- NANOG - lists.nanog.org

Windows Encryption Software
by Brandon Kim 15 Dec '10

15 Dec '10

Hey guys: This is most definitely OT so please contact me off list. (don't want to annoy anyone) I come to you all because of all your wisdom. =) I want to know if there's software out there that will encrypt files on win2k3, winxp, win7, so that if someone decides to steal the computer and plug the harddrive into a USB external case, they won't be able to read the files on the harddrive. I know windows has bitlocker, but I don't know if that is available for Win2003? And it always seems like 3rd party apps seem to do a better job than what Microsoft gives you. Encryption needs to be done on the fly so if at anytime the harddrive is stolen, there's no way to read the data... Thoughts?? Brandon

12 14

Net-Neutrality or Net-Neutered?
by Beavis 15 Dec '10

15 Dec '10

I come across this interesting link. http://blogs.techrepublic.com.com/security/?p=4828&tag=nl.e036 Is ICANN really that susceptible to govt. pressure? I only see chaos ahead specially with ipv6 coming into the scene. -- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments Disclaimer: http://goldmark.org/jeff/stupid-disclaimers/

5 5

TCP congestion control and large router buffers
by Jim Gettys 15 Dec '10

15 Dec '10

As I'm attempting to lay out in my posts, there are are a plethora of problems, end-to-end in the network. Would that there was only one problem. Excessive, unmanaged buffers afflict the user's OS's (Windows, Mac and Linux alike), particularly on recent hardware. Home routers and the broadband connections (as shown by netalyzr) all have problems. The bottleneck may be anywhere in the path; with the (sometimes) exception of Windows XP, all edge equipment now routinely congests the edge. Multiple seconds of latencies, in both directions, are dismaying commonplace. Retail operators have had a hidden major support problem: how many of the "bad service" calls have been due to the problem? It tends to be transient in behavior, and I've chased the problem personally at least 5 times in the last 3 years. I've placed service calls I now believe likely due to bufferbloat. I've caught problems with crash dumps being uploaded to the net; backup and downloads can all cause trouble. Courtesy of the Netalyzr team, I've been able to post color versions of their results on http://gettys.wordpress.com/2010/12/06/whose-house-is-of-glasse-must-not-th…; they first reported results at the NANOG meeting last summer. Disentangling broadband data from home router and operating system bufferbloat is difficult; I've found bufferbloat is present in all of them. The power of two bufferbloat sizes are almost certainly all broadband gear (since the OS buffer sizes are quantised in packets, not bytes). In the downstream direction, one of the possible causes is be failure to run any AQM in the broadband head-ends; this is certainly also the case in home routers. Also, as outlined in: Characterizing Residential Broadband Networks http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.65.6825&rep=rep1&t… we have good reason to believe this is taking place. Since I became aware that bufferbloat might have become a generic problem last summer from anecdotal data and personal experiments, I've probed networks wherever I've travelled. Some of what I've seen was clearly broadband bufferbloat; but more disturbingly, I've also seen other evidence further into several of the networks I've probed (from hotels *not* using broadband for their service), further confirming the initial anecdotal data I was given that queue management is far from universal (and essentially unheard of in the home). If the idea that the buffers have destroyed congestion avoidance doesn't scare you, I don't know what will. It's a major problem. Best Regards, - Jim Gettys

1 0

DNS "Fake" Authority for hidden forwarders?
by Leland Vandervort 15 Dec '10

15 Dec '10

Hi All, Apologies if off topic, but hoping that one of you gurus out there might have some tips on this. I have a rather "unusual" application for DNS which I need to figure out a way to make it work, but running into authority issues. Basically, I have a "fake" server running on a private network which can respond to PTR and A requests dynamically, with their details extracted from a database. In front of that in the public network, I have two servers (load-balanced) which can handle the queries from the "world" for these zones. The problem is that the backend "dummy" server doesn't not actually generate a zone as such, and does not set the AA bit (it's a python script, actually...). I'm trying find a way for the front-end servers to declare themselves as authority for the zones in question, but obtaining the details of the records via forwarder to the dummy server behind, then of course caching the response for the stated TTL in the response. I have looked at various configuration options of BIND and nothing really works, be it a forward, split-horizion, hidden-master, hidden-slave, etc. Is there another daemon somewhere out there that can do something along lines of this pseudo configuration: zone "1.168.192.in-addr.arpa" { type master; // actually a "fake" master to pretend to be the authority allow-query { any; }; recursion no; file "/etc/bind/zones/1.168.192.in-addr.fake-master.zone"; // file contains an SOA and NS record of the zone // pointing to the "public" visible servers (i.e. myself) // actual records (PTR, A, AAAA, etc.) are dynamically retrieved // from a "record-forwarder", but works the same way as // a standard forward type zone: record-forwarders { 10.1.1.2; }; }; When an external query arrives for the zone, the front-end server declares itself to be authoritative for the zone, but obtains the actual A/PTR/AAAA record via the back-end forwarder, and stuffs it into the response as if it was locally configured. It then keeps it in cache. For the moment, I have it setup simply as a forwarder, and it does indeed respond to queries for the dynamically generated queries, but only if queried DIRECTLY (dig -x 1.1.1.1 @frontend-server) , but it responds without authority. As such, this configuration cannot be used for "live" deployment. (the front-end servers are of course fully delegated for the zones in question, so they need to be authoritative). Is there anything out there that can do such authority masquerading/proxying? Thanks in advance Leland

3 2

NANOG Server Maintenance
by Michael K. Smith - Adhost 14 Dec '10

14 Dec '10

Hello All: This Friday morning, December 17, at 5:00 a.m. EST, Merit staff will relocate the server that operates the NANOG mailing lists and website. This will result in a list outage that should last not more than two hours. If you have any questions, please send them to admins(a)nanog.org. Regards, Mike On behalf of the Communications Committee -- Michael K. Smith - CISSP, GSEC, GISP Chief Technical Officer - Adhost Internet LLC mksmith(a)adhost.com w: +1 (206) 404-9500 f: +1 (206) 404-9050 PGP: B49A DDF5 8611 27F3 08B9 84BB E61E 38C0 (Key ID: 0x9A96777D)

1 0

Re: TCP congestion control and large router buffers
by Mikael Abrahamsson 14 Dec '10

14 Dec '10

On Tue, 14 Dec 2010, Sam Stickland wrote: > But there's no need for AQM, just smaller buffers would make a huge > difference. Well, yes, buffering packets more than let's say 30-50ms on a 1 meg link doesn't make much sense. But doing some basic AQM would make things even better (some packets would see 0 buffering instead of 30ms). > Surely buffers that can store seconds worth of data are simply too big? FIFO with seconds worth of data is just silly, yes. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

2 2

peering, derivatives, and big brother
by Jeff Wheeler 14 Dec '10

14 Dec '10

A read through this New York Times article on derivatives clearing, and the exclusivity that big banks seek to maintain, would look very much like an article on large-scale peering, to someone who is not expert in both topics. The transit-free club and the "derivatives dealers club" may have other similarities in the future, and it's worth watching how further government regulation develops in this area. It may lead to insight into how government might eventually regulate ISPs seeking to become settlement-free. "“It appears that the membership criteria were set so that a certain group of market participants could meet that, and everyone else would have to jump through hoops,” Mr. Katz said." http://www.nytimes.com/2010/12/12/business/12advantage.html?pagewanted=1&_r… -- Jeff S Wheeler <jsw(a)inconcepts.biz> Sr Network Operator / Innovative Network Concepts

7 9

Re: TCP congestion control and large router buffers
by Mikael Abrahamsson 14 Dec '10

14 Dec '10

On Mon, 13 Dec 2010, Sam Stickland wrote: > Ironically though, wouldn't smaller buffers cost less thus making the CPEs 1 megabyte of buffer (regular RAM) isn't really expensive. > cheaper still? I believe the argument made in the blog post is that > cheaper RAM been causing the CPE manufacturers to mistakenly provision > too much buffer space, which in turn apparently means that TCP can't > stabilize at a rate less than available bandwidth (I.e. It's the old > 1980's congestion collapse problem all over again). Of course, you'll > only see this if a single TCP stream is actually capable of saturating > the link. Sam I would guess they're running standard OSes and haven't tuned the buffers at all. Implementing WRED or fair-queue (even if it just means turning it on) requires validation which the CPE manufacturers want to minimize. Also it's our fault as a business, how many ISPs have included AQM in their RFPs for CPEs and actually would pay USD5 more per device for this feature? I'm not very surprised at the lack of this though, it's hard to explain to the end customer with some kind of marketing, both for the ISP and the CPE vendor if they're selling to end customers. It's one of those "in the black box" things that should just work, but there is little upside in having it because it's hard to charge for. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

1 0

(no subject)
by Atticus 13 Dec '10

13 Dec '10

Cc

5 4

Re: Wake on LAN in the enterprise
by Berry Mobley 13 Dec '10

13 Dec '10

Thanks, everyone, for the replies - looks like I need to get my server team interested in knowing broadcast addresses for hosts, and making SMS send to those addresses. I do have the 'ip directed-broadcast <acl>' in place, but the servers are currently sending the magic packets to the all-1's address. Maybe I can get that changed. Berry

1 0