Speeding up bgpq4 with IRRd in a container

When building route filters with bgpq4 or bgpq3, the speed of rr.ntt.net or whois.radb.net can be a bottleneck. Updating many filters may take several tens of minutes, depending on the load:

$ time bgpq4 -h whois.radb.net AS-HURRICANE | wc -l
909869
1.96s user 0.15s system 2% cpu 1:17.64 total
$ time bgpq4 -h rr.ntt.net AS-HURRICANE | wc -l
927865
1.86s user 0.08s system 12% cpu 14.098 total

A possible solution is to have your own IRRd instance in your network, mirroring the main routing registries. A close alternative is to bundle IRRd with all the data in a ready-to-use Docker image. This also has the advantage of easy integration into a Docker-based CI/CD pipeline.

$ git clone https://github.com/vincentbernat/irrd-legacy.git -b blade/master
$ cd irrd-legacy
$ docker build . -t irrd-snapshot:latest
[…]
Successfully built 58c3e83a1d18
Successfully tagged irrd-snapshot:latest
$ docker container run --rm --detach --publish=43:43 irrd-snapshot
4879cfe7413075a0c217089dcac91ed356424c6b88808d8fcb01dc00eafcc8c7
$ time bgpq4 -h localhost AS-HURRICANE | wc -l
904137
1.72s user 0.11s system 96% cpu 1.881 total

The Dockerfile contains three stages:

1. building IRRd,¹
2. retrieving various IRR databases, and
3. assembling Continue reading

Feedback: VMware NSX Deep Dive

The mission of ipSpace.net is very simple: explain new networking technologies and products in a no-nonsense marketing-free and hopefully understandable way.

Sometimes we’re probably way off the mark, but every now and then we get it just right as evidenced by this feedback from one of our subscribers:

I was given short notice to present a board-level overview of VMWare NSX-T for an urgent virtualization platform change from Microsoft. Tech execs needed to understand NSX-T’s position in the market, in its product lifecycle, feature advantages, possible feature deficits, and an idea of the level of effort for implementation.

Feedback: VMware NSX Deep Dive

The mission of ipSpace.net is very simple: explain new networking technologies and products in a no-nonsense marketing-free and hopefully understandable way.

Sometimes we’re probably way off the mark, but every now and then we get it just right as evidenced by this feedback from one of our subscribers:

I was given short notice to present a board-level overview of VMWare NSX-T for an urgent virtualization platform change from Microsoft. Tech execs needed to understand NSX-T’s position in the market, in its product lifecycle, feature advantages, possible feature deficits, and an idea of the level of effort for implementation.

NSX deep dive sessions at VMworld 2020

It’s that time of year again; VMworld!  This VMworld is unprecedented in its delivery this year.  VMworld 2020 will be entirely online and general sessions available for anyone who wants to attend for free!  There is a small fee track for Premier pass which has access to additional sessions.  More on that in the links below.  The numbers we’re seeing for potential attendees is staggering and people who may not have been able to attend in the past, can now join their industry peers for discussions, hands-on labs, and breakout and keynote sessions.

At previous VMworld events, it could be difficult to attend all the sessions you wanted, as they may have had times where one or more overlapped.  This year, the majority of our sessions are on-demand for the attendee convenience.   Log on and watch whatever the session you want, whenever you want.  To ensure you don’t miss out on all the deepest technical NSX content the Network and Security Business Unit at VMware as created, we’ve come up with a list of sessions for you to check out:

Security

Apply Consistent Security Across VMs, Containers and Physical Server with NSX-T [ISNS1272]
Continue reading

Tech Bytes: Fortinet’s SD-WAN Is Good Medicine For Healthcare Provider’s Video App (Sponsored)

Tech Bytes: Fortinet’s SD-WAN Is Good Medicine For Healthcare Provider’s Video App (Sponsored)

Urgent care company PM Pediatrics relies on SD-WAN from Fortinet to provide the performance and security to support real-time voice and video applications as well as other critical apps, and to help cut bandwidth costs and streamline operations. Our guest is John Tabako, Director of IT Infrastructure for PM Pediatrics.

The post Tech Bytes: Fortinet’s SD-WAN Is Good Medicine For Healthcare Provider’s Video App (Sponsored) appeared first on Packet Pushers.

Pure Vector Engines Get GPU Math Help for Next Earth Simulator

For those who have followed the evolution of supercomputing over the years, the Earth Simulator series of systems has represented the state of the art in workload-oriented design. …

Pure Vector Engines Get GPU Math Help for Next Earth Simulator was written by Nicole Hemsoth at The Next Platform.

Birthday Week on Cloudflare TV: Announcing 24 Hours of Live Discussions on the Future of the Internet

This week marks Cloudflare’s 10th birthday, and we’re excited to continue our annual tradition of launching an array of products designed to help give back to the Internet. (Check back here each morning for the latest!)

We also see this milestone as an opportunity to reflect on where the Internet was ten years ago, and where it might be headed over the next decade. So we reached out to some of the people we respect most to see if they’d be interested in joining us for a series of Fireside Chats on Cloudflare TV.

We’ve been blown away by the response, and are thrilled to announce our lineup of speakers, featuring many of the most celebrated names in tech and beyond. Among the highlights: Apple co-founder Steve Wozniak, Zoom CEO Eric Yuan, OpenTable CEO Debby Soo, Stripe co-founder and President John Collison, Former CEO & Executive Chairman, Google // Co-Founder, Schmidt Futures. Eric Schmidt, former McAfee CEO Chris Young, Magic Leap CEO and longtime Microsoft executive Peggy Johnson, former Seal Team 6 Commander Dave Cooper, Project Include CEO Ellen Pao, and so many more. All told, we have over 24 hours Continue reading

Random Thoughts

This week is very busy for me, so rather than writing a single long, post, I’m throwing together some things that have been sitting in my pile to write about for a long while.

From Dalton Sweeny:

A physicist loses half the value of their physics knowledge in just four years whereas an English professor would take over 25 years to lose half the value of the knowledge they had at the beginning of their career. . . Software engineers with a traditional computer science background learn things that never expire with age: data structures, algorithms, compilers, distributed systems, etc. But most of us don’t work with these concepts directly. Abstractions and frameworks are built on top of these well studied ideas so we don’t have to get into the nitty-gritty details on the job (at least most of the time).

This is precisely the way network engineering is. There is value in the kinds of knowledge that expire, such as individual product lines, etc.—but the closer you are to the configuration, the more ephemeral the knowledge is. This is one of the entire points of rule 11 is your friend. Learn the foundational things that make learning the ephemeral things Continue reading

Network Break 303: Ericsson Acquires Cradlepoint For WAN Connectivity; HPE/Silver Peak Deal Closes

Network Break 303: Ericsson Acquires Cradlepoint For WAN Connectivity; HPE/Silver Peak Deal Closes

Today's Network Break starts with follow-up to correct a few items, and then dives into Ericsson's Cradlepoint acquisition. On the acquisition front, HPE finalizes its Silver Peak purchase, Kentik adds synthetics to its visibility platform, Cisco bets on a live, in-person event in 2021, and more tech news.

The post Network Break 303: Ericsson Acquires Cradlepoint For WAN Connectivity; HPE/Silver Peak Deal Closes appeared first on Packet Pushers.

The Week in Internet News: Lawmakers Hampered by Poor Internet Service

Too slow: Some state lawmakers in New Mexico are having trouble attending virtual committee meetings because of poor Internet service, Government Technology reports. State Rep. Micaela Lara Cadena has to share a slow connection with her children, who are attending virtual school. “The only Internet I can get comes through a phone line,” she said. “There’s no broadband, no fiber optics.”

Kicked out: Facebook and Twitter have removed several hundred fake accounts they said are linked to Russian military intelligence and other Kremlin-backed actors previously tied to interference in U.S. politics, NPR reports. The accounts were not tied to interference in the 2020 U.S. election, Facebook said, but they were linked to past attempts.

Investigating speech: In other Facebook news, the social media company is facing an investigation by a New Delhi government committee over its alleged role in religious riots earlier this year, CNN says. This is the second time in recent weeks that Facebook has been investigated for being used to spread controversial speech. Earlier, Facebook allowed a politician from India’s ruling party to remain on its platform even though his anti-Muslim posts appeared to violate rules against hate speech. 

Targeting the dark web: One Continue reading

Introducing Cron Triggers for Cloudflare Workers

Today the Cloudflare Workers team is thrilled to announce the launch of Cron Triggers. Before now, Workers were triggered purely by incoming HTTP requests but starting today you’ll be able to set a scheduler to run your Worker on a timed interval. This was a highly requested feature that we know a lot of developers will find useful, and we’ve heard your feedback after Serverless Week.

We are excited to offer this feature at no additional cost, and it will be available on both the Workers free tier and the paid tier, now called Workers Bundled. Since it doesn’t matter which city a Cron Trigger routes the Worker through, we are able to maximize Cloudflare’s distributed system and send scheduled jobs to underutilized machinery. Running jobs on these quiet machines is both efficient and cost effective, and we are able to pass those cost savings down to you.

What is a Cron Trigger and how might I use such a feature?

In case you’re not familiar with Unix systems, the cron pattern allows you to schedule jobs to run periodically at fixed intervals or at scheduled times. Cron Triggers in the context of Workers allow users to set time-based invocations Continue reading

Making Time for Cron Triggers: A Look Inside

Today, we are excited to launch Cron Triggers to the Cloudflare Workers serverless compute platform. We’ve heard the developer feedback, and we want to give our users the ability to run a given Worker on a scheduled basis. In case you’re not familiar with Unix systems, the cron pattern allows developers to schedule jobs to run at fixed intervals. This pattern is ideal for running any types of periodic jobs like maintenance or calling third party APIs to get up-to-date data. Cron Triggers has been a highly requested feature even inside Cloudflare and we hope that you will find this feature as useful as we have!

Where are Cron Triggers going to be run?

Cron Triggers are executed from the edge. At Cloudflare, we believe strongly in edge computing and wanted our new feature to get all of the performance and reliability benefits of running on our edge. Thus, we wrote a service in core that is responsible for distributing schedules to a new edge service through Quicksilver which will then trigger the Workers themselves.

What’s happening under the hood?

At a high level, schedules created through our API create records in our database with the information necessary to execute Continue reading

Security’s Role in Client to Cloud Networking

The Networking industry is undergoing a metamorphosis. Modern networking operations teams are challenged to cope with multiple operational models. As attackers become better and better at breaching our defenses, security analysts are increasingly at the heart of a security organization. The operators are responsible for detecting, investigating and remediating potential breaches before they progress into brand, customer, financial and IP damage. This confluence of DevOps, NetOps, SecOps, and CloudOps demands persistent operations control. How do you cope with decades of security, threat and cyber detection done in reactive silos? What happens as more workloads move to the cloud? At Arista, we value our ecosystem of security partners and networking must adapt to the new complex threats.

Security’s Role in Client to Cloud Networking

The Networking industry is undergoing a metamorphosis. Modern networking operations teams are challenged to cope with multiple operational models. As attackers become better and better at breaching our defenses, security analysts are increasingly at the heart of a security organization. The operators are responsible for detecting, investigating and remediating potential breaches before they progress into brand, customer, financial and IP damage. This confluence of DevOps, NetOps, SecOps, and CloudOps demands persistent operations control. How do you cope with decades of security, threat and cyber detection done in reactive silos? What happens as more workloads move to the cloud? At Arista, we value our ecosystem of security partners and networking must adapt to the new complex threats.

Workers Durable Objects Beta: A New Approach to Stateful Serverless

We launched Cloudflare Workers® in 2017 with a radical vision: code running at the network edge could not only improve performance, but also be easier to deploy and cheaper to run than code running in a single datacenter. That vision means Workers is about more than just edge compute -- we're rethinking how applications are built.

Using a "serverless" approach has allowed us to make deploys dead simple, and using isolate technology has allowed us to deliver serverless more cheaply and without the lengthy cold starts that hold back other providers. We added easy-to-use eventually-consistent edge storage to the platform with Workers KV.

But up until today, it hasn't been possible to manage state with strong consistency, or to coordinate in real time between multiple clients, entirely on the edge. Thus, these parts of your application still had to be hosted elsewhere.

Durable Objects provide a truly serverless approach to storage and state: consistent, low-latency, distributed, yet effortless to maintain and scale. They also provide an easy way to coordinate between clients, whether it be users in a particular chat room, editors of a particular document, or IoT devices in a particular smart home. Durable Objects are the missing piece Continue reading

How to view information on your Linux devices with lshw

While far from being one of the first 50 Linux commands anyone learns, the lshw command (read as “ls hardware”) can provide a lot of useful details on your system’s hardware.It extracts details—maybe quite a few more than you knew were available—in a format that is reasonably easy to digest. Given descriptions, logical (device) names, sizes, etc., you are likely to appreciate how much detail you can access.This post examines the information that lshw provides with a particular focus on disk and related hardware. Here is some sample lshw output:$ sudo lshw -C disk *-disk:0 description: SCSI Disk product: Card Reader-1 vendor: JIE LI physical id: 0.0.0 bus info: scsi@4:0.0.0 logical name: /dev/sdc version: 1.00 capabilities: removable configuration: logicalsectorsize=512 sectorsize=512 *-medium physical id: 0 logical name: /dev/sdc Note that you should run the lshw command with sudo to ensure that you get all of the available details.To read this article in full, please click here

Syncing RIPE, ARIN and APNIC objects with a custom Ansible module

Internet is split into five regional Internet registry: AFRINIC, ARIN, APNIC, LACNIC and RIPE. Each RIR maintains an Internet Routing Registry. An IRR allows one to publish information about the routing of Internet number resources.¹ Operators use this to determine the owner of an IP address and to construct and maintain routing filters. To ensure your routes are widely accepted, it is important to keep the prefixes you announce up-to-date in an IRR.

There are two common tools to query this database: whois and bgpq4. The first one allows you to do a query with the WHOIS protocol:

$ whois -BrG 2a0a:e805:400::/40
[…]
inet6num:       2a0a:e805:400::/40
netname:        FR-BLADE-CUSTOMERS-DE
country:        DE
geoloc:         50.1109 8.6821
admin-c:        BN2763-RIPE
tech-c:         BN2763-RIPE
status:         ASSIGNED
mnt-by:         fr-blade-1-mnt
remarks:        synced with cmdb
created:        2020-05-19T08:04:58Z
last-modified:  2020-05-19T08:04:58Z
source:         RIPE

route6:         2a0a:e805:400::/40
descr:          Blade IPv6 - AMS1
origin:         AS64476
mnt-by:         fr-blade-1-mnt
remarks:        synced with cmdb
created:        2019-10-01T08:19:34Z
last-modified:  2020-05-19T08:05:00Z
source:         RIPE

The second one allows you to build route filters using the information contained in the IRR database:

$ bgpq4 -6 -S RIPE -b AS64476
NN = [
    2a0a:e805::/40,
    2a0a:e805:100::/40,
    2a0a:e805:300::/40,
    2a0a:e805:400::/40,
    2a0a:e805:500::/40
];

There is no module available on Ansible Galaxy Continue reading

Understanding Linux Networking

Got this interesting question from one of my readers

Based on my experience, the documentation regarding Linux networking is either elementary man pages for user-space utilities or very complicated Linux kernel source code. Does getting deep into Linux networking mean reading source code?

It all depends on how deep you plan to go:

Deploying whitebox switches. If you’re just starting you SHOULD buy a supported solution that includes hardware and a variant of Linux running on it. Your problem transformed into “configuring control-plane protocols on Linux”. Congratulations, you’ll be perfectly fine studying Cumulus Networks documentation. Apart from the secret-sauce-ASIC-blob they’re using open-source software, so whatever you learn there should be transferrable to any other Linux networking environment.

However, even though the documentation is pretty good, expect a few gotchas. As Dinesh Dutt told me:

• Unlike a traditional NOS, Linux is not a monolithic entity. There’s the kernel and there are software packages than run on top. To make installation and management easier, different folks put together Continue reading