- NANOG - lists.nanog.org

Throttle traffic for a single local IP on a Linux router?
by johnc＠hush.ai 24 Dec '10

24 Dec '10

Hi, I know this might not be 100% on-topic and might be better suited for a Linux-distro mailinglist, but I hope to get more diverse methods from you networking experts. Basically, I have a small residential connection, 5 Mbit down, 0.5 Mbit up. A user on my local network, who we will call 192.168.1.105, is using too much bandwidth. I have tried social engineering to get him to stop, he claims to, but iftop says otherwise. My network is setup like this: Cable modem goes to eth0 on router running Ubuntu server, eth1 on the Ubuntu box goes to a wrt54gl (behaving purely as a bridge), and all clients are connected wirelessly. The Ubuntu box handles everything. So I have tried this script, and it does not work -- download speed gets limited just fine, but upload remains unlimited for some reason: TC=/sbin/tc OUTIF=eth0 # Interface for WAN (internet) INIF=eth1 # Interface for LAN (internal network) DNLD=0.5mbit # DOWNLOAD Limit UPLD=0.1mbit # UPLOAD Limit IP=192.168.1.105 U32="$TC filter add dev $IF protocol ip parent 1:0 prio 1 u32" $TC qdisc del dev $INIF root $TC qdisc del dev $OUTIF root $TC qdisc add dev $INIF root handle 1: htb default 30 $TC qdisc add dev $OUTIF root handle 1: htb default 30 $TC class add dev $INIF parent 1: classid 1:1 htb rate $DNLD ceil $DNLD $TC class add dev $OUTIF parent 1: classid 1:1 htb rate $UPLD ceil $UPLD $TC filter add dev $INIF parent 1:0 ip pref 1 u32 match ip src $IP/32 0xFFFFFFFF flowid 1:1 $TC filter add dev $OUTIF parent 1:0 ip pref 1 u32 match ip dst $IP/32 0xFFFFFFFF flowid 1:1 Anyone see any problems in my setup, this script, or have any idea how I can limit the speeds of Mr. 192.168.1.105 without social engineering? Thank you for your time.

4 3

Re: Throttle traffic for a single local IP on a Linux router?
by Jeffrey Lyon 24 Dec '10

24 Dec '10

Try a Linksys RV016, it has some decent traffic shaping tools for larger home and small business networks. Jeff On Dec 24, 2010 5:31 AM, "gordon b slater" <gordslater(a)ieee.org> wrote: On Thu, 2010-12-23 at 18:32 -0500, johnc(a)hush.ai wrote: > $TC class add dev $INIF parent 1: classid ... yes, I think you have the same IDs in the last 4 lines. classid's should be 1:1 and 1:2 flowid's shoild be 1:1 and 1:2 yours are 1:1 in both cases of each try :- $TC class add dev $INIF parent 1: classid 1:1 htb rate $DNLD ceil $DNLD $TC class add dev $OUTIF parent 1: classid 1:2 htb rate $UPLD ceil $UPLD # ^^^ $TC filter add dev $INIF parent 1:0 ip pref 1 ... $IP/32 0xFFFFFFFF flowid 1:2 # ^^^ (line breaks may be affected by email formatting etc ) Gord -- # ~ TC , the undisputable leader of the gang ~ #

2 1

Re: Wake on LAN in the enterprise
by Owen DeLong 24 Dec '10

24 Dec '10

WOL is unfortunately terribly deficient in that the spec. never envisioned the possibility of a need for wake on WAN. Bottom line, it's a non-routeable layer 2 protocol. Your choices boil down to the helper address nightmare you describe or proxy servers on every subnet. Owen On Dec 13, 2010, at 8:08 AM, Berry Mobley wrote: > Hello... > > I'm trying to get a handle on implementation of wake-on-lan in an enterprise environment. Cisco gear, lots of subnets. I've made it work with directed broadcasts, but I'd really rather not have 40 or 50 'ip helper-address x.x.x.bcastaddr' statements on the vlans with the SMS servers. > > Are there any enterprises that are doing this for large (100+) numbers of subnets? I can't find a single example anywhere with more than 2 networks. > > I've searched the Cisco-NSP archives as well with no luck, but maybe I didn't go back far enough. > > Thanks for any help you can provide. > > Berry Mobley >

4 3

Sprint data network contact?
by Stephen Lau 23 Dec '10

23 Dec '10

I'm trying to find a contact for someone who might know something about the proxies running on Sprint's data network. Basically our Android app uses a local http server to serve content to the Android media player, i.e. listening via 127.0.0.1. Unfortunately, a system update that Sprint pushed last week seems to enforce a Sprint proxy (pd.vog.sprintpcs.com:8085) on all HTTP & RTSP traffic... including traffic to 127.0.0.1, which as you can imagine, predictably fails. The EVO is our most popular Android device amongst our subscribers, and we're rapidly losing subscribers because of this problem. This breaks streaming for many Android apps that have to use a local content server (for a variety of reasons, some for playing encrypted content like ourselves, others who need to maintain backwards compatibility with <2.2 Android which lacked RTSP streaming). I'm running into brick walls so far and hoping that someone in NANOG might know a responsible network engineer at Sprint who could help resolve the issue quickly? cheers, steve -- stephen lau | steve(a)grommit.com | http://whacked.net | @stevel

1 0

.gov registrar problem
by Andy Harrison 23 Dec '10

23 Dec '10

In case anyone else notices spotty problems resolving .gov names, I just sent the following message to registrar(a)dotgov.gov: ---- I started investigating a dns issue after we received a few customer complaints regarding intermittent problems resolving hostnames under noaa.gov. After some in-depth investigation, I believe I’ve identified the issue. First, the query to see the list of authoritative name servers for .gov: # dig NS gov @c.root-servers.net ; <<>> DiG 9.6.1-P3 <<>> NS gov @c.root-servers.net ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53495 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 7, ADDITIONAL: 7 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;gov. IN NS ;; AUTHORITY SECTION: gov. 172800 IN NS f.usadotgov.net. gov. 172800 IN NS a.usadotgov.net. gov. 172800 IN NS g.usadotgov.net. gov. 172800 IN NS b.usadotgov.net. gov. 172800 IN NS d.usadotgov.net. gov. 172800 IN NS e.usadotgov.net. gov. 172800 IN NS c.usadotgov.net. ;; ADDITIONAL SECTION: a.usadotgov.net. 172800 IN A 74.208.172.129 b.usadotgov.net. 172800 IN A 206.204.217.151 c.usadotgov.net. 172800 IN A 69.72.142.35 d.usadotgov.net. 172800 IN A 204.168.112.71 e.usadotgov.net. 172800 IN A 213.165.80.240 f.usadotgov.net. 172800 IN A 66.207.175.172 g.usadotgov.net. 172800 IN A 64.62.200.134 ;; Query time: 9 msec ;; SERVER: 192.33.4.12#53(192.33.4.12) ;; WHEN: Thu Dec 23 17:37:59 2010 ;; MSG SIZE rcvd: 258 The glue records show a.usadotgov.net with an ip of 74.208.172.129. Next, using one of the authoritative name servers for usadotgov.net, we resolve the a.usadotgov.net name: # dig a.usadotgov.net @DNSSEC7.DATAMTN.COM ; <<>> DiG 9.6.1-P3 <<>> a.usadotgov.net @DNSSEC7.DATAMTN.COM ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61276 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 6, ADDITIONAL: 10 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;a.usadotgov.net. IN A ;; ANSWER SECTION: a.usadotgov.net. 86400 IN A 76.73.18.236 You can see that the ip address is incorrect for that hostname. This is going to cause an issue where some responses for .gov addresses will come from a non-authoritative source and should be taken care of as soon as possible as this could potentially affect all .gov domains. -- Andy Harrison Lead Systems Engineer Metrocast Cablevision

2 1

RE: Router only speaks IGP in BGP network
by Tarig Yassin 23 Dec '10

23 Dec '10

Hi Andre That actually what I had done.. I thought it might be another solution many thanks -- Tarig Y. Adam SUIN Network Date: Thu, 23 Dec 2010 13:41:12 -0500 Subject: Re: Router only speaks IGP in BGP network From: anfoju(a)gmail.com To: tariq198487(a)hotmail.com how about sending only a default into your OSPF domain from BGP? of course this can be a "conditional" type of redistribution;if you want no redistribution at all, then consider generating the default at your ASBR, which also can be conditional. without much more details on your topology, this is as vague an answer i can provide. cheers On Thu, Dec 23, 2010 at 1:18 PM, Tarig Yassin <tariq198487(a)hotmail.com> wrote: Dear all In my network, I have a router in a middle only speaks OSPF. is there any solution (without redistribute BGP into OSPF) for this kind of problem? thanks -- Tarig Y. Adam CTO - SUIN www.suin.edu.sd

1 0

TCP congestion control and large router buffers
by Vasil Kolev 23 Dec '10

23 Dec '10

https://gettys.wordpress.com/2010/12/06/whose-house-is-of-glasse-must-not-t… I wonder why this hasn't made the rounds here. From what I see, a change in this part (e.g. lower buffers in customer routers, or a change (yet another) to the congestion control algorithms) would do miracles for end-user perceived performance and should help in some way with the net neutrality dispute. I also understand that a lot of the people here operate routers which are a bit far from the end-users and don't have a lot to do with this issue, but the rest should have something to do with choosing/configuring these end-user devices, so this should be relevant. -- Regards, Vasil Kolev

8 10

Re: Some truth about Comcast - WikiLeaks style
by Jay Ashworth 23 Dec '10

23 Dec '10

----- Original Message ----- > From: "JC Dill" <jcdill.lists(a)gmail.com> > On 19/12/10 8:31 PM, Chris Adams wrote: > > Look up pictures of New York City in the early days of electricty. > > There were streets where you couldn't hardly see the sky because of > > all > > the wires on the poles. > > > Can you provide a link to a photo of this situation? Sure, though they're a bit harder to find on the web than you'd think; it took me almost 20 minutes to find this one when I wrote the piece: http://baylink.pitas.com/#LASTMILE Cheers, -- jra

2 2

Some truth about Comcast - WikiLeaks style
by Steve Schultze 23 Dec '10

23 Dec '10

George Bonser wrote: > What would any provider think if a city said "sure, you can have access > to our residents' eyeballs. It will cost you $5 per subscriber per month". > Would Comcast or anyone go for that? Dave Temkin wrote: > These are exactly what Franchise Agreements are for. Yes, cities charge > MSOs and LECs for access all the time. I've been lurking on this thread for awhile, but I feel a need to weigh in here. There are some critical distinctions between a city imposing conditions on access to its property and a telecommunications company imposing conditions on access to its network. There are also some important limitations to the cases in which cities can indeed impose any access restrictions, which prompt the question of why parallel policy limitations do not necessarily apply to last-mile companies. First, the justification for cities requiring things of companies in order to gain access to the local market are grounded in practical and policy considerations. On a very concrete level, putting wires in the ground requires permission from the city for rights-of-way (and such activities have genuine costs for the city). This permission comes in the form of the "Franchise Agreements" that Dave refers to. From a policy perspective, the city has an interest in ensuring that it gets the greatest value for its citizens out of the valuable last-mile concessions it grants to private parties. Historically, this meant that last-mile rights-of-way were a hook for enforcing customer service requirements, disciplining pricing, ensuring universal service, and supporting diversity of programming and "public access." Negotiating these terms with each municipality was the price that companies had to pay for monopoly access to local markets. What I think George's comment does not completely appreciate is that (ideally) cities are imposing such requirements at the behest of and for the benefit of the (local) public, whereas private constraints on local access are (by design) motivated by profit. Now, all of these requirements apply to providers of cable video content under the terms of the Cable Act of 1984 (which created a new Title in the Communications Act). None of them applied to LECs, which traditionally had a blanket permission to build out for their telecommunications services. The exception is for LECs that have started to offer video services. In that case, the same requirements kick in (for the video portion of those services). The exception to THAT is for states in which the LECs have successfully lobbied the state government to give them a blanket license to deploy video services statewide without negotiating locally (Michigan, for example, as opposed to Massachusetts). Whether or not you think such statewide agreements are a good thing tends to be a funciton of who you represent. In any event, the FCC has also further weakened localities' ability to impose requirements on even the video portion of these services (22 FCC Rcd. 5101 and 22 FCC Rcd. 19633). Importantly, for the NANOG crowd, none of these local controls applies to the broadband portion of such services. This all goes back to our artificially siloed Communications Act and some decisions made by the FCC almost a decade ago. The 2002 Cable Modem Order said that localities had no power to exercise authority over the broadband portion of such services. That means that they cannot demand payment for access to rights-of-way for broadband services, but it also means that they cannot impose public interest requirements on the provision of that service... for example that such service be provided universally to all citizens or that access to different types of content be provided on a non-discriminatory basis. The reasoning was that these services were not the video services envisioned in the Cable Act of 1984, but rather broadband services that the FCC was newly classifying as "deregulated." The 2002 Cable Modem Order was in fact the event that precipitated the 2005 "Brand X" Supreme Court decision that cemented the FCC's authority to reclassify last-mile broadband services not as common carriers but rather in a vaguely deregulated service. This helped lead to our modern debate about net neutrality. These jurisdictional turf wars are also at the heart of fights to allow cities to create municipally owned broadband networks that may then be leased on equal terms to all comers. It is also the reason that cities do not have the legal authority to compel "open access" or "non-discrimination" requirements on private networks within their boundaries. Broadband providers have understandably sought to gain near-exclusive control over their customers, and the legal framework helps them to avoid municipal networks and other requirements. Whether or not you believe that the local franchising regime that emerged in the 1980s makes sense for internet access today (not that it applies to broadband anyway), you must at least admit a fundamentally different incentive model compared to that of private companies. Whereas localities must now provide equal access to all companies that wish to do a physical buildout, those companies do not have any locally imposed requirement to provide equal access of use of their networks. Regards, Steve

40 91

Post positive reviews
by Eugene Zola 23 Dec '10

23 Dec '10

Google’s Huge Change and How it affects you. • Anyone can now post bad reviews and kill your rank. • We post good reviews and improve your rank. • We post good reviews to keep others from killing your rank. Google: Judge, Jury and Online Shopping Executioner Google rank is based on reviews of your business? Google Statement: "...in the last few days we developed an algorithmic solution which detects the merchant from the Times article along with hundreds of other merchants that, in our opinion, provide an extremely poor user experience. The algorithm we incorporated into our search rankings represents an initial solution to this issue, and Google users are now getting a better experience as a result." This means that anyone can write bad reviews about your business and lower your ranking. We knew that getting good reviews and not getting bad reviews was always important. Now it is a must to have good reviews for your business to keep the rank safe or to improve rank with Google. We post positive reviews for your company. We have the experience and ability to post hundreds of positive reviews that are all unique content and posted on unique IP addresses. wwwpostgoodreviews.com

2 1