Re: Broadband initiatives - impact to your network?

2010-06-29 Thread sthaug
you are comparing LAN to WAN, never a bright idea Even ATM years ago blurred that arbitrary line. Why does there even need to be a line between local and wide in terms of networking? As far as IP is concerned, there is no difference. Even as far as Ethernet is concerned, there is no

Re: Advice regarding Cisco/Juniper/HP

2010-06-30 Thread sthaug
That's strange, I abhor the Cisco way of doing VLANs and love the HP/Procurve method. What do you find so irritating? It just feels ass backwards alot of the time, especially trunking. That's more likely an RTFM problem, but the Cisco VLAN config has always just seemed more logical.

Re: Vyatta as a BRAS

2010-07-14 Thread sthaug
Regardless of recommendations, people are using commodity server-grade SMP hardware to run commodity OS's to get the job done, and given the people who have chimed in here, apparently are doing it without lots of problems. The increase on this and other lists of questions about Mikrotik,

Re: Vyatta as a BRAS

2010-07-14 Thread sthaug
I wasn't aware that the 7206 and M20 classified as software-based. I don't see why you could call it anything but a software router. The 7206 yes. The M20, no. Steinar Haug, Nethelp consulting, sth...@nethelp.no

Re: Addressing plan exercise for our IPv6 course

2010-07-23 Thread sthaug
It is not about how many devices, it is about how many subnets, because you may want to keep them isolated, for many reasons. It is not just about devices consuming lots of bandwidth, it is also about many small sensors, actuators and so. I have no problems with giving the customer several

ATT routing problems towards www.worldspan.com?

2010-08-30 Thread sthaug
We have problems reaching www.worldspan.com (216.113.132.22) from some locations. The common problem seems to be ATT (AS 7018). Our AS path towards the 216.113.128.0/19 prefix is typically 3356 7018 17228 19631 Anybody else see problems here? I note that I can ping 216.113.132.22 from some

Re: ATT routing problems towards www.worldspan.com?

2010-08-30 Thread sthaug
That host is not working for us either, but looks more like a host problem rather then BGP problem. I have no problem getting to other IP's in that range like 216.113.132.21 which is probably it's default gateway. I can ping 216.113.132.21 from all the places I have tried too. So I agree

Re: Q-In-Q using M7i and CISCO Switch

2010-09-01 Thread sthaug
We have a client with the following situation: v1, v2, v3 ---| Switch | --| Switch || Switch|- JUNIPER M7i IQ2E - Carrier offers only 3 vlans to the client. But he wants to push

Re: Did Internet Founders Actually Anticipate Paid, Prioritized Traffic?

2010-09-16 Thread sthaug
Will the provider unbundle the components so that it's feasible for a niche vendor to sell me custom connection services? No? Then the provider doesn't get to decide. It's about control. As the customer, the guy with the green, I should have it. A combination of decisions on the

Re: Software-based Border Router

2010-09-26 Thread sthaug
Just want to ask if anyone here had experience deploying software-based routers to serve as perimeter / border router? How does it gauge with hardware-based routers? Any past experiences will be very much appreciated. Software based routers (e.g. Cisco 7200 series) have been used as border

Re: RINA - scott whaps at the nanog hornets nest :-)

2010-11-06 Thread sthaug
Completely agree with you on that point. I'd love to see Equinix, AMSIX, LINX, DECIX, and the rest of the large exchange points put out statements indicating their ability to transparently support jumbo frames through their fabrics, or at least indicate a roadmap and a timeline to when

Re: RINA - scott whaps at the nanog hornets nest :-)

2010-11-06 Thread sthaug
RFC 4821 PMTUD is that negotiation that is lacking. It is there. It is deployed. It actually works. No more relying on someone sending the ICMP packets through in order for PMTUD to work! For some value of works. There are way too many places filtering ICMP for PMTUD to work consistently.

Re: RINA - scott whaps at the nanog hornets nest :-)

2010-11-06 Thread sthaug
RFC 4821 PMTUD is that negotiation that is lacking. It is there. It is deployed. It actually works. No more relying on someone sending the ICMP packets through in order for PMTUD to work! For some value of works. There are way too many places filtering ICMP for PMTUD to work

Re: IPv6

2010-11-19 Thread sthaug
That's what I'm hearing. Cogent refuses to peer with HE via IPv6. So cogent IPv6 Customers currently can not hit things at HE. And they can't do anything about it. Besides 6to4 tunneling and BGP peering with HE (or native, If they can). A few weeks ago I compared what cogent sees

Re: IPv6

2010-11-21 Thread sthaug
Yahoo just dropped in on the IPv6 content party http://ipv6.weather.yahoo.com/ I just bookmarked it. Well done Yahoos. Well, ipv6.ycpi.ops.yahoo.net has IPv6 address 2a00:1288:f006:1fe::1000 ipv6.ycpi.ops.yahoo.net has IPv6 address 2001:4998:f00b:1fe::1000 ipv6.ycpi.ops.yahoo.net

Re: AS6453 (Tata/Teleglobe/Globe Internet?) - various US ISP Outage?

2010-11-22 Thread sthaug
Anyone else seeing problems reaching ATT/XO possibly others from AS6453 in Europe? Seems to work okay from Norway: traceroute to 140.239.191.10 (140.239.191.10), 64 hops max, 40 byte packets 1 ge0-0-0-3000.br1.fn3.no.catchbone.net (193.75.4.1) 0.165 ms 0.179 ms 0.235 ms 2

Re: Network management software with high detailed traffic report

2010-11-22 Thread sthaug
Does any one know the NMS (network management software) which can do the fallowing: 1. Monitor on Cisco Routers/Switches interface utilization every 5-10 seconds and send e-mail alarm when utilization low or high of predefined thresholds. 2. Collect net-flow statistics (at least src/dst)

Re: Are you ready for RPKI in your BGP?

2010-12-09 Thread sthaug
I guess router vendors need to start supporting https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr/ and I'd imagine that'll take 6-12 months after it's even feature commit, so seeing deployment of this in 2011 seems highly doubtful? It's one of those features I doubt would ever be

Re: Alleged backdoor in OpenBSD's IPSEC implementation.

2010-12-15 Thread sthaug
More to the point, I think it wouldn't be an NDA, but a security classification on the knowledge of the backdoors, and probably one not subject to automatic downgrading. Please pardon my ignorance on the matter as I am not involved in any way with Open Source development, but it stands

Re: NIST IPv6 document

2011-01-05 Thread sthaug
All the same, beware of the anycast addresses if you want to use a smaller block for point-to-point and for LANs, you break stateless autoconfig and very likely terminally confuse DHCPv6 if your prefix length isn't /64. Breaking stateless autoconfig such that it *cannot* ever work, on my

Re: IPv6 - real vs theoretical problems

2011-01-07 Thread sthaug
Are there any large transit networks doing /64 on point-to-point networks to BGP customers? Who are they? What steps have they taken to eliminate problems, if any? Our Global Crossing IPv6 transit is on a /64 Ethernet point-to-point. Steinar Haug, Nethelp consulting, sth...@nethelp.no

Re: Using IPv6 with prefixes shorter than a /64 on a LAN

2011-01-24 Thread sthaug
IPv6 is classless; routers cannot blindly make that assumption for performance optimization. Blindly, no. However, it's not impractical to implement fast path switching that handles things on /64s and push anything that requires something else to the slow path. Any vendor who was

Re: [arin-announce] ARIN Resource Certification Update

2011-01-30 Thread sthaug
- Hosted solutions offer a low barrier entry to smaller organizations who simply cannot develop their own PKI infrastructure. This is the case where they also lack the organizational skills to properly manage the keys themselves, so, in most cases at least, they are *better off* with a

Re: quietly....

2011-02-02 Thread sthaug
It's a bit of a shame that people who've gotten into networking in the last 10 to 15 years haven't studied or worked with anything more than IPv4. They've missed out on seeing a variety of different ways to solve the same types of problems and therefore been exposed to the various benefits

Re: Using IPv6 with prefixes shorter than a /64 on a LAN

2011-02-03 Thread sthaug
The subject says it all... anyone with experience with a setup like this ? Unicast addresses must be located in at least a /64 subnet. No doubt there are vendors which enforce this (perhaps even in the ASICs), so deviating from this rule will result in some lock-in. The Juniper and

Re: quietly....

2011-02-03 Thread sthaug
I'm perfectly happy with an IPv6 network that only has rational people on it while those who insist on NAT stay behind on IPv4. There's an inherent conflict between your wish here and the desire to bring IPv6 to the masses... Steinar Haug, Nethelp consulting, sth...@nethelp.no

Re: IPv6 addressing for core network

2011-02-09 Thread sthaug
Is there a NANOG FAQ we can add this to? 1- Use Public Ipv6 with /122 and do not advertise to Internet 2- Use Public Ipv6 with /127 and do not advertise to Internet The all zeros address is the all routers anycast address so on most non-Cisco routers you can't use it, ruling out

Re: IPv6 addressing for core network

2011-02-09 Thread sthaug
A /127 mask is still the best way to handle real point-to-point links like SDH/SONET today, to avoid the ping-pong problem. Works fine with Cisco and Juniper, not tried with other vendors. I know it's immature, but I can't wait for some new hire at vendor C or vendor J to reread the

Re: IPv6 addressing for core network

2011-02-09 Thread sthaug
Global scope addresses on router-to-router interfaces are necessary today for traceroute to work. Some ISPs are *requiring* working traceroute (without MPLS hiding of intermediate hops) in RFPs to transit providers. If you can get router ICMP handling changed such that the ICMP packet

Re: IPv6 addressing for core network

2011-02-09 Thread sthaug
A /127 mask is still the best way to handle real point-to-point links like SDH/SONET today, to avoid the ping-pong problem. Works fine with Cisco and Juniper, not tried with other vendors. Can you elaborate on this? What's the ping-pong problem? This has been well covered in the

Re: Mac OS X 10.7, still no DHCPv6

2011-02-27 Thread sthaug
Does anybody have anything neat to keep logs of what host gets what ipv6 address in an SLAAC environment? You'd have to correlate ND information in the router to some kind of record of who has what MAC address at any given time. With SLAAC the host doesn't get an IPv6 address, it takes

Re: Mac OS X 10.7, still no DHCPv6

2011-02-27 Thread sthaug
In fairness, said device can do the same sort of inspection of SLAAC traffic. It just looks at neighbor discovery messages instead of DHCP messages. http://tools.ietf.org/html/draft-ietf-savi-fcfs Any known (existing) or planned implementations of this? Steinar Haug, Nethelp consulting,

Re: Switch with 10 Gig and GRE support in hardware.

2011-03-01 Thread sthaug
Juniper MX80 does all this. 1. It's not a switch (so don't expect switch pricing). 2. It doesn't offer 12 x 10GE ports. And I believe this has been mentioned earlier in the same thread... Steinar Haug, Nethelp consulting, sth...@nethelp.no

Re: Switch with 24x SFP PVLAN QinQ Layer 2

2011-03-02 Thread sthaug
Requirements are basically just 24/48 SFP ports, PVLAN and selective QinQ. Most devices that fit the requirements are Layer 3, which pushes the cost per port too high. ... The ME3600X might be more a more appropriate Cisco solution than the ME6524. The ME3600X

Re: Real World NAT64 deployments

2011-03-03 Thread sthaug
6to4 is handy as a toy or for experimenting, but it relies on a loose network of generous volunteers who, while generous, are neither generous nor numerous enough to support production traffic. Any ISP that is delivering IPv6 to their clients would be insane to not run a 6to4 relays for

Re: Why does abuse handling take so long ?

2011-03-13 Thread sthaug
Why o why are isp's and hosters so ignorant in dealing with such issues and act like they do not care? they don't act like they do not care. they really *don't* care. no acting. Well now, I'd say this varies considerably. There are definitely ISPs that care and *do* work hard at reducing

Re: MTU issues s0.wp.com

2012-11-06 Thread sthaug
Is anyone else experiencing similar issues? Not from here (AS 2116, Norway). No problem getting up the web page, tcpdump shows MSS 1440. My traceroute shows they are employing a CDN for s0.wp.com, so not everyone might be affected. 7 asd2-rou-1022.NL.eurorings.net

Re: Whats so difficult about ISSU

2012-11-10 Thread sthaug
as to whether ios/xe is rtc, you may want to see my preso at the last nanog. NANOG56? I only found RPKI Propagation by you. Direct URL would be appreciated. Look towards the end of the presentation and you'll find run to completion... Steinar Haug, Nethelp consulting, sth...@nethelp.no

Re: Big day for IPv6 - 1% native penetration

2012-11-26 Thread sthaug
Again, where're the compelling IPv6-only content/apps/services? To answer your rhetorical question, http://www.kame.net/ has a dancing kame. To my knowledge, that's the most compelling IPv6-only content. Don't forget http://loopsofzen.co.uk/ - that's definitely the most compelling

Re: OOB core router connectivity wish list

2013-01-10 Thread sthaug
I don't think you can get ethernet and transport out-of-the-area in some places at a reasonable cost, so having serial-console I think is still a requirement. TDM is disappearing quickly in at least some parts of the world. We may not be quite there yet, but I think it's entirely reasonable to

Re: Line cut in Mediterranean?

2013-03-27 Thread sthaug
Getting reports from a third party vendor that there's been a line cut in the Mediterranean that is affecting some Internet traffic. Anyone have any details? See the outages list: https://puck.nether.net/pipermail/outages/2013-March/005386.html Steinar Haug, Nethelp consulting,

Re: Cogent input

2009-06-12 Thread sthaug
It's worth noting that being a v4 tier1/transit-free network doesn't necessarily mean that they're the same in the v6 world. For instance, Google appears to be a transit-free v6 network. It wouldn't surprise me if the same is true for other big v6 players like Tinet and HE. Good point.

Re: spamhaus drop list

2009-06-16 Thread sthaug
Is there a competing droplist, that can be compared against Spamhaus's droplist? That seems like an extraordinary claim, so I'm not satisfied with the evidence provided. Is this not the best droplist? Obviously the Spamhaus DROP list should be evaluated - you should not use such lists

Re: Point to Point Ethernet

2009-07-08 Thread sthaug
1. What's the point of increasing the max MTU from 9000 to 9012? If we want a higher MTU, why not just ask for one in the next standard? To me the only reason for this would be to lessen overhead on small packets. Also, afaik standard payload MTU is 1500 for ethernet, anything else is

Re: Point to Point Ethernet

2009-07-08 Thread sthaug
My understanding is that 9000 is a standard for GigE and up but for compatibility with earlier ethernets it's not the default. Your understanding is wrong. The only IEEE standard is 1500 bytes. Steinar Haug, Nethelp consulting, sth...@nethelp.no

Re: Point to Point Ethernet

2009-07-08 Thread sthaug
Speaking from a personal interest, has the Point-to-Point Protocol stopped being useful? After all, PPP over Sonet/SDH was specifically designed for just this case. Absolutely, and it still works great for that purpose. However, given a provider backbone with Ethernet being the underlying

Re: [SPAM-HEADER] - Re: Point to Point Ethernet - Email has different SMTP TO: and MIME TO: fields in the email addresses

2009-07-08 Thread sthaug
The reality is that is an SDH/SONET backbone underlying most of these Ethernet networks. That may be so (however, numbers for the national provider I work for do not tend to bear this out). But does it matter? People presumably use Ethernet because it is inexpensive, easily available, well

Re: Point to Point Ethernet

2009-07-09 Thread sthaug
Best case, you blow 12 bytes on IFG in gig, 20 bytes on fast-e/slow-e. As far as I know Gig and 10 Gig (with LAN PHY) are exactly the same as 10 and 100 Mbps in this respect, i.e. 8 bytes of preamble and 12 bytes of IFG. So you always have an overhead of 20 bytes, no matter what. 10 Gig with

Re: Using CE Router for Internet and VPN services

2009-07-17 Thread sthaug
Please describe all benefits and detriments of using more than /30 subnet on SP PE. Some good links will be very useful for me. Don't know all, but have you see the arp tables on a PE router? Have you seen some of the crazy things devices other than routers can do on ethernet? Good

Re: Cisco 7600 (7609) as a core BGP router.

2009-07-21 Thread sthaug
GSR is far better platform. Concur 100%. --- I'm probably wrong, but aren't the 7600s 40Gbps per slot vs the GSR only being 10Gbps per slot? and doesn't that mean that there should (fairly soon) be a new version of the GSR coming that ups the slot width? It's called the CRS-1 :-)

Re: questionable email filtering policies?

2009-07-27 Thread sthaug
BT outsources all of their mail to Yahoo. It actually works pretty well, either POP or web mail. so far btopenworld.com looks like bullet proof phishing drop boxes, based on yahoo's cluefree response. How about writing to Bruce Schneier and explaining the problem? He's Chief Security

Re: sat-3 cut?

2009-07-30 Thread sthaug
In other news, Nigerian Scams at an all time low this morning/afternoon. Unfortunately a lot of the Nigerian scams run out of Dutch coffee shops/internet cafes and thus won't be affected. Steinar Haug, Nethelp consulting, sth...@nethelp.no

Re: Network Ring

2009-09-08 Thread sthaug
Rod Beck wrote: What is EAPS? A joke of a standard and something to be avoided at all costs. I would echo the last part about Extreme switches too. Disagree. I don't believe anybody would claim EAPS is a standard just because an RFC has been published. In any case, EAPS is working quite

Re: Keepalives are temporarily in throttle due to closed TCP window

2009-09-16 Thread sthaug
I checked the MTUs on the 3550s and I am seeing the Fast E interfaces are still showing 1500 bytes. Would increasing the MTU size on the switches cause any harm? The 3550s are very limited with respect to MTU - the standard model can only do up to 1546 byte, while I believe the -12G model can

Re: Maximum devices in OSPF area 0

2009-10-19 Thread sthaug
We are looking to deploy a greenfield MPLS network with OSPF as the IGP. I'm told OSPF areas don't play well with OSPF TED. For this reason, we are looking at using you said .. greenfield.. why use OSPF? I was thinking the same. If you run OSPF and want IPv6 some time in the future

Re: IPv6 Deployment for the LAN

2009-10-22 Thread sthaug
I point you to a fairly common Internet architecture artifact, the exchange point... dozens of routers sharing a common media for peering exchange. Bill, could you explain how or why ra or dhcp or dhcpv6 have any relevance to an IXP? Being one of these artefact operators -

Re: What DNS Is Not

2009-11-10 Thread sthaug
When the conficker worms phones home to one of the 50,000 potential domains names it computes each day, there are a lot of IT folks out there that wish their local resolver would simply reject those DNS requests so that infected machines in their network fail to phone home. To

Re: What DNS Is Not

2009-11-10 Thread sthaug
When the conficker worms phones home to one of the 50,000 potential domains names it computes each day, there are a lot of IT folks out there that wish their local resolver would simply reject those DNS requests so that infected machines in their network fail to phone home. That's an

Re: What DNS Is Not

2009-11-11 Thread sthaug
Since people need to *explicitly* choose using the OpenDNS servers, I can hardly see how anybody's wishes are foisted on these people. If you don't like the answers you get from this (free) service, you can of course choose to use a different service - for instance your ISP's name

Re: Alternatives to Cisco SFP-GE-S?

2009-11-15 Thread sthaug
Does anyone have any practical long term experience with third party alternatives to the (must be made from solid gold) Cisco SFP-GE-S module that they'd like to share with me? I suppose I could just use compatible GLC-SX-MM instead, but I kind of want to have DOM support. There are plenty of

Re: Juniper M120 Alternatives

2009-11-16 Thread sthaug
Having slightly lost track of what everybody is using for peering routers these days, what is the consensus about the best alternative to Juniper M series routers? Juniper MX series? Works great for us. Much nicer 10G prices than M120. Steinar Haug, Nethelp consulting, sth...@nethelp.no

Re: Juniper M120 Alternatives

2009-11-16 Thread sthaug
I had looked briefly, does anybody here actually use them as peering routers? I've seen a few implementations using them in the MPLS P and PE router roles but never as border routers. We use MX series as peering routers. They work very well. Steinar Haug, AS 2116

Re: Juniper M120 Alternatives

2009-11-18 Thread sthaug
That's excellent news - any word on when Cisco will be back-porting these truly useful features from XR to that platform which so many of us are still running on (ie traditional IOS)? Obviously not speaking for Cisco here - but as a significant customer we have had no indication that this will

Re: Breaking the internet (hotels, guestnet style)

2009-12-08 Thread sthaug
This really should be a DHCP option which points to the authentification server using ip addresses. This should be return to clients even if they don't request it. Web browers could have a hot-spot button that retrieves this option then connects using the value returned. Unfortunately,

Re: Linux shaping packet loss

2009-12-08 Thread sthaug
Won't say I'm an expert with TC, but anytime I see packet loss on an interface I always check the interface itself...10% packet loss is pretty much what you would get if there was a duplex problem. I always try to hard set my interfaces on both the Linux machines and Switches. Used to set

Re: Linux shaping packet loss

2009-12-08 Thread sthaug
The biggest problem with duplex had to do with 100mb. Cisco (and a lot of other companies) decided in their infinite wisdom that at 100mb if auto-negotiation fails, to use half duplex as the default. No, that wasn't those companies deciding to do so in their infinite wisdom. That was those

Re: news from Google

2009-12-11 Thread sthaug
If you aren't breaking the law, the government won't be looking for your data, and won't ask Google/Yahoo/Bing/AltaVista or other search companies for your data. That's an extremely naive view of how governments operate. To put it mildly. Steinar Haug, Nethelp consulting, sth...@nethelp.no

Re: Performance Issues - PTR Records

2011-11-07 Thread sthaug
The practice of filling out the reverse zone with fake PTR record started before there was wide spread support for UPDATE/DNS. There isn't any need for this to be done anymore. Machines are capable of adding records for themselves. How do I setup this for DHCPv6-PD? Say, I delegate

Re: Recent DNS attacks from China?

2011-11-30 Thread sthaug
I am wondering if anyone else is seeing a sudden increase in DNS attacks emanating from chinese IP addresses? Over the past 24 hours we've seen a sudden rash of chinese IPs attacking our DNS servers in the order of 5 to 10 million PPS for periods of 5 to 10 mins, repeated every 20 to 30

Re: Any tools to help network security

2011-12-21 Thread sthaug
We discover there are so many (source) ip not belonging to our network to go to outside. We can block it but don't know how to locate the source. Any tools can be easily found out. http://lmgtfy.com/?q=unicast+rpf Steinar Haug, Nethelp consulting, sth...@nethelp.no

Re: subnet prefix length 64 breaks IPv6?

2011-12-23 Thread sthaug
I am not sure if this is the reason as this only applies to the link local IP address. One could still assign a global IPv6 address. So, why does basic IPv6 (ND process, etc) break if i use a netmask of say /120? As long as you assign addresses statically, IPv6 works just fine with a netmask

Re: subnet prefix length 64 breaks IPv6?

2011-12-25 Thread sthaug
prefixes on the same link.  Choosing to make use of a 120-bit prefix (for example) will do nothing to protect against a rogue RA announcing its own 64-bit prefix with the A flag set. I could not find any A flag in the RA. Am i missing something? It's part of the Prefix Information

Re: subnet prefix length 64 breaks IPv6?

2011-12-28 Thread sthaug
On the other hand there's also the rule that IPv6 is classless and therefore routing on any prefix length must be supported, although for some implementations forwarding based on /64 is somewhat less efficient. Can you please name names for the somewhat less efficient part? I've seen this

Re: subnet prefix length 64 breaks IPv6?

2011-12-28 Thread sthaug
Most vendors have a TCAM that by default does IPv6 routing for netmasks =64. They have a separate TCAM (which is usually limited in size) that does routing for masks 64 and =128. Please provide references. I haven't seen any documentation of such an architecture myself. TCAMs are expensive

Re: subnet prefix length 64 breaks IPv6?

2011-12-28 Thread sthaug
Can you please name names for the somewhat less efficient part? I've seen this and similar claims several times, but the lack of specific information is rather astounding. Well, I do know if you look at the specs for most newer L3 switches, they will often say something like max IPv4

Re: subnet prefix length 64 breaks IPv6?

2011-12-28 Thread sthaug
If every route is nicely split at the 64-bit boundary, then it saves a step in matching the prefix. Admittedly a very inexpensive step. My point here is that IPv6 is still defined as longest prefix match, so unless you *know* that all prefixes are = 64 bits, you still need the longer match.

Re: subnet prefix length 64 breaks IPv6?

2011-12-28 Thread sthaug
IPv6 CEF appears to be functioning normally for prefixes longer than 64-bit on my 720(s). I'm not seeing evidence of unexpected punting. The CPU utilization of the software process that would handle IPv6 being punted to software, IPv6 Input, is at a steady %0.00 average (with spikes up

Re: subnet prefix length 64 breaks IPv6?

2012-01-07 Thread sthaug
Note: An IPv4 route requires only one TCAM entry. Because of the hardware compression scheme used for IPv6, an IPv6 route can take more than one TCAM entry, reducing the number of entries forwarded in hardware. For example, for IPv6 directly connected IP addresses, the

Re: Common operational misconceptions

2012-02-16 Thread sthaug
If you want to know if your resolver talks IPv6 to the world and supports 4096 EDNS UDP messages the following query will tell you. dig edns-v6-ok.isc.org txt Similarly for IPv4. dig edns-v4-ok.isc.org txt Both PowerDNS recursor 3.3 and Nominum CNS 3.0.5

Re: Attack on the DNS ?

2012-03-31 Thread sthaug
Anyone seen signs of this attack actually occurring ? http://www.nytimes.com/2012/03/31/technology/with-advance-warning-bracing-for-attack-on-internet-by-anonymous.html?_r=1 From my vantage point in Oslo, Norway, there is no sign of any attack occurring. Steinar Haug, Nethelp consulting,

Re: Attack on the DNS ?

2012-03-31 Thread sthaug
We already have this type of attack in Bucharest/Romania since last Friday. The targets where IP's of some local webhosters, but at one moment we event saw IP's from Go Daddy. Tcpdump will show something like: 11:10:41.447079 IP target open_resolver_ip.53: 80+ [1au] ANY? isc.org. (37)

Re: Cheap Juniper Gear for Lab

2012-04-11 Thread sthaug
Anyway, not the best devices for an edge router that is for sure. Which is too bad... for very small DC edge applications, the J6350 was a pretty cool router in earlier versions of JunOS that didn't decide to re-engineer your network and transit for you. We have 3 J2320s in the lab, all

Re: [IPv6] Monitoring BGP IPv6 Sesions

2012-04-19 Thread sthaug
There's new mib support in new IOS's and ASR9k stuffs but there's still not feature parity with IPv4. It seems the current prevailing winds indicate less support for SNMP and more for NETCONF. So maybe we should all get cozy with XML rather than OIDs... shudder All I've seen of Netconf so

Re: HE.net BGP origin attribute rewriting

2012-05-31 Thread sthaug
I disagree. Origin is tremendously useful as a multi-AS weighting tool, and isn't the blunt hammer that AS_PATH is. If you think of AS_PATH as a blunt hammer, how would you describe localpref? We use AS_PATH in many cases *precisely* because we don't consider it to be a blunt hammer...

Re: DDoS using port 0 and 53 (DNS)

2012-07-25 Thread sthaug
The port number of the Layer 4 connection cannot be determined without executing IP fragment reassembly in that case.Routers normally reassemble fragments they receive, if possible. No, routers normally do *not* reassemble fragments. This is typically done by hosts and firewalls. Steinar

Re: Does anyone use anycast DHCP service?

2012-08-13 Thread sthaug
I think it would be far more reliable to simply have two independent DHCP servers with mutually exclusive address ranges, and have one system be secondary and delay its responses by 2s so it always loses when the primary is up and running well. Yes, you lose the ability for clients to get

Re: HSRP vs VRRP for IPv6 on IOS-XE - rekindling an old flame

2012-08-20 Thread sthaug
Yeah I see the disconnect. I'm assuming that what I see is what I get. Which means I'm going to stick with HSRP. If our AS team gives me any good feedback that I can share I will do so. Thanks Nick. XE: v4: HSRPv1, HSRPv2, VRRPv6: HSRPv2 Not particularly relevant to the

Re: Estimate of satellite vs. Land-based traffic

2009-01-07 Thread sthaug
When I was working with Svalbard, Internet connectivity was through a satellite link at about 2.5 degrees elevation looking through a notch in the mountains. I don't think it has changed It has. Svalbard now has undersea cable connection to the Norwegian mainland. See

Re: can I ask mtu question

2009-01-30 Thread sthaug
That depends on the hardware. I've seen gear running as low as ~8k. I'd have to consult standard, but I think the max is 10k (10240). There *is* no standard for jumbo MTU. IEEE has steadfastly refused to standardize anything bigger than 1500 bytes. Steinar Haug, Nethelp consulting,

Re: Private use of non-RFC1918 IP space

2009-02-02 Thread sthaug
There are sometimes good reasons to do this, for instance to ensure uniqueness in the face of mergers and acquisitions. How does that help? If you are renumbering due to a merger, couldn't you just agree on separate private space just as easily? It would ensure that you could get the

Re: Private use of non-RFC1918 IP space

2009-02-02 Thread sthaug
What reason could you possibly have to use non RFC 1918 space on a closed network? It's very bad practice - unfortunately I do see it done sometimes There are sometimes good reasons to do this, for instance to ensure uniqueness in the face of mergers and acquisitions. Steinar Haug,

Re: v6 DSL / Cable modems

2009-02-06 Thread sthaug
The problem is that DHCP seemed like a good idea at the time but it doesn't make any sense today. We know that parsing complex binary data formats is asking for security problems. And parsing complex text data structures is better? What we need is a simple, fast, efficient way to

Re: v6 DSL / Cable modems

2009-02-07 Thread sthaug
I suppose you can individually configure every host to get itself temporary addresses from RA announcements. This isn't usually a good default configuration, but OS implementation already seems to be inconsistent on the default configuration here. So we're back to the IPv4 dark ages

Re: 3/11 (invalid or corrupt AS path)

2009-02-16 Thread sthaug
I am starting to see random BGP neighbor messages from multiple neighbors on different boxes. %BGP-3-NOTIFICATION: received from neighbor X.X.X.X 3/11 (invalid or corrupt AS path) 516 bytes Maybe because of this? 94.125.216.0/21*[BGP/170] 00:31:49, MED 22367, localpref 100

Re: IPv6 Confusion

2009-02-18 Thread sthaug
Just how DO we get the message to the IETF that we need all the tools we have in v4 (DHCP, VRRP, etc) to work with RA turned off? You don't, because there isn't really a technical reason for turning off RA. I'm glad to see that several of the big vendors seem to disagree with you. -

Re: IPv6 Confusion

2009-02-18 Thread sthaug
2) Some end-node box with a IPv6 stack from Joe's Software Emporium and Bait-n-Tackle sees an RA packet, and concludes that since RA and DHCPv6 are mutually exclusive, to ignore any DHCPv6 packets it sees, and hilarity ensues. They are not mutually exclusive, DHCPv6

Re: 23456 without AS4_PATH?

2009-02-28 Thread sthaug
Anyone else seeing this: * 91.196.186.0/24 62.237.167.25 0 3292 3549 15703 43531 23456 i http://www.ietf.org/rfc/rfc4893.txt 6. Transition An OLD BGP speaker MUST NOT use AS_TRANS as its Autonomous System number. Seeing it here too. On our 4-byte capable

Re: options for full routing table in 1 year?

2009-04-09 Thread sthaug
Cisco 6500/7600 with SUP720-3BXL handles 1mil routes If I remember correctly, using certain function(s) like e.g. uRPF halves this value (in FIB). Old Sup2, yes. Sup720 and related, no. Steinar Haug, Nethelp consulting, sth...@nethelp.no

Re: BGP FlowSpec support on provider networks

2009-04-11 Thread sthaug
Now I realize that FlowSpec isn't a panacea, but it certainly meets some of the requirements that many customers have today, and it gives us a lot more flexibility over simply destination based filtering. Whether it's FlowSpec or something else, what's it going to take to get the vendors and

Re: Where to buy Internet IP addresses

2009-05-03 Thread sthaug
We *want* things like IPv6 stateless autoconfig to work. It's a great idea. We *want* a protocol simple enough that we don't have to deal with stateful DHCP, we *want* something that is hard to screw up. You should be aware that this is by no means a universal viewpoint. IPv6 stateless

  1   2   >