is far less. So put some laser googles at around 400 USD/each to the purchase list. If one decides to do so then add a post-amplifier on each *end* of the fiber link to increase the signal before hitting the receiver, and do not pump in star-wars class laser power at the beginning ;) .

Depends where you buy your EDFAs, I suspect you could probably get them for less than the cost of a single channel of super long reach optics if you tried hard enough.

Respectfully disagree here - been there (googled^H^Hmarket research, talked to both manufactures and resellers for the last year), bought sample and went through lab tests. Still was unable to find trustful/working EDFAs near the cost of a pair of 40dB SFPs. 200km SFPs are even cheaper than 'original' Cisco CWDM-SFPs (standard 80km). We have them on stock for resale (no commercials intended here), so this price indication is near real-time ;)

If you needed to add DWDM later on, and/or dispersion compensation for 10G links the EDFAs will be needed anyways, so sometimes it just makes sense to solve the problem once with an amp rather than trying to solve it on a per-channel basis.

It depends on the requirement - of course. When Mike is heading for 10G DWDM demand levels he will probably have to amplify and cromatic-disperse-compensate with 120km G.652 (depending on the transceiver type) in any case. There are plenty of commercial solutions available for such spans, or he can try a building-block approach. My point is to skip EDFAs in a single 1G 120km fiber setup for commercial aspects, let alone technical reasons (complexity, safety), if there is no requirement for more bandwidth. IMHO even with multiple 1G CWDM-style setups, but your mileage may of course vary.

You're also vastly exagerating the power of what are effectively metro reach amps, you're really in no danger of making an eye hazard unless you start slapping on ultra long-haul 1500+km transport gear with class 3B lasers

In Mikes scenario this might be as a +10dB pre-amp would do the trick with low power, but a post-amp (+17dB gain with levels around -20..-30dBm to get some additional power budget) is what I would use if EDFAs are a stringent requirement. Most new long-haul transport systems have an automatic power-off feature for optical protection (e.g.the splice teams after a fiber cut/disconnect) now because of this.

(i.e. you're in far more danger from someone with a green laser pointer ordered from the Internet :P).

Agreed, but failed to save the whales - http://www.youtube.com/watch?v=Tuxf2xJ08Cc

Remember that 1550nm is infrared and very effectively filtered by the human eye, so even a +17dBm output EDFA (the max output for most metro systems) is still going to be class 1M and effectively safe as long as you don't stare at it in a microscope.

Or stare in the beam at 500mW/27dBm without noticing because it is infrared, and there is no eyelid closure reflex. I tend not to take chances for my colleagues and me but as common knowledge says it is everyones own decision to look into the laser with the remaining good eye. Cheers, -- Rene Avi next layer Telekommunikationsdienstleistungs- und Beratungs GmbH Mariahilfer Guertel 37/7 | A-1150 Wien | FB 257486g | HG Wien tel: +43 664 31764 00 | fax: +43 517649 | web: www.nextlayer.at my layers: Fiber/Metro | D/CWDM | Cisco | Juniper | I/BGP | MPLS

On 02/01/2010 00:24, ML wrote:

Pardon my ignorance in this area but is too much to ask for OTDR data before signing contracts? In addition to data on the make of the fiber if you wanted to do xWDM in the future.

fibre grade / quality, absolutely. otdr is difficult, because fibre providers usually splice up a specific path for a specific order. This means that they cannot always provide the otdr without first going to some trouble and expense. So you may find yourself having to specify acceptable attenuation limits in advance, then putting in an order and then getting the otdr + accurate attenuation results after the order has been accepted. Obviously, you assume some risk in terms of hoping that the optics that you buy for the circuit will actually do the job. Nick

On Fri, Jan 1, 2010 at 4:52 PM, Mike <mike-nanog@tiedyenetworks.com> wrote:

I am looking at the possibility of leasing a ~70 mile run of fiber. I don't have access to any mid point section for regeneration purposes, and so I am wondering what the chances that a 120km rated SFP would be able to light the path and provide stable connectivity. There are a lot of unknowns including # of splices, condition of the cable, or the actual dispersion index or other properties (until we actually get closer to leasing it). Its spare telco fibers in the same cable binder they are using interoffice transport, but there are regen huts along the way so it works for them but may not for us, and 'finding out' is potentially expensive. How would someone experienced go about determining the feasibillity of this concept and what options might there be? Replies online or off would be appreciated.

I second the recommendation that you request OTDR traces from whomever you are leasing the glass from, and further request traces for each strand in *both* directions (a end to z end, z end to a end) at multiple wavelengths, say 1530nm-1640nm at a maximum of 200GHz wavelength spacing to properly identify potential problem locations in the future when you want to build out a 10GE metro DWDM solution (You really do want to know about that old mechanical splice 20km into your run, etc). An OTDR will provide you with granular loss/gain event details for your entire span, while a power meter/light source will only tell you your overall span loss. While your fiber provider may not pony up OTDR results until after you've executed the contract, they should be able to give you a rough estimate of the total loss (in dB for a 1550nm signal) for the span you are looking at leasing, and you can build provisions into your contract that enforce an absolute maximum loss on the span, in which case the provider will be forced to take necessary actions to replace old poorly executed splices with fusion splices, isolate and correct bends, etc. As most have pointed out - EDFA should not be required for a 1GE single channel solution, and probably would not be required for a simple 1GE CWDM setup either. Once you graduate to an active 10GE DWDM solution EDFA's will be more of a necessity (possibly with dispersion compensation, depending on your vendor this may be an entirely separate shelf module or may be build into the amp card). The addition of EDFA's in a multi-channel solution also adds complexity (if you want to build a scalable/cost effective solution). Most EDFA's have a maximum and minimum per-channel input power, and ideally you would want to have each channel near the same power level before hitting the EDFA. Depending on your gear, topological complexity, etc this may require the use of an optical spectrum analyzer to verify individual channel power levels so the correct amount of attenuation can be added to each channel before it hits the EDFA, however for a single point to point span this will probably not be a concern. -- Cheers, Kevin ================================================================ Kevin Hodle | http://www.linkedin.com/in/kevinhodle PGP Key ID | fingerprint 0x803F24BE | 1094 FB06 837F 2FAB C86B E4BE 4680 3679 803F 24BE "Elegance is not a dispensable luxury but a factor that decides between success and failure. " -Edsgar Dijkstra ================================================================

On Mon, Jan 4, 2010 at 4:01 AM, Martin, Paul <Paul.Martin@viatel.com> wrote:

If you only want 1gig, then if the SP provides it, won't it be cheaper to simply get a 1gig circuit from them that hands off to you on a GigE port rather than pay for all the various higher spec equipment that you'd otherwise require?

Paul.

Yes, a carrier provided lit service (wavelength, EoMPLS) would obviously be less expensive than leasing dark for a single 1GE channel (especially for longer spans), but I'm assuming OP has already considered this and is going with a dark fiber option for one of the following reasons: A) Expected rapid growth in transfer volume, wherein a dark fiber solution provides the OP with the flexibility to rapidly upgrade to either a multi-channel xWDM 1GE, single channel 10GE, or xWDM 10GE solution immediately, as opposed to a lit solution where he would be restricted by the provisioning time line of the carrier (dark quickly becomes a more attractive solution than lit services as bandwidth needs increase) B) Specific business requirements (ie security concerns) that preclude the usage of 3rd party's network/transmission gear from carrying traffic deemed 'sensitive', 'confidential', etc. You fill in the blanks. The idea is laughable to many operators, but sometimes a board's ideal model of data security is not exactly in line with business and technical realities (Usually this means money in your pocket). -- Cheers, Kevin ================================================================ :: :: Kevin Hodle | http://www.linkedin.com/in/kevinhodle PGP Key ID | fingerprint 0x803F24BE | 1094 FB06 837F 2FAB C86B E4BE 4680 3679 803F 24BE "Elegance is not a dispensable luxury but a factor that decides between success and failure. " -Edsgar Dijkstra ================================================================