- NANOG - lists.nanog.org

Brightmail Contact
by Malcolm Staudinger 06 Jul '06

06 Jul '06

Does anyone have a contact at Brightmail besides investigations(a)security.symantec.com? A phone number off-list would be nice. Malcolm Staudinger Postmaster Dotster, Inc.

1 0

DNS Based Load Balancers
by James Baldwin 06 Jul '06

06 Jul '06

I'm soliciting recommendations for DNS based load balancers. Currently, we have Cisco Global Site Selectors deployed buy have reached a limit for the number of active HTTP HEAD checks we can perform. This lack of scalability is restricting us severely with regards to the number of customers we can deploy for our product, which requires a separate HTTP HEAD check per IP per customer. I am hoping to receive recommendations for devices which allow for DNS based load balancing (round robin and proximity based) as well as HTTP health checks (including content based health checks). It must be scalable to, at least, 2000 active checks and active answers. I am currently investigating the Netscaler DNS offering as well as F5's 3DNS (or whatever they've changed the name to).

13 22

Huawei Routers in the Core
by Kim Onnel 06 Jul '06

06 Jul '06

Hello, We have been looking at Huawei line of routers recently and i was kind of surprised to see they have Core stuff, that are able to handle Gigs of traffic and MPLS, i cant seem to find anyone around that have used any of these, i wonder if anyone here has, i'd love to hear what he/she has to say, positive or negative feedback. Offline messages are welcomed. Thanks, Kim

1 1

re: NANOG Spam?
by Etaoin Shrdlu 05 Jul '06

05 Jul '06

Joe Johnson wrote: > Am I the only one to get this email? Headers say merit.edu sent it. I > have NANOG whitelisted, though, so it came to my mailbox. You do realize that by including the whole email, that anyone who had it blocked, will not have seen your message either. I have multiple spam filtering, and that message was trapped at my first line of defense. Only because I have the habit of grepping From headers, did I see your message... What was funny is that you got a higher score with spamassassin than the original spam did;-) -- No matter how much you want to try and spin it, MySpace is the Paris Hilton of the internet. (http://www.digg.com/users/ArcaneDevice)

1 0

RE: DNS Based Load Balancers
by Joseph Jackson 05 Jul '06

05 Jul '06

What would be a better solution then? -----Original Message----- From: Lincoln Dale [mailto:ltd@interlink.com.au] Sent: Tue Jul 04 18:30:00 2006 To: 'Rodrick Brown'; 'Sam Stickland' Cc: 'Matt Ghali'; 'Patrick W. Gilmore'; nanog(a)merit.edu Subject: RE: DNS Based Load Balancers > As someone who has also deployed GSLB's with hardware applicances I > would also like to know real world problems and issues people are > running into "today" on modern GSLB implementations and not > theoretical ones, as far as I can tell our GSLB deployment was very > straight forward and works flawlessly. GSLB based on DNS have one significant shortcoming that moone here has yet mentioned: they are performing their magic on the location of the _nameserver_ that issued the query. this can be VERY different to that of the ACTUAL location of the client. for example, Akamai always sends to off to a serverfarm in Northern California, because that's where my DNS query is originating from. that is almost the exact opposite side of the planet from where I'm coming from....... irony is that there is an akamai cluster about 10 feet away from where my [subsequent] http requests originate from... sure - perhaps this isn't the norm - split-tunnel VPNs being what they are - but it's a perfect example of why GSLB based on DNS ain't perfect. cheers, lincoln.

6 5

Wanna hold a brick on your dick? Try our Soft Cialis Tabs. (Warning: don�t try it).
by nanog＠enterzone.net 05 Jul '06

05 Jul '06

2 1

Fanless x86 Server Recommendations
by Ray Van Dolson 05 Jul '06

05 Jul '06

We're looking to acquire a couple small servers that can act as routers for us at remote locations. To minimize hardware issues, I'd love to get something that has no fans, can still run a fairly decent processor and preferably no hard drive (easy with an IDE CF adapter). It would need a couple PCI slots for quad port ethernet cards and a fairly robust tolerance to temperature variations. I like what I see at Advantech -- anyone have any testimonies as to what they've had success/problems with? Ray

11 14

RE: DNS Based Load Balancers
by Brandon Butterworth 05 Jul '06

05 Jul '06

> GSLB based on DNS have one significant shortcoming that moone here has yet > mentioned: they are performing their magic on the location of the > _nameserver_ that issued the query. > > this can be VERY different to that of the ACTUAL location of the client. Systems that infer stuff make errors, at least DNS GSLB fails working I've seen problems with DRM that assumed the IP requesting http would be the same as that requesting rtsp, neither of which were the actual client after some ISP caching. > for example, Akamai always sends to off to a serverfarm in Northern > California, because that's where my DNS query is originating from. > > that is almost the exact opposite side of the planet from where I'm coming > from....... That's more a failure of your systems than Akamai, depending on something the other side of the planet for something best done locally > irony is that there is an akamai cluster about 10 feet away from where my > [subsequent] http requests originate from... yes, like a free ride when you've already paid I don't see any point arguing over DNS GSLB. It exists, it can work, and no surprise some products aren't well designed. We've used a DNS GSLB system since 1997, it does the job we designed it to, it has the edge cases we expected, we're happy with it. Don't try using one without adult supervision The hardware SLB products we've tried have caused more down time than our DNS LB brandon

1 0

IP failover/migration question.
by Andrew Warfield 05 Jul '06

05 Jul '06

I've got a bit of a network reconfiguration question that I'm wondering if anyone on NANOG might be able to provide a bit of advice on: I'm working on a project to provide failover of entire cluster-based (and so multi-host) applications to a geographically distinct backup site. The general idea is that as one datacentre burns down, a live service may be moved over to an alternate site without any interruption to clients. All of the host-state migration is done using virtual machines and associated magic; I'm trying to get a more clear understanding as to what is involved in terms of moving the IPs, and how fast it can potentially be done. I'm fairly sure that what I would like to do is to arrange what is effectively dual-homing, but with two geographically distinct homes: Assuming that I have an in-service primary site A, and an emergency backup site B, each with a distinct link into a common provider AS, I would configure B's link as redundant into the stub AS for A -- as if the link to B were the redundant link in a (traditional single-site) dual-homing setup. B would additionally host it's own IP range, used for control traffic between the two sites in normal operation. When I desire to migrate hosts to the failover site, B would send a BGP update advertizing that the redundant link should become preferred, and (hopefully) the IGP in the provider AS would seamlessly redirect traffic. Assuming that everything works okay with the virtual machine migration, connections would continue as they were and clients would be unaware of the reconfiguration. Does the routing reconfiguration story here sound plausible? Does anyone have any insight as to how long such a reconfiguration would reasonably take and/or if it is something that I might be able to negotiate a SLA for with a provider if I wanted to actually deploy this sort of redundancy as a service? Is anyone aware of similar high-speed failover schemes in use on the network today? Thoughts appreciated, I hope this is reasonably on-topic for the list. best, a.

12 23

IP Delegations for Forum Spammers and Invalid Whois info
by Mark Foster 05 Jul '06

05 Jul '06

I assume the ongoing problems that forum administrators have with people randomly signing up to forums - even closed ones requiring admin approval for all accounts - for the purpose of spamming their web urls around the place is an old one. I run such a forum and have started implementing /16 level bans to try to slow them down. Obviously not the best solution. The forum in question is phpBB (I know - whos isn't) and i'm yet to have time to actually start digging into whether there are better ways of responding to this issue. (Volume isnt prohibitive - yet.) In the most recent case the IP address space that the website concerned points back to is in the Ukraine and the listed abuse contact is on a domain which is canned due to invalid contact details provided. My question then is - what happens now? The IP address space is essentially 'untraceable' except perhaps through bandwidth-supplier-agreements or somesuch. Shouldn't IP's with similarly invalid contact details be 'suspended' after being given opportunity to provide updated, correct details? The IP range in question is 195.225.176.0 - 195.225.179.255 and a snippet of the whois info provided is as follows: remarks: **************************************** remarks: * Abuse contacts: abuse(a)netcathost.com * remarks: **************************************** person: Vsevolod Stetsinsky address: 01110, Ukraine, Kiev, 20Á, Solomenskaya street. room 206. phone: +38 050 6226676 e-mail: vs(a)netcathost.com nic-hdl: VS1142-RIPE source: RIPE # Filtered Forgive the relative noobishness of the question, but I've not had to deal with this sort of situation before. Should I be forwarding to RIPE?

4 4