Re: Disabling temporary addresses by default?

[Gyan Mishra <[e-mail]>]

On Sun, Feb 2, 2020 at 8:16 AM Jared Mauch <[e-mail]> wrote:

>
>
> On Feb 2, 2020, at 3:53 AM, Mark Smith <[e-mail]> wrote:
>
> 
>
>
> On Sun, 2 Feb 2020, 19:05 Jared Mauch, <[e-mail]> wrote:
>
>> They are also useful and needed when debugging hashing or 802.3ad related
>> issues. To debug the flow hash you often need stable addresses which are
>> not easily changed
>
>
> Can you explain how you do this troubleshooting? Do you spoof end users
> addresses?
>
>
> No you try to find a combination of source ip, dest ip, protocol and
> source plus dest ports that aren't working and debug from there.
>
> The routers/hardware compute a hash from these tuples plus some initial
> entropy to assign traffic to a specific link member. If you have 4 or 6x
> 100g links (for example) you may see one link member misbehaving from a
> software bug or programming issue. You have to debug these layers to find
> the bad link.
>
> Some of the vendors make seeing their hash calculation easier than others.
> If we want to fix the bug we have to leave it broken or reproduce it for
> the developers.
>
> You may see this as 1:16 flows behaves poorly or is dropped. Sometimes you
> are more unlucky than others.
>

   Gyan> The L2 or L3 hash algorithm in generating the hash is vendor
proprietary usually an XOR of the tuple.  For example, Cisco lb hash for
all of their IOS flavors is generated using source/destination by default,
however you can add port to the lb hash alg making it a tuple.

   The lb hash alg  feature is pretty basic and is standard operation for
most all vendors which have a  CLI show command to determine what member
ink of L2 bundle the src/dest flow is taking.  I am not aware of any Cisco
bugs.

    Which vendor are you referring to regarding software bug or programming
issue?

> or provided by the average user who just expects the technology to work.
>
>
> Temporary addresses have been the default on Apple OS X since Lion in 2011
> and Windows Vista in 2007. That doesn't seem to have prevented IPv6 working
> for the average user.
>
>
> HE may mask the issue so the end user isn't seeing issues but doesn't stop
> things from working.
>
> Day in the life of an operator perspective on making things too hard to
> debug automatically. We try but sometimes it takes that user report.
>
> This is aside from my concerns about the hyper privacy people blowing out
> ND.
>
> If you are spending all your time in software/centralized lookup platforms
> you are missing out on the joys of debugging networks based on ingress
> interface and these hash calculators
>


> Gyan> Most all newer platforms across all vendors are hardware based and
> of course the larger platforms have distributed LC FIB versus centralized
> processor.
>
>
>
>
>> Sent from my iCar
>>
>> > On Feb 1, 2020, at 4:24 PM, Gyan Mishra <[e-mail]> wrote:
>> >
>> > Stable random IPv6 address works best to meet the objective of an
>> enterprise.
>>
>> --------------------------------------------------------------------
>> IETF IPv6 working group mailing list
>> [e-mail]
>> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
>> --------------------------------------------------------------------
>>
>

-- 

Gyan  Mishra

Network Engineering & Technology

Verizon

Silver Spring, MD 20904

Phone: [phone]

Email: [e-mail]