- NANOG - lists.nanog.org

BGP-based blackholing/hijacking patented in Australia?
by Bevan Slattery 18 Aug '04

18 Aug '04

Hi, Just to ease peoples concerns, the patent has nothing to do with blackholing. A brief description of the way it works can be found here: http://www.scamslam.com/ScamSlam/whatis.shtml We have not disclosed the site address to the "public" at this stage, the text of the site is only draft form for the purposes of editing and needs to be "polished". Perhaps the article wasn't as articulate in conveying this, but I'm sure you appreciate journalists sometimes don't get it right :) Kind Regards Bevan Slattery PIPE Networks ______________________________________ PIPE Networks/IX Services Australia disclaimer The above email should be read in conjunction with our standard disclaimer/terms which can be found at : http://www.pipenetworks.com/docs/disclaimer.htm

10 13

"Internode Nodemap" network visualization/monitoring software
by Mark Newton 18 Aug '04

18 Aug '04

Posted here on the assumption that some will find it useful: http://nodemap.internode.on.net # Internode Nodemap performs SNMP queries against network devices to # determine the status of network links in complicated networks. # # Using the results of those probes, Nodemap produces visualizations # to convey the "holistic" state of the network. A "drill-down" user # interface is provided which permits detailed link-by-link status # information to be presented at low-levels, with abstracted # summarizations available at higher levels. This enables network # operations staff to determine the current state of a network with # a single glance, without regard to topology complications or the # number of devices on the network. It's GPLed. Simple config examples, screenshots, vast quantities of documentation and mailing list subscription details are on the website referenced above. - mark -- Mark Newton Email: newton(a)internode.com.au (W) Network Engineer Email: newton(a)atdot.dotat.org (H) Internode Systems Pty Ltd Desk: +61-8-82282999 "Network Man" - Anagram of "Mark Newton" Mobile: +61-416-202-223

1 0

RE: Current street prices for US Internet Transit
by Michel Py 18 Aug '04

18 Aug '04

> William B. Norton wrote: > First - As for whether the US Transit > market is healthy or unhealthy... Hmm. For this one topic I think I have the best explanation in the world (tm): it's unhealthy if you bite the dust, it's healthy if one of your competitors bites the dust :-) > It certainly appears that the majors can't make money in > this transit market, and they would probably say that the > bottom feeders are greasing the skids to financial ruin > for this industry. Indeed, and see above. That being said, historically (and valid only for that long) dominant players in a given industry are the ones that survived the slide with greased skids. >> Michel Py wrote: >> Someone mentioned that this was comparing apples to >> oranges. Indeed it is, <stuff deleted> > I would disagree that these are apples and oranges > comparisons - these are real prices (normalized to USD) > for transit that someone in the country would pay to > access the big 'I' Internet. I misread Patrick and withdraw my statement. In the context you meant it, these are apples to apples. What Patrick meant though (which remains extremely valid) (2nd disclaimer, forgive my poor English) is that comparing what it takes to build and/or sell transit in different countries is comparing apples to oranges. However, what you wrote as being the cost of connecting to the big "I" is totally valid (that's where I was trying to get to with my P2P comparison) and has indeed to be understood WRT to Joe's comments: > Joe Abley wrote: > http://www.economist.com/markets/Bigmac/Index.cfm > I suppose a more direct analogy to the Big Mac Index would be > to take some usefully-accurate measure of transit costs in each > country, and use that to weight a comparison between other > related commodities (cell phone calls? televisions? computers?) Please accept my entry for the Big Mac Index: One Mbps worth of residential traffic, link always-on, unlimited, un-metered, in an urban area within 12,000ft of the CO. Valid between 500 Kbps and 3 Mbps, pro-rated to 1Mbps. Please fill-in the blanks, convert your local currency to US$ and send it to me privately, I will post summary results to the ML. Then we can compare to the cost of transit as Bill posted yesterday and have a better grasp at the relevance of the BMI. +-------+----------+---+----+-----+-------+-------+ |Country| State / |ISP|Link|Speed|Monthly|Monthly| | | Province | |type|Mbps | cost | /Mbps | +-------+----------+---+----+-----+-------+-------+ | USA |California|SBC|DSL | 2.5 | US$37 | US$15 | +-------+----------+---+----+-----+-------+-------+ | .. | .... | | | | | | +-------+----------+---+----+-----+-------+-------+ ^ | Big Mac Index > Eric Kuhnke wrote: > You can peg a 100Mb/s FTTH line (which costs about $65 > USD/month on a 1 year contract) from Chunghwa Telecom in > Taipei 24/7, as long as the majority of your traffic > stays on the island of Taiwan... This is not connecting to the big "I" because there are strings attached to it; it's just like an ISP saying "traffic to a web site we also host is free". Joe Consumer does not give a rip to this concept: when he surfs the net it does not matter where the site is. Michel.

1 0

RE: Current street prices for US Internet Transit
by William B. Norton 18 Aug '04

18 Aug '04

First - As for whether the US Transit market is healthy or unhealthy... I am not privy to the ISP calculations that demonstrate financial viability at these prices, so I can only go on the sentiments expressed by folks that have done the analysis for their companies and have shared their views with me or my colleagues. Having said that...It certainly appears that the majors can't make money in this transit market, and they would probably say that the bottom feeders are greasing the skids to financial ruin for this industry. At 08:50 PM 8/16/2004 -0700, Michel Py wrote: >The really interesting question IMHO is this: does said content company >also peers, or just buys transit? I read in Bill Norton's papers that a >content company is a good candidate to peer with large tier-2s. Well, it is the *large* network-savvy Content Guys that I see peering quite a bit of their traffic. For these guys the motivation seems to be the performance benefits (it is all about pages coming up fast, end user behavior stuff), but the financial savings isn't far behind. FOr these guys the savings are still in the millions per annum. And these are the guys that do enough volume to negotiate transit prices in the teens. > > The Cost of Internet Transit in.. > > Commit AU SG JP HK USA > > 1 Mbps $720 $625 $490 $185 $125 > > 10 Mbps $410 $350 $150 $100 $80 > > 100 Mbps $325 $210 $110 $80 $45 > > 1000 Mbps $305 $115 $50 $50 $30 > >Someone mentioned that this was comparing apples to oranges. Indeed it >is, <stuff deleted> I would disagree that these are apples and oranges comparisons - these are real prices (normalized to USD) for transit that someone in the country would pay to access the big 'I' Internet. The Peering Coordinators I spoke with that have expanded into these markets did point out that each Peering Ecosystem differs - I think I documented about 10 differences in the Asia Pacific Peering Guidebook - but, ultimately, they will need to buy transit in that market. So these numbers are useful for budgeting for network expansion into Asia. I would also share that the local loop prices in these other markets vary widely ; an OC-3 local loop in Singapore may be twice the cost of a distance insensitive OC-3 local loop in Hong Kong. To that end, the business cases for peering will be quite different. Bill

5 4

New list: ddos-fighter
by Nicolas FISCHBACH 17 Aug '04

17 Aug '04

Hi all, We would like to announce a new mailing-list: ddos-fighter(a)securite.org This list has been created to enable owners and users of DDoS detection and mitigation devices (*) at ISPs/NSPs to discuss architecture and deployment, share tips, filtering templates, experience and operational models, etc. To subscribe send a mail specifying: who you are (ASN/company, position/job desc., Internet security references - if any) and which product(s) [detection and mitigation] you use AND are willing to discuss/share experience on (no lurkers, no marketing, no sales, etc) to: ddos-fighter-subscribe(a)securite.org We may ask you to "prove" that you actually own and operate such devices. If you have any question or feedback: nico(a)securite.org This list is not for real-time DDoS mitigation and inter-SP coordination, for this please see nsp-sec: http://puck.nether.net/mailman/listinfo/nsp-security Most of the nsp-sec charter applies to this list too. Also, note that the list is currently not "public" (as opposed to cisco-nsp or juniper-nsp for example). (*) Arbor Peakflow, Cisco(/Riverhead) Guard, Mazu Profiler/ Enforcer, TopLayer IPS, Captus IPS, TippingPoint Unity, etc. Things like ACLs and blackholing don't count :) Nico. -- Nicolas FISCHBACH (nico(a)securite.org) <http://www.securite.org/nico/> Senior Manager - IP Engineering/Security - COLT Telecom Securite.Org Team - http://www.securite.org/

2 1

Re: Summary with further Question: Domain Name System protection
by sthaug＠nethelp.no 17 Aug '04

17 Aug '04

> > this should be pushed to > > the router. don't waste CPU cycles > > on the Nameserver. > > Hosts tend to be a faster writeoff cycle than routers in companies I've > worked at, therefore getting the benefit of moores law about 25% faster > than the routers. Turn on firewalling in the host. If you have a choice between access lists on a software forwarding based router and firewall on a host, this may be a good choice. If your routers have hardware forwarding, I'd go for the router every time... Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

2 1

Re: SYN flood attacks? [Virus Checked]
by Brent_OKeeffe＠asc.aon.com 17 Aug '04

17 Aug '04

I think I also heard about some new email worm that takes advantage users that open attachments... (Sorry, just HAD to jump on that bandwagon) Brent Richard A Steenbergen <ras(a)e-gerbil.net> Sent by: owner-nanog(a)merit.edu 08/17/2004 02:41 PM To: jgraun(a)comcast.net cc: nanog(a)merit.edu Subject: Re: SYN flood atacks? [Virus Checked] On Tue, Aug 17, 2004 at 06:28:55PM +0000, jgraun(a)comcast.net wrote: > I have been hearing rumors about some SYN flood atacks on the Internet > today. Anybody hear anything? Interesting coincidence, I just heard a rumor about someone receiving spam today. Perhaps the are connected. It might even be a conspiracy. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

1 0

SYN flood atacks?
by jgraun＠comcast.net 17 Aug '04

17 Aug '04

I have been hearing rumors about some SYN flood atacks on the Internet today. Anybody hear anything? Thanks Jason

3 2

Re: Summary with further Question: Domain Name System protection
by sthaug＠nethelp.no 17 Aug '04

17 Aug '04

> What I'm not sure about ACL on router is, how to > survive DNS server under DoS/DDos attack. We suffered > from DoS attack last year, and we found the source IPs > of that attack locate in our customers IP address > blocks. ACL on router could only filter those traffic > not meaningful to DNS server, but how about those DDoS > attacking packets? Your router can presumably rate limit the traffic towards the name server to a level the name server can handle. On the name server you can perform further rate limiting on an IP address basis, with for instance FreeBSD ipfw. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

Re: Summary with further Question: Domain Name System protection
by sthaug＠nethelp.no 17 Aug '04

17 Aug '04

> 1. ISPs use firewall to protect their DNS server; Depends. You don't normally need a full fledged (stateful) firewall. Normal (stateless) router access lists are just fine. > 2. ACL on router may be a good solution for protecting > DNS servers, the policy could be "only pass those > packets, whose originate from incustomers' IP address > blocks and destinate to UDP port 53 of DNS server"; In general, allow only relevant traffic. That may be a bit more than just UDP port 53: You really want to allow TCP based DNS queries also, and your name server probably needs SSH, NTP and similar. > 5. 'bogon'in BIND configuration could be used to > filter requests from RFC1918 address; Better to do it on the router. > 6. Firewall may become bottleneck of DNS server farm > in situation of DoS attack or situation of high > session rate; Routers with hardware based access lists. No problem. > b) Is there any public available performance > evaluation on Nominum's product? See Brad Knowles' tests: http://www.ripe.net/ripe/meetings/archive/ripe-44/presentations/ripe44-dns-… We currently have the Nominum CNS on trial here, and we are very impressed. It performs much better than BIND 8/9 - our measurements show even greater differences than Brad Knowles' tests. Example: One server running BIND 9 shows more than 30% CPU usage during peak hours, but only 2-3% with Nominum CNS. We also have the issue that BIND 9 seems to start *failing* when it reaches a certain cache size (as in: Some queries are either not answered at all, or they are answered with SERVFAIL). Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

2 1