Re: Network configuration archiving

2013-10-25 Thread Saku Ytti
On (2013-10-25 10:22 -0400), Phil Bedard wrote: There are companies like Tail-F who are trying to use things like YANG Tail-F is very cool, but it needs support for both direction. Abstract data - Vendor Config(easy problem, just agnostic ascii template) Vendor Config - Abstract data

Re: Network configuration archiving

2013-10-25 Thread Saku Ytti
On (2013-10-25 14:27 -0400), Phil Bedard wrote: The vendor config-abstract data (really structured data) is the point of YANG definitions. I think I'm correct but Tail-F's system works by interpreter based on those definitions. The trick is getting the standards bodies and vendors to

Re: BGP Attribute 128

2013-09-27 Thread Saku Ytti
On (2013-09-26 17:02 -0500), Jared Mauch wrote: I certainly agree. There is a very narrow case for filtering 128 as it's a VPN attribute that should not be in the big-I Internet. I can't think of application right now, but I'm not convinced there isn't application for 128 over INET. I know

Re: BGP Attribute 128

2013-09-26 Thread Saku Ytti
On (2013-09-25 11:35 -0400), Jared Mauch wrote: Hi, I'm not really in favor of the features vendors have provided, such as this to just drop the attribute or routes. I would encourage customers to require in their transit agreements that bgp updates are not mangled by provider. It would help

Re: 10G Router

2013-09-03 Thread Saku Ytti
On (2013-09-03 12:59 -0400), ja...@towardex.com wrote: Do note however: MX80-48T (cheaper variant with 48x tri-rate copper) uses the old MS-DPC and does not scale very well when things like Netflow/IPFix No it does not, it uses trio just no QX chip for per-vlan QoS. -- ++ytti

Re: subrate SFP?

2013-08-31 Thread Saku Ytti
On (2013-08-30 11:30 -0400), Tim Durack wrote: It would be interesting to have some other smart SFP options too, like macsec for example... Or HQoS in a SFP, for that one port which kills your ability to get away with cheap L3-switch style box :) But tbh the moment you'll need control-plane

Re: subrate SFP?

2013-08-30 Thread Saku Ytti
certainly get such SFP built. Obviously this SFP would cost bit more than normal cuSFP, as it needs to do rudimentary buffering, packet dropping and it needs to have frame parser. On 29 August 2013 23:38, joel jaeggli joe...@bogus.com wrote: On 8/29/13 6:08 AM, Saku Ytti wrote: How do people deal

Re: subrate SFP?

2013-08-30 Thread Saku Ytti
I actually emailed RAD, MethodE and Avago yesterday and pitched the idea. MiTOP is my exact justification why it should technically be feasible. I guess it would be easier to pitch, if there would be commitment to buy, but I don't personally need many units, just 1-2 here and there. On 30

subrate SFP?

2013-08-29 Thread Saku Ytti
How do people deal with situation where you need =48 SFP/SFP+ ports, but you occasionally need one or two cu 10/100 ports? For some reason it's becoming quite rare for SFP port to natively support 10M and 100M rates. Technically obviously solution to me would be subrate SFP, which presents

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Saku Ytti
On (2013-08-27 00:01 +), Christopher Palmer wrote: If anyone has any data or anecdotes, please feel free to send an off-list email or whatever. [y...@ytti.fi ~]% ssh ring ring-all -t90 ping -s 1473 -c2 -w3 ip.fi|pastebinit http://p.ip.fi/KA7N [ytti@sci ~]% curl -s

Re: IP Fragmentation - Not reliable over the Internet?

2013-08-27 Thread Saku Ytti
On (2013-08-27 10:45 +0200), Emile Aben wrote: 224 vantage points, 10 failed. 48 byte ping:42 out of 3406 vantage points fail (1.0%) 1473 byte ping: 180 out of 3540 vantage points fail (5.1%) Nice, it's starting to almost sound like data rather than anecdote, both tests implicate 45%

Re: Typical warranty for generic DWDM transceivers

2013-08-20 Thread Saku Ytti
On (2013-08-20 00:00 -0600), Manuel Marín wrote: We are currently evaluating the use of generic third party optics (SFP+ and XFP) for 40Kms and 80Kms applications from vendors like NHR and Champion One and I was wondering if someone in the group has experience using optics Neither of these

Re: How big is the Internet?

2013-08-14 Thread Saku Ytti
On (2013-08-14 10:32 -0400), Sean Donelan wrote: What are the current estimates about the size of the Internet, all IP networks including managed IP and private IP, and all telecommunications including analog voice, video, sensor data, etc? One interesting datapoint might be how many OUI have

Re: questions regarding prefix hijacking

2013-08-08 Thread Saku Ytti
On (2013-08-08 17:48 +0300), Martin T wrote: In most cases upstream does not do any automatic prefix filter generation, it's maybe somewhat popular in mid-sized european shops but generally not too common. What do you mean? In most cases upstreams do not filter prefixes at all?

Re: questions regarding prefix hijacking

2013-08-07 Thread Saku Ytti
On (2013-08-07 11:20 +0300), Martin T wrote: on Internet? Has there been such situations in history? Isn't there a method against such hijacking? Or have I misunderstood something and this isn't possible? Certainly practical scenario, but in many cases not needed at all. In most cases

Re: OSPF Vulnerability - Owning the Routing Table

2013-08-04 Thread Saku Ytti
On (2013-08-03 18:38 -0500), Jimmy Hess wrote: That's not news to me, but fully expected. Do the vendors /really/ have a code fix to what would seem to be an inherent problem; if you failed to properly secure your OSPF implementation (via MD5 authentication)? It is news to me. It's design

Re: OSPF Vulnerability - Owning the Routing Table

2013-08-04 Thread Saku Ytti
On (2013-08-04 05:01 -0500), Jimmy Hess wrote: I would say the risk score of the advisory is overstated. And if you think ospf is secure against LAN activity after any patch, that would be wishful thinking. Someone just rediscovered one of the countless innumerable holes in the back of the

Re: nLayer IP transit

2013-08-01 Thread Saku Ytti
On (2013-08-01 10:00 +1000), Mark Tees wrote: I remember reading a while back that customers of nLayer IP transit services could send in Flowspec rules to nLayer. Anyone know if that is true/current? Anyone planning to do this might want to be aware that the validation process of flowspec

Re: SNMP DDoS: the vulnerability you might not know you have

2013-08-01 Thread Saku Ytti
On (2013-07-31 17:07 -0700), bottiger wrote: But realistically those 2 problems are not going to be solved any time in the next decade. I have tested 7 large hosting networks only one of them had BCP38. I wonder if it's truly that unrealistic. If we target access networks, it seems

Re: nLayer IP transit

2013-08-01 Thread Saku Ytti
On (2013-08-01 11:35 +0400), Alexandre Snarskii wrote: You can match flow actions by extended communities and not accept actions you do not like. For example, to permit only discard action you can match community flow_discard members traffic-rate:*:0; Or am I missing something ?

disregard, test

2013-07-09 Thread Saku Ytti
https://i.chzbgr.com/maxW500/7644490752/h49306FE3/ many complain that they've not seen emails from nanog in few days (since 5th day of 'The Cidr Report') -- ++ytti

Re: disregard, test

2013-07-09 Thread Saku Ytti
On (2013-07-09 05:31 -0700), Shrdlu wrote: Next time? Please consider just examining the archives, so that you may verify that indeed, a miracle has occurred, and that indeed, no one has anything in particular to say. I admit that I checked the archives myself, when it seemed to quiet. I'm

Re: Google's QUIC

2013-07-02 Thread Saku Ytti
On (2013-06-29 23:36 +0100), Tony Finch wrote: Reminds me of MinimaLT: http://cr.yp.to/tcpip/minimalt-20130522.pdf Now that I read separate 'QUIC Crypto' page. It sounds bit of a deja vu. QUIC also uses Curve25519 pubkey and Salsa20 cipher, which is hard to attribute as chance, considering

Re: Egress filters dropping traffic

2013-07-01 Thread Saku Ytti
On (2013-06-30 22:04 +0530), Glen Kent wrote: Under what scenarios do providers install egress ACLs which could say for eg. 1. Allow all IP traffic out on an interface foo if its coming from source IP x.x.x.x/y 2. Drop all other IP traffic out on this interface. Question seems to be 'when

Re: Google's QUIC

2013-06-30 Thread Saku Ytti
On (2013-06-29 23:36 +0100), Tony Finch wrote: Reminds me of MinimaLT: http://cr.yp.to/tcpip/minimalt-20130522.pdf ACK. Any cryptobased 0 RTT will necessarily have many things similar, and indeed crypto is the key for low latency without major attack vectors. But MinimaLT does not support

Re: Google's QUIC

2013-06-30 Thread Saku Ytti
On (2013-06-30 11:15 +0300), Saku Ytti wrote: But MinimaLT does not support multiplexing, which seems to be critical design goal for QUIC. Mea culpa, it does support multiplexing. -- ++ytti

Re: Google's QUIC

2013-06-29 Thread Saku Ytti
On (2013-06-29 10:27 -0400), Darius Jahandarie wrote: On Sat, Jun 29, 2013 at 7:53 AM, Grzegorz Janoszka grzeg...@janoszka.pl wrote: I am surprised nobody mentioned security issues. To minimize latency the following would be best: the client sends one UDP packet and receives stream of

Re: huawei

2013-06-13 Thread Saku Ytti
On (2013-06-13 12:22 -0400), Patrick W. Gilmore wrote: Do you think Huawei has a magic ability to transmit data without you noticing? I always found it dubious that public sector can drop them from tender citing publicly about spying, when AFAIK Huawei hasn't never actually been to court about

ipfix analyzers

2013-04-09 Thread Saku Ytti
Can someone point me to IPFIX analysers that do automatic learning of traffic patterns, raise events as suspected dos, and when operator marked as false positive, won't trigger that pattern anymore? This should be without configuring any explicit network ranges anywhere. So when I do get new

Re: Tier 2 ingress filtering

2013-03-30 Thread Saku Ytti
On (2013-03-29 13:31 +0100), Tore Anderson wrote: I've had some problems with my upstream providers' ingress filtering, for example: That sounds like uRPF, which you should not run towards your transit customers. I'm talking only about using ACL. And I stand-by that I've never had to fix

Re: Tier 2 ingress filtering - folo

2013-03-30 Thread Saku Ytti
On (2013-03-30 11:39 -0400), Jay Ashworth wrote: But there's no way for an upstream transit carrier to know that *at the present time*. We expect our customers to mark any customers they have in their AS-SET. And we filter BGP announcements and we ACL traffic based on that. I know mandating

Re: Can we not just fix it? WAS:Re: Open Resolver Problems

2013-03-28 Thread Saku Ytti
On (2013-03-27 22:27 -1000), David Conrad wrote: One of the largest DDoS attacks I've witnessed was SNMP-based, walking entire OID sub-trees (with spoofed source addresses) across thousands of CPEs that defaulted to allowing SNMP queries over the WAN interface. Oops. Topped out around 70

Re: Tier 2 ingress filtering

2013-03-28 Thread Saku Ytti
On (2013-03-28 13:07 -0400), Jay Ashworth wrote: The edge carrier's *upstream* is not going to know that it's reasonable for their customer -- the end-site's carrier -- to be originating traffic with those source addresses, and if they ingress filter based on the prefixes they route down to

Re: Tier 2 ingress filtering

2013-03-28 Thread Saku Ytti
On (2013-03-28 15:47 -0400), Jay Ashworth wrote: You can't do it at top-level nor it's not practical to hope that some day BCP38 is done in reasonably many last-mile port. I don't know that that's true, actually; unicast-rpf does, as I understand it, most of the work, and is in most of

Re: Tier 2 ingress filtering

2013-03-28 Thread Saku Ytti
On (2013-03-28 23:45 +), Rajiv Asati (rajiva) wrote: In fact, what makes it easier is that uRPF can be part of the template that can be universally applied to every edge port. There is incredible amount of L3 interfaces in the last mile, old ghetto stuff, latest gen Cisco, which does not

Re: BCP38 - Internet Death Penalty

2013-03-27 Thread Saku Ytti
On (2013-03-27 11:05 -0500), Jack Bates wrote: I'm not arguing that the process can't be done. The problem is, there are a number of networks that don't know it needs to be done and why, or they don't know how to do it. There are a number of networks that have no concept of scripting changes

Re: Open Resolver Problems

2013-03-26 Thread Saku Ytti
On (2013-03-26 09:28 -0700), Owen DeLong wrote: Let me rephrase the question… How do you find an open IPv6 recursive name server that isn't listed in an NS entry and hasn't been publicized someplace that Google can find it? Pwn authorative server catering moderately popular domain and

Re: Cloudflare is down

2013-03-04 Thread Saku Ytti
On (2013-03-04 06:51 -0800), Leo Bicknell wrote: From what I have heard so far there is something else they could have done, hire higher quality people. Your solution to mistakes seem to be not to make them. I can understand the train of thought, but I suspect the practicality of such advice.

Re: Cloudflare is down

2013-03-04 Thread Saku Ytti
On (2013-03-04 13:23 -0500), Jeff Wheeler wrote: We have lots of stupid people in our industry because so few understand The Way Things Work. We have tendency to view mistakes we do as unavoidable human errors and mistakes other people do as avoidable stupidity. We should actively plan for

Re: Cloudflare is down

2013-03-04 Thread Saku Ytti
On (2013-03-04 12:33 -0800), Constantine A. Murenin wrote: to use http-acceleration services without DNS tie-ins. Last I checked, CloudFlare didn't even let you setup just a subdomain for their service, e.g. they do require complete DNS control from the registrar-zone level, all the time,

Re: Cloudflare is down

2013-03-03 Thread Saku Ytti
On (2013-03-03 12:46 -0800), Constantine A. Murenin wrote: Definitely smart to be delegating your DNS to the web-accelerator company and a single point of failure, especially if you are not just running a web-site, but have some other independent infrastructure, too. To be fair, most of us

Re: SDN - Killer Apps

2013-02-25 Thread Saku Ytti
On (2013-02-25 13:53 +0530), Glen Kent wrote: I understand that this is just some bit of what we can do with SDN. The amount of what all can be done is limitless. So, a question to all out there - Is my understanding of what can be achieved with SDN, is correct? Frankly I don't think there is

Re: The 100 Gbit/s problem in your network

2013-02-11 Thread Saku Ytti
On (2013-02-11 11:58 +0100), Adam Vitkovsky wrote: The only time real-time per se matters is if you're playing the same content on multiple screens and *synchronization* matters. And there's the HFT where real-time really does matter :) I think most of HFT crowd are buying into low-latency

Re: The 100 Gbit/s problem in your network

2013-02-11 Thread Saku Ytti
On (2013-02-11 12:16 +), Aled Morris wrote: I don't see why, as an ISP, I should carry multiple, identical, payload packets for the same content. I'm more than happy to replicate them closer to my subscribers on behalf of the content publishers. How we do this is the question, i.e. what

Re: The 100 Gbit/s problem in your network

2013-02-08 Thread Saku Ytti
On (2013-02-08 14:15 +), Aled Morris wrote: Multicast I don't see multicast working in Internet scale. Essentially multicast means core is flow-routing. So we'd need some way to decide who gets to send their content as multicast and who are forced to send unicast. It could create de-facto

Re: Juniper MX10 and dual stack BGP

2013-01-30 Thread Saku Ytti
On (2013-01-30 21:06 -0500), David Miller wrote: According to Juniper, the MX uses separate memory for v4 and v6. Where do they state this? MX is ambiguous, what matters is linecard HW. The numbers that I have seen for MX80 are: I.e. trio. No. Trio uses flat RLDRAM, and any IPv6 route

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 10:48 +), Dobbins, Roland wrote: No it isn't, any more than SNMP is a task for those interfaces. Sending flowrecords to your slow ppc CPU just to allow export in non-HW interface is silly, when HW can export it directly, without ever hitting your control-plane. Polling SNMP

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 08:57 -0500), Jared Mauch wrote: I am very much against USB consoles. there can be a whole plethora of issues involved from OS-level to the device-level. When I'm on the console, things have already gone bad. I don't need to find out if the vendor has the right

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 09:35 -0500), Christopher Morrow wrote: I don't think you can get ethernet and transport out-of-the-area in some places at a reasonable cost, so having serial-console I think is still a requirement. I don't understand this point. Where does your RS232 port go? It goes to

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 09:54 -0500), Jared Mauch wrote: I don't think you can get ethernet and transport out-of-the-area in some places at a reasonable cost, so having serial-console I think is still a requirement. Some of the POTS carriers are trying to jettison their equipment before the end

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 11:41 -0500), Randy Whitney wrote: Nothing beats POTS in a broad power outage scenario. Numerous power outages have taken down mobile service completely while the POTS lines stayed up as it carries its own power by design. Is your RS232 Modem POTS powered? If POP is

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 12:08 -0500), Jared Mauch wrote: Not sure about you, but I've used the ability for a POTS line to either ring or give me a modem tone to determine the power status at the site. So the modem is not PSTN powered, so if it responds, pop must be powered? Wouldn't any old CPE on any

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 11:52 -0600), Charles N Wyble wrote: I have every device hooked to this. Pdus, routers, switches, vm, storage servers. That allows me to get console and power cycle every device. What more would I want? Dialup means I need to be in a place I can hook up a modem. Not too

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
On (2013-01-09 15:37 +0100), Mikael Abrahamsson wrote: equipment already have an mgmt ethernet port, but usually this can't do everything, meaning today one has to have OOB ethernet *and* OOB serial which just brings more pain than before. The key difference is, that those are not OOB at all,

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
On (2013-01-09 11:18 -0500), William Herrin wrote: (a) This is a P2 not a P1. Asking the OOB to be critically dependent on an external network element is dubious to begin with but even if desired it's usable without. Agreed that P2 suffices. Usage scenario is installing fresh router. You

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
On (2013-01-09 09:12 -0800), Leo Bicknell wrote: So while I agree with the list of features in large part, I'm not sure I agree with the concept of having some sort of ethernet interface that allows all of this out of band. I think it will add cost, complexity, and a lot of new failure

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
On (2013-01-09 10:18 -0800), Leo Bicknell wrote: I also still think there's a lot of potential here to take gigantic steps backwards. Replacing a serial console with a Java applet in a browser (a la most IPMI devices) would be a huge step backwards. Today it's trival to script console

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
On (2013-01-09 23:17 +), Dobbins, Roland wrote: Flow telemetry export - many of these so-called 'management' ports can't be used to export flow, oddly enough. That is task for on-band interfaces, which attach to your forwarding-logic. OOB is separate component, really only relying on same

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
On (2013-01-09 22:05 -0500), Randy Carpenter wrote: 1. Something that is *not* network (ethernet or otherwise) (isn't that the point of OOB?) No. This is not what OOB means. Out-of-band means not fate-sharing your production network. OOB networks are networks, running ethernet, frame-relay,

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
I completely disagree. The ability for serial to go over POTS makes it ridiculously cheap compared to building a reliable ethernet connection over hundreds or thousands of miles. This is identical to ethernet. You need external device then, dial-up modem or CPE, no difference. The

Re: IP Address Management IPAM software for small ISP

2012-12-20 Thread Saku Ytti
On (2012-12-20 10:30 +0100), Thilo Bangert wrote: I'm not remotely interested in externally developed software for this problem. what do you mean. i'd be fine with an opensource project providing this. If exactly what I want exist, of course I'd love to have it. But evaluating options,

Re: IP Address Management IPAM software for small ISP

2012-12-20 Thread Saku Ytti
On (2012-12-20 11:02 +0100), Phil Regnauld wrote: I have same opinion for NMS also. Everything I see offered is terrible and do not even solve easy-to-solve problems correctly. Right, that's what's great about Open Source :D The comment fully applies to system like HP OV or NNM or

Re: Validation of FCS

2012-12-19 Thread Saku Ytti
On (2012-12-19 09:53 -0500), Jason Lixfeld wrote: Perhaps in simpler terms, a CRC error is a localized thing and would never be forwarded from one device to another. It would be forwarded in cut-through switching. -- ++ytti

Re: Validation of FCS

2012-12-19 Thread Saku Ytti
... until the bad frame reached the first store-and-forward switch (or most any router) which would log the FCS error, correct? Log and drop yes. cut-through would log it also, but it would be too late to drop it. -- ++ytti

Re: IP Address Management IPAM software for small ISP

2012-12-19 Thread Saku Ytti
On (2012-12-20 03:24 +), Blake Pfankuch wrote: I actually was doing research on this today as well. Anyone have any experience with the solutions that implement VLAN management as well like Gestioip? I'm not remotely interested in externally developed software for this problem. But

Re: Google/Youtube problems

2012-11-19 Thread Saku Ytti
On (2012-11-18 23:47 +0100), Daniel Suchy wrote: Is anyone else seeing similar problems with Google/Youtube? My advice is, host the content locally. Certain Finnish domestic SPs had issues with youtube during peak hours for years, when content came via Stockholm, if content came from mainland

Re: Google/Youtube problems

2012-11-19 Thread Saku Ytti
On (2012-11-19 08:27 -0500), Patrick W. Gilmore wrote: Second, I see no reason why that requires anything close - not even within a couple orders of magnitude - of 10% of the Internet's revenue to be profitable. Why would you assume such a thing? Agreed, 10% of Internet's revenue would be

Re: Google/Youtube problems

2012-11-19 Thread Saku Ytti
On (2012-11-19 06:30 -0800), Leo Bicknell wrote: Consider a different model. Google checks out your gmail account, and discovers you really like Red Bull and from your YouTube profile knows you watch a lot of Ke$ha videos. It also discovers there are a lot more Sure. I have no doubt the

Re: Whats so difficult about ISSU

2012-11-11 Thread Saku Ytti
On (2012-11-11 08:50 +0900), Randy Bush wrote: linux has become a fad in the vendor community. it seems to lend legitimacy to their products in some way, witness this discussion. but linux has the gpl poison. so, any code that they wish to keep proprietary is in userland. I've sometimes

Re: Whats so difficult about ISSU

2012-11-10 Thread Saku Ytti
On (2012-11-09 20:24 -0500), Pete Lumbis wrote: So each IOSd process 'show proc cpu' are separate threads to linux? Yep. The show platform software... commands are used to look at things in To be honest I'm very sceptical about this. I fully accept that IOSd is multithreaded. But I'm having

Re: Whats so difficult about ISSU

2012-11-10 Thread Saku Ytti
On (2012-11-10 10:43 +0200), Saku Ytti wrote: So each IOSd process 'show proc cpu' are separate threads to linux? Yep. The show platform software... commands are used to look at things in To be honest I'm very sceptical about this. I fully accept that IOSd is multithreaded. But I'm

Re: Whats so difficult about ISSU

2012-11-10 Thread Saku Ytti
On (2012-11-11 00:14 +0900), Randy Bush wrote: as to whether ios/xe is rtc, you may want to see my preso at the last nanog. NANOG56? I only found RPKI Propagation by you. Direct URL would be appreciated. But I really have 0 doubt that IOSd is run-to-completion, exactly like RPD is. But IOSd

Re: Whats so difficult about ISSU

2012-11-09 Thread Saku Ytti
On (2012-11-09 08:02 -0500), Pete Lumbis wrote: I can't speak for JunOS, but none of the new IOS operating systems are run to completion. This includes IOS-XE, XR and NX-OS. Really? I thought IOS XE is Linux control-plane on top of where you have monolithic IOSd process? I had chat with

Re: Whats so difficult about ISSU

2012-11-09 Thread Saku Ytti
On (2012-11-09 13:33 -0500), Pete Lumbis wrote: I apologize, I realized I forgot a critical word in my reply. The new Cisco OSes are /NOT/ run to completion. I did not notice that :). I assumed not was there, and was arguing that I thought IOS XE still is. I know XR and NX-OS aren't. For

Re: Whats so difficult about ISSU

2012-11-09 Thread Saku Ytti
On (2012-11-09 16:58 -0500), Pete Lumbis wrote: I do not believe that the linux scheduler is run to completion, but to be honest I'm not 100% certain. I know a big reason for IOS-XE was to It certainly is not, I'm not proposing it is. I'm saying it is bit of a stretch to believe that IOSd

Re: Whats so difficult about ISSU

2012-11-08 Thread Saku Ytti
On (2012-11-09 01:22 +0200), Kasper Adel wrote: We've been hearing about ISSU for so many years and i didnt hear that any vendor was able to achieve it yet. What is the technical reason behind that? I'd say generally code quality in routers is really really bad, I'm not sure why this is. I

Re: Dropping IPv6 Fragments

2012-10-04 Thread Saku Ytti
On (2012-10-04 10:16 -0400), Tom Taylor wrote: Who drops IPv6 fragments in their network, under what circumstances? No one who offers working IP connections. Dropping IPv6 fragments against your control-plane, that is another discussion, but dropping them in transit would be short-lived

Re: Internet routing table completeness monitoring?

2012-10-03 Thread Saku Ytti
On (2012-10-03 00:43 -0400), ML wrote: Has anyone put in place a method to identify if one their BGP peers suddenly withdraws X% of their prefixes? I've had monitoring for this for many years, over SNMP. Right now my limits are a) prefix count went or came from 0 or b) relative difference is

Re: Provider standard ARP Timeout?

2012-08-10 Thread Saku Ytti
On (2012-08-10 10:23 -0400), Jay Nakamura wrote: Cisco default ARP timeout is 4 hours. Do anyone change that to something shorter in a provider environment for customer with Ethernet connectivity? What is a good value to set it to? Maximum value should be your L2 MAC timeout. Most other

Re: using reserved IPv6 space

2012-07-19 Thread Saku Ytti
On (2012-07-19 10:25 +1000), Mark Andrews wrote: The point of the algorithm was to have something which would do a reasonable job in a CPE router without a hardware source of randomness. In that context it very much makes sense. It is a SAMPLE routinue. It is not YOU MUST DO IT THIS WAY

Re: using reserved IPv6 space

2012-07-19 Thread Saku Ytti
On (2012-07-19 15:16 +1000), Karl Auer wrote: True. But you cannot tell, from a sample of one number, whether that number was chosen randomly. You can only test it statistically within a series. A particular number may be random in one sequence, non-random in another. RFC2777 deals with this

Re: using reserved IPv6 space

2012-07-19 Thread Saku Ytti
On (2012-07-19 14:29 -0400), valdis.kletni...@vt.edu wrote: OK? So even if you merge and re-merge, and go on a massive buying spree and accumulate a network where you have to interoperate 1,000 ULAs, you're *still* looking at a literally million-to-one shot. And if you only have a mess of

Re: using reserved IPv6 space

2012-07-18 Thread Saku Ytti
On (2012-07-18 00:34 +0200), Jeroen Massar wrote: Here's a calculator that will generate a random one for you: does not follow RFC4193 in any way at all. A such do not use it. Another silly oneliner, not RFC4193. ruby -e'p (fd+rand(2**40).to_s(16)).scan(/.{1,4}/).join(:)+::/48' I'm not

Re: using reserved IPv6 space

2012-07-18 Thread Saku Ytti
On (2012-07-18 09:10 -0400), valdis.kletni...@vt.edu wrote: You want to roll in at some entropy by adding in the current date or something, so two Joes' Burritos and Internet in 2 different states don't generate the same value. There's a reason that 4193 recommends a 64bit timestamp and an

Re: using reserved IPv6 space

2012-07-18 Thread Saku Ytti
On (2012-07-18 08:37 -0500), Stephen Sprunk wrote: it should bepossible to incorporate RFC2777 verifiability to it. There is no need for that, since your failure to use a good source of randomness hurts nobody except yourself. I think you're making fact out of opinion. Maybe SP is

Re: using reserved IPv6 space

2012-07-18 Thread Saku Ytti
On (2012-07-18 08:47 -0500), Stephen Sprunk wrote: And, if they did, who cares? It's not like it hurts me for them to do so--unless I'm dumb enough to do the same thing, happened to get the same result /and/ happened to merge with them--all of which are still unlikely events. In which case,

Re: using reserved IPv6 space

2012-07-18 Thread Saku Ytti
On (2012-07-18 11:39 -0500), Stephen Sprunk wrote: On 18-Jul-12 08:48, Saku Ytti wrote: Why would they do that? SPs should only be assigning (and routing) GUAs. Because SP might be tasked to provide network plan for customers L3 MPLS VPN and customer might get INET from different SP and might

Re: using reserved IPv6 space

2012-07-17 Thread Saku Ytti
I wonder who really believes there is no usage case for NAT66. Have these people seen non-trivial corporate networks? I'm sure many people in this list finance part of their lives with renumber projects costing MUSDs. For many companies just finding out where addresses have been punched in (your

Re: F-ckin Leap Seconds, how do they work?

2012-07-04 Thread Saku Ytti
On (2012-07-03 16:53 -0700), Owen DeLong wrote: Sure, but even with that, 99% of it has only a passing 'interesting' effect and then recovers. Inclusive you no longer know order of events based on your logs, and virtually none of your software are logging 60th second. What are only

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread Saku Ytti
On (2012-07-03 01:54 -0700), Wolfgang S. Rupprecht wrote: kernel time, why do we do it with leapseconds? We should really move the leapseconds correction into the display routines like DST and Yes. TAI time natively and presentation uses leap lookup tables to convert to UTC. Unixtime is not

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread Saku Ytti
On (2012-07-03 10:33 -0400), valdis.kletni...@vt.edu wrote: On the other hand, how many subtle bugs will we introduce when we break code that currently assumes the system clock is UTC, not TAI? Progress has non zero cost :) -- ++ytti

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread Saku Ytti
On (2012-07-03 10:11 -0700), Owen DeLong wrote: Trading one known set of bugs for a (probably) larger set of unknown bugs is not my definition of progress. Cost without progress is harmful and should be avoided. Leap bugs are NOT known. Most people have no idea unixtime is not monotonically

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread Saku Ytti
On (2012-07-03 19:33 +0100), Nick Hilliard wrote: Google's approach to this is interesting: http://googleblog.blogspot.ie/2011/09/time-technology-and-leaping-seconds.html Yes. I'm sure this is good enough for most people, most people don't need precise time but virtually everyone needs

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread Saku Ytti
On (2012-07-03 12:46 -0700), Owen DeLong wrote: If you don't know that time is not monotonically increasing, then that only becomes a software bug when you codify your own ignorance into software you write. If only all software could be ordered from you Owen, but in practice this is not

Re: strat-1 gps

2012-06-26 Thread Saku Ytti
On (2012-06-26 15:05 -0500), Ryan Malayter wrote: If you have to have something pre-integrated and soon, I'd look at Meinberg: http://www.meinberg.de/english/products/index.htm#network_sync We have several Meinbergs, quality hardware definitely. But I really wish they'd have hardware

Re: solid v smart optics

2012-06-20 Thread Saku Ytti
On (2012-06-19 17:07 -0700), ryanL wrote: anyone have any opinions on the two subject vendors, with general regard to 10GE transceivers? SR multi-mode data center stuff for my application. I'm not familiar with solid optics, but AFAIK smart optics today resells finisar, so you probably don't

Re: Trouble viewing slides for Automated Configuration and Validation of a Large Scale Network

2012-06-06 Thread Saku Ytti
On (2012-06-06 06:57 -0700), vijay gill wrote: A non-cut off version is here: http://sdrv.ms/MeQl1L For me provisioning automatically has always been quite trivial problem, system just has object representation of service with references to other objects and then those objects are used to fill

Re: bgp best practice question

2012-06-04 Thread Saku Ytti
On (2012-06-04 11:36 -0700), jon Heise wrote: I need to make one of our data centers internet accessible, i plan to advertise a /24 out of our existing /22 network block at our new site. My question is for our main datacenter, is it a better idea to continue to advertise the full /22 or

Re: HE.net BGP origin attribute rewriting

2012-06-01 Thread Saku Ytti
On (2012-06-01 10:19 +0200), Daniel Suchy wrote: I think RFC 4271 (http://tools.ietf.org/html/rfc4271) is very clear here. Back to the standard, why condone it's violation? Yes, statement It's extremely hard to find RFC which does not contain incorrect information or practically undeployable

Re: HE.net BGP origin attribute rewriting

2012-05-31 Thread Saku Ytti
On (2012-05-31 08:46 -0700), David Barak wrote: On what precisely do you base the idea that a mandatory transitive attribute of a BGP prefix is a purely advisory flag which has no real meaning?  I encourage you to reconsider that opinion - it's actually a useful attribute, much the way

<    3   4   5   6   7   8   9   >