- NANOG - lists.nanog.org

Re: More undersea cable wars brewing in India
by Fergie (Paul Ferguson) 24 Dec '04

24 Dec '04

I think everyone has pretty much known that the international cable companies are basically cartels -- leaking bandwidth into the market at a rate sufficient enough to keep prices artificially high enough to (at the very least) sustain fiscal margins. This has been going on for years. - fergie -- Adrian Chadd <adrian(a)creative.net.au> wrote: On Thu, Dec 23, 2004, Suresh Ramasubramanian wrote: > > .. and meanwhile, the best part of 32 STM-1s worth of fiber is lying dark ... If they lit /all/ of the fibre, don't you think it'll all be used very very quickly? What will they do then? Lay more fibre next year? :) -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

3 2

Re: More undersea cable wars brewing in India
by Adrian Chadd 24 Dec '04

24 Dec '04

On Thu, Dec 23, 2004, Laconsults(a)aol.com wrote: > this already doubles TCP throughputs over inter-continental cables/ > satellites/ WAN links, just one-click install ( all window platforms TCP upgrade > downloads to follow within a month ) . > the cable link utilisation & also end user TCP throughput graphs will both > show constant 95%-100% levels, cf existing saw-tooths. Its not increasing the bandwidth of a fibre, its just allowing TCP streams to use more bandwidth. Hacks to do this have been popping up here and there for a number of years. So how is it relevant to the international cable company practice(s) of artifically limiting bandwidth to limit growth? Adrian -- Adrian Chadd "You don't have a TV? Then what's <adrian(a)creative.net.au> all your furniture pointing at?"

1 0

Anycast 101
by Iljitsch van Beijnum 23 Dec '04

23 Dec '04

I got some messages from people who weren't exactly clear on how anycast works and fails. So let me try to explain... In IPv6, there are three ways to address a packet: one-to-one (unicast), one-to-many (multicast), or one-to-any (anycast). Like multicast addresses, anycast addresses are shared by a group of systems, but a packet addressed to the group address is only delivered to a single member of the group. IPv6 has "round robin ARP" functionality that allows anycast to work on local subnets. Anycast DNS is a very different beast. Unlike IPv6, IPv4 has no specific support for anycast, and the point here is to distribute the group address very widely, rather than over a single subnet anyway. So what happens is that a BGP announcement that covers the service address is sourced in different locations, and each location is basically configured to think it's the "owner" of the address. The idea is that BGP will see the different paths towards the different anycast instances, and select the best one. Now note that the only real benefit of doing this is reducing the network distance between the users and the service. (Some people cite DoS benefits but DoSsers play the distribution game too, and they're much better at it.) Anycast is now deployed for a significant number of root and gtld servers. Before anycast, most of those servers were located in the US, and most of the rest of the world suffered significant latency in querying them. Due to limitations in the DNS protocol, it's not possible to increase the number of authoritative DNS servers for a zone beyond around 13. With anycast, a much larger part of the world now has regional access to the root and com and net zones, and probably many more that I don't know about. However, there are some issues. The first one is that different packets can end up at different anycast instances. This can happen when BGP reconverges after some network event (or after an anycast instance goes offline and stops announcing the anycast prefix), but under some very specific circumstances it can also happen with per packet load balancing. Most DNS traffic consists of single packets, but the DNS also uses TCP for queries sometimes, and when intermediate MTUs are small there may be fragmentation. Another issue is the increased risk of fait sharing. In the old root setup, it was very unlikely for a non-single homed network to see all the root DNS servers behind the same next hop address. With anycast, this is much more likely to happen. The pathological case is one where a small network connects to one or more transit networks and has local/regional peering, and then sees an anycast instance for all root servers over peering. If then something bad happens to the peering connection (peering router melts down, a peer pulls an AS7007, peering fabric goes down, or worse, starts flapping), all the anycasted addresses become unreachable at the same time. Obviously this won't happen to the degree of unreachability in practice (well, unless there are only two addresses that are both anycast for a certain TLD, then your milage may vary), but even if 5 or 8 or 12 addresses become unreachable the timeouts get bad enough for users to notice. The 64000 ms timeout query is: at what point do the downsides listed above (along with troubleshooting hell) start to overtake the benefit of better latency? I think the answer lies in the answers to these three questions: - How good is BGP in selecting the lowest latency path? - How fast is BGP convergence? - Which percentage of queries go to the first or fastest server in the list?

18 35

Re: More undersea cable wars brewing in India
by Suresh Ramasubramanian 23 Dec '04

23 Dec '04

On Thu, 23 Dec 2004 09:40:24 EST, Laconsults(a)aol.com <Laconsults(a)aol.com> wrote: > Yes, you may be interested to know there is a very much easier immediate > solution : [lots of capitals] [strong odor of snake oil] If it is that easy, trot it out ... on nanog. -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

1 0

More undersea cable wars brewing in India
by Suresh Ramasubramanian 23 Dec '04

23 Dec '04

.. and meanwhile, the best part of 32 STM-1s worth of fiber is lying dark ... srs http://www.indianexpress.com/full_story.php?content_id=61366 > Flag, VSNL spar over bandwidth > > Posted online: Thursday, December 23, 2004 at 0046 hours IST > > MUMBAI, DECEMBER 22: TATA group company VSNL, one of the original > investors in the Flag Cable Systems in 1995-1996, has been > accused by Flag Telecom Ltd, a Reliance company, of artificially > restricting access on Flag Europe Asia (FEA) cable and preventing > the ability to respond to market demand. as another article points out, they're invoking WTO GATS provisions on this - > http://economictimes.indiatimes.com/articleshow/968127.cms > VSNL violates WTO norms > > PTI[ WEDNESDAY, DECEMBER 22, 2004 07:38:18 PM] > MUMBAI: VSNL has been accused of restricting access on Reliance > group-owned FLAG Europe Asia cable, which is in direct violation > of WTO's General Agreement on Trade in Services (GATS). and then, REACH, seconded by VSNL, stirs the pot a bit more .. http://www.hindustantimes.com/news/181_1159772,0003.htm > FLAG partner calls for meet on cable upgrade > Press Trust of India > Mumbai, December 19, 2004|16:45 IST [...] > The global carrier wants to discuss "unauthorised upgrade of FEA > cable between UK and UAE" as it did not get approval from all 12 > landing signatories, which is required under the Construction and > Maintenance Agreement (C&MA), REACH said in a letter to FLAG Telecom > Ltd's management committee. -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

3 5

Agenda so far for NANOG33
by Susan Harris 22 Dec '04

22 Dec '04

Greetings - here are some of the talks we've lined up so far for the Las Vegas meeting (Jan. 30 - Feb. 1): SUNDAY TUTORIALS ---------------- - Build for Success--How to Use Network Design Principles to Differentiate the Good, the Bad, and the Ugly Level: Introductory/Intermediate Barry Greene and Dave Meyer, Cisco - Understanding MPLS OAM Capabilities for Troubleshooting MPLS Networks Level: Introductory/Intermediate Moiz Moizuddin and Mukhtiar Shaikh, Cisco - BGP Troubleshooting Techniques Level: Introductory/Intermediate Philip Smith, Cisco GENERAL SESSION --------------- - A Day in the Security Life of a Service Provider--Qwest Don Smith, Qwest - Team Cymru Bogon Route Servers Dave Deitrich, Team Cymru - IGP Tuning in an MPLS Network Martin Horneffer, Deutsche Telekom - IP Fast-Reroute: An Analysis of Applicability to a Core Network Alia Atlas, Avici, and Gagan Choudhury, AT&T - Panel: Network-based Layer 2/3 VPN Deployment Danny McPherson, Arbor, moderator Ted Seely, Sprint Shane Amante, Level(3) Shankar Rao, Qwest - Implementation of Modern L2 VPNs Scott Gross, MCI - IETF Update Leslie Daigle, Verisign, and Alex Zinin, Cisco - Panel: A Look at the IP Multimedia Subsystem (IMS) Dave Meyer, Cisco, moderator - Looking Glasses--What's In It for You? Steve Gibbard, Packet Clearing House - Experience With In-bailiwick Nameservers Masato Minda, JPRS BOFs ---- - ISP Security and NSP-SEC BOF VIII Danny McPherson, Arbor, and Merike Kaeo, Double Shot Security, moderators - Peering BOF VIII Bill Norton, Equinix, moderator

1 0

Sanity worm defaces websites using php bug
by Fergie (Paul Ferguson) 22 Dec '04

22 Dec '04

These people don't waste much time when a new exploit found, do they? Geez. http://isc.sans.org/diary.php?date=2004-12-21 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

6 7

Israeli ISP's experience broadband dialer malware outbreak
by Gadi Evron 22 Dec '04

22 Dec '04

I received several notices today from fellow ISP's, originally from an Israeli ISP's security information sharing mailing list, that several large Israeli ISP's experience an outbreak that cause tech support lines to overflow. Basically, this malware appears to change dialer configuration for broadband users. "Advanced" setting is turned back to "Basic", Local Area Connection is being played with, the user name is changed to <random number>username, etc. The users get the following errors: 734 ,769, 789 or 800. On the press, several rumors are circulating: 1. This thing is from Kazaa. 2. Process names are: chksp2.exe, sp2ctr.exe and glwgmgeb.exe. 3. Also, this link has been provided: http://www.sophos.com/virusinfo/analyses/trojdlucam.html We haven't yet got my hands on a sample, but I hope to have one soon. I haven't seen any chatter about this in AV forums.. and for now it seems to be limited to Israel unless someone can inform me differently? Gadi.

1 0

A Road Runner NOC contact
by Eric Brunner-Williams in Portland Maine 22 Dec '04

22 Dec '04

Off list please. A user issue. Sensetive.

1 0

Re: Sanity worm defaces websites using php bug
by sgorman1＠gmu.edu 21 Dec '04

21 Dec '04

there is this from f-secure with some detail of after effects. http://www.f-secure.com/v-descs/santy_a.shtml ----- Original Message ----- From: cw <nanog(a)fidei.co.uk> Date: Tuesday, December 21, 2004 3:47 pm Subject: Re: Sanity worm defaces websites using php bug > > Does anyone have any more detail on exactly what this thing does > after > it gets into a system? > > The cgi platform for a company I use has been hit and the effect > is > not just limited to phpBB, it seems to get into the server and > then go > through everything it can write to.. > > I lost a copy of UBB to this worm even though I don't rund phpBB > off > the same vhost. > > Gonna be a nightmare for server ops to ensure that all client > copies > of phpBB are patched.. > >

1 0