NLNOG RING from a user perspective Bartek Gajda gajda@man.poznan.pl
Source: Job Snijders https://ripe65.ripe.net/presentations/105-RIPE65_NLNOG_RING_Job_Snijders.pdf 2
Source: Job Snijders https://ripe65.ripe.net/presentations/105-RIPE65_NLNOG_RING_Job_Snijders.pdf 3
NLNOG RING - Motivation Debug network issues and troubleshoot ‘from the outside’ A point of view outside your network is absolutely essential Seeing what others see is a useful thing with a variety of network problems Source: ring.nlnog.net 4
NLNOG RING - Solution Provide a streamlined way of cooperating ”NLNOG RING” – simple essence: You make a (virtual) machine available to the RING, You gain access on all servers which are part of the project, hence the name “RING”. Great example would be to launch a traceroute from 173 servers in different networks and quickly get the results instead of waiting till somebody has the time to run some tests for you. Source: ring.nlnog.net 5
NLNOG RING – how to use it CLI interface: ring scripts ring-all – run commands on all servers ring-ping – run comands from all servers ring-trace - ICMP traceroutes from all servers allows to create graphs which visualise traceroutes from a number of ring sources Distributed Smokeping Web based statistics A smokeping Master/Slave setup has been created to graph latency between all nodes thus graphing nodes in context of a torus. BGP Looking glass Web based on-line interface 6
CLI interface ring-ping [-6v] host poznan@poznan01:~$ ring-ping -v www.terena.org sidn01: 3.934 fnutt01: 25.511 a2binternet01: 2.007 melbourne01: 16.713 digiweb01: 17.661 … ring-ping www.terena.org connect: Network is unreachable www.terena.org - 173 servers: 44ms average www.terena.org - unreachable via: nlnetlabs01 ssh connection failed: atrato01 bahnhof01 bci01 digmia01 occaid01 solnet01 teamix0 7
CLI interface usage: ring-trace [-h] -a, --asn group by ASN instead of IP -c, --show-country show country codes for IP addresses -n RANDOM, pick a given number of hosts at random -b send output to a pastebin instead of saving it to file -B remove broken hops from output image -e exclude a specific host -i include this host -l {dot,neato,fdp,sfdp,twopi,circo}] layout style -o output filename -p pick top N and bottom N hosts based on hopcount -r try to resolve all addresses (WARNING: can take long!) -t {dot,gif,pdf,png,jpg,ps,svg} output filetype -T TIMEOUT -u username for SSH logins -U use UDP instead of ICMP ECHO -v -vv -x, remove IXP hops from traces -X, highlight IXP hops in output -4 | -6 destination 8
CLI interface poznan@poznan01:~$ ring-trace -a -4 -b -B -n 5 www.terena.org ring-trace v1.6.1 - written by Teun Vink <teun@teun.tv> picked 5 hosts at random: imagine01 heanet01 solido01 claranet04 rootlu01 Performing ICMP traceroutes towards www.terena.org from 5 ring hosts, ssh-timeout is 10 seconds. Image uploaded to https://ring.nlnog.net/paste/p/1t1kmf13ocmuzj0 Done in 12.5 seconds. Or (Created file: trace-www.terena.org.jpg) 9
CLI interface ring-trace -c -B -n 10 www.terena.org 10
Distributed Smokeping AMP (AcIve Measurement Project) Developed by WAND Network Research Group http://amp.ring.nlnog.net/ • Ping • Historic Traceroutes • MTU testing • Jitter • loss, etc 11
Distributed Smokeping 12
Distributed Smokeping 13
BGP looking glass 14
BGP looking glass – BGP map 15
NLNOG RING - Participation Open to everybody who meets the following requirements: You are a network operator The organisation you work for has BGP routers connected to the ”Default Free Zone” and maybe even IXP’s. Your organisation has its own ASN, IPv4 and IPv6 prefix(es). You have enable or configure rights on those routers. You are involved in the networkers community. You have permission from your organisation to become involved in the NLNOG RING. Source: ring.nlnog.net 16
NLNOG RING – Hardware • Hardware requirements • Mandatory: – Clean Ubuntu 12.04 Precise Pangolin 64-bit (amd64/x86_64) Server Edition installation (no special packages are required except openssh-server) – 64 bit CPU – 1 globally reachable and unique statically configured IPv4 address – 1 globally reachable and unique statically configured IPv6 address – You are willing to give full sudo access to the Ring-Admins • The following suggestions are indicative: – 1 core or CPU – 20 gigabyte disk space – at least 512 megabyte RAM, but more is better – 10mbit NIC (more is fine) Source: ring.nlnog.net 17
NLNOG RING – Management All regular nodes (machines provided by organisations) are managed through a centralized puppet system. Ring-Admins will take care of software and security updates, installation and user management. The goal: make it as easy as possible for organisations Not to worry about it afterwards. Machine owners are allowed and encouraged to install software which they deem necessary to comply with the standards of their organisation, examples are: n2, backup programs or a snmp daemon. Source: ring.nlnog.net 18
NLNOG RING – Participants PSNC joined in October 2012 https://ring.nlnog.net/participants/ 19
NLNOG RING – Security considerations A ‘zero tolerance’ policy RING box – regarded as (your) enduser Should be placed outside internal network Separate VLAN etc. 20
NLNOG RING – aditional information Link to RIPE presentation pdf & video(!) https://ripe65.ripe.net/programme/meeting-plan/plenary- agenda/#tues2 21
Recommend
More recommend
