- NANOG - lists.nanog.org

ISP port blocking practice
by Zhiyun Qian 13 Sep '10

13 Sep '10

Hi all, What is the common practice for enforcing port blocking policy (or what is the common practice for you and your ISP)? More specifically, when ISPs try to block certain outgoing port (port 25 for instance), they could do two rules: 1). For any outgoing traffic, if the destination port is 25, then drop the packets. 2). For any incoming traffic, if the source port is 25, then drop the packets. Note that either of the rule would be able to block outgoing port 25 traffic since each rule essentially represent one direction in a TCP flow. Of course, they could apply both rules. However, based on our measurement study, it looks like most of the ISPs are only using rule 1). Is there any particular reason why rule 1) instead of rule 2)? Or maybe both? Also, is it common that the rules are based on tcp flags (e.g. SYN, SYN-ACK)? One would think block SYN packet is good enough. Regards. -Zhiyun

52 121

Re: Did Internet Founders Actually Anticipate Paid, Prioritized Traffic?
by Tim Franklin 13 Sep '10

13 Sep '10

> Competition would be wonderful, but is simply not practical in many > cases. Most people and companies don't want to hear this, but from > a consumer perspective the Internet is a utility, and very closely > resembles water/sewer/electric/gas service. That is, having 20 > people run fiber past your home when you're only going to buy from > one of them makes no economic sense. Indeed, we probably wouldn't > have both cable and DSL service if those were both to the home for > other reasons already. The copper pair from your house to the exchange isn't congested (at least, between you and other people), by definition. The fibre from your house to somewhere isn't congested, in the same way - although the 'somewhere' may be closer to you than the exchange. There's no reason to have competition here - but there's no reason to have a commercial entity trying to make a profit here either. Treat it like a real, basic utility, and run it on a cost-recovery basis, either directly by your local government entity, or by a dedicated organisation acting on their behalf. Whatever entity owns the local-loop sells access to competing service providers on an equal and transparent basis. Providers can then compete on level of network congestion, amongst other things, because they can directly control it in terms of how much backhaul they want to build from the exchange / FTTP street cab / whatever the aggregation point is against the volume of subscribers they sell off that aggregation point. For places which have it, this seems to work much better, or least break far less, than the alternatives (Openreach in the UK, Stokab in Stockholm being two I've dealt with). Exactly like electricity and gas - I only have one set of wires / pipes to my house, but there's a plethora of companies I can choose to buy energy services from. Regards, Tim.

2 1

Multicast issues in windows TCP/IP stack
by Philip Lavine 13 Sep '10

13 Sep '10

Not sure if this the the right venue for this, but would anyone happen to know if there is any changes or "enhancements" in the Windows 2008 64 Bit R2 TCP/IP stack or in TOE that would cause multicast or microsecond bursts of UDP to be dropped between the physical layer (NIC) and OS. I am running the same multicast app on Windows 2008 64 bit NOT R2 or standard and do not have this issue. -thx Philip

1 0

Re: Transporting QinQ across a Layer 2 link locked at 1518 octets AND across a Layer 3 link
by Nick Olsen 13 Sep '10

13 Sep '10

Only input I can give is on EOIP tunnels and MTU. Scenario is we had 1 remote router running, Tunneled back to our network using EOIP so that the remote network could use our ip space. Don't remember how I figured it out, But I was using the MTU of 1458 (On the EOIP interface). Everything was great, But weird things started happening. Certain sites wouldn't load, MSN.com....etc it was strange. Jacking it back up to 1500 flat fixed it. Nick Olsen Network Operations (877) 804-3001 x106 ---------------------------------------- From: "Francois Menard" <francois(a)menards.ca> Sent: Sunday, September 12, 2010 10:13 PM To: "Francois Menard" <francois(a)menards.ca> Subject: Re: Transporting QinQ across a Layer 2 link locked at 1518 octets AND across a Layer 3 link Oops two typos - sunday evening casualties. On 2010-09-12, at 10:06 PM, Francois Menard wrote: > Folks, > > Question #1: > > Is it possible for me to put an MPLS router on both ends of a circuit leased from a transport service provider which does not support QinQ (i.e. packets of 1526 bytes), and which requires us to tag traffic onto a well specified set of VLANs (i.e. if we want two VLANs, the service provider tells us which two VLANs to use). > > I was thinking of lowering the MTU size on my MPLS router such that I could do QinQ over VPLS, over MPLS, over Ethernet transport locked at @ 1514 octets. > > I would imagine that my effective IPv4 payload would be reduced to something like (not taking into account CRC removed in the Ethernet driver) > > 1514 minus 8 bytes for MPLS label minus 4 bytes for VPLS control word minus 4 bytes for VLAN tag #1 minus 4 bytes for VLAN tag #2 = > 1514 -8 -4 -4 -4 -4 = 1490 octets > > So if I set my MTU on my MPLS router at 1490 octets and send QinQ over VPLS over , wouldn't that allow for all of the above mentioned overhead to pile-up without exceeding the 1514 octets size allowed by my transport provider ? > So if I set my MTU on my MPLS router at 1490 octets and send QinQ over VPLS over MPLS over Ethernet, wouldn't that allow for all of the above mentioned overhead to pile-up without exceeding the 1514 octets size allowed by my transport provider ? > Question #2: > > I have another link, which is restricted by the transport service provider, which is an MPLS-VPN service, and which does not support QinQ, nor supports layer 2 bridging. > > An option available to me is to use an EoIP tunnel on a Mikrotik RouterOS router, which maps Ethernet over GRE over IP, causing some 28 octets of overhead. This is proprietary to Mikrotik. > > So in this case, assuming that I want to do something as dangerous as: > > QinQ over VPLS over MPLS over Ethernet over EoIP (over GRE, over IP) > > And accordingly set my MTU to: > > 1480 (from above) minus 28 octets (Ethernet over GRE over IP) = 1452 octets > 1490 (from above) minus 28 octets (Ethernet over GRE over IP) = 1462 octets > So if I set my MTU on my MPLS router at 1452 octets, wouldn't that allow for all of the above mentioned overhead to be successfully transported across an IP layer 3 circuit, effectively ending up with > 1462 octets > QinQ over MPLS over Ethernet over IP ? > > What are the consequences of setting the MTU as low as 1452 octets? What applications end-up breaking ? > 1462 octets > -=Francois=- > > > >

1 0

POS to Ethernet Converter
by Alan Bryant 13 Sep '10

13 Sep '10

I did a quick google search for a converter but either I'm not understanding, or I'm not searching for the right thing. We currently have a POS OC-3 that I would like to be able to convert it to Ethernet, if possible. Do such devices exist? -- Alan Bryant | Systems Administrator Gtek Computers & Wireless, LLC. alan(a)gtekcommunications.com | www.gtek.biz O 361-777-1400 | F 361-777-1405

12 11

Transporting QinQ across a Layer 2 link locked at 1518 octets AND across a Layer 3 link
by Francois Menard 13 Sep '10

13 Sep '10

Folks, Question #1: Is it possible for me to put an MPLS router on both ends of a circuit leased from a transport service provider which does not support QinQ (i.e. packets of 1526 bytes), and which requires us to tag traffic onto a well specified set of VLANs (i.e. if we want two VLANs, the service provider tells us which two VLANs to use). I was thinking of lowering the MTU size on my MPLS router such that I could do QinQ over VPLS, over MPLS, over Ethernet transport locked at @ 1514 octets. I would imagine that my effective IPv4 payload would be reduced to something like (not taking into account CRC removed in the Ethernet driver) 1514 minus 8 bytes for MPLS label minus 4 bytes for VPLS control word minus 4 bytes for VLAN tag #1 minus 4 bytes for VLAN tag #2 = 1514 -8 -4 -4 -4 -4 = 1490 octets So if I set my MTU on my MPLS router at 1490 octets and send QinQ over VPLS over , wouldn't that allow for all of the above mentioned overhead to pile-up without exceeding the 1514 octets size allowed by my transport provider ? Question #2: I have another link, which is restricted by the transport service provider, which is an MPLS-VPN service, and which does not support QinQ, nor supports layer 2 bridging. An option available to me is to use an EoIP tunnel on a Mikrotik RouterOS router, which maps Ethernet over GRE over IP, causing some 28 octets of overhead. This is proprietary to Mikrotik. So in this case, assuming that I want to do something as dangerous as: QinQ over VPLS over MPLS over Ethernet over EoIP (over GRE, over IP) And accordingly set my MTU to: 1480 (from above) minus 28 octets (Ethernet over GRE over IP) = 1452 octets So if I set my MTU on my MPLS router at 1452 octets, wouldn't that allow for all of the above mentioned overhead to be successfully transported across an IP layer 3 circuit, effectively ending up with QinQ over MPLS over Ethernet over IP ? What are the consequences of setting the MTU as low as 1452 octets? What applications end-up breaking ? -=Francois=-

1 1

List of Teredo servers and teredo relays
by Fernando Gont 12 Sep '10

12 Sep '10

Hi, Does any body maintain a list of Teredo servers and Teredo relays? Thanks! Kind regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

8 9

UK key roll-over - may need to flush name server caches
by Sean Donelan 12 Sep '10

12 Sep '10

If you are experiencing DNSSEC lookup validation failures for domains under the .UK TLD, you may (engineering-speak for almost definitely) need to flush your name server caches. http://www.nominet.org.uk/registrars/systems/serviceannouncements/ DNSSEC validation issue Due to a failure of a Hardware Security Module (HSM), as a matter of precaution, we failed over to our backup signing system this afternoon. As the backup system did not use the exact same Zone Signing Keys (ZSK), there is the possibility of validation failures. To make sure validators use the correct zone signing keys, caches might need to be flushed.

1 0

Re: Convenience or slippery slope... or something else?
by Jon Lewis 12 Sep '10

12 Sep '10

On Fri, 10 Sep 2010, Reese wrote: > A friend brought this to my attention: > > http://ipq.co/ > > He saw it at http://news.ycombinator.com/item?id=1678324 > > I'm not sure whether to shriek in joy or in pain. Will data from > this service - if it is a worthy service - propagate properly? > Play nicely with or break other people's toys? Is it a gimmick? How's it going to break anything? I just created one... tentententen.ipq.co. 86400 IN A 10.10.10.10 so...now I can use tentententen.ipq.co as a name that resolves to 10.10.10.10...assuming I trust ipq.co to keep that A record and not delete or change it at some point. Other than the fact that you can't change it[1], how is this any different (other than being less useful) or scarier than DynDNS? 1. EMAIL ADDRESS optional, but will allow you to update the record later (once we implement it) ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

4 3

Re: List of Teredo servers and teredo relays
by khatfield＠socllc.net 11 Sep '10

11 Sep '10

Thanks for the explanation. And Owen: thanks, I just thought most networks/facilities (colo/private) should be close to ipv6 now days. At least capable, maybe not configured. I think I was just making an assumption so thanks for the info. ------Original Message------ From: Jeff Kell To: Kevin Hatfield Cc: NANOG Subject: Re: List of Teredo servers and teredo relays Sent: Sep 11, 2010 3:22 PM On 9/11/2010 3:29 PM, khatfield(a)socllc.net wrote: > I may be missing the point here completely but to me Teredo just seems like a glorified hack/workaround for a bigger problem. Isn't is better (yes less cost-effective) to just upgrade equipment? > > I really don't see the advantage here. Maybe someone can explain away my ignorance to the concept? > Teredo is a "last-ditch" solution, but unfortunately in the Microsoft world, and acceptable and preferable solution over IPv4. Pure speculation, but the IPv6 efforts of many (looking at current MacOS, Windows, and a growing segment of PDAs/phones) are making tremendous effort to obtain "some" form of IPv6 connectivity. This makes sense if there were (a) only IPv6 connectivity at the client endpoint, or (b) only IPv6 connectivity at the service endpoint. That would insure things would work if either case were true. What is currently "breaking" things is the preference of IPv6 over IPv4. If you're running a default Win2K8 active directory, it's publishing all of it's goodies for login in IPv6 form complete with AAAA address records. If your network isn't end-to-end IPv6 compliant, but some Win7 client across the hall (on another subnet) has found *any* IPv6 connectivity (6to4, Teredo, doesn't matter how good/bad/ugly/slow), it is going to try to communicate with the domain controller over that IPv6 connection. I have seen this in action, and stacks of trouble tickets of slow / intermittent / no connectivity with the domain. As it currently stands, if you're not 100% end-to-end IPv6 ready with compliant transport, these "preferences" break or cripple things. Of course, this all may be by IPv6 design (make it so horribly painful not to accomodate to push you to provide better alternatives) :-) Jeff

2 1