Re: Low Cost 10G Router

2015-05-20 Thread Nick Hilliard
On 20/05/2015 15:25, Aled Morris wrote: Couldn't your back-end scripts running under ExaBGP also manage the FIB, using standard Unix tools/APIs? Managing the FIB is basically just route add and route delete right? Yes, you could probably do this. No, you probably wouldn't want to do this.

Re: Thousands of hosts on a gigabit LAN, maybe not

2015-05-10 Thread Nick Hilliard
On 10/05/2015 00:33, Karl Auer wrote: Would be interesting to see how IPv6 performed, since is one of the things it was supposed to be able to deliver - massively scalable links (equivalent to an IPv4 broadcast domain) via massively reduced protocol chatter (IPv6 multicast groups vs IPv4

Re: dns on fios/frontier

2015-04-20 Thread Nick Hilliard
On 20/04/2015 19:42, Randy Bush wrote: [ excuse abnormal cluelessness even for me. overwhelmed by mucous and it is the middle of the night here ] anyone on fios/frontier can please run a quickie and see if you can get to http://psg.com/? have a net friend who can not from multiple hosts

Re: Cisco Routers Vulnerability

2015-04-13 Thread Nick Hilliard
On 13/04/2015 23:29, Rashed Alwarrag wrote: Today we have a lot of customers report that their Cisco routers got a root access and the IOS got erased , is there any known vulnerability in cisco products thats they report in their Security alerts about this recently ? is there any one face

Re: Cisco Routers Vulnerability

2015-04-13 Thread Nick Hilliard
On 13/04/2015 23:48, Rashed Alwarrag wrote: It's reported by different customers in different locations so I don't think it's password compromised Have you checked? If the routers had vty access open (ssh or telnet) and the passwords were easy to guess, then it's more likely that this was a

Re: 100Gb/s TOR switch

2015-04-09 Thread Nick Hilliard
On 09/04/2015 21:54, Christopher Morrow wrote: the math on their page is 'interesting'... it's a t2 chipset. should be all forwarded at asic level, i.e. at line rate per port. Nick

Re: 100Gb/s TOR switch

2015-04-09 Thread Nick Hilliard
On 09/04/2015 13:30, Colton Conor wrote: So are we expecting these new switches to be the same price or cheaper than the current 40G uplinks models? Do you think the vendors will heavily discount the switches with 10G user port and 40G uplinks? like this?

Re: Consumer products with baked-in VLAN tagging

2015-04-05 Thread Nick Hilliard
On 05/04/2015 03:32, Robert Seastrom wrote: As you may know if you've played around with recent Apple Airports (Express at least) in bridge mode with guest network turned on, they seem to know about 802.1q and have fairly reasonable or at least defensible behavior out of the box - that is to

Re: Phone adapter with router

2015-03-11 Thread Nick Hilliard
On 11/03/2015 10:02, Baldur Norddahl wrote: It should be possible to do the emergency call without a SIM. That way you got 112 / 911 calls covered... emergency calls without sim are part of the gsm standard. So unless the OP's provider is doing something terribly wrong and probably illegal,

Re: ASN to IP Mapping

2015-03-07 Thread Nick Hilliard
On 07/03/2015 15:37, Andrew Iwamoto wrote: Is there a tool or method to determine IP blocks assigned to an organization by ASN? I.e. if I have an organization's ASN number I want to know all blocks assigned to that ASN. ip address blocks are not assigned to ASNs. IP address blocks and ASNs

Re: symmetric vs. asymmetric [was: Verizon Policy Statement on Net Neutrality]

2015-03-04 Thread Nick Hilliard
On 04/03/2015 16:26, Dave Taht wrote: A geeky household with dad doing skype, mom uploading to facebook, a kid doing a game, and another kid doing netflix, however, is common. And, it is truly amazing how many households have more than one device per person nowadays. and $kid running a

Re: optical gear cooling requirements

2015-03-04 Thread Nick Hilliard
On 04/03/2015 21:33, Jay Hennigan wrote: We used Livingston Portmaster 3 back in the day. Front to back ventilation, ran cool as a cucumber, plug it in and it just worked. Awesome gear until Lucent bought the company to kill the product in favor of their Ascend TNT space heaters. Ascend kit

Re: Verizon Policy Statement on Net Neutrality

2015-03-01 Thread Nick Hilliard
On 01/03/2015 03:41, Barry Shein wrote: On February 28, 2015 at 23:20 n...@foobar.org (Nick Hilliard) wrote: there were several reasons for asymmetric services, one of which was commercial. Another was that most users' bandwidth profiles were massively asymmetric to start with so

Re: Verizon Policy Statement on Net Neutrality

2015-02-28 Thread Nick Hilliard
On 28/02/2015 22:38, Barry Shein wrote: Asymmetric service was introduced to discourage home users from deploying commercial services. there were several reasons for asymmetric services, one of which was commercial. Another was that most users' bandwidth profiles were massively asymmetric to

Re: draft-ietf-mpls-ldp-ipv6-16

2015-02-22 Thread Nick Hilliard
On 21/02/2015 14:28, Rogers, Josh wrote: RFC7349 is a nice summary of everything we¹re still missing wrt MPLS and is relatively recent so should be close to up to date. In addition to the MPLS shortcomings, it also touches on recent IGP updates: rfc7439, not 7349:

Re: Checkpoint IPS

2015-02-05 Thread Nick Hilliard
On 05/02/2015 13:15, jim deleskie wrote: you know that forcing traffic to be symmetrical is evil it's not evil; it's stupid because enforcing symmetry creates a potentially unnatural stress in a network which will revert to asymmetry, given half a chance. Nick

Re: scaling linux-based router hardware recommendations

2015-01-28 Thread Nick Hilliard
On 28/01/2015 14:45, Colin Johnston wrote: qnx os based router works well with powerpc, could be pushed far higher load than intel based chips that may be so, but how many people out there know how to push qnx that hard compared freebsd/linux on amd64 compatible hardware, and how many people

Re: Recommended L2 switches for a new IXP

2015-01-19 Thread Nick Hilliard
On 19/01/2015 10:12, Marian Ďurkovič wrote: Thus if you use VPLS or SPB-M on Trident HW, the egress PE doesn't support per-flow loadbalancing on IXP participants' LAGs. not completely true. Extreme XOS has an interesting hack to work around this. Nick

Re: Recommended L2 switches for a new IXP

2015-01-13 Thread Nick Hilliard
On 13/01/2015 22:10, Jeff Tantsura wrote: What does it mean - to be SDN ready? it means fully buzzword compliant. Nick

Re: Recommended L2 switches for a new IXP

2015-01-12 Thread Nick Hilliard
On 12/01/2015 06:35, Manuel Marín wrote: We are trying to build a new IXP in some US Metro areas where we have multiple POPs and I was wondering what do you recommend for L2 switches. I know that some IXPs use Nexus, Brocade, Force10 but I don't personally have experience with these switches.

Re: RADB

2015-01-08 Thread Nick Hilliard
On 08/01/2015 01:39, John East wrote: Is there anyone from RADB or MerIt on this list that could contact me off the list? radb-supp...@merit.edu is responsive when it comes to RADB IRRDB issues. Nick

Re: whois server features

2015-01-07 Thread Nick Hilliard
On 07/01/2015 20:07, Bill Woodcock wrote: Correct. It gets you a blob of text. Sometimes, a blob is just a blob. Other times, it contains what _appear_ to be key-value pairs, but are instead loosely-formatted text. Other times, it contains textually-represented key-value pairs that are

Re: MPLS VPN design - RR in forwarding path?

2015-01-02 Thread Nick Hilliard
On 02/01/2015 18:24, Mark Tinka wrote: Wish I could - to be honest, these don't give me enough comfort for a production network. It's not even possible for a vpn enabled network right now. Having said that, I use bird in anger for ixp route server functionality (i.e. ebgp route reflector) and

Re: MPLS VPN design - RR in forwarding path?

2015-01-02 Thread Nick Hilliard
...@ericsson.com javascript:; To: Nick Hilliard n...@foobar.org javascript:; Cc: nanog@nanog.org javascript:; Sent: Thursday, January 1, 2015 7:54:32 PM Subject: Re: MPLS VPN design - RR in forwarding path? You don't need LDP on RR as long as clients support not on lsp flag (different

Re: MPLS VPN design - RR in forwarding path?

2015-01-01 Thread Nick Hilliard
On 01/01/2015 21:37, Baldur Norddahl wrote: Are anyone using Bird, Quagga etc. for this? there are patches for both code-bases and some preliminary support for vpnv4 in quagga, but other than that neither currently supports either ldp or the vpnv4/vpnv6 address families in the main-line code.

Re: MPLS VPN design - RR in forwarding path?

2014-12-31 Thread Nick Hilliard
On 31/12/2014 12:08, Marcin Kurek wrote: I'm reading Randy's Zhang BGP Design and Implementation and I found following guidelines about designing RR-based MPLS VPN architecture: - Partition RRs - Move RRs out of the forwarding path - Use a high-end processor with maximum memory - Use peer

Re: Is there list of IXPs (containing the information of the AS# of the IXP)

2014-12-22 Thread Nick Hilliard
On 22/12/2014 13:50, Jeroen Massar wrote: IXs themselves do not have ASNs, as they are Layer 2 providers. most modern IXPs will have an ASN for their route server, and possibly a separate asn for their mgmt infrastructure. Not sure how useful the mgmt ASN is, although most IXPs will

Re: 10Gb iPerf kit?

2014-12-07 Thread Nick Hilliard
On 06/12/2014 20:24, Pete Mundy wrote: I've done loads of 1Gbit testing using the entry-level MacBook Air and a Thunderbolt Gigabit Ethernet adapter though, and I disagree with Saku's statement of 'You cannot use UDPSocket like iperf does, it just does not work, you are lucky if you reliably

Re: ARIN's RPKI Relying agreement

2014-12-05 Thread Nick Hilliard
On 05/12/2014 11:38, Randy Bush wrote: and the difference is? rpki might work at scale. Nick

Re: ARIN's RPKI Relying agreement

2014-12-05 Thread Nick Hilliard
On 05/12/2014 11:47, Randy Bush wrote: and the difference is? rpki might work at scale. ohhh noo! rtconfig + prefix lists were never going to work at scale, so rpsl based filters were mostly only ever deployed on asn edges rather than dfz core inter-as bgp sessions. This meant that

Re: Buying IP Bandwidth Across a Peering Exchange

2014-11-25 Thread Nick Hilliard
On 25/11/2014 18:47, Colton Conor wrote: Is this possible? it depends. Some transit providers will decline to do this because it can impact on their margin. Most IXPs don't have a problem with it, but some do - although it's not clear how they can tell which packets are transit and which are

Re: A case against vendor-locking optical modules

2014-11-17 Thread Nick Hilliard
On 17/11/2014 18:11, Jérôme Nicolle wrote: What are other arguments against vendor lock-in ? Is there any argument FOR such locks (please spare me the support issues, if you can't read specs and SNMP, you shouldn't even try networking) ? there have been documented cases in the past where

Re: BGP Security Research Question

2014-11-04 Thread Nick Hilliard
On 04/11/2014 12:38, sth...@nethelp.no wrote: These mechanisms do little or nothing to protect against unauthorized origination of routing information. There are plenty of examples which say it has *not* been enough, see for instance the Pakistan Telecom - Youtube incident in 2008.

Re: Why is .gov only for US government agencies?

2014-10-20 Thread Nick Hilliard
On 19/10/2014 13:05, Matthew Petach wrote: Would love to get any info about the history of the decision to make it US-only. incidentally, why does the .gov SOA list usadotgov.net in its SOA? The web site for the domain looks like it's copied from drjanicepostal.com. Has USGOV decided to open

Re: ISP Shaping Hardware

2014-10-20 Thread Nick Hilliard
On 20/10/2014 11:12, Roland Dobbins wrote: Is QoS in the network infrastructure coupled with strictly-enforced quotas insufficient to needs? for satellite, no. These permanently-inline boxes and blades that dork around with general Internet traffic to/from eyeball networks can be a

Re: RADB

2014-10-08 Thread Nick Hilliard
On 08/10/2014 21:44, Brandon Wade wrote: My next question is, why would RADB offer zero support for confirming this? And lastly, why should my organization pay $500 per year to a service that is unwilling to assist in making sure their subscriber is using their service properly? radb.net

Re: large BCP38 compliance testing

2014-10-02 Thread Nick Hilliard
On 02/10/2014 11:10, Mikael Abrahamsson wrote: Why isn't this being done? Why are we complaining about 300 gigabit/s DDOS attacks, asking people to fix their open resolvers, NTP servers etc, when the actual culprit is that some networks in the world don't implement BCP38? ntp monlist / dnssec

Re: large BCP38 compliance testing

2014-10-02 Thread Nick Hilliard
On 02/10/2014 12:23, Jérôme Nicolle wrote: This. But let me ask you, how many transit provider actually implement strict prefix-filtering ? I've seen many using a max-prefix as their sole defense. Plenty do and have no back-end capability to handle this, other than email updates. Now,

Re: Scotland ccTLD?

2014-09-16 Thread Nick Hilliard
On 16/09/2014 16:43, Jay Ashworth wrote: Except that, alas, .sc is already assigned, to Seychelles. Or this wouldn't be a thing. :-) no-one's recently found oil under the Seychelles, so there doesn't seem to be an immediate need to install some new democracy over there and liberate the

Re: 2000::/6

2014-09-14 Thread Nick Hilliard
On 14/09/2014 22:19, Jimmy Hess wrote: Any decent router won't allow you to enter just anything in that range into the export rules with a /6, except 2000:: itself tarko is right in suggesting that config typos can cause this sort of thing, e.g. -- router bgp 6 address-family ipv6

Re: 2000::/6

2014-09-12 Thread Nick Hilliard
On 12/09/2014 08:53, Tarko Tikan wrote: I'm pretty sure it was a typo in the config, the prefix length had to be /64 but was entered as /6 instead. 2000::/64 doesn't make much sense either. Nick

Re: Facebook down?

2014-09-03 Thread Nick Hilliard
it totally was not down from interstellar orbit. You didn't have time to tell because rtt from interstellar space is 11 hours minimum, which is even worse than some cellular data operators. Pants on fire. Can anyone confirm if it was down in the MD/DC, Northern Oregon, Eastern PA and Palo Alto

Re: Prefix hijacking, how to prevent and fix currently

2014-08-31 Thread Nick Hilliard
On 29/08/2014 23:39, Rob Seastrom wrote: I'd assume that it would be included in your annual LRSA maintenance fees. it will be interesting to see if we get proposals in the future to move legacy space between RIRs. Nick

Re: Best practice for BGP session/ full routes for customer

2014-07-17 Thread Nick Hilliard
On 14/07/2014 18:32, Jeff Tantsura wrote: BGP to RIB filtering (in any vendor implementation) is targeting RR which is not in the forwarding path, so there¹s no forwarding towards any destination filtered out from RIB. Using it selectively on a forwarding node is error prone and in case of

Re: Verizon Public Policy on Netflix

2014-07-13 Thread Nick Hilliard
On 13/07/2014 01:22, na...@brettglass.com wrote: Open Connect is not, in fact, a CDN. Nor is it peering. It is merely a set of policies for direct connection to ISPs, and for placing servers in ISPs' facilities, that is as favorable as possible in every way to Netflix. It costs Netflix as

Re: Finisar SFP/SFP+

2014-06-24 Thread Nick Hilliard
On 24/06/2014 17:39, Faisal Imtiaz wrote: Anyone out there, know what is the 'code' sequence for programming Finisar SFP / SFP+ ? this is a very broken question. I'm going to assume you have a bunch of finisar transceivers and you want to reprogram them to look like e.g. cisco or juniper or

Re: Finisar SFP/SFP+

2014-06-24 Thread Nick Hilliard
On 24/06/2014 21:23, Faisal Imtiaz wrote: I was wanting to know if there is anyone who has such code for the Finisar SFP/SFP+. there's a clear solution here: if a vendor locks the transceiver from reprogramming, don't buy transceivers from them. Nick

Re: Client on OS X, Browsers ALL fail DNS Lookup off net Hosts, SMTP+shell OK

2014-06-18 Thread Nick Hilliard
The Internet is down. Didn't you hear? Nick On 18/06/2014 16:40, Niels Bakker wrote: I'm sorry, this is NANOG, not your local helpdesk. HTH, HAND, -- Niels. * efba...@gmail.com (Everett F Batey II Gi) [Wed 18 Jun 2014, 17:34 CEST]: Newly evolved problems (network has been

Re: FW: Getting pretty close to default IPv4 route maximum for 6500/7600routers.

2014-06-13 Thread Nick Hilliard
On 13/06/2014 15:54, Jon Lewis wrote: I was just looking at / thinking about this again, and though I don't disagree that doing the split your way is probably better, I think it's a moot point. I strongly suspect these boxes will run out of RAM before they're able to utilize another 256k

Re: rz.verisign-grs.com root zone ftp access

2014-05-20 Thread Nick Hilliard
On 20/05/2014 22:21, Brandon Applegate wrote: Is anyone using this and having failed login for a few days now ? I’ve been mirroring the root zone(s) for years and I just started getting failures in my logs. ftp://rs.internic.net/domain/root.zone Nick

Re: Observations of an Internet Middleman (Level3) (was: RIP Network Neutrality

2014-05-12 Thread Nick Hilliard
On 10/05/2014 22:34, Randy Bush wrote: imiho think vi hart has it down simply and understandable by a lay person. http://vihart.com/net-neutrality-in-the-us-now-what/. my friends in last mile providers disagree. i take that as a good sign. Vi's analogy is wrong on a subtle but important

Re: Observations of an Internet Middleman (Level3)

2014-05-12 Thread Nick Hilliard
On 12/05/2014 15:27, Clayton Zekelman wrote: I think that's where the biggest gulf exists. It doesn't seem fair. It seems like extortion. The last mile access guys are the gatekeepers to the end user, with little competition. that is the core problem: lack of competition. Net neutrality is

Re: US patent 5473599

2014-05-08 Thread Nick Hilliard
On 08/05/2014 11:25, Henning Brauer wrote: you shouldn't see issues but log spam. maybe you misunderstand the problem. If you have vrrp and carp on the same vlan, using the same vrrp group ID as VHID, then each virtual IP will arp for the same mac address on that vlan. This messes up the

Re: US patent 5473599

2014-05-08 Thread Nick Hilliard
On 08/05/2014 12:09, Henning Brauer wrote: my switches seem to deal with that, wether they have special handling for that mac addr range or not i dunno. I've seen this problem cause downtime on production networks. fyi, it will probably work fine on hubs, but not on switches. again, stress

Re: Getting pretty close to default IPv4 route maximum for 6500/7600 routers.

2014-05-06 Thread Nick Hilliard
On 06/05/2014 16:39, Drew Weaver wrote: In case anyone wants to check on a 6500, you can run: show platform hardware capacity pfc and then look under L3 Forwarding Resources. to fix the problem on sup720/rsp720: Router(config)#mls cef maximum-routes ip 768 This requires a reload to take

Re: Getting pretty close to default IPv4 route maximum for 6500/7600 routers.

2014-05-06 Thread Nick Hilliard
On 06/05/2014 18:01, Drew Weaver wrote: I believe you mean This problem also affects ASR9000 boxes running ...trident... line cards. Please confirm? er, yes, trident cards, not typhoon cards. typhoon cards are not affected by this. Nick

Re: US patent 5473599

2014-04-26 Thread Nick Hilliard
On 23/04/2014 17:47, Henning Brauer wrote: fortunately this obviously isn't a big problem in practice, based on the fact that we don't get any complaints/reports in that direction. still would be way micer if that situation had been created in the first place, but as said - we weren't given

US patent 5473599

2014-04-22 Thread Nick Hilliard
... turns 20 today. This is the patent which covers hsrp, vrrp, many applications of carp and some other vendor-specific standby protocols. Assuming no term adjustments, 20 years is the normal term for US patents so unless there's been any adjustments / continuations, probably this patent is now

Re: US patent 5473599

2014-04-22 Thread Nick Hilliard
On 22/04/2014 12:31, Henning Brauer wrote: it does NOT cover carp, not at all. that is a political statement rather than a legal opinion. If you read the patent, it's pretty obvious that when you have a group of carp-enabled devices providing a stable gateway IP address, and these devices are

Re: Requirements for IPv6 Firewalls

2014-04-18 Thread Nick Hilliard
On 18/04/2014 01:51, Matthew Kaufman wrote: While you're at it, the document can explain to admins who have been burned, often more than once, by the pain of re-numbering internal services at static addresses how IPv6 without NAT will magically solve this problem. it's magic. There's no need

Re: CVE-2014-0160 mitigation using iptables

2014-04-10 Thread Nick Hilliard
On 09/04/2014 11:07, Fabien Bourdaire wrote: Following up on the CVE-2014-0160 vulnerability, heartbleed. We've created some iptables rules to block all heartbeat queries using the very powerful u32 module. as someone pointed out on the UKNOF mailing list yesterday, you make a number of

Re: BGPMON Alert Questions

2014-04-04 Thread Nick Hilliard
On 04/04/2014 16:17, Sharon Goldberg wrote: we assumed that no one filters their downstreams downstreams. plenty of organisations do this. it can easily be done with irrdb AS sets. Nick

Re: BGPMON Alert Questions

2014-04-03 Thread Nick Hilliard
On 03/04/2014 13:09, ML wrote: Did you get any details on what specifically went wrong? I don't recall any switch in my routing gear to re-originate every prefix on the planet as my own. Easy enough to do by e.g. redistributing your ebgp into your IGP and then back again, or by a variety of

Re: BGPMON Alert Questions

2014-04-03 Thread Nick Hilliard
On 03/04/2014 13:41, Mark Tinka wrote: max-prefix could have come in handy here. But this is an old song (let alone prefix filtering or RPKI). I'm currently seeing ~100 prefixes originating from 4761, and an additional 725 transited through 4761. This would not be difficult to handle with

Re: ARIN board accountability to network operators

2014-03-28 Thread Nick Hilliard
On 28/03/2014 14:03, Sander Steffann wrote: Yeah, RIPE NCC is definitely much cheaper for PI: no initial registration fee of ≥$500. The maintenance cost is $100/year vs €100/year (±$137) so there is a little difference there. The $37 €50 per PI assignment from the ripe ncc, no?

Re: misunderstanding scale

2014-03-24 Thread Nick Hilliard
On 24/03/2014 06:47, Mark Tinka wrote: Because, at the very least, a laptop or server can run a stateless packet filter to keep out pokes at ports that may be running by default, but have no business being queried over the network. once upon a time, they didn't have host firewalls or

Re: misunderstanding scale

2014-03-23 Thread Nick Hilliard
On 23/03/2014 03:00, Doug Barton wrote: Hyperbole of the past doesn't negate the reality of the future. :) the past and present hyperbole continues to grate. With respect I think you're ignoring some pretty important facts. Not the least of which is the level of pressure that's been taken off

Re: misunderstanding scale (was: Ipv4 end, its fake.)

2014-03-23 Thread Nick Hilliard
On 23/03/2014 18:39, Mark Andrews wrote: As for printers directly reachable from anywhere, why not. because in practice it's an astonishingly stupid idea. Here's why: chargen / other small services ssh www buffer overflows open smtp relays weak, default or non existent passwords information

Re: misunderstanding scale

2014-03-23 Thread Nick Hilliard
On 23/03/2014 21:02, Mark Andrews wrote: Actually all you have stated in that printer vendors need to clean up their act and not that one shouldn't expect to be able to expose a printer to the world. It isn't hard to do this correctly. perish the thought - and I look forward to the day that

Re: misunderstanding scale

2014-03-22 Thread Nick Hilliard
On 22/03/2014 16:29, Doug Barton wrote: It is a mistake to believe that the only reason to add IPv6 to your network is size. Adding IPv6 to your network _now_ is the right decision because at some point in the not-too-distant future it will be the dominant network technology, and you don't

Re: misunderstanding scale

2014-03-22 Thread Nick Hilliard
On 22/03/2014 18:50, Tore Anderson wrote: * Nick Hilliard the level of pain associated with continued deployment of ipv4-only services is still nowhere near the point that ipv6 can be considered a viable alternative. This depends on who you're asking; as a blanket statement it's

Re: misunderstanding scale

2014-03-22 Thread Nick Hilliard
On 22/03/2014 19:35, Justin M. Streiner wrote: CGN also comes with lots of downside that customers are likely to find unpleasant. For some operators, customer (dis)satisfaction might be the driver that ultimately forces them to deploy IPv6. don't believe for a moment that v6 to v4 protocol

Re: new DNS forwarder vulnerability

2014-03-14 Thread Nick Hilliard
On 14/03/2014 13:45, Mark Allman wrote: - We have found 7--9% of the open resolver population---or 2-3 million boxes---to be vulnerable to this cache poisoning attack. (The variance is from different runs of our experiments.) did you characterise what dns servers / embedded kit were

Re: new DNS forwarder vulnerability

2014-03-14 Thread Nick Hilliard
On 14/03/2014 16:05, Merike Kaeo wrote: Has someone / is someone doing this? someone has, and many CPEs use dnsmasq. current uplink too slow to find references. Nick

Re: Need ARIN routing registry help

2014-03-07 Thread Nick Hilliard
On 07/03/2014 22:12, Meshier, Brent wrote: Level3 won't let us advertise our netblock because RADB shows it owned by Telkom South Africa, but it's clearly assigned to us by ARIN. I've raised a question with ARIN, could really use someone there that could expedite. On that note, when ARIN

Re: DNS Resolving issues. So for related just to Cox. But could be larger.

2014-03-06 Thread Nick Hilliard
On 06/03/2014 12:14, bmann...@vacation.karoshi.com wrote: On Wed, Mar 05, 2014 at 07:52:10AM -0500, Rob Seastrom wrote: to secondary nameservers. Speaking of that... ;; ADDITIONAL SECTION: ns1.nineplanetshosting.com. 172800 IN A 199.73.57.122 ns2.nineplanetshosting.com. 172800 IN

Re: Filter on IXP

2014-03-02 Thread Nick Hilliard
On 02/03/2014 12:45, Vitkovský Adam wrote: On the other hand, if a member provides transit, he will add its customer prefixes to RaDB / RIPEdb with appropriate route objects and the ACL will be updated accordingly. Shouldn't break there. And that's a really nice side effect. and it only

Re: Filter on IXP

2014-02-28 Thread Nick Hilliard
On 28/02/2014 15:42, Jérôme Nicolle wrote: Instead, IXPs _could_ enforce BCP38 too. Mapping the route-server's received routes to ingress _and_ egress ACLs on IXP ports would mitigate the role of BCP38 offenders within member ports. It's almost like uRPF in an intelligent and useable form.

Re: Filter NTP traffic by packet size?

2014-02-25 Thread Nick Hilliard
On 25/02/2014 17:22, Staudinger, Malcolm wrote: Why wouldn't you just block chargen entirely? While we're at it, why not just block everything except for tcp port 80 and dns? Isn't that the only legitimate traffic on the interweb these days? Nick

Re: Filter NTP traffic by packet size?

2014-02-22 Thread Nick Hilliard
On 22/02/2014 09:07, Cb B wrote: Summary IETF response: The problem i described is already solved by bcp38, nothing to see here, carry on with UDP udp is here to stay. Denying this is no more useful than trying to push the tide back with a teaspoon. It's worth bearing in mind that any open

Re: 7206 VXR NPE-G1 throughput

2014-02-10 Thread Nick Hilliard
On 10/02/2014 15:30, Remco Bressers wrote: This depends on multiple variables. The 7200 is a single-CPU platform where CPU can go sky-high when using features like ACL's, QoS, IPv6 and you name it.. Also, changing from IOS 12.4 to 15 increased our CPU usage with another 10%+. Stick to the bare

Re: 7206 VXR NPE-G1 throughput

2014-02-10 Thread Nick Hilliard
On 10/02/2014 19:44, Nikolay Shopik wrote: You mean IOS XR? Which was never released for software based routers, right? as it QNX in core. no, I meant modular IOS, not XR. This was an attempt to run a non bare-metal IOS. The kernel was based on qnx (http://goo.gl/9RSwHn), and cisco released

Re: Need trusted NTP Sources

2014-02-06 Thread Nick Hilliard
On 06/02/2014 10:03, Notify Me wrote: I'm trying to help a company I work for to pass an audit, and we've been told we need trusted NTP sources (RedHat doesn't cut it). So presuming that your company is using RH or Fedora or CentOS something, the auditors are claiming that Red Hat, Inc is

Re: Need trusted NTP Sources

2014-02-06 Thread Nick Hilliard
On 06/02/2014 11:46, Notify Me wrote: We're a redhat shop, and we use redhat auth which by default uses redhat NTP sources. Sounds odd to me too. They claim this is what PCI DSS demands. PCI DSS states: 10.4.3 Time settings are received from industry-accepted time sources. The default RHEL

Re: Need trusted NTP Sources

2014-02-06 Thread Nick Hilliard
On 06/02/2014 12:30, Martin Hotze wrote: here is a well done how-to: http://open.konspyre.org/blog/2012/10/18/raspberry-pi-time-server/ The OP had a question about standards compliance, not about something that made technical sense and would deliver a superior service. The two things aren't

Re: [iab-ch...@iab.org: Call for Review of draft-iab-filtering-considerations-06.txt, Technical Considerations for Internet Service Blocking and Filtering]

2014-02-05 Thread Nick Hilliard
On 05/02/2014 19:17, Jeffrey Haas wrote: It's IETF stuff. Operator sanity check would probably be appreciated. :-) Jeff, maybe run this past grow@ietf? Nick - Forwarded message from IAB Chair iab-ch...@iab.org - Date: Wed, 29 Jan 2014 11:16:56 -0500 From: IAB Chair

Re: While on the subject of IRR and route objects

2014-01-31 Thread Nick Hilliard
On 31/01/2014 13:58, Alain Hebert wrote: IRRToolset 5.0.1 (rtconfig really) finally gave out on a pretty messy RPSL parse. of direct relevance to this: https://lists.isc.org/pipermail/irrtoolset/2011-April/000736.html tl;dr: rpsl itself is a mess = no point in fixing irrtoolset There is

Re: Fw: ipv6 newbie question

2014-01-29 Thread Nick Hilliard
On 29/01/2014 17:35, Philip Lavine wrote: Is it best practice to have the internet facing BGP router's peering ip (or for that matter any key gateway or security appliance) use a statically configured address or use EUI-64 auto config? how are you going to set up the bgp session from the

Re: Route Server Filters at IXPs and 4-byte ASNs

2014-01-25 Thread Nick Hilliard
On 25/01/2014 15:48, Sebastian Spies wrote: To make things worse: even if the IXPs ASN is 2-byte, I would assume, that RS implementors chose to interpret extended community strings as always being in the format 4-byte:2-byte (see RFC5668). some ixp operators (e.g. me) are rather enthusiastic

Re: Route Server Filters at IXPs and 4-byte ASNs

2014-01-25 Thread Nick Hilliard
On 25/01/2014 22:50, Randy Bush wrote: do we have a chat with robert or push an alternative so that the wg is pushed to compromise? i get the impression that Robert realises that the current draft is unworkably complicated. Nick

Re: Experiences with IPv6 and Routing Efficiency

2014-01-19 Thread Nick Hilliard
On 19/01/2014 04:08, Mukom Akong T. wrote: Just because you can have 2^64 possible hosts on a LAN still doesn't mean we through principles of good LAN design out the door. :-) So I'd say it's rather the fault of shoddy network design rather than address policy. no, it's a problem with the

Re: Experiences with IPv6 and Routing Efficiency

2014-01-19 Thread Nick Hilliard
On 19/01/2014 04:00, Mukom Akong T. wrote: Have you found them to be more troublesome to process than IPv4 options are/were? The problem is that you can have long EH chains, with one after another. Generally speaking, most hardware forwarding engines will perform a lookup based on the first N

Re: Internet Routing Registries - RADb, etc

2014-01-16 Thread Nick Hilliard
On 16/01/2014 14:32, Blake Hudson wrote: Thanks for the responses, these objects are all older. However, none of them are stale or from previous owners, allocations, etc. Each of these objects were posted to their respective IRR's after the IP space was allocated to us. This leads me to

Re: Internet Routing Registries - RADb, etc

2014-01-16 Thread Nick Hilliard
On 16/01/2014 21:22, Jon Lewis wrote: Also, at least of the ones I've dealt with, there is no verification of records as they're entered. on the RIPE IRRDB, there is validation, so you can't just go in and register route: objects for someone else's allocations or assignments. Not sure about

Re: Internet Routing Registries - RADb, etc

2014-01-15 Thread Nick Hilliard
On 15/01/2014 21:22, Blake Hudson wrote: I have emailed Level3 about the incorrect entries in their IRR with no response. I have also emailed Cogent about their incorrect entry in RADb, also with no response. Should I be concerned about these entries? Do these entries give someone the

Re: EIGRP support !Cisco

2014-01-10 Thread Nick Hilliard
On 08/01/2014 18:14, Christopher Morrow wrote: you could employ one of the several methods to migrate from 'less desirable igp' to 'more desirable igp' on all of the things in question... there's people that have done this before even :)

Re: EIGRP support !Cisco

2014-01-08 Thread Nick Hilliard
On 08/01/2014 17:30, Nick Olsen wrote: Looking for EIGRP support in a platform other than Cisco. Since it was opened up last year. We have a situation where we need to integrate into a network running EIGRP and would like to avoid cisco if at all possible. Why not use isis or ospf? Both are

Re: EIGRP support !Cisco

2014-01-08 Thread Nick Hilliard
On 08/01/2014 17:52, Nick Olsen wrote: Completely agree. But this is needed to integrate into an existing network. OSPF would've been my first choice. you'll need to pay cisco tax then. Cisco opened up most of eigrp to the ietf as an informational rfc, but didn't release anything related to

Re: 10gbps peering subscriber switch recommendation

2014-01-07 Thread Nick Hilliard
On 06/01/2014 19:43, Mark Tinka wrote: FIB space requirements in a switch are also going to limit your options. it's the merchant silicon boxes which are driving high density 10g prices down, but most of these boxes tends to come with small fibs and tiny buffers which limits their deployment

Re: 10gbps peering subscriber switch recommendation

2014-01-06 Thread Nick Hilliard
On 06/01/2014 18:12, Adrian Minta wrote: Brocade ICX 7750 Switch seems to satisfy all the requirements. except qos (which needs switch port buffer space). There are no cheap 10G boxes on the market at the moment which have reasonable numbers of 10G ports and reasonable sized. Plenty which have

<    1   2   3   4   5   6   7   8   >