Re: Standard for BGP community lists

2010-07-20 Thread Saku Ytti
On (2010-07-19 23:45 -0500), Brad Fleming wrote: Hey, : for local rtbh : for local + remote rtbh I didn't have much reason for selecting other than it was easy to identify visually. And obviously, I have safe-guards to not leak those communities into other networks.

Re: Addressing plan exercise for our IPv6 course

2010-07-24 Thread Saku Ytti
On (2010-07-24 03:50 -0400), valdis.kletni...@vt.edu wrote: Firewall != NAT. The former is still needed in IPv6, the latter is not. And I suspect that most Joe Sixpacks think of that little box they bought as a Maybe you are talking strictly in context of residential DSL, in which case I

Re: Addressing plan exercise for our IPv6 course

2010-07-24 Thread Saku Ytti
On (2010-07-24 02:13 -0700), Owen DeLong wrote: This is non-technical problem, enterprises of non-trivial size can't typically even tell without months of research all the devices and software where they've written down the IP addresses. Sounds like they haven't written them down very

Re: Addressing plan exercise for our IPv6 course

2010-07-25 Thread Saku Ytti
On (2010-07-25 17:32 +1000), Karl Auer wrote: The risk of a ULA prefix conflict is for *all practical purposes* zero. http://www.wolframalpha.com/input/?i=1-((2^40)!)%2F((2^40)^100+((2^40)-100)!)+ It wouldn't puke nice graph with 'n', it did try, but never finished. So if there are

Re: Addressing plan exercise for our IPv6 course

2010-07-25 Thread Saku Ytti
On (2010-07-25 10:28 -0400), valdis.kletni...@vt.edu and Mark Smith wrote similarly: http://www.wolframalpha.com/input/?i=1-((2^40)!)%2F((2^40)^100+((2^40)-100)!)+ So if there are million assigned ULA's there is 36.5% chance of collision, if formula is right. Bzzt! Wrong,

Re: Did your BGP crash today?

2010-08-28 Thread Saku Ytti
On (2010-08-28 09:22 +0100), Thomas Mangin wrote: i suspect that these folk will test better next time. i sure hope so. Not sure the researcher can afford to buy a ios xr and may not have access to one ! Indeed. Also testing is hard, especially so, when you essentially need to reinvent

Re: Did your BGP crash today?

2010-08-28 Thread Saku Ytti
On (2010-08-28 18:20 +0900), Randy Bush wrote: a bgp regression suite would not have caught this as it was not a repeat. but it sure would be useful to implementors. Naturally 'proving' that non-trivial software works is practically impossible. But stating what non-existing test-suite would

Re: Did your BGP crash today?

2010-08-28 Thread Saku Ytti
On (2010-08-28 13:23 +0200), Thomas Mangin wrote: Those tools are not suitable for regression testing ( I know I wrote exabgp ) not saying they could not be adapted though. Fizzing may return crashes or issues with the daemon but it is unlikely. You need predictable input for regression

Re: Reverse DNS for IPv6 client networks

2010-09-14 Thread Saku Ytti
On (2010-09-14 14:27 +0200), Elmar K. Bins wrote: I as a networking droid have not much quarrel with that, but I am interested in how or whether at all others handle this. About year ago I spent half and hour hacking together base36 and rfc2289 stateless DNS for IPv6. I'm not making any

Re: Prefix 120.29.240.0/21

2010-11-17 Thread Saku Ytti
On (2010-11-17 14:40 +0100), Fredy Kuenzler wrote: We asked some customers what gear they are running, and here is a short compilation - all these systems were affected by the BGP flaps: - Cisco 2821 - c2800nm-advipservicesk9-mz.124-20.T4 - Cisco 2821 -

Re: Jumbo frame Question

2010-11-26 Thread Saku Ytti
On (2010-11-25 21:14 -0800), George Bonser wrote: Hey George, 9000 MTU internally. We don't deploy any servers anymore with MTU 1500. MTU 1500 is just plain stupid with any network 100mb ethernet. I'm big proponent of high MTU, to facilitate user MTU of 1500 while adding say GRE or IPSEC

Re: Jumbo frame Question

2010-11-26 Thread Saku Ytti
On (2010-11-26 12:39 -0500), valdis.kletni...@vt.edu wrote: That's only half the calculation. The *other* half is if you have gear that has a packets-per-second issue - if you go to 9000 MTU, you can move 6 times as much data in the same packets-per-second. Anybody who's ever had to trim a

Re: Whats so difficult about ISSU

2012-11-08 Thread Saku Ytti
On (2012-11-09 01:22 +0200), Kasper Adel wrote: We've been hearing about ISSU for so many years and i didnt hear that any vendor was able to achieve it yet. What is the technical reason behind that? I'd say generally code quality in routers is really really bad, I'm not sure why this is. I

Re: Whats so difficult about ISSU

2012-11-09 Thread Saku Ytti
On (2012-11-09 08:02 -0500), Pete Lumbis wrote: I can't speak for JunOS, but none of the new IOS operating systems are run to completion. This includes IOS-XE, XR and NX-OS. Really? I thought IOS XE is Linux control-plane on top of where you have monolithic IOSd process? I had chat with

Re: Whats so difficult about ISSU

2012-11-09 Thread Saku Ytti
On (2012-11-09 13:33 -0500), Pete Lumbis wrote: I apologize, I realized I forgot a critical word in my reply. The new Cisco OSes are /NOT/ run to completion. I did not notice that :). I assumed not was there, and was arguing that I thought IOS XE still is. I know XR and NX-OS aren't. For

Re: Whats so difficult about ISSU

2012-11-09 Thread Saku Ytti
On (2012-11-09 16:58 -0500), Pete Lumbis wrote: I do not believe that the linux scheduler is run to completion, but to be honest I'm not 100% certain. I know a big reason for IOS-XE was to It certainly is not, I'm not proposing it is. I'm saying it is bit of a stretch to believe that IOSd

Re: Whats so difficult about ISSU

2012-11-10 Thread Saku Ytti
On (2012-11-09 20:24 -0500), Pete Lumbis wrote: So each IOSd process 'show proc cpu' are separate threads to linux? Yep. The show platform software... commands are used to look at things in To be honest I'm very sceptical about this. I fully accept that IOSd is multithreaded. But I'm having

Re: Whats so difficult about ISSU

2012-11-10 Thread Saku Ytti
On (2012-11-10 10:43 +0200), Saku Ytti wrote: So each IOSd process 'show proc cpu' are separate threads to linux? Yep. The show platform software... commands are used to look at things in To be honest I'm very sceptical about this. I fully accept that IOSd is multithreaded. But I'm

Re: Whats so difficult about ISSU

2012-11-10 Thread Saku Ytti
On (2012-11-11 00:14 +0900), Randy Bush wrote: as to whether ios/xe is rtc, you may want to see my preso at the last nanog. NANOG56? I only found RPKI Propagation by you. Direct URL would be appreciated. But I really have 0 doubt that IOSd is run-to-completion, exactly like RPD is. But IOSd

Re: Whats so difficult about ISSU

2012-11-11 Thread Saku Ytti
On (2012-11-11 08:50 +0900), Randy Bush wrote: linux has become a fad in the vendor community. it seems to lend legitimacy to their products in some way, witness this discussion. but linux has the gpl poison. so, any code that they wish to keep proprietary is in userland. I've sometimes

Re: Google/Youtube problems

2012-11-19 Thread Saku Ytti
On (2012-11-18 23:47 +0100), Daniel Suchy wrote: Is anyone else seeing similar problems with Google/Youtube? My advice is, host the content locally. Certain Finnish domestic SPs had issues with youtube during peak hours for years, when content came via Stockholm, if content came from mainland

Re: Google/Youtube problems

2012-11-19 Thread Saku Ytti
On (2012-11-19 08:27 -0500), Patrick W. Gilmore wrote: Second, I see no reason why that requires anything close - not even within a couple orders of magnitude - of 10% of the Internet's revenue to be profitable. Why would you assume such a thing? Agreed, 10% of Internet's revenue would be

Re: Google/Youtube problems

2012-11-19 Thread Saku Ytti
On (2012-11-19 06:30 -0800), Leo Bicknell wrote: Consider a different model. Google checks out your gmail account, and discovers you really like Red Bull and from your YouTube profile knows you watch a lot of Ke$ha videos. It also discovers there are a lot more Sure. I have no doubt the

Re: Validation of FCS

2012-12-19 Thread Saku Ytti
On (2012-12-19 09:53 -0500), Jason Lixfeld wrote: Perhaps in simpler terms, a CRC error is a localized thing and would never be forwarded from one device to another. It would be forwarded in cut-through switching. -- ++ytti

Re: Validation of FCS

2012-12-19 Thread Saku Ytti
... until the bad frame reached the first store-and-forward switch (or most any router) which would log the FCS error, correct? Log and drop yes. cut-through would log it also, but it would be too late to drop it. -- ++ytti

Re: IP Address Management IPAM software for small ISP

2012-12-19 Thread Saku Ytti
On (2012-12-20 03:24 +), Blake Pfankuch wrote: I actually was doing research on this today as well. Anyone have any experience with the solutions that implement VLAN management as well like Gestioip? I'm not remotely interested in externally developed software for this problem. But

Re: IP Address Management IPAM software for small ISP

2012-12-20 Thread Saku Ytti
On (2012-12-20 10:30 +0100), Thilo Bangert wrote: I'm not remotely interested in externally developed software for this problem. what do you mean. i'd be fine with an opensource project providing this. If exactly what I want exist, of course I'd love to have it. But evaluating options,

Re: IP Address Management IPAM software for small ISP

2012-12-20 Thread Saku Ytti
On (2012-12-20 11:02 +0100), Phil Regnauld wrote: I have same opinion for NMS also. Everything I see offered is terrible and do not even solve easy-to-solve problems correctly. Right, that's what's great about Open Source :D The comment fully applies to system like HP OV or NNM or

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
On (2013-01-09 15:37 +0100), Mikael Abrahamsson wrote: equipment already have an mgmt ethernet port, but usually this can't do everything, meaning today one has to have OOB ethernet *and* OOB serial which just brings more pain than before. The key difference is, that those are not OOB at all,

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
On (2013-01-09 11:18 -0500), William Herrin wrote: (a) This is a P2 not a P1. Asking the OOB to be critically dependent on an external network element is dubious to begin with but even if desired it's usable without. Agreed that P2 suffices. Usage scenario is installing fresh router. You

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
On (2013-01-09 09:12 -0800), Leo Bicknell wrote: So while I agree with the list of features in large part, I'm not sure I agree with the concept of having some sort of ethernet interface that allows all of this out of band. I think it will add cost, complexity, and a lot of new failure

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
On (2013-01-09 10:18 -0800), Leo Bicknell wrote: I also still think there's a lot of potential here to take gigantic steps backwards. Replacing a serial console with a Java applet in a browser (a la most IPMI devices) would be a huge step backwards. Today it's trival to script console

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
On (2013-01-09 23:17 +), Dobbins, Roland wrote: Flow telemetry export - many of these so-called 'management' ports can't be used to export flow, oddly enough. That is task for on-band interfaces, which attach to your forwarding-logic. OOB is separate component, really only relying on same

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
On (2013-01-09 22:05 -0500), Randy Carpenter wrote: 1. Something that is *not* network (ethernet or otherwise) (isn't that the point of OOB?) No. This is not what OOB means. Out-of-band means not fate-sharing your production network. OOB networks are networks, running ethernet, frame-relay,

Re: OOB core router connectivity wish list

2013-01-09 Thread Saku Ytti
I completely disagree. The ability for serial to go over POTS makes it ridiculously cheap compared to building a reliable ethernet connection over hundreds or thousands of miles. This is identical to ethernet. You need external device then, dial-up modem or CPE, no difference. The

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 10:48 +), Dobbins, Roland wrote: No it isn't, any more than SNMP is a task for those interfaces. Sending flowrecords to your slow ppc CPU just to allow export in non-HW interface is silly, when HW can export it directly, without ever hitting your control-plane. Polling SNMP

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 08:57 -0500), Jared Mauch wrote: I am very much against USB consoles. there can be a whole plethora of issues involved from OS-level to the device-level. When I'm on the console, things have already gone bad. I don't need to find out if the vendor has the right

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 09:35 -0500), Christopher Morrow wrote: I don't think you can get ethernet and transport out-of-the-area in some places at a reasonable cost, so having serial-console I think is still a requirement. I don't understand this point. Where does your RS232 port go? It goes to

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 09:54 -0500), Jared Mauch wrote: I don't think you can get ethernet and transport out-of-the-area in some places at a reasonable cost, so having serial-console I think is still a requirement. Some of the POTS carriers are trying to jettison their equipment before the end

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 11:41 -0500), Randy Whitney wrote: Nothing beats POTS in a broad power outage scenario. Numerous power outages have taken down mobile service completely while the POTS lines stayed up as it carries its own power by design. Is your RS232 Modem POTS powered? If POP is

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 12:08 -0500), Jared Mauch wrote: Not sure about you, but I've used the ability for a POTS line to either ring or give me a modem tone to determine the power status at the site. So the modem is not PSTN powered, so if it responds, pop must be powered? Wouldn't any old CPE on any

Re: OOB core router connectivity wish list

2013-01-10 Thread Saku Ytti
On (2013-01-10 11:52 -0600), Charles N Wyble wrote: I have every device hooked to this. Pdus, routers, switches, vm, storage servers. That allows me to get console and power cycle every device. What more would I want? Dialup means I need to be in a place I can hook up a modem. Not too

Re: Juniper MX10 and dual stack BGP

2013-01-30 Thread Saku Ytti
On (2013-01-30 21:06 -0500), David Miller wrote: According to Juniper, the MX uses separate memory for v4 and v6. Where do they state this? MX is ambiguous, what matters is linecard HW. The numbers that I have seen for MX80 are: I.e. trio. No. Trio uses flat RLDRAM, and any IPv6 route

Re: The 100 Gbit/s problem in your network

2013-02-08 Thread Saku Ytti
On (2013-02-08 14:15 +), Aled Morris wrote: Multicast I don't see multicast working in Internet scale. Essentially multicast means core is flow-routing. So we'd need some way to decide who gets to send their content as multicast and who are forced to send unicast. It could create de-facto

Re: The 100 Gbit/s problem in your network

2013-02-11 Thread Saku Ytti
On (2013-02-11 11:58 +0100), Adam Vitkovsky wrote: The only time real-time per se matters is if you're playing the same content on multiple screens and *synchronization* matters. And there's the HFT where real-time really does matter :) I think most of HFT crowd are buying into low-latency

Re: The 100 Gbit/s problem in your network

2013-02-11 Thread Saku Ytti
On (2013-02-11 12:16 +), Aled Morris wrote: I don't see why, as an ISP, I should carry multiple, identical, payload packets for the same content. I'm more than happy to replicate them closer to my subscribers on behalf of the content publishers. How we do this is the question, i.e. what

Re: SDN - Killer Apps

2013-02-25 Thread Saku Ytti
On (2013-02-25 13:53 +0530), Glen Kent wrote: I understand that this is just some bit of what we can do with SDN. The amount of what all can be done is limitless. So, a question to all out there - Is my understanding of what can be achieved with SDN, is correct? Frankly I don't think there is

Re: Cloudflare is down

2013-03-03 Thread Saku Ytti
On (2013-03-03 12:46 -0800), Constantine A. Murenin wrote: Definitely smart to be delegating your DNS to the web-accelerator company and a single point of failure, especially if you are not just running a web-site, but have some other independent infrastructure, too. To be fair, most of us

Re: Cloudflare is down

2013-03-04 Thread Saku Ytti
On (2013-03-04 06:51 -0800), Leo Bicknell wrote: From what I have heard so far there is something else they could have done, hire higher quality people. Your solution to mistakes seem to be not to make them. I can understand the train of thought, but I suspect the practicality of such advice.

Re: Cloudflare is down

2013-03-04 Thread Saku Ytti
On (2013-03-04 13:23 -0500), Jeff Wheeler wrote: We have lots of stupid people in our industry because so few understand The Way Things Work. We have tendency to view mistakes we do as unavoidable human errors and mistakes other people do as avoidable stupidity. We should actively plan for

Re: Cloudflare is down

2013-03-04 Thread Saku Ytti
On (2013-03-04 12:33 -0800), Constantine A. Murenin wrote: to use http-acceleration services without DNS tie-ins. Last I checked, CloudFlare didn't even let you setup just a subdomain for their service, e.g. they do require complete DNS control from the registrar-zone level, all the time,

Re: Open Resolver Problems

2013-03-26 Thread Saku Ytti
On (2013-03-26 09:28 -0700), Owen DeLong wrote: Let me rephrase the question… How do you find an open IPv6 recursive name server that isn't listed in an NS entry and hasn't been publicized someplace that Google can find it? Pwn authorative server catering moderately popular domain and

Re: BCP38 - Internet Death Penalty

2013-03-27 Thread Saku Ytti
On (2013-03-27 11:05 -0500), Jack Bates wrote: I'm not arguing that the process can't be done. The problem is, there are a number of networks that don't know it needs to be done and why, or they don't know how to do it. There are a number of networks that have no concept of scripting changes

Re: Can we not just fix it? WAS:Re: Open Resolver Problems

2013-03-28 Thread Saku Ytti
On (2013-03-27 22:27 -1000), David Conrad wrote: One of the largest DDoS attacks I've witnessed was SNMP-based, walking entire OID sub-trees (with spoofed source addresses) across thousands of CPEs that defaulted to allowing SNMP queries over the WAN interface. Oops. Topped out around 70

Re: Tier 2 ingress filtering

2013-03-28 Thread Saku Ytti
On (2013-03-28 13:07 -0400), Jay Ashworth wrote: The edge carrier's *upstream* is not going to know that it's reasonable for their customer -- the end-site's carrier -- to be originating traffic with those source addresses, and if they ingress filter based on the prefixes they route down to

Re: Tier 2 ingress filtering

2013-03-28 Thread Saku Ytti
On (2013-03-28 15:47 -0400), Jay Ashworth wrote: You can't do it at top-level nor it's not practical to hope that some day BCP38 is done in reasonably many last-mile port. I don't know that that's true, actually; unicast-rpf does, as I understand it, most of the work, and is in most of

Re: Tier 2 ingress filtering

2013-03-28 Thread Saku Ytti
On (2013-03-28 23:45 +), Rajiv Asati (rajiva) wrote: In fact, what makes it easier is that uRPF can be part of the template that can be universally applied to every edge port. There is incredible amount of L3 interfaces in the last mile, old ghetto stuff, latest gen Cisco, which does not

Re: Tier 2 ingress filtering

2013-03-30 Thread Saku Ytti
On (2013-03-29 13:31 +0100), Tore Anderson wrote: I've had some problems with my upstream providers' ingress filtering, for example: That sounds like uRPF, which you should not run towards your transit customers. I'm talking only about using ACL. And I stand-by that I've never had to fix

Re: Tier 2 ingress filtering - folo

2013-03-30 Thread Saku Ytti
On (2013-03-30 11:39 -0400), Jay Ashworth wrote: But there's no way for an upstream transit carrier to know that *at the present time*. We expect our customers to mark any customers they have in their AS-SET. And we filter BGP announcements and we ACL traffic based on that. I know mandating

ipfix analyzers

2013-04-09 Thread Saku Ytti
Can someone point me to IPFIX analysers that do automatic learning of traffic patterns, raise events as suspected dos, and when operator marked as false positive, won't trigger that pattern anymore? This should be without configuring any explicit network ranges anywhere. So when I do get new

Re: Cisco 7600 (7609) as a core BGP router.

2009-07-18 Thread Saku Ytti
On (2009-07-18 15:58 +0700), Roland Dobbins wrote: uRPF for 7600/6500 can only be in one mode for the whole box, all interfaces. This is a major problem in many cases. I referred to this as 'chassis wide uRPF'. I'm not sure if that is big issue in many networks. You run uRPF/strict to single

Re: Cisco 7600 PFC3B(XL) and IPv6 packets with fragmentation header

2011-09-30 Thread Saku Ytti
On (2011-09-30 01:55 -0400), Christopher Morrow wrote: when will vendors learn that punting to the RE/RP/smarts for packets in the fastpath is ... not just 'unwise' but wholesale stupid? :( What to do with IP options or IPv6 hop-by-hop options? What to do with IPv6 packets which contain

Re: Cisco 7600 PFC3B(XL) and IPv6 packets with fragmentation header

2011-09-30 Thread Saku Ytti
On (2011-09-30 10:09 -0400), Christopher Morrow wrote: a switch to be used that stops processing this sort of thing, in an internet core (and honestly most enterprise core) routers, all I want is packet-in/packet-out. there's no need for anything else, stop trying to send line-rate packets to

Re: Cisco 7600 PFC3B(XL) and IPv6 packets with fragmentation header

2011-09-30 Thread Saku Ytti
On (2011-09-30 10:45 -0400), Christopher Morrow wrote: after this long, yes... this is just dumb, there's no reason that the default should be punt. There are cases (you've brought up a few) where it's required today because of design limitations, there really shouldn't be cases like this

Re: Juniper DOS/Blackhole question

2011-10-23 Thread Saku Ytti
On (2011-10-22 20:38 -0500), Jack Bates wrote: the route. This seems strange to me. Any idea why a route would be rejected unless multihop was enabled? RFC4271 states: -- - By default (if none of the above conditions apply), the BGP speaker SHOULD use the IP address of the interface that

Re: Odd router brokenness

2011-11-23 Thread Saku Ytti
On (2011-11-23 09:41 -0500), Mark Radabaugh wrote: The question is: How does a router break in this manner?It appears to unintentionally be doing something different with traffic based on the source address, not the destination address.I realize this can be done intentionally - but

Re: Odd router brokenness

2011-11-23 Thread Saku Ytti
On (2011-11-23 11:45 -0500), Mark Radabaugh wrote: I was told the router was reloaded to resolve a CEF issue. Not sure what was wrong with 'clear cef linecard'. Or just fixing the broken prefixes/adjacencies and opening CTAC case about what was wrong with them.

Re: subnet prefix length 64 breaks IPv6?

2011-12-29 Thread Saku Ytti
On (2011-12-29 16:56 +0800), Mark Tinka wrote: On Thursday, December 29, 2011 03:46:48 AM sth...@nethelp.no wrote: And there are other platforms, e.g. Juniper M/MX/T, where there is no concept of punt a packet to software to forwarded in hardware, or dropped. IPv6 prefixes 64 IOS

Re: Monday Night Footbal -- on Google?

2012-01-15 Thread Saku Ytti
On (2012-01-11 17:45 -0500), Justin M. Streiner wrote: If multicast is used it shouldn't take 150pbps, it should be much lower. That could be one of the things that helps spur v6 adoption - multicast being somewhat less of an afterthought :) While v4 multicast works, and delivering video

Re: Monday Night Footbal -- on Google?

2012-01-15 Thread Saku Ytti
On (2012-01-15 09:47 -1000), Antonio Querubin wrote: This is misguided, IPV6 does no magic to help scale multicast to Internet scale compared to IPV4. Actually, IPv6 embedded RP improves scalability over IPv4 MSDP peering and ASM. Unfortunately that does exactly nothing to help with

Re: juniper mx80 vs cisco asr 1000

2012-01-20 Thread Saku Ytti
On (2012-01-19 12:10 -0800), jon Heise wrote: Does anyone have any experience with these two routers, we're looking to buy one of them but i have little experience dealing with cisco routers and zero experience with juniper. It might be because of your schedule/timetable, but you are

Re: XBOX 720: possible digital download mass service.

2012-01-27 Thread Saku Ytti
On (2012-01-27 11:35 +0100), Tei wrote: Theres also a rumour that these new consoles will require internet to download games. These games can weigth 9 to 20 GB. That may be 30 million users in USA, maybe 50 worldwide. Source to these rumours? It seems ridiculous thought, considering you can

Re: 10GE TOR port buffers (was Re: 10G switch recommendaton)

2012-01-27 Thread Saku Ytti
On (2012-01-27 17:35 +0100), bas wrote: Chassis: Juniper EX8200-8XS512MB/10GE Cisco WS-X6708-10GE 32MB/10GE (or 24MB) Cisco N7K-M132XP-12 36MB/10GE Arista DCS-7548S-LC 48MB/10GE Brocade BR-MLX-10Gx8-X128MB/10GE (not sure) 1GE

Re: 10GE TOR port buffers (was Re: 10G switch recommendaton)

2012-01-28 Thread Saku Ytti
On (2012-01-27 22:40 +0100), bas wrote: But do you generally agree that the market has a requirement for a deep-buffer TOR switch? Or am I crazy for thinking that my customers need such a solution? No, you're not crazy. If your core is higher rate than your customer, then you need at

Re: 10GE TOR port buffers (was Re: 10G switch recommendaton)

2012-01-28 Thread Saku Ytti
On (2012-01-28 21:06 +0900), Masataka Ohta wrote: The required amount of memory is merely 150KB. Assuming we don't support jumbo frames and switch cannot queue sub packet sizes (normally they can't but VXR at least has 512B cell concept, so tx-ring is packet size agnostic, but this is just

Re: 10GE TOR port buffers (was Re: 10G switch recommendaton)

2012-01-28 Thread Saku Ytti
On (2012-01-28 21:53 +0900), Masataka Ohta wrote: 1.5MB @ 100Mbps is 120ms, which is prohibitively lengthy even as BE. The solution is to have less number of classes. The solution is to per class define max queue size, so user with fewer queues configured will not use all available buffer

Re: Console Server Recommendation

2012-01-31 Thread Saku Ytti
On (2012-01-30 11:08 -0500), Ray Soucy wrote: What are people using for console servers these days? We've historically used retired routers with ASYNC ports, but it's time for an upgrade. This is very very common thread, replaying couple times a year in various lists, with to my cursory look

Re: Console Server Recommendation

2012-01-31 Thread Saku Ytti
On (2012-01-31 10:01 +), Nick Hilliard wrote: I like feature list you posted, btw. If there were any console servers out there with these features, I would buy a bunch of them. I think OpenGear supports all of them (according to co-worker who tested them recently), but not 100% sure

Re: Console Server Recommendation

2012-01-31 Thread Saku Ytti
On (2012-01-31 11:09 -0800), Owen DeLong wrote: - IP address mappable to a console port. So that accessing device normally is 'ssh router' and via OOB 'ssh router.oob' no need to train people How about normal is 'ssh device' and OOB is 'console device'? Home-baked systems are certainly

Re: Console Server Recommendation

2012-02-01 Thread Saku Ytti
On (2012-02-01 09:07 -0800), Owen DeLong wrote: I would hardly call conserver software a home-baked solution unless you'd also call anything based on OSS a home-baked solution. Home-baked, i.e. it's not product you can get shipped and it'll work out of the box and you have organization

Re: Huawei edge routers..

2012-03-06 Thread Saku Ytti
On (2012-03-06 09:24 +), Leigh Porter wrote: Has anybody had any experience of Huawei Mobile/Metro edge routers? I'm looking for something that will handle various MPLS services (Layer 2/3), QinQ with about 10x1Gb Ethernet interfaces (no need for 10G). How are they compared to

Re: Huawei edge routers..

2012-03-06 Thread Saku Ytti
On (2012-03-06 11:05 +0100), Bjørn Mork wrote: do without docs. On paper they look fine, CLI is worse than IOS, but honestly if CLI is critical to you, you're probably doing something wrong anyhow (meaning, systems should be touching routers, not people) Hmm, we have systems using CLI

Re: L3 VPN Management

2012-03-07 Thread Saku Ytti
On (2012-03-07 07:07 +), Leigh Porter wrote: What's the nicest way of allowing the ops servers all talk to each VPN instance? At the moment I just us pretty normal L3VPN techniques so that every VPN sees routes tagged with the ops VPN target community and so that the ops VPN sees all

Re: Huawei edge routers..

2012-03-07 Thread Saku Ytti
On (2012-03-07 09:46 -), Tim Franklin wrote: This does occasionally brighten up my day with gems like rip no work and reset-recycle-bin, so it's not all bad :) I liked how ssh is secure-telnet, took bit head scratching to enable ssh. But again, I don't think crappy or good CLI is very

Handling of L2 broadcast, L3 unicast frames

2012-04-02 Thread Saku Ytti
If you try % sudo ip route add 194.100.7.227/32 dev eth0 % sudo arp -i eth0 -s 194.100.7.227 ff:ff:ff:ff:ff:ff % ping 194.100.7.227 Chances are that you get ping replies (Cisco VXR, Cisco ISR, Juniper SRX, Juniper M10i, Juniper M7i, Linksys e4200) But you also might not be getting replies

Re: Securing OOB

2012-04-23 Thread Saku Ytti
On (2012-04-23 12:45 +), Leigh Porter wrote: I have juniper SRX110s that use the magic new multi site IPSec thing. +1. This is the way to roll OOB, CPE (Cisco ISR, Juniper SRX), RS232 console server (opengear, avocent) and switch if you happen to have modern gear which support proper OOB

Re: rpki vs. secure dns?

2012-04-28 Thread Saku Ytti
On (2012-04-27 22:05 +), Paul Vixie wrote: this seems late, compared to the various commitments made to rpki in recent years. is anybody taking it seriously? (disclaimer I'm almost completely clueless on RPKI). If two fails don't make win, then I think ROVER is better solution, doesn't

Re: Juniper advertises ::/0 Cisco hears ::/3

2012-05-12 Thread Saku Ytti
On 12 May 2012 04:29, Ben Bartsch uwcable...@gmail.com wrote: Has anyone seen this behavior with BGP IPv6 between Juniper (owned by Level 3, advertising routes correctly, sending default ::/0) and Cisco (6509 running 12.2.58.SXI6 advipservices, receiving all routes fine except default, hearing

Re: HE.net BGP origin attribute rewriting

2012-05-31 Thread Saku Ytti
On (2012-05-31 08:46 -0700), David Barak wrote: On what precisely do you base the idea that a mandatory transitive attribute of a BGP prefix is a purely advisory flag which has no real meaning?  I encourage you to reconsider that opinion - it's actually a useful attribute, much the way

Re: HE.net BGP origin attribute rewriting

2012-06-01 Thread Saku Ytti
On (2012-06-01 10:19 +0200), Daniel Suchy wrote: I think RFC 4271 (http://tools.ietf.org/html/rfc4271) is very clear here. Back to the standard, why condone it's violation? Yes, statement It's extremely hard to find RFC which does not contain incorrect information or practically undeployable

Re: bgp best practice question

2012-06-04 Thread Saku Ytti
On (2012-06-04 11:36 -0700), jon Heise wrote: I need to make one of our data centers internet accessible, i plan to advertise a /24 out of our existing /22 network block at our new site. My question is for our main datacenter, is it a better idea to continue to advertise the full /22 or

Re: Trouble viewing slides for Automated Configuration and Validation of a Large Scale Network

2012-06-06 Thread Saku Ytti
On (2012-06-06 06:57 -0700), vijay gill wrote: A non-cut off version is here: http://sdrv.ms/MeQl1L For me provisioning automatically has always been quite trivial problem, system just has object representation of service with references to other objects and then those objects are used to fill

Re: solid v smart optics

2012-06-20 Thread Saku Ytti
On (2012-06-19 17:07 -0700), ryanL wrote: anyone have any opinions on the two subject vendors, with general regard to 10GE transceivers? SR multi-mode data center stuff for my application. I'm not familiar with solid optics, but AFAIK smart optics today resells finisar, so you probably don't

Re: strat-1 gps

2012-06-26 Thread Saku Ytti
On (2012-06-26 15:05 -0500), Ryan Malayter wrote: If you have to have something pre-integrated and soon, I'd look at Meinberg: http://www.meinberg.de/english/products/index.htm#network_sync We have several Meinbergs, quality hardware definitely. But I really wish they'd have hardware

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread Saku Ytti
On (2012-07-03 01:54 -0700), Wolfgang S. Rupprecht wrote: kernel time, why do we do it with leapseconds? We should really move the leapseconds correction into the display routines like DST and Yes. TAI time natively and presentation uses leap lookup tables to convert to UTC. Unixtime is not

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread Saku Ytti
On (2012-07-03 10:33 -0400), valdis.kletni...@vt.edu wrote: On the other hand, how many subtle bugs will we introduce when we break code that currently assumes the system clock is UTC, not TAI? Progress has non zero cost :) -- ++ytti

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread Saku Ytti
On (2012-07-03 10:11 -0700), Owen DeLong wrote: Trading one known set of bugs for a (probably) larger set of unknown bugs is not my definition of progress. Cost without progress is harmful and should be avoided. Leap bugs are NOT known. Most people have no idea unixtime is not monotonically

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread Saku Ytti
On (2012-07-03 19:33 +0100), Nick Hilliard wrote: Google's approach to this is interesting: http://googleblog.blogspot.ie/2011/09/time-technology-and-leaping-seconds.html Yes. I'm sure this is good enough for most people, most people don't need precise time but virtually everyone needs

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread Saku Ytti
On (2012-07-03 12:46 -0700), Owen DeLong wrote: If you don't know that time is not monotonically increasing, then that only becomes a software bug when you codify your own ignorance into software you write. If only all software could be ordered from you Owen, but in practice this is not

Re: F-ckin Leap Seconds, how do they work?

2012-07-04 Thread Saku Ytti
On (2012-07-03 16:53 -0700), Owen DeLong wrote: Sure, but even with that, 99% of it has only a passing 'interesting' effect and then recovers. Inclusive you no longer know order of events based on your logs, and virtually none of your software are logging 60th second. What are only

  1   2   3   4   5   6   7   8   9   >