<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1375160746;
mso-list-type:hybrid;
mso-list-template-ids:546886384 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>When a CAM Table is maxed-out a switch becomes a full-duplex hub. (Cool hey).<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>If it doesn’t know which mac address to send the traffic to, it sends it EVERYWHERE.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>If the traffic is deliberately being injected into a port knowing that the mac address doesn’t exist on the peering fabric, EVERYONE gets it, even if the CAM table isn’t full.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I’m not on PIPE-IX-SYD, (Only on Equinix-SYD, O Hai) but I can imagine that..<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>There’s a customer connected to the IX who’s own network has become a hub so they are smashing L2 traffic into the IX not on purpose.<o:p></o:p></span></b></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>At least I’d hope that’s the case, I wouldn’t imagine anyone would deliberately sabotage the IX.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>If someone can sniff the packets you may be able to get the MAC address, then do an Arping on all of the IX IP’s and see which mac addresses match the IP’s in question, or look at your routers ARP table for a corresponding MAC address to get the offending networks PEER-IP. (Or look on the graphs and see who is inverse to everyone else).<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Who has more peers, by the way? Equinix-SYD or PIPE-SYD? <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>S.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> ausnog-bounces@lists.ausnog.net [mailto:ausnog-bounces@lists.ausnog.net] <b>On Behalf Of </b>ZoneNetworks - Joel<br><b>Sent:</b> Sunday, November 13, 2011 9:35 AM<br><b>To:</b> Skeeve Stevens<br><b>Cc:</b> ausnog@ausnog.net<br><b>Subject:</b> Re: [AusNOG] SPAM-LOW: Pipe peering issue - Equinix<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>To my knowledge it's a hardware/firmware issue not traffic related ...though looking at the graphs it seems like traffic/flood which is misleading<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>If more customers gave them a hard time it might get fixed sooner, we were told (in august) they had a long term fix in plan but no ETA when it will be done<o:p></o:p></p></div><div><p class=MsoNormal>Not something you would hear from the "old pipe"<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Joel<o:p></o:p></p></div><div><p class=MsoNormal>Sent from my iPad<o:p></o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><br>On 13/11/2011, at 10:06 AM, Skeeve Stevens <<a href="mailto:Skeeve@eintellego.net">Skeeve@eintellego.net</a>> wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div><div><div><p class=MsoNormal>Do we know where the traffic is coming from?<o:p></o:p></p></div><div><div><div><p class=MsoNormal><span style='font-size:13.5pt;font-family:"Calibri","sans-serif";color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span class=apple-style-span><span style='font-size:13.5pt;font-family:"Calibri","sans-serif";color:#002060'>…Skeeve</span></span><span style='font-size:13.5pt;font-family:"Calibri","sans-serif";color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:13.5pt;font-family:"Calibri","sans-serif";color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span class=apple-style-span><span style='font-size:13.5pt;font-family:"Calibri","sans-serif";color:#002060'>--</span></span><span style='font-size:13.5pt;font-family:"Calibri","sans-serif";color:black'><o:p></o:p></span></p></div><div><div><p style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Calibri","sans-serif";color:black'>Skeeve Stevens, CEO - eintellego Pty Ltd<o:p></o:p></span></p><p style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Calibri","sans-serif";color:black'><a href="mailto:skeeve@eintellego.net">skeeve@eintellego.net</a> ; <a href="http://www.eintellego.net">www.eintellego.net</a><o:p></o:p></span></p><p style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Calibri","sans-serif";color:black'>Phone: 1300 753 383 ; Fax: (+612) 8572 9954<o:p></o:p></span></p><p style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Calibri","sans-serif";color:black'>Cell +61 (0)414 753 383 ; <a href="skype://skeeve">skype://skeeve</a><o:p></o:p></span></p><p style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Calibri","sans-serif";color:black'><a href="http://facebook.com/eintellego">facebook.com/eintellego</a><o:p></o:p></span></p><p style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Calibri","sans-serif";color:black'><a href="http://twitter.com/networkceoau">twitter.com/networkceoau</a> ; <a href="http://www.linkedin.com/in/skeeve">www.linkedin.com/in/skeeve</a><o:p></o:p></span></p><p style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Calibri","sans-serif";color:black'>PO Box 7726, Baulkham Hills, NSW 1755 Australia<o:p></o:p></span></p><div><p class=MsoNormal><span style='font-size:13.5pt;color:#002060'><o:p> </o:p></span></p></div><p style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Calibri","sans-serif";color:black'>--<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:13.5pt;color:#7F007F'>eintellego - The Experts Who The Experts Call<o:p></o:p></span></p></div><div><p class=MsoNormal><span class=apple-style-span><span style='font-size:13.5pt;color:#002060'>Juniper - HP Networking - Cisco - Brocade</span></span><span style='font-size:13.5pt;color:#7F007F'><o:p></o:p></span></p></div></div></div></div></div></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><div><p class=MsoNormal>On 13/11/11 10:04 AM, "Jared Hirst" <<a href="mailto:jared.hirst@serversaustralia.com.au">jared.hirst@serversaustralia.com.au</a>> wrote:<o:p></o:p></p></div></div><div><p class=MsoNormal><o:p> </o:p></p></div><blockquote style='border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-right:0in' id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"><div><div><div><p class=MsoNormal>Yeah every few weeks it happens is what I mean, they start sending<o:p></o:p></p></div><div><p class=MsoNormal>hundreds of mbits of useless broadcast traffic to all customers in<o:p></o:p></p></div><div><p class=MsoNormal>Equinix. It's getting frustrating and annoying as it always seems to<o:p></o:p></p></div><div><p class=MsoNormal>happen at 2:00on a Saturday morning :(<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Kindest Regards,<o:p></o:p></p></div><div><p class=MsoNormal>Jared Hirst<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Servers Australia Pty Ltd<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Phone: 02 4307 4200<o:p></o:p></p></div><div><p class=MsoNormal>Fax: 02 4307 4201<o:p></o:p></p></div><div><p class=MsoNormal>Web: <a href="http://www.serversaustralia.com.au">http://www.serversaustralia.com.au</a><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>On 13/11/2011, at 4:26 AM, "<a href="mailto:joel@zonenetworks.com.au">joel@zonenetworks.com.au</a>"<o:p></o:p></p></div><div><p class=MsoNormal><<a href="mailto:joel@zonenetworks.com.au">joel@zonenetworks.com.au</a>> wrote:<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><blockquote style='border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-right:0in' id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"><div><p class=MsoNormal>It's been happening for months now not few weeks<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Last time we were told they need to fix switch/router but they can't do it for some reason<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Sent from my HTC<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>----- Reply message -----<o:p></o:p></p></div><div><p class=MsoNormal>From: "Jared Hirst" <<a href="mailto:jared.hirst@serversaustralia.com.au">jared.hirst@serversaustralia.com.au</a>><o:p></o:p></p></div><div><p class=MsoNormal>To: "<a href="mailto:ausnog@ausnog.net">ausnog@ausnog.net</a>" <<a href="mailto:ausnog@ausnog.net">ausnog@ausnog.net</a>><o:p></o:p></p></div><div><p class=MsoNormal>Subject: SPAM-LOW: [AusNOG] Pipe peering issue - Equinix<o:p></o:p></p></div><div><p class=MsoNormal>Date: Sun, Nov 13, 2011 3:30 am<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Guys,<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Just as an FYI there appears to be some form of broadcast storm on the<o:p></o:p></p></div><div><p class=MsoNormal>pipe peering fabric in Equinix Sydney, looks to be affecting a few<o:p></o:p></p></div><div><p class=MsoNormal>people and filling links from the looks of their online graphs.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>We have had to shut our pipe peering down until they resolve it, which<o:p></o:p></p></div><div><p class=MsoNormal>is my next question... Do pipe have a 24/7 NOC still? I called over 30<o:p></o:p></p></div><div><p class=MsoNormal>minutes ago and went to a messaging service but have not had a call<o:p></o:p></p></div><div><p class=MsoNormal>back, have also created a ticket with no response.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>So if anyone is wondering why their pipe link is full, this is why.<o:p></o:p></p></div><div><p class=MsoNormal>Appears to be happening every few weeks in Equinix lately.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Kindest Regards,<o:p></o:p></p></div><div><p class=MsoNormal>Jared Hirst<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Servers Australia Pty Ltd<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Phone: 02 4307 4200<o:p></o:p></p></div><div><p class=MsoNormal>Fax: 02 4307 4201<o:p></o:p></p></div><div><p class=MsoNormal>Web: <a href="http://www.serversaustralia.com.au">http://www.serversaustralia.com.au</a><o:p></o:p></p></div><div><p class=MsoNormal>_______________________________________________<o:p></o:p></p></div><div><p class=MsoNormal>AusNOG mailing list<o:p></o:p></p></div><div><p class=MsoNormal><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><o:p></o:p></p></div><div><p class=MsoNormal><a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div></blockquote><div><p class=MsoNormal>_______________________________________________<o:p></o:p></p></div><div><p class=MsoNormal>AusNOG mailing list<o:p></o:p></p></div><div><p class=MsoNormal><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><o:p></o:p></p></div><div><p class=MsoNormal><a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div></div></div></blockquote></div></blockquote></div></body></html>