Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
tortilla_chip
Jun 13, 2007

k-partite
Most carriers aren't leaving route selection up to AS_PATH, but assign LOCAL_PREF depending on a variety of voodoo (customer vs. paid peer vs. settlement free, POP origin, link capacity, etc.)

Adbot
ADBOT LOVES YOU

madsushi
Apr 19, 2009

Baller.
#essereFerrari

adorai posted:

out of curiousity, at what size of business (bank if it matters) should I be to (be worried about) get my own AS?

At least 125 public IPs in use. You can get an ASN from ARIN easily, but you don't need it unless you have IP space, and you don't need/can't get IP space unless you can fill 50% of a /24. (Actually it might be 80% now)

CrazyLittle
Sep 11, 2001





Clapping Larry

Powercrazy posted:

If you host public web services and have IPv4 space, you should have your own AS number. They are easy to get unlike IP addresses.

Also if you want your own portable IPv6 space, you'll need an ASN.

inignot
Sep 1, 2003

WWBCD?

adorai posted:

out of curiousity, at what size of business (bank if it matters) should I be to (be worried about) get my own AS?

An intent to dual home with two ISPs is enough to justify an AS for ARIN.

Collateral Damage
Jun 13, 2009

Powercrazy posted:

Is it an autonomous AP? Because if so, I'd say because it is sending tagged frames.
Turned out to be a firmware bug. :argh:

doomisland
Oct 5, 2004

Powercrazy posted:

If you host public web services and have IPv4 space, you should have your own AS number. They are easy to get unlike IP addresses.

16 bit ASNs are the next big thing!

madsushi posted:

At least 125 public IPs in use. You can get an ASN from ARIN easily, but you don't need it unless you have IP space, and you don't need/can't get IP space unless you can fill 50% of a /24. (Actually it might be 80% now)

Note: The IPs do not have to be on the public internet just as long as they're used ;)

ragzilla
Sep 9, 2005
don't ask me, i only work here


Powercrazy posted:

Hmm.

Well how about this scenario. We have multiple providers and we are trying to get to a remote AS, (AWS Tokyo) from New York. Somewhere in the BGP chosen return path is congestion/loss/internet fuckery. So our ~200Mb/s SCP transfer speeds drop to 150kb/s. AS-prepend didn't redirect the return path traffic for whatever reason, but withdrawing the prefix from one of our providers, using a do not advertise community did work to shift return traffic to the other provider, and more importantly fixed the slow transfer speeds.

What would you do to address it? Note that i'm not a carrier or anything, this is just our own prefix from our own AS, dual homed.

In order of preference:
Carrier specific prepend/suppression communities (usually only works if the guy 2 hops out you're trying to avoid is a peer, not customer, of your provider).
TE prefix on your other carriers if you can (assumes you're advertising /23s or shorter).
AS path poisoning your prefix on that transit (wouldn't do this long term)

Moey
Oct 22, 2010

I LIKE TO MOVE IT

Upgrade to something more current.

Thanks Ants
May 21, 2004

#essereFerrari


In the world of a huge number of services being hosted on public cloud providers, and those services all using HTTPS, how are people ensuring the correct QoS is applied to different services? Say I have a web application that all the company employees practically live in, it's hosted on AWS and maybe it pulls files attached to records out of S3. If the marketing department uses a file transfer service that uses S3 at the backend, how are people ensuring that the large download is treated at a lower priority than the smaller requests to the business application? Are there firewall features that can look at how much traffic has been transferred in a certain time period in one session and decide it's a download, do I need to hope that the applications work in such a way that I can identify their requests by looking at the DNS hostnames, or is the correct answer to use something like AWS Direct Connect for the business app and let everything else happen over the Internet?

abigserve
Sep 13, 2009

this is a better avatar than what I had before

Powercrazy posted:

Only takes one transit AS to strip the duplicate path, and then it does nothing.

Yeah I mean your upstream carrier, as soon as it gets more than one AS away you're out of luck.

madsushi
Apr 19, 2009

Baller.
#essereFerrari
The ScreenOS master password:

<<< %s(un='%s') = %u

Rapid7 write-up

They say ~25k internet-exposed ScreenOS boxes, although I assume (and hope) many were patched.

Prescription Combs
Apr 20, 2005
   6
Shame on your for using a NetScreen in TYOOL2015

Computer Serf
May 14, 2005
Buglord
Researching 720p 30FPS+ video conference capability (mainly for 30fps screensharing actually)..

Looking into H323/SIP P2P endpoints/codecs in 2016 and it's all still multi-thousand dollar dedicated hardware systems. Meanwhile teens are trailblazing live video broadcasts from their bedroom with $200 capture cards livestreaming 1080p60fps across the globe via youtube/twitch ... is there really no middle ground for live P2P HQ video chat?

Computer Serf fucked around with this message at 09:04 on Dec 21, 2015

falz
Jan 29, 2005

01100110 01100001 01101100 01111010
A pair of xbones with kinekt and Skype does head tracking fwiw.

BurgerQuest
Mar 17, 2009

by Jeffrey of YOSPOS

Panda Time posted:

Researching 720p 30FPS+ video conference capability (mainly for 30fps screensharing actually)..

Looking into H323/SIP P2P endpoints/codecs in 2016 and it's all still multi-thousand dollar dedicated hardware systems. Meanwhile teens are trailblazing live video broadcasts from their bedroom with $200 capture cards livestreaming 1080p60fps across the globe via youtube/twitch ... is there really no middle ground for live P2P HQ video chat?

I wouldn't consider that an apples and oranges comparison. One is a platform designed around the distribution of living streaming content to as many users as possible while injecting ads to generate revenue to cover the incredible costs of doing this. The other is trying to rely on god knows what kind of internet circuit between two points and hoping for the best. They have to make money somewhere so... hardware it is.

n0tqu1tesane
May 7, 2003

She was rubbing her ass all over my hands. They don't just do that for everyone.
Grimey Drawer
None of the software solutions do great echo cancellation either, which the hardware systems do a pretty good job on.

FatCow
Apr 22, 2002
I MAP THE FUCK OUT OF PEOPLE
We use something similar to these: http://www.forbes.com/sites/roberthof/2014/02/06/google-launches-999-meeting-room-in-a-box/ It's basicaly a PC that boots straight to hangouts. Works better than any paid solution I've seen. And I believe you don't need a Google account to join a hangout anymore either. (That may be a paid feature with Gapps for work)

Collateral Damage
Jun 13, 2009

Lol Forbes. "Turn off your ad blocker to continue." :fuckoff:

DigitalMocking
Jun 8, 2010

Wine is constant proof that God loves us and loves to see us happy.
Benjamin Franklin
All right ciscogoons, I've got one that has me stumped.

Setting up a new MPLS circuit. Vendor configures BGP, I configure BGP, we connect, all is well, except I'm not getting all the routes he's advertising to me.

My router: 172.16.55.1 ASN 100
Vendor router: 172.16.55.2 ASN 65333

What I'm receiving and putting into the routing table:
code:
us-2911-1#sh ip bgp neighbors 172.16.55.2 received-routes
BGP table version is 42, local router ID is 68.137.185.66
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *   10.22.55.0/30    172.16.55.2                            0 65333 7385 7385 i
 *   67.136.70.0/29   172.16.55.2                            0 65333 7385 ?
 *   70.98.151.176/29 172.16.55.2              0             0 65333 ?
 *   172.16.55.0/30   172.16.55.2              0             0 65333 ?

Total number of prefixes 4

us-2911-1#sh ip bgp neighbors 172.16.55.2 routes
BGP table version is 42, local router ID is 68.137.185.66
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>  10.22.55.0/30    172.16.55.2                          100 65333 7385 7385 i
 *>  67.136.70.0/29   172.16.55.2                          100 65333 7385 ?
 *>  70.98.151.176/29 172.16.55.2              0           100 65333 ?
 *   172.16.55.0/30   172.16.55.2              0           100 65333 ?

Total number of prefixes 4
However, this is what his router is advertising:
code:
145550#show ip bgp neighbors 172.16.55.1 advertised-routes
BGP table version is 93, local router ID is 70.98.151.179
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, x best-external, f RT-Filter
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 10.21.8.0/24     172.16.55.1                            0 100 65000 65000 ?
*> 10.21.12.0/24    172.16.55.1                            0 100 65000 65000 ?
*> 10.21.14.0/24    172.16.55.1                            0 100 65000 65000 ?
*> 10.21.15.0/24    172.16.55.1                            0 100 65000 65000 ?
*> 10.22.0.0/24     172.16.55.1                            0 100 393887 ?
*> 10.22.2.0/24     70.98.151.177                          0 7385 7385 100 ?
*> 10.22.4.0/24     70.98.151.177                          0 7385 7385 100 ?
*> 10.22.55.0/30    70.98.151.178                          0 7385 7385 i
*> 10.30.0.0/16     172.16.55.1                            0 100 65000 65000 ?
*> 10.212.134.0/24  172.16.55.1                            0 100 393887 ?
*> 67.136.70.0/29   70.98.151.177                          0 7385 ?
*> 68.137.185.64/30 172.16.55.1              0             0 100 ?
*> 68.139.88.176/30 172.16.55.1                            0 100 65000 i
*> 70.98.151.176/29 0.0.0.0                  0         32768 ?
*> 100.65.0.4/30    172.16.55.1                            0 100 65001 3549 i
*> 110.143.8.170/32 172.16.55.1                            0 100 65000 65000 ?
*> 124.148.21.4/30  172.16.55.1                            0 100 65000 65000 ?
*> 150.101.32.92/32 172.16.55.1                            0 100 65000 65000 ?
*> 152.161.10.4/30  172.16.55.1                            0 100 65000 ?
*> 172.16.0.0/24    172.16.55.1              0             0 100 ?
*> 172.16.0.0       172.16.55.1              0             0 100 ?
*> 172.16.15.0/24   172.16.55.1              0             0 100 ?
*> 172.16.55.0/30   0.0.0.0                  0         32768 ?
*> 172.18.80.0/24   172.16.55.1              0             0 100 ?
*> 202.45.105.224/32
                    172.16.55.1                            0 100 65000 65000 ?
*> 203.45.253.1/32  172.16.55.1                            0 100 65000 65000 ?

Total number of prefixes 26
Some of those routes are my routes being advertised back to me, no problem, that's normal for BGP, but the routes for 10.22.0.0/24 10.22.2.0/24 and 10.22.4.0/24 are being advertised according to his router, but I'm not seeing them on mine.

So I decide to do a wireshark capture and the first message from him is a BGP update:
code:
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 67
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 0
    Total Path Attribute Length: 32
    Path attributes
        Path Attribute - ORIGIN: INCOMPLETE
            Flags: 0x40, Transitive: Well-known, Transitive, Complete
                0... .... = Optional: Well-known
                .1.. .... = Transitive: Transitive
                ..0. .... = Partial: Complete
                ...0 .... = Length: Regular length
            Type Code: ORIGIN (1)
            Length: 1
            Origin: INCOMPLETE (2)
        Path Attribute - AS_PATH: 65333 7385 7385 100 
            Flags: 0x40, Transitive: Well-known, Transitive, Complete
                0... .... = Optional: Well-known
                .1.. .... = Transitive: Transitive
                ..0. .... = Partial: Complete
                ...0 .... = Length: Regular length
            Type Code: AS_PATH (2)
            Length: 18
            AS Path segment: 65333 7385 7385 100
                Segment type: AS_SEQUENCE (2)
                Segment length (number of ASN): 4
                AS4: 65333
                AS4: 7385
                AS4: 7385
                AS4: 100
        Path Attribute - NEXT_HOP: 172.16.55.2 
            Flags: 0x40, Transitive: Well-known, Transitive, Complete
                0... .... = Optional: Well-known
                .1.. .... = Transitive: Transitive
                ..0. .... = Partial: Complete
                ...0 .... = Length: Regular length
            Type Code: NEXT_HOP (3)
            Length: 4
            Next hop: 172.16.55.2
    Network Layer Reachability Information (NLRI)
        10.22.2.0/24
            NLRI prefix length: 24
            NLRI prefix: 10.22.2.0
        10.22.4.0/24
            NLRI prefix length: 24
            NLRI prefix: 10.22.4.0
        10.22.0.0/24
            NLRI prefix length: 24
            NLRI prefix: 10.22.0.0
So... wtf Cisco?

ragzilla
Sep 9, 2005
don't ask me, i only work here


DigitalMocking posted:

All right ciscogoons, I've got one that has me stumped.

Setting up a new MPLS circuit. Vendor configures BGP, I configure BGP, we connect, all is well, except I'm not getting all the routes he's advertising to me.

My router: 172.16.55.1 ASN 100
Vendor router: 172.16.55.2 ASN 65333

What I'm receiving and putting into the routing table:
:words:

So... wtf Cisco?

Your local AS is 100? Do you have allowas-in turned on?

ate shit on live tv
Feb 15, 2004

by Azathoth
You have an import-list? Or a prefix list? You learning those routes via a different IGP? Have you tried to debug the bgp process, and the routing table to see why the routes aren't being imported even though they are being received?

Also yea this:

ragzilla posted:

Your local AS is 100? Do you have allowas-in turned on?

madsushi
Apr 19, 2009

Baller.
#essereFerrari

DigitalMocking posted:

All right ciscogoons, I've got one that has me stumped.

Setting up a new MPLS circuit. Vendor configures BGP, I configure BGP, we connect, all is well, except I'm not getting all the routes he's advertising to me.

What do your route-maps and import policies look like?

DigitalMocking
Jun 8, 2010

Wine is constant proof that God loves us and loves to see us happy.
Benjamin Franklin

ragzilla posted:

Your local AS is 100? Do you have allowas-in turned on?

I'm an idiot.

Thanks.

H.R. Paperstacks
May 1, 2006

This is America
My president is black
and my Lambo is blue
What is everyone using for inventory tracking and does it support parent/child relationships for piece parts (line cards / modules)? We currently use an Excel spreadsheet that I built with respective tabs for each site, drop-down menus for most of the column information, and it has several functions and formulas for populating contract information from a sheet that has all of the appropriate information provided from the vendor.

I want something internally accessible that runs on a LAMP environment so I can query it directly for various checks, population of devices for scripting, etc. Basically a good host database that scales well with custom fields. I looked into racktables.org, but I have an IPAM solution (phpIPAM) and don't want to migrate away from it and in order to populate devices and their respective IP's, the IP subnets had to be defined as well, which just doubles up the work. I'm looking at using the custom fields within phpIPAM but I'd rather not extend/hack my IPAM solution into an inventory tracker as that isn't the projects original intention.

Anytime I go looking for a solution I end up saying "I should just convert the excel document into a php/mysql setup and be done with it" because what's out there either doesn't function in enough detail or comes with a bunch of extra features I don't want/need. I figured I would ask again before just building something myself.

DigitalMocking
Jun 8, 2010

Wine is constant proof that God loves us and loves to see us happy.
Benjamin Franklin

H.R. Paperstacks posted:

What is everyone using for inventory tracking and does it support parent/child relationships for piece parts (line cards / modules)? We currently use an Excel spreadsheet that I built with respective tabs for each site, drop-down menus for most of the column information, and it has several functions and formulas for populating contract information from a sheet that has all of the appropriate information provided from the vendor.

I want something internally accessible that runs on a LAMP environment so I can query it directly for various checks, population of devices for scripting, etc. Basically a good host database that scales well with custom fields. I looked into racktables.org, but I have an IPAM solution (phpIPAM) and don't want to migrate away from it and in order to populate devices and their respective IP's, the IP subnets had to be defined as well, which just doubles up the work. I'm looking at using the custom fields within phpIPAM but I'd rather not extend/hack my IPAM solution into an inventory tracker as that isn't the projects original intention.

Anytime I go looking for a solution I end up saying "I should just convert the excel document into a php/mysql setup and be done with it" because what's out there either doesn't function in enough detail or comes with a bunch of extra features I don't want/need. I figured I would ask again before just building something myself.

I set up netdot about a year and a half ago and just half-assed most of it, but its turned out to be surprisingly useful once you start putting some time into it.

https://osl.uoregon.edu/redmine/projects/netdot

There's whole sections I just don't use, but for asset tracking and referencing back to our internal asset tags as well as contracts it works great.

We also use the IPAM religiously, which was a huge step up from excel spreadsheets.

FatCow
Apr 22, 2002
I MAP THE FUCK OUT OF PEOPLE
http://racktables.org/

Slickdrac
Oct 5, 2007

Not allowed to have nice things

H.R. Paperstacks posted:

What is everyone using for inventory tracking

A roll of numbered stickers and an excel sheet managed by a small dedicated internal team. With some extra support from fairy dust and good feelings.

It works for a multi billion dollar company, it can work for you!

Bigass Moth
Mar 6, 2004

I joined the #RXT REVOLUTION.
:boom:
he knows...
I wish someone had told me about translatorx a long time ago. What a great program for collaboration trace file analysis.

Partycat
Oct 25, 2004

It get used in TVOICE for course work , and, maybe you could use it for your IRL job / work, but that exam also expects you know how to read some of the traces as they are without that utility.

Bigass Moth
Mar 6, 2004

I joined the #RXT REVOLUTION.
:boom:
he knows...
Yeah the exams don't use it but its great for irl.

22 Eargesplitten
Oct 10, 2010



I'm reviewing summarization, and I think the guy making the video made a mistake. He said that networks on 10.1.1.0, 10.1.2.0, 10.1.3.0, and 10.1.4.0 would be a 24 bit mask, and that since the first five bits of the third octet are all the same, the summarization would lead to a 29 bit mask. I'm thinking he screwed up and said 24 when he should have said 16. Am I right?

Thanks Ants
May 21, 2004

#essereFerrari


I'm rusty at this but I don't think you can summarise 10.1.1.0 thru 10.1.4.255. You can do 10.1.0.0/19 to get 4 /24 subnets, but that doesn't include 10.1.4.0/24

22 Eargesplitten
Oct 10, 2010



The video said the network ID would be 10.1.0.0, and the mask would be /29. Maybe I should watch some other videos. Most of the videos seem okay, and they're free on Linda, but Laz Diaz misspeaks a lot.

Filthy Lucre
Feb 27, 2006
10.1.0.0/19 would be 10.1.0.0 - 10.1.31.255.

If you need four /24 networks, you would use a /22.

If you specifically needed 10.1.1.0/24 through 10.1.4.255, you would have to use 10.1.0.0/21 and have some unused space.

10.1.0.0/22 would be 10.1.0.0 -10.1.3.255, so if you needed 10.1.4.0/24, you'l need to shift over one more bit.

Thanks Ants
May 21, 2004

#essereFerrari


Jesus I can't type. Not sure where I got the /19 from up there. Sorry if that confused anyone.

falz
Jan 29, 2005

01100110 01100001 01101100 01111010
It sounds like the 3rd and 4th octets were flip flopped and he's talking about the first four usable in 10.1.0.0/29 (.1 - .4 of .1 - .6 usable)

Bigass Moth
Mar 6, 2004

I joined the #RXT REVOLUTION.
:boom:
he knows...
Does anyone have a reputable site to purchase Cisco odds and ends at a consumer level? For instance, I need a power cable for my 2801 router at home.

Collateral Damage
Jun 13, 2009

Isn't that just a regular IEC C13 connector?

Bigass Moth
Mar 6, 2004

I joined the #RXT REVOLUTION.
:boom:
he knows...
True, I guess I don't care if it's the Cisco approved cable since its for home. Just bought some generics.

Adbot
ADBOT LOVES YOU

Collateral Damage
Jun 13, 2009

Yeah just get a $5 one from your nearest electronics store.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply