Re: Checking bogon status of new address space

On Fri, 8 May 2009, Steve Bertrand wrote: IMHO, if a network doesn't either update filters based on IANA notifications or follow Cymru BOGON, then they don't deserve to receive traffic from your network ;) See how far you get telling customers that after you've given them recently debogonized

Re: two interfaces one subnet

On May 11, 2009, at 11:43 PM, Ben Scott wrote: On Mon, May 11, 2009 at 11:01 PM, Patrick W. Gilmore > wrote: Do you even read your own posts? Specifically: On May 11, 2009, at 5:40 PM, Ben Scott wrote: Either way, if the packet *from* X was addressed *to* B but the response comes back from

Re: Checking bogon status of new address space

Oliver Hookins wrote: > Hi, > > my company has just been allocated some new IPv4 address space, and I want > to do some sort of automated testing to find out any ASs out there that > haven't removed the /8 it's on from their bogon list (the allocation to our > local registry only occurred in Novem

Re: two interfaces one subnet

On Mon, May 11, 2009 at 11:01 PM, Patrick W. Gilmore wrote: >>> It doesn't matter which physical interface transmits the packet. >> >>  Well, in the general sense, I suppose not.  The computer can put >> whatever it wants in an Ethernet frame, and as long as it's valid for >> the receiving system,

Can Interdomain routing[BGP] self recover from prefix hijack?

HiSolutions like BGPmon.net,Cyclops,etc are doing a very good job of alerting   about the prefix hijack/configuration erros/experiments gonig on/etc.But i would like to ask "Alerting the victim is the best we can do after detecting such incidents" or what else we can do?What do you think about "B

Re: PPP multilink help

It could very well be microburst in the flow creating congestion as seen in the default class: > Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 252140 > 30 second output rate 1795000 bits/sec, 243 packets/sec > > Class-map: class-default (match-any) > 27511

Re: two interfaces one subnet

On May 11, 2009, at 8:04 PM, Ben Scott wrote: On Mon, May 11, 2009 at 6:01 PM, Patrick W. Gilmore wrote: It doesn't matter which physical interface transmits the packet. Well, in the general sense, I suppose not. The computer can put whatever it wants in an Ethernet frame, and as long as

RE: two interfaces one subnet

Yes, similar happens to me all the time with both Windows Server 2008 and Vista with respect to 802.11 putting two interfaces on the same subnet (and LAN segment). I typically am never the wiser until I notice that a SMB connection had gone over to 802.11 first, because that associated before t

Re: two interfaces one subnet

Once upon a time, David Coulson said: > Remember, Linux has no concept of downing an interface when the link > goes away Not true in several different ways. You can run netplugd or Network Manager to control it. -- Chris Adams Systems and Network Administrator - HiWAAY Internet Services I do

Re: two interfaces one subnet

Remember, Linux has no concept of downing an interface when the link goes away, so even if you have two interfaces with the same subnet config, the kernel will continue to send traffic to a disconnected interface. Utilizing the bonding kernel module is the only really effective way to handle la

Re: two interfaces one subnet

On Mon, May 11, 2009 at 7:04 PM, Ben Scott wrote: > On Mon, May 11, 2009 at 6:01 PM, Patrick W. Gilmore wrote: >[snip] Many OSes should handle it correctly, in principle, there's nothing wrong with hosts homed twice to the same network and addressed inside the same subnet, but for Linux hosts,

Re: two interfaces one subnet

On Mon, May 11, 2009 at 6:01 PM, Patrick W. Gilmore wrote: > You are assuming facts not in evidence. I *have* actually done this before, so I'd like to think, for my own purposes at least, my experiences are factual. :) > It doesn't matter which physical interface transmits the packet. Wel

Re: two interfaces one subnet

> Date: Mon, 11 May 2009 18:29:08 -0500 > From: Chris Adams > > Once upon a time, Kevin Oberman said: > > > From: Chris Meidinger > > > For example, eth0 is 10.0.0.1/24 and eth1 is 10.0.0.2/24, nothing like > > > bonding going on. The customers usually have the idea of running one > > > int

Re: two interfaces one subnet

Once upon a time, Kevin Oberman said: > > From: Chris Meidinger > > For example, eth0 is 10.0.0.1/24 and eth1 is 10.0.0.2/24, nothing like > > bonding going on. The customers usually have the idea of running one > > interface for administration and another for production (which is a > > _go

Re: two interfaces one subnet

On May 11, 2009, at 6:35 PM, Arnold Nipper wrote: On 12.05.2009 00:25 Patrick W. Gilmore wrote On May 11, 2009, at 6:13 PM, Arnold Nipper wrote: On 11.05.2009 23:47 Patrick W. Gilmore wrote On May 11, 2009, at 5:19 PM, Alex H. Ryu wrote: It may be allowed from host-level, but from router equ

Re: two interfaces one subnet

On 12.05.2009 00:25 Patrick W. Gilmore wrote > On May 11, 2009, at 6:13 PM, Arnold Nipper wrote: >> On 11.05.2009 23:47 Patrick W. Gilmore wrote >>> On May 11, 2009, at 5:19 PM, Alex H. Ryu wrote: >>> It may be allowed from host-level, but from router equipment, I don't think it w

RE: two interfaces one subnet

I think the idea of one interface per subnet originates in the early RFCs, such as RFC 1009 "Requirements for Internet Gateways": "Section 1.1.2 Networks and Gateways ... A gateway is connected to two or more networks, appearing to each of these networks as a connected host. Thus, it ha

Re: two interfaces one subnet

On May 11, 2009, at 6:13 PM, Arnold Nipper wrote: On 11.05.2009 23:47 Patrick W. Gilmore wrote On May 11, 2009, at 5:19 PM, Alex H. Ryu wrote: It may be allowed from host-level, but from router equipment, I don't think it was allowed at all. Ever used HSRP / VRRP? Two interfaces in the sa

Re: two interfaces one subnet

On May 11, 2009, at 5:59 PM, Chris Meidinger wrote: Just to restate here, for people who have been responding both publicly and privately: I know that *I* can make it work, and I know that *you* can make it work. But I also know that it's not likely to stay working. One day, down the road

Re: two interfaces one subnet

On 11.05.2009 23:47 Patrick W. Gilmore wrote > On May 11, 2009, at 5:19 PM, Alex H. Ryu wrote: > >> It may be allowed from host-level, but from router equipment, I don't >> think it was allowed at all. > > Ever used HSRP / VRRP? Two interfaces in the same subnet. Works > fine. In fact, most

Re: two interfaces one subnet

On 12/05/2009, at 9:00 AM, Charles Wyble wrote: What does two interfaces in one subnet mean? Two NICs? Or virtual interfaces? Also, what does one subnet mean? A. Using the same IP prefix on two different networks (ie. ethernet broadcast domains) with an interface in to each, or B. running

Re: two interfaces one subnet

In my case, each Ethernet interface has its own unique MAC address. Dave On Mon, May 11, 2009 at 4:28 PM, Hector Herrera wrote: > On Mon, May 11, 2009 at 2:22 PM, David Devereaux-Weber > wrote: > > Chris, > > > > I work with iHDTV , a project that sends uncompressed > high > >

Re: two interfaces one subnet

On May 11, 2009, at 5:40 PM, Ben Scott wrote: On Mon, May 11, 2009 at 5:28 PM, Hector Herrera > wrote: On Mon, May 11, 2009 at 2:22 PM, David Devereaux-Weber wrote: ... both> interfaces are on the same subnet, the OS sees the same router (gateway) address on both interfaces, and the results ar

Re: two interfaces one subnet - SOLVED

On 11.05.2009, at 23:39, Mike O'Connor wrote: :Hi, : :This is a pretty moronic question, but I've been searching RFC's on- :and-off for a couple of weeks and can't find an answer. So I'm hoping :someone here will know it offhand. : :I've been looking through RFC's trying to find a clear statemen

Re: two interfaces one subnet

On 11.05.2009, at 23:48, Ben Scott wrote: On Mon, May 11, 2009 at 5:38 PM, Chris Meidinger wrote: For example, eth0 is 10.0.0.1/24 and eth1 is 10.0.0.2/24, nothing like bonding going on. The customers usually have the idea of running one interface for administration and another for productio

Re: two interfaces one subnet

On 5/11/09 3:23 PM, Chris Meidinger wrote: On 11.05.2009, at 23:19, Alex H. Ryu wrote: Unless you configure Layer 2 for two interfaces, it's not going to work. It is invalid from networking principle. If you have to send the traffic for host in same subnet you configured, which interface it sho

Re: two interfaces one subnet

On May 11, 2009, at 4:45 PM, Chris Meidinger wrote: On 11.05.2009, at 22:34, Patrick W. Gilmore wrote: On May 11, 2009, at 4:29 PM, Chris Meidinger wrote: I would be grateful for a pointer to such an RFC statement, assuming it exists. Why would an RFC prohibit this? Most _implementations_

RE: two interfaces one subnet

If it were me and had the requirement of having both NICs in the same L2 segment, but unique IP addresses, I'd assign a secondary IP address to the Layer3 SVI on the upstream device, and give the 2nd NIC on the server an IP on that secondary IP block. Ken Matlock Network Analyst Exempla Healthcar

Re: two interfaces one subnet

> From: Chris Meidinger > Date: Mon, 11 May 2009 23:38:30 +0200 > > On 11.05.2009, at 23:31, Dan White wrote: > > > Chris Meidinger wrote: > >> Hi, > >> > >> This is a pretty moronic question, but I've been searching RFC's on- > >> and-off for a couple of weeks and can't find an answer. So I'm

Re: two interfaces one subnet

On 11.05.2009, at 23:42, Kevin Oberman wrote: Date: Mon, 11 May 2009 16:19:56 -0500 From: "Alex H. Ryu" Unless you configure Layer 2 for two interfaces, it's not going to work. It is invalid from networking principle. If you have to send the traffic for host in same subnet you configured,

Re: two interfaces one subnet

:Hi, : :This is a pretty moronic question, but I've been searching RFC's on- :and-off for a couple of weeks and can't find an answer. So I'm hoping :someone here will know it offhand. : :I've been looking through RFC's trying to find a clear statement that :having two interfaces in the same su

Re: two interfaces one subnet

On Mon, May 11, 2009 at 5:38 PM, Chris Meidinger wrote: > For example, eth0 is 10.0.0.1/24 and eth1 is 10.0.0.2/24, nothing like > bonding going on. The customers usually have the idea of running one > interface for administration and another for production (which is a _good_ > idea) but they want

Re: two interfaces one subnet

On May 11, 2009, at 5:19 PM, Alex H. Ryu wrote: Unless you configure Layer 2 for two interfaces, it's not going to work. It can work. Of course it _may_ not, depending upon your implementation, but then some implementations can't get a single interface to work properly per subnet. It

RE: two interfaces one subnet

Hi Chris, I remember this. I remember it in an early IP RFC, but couldn't find it in 10 minutes of searching. It had to do with intefaces cannot have overlapping address space. One of the IETF greybeards ought to know. It's been a while since I was writing code with marked up rfc's in fro

Re: two interfaces one subnet

> Date: Mon, 11 May 2009 16:19:56 -0500 > From: "Alex H. Ryu" > > Unless you configure Layer 2 for two interfaces, it's not going to work. > It is invalid from networking principle. > If you have to send the traffic for host in same subnet you configured, > which interface it should send out ? >

Re: two interfaces one subnet

On Mon, May 11, 2009 at 5:28 PM, Hector Herrera wrote: > On Mon, May 11, 2009 at 2:22 PM, David Devereaux-Weber > wrote: >> ... both> interfaces are on the same subnet, the OS sees the same router >> (gateway) >> address on both interfaces, and the results are sub-optimal ... around 50% >> packe

Re: two interfaces one subnet

On 11.05.2009, at 23:31, Dan White wrote: Chris Meidinger wrote: Hi, This is a pretty moronic question, but I've been searching RFC's on- and-off for a couple of weeks and can't find an answer. So I'm hoping someone here will know it offhand. I've been looking through RFC's trying to find a

Re: two interfaces one subnet

Chris Meidinger wrote: Hi, This is a pretty moronic question, but I've been searching RFC's on-and-off for a couple of weeks and can't find an answer. So I'm hoping someone here will know it offhand. I've been looking through RFC's trying to find a clear statement that having two interfaces i

Re: two interfaces one subnet

On Mon, May 11, 2009 at 2:22 PM, David Devereaux-Weber wrote: > Chris, > > I work with iHDTV , a project that sends uncompressed high > definition television (1.5 Gbps) as UDP over two 1 Gbps interfaces.  If both > interfaces are on the same subnet, the OS sees the same router (g

Re: two interfaces one subnet

On 11.05.2009, at 23:19, Alex H. Ryu wrote: Unless you configure Layer 2 for two interfaces, it's not going to work. It is invalid from networking principle. If you have to send the traffic for host in same subnet you configured, which interface it should send out ? Basically it may create

Re: two interfaces one subnet

Chris, I work with iHDTV , a project that sends uncompressed high definition television (1.5 Gbps) as UDP over two 1 Gbps interfaces. If both interfaces are on the same subnet, the OS sees the same router (gateway) address on both interfaces, and the results are sub-optimal ...

Re: two interfaces one subnet

Unless you configure Layer 2 for two interfaces, it's not going to work. It is invalid from networking principle. If you have to send the traffic for host in same subnet you configured, which interface it should send out ? Basically it may create broadcast storm loop by putting two ip addresses in

Re: two interfaces one subnet

On 11.05.2009, at 23:00, Charles Wyble wrote: What does two interfaces in one subnet mean? Two NICs? Or virtual interfaces? Two NICs, as in physical interfaces.

Re: two interfaces one subnet

What does two interfaces in one subnet mean? Two NICs? Or virtual interfaces? Mikael Abrahamsson wrote: On Mon, 11 May 2009, Chris Meidinger wrote: I've been looking through RFC's trying to find a clear statement that having two interfaces in the same subnet does not work, but can't find i

Re: two interfaces one subnet

On Mon, May 11, 2009 at 3:39 PM, Mikael Abrahamsson wrote: > ... There are "legitimate" cases where you might want to do > this. > NetApp filers consider this to be a legitimate configuration, even a "supported and recommended one". If I understand the documentation correctly, NetApp will (some

Re: two interfaces one subnet

On 11.05.2009, at 22:34, Patrick W. Gilmore wrote: On May 11, 2009, at 4:29 PM, Chris Meidinger wrote: I would be grateful for a pointer to such an RFC statement, assuming it exists. Why would an RFC prohibit this? Most _implementations_ do, but as far as network "rules" in general it is

Re: two interfaces one subnet

On Mon, 11 May 2009, Chris Meidinger wrote: I've been looking through RFC's trying to find a clear statement that having two interfaces in the same subnet does not work, but can't find it that statement anywhere. I don't know if it still works, but it did in Linux little over 10 years back.

Re: two interfaces one subnet

On May 11, 2009, at 4:29 PM, Chris Meidinger wrote: This is a pretty moronic question, but I've been searching RFC's on- and-off for a couple of weeks and can't find an answer. So I'm hoping someone here will know it offhand. I've been looking through RFC's trying to find a clear statement

two interfaces one subnet

Hi, This is a pretty moronic question, but I've been searching RFC's on- and-off for a couple of weeks and can't find an answer. So I'm hoping someone here will know it offhand. I've been looking through RFC's trying to find a clear statement that having two interfaces in the same subnet d

Re: Speaking of weird ASPATHs

Jason Lewis wrote: > I started seeing these on May 8th. > > * 95.87.192.0/18 3257 9070 43561 {196738} > * 8928 9070 43561 {196738} > *> 8928 9070 43561 {196738} > * 1273 9050 8866 43561 {196738} > * 6762 8400 8866 43561 {196

Re: Anomalies with AS13214 ?

On Mon, 11 May 2009, bmann...@vacation.karoshi.com wrote: I certainly do. This time it is a config error, next time it will be researcher X doing some testing for a NANOG paper, and the time after that it will be some RBN test to see if anyone cares anymore to look deeply into what they are t

Speaking of weird ASPATHs

I started seeing these on May 8th. * 95.87.192.0/18 3257 9070 43561 {196738} * 8928 9070 43561 {196738} *> 8928 9070 43561 {196738} * 1273 9050 8866 43561 {196738} * 6762 8400 8866 43561 {196738}

Re: Anomalies with AS13214 ?

Hi all, First, thanks for using Cyclops, and thanks for all the Cyclops users that drop me a message about this. It seems some router in AS13214 decided to originate all the prefixes and send them to AS48285 in the Caymans, all the ASPATHs are 48285 13214. The first announcement was on 20

Re: Anomalies with AS13214 ?

Hello, Jay Hennigan wrote: > We're getting cyclops[1] alerts that AS13214 is advertising itself as > origin for all of our prefixes. Their anomaly report shows thousands of > prefixes originating there. > > Anyone else seeing evidence of this or being affected? I have also seen this today for o

Re: Anomalies with AS13214 ?

On Mon, May 11, 2009 at 2:29 PM, Andree Toonk wrote: > .-- My secret spy satellite informs me that at Mon, 11 May 2009, Jay Hennigan > wrote: > >> We're getting cyclops[1] alerts that AS13214 is advertising itself as >> origin for all of our prefixes.  Their anomaly report shows thousands of >> p

Re: Anomalies with AS13214 ?

.-- My secret spy satellite informs me that at Mon, 11 May 2009, Jay Hennigan wrote: > We're getting cyclops[1] alerts that AS13214 is advertising itself as > origin for all of our prefixes. Their anomaly report shows thousands of > prefixes originating there. > > Anyone else seeing evidence

Re: PPP multilink help

To address the concerns about the overhead (FTP is still transferring that file: core.bvzn#sh proc cpu hist core.bvzn 12:44:07 PM Monday May 11 2009 EST 43322322 100 90 80 70 60 50 40 30 20 10 0511223

Re: Anomalies with AS13214 ?

Robert D. Scott wrote: It looks like Cyclops is seeing these from AS 48285, but I see no indication they are being advertised to any production upstream provider. Our /16 is being alerted in Cyclops, but I can not find any advert on any looking glass. That's what I'm seeing as well. It's possi

Re: Anomalies with AS13214 ?

Yeah, interesting contact name on this: person: Fredrik Neij address:DCPNetworks address:Box 161 address:SE-11479 Stockholm address:Sweden mnt-by: MNT-DCP phone: +46 707 323819 nic-hdl:FN2233-RIPE source: RIPE # Filtered

Re: Anomalies with AS13214 ?

anyone but me find it "unusual" that we accept behaviours by some that we would find unacceptable by others... its stuff like that which provides my strongest motivation for things like SIDR... --bill On Mon, May 11, 2009 at 05:41:36PM +0100, David Freedman wr

RE: Anomalies with AS13214 ?

It looks like Cyclops is seeing these from AS 48285, but I see no indication they are being advertised to any production upstream provider. Our /16 is being alerted in Cyclops, but I can not find any advert on any looking glass. >From Cyclops: BGP protocol Time (UTC) W/A/B Peer IP Peer ASN Prefix

Re: Anomalies with AS13214 ?

On Mon, May 11, 2009 at 12:41 PM, David Freedman wrote: > Randy doing testing again? 13214 != 3130

Re: Anomalies with AS13214 ?

Randy doing testing again? Jay Hennigan wrote: > We're getting cyclops[1] alerts that AS13214 is advertising itself as > origin for all of our prefixes. Their anomaly report shows thousands of > prefixes originating there. > > Anyone else seeing evidence of this or being affected? > > > [1] h

RE: PPP multilink help

I would also think the problem is with flow control not allowing the maximum bandwidth. Trying multiple ftp streams and seeing if that would max it out would help. I would think you would want to add a WRED to the class-default entry to prevent global tcp synchronization ... class class-defaul

Re: Anomalies with AS13214 ?

Seeing the same issues with AS13214 and no corresponding drop in traffic, route views doesn't show any rogue adverts for out prefixes either. -James On May 11, 2009, at 9:01 AM, Vincent Hoffman wrote: On 11/5/09 16:30, Jay Hennigan wrote: We're getting cyclops[1] alerts that AS13214 is ad

Re: Anomalies with AS13214 ?

On Mon, 11 May 2009, Russell Heilling wrote: Same here. Cyclops reporting an origin change but we are seeing no change in traffic levels. Still investigating at the moment... Somewhere, something is confused. I'm seeing cyclops report some of my prefixes with origins of 6364 (correct), 1321

Re: PPP multilink help

On Mon, May 11, 2009 at 10:37:25AM -0400, Andrey Gordon wrote: > Hey folks, I'm sure to you it's peanuts, but I'm a bit puzzled (most likely > because of the lack of knowledge, I bet). > > I'm buying an IP backbone from VNZ (presumably MPLS). I get a MLPPP hand off > on all sites, so I don't do th

Re: Anomalies with AS13214 ?

Same here. Cyclops reporting an origin change but we are seeing no change in traffic levels. Still investigating at the moment... 2009/5/11 Jay Hennigan > We're getting cyclops[1] alerts that AS13214 is advertising itself as > origin for all of our prefixes. Their anomaly report shows thousand

Re: PPP multilink help

Gents, On Mon, May 11, 2009 at 10:54 AM, Dan White wrote: > Andrey Gordon wrote: [snip] >> When I transfer a large file over FTP (or CIFS, or anything else), I'd >> expect it to max out either one or both T1, but instead utilization on the >> T1s is hoovering at 70% on both and sometimes MLPPP

Re: Anomalies with AS13214 ?

On 11/5/09 16:30, Jay Hennigan wrote: > We're getting cyclops[1] alerts that AS13214 is advertising itself as > origin for all of our prefixes. Their anomaly report shows thousands > of prefixes originating there. > > Anyone else seeing evidence of this or being affected? > > > [1] http://cyclops.

Anomalies with AS13214 ?

We're getting cyclops[1] alerts that AS13214 is advertising itself as origin for all of our prefixes. Their anomaly report shows thousands of prefixes originating there. Anyone else seeing evidence of this or being affected? [1] http://cyclops.cs.ucla.edu/ -- Jay Hennigan - CCIE #7880 - Ne

Re: PPP multilink help

Andrey Gordon wrote: Hey folks, I'm sure to you it's peanuts, but I'm a bit puzzled (most likely because of the lack of knowledge, I bet). I'm buying an IP backbone from VNZ (presumably MPLS). I get a MLPPP hand off on all sites, so I don't do the actual labeling and switching, so I guess for pr

PPP multilink help

Hey folks, I'm sure to you it's peanuts, but I'm a bit puzzled (most likely because of the lack of knowledge, I bet). I'm buying an IP backbone from VNZ (presumably MPLS). I get a MLPPP hand off on all sites, so I don't do the actual labeling and switching, so I guess for practical purposes what I

need help in bandwidth

Hi all Any better ways to contr ol the bandwidth? and how? eg: in hardware : switch, router or software: iptables...tc, access-list Thank you for your help

host.net contact person

Hi - I'm trying to resolve an IRRD mirroring issue. The contact e-mail "db-ad...@rr.host.net" bounces. http://rr.host.net/help-mirroring.html Does anyone have the correct address or the details of someone at host.net who could give me a hand? Thanks! -- Kind Regards, Tom Wright Internode Net