Show 159 – Finding a Way To Test It

A welcome return to the Packet Pushers of old where we get where we get a bunch of engineers around the table to generally poke sticks into a box of networking problems and laugh at the noises. Topics What VMware do with networking at VMworld Mentoring in the Day Job – how and what you do to […]

Author information

Greg Ferro

Greg Ferro is a Network Engineer/Architect, mostly focussed on Data Centre, Security Infrastructure, and recently Virtualization. He has over 20 years in IT, in wide range of employers working as a freelance consultant including Finance, Service Providers and Online Companies. He is CCIE#6920 and has a few ideas about the world, but not enough to really count.

He is a host on the Packet Pushers Podcast, blogger at EtherealMind.com and on Twitter @etherealmind and Google Plus.

The post Show 159 – Finding a Way To Test It appeared first on Packet Pushers Podcast and was written by Greg Ferro.

Let Me Tell You…

In the last post in this series, I spent some time talking about the process of detecting a link failure (given down detection is always the more important issue in fast convergence); let’s continue by looking at notification. If a router discovers a down link, or a down neighbor, how does it tell all the […]

Author information

Russ White

Russ White
Principle Engineer at Ericsson

Russ White is a Network Architect who's scribbled a basket of books, penned a plethora of patents, written a raft of RFCs, taught a trencher of classes, and done a lot of other stuff you either already know about, or don't really care about. You want numbers and letters? Okay: CCIE 2635, CCDE 2007:001, CCAr, BSIT, MSIT (Network Design & Architecture, Capella University), MACM (Biblical Literature, Shepherds Theological Seminary). Russ is a Principal Engineer in the IPOS Team at Ericsson, where he works on lots of different stuff, serves on the Routing Area Directorate at the IETF, and is a cochair of the Internet Society Advisory Council. Russ will be speaking in November at the Ericsson Technology Day. he recently published The Art of Network Architecture, is currently working on a new book in the area Continue reading

DCI with LISP for Cold Migrations

Let’s step back for a minute. So far in this series of blog posts on DCI, I’ve been focusing on extending the Layer 2 domain between data centers with the goal of supporting hot migrations — ie, moving a virtual machine between sites while it’s online and servicing users.

Is that the only objective with DCI?

Well if it was, there wouldn’t be a need for this blog post :-) Cold migrations have valid use cases too. Cold migrations occur when the virtual machine is shut down in one site and then booted in a new site. As part of that operation, typically an orchestration layer (such as VMware’s Site Recovery Manager) will poke and prod the VM to make it ready for operation in the new site. Most notably, it takes care of changing the VM’s IP address and default gateway.

Cold migrations do not have a requirement for the same IP subnet in both sites. This is because there’s no need to maintain active user sessions during the migration. Different IP subnets in the sites means no stretched Layer 2 which means no risk of combining failure domains!

What if that orchestration layer didn’t have to poke Continue reading

Healthy Paranoia Show 16: BSides DC Oktoberfest!

Willkommen, bienvenue, welcome!  Meine Damen und Herren, Mesdames et Messieurs, Ladies and Gentlemen. Introducing the latest installment in that grand epic known as Healthy Paranoia. Where the nerds are a little nerdier, and the evil bit is always set on your packets. In this episode, we help launch the very first Security Oktoberfest, aka BSides DC. […]

Author information

Mrs. Y

Snarkitecht at Island of Misfit Toys

Mrs. Y is a recovering Unix engineer working in network security. Also the host of Healthy Paranoia and official nerd hunter. She likes long walks in hubsites, traveling to security conferences and spending time in the Bat Cave. Sincerely believes that every problem can be solved with a "for" loop. When not blogging or podcasting, can be found using up her 15 minutes in the Twittersphere or Google+ as @MrsYisWhy.

The post Healthy Paranoia Show 16: BSides DC Oktoberfest! appeared first on Packet Pushers Podcast and was written by Mrs. Y.

Understanding OTV


I took notes while reading up on OTV documentation. If you don't want to read through the OTV IETF or related Cisco documentation, this can be a quick deep dive into what OTV is and how it functions. Hopefully I'll implement this in a real network sometime soon to share actual configs. 

Overlay Transport Virtualization (OTV)

OTV is a data center interconnect technology that routes mac based information by encapsulating mac addresses with IP addresses in an overlay transit network. As long as there is IP connectivity between two or more sites (DCs), OTV will function (ofcourse with the right hardware and configuration).

'MAC in IP' technique for supporting L2 VPNs over L2/L3 infrastructure. 
Routing and forwarding states are maintained at the network edge devices between sites, not within the site or core.
There is no need to extend STP across sites, and STP topologies can be local to each site.

Hardware Requirements:

As of March 2013, from here.

Cisco Nexus 7000
M1/M2 line cards
NX-OS 5.0(3) or later, 5.2(3) or 6.2(2) are Cisco recommendations
Transport Services License

Cisco ASR 1000
IOS XE 3.5 or later
Adv IP Srvcs / Adv Ent Srvcs license

The Only Two Ok Responses to Valid Feedback

Earlier this week, I wrote over on the Plexxi blog that the most important thing to look for in a potential new hire is coachability. If being coachable is the most important contributor to sustained long-term growth in employees, then how do you make yourself more coachable? There are countless tips and tricks to being […]

Author information

The post The Only Two Ok Responses to Valid Feedback appeared first on Packet Pushers Podcast and was written by Michael Bushong.

Show 158 – Avaya – Software Defined Data Centre & Fabric Connect

We’ve done many podcasts now on Software Defined Whatever. Most of those shows are focused on diving deep into SDN technology and how protocols such as OpenFlow are meant to work. Let’s face it - this is fascinating stuff to a bunch of engineers. But over and beyond just being cool technology – SDN must solve a problem.

Author information

Greg Ferro

Greg Ferro is a Network Engineer/Architect, mostly focussed on Data Centre, Security Infrastructure, and recently Virtualization. He has over 20 years in IT, in wide range of employers working as a freelance consultant including Finance, Service Providers and Online Companies. He is CCIE#6920 and has a few ideas about the world, but not enough to really count.

He is a host on the Packet Pushers Podcast, blogger at EtherealMind.com and on Twitter @etherealmind and Google Plus.

The post Show 158 – Avaya – Software Defined Data Centre & Fabric Connect appeared first on Packet Pushers Podcast and was written by Greg Ferro.

To Sit or Stand?

Unless you’ve been living under a rock for the last couple of years, I’m sure you’ve read the articles about how bad prolonged sitting is for your health. If you sit for a major part of your day (at work, in traffic and at home), your risk of diabetes and heart disease is doubled. The […]

Author information

Mrs. Y

Snarkitecht at Island of Misfit Toys

Mrs. Y is a recovering Unix engineer working in network security. Also the host of Healthy Paranoia and official nerd hunter. She likes long walks in hubsites, traveling to security conferences and spending time in the Bat Cave. Sincerely believes that every problem can be solved with a "for" loop. When not blogging or podcasting, can be found using up her 15 minutes in the Twittersphere or Google+ as @MrsYisWhy.

The post To Sit or Stand? appeared first on Packet Pushers Podcast and was written by Mrs. Y.

IPv6 Implementation beyond theory & How playing with RA messages may be issue-istic

How does the internet work - We know what is networking

Some of this things I read in books and some of them took me few days of troubleshooting and sweating to get to them so I give them for free here to save you fellow networker some time: SLAAC The mighty SLAAC is the prefered method of IPv6 allocation, but is it so mighty? Or it […]

IPv6 Implementation beyond theory & How playing with RA messages may be issue-istic

Networking Field Day 6

I’ll be attending Networking Field Day 6 in San Jose, CA from September 11 - 13th. I am both honored and humbled to be a part of this event, and I am counting the days until my flight leaves for Silicon Valley. I love the area in general, as I’ve been there several times now - but having the privilege to go back for something like Networking Field Day is truly exciting.

Networking Field Day 6

I’ll be attending Networking Field Day 6 in San Jose, CA from September 11 - 13th. I am both honored and humbled to be a part of this event, and I am counting the days until my flight leaves for Silicon Valley. I love the area in general, as I’ve been there several times now - but having the privilege to go back for something like Networking Field Day is truly exciting.

RSVP Per Flow Limit and RSVP Call Rate

When configuring RSVP, the “ip rsvp bandwidth (bandwidth) [per flow limit]” command there is an optional parameter which limits the per flow bandwidth of individual RSVP reservation.  When using Call Admission Control for VoIP, that is the rate of an individual voice call in one direction, but the behavior is not as clear cut as it seems.

This feature was added to prevent other application from reserving all of interface’s reservable bandwidth.  If a video application uses RSVP within the network, it can take up majority of the reservation with a single video call.  For example if the smallest interface only has 500 kbps RSVP bandwidth and a video conference request all 500 kbps, no voice calls will be allowed through. Per flow limit wouldn’t allow one reservation to request all of the bandwidth. There are other methods to limit other application’s ability to reserve bandwidth with a more granular method using a RSVP local policy.

The actual VoIP rate is depended on many factors such as codec, sampling rate and header overhead.[1] The most common codec is either G.711 or G.729. For the G.711 codec, the IP rate is 80 Continue reading

How Fast is Fast?

“How fast is fast?” In the “bad old days,” when routing protocols were young, and we still shot NERF guns at one another in TAC, IGRP was a going concern (not EIGRP, IGRP!). IGRP holds the distinction of being the slowest converging routing protocol (with default timers) ever deployed in real networks. How slow is […]

Author information

Russ White

Russ White
Principle Engineer at Ericsson

Russ White is a Network Architect who's scribbled a basket of books, penned a plethora of patents, written a raft of RFCs, taught a trencher of classes, and done a lot of other stuff you either already know about, or don't really care about. You want numbers and letters? Okay: CCIE 2635, CCDE 2007:001, CCAr, BSIT, MSIT (Network Design & Architecture, Capella University), MACM (Biblical Literature, Shepherds Theological Seminary). Russ is a Principal Engineer in the IPOS Team at Ericsson, where he works on lots of different stuff, serves on the Routing Area Directorate at the IETF, and is a cochair of the Internet Society Advisory Council. Russ will be speaking in November at the Ericsson Technology Day. he recently published The Art of Network Architecture, is currently working on a new book in Continue reading

There’s No Stupid Question, But…

While I’m a big proponent of people asking questions, there are a few considerations that I’d like to address. These considerations are not about looking (or sounding) “stupid” or otherwise inhibiting the necessary free flow of information. These points are about the appropriateness and reasons for asking a question or series of questions. This article […]

Author information

Paul Stewart

Paul is a Network and Security Engineer, Trainer and Blogger who enjoys understanding how things really work. With nearly 15 years of experience in the technology industry, Paul has helped many organizations build, maintain and secure their networks and systems. Paul also writes technical content at PacketU.

The post There’s No Stupid Question, But… appeared first on Packet Pushers Podcast and was written by Paul Stewart.

A Question of DNS Protocols

One of the most prominent denial of service attacks in recent months was one that occurred in March 2013, launched against Spamhaus and Cloudflare. With a peak volume of attack traffic of some 120Gbps, it was a very significant attack. How did the attackers generate such massive volumes of attack traffic? The answer lies in the Domain Name System (DNS). The attackers asked about domain names, and the DNS system answered. Something we all do all of the time on the Internet. So how can a conventional activity of translating a domain name into an IP address be turned into a massive attack?

Using Deny ACEs in your PBR ACL on your Nexus 7k

Quite a while ago I had a need for some network duct tape… Policy Based Routing while useful should only IMHO be used as a temporary fix. But as you know, temporary things soon become part of production and they end up staying around far too long. But I digress. I had a need for some PBR, but soon found out that NX-OS had no support for deny entries in your ACL. This can pose an issue depending on the amount of destinations needed. Mine needed to match everything on the internet, minus RFC1918, and some internal VPN routes and such. Over time, I ended up having to rewrite this 100 line ACL several times, until I saw that NX-OS 6.1(3) had support for deny statements.

I was so excited, I immediately rewrote my ACL into a very svelte 20 lines including remarks. My change window came, I applied my ACL, and was faced with an error message. Luckily, I quickly figured out that we need to enable the ability to use denies.

nexus-7010(config)# hardware access-list allow deny ace

Honestly, I just wanted to get this bit of info out there as I haven’t really seen information on it. Continue reading

RSVP Bandwidth on DMVPN Tunnels

Configuring RSVP on DMVPN mGRE tunnels requires few extra steps and a little bit of calculations to figure out the additional overhead. Without correctly configured overhead, the mismatch between RSVP and available LLQ bandwidth can cause degraded VoIP call performance.

Tunnel Bandwidth

By default, the bandwidth value on the tunnel interfaces is set to a low value. Older IOS versions use 8 Kbps while some of the newer IOS versions use 100 Kbps. The idea behind setting such a low bandwidth value is to make it less preferred by routing protocols like EIGRP and OSPF that rely on bandwidth for metric calculation to prevent recursive routing.

A low bandwidth value set on a tunnel interface can cause RSVP problem. If RSVP is enabled on a tunnel interface, by default 75% of its bandwidth is reserved for RSVP. Eight kbps or 100 kbps is too small for any VoIP calls. Ensure that that the correct bandwidth of the underlying physical interface is manually set. It is very easy to miss that Tun2 only have 75 Kbps of reservable bandwidth, while Gi0/2 has 75 Mbps.

b-ro02#sh ip rsvp interface
interface    rsvp  allocated  i/f max  flow max sub max  VRF
Gi0/0        ena   0          Continue reading