- NANOG - lists.nanog.org

ISPs slowing P2P traffic...
by Deepak Jain 14 Jan '08

14 Jan '08

http://www.dslreports.com/shownews/TenFold-Jump-In-Encrypted-BitTorrent-Tra… http://www.dslreports.com/shownews/Comcast-Traffic-Shaping-Impacts-Gnutella… http://www.dslreports.com/shownews/Verizon-Net-Neutrality-iOverblowni-73225 If I am mistakenly being duped by some crazy fascists, please let me know. However, my question is simply.. for ISPs promising broadband service. Isn't it simpler to just announce a bandwidth quota/cap that your "good" users won't hit and your bad ones will? This chasing of the lump under-the-rug (slowing encrypted traffic, then VPN traffic and so on...) seems like the exact opposite of progress to me (by progressively nastier filters, impeding the traffic your network was built to move, etc). Especially when there is no real reason this P2P traffic can't masquerade as something really interesting... like Email or Web (https, hello!) or SSH or gamer traffic. I personally expect a day when there is a torrent "encryption" module that converts everything to look like a plain-text email conversation or IRC or whatever. When you start slowing encrypted or VPN traffic, you start setting yourself up to interfere with all of the bread&butter applications (business, telecommuters, what have you). I remember Bill Norton's peering forum regarding P2P traffic and how the majority of it is between cable and other broadband providers... Operationally, why not just lash a few additional 10GE cross-connects and let these *paying customers* communicate as they will? All of these "traffic shaping" and "traffic prioritization" techniques seem a bit like the providers that pushed for ubiquitous broadband because they liked the margins don't want to deal with a world where those users have figured out ways to use these amazing networks to do things... whatever they are. If they want to develop incremental revenue, they should do it by making clear what their caps/usage profiles are and moving ahead... or at least transparently share what shaping they are doing and when. I don't see how Operators could possibly debug connection/throughput problems when increasingly draconian methods are used to manage traffic flows with seemingly random behaviors. This seems a lot like the evil-transparent caching we were concerned about years ago. So, to keep this from turning into a holy war, or a non-operational policy debate, and assuming you agree that providers of consumer connectivity shouldn't employee transparent traffic shaping because it screws the savvy customers and business customers. ;) What can be done operationally? For legitimate applications: Encouraging "encryption" of more protocols is an interesting way to discourage this kind of shaping. Using IPv6 based IPs instead of ports would also help by obfuscating protocol and behavior. Even IP rotation through /64s (cough 1 IP per half-connection anyone). For illegitimate applications: Port knocking and pre-determined stream hopping (send 50Kbytes on this port/ip pairing then jump to the next, etc, etc) My caffeine hasn't hit, so I can't think of anything else. Is this something the market will address by itself? DJ

15 25

RE: Stupid Question: Network Abuse RFC?
by Paul Ferguson 14 Jan '08

14 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 So, someone else (Thanks, by the way -- this is the one I was looking for) pointed me to RFC3013/BCP46: http://rfc-editor.org/cgi-bin/rfcdoctype.pl?loc=RFC&letsgo=3013&type=http&f ile_format=txt In addition to RFC2142, it would appear that these are largely ignored just as much as any other operational IETF documents. That's a shame. $.02, - - ferg p.s. Thanks to everyone for their replies. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHiarRq1pz9mNUZTMRAkF1AKDMzsJlzSLPPVkR2GMrUXN/CDFBXgCguQy4 C9PMJ0Jl9a9XJjEZ9aqLIUY= =G7gb -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

Re: ISPs slowing P2P traffic...
by David E. Smith 14 Jan '08

14 Jan '08

>It may. Some of those other things will, too. I picked 1) and 2) as >examples where things could actually get busy for long stretches of >time. The wireless ISP business is a bit of a special case in this regard, where P2P traffic is especially nasty. If I have ten customers uploading to a Web site (some photo sharing site, or Web-based email, say), each of whom is maxing out their connection, that's not a problem. If I have one customer running Limewire or Kazaa or whatever P2P software all the cool kids are running these days, even if he's rate-limited himself to half his connection's maximum upload speec, that often IS a problem. It's not the bandwidth, it's the number of packets being sent out. One customer, talking to twenty or fifty remote hosts at a time, can "kill" a wireless access point in some instances. All those little tiny packets tie up the AP's radio time, and the other nine customers call and complain. One customer just downloading stuff, disabling all the upload features in their P2P client of choice, often causes exactly the same problem, as the kids tend to queue up 17 CDs worth of music then leave it running for a week. The software tries its darnedest to find each of those hundreds of different files, downloading little pieces of each of 'em from multiple servers. We go out of our way to explain to every customer that P2P software isn't permitted on our network, and when we see it, we shut the customer off until that software is removed. It's not ideal, but given the limitations of wireless technology, it's a necessary compromise. I still have a job, so we must have a few customers who are alright with this limitation on their broadband service. There's more to bandwidth than just bandwidth. David Smith MVN.net

7 7

Re: Stupid Question: Network Abuse RFC?
by Paul Ferguson 14 Jan '08

14 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Randy Bush <randy(a)psg.com> wrote: >2142 > >but i am surprised you asked here instead of an ietf list. here we actually do the stuff, not tell other folk how they should do it. :) > Thanks for the pointer, and I even appreciate you snarky reply. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHiaT9q1pz9mNUZTMRAsUwAKDfzxtwp/OLvLgl+xnO1lmMV7bcjACgzpAz bDJjr/2v8tbWJep9AIAfxkk= =Puaa -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

6 5

Looking glass or web-tracerouter within Chinanet/AS4134 needed
by Gunther Stammwitz 14 Jan '08

14 Jan '08

Hello colleagues, I'm trying to optimize the latency & packet loss between CHINANET (AS4134) and our network. The outgoing traffic to china is fine now but I have no idea how they are routing towards us. This is why I'm looking for some sort of looking glass, route server or webtracerouter within AS4134. Any where to find one? Thanks, Gunther

1 0

Re: Stupid Question: Network Abuse RFC?
by Paul Ferguson 14 Jan '08

14 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Sean Donelan <sean(a)donelan.com> wrote: >MAAWG is useful for particular subjects, not as useful for other subjects. >I expect the same will be true for any forum. > What is the appropriate mechanism within NANOG? I mean, given previous topics covered in the NANOG security BoFs, it would appear that a lot of attention has been given to statistical analysis of DDoS flows traffic, securing infrastructure, etc. -- all of which are honorable & desired goals. But what about involvement of incident reporting (and responding?), that is inclusive of the Internet community at-large? NSP-Sec is clearly a "closed" community which excludes many of the organizations who could actually help contribute intelligence, work with law enforcement, and make a positive difference. My opinion is that the ISP community, by and large, tend to say that they are dealing with the situation, and are willing to address these issue, yet in reality they tend to minimize the issues and sweep it under the rug because it is not in their financial interests to enagage them, or it doesn't jive with their "existing processes". So I ask you, how do we address this situation? Instead of being an apologist for the problem, how would _you_ suggest we address these process, procedural, and organizational issues? I consider this to be way beyond the boiling point, and an issue that we all need to address -- and engage. Thanks, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHisZWq1pz9mNUZTMRAgahAJ9TxYI3q9FS+KlQvCLytVNqlEaHKQCg5Xev MzJItZoHM8rbUs3UbBewA2w= =SyBg -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

IP/MPLS Circuit Provisioning Software
by Gregory Urban 14 Jan '08

14 Jan '08

Currently, our network uses ATM to provide approximately 1200 virtual circuits to our subscriber base. We use the ATM switch manufacturer's management software (Marconi Service On Data) to manage both the ATM switches and all of the virtual circuits (mostly SVCs) we have provisioned. We are in the process of migrating off of ATM and provisioning these services as MPLS circuits (mostly pseudo-wire). But we need a tool to replace Service On Data, as configuring 1200 circuits manually on each router/switch isn't going to cut it. The network is primarily Juniper Routers at the core and Cisco 3750 Metro switches at the edge. Does anyone have any experience with a provisioning tool that can build MPLS circuits in a multi-vendor network? We're evaluating Dorado Red Cell, but I'm not sold on it yet. TIA. Gregory Urban Director, networkMaryland www.networkMaryland.gov <http://www.networkmaryland.gov/>

1 0

[Fwd: Unstable BGP Peerings?]
by Sue Joiner 13 Jan '08

13 Jan '08

Forwarding for Mohit Lad and Jonathan Park. -sue Sue Joiner Merit Network -------- Original Message -------- Subject: Unstable BGP Peerings? Date: Sun, 13 Jan 2008 17:49:44 +0000 From: ParkJonathan <j13park(a)hotmail.com> To: <nanog(a)merit.edu> CC: <smj(a)merit.edu>, <mohit(a)cs.ucla.edu> During our recent study on BGP routing instability, we found cases where lots of routes changed from one subpath to another subpath, repeating this kind of behavior over a few months . We do not know the cause of this repeated instability, but suspect the BGP peering between routers in two AS was unstable or had some problems and this caused routing changes seen by many observation points. Specifically, the peerings in question are 174 (Cogent) and 9121 (TTNet) 3257 (Tiscali) and 9121 (TTNet) 9304 (Hutchison) and 15412 (Flag Telecom) 1273 (Cable&Wireless) 4651 (Thai Gateway) 6762 (Seabone) and 7473 (Singapore Telecom) For details of events and timings, please find a short summary on the link below. http://irl.cs.ucla.edu/pca/active-links.html We would really appreciate if somebody from the ISPs involved in this activity (or anybody who might know what happened) would contact us and throw some light on the reasons for this behavior. Thanks Mohit Lad, Jonathan Park UCLA ------------------------------------------------------------------------ e벗 사귀기, 쪽지 보내기, 가젯 즐기기를 통해 전세계 친구들을 만나세요! 나 의 글로벌 인맥, Windows Live Space! <http://www.spaces.live.com >

1 0

Re[2]: Stupid Question: Network Abuse RFC?
by Paul Ferguson 13 Jan '08

13 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Randy Bush <randy(a)psg.com> wrote: >2142 > >but i am surprised you asked here instead of an ietf list. here we actually do the stuff, not tell other folk how they should do it. :) > Be careful when you say "we". Evidence points to the contrary. Thanks! - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHiaVlq1pz9mNUZTMRAilIAJ0SKnZXIDzCrpI96/oesndnuBYV/wCdH74g Fxjq6EveeEy92dIbniR0Qr4= =D+wu -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Stupid Question: Network Abuse RFC?
by Paul Ferguson 13 Jan '08

13 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I searched the RFC Editor archives for a few keywords to find what I was looking for, but apparently I'm brain-damaged at the moment. Can someone please point me to the RFC for network abuse reporting? Thanks! - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHiZ4kq1pz9mNUZTMRAur/AKDs5ltmLBuZqR4BxC8Tr89M7w0gswCePInw fdvfWNaeD0F6qy7jmVmEaVs= =+rGs -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1