- NANOG - lists.nanog.org

Whois/RWhois Server - what is everyone running..?
by Richard J. Sears 21 Jul '04

21 Jul '04

We are looking into the possibility of implementing our own RWhois server as opposed to continuing to provide information via SWIP. I am looking for any advice as to what people are currently running for their whois/rwhois server. I have seen http://www.rwhois.net and actually have it installed and running, but it utilized flat files instead of a backend database, and we have looked at the RIPE whois server as well. Searching Google does not seem to produce a variety of whois/rwhois server software. TIA ! ****************************************** Richard J. Sears

2 1

Network-based Security Solutions
by Josh Fleishman 20 Jul '04

20 Jul '04

I'm currently researching security solutions for the service provider environment and figured I'd query the list for recommendations and real world experiences. I know network security is a rather large topic, so let me try to narrow down my area of interest some.. Network infrastructure protection seems to be the topic of most of the security presentations given at previous meetings, however there's not much information out there regarding host and subscriber protection via the network. Specifically my interests are focused on the netflow based solutions, network appliances (IPS, etc..) and traffic scrubbers. I'm finding it increasingly difficult to weed through all the vendors out there who upon closer evaluation are truly only suited for enterprise/small service provider deployments (less than 1Gbs). Any help in narrowing down my focus along with real world experiences is greatly appreciated. A discussion of router configuration, black-holing, sink-holing, and other types of holing isn't necessary. Also, I'm also interested in hearing any suggested testing methodologies or publications that might assist with the overall selection process. Thanks, Josh

1 0

Script Injection Makes Phishing Harder to Catch
by Henry Linneweh 20 Jul '04

20 Jul '04

A new twise on phishing... http://www.eweek.com/article2/0,1759,1624905,00.asp -Henry

2 1

Re: BGP Dampening question
by D Train 20 Jul '04

20 Jul '04

<<<If A is flapping THAT much, time to get another provider, or another local loop. If it <<<only flaps occasionally, not a big deal, the routers will handle it. It isn't so much that one of our links are flapping all of the time, but in our enterprise we have over 1000 locations, which can be 10 or 15 circuits flapping at one given time. This is more for management/administration reasons, other than just wheather or not the router can with stand the torture. Each location is its own AS, and we are running EBGP between all of our ASs, internally inside our global AS, if that makes sense. If it were just a couple of cirucits dying on us, that would be fine, but we are trying to come up with some sort of dynamic solution so if our primary circuit is flapping, we won't be flopping back in forth, from our primary to our secondary, from BGP routes, to default route, and vice-versa, keeping our network stable . <<<That said, I would not use flap dampening for this. If you don't recommend BGP dampening to fix our problem, what else is there, that I have not found or thought of yet. Is there a true dynamic solution to our problem? <<<yes, you can do what you want with flap dampening. Your router will penalize the <<<announcements from A for every time it flaps, and will wait until it has stopped <<<flapping for a user definable time before sending packets to A again. So you could still use dampening successfully, even though the bgp session keeps resetting. Does your peering session have to remain stable, with you just dampening some routes, or can your session keep bouncing, and it will still know to store these routes in either their history state, or dampening state? D- --------------------------------- Do you Yahoo!? Yahoo! Mail Address AutoComplete - You start. We finish.

2 1

Re: Looking for recommendations for Datacenter off CA Faultline
by Robert Bonomi 20 Jul '04

20 Jul '04

David Lesher <wb8foz(a)nrk.com>, wrote: > > Speaking on Deep Background, the Press Secretary whispered: > > > > > > > > Lots of stuff from Wall Street Financial houses set up their backups in > > Kansas City. > > Is there a backup site in those KC limestone mines? > > Only thing is, where's the New Madrid fault....? Reasonably far away from Wall Street. <grin> The whole idea behind 'geographically diverse' backups is not to have a place where 'nothing can happen to knock it out', but to have places such that _no_single_event_ can clobber everything. If New Madrid lets go, *and* San Andreas lets go at the same time, a *lot* of places will have _real_ troubles. Heck, not that many years ago, when the Chicago River 'sprang a leak' and took out most of Chicago's business district -- it turned out that there was not enough 'hot site' reserve capacity in _all_of_North_America_ to accomodate all the _downtown_Chicago_only_ sites that pulled the trigger on their emergency backup plan. One of my then clients activated their contract backup plan about 4 hours into the mess. They got the last available systme in San Diego (closest thing available). If they'd been 10 minutes later, it would have been Hawaii. (The systems group was *really* wishing managemnt _had_ waffled for another 10-15 minutes! :) There _were_ a bunch of slower-reacting sites that got told "sorry, we're full up. No room at the inn." I hate to think what things would have been like if it had been something that affected the 'suburban' data-center facilities as well. Not to mention something like New Madrid cutting loose, and taking out St. Louis, Kansas City, Des Moines, and a bunch of other places, as well as Chicago.

1 0

Looking for recommendations for Datacenter off CA Faultline
by Nicole 20 Jul '04

20 Jul '04

Hello all. A company I work with (who's servers are located in the San Jose, CA) is looking to setup some backup servers at a datacenter whose connectivity and location is off any faultline, or away from other malady, that might effect its main servers datacenter or connectivity. Problem is, they also want them as physically close as possible. Might anyone have any recommendations for datacenters and or ways I can best determine this? It does me no good to go to a datacenter whose connectivity also comes from the same peeing points or fiber that would be effected or take down a data center in South Bay. Despite being off faultline. Hopefully I have worded this coherently. Thanks!! Nicole

16 16

anybody got functioning contacts at shaw.ca ?
by Robert Bonomi 20 Jul '04

20 Jul '04

Trying to notify them of virus-infected machines on their network. Sending to the address they have registered with 'abuse.net', gets: > From MAILER-DAEMON Mon Jul 19 11:34:50 2004 > Date: Mon, 19 Jul 2004 10:34:35 -0600 > From: Mail Delivery Subsystem <MAILER-DAEMON(a)aup.shaw.ca> > Subject: Returned mail: see transcript for details > > This is a MIME-encapsulated message > > --Boundary_(ID_aXUiob0fehS5A7mHSD1mfA) > Content-type: TEXT/PLAIN > Content-transfer-encoding: 7BIT > > The original message was received at Tue, 13 Jul 2004 05:01:49 -0600 > from orion.shaw.ca [10.0.30.40] > > ----- The following addresses had permanent fatal errors ----- > "|/home/aup/autoresponder-script" > (reason: Deferred) > (expanded from: <aup(a)aup.shaw.ca>) > > ----- Transcript of session follows ----- > Duplicate specification "errors-to|e=s" for option "e" > Duplicate specification "verbose|v" for option "v" > Unknown option: ignore-to > Bad RFC822 field name ' as of 2004/07/13 06' > at /usr/local/bin/autoresponder line 725 > Deferring message and exiting > No recipient addresses found in header > "|/home/aup/autoresponder-script"... Deferred: prog mailer (/bin/sh) exited with EX_TEMPFAIL > Message could not be delivered for 5 days > Message will be deleted from queue > > --Boundary_(ID_aXUiob0fehS5A7mHSD1mfA) > Content-type: message/delivery-status > > Original-Envelope-Id: 0I0S00303EN09I00(a)orion.shaw.ca > Reporting-MTA: dns; aup.shaw.ca > Arrival-Date: Tue, 13 Jul 2004 05:01:49 -0600 > > Original-Recipient: rfc822;internet.abuse(a)sjrb.ca > Final-Recipient: RFC822; aup(a)aup.shaw.ca > X-Actual-Recipient: X-Unix; |/home/aup/autoresponder-script > Action: failed > Status: 4.4.7 > Diagnostic-Code: X-Unix; 75 > Last-Attempt-Date: Mon, 19 Jul 2004 10:34:35 -0600 > They appear to have a bunch of script problems -- only one of which i can troubleshoot from this end. :-% The 'bad RFC822 field name' is the last part of the actual "Subject: " header. looks like 'something' line-wrapped it, and then 'something else' didn't recognice a 'continuation line' -- the original line is about 85 chars long.

2 1

BGP Dampening question
by D Train 19 Jul '04

19 Jul '04

I was needing to know if anyone could assist in helping me find a solution to a problem I am experiencing. Here is the scenario: I have an AS 20, that has 2 circuits one to city A, and one to City B. City A and City B are in another AS, lets say AS 1. In my AS 20, I am learning the default route via EBGP, from City A,through my primary link, and also have a static route configured to traverse my secondary link, to City B. If I keep seeing the physical connection to City A flapping, of course bgp will flap, but will I be able to use route dampening to control the instability in AS 20? Will I be able to tweak route dampening to where I will be able to just use the secondary for say a set time, before it will try to use the primary link, even if this connection is continuously flapping? I am hoping that I will be able to tweak dampening to where it will just use my secondary link, until I can fix my primary link, w/o having to manually shut the interface, or shut bgp? I apologize if this is a bit off topic... TIA, D- --------------------------------- Do you Yahoo!? Yahoo! Mail - 50x more storage than other providers!

3 2

RE: Regional differences in P2P
by Michel Py 19 Jul '04

19 Jul '04

> Mikael Abrahamsson wrote: > Ethernet: > Peak almost twice upload as download. > Average is 2.5-3 times more upload than download. > ADSL 8M/800k: > Peak twice the amount download as upload > Average is 1.3-1.5 more download than upload > Upload bw usage is almost flat over time > Download bw peak is approx double the average level. I have similar figures. > My interpretation of this is that p2p networks are > quite intelligent in using the available bandwidth, All the available egress bandwidth, indeed. It is very unusual to see a p2p broadband client maxed out on the downstream. But what is also true is that the bugger the upstream, the better what comes as p2p downstream, as most p2p systems have something that rewards heavy uploaders. > and that Copyright holders only solution is a > "content crunch" due to providers limiting their > users upload potential due to heavy usage, such as > capping the amount of bandwidth allowed per month > or alike. I agree, but I see it as a bottom line matter, not a Copyright matter. It does cost a lot of money to build/upgrade the network to support big bandwidth and the corresponding transit. > Walter De Smedt wrote: > It makes more sense to introduce more differentiation in > product offerings (pricing) where BW 'hoggers' pay more > than the 'moderate' users instead of a general price > increase. The net effect should be that profits increase, > either by reduced network load or by higher revenues from > product differentiation. Agree in principle. > Caveat: this might be an utopian vision ;-) Let's say we don't have the tools yet for this. This is why today we speed limits, because speed limits are the poor man's bandwidth management. > what if P2P applications would employ encryption > schemes (e.g. IPSec) - this would render > signature-based recognition useless. p2p apps _will_ use encryption sooner or later, if not to fool signature-based recognition systems to try to dissimulate the piracy behind encryption. > Are there any p2P systems which optimize traffic > by localizing it, when possible? It's not possible today. Optimizing traffic by localizing it would imply that out of two possible sources, one local and one remote, you use only the local one. This goes against speed: most p2p clients will download simultaneously from both sources (from all available sources for that matter). Optimizing traffic by localizing it requires that the supply exceeds the demand, which we don't have today. Besides, there is another form of localizing that happens on campuses, it's called a blank CD-R :-) Michel.

1 0

Traffic Volume Manager ? (Previously: RE: Regional differences in P2P)
by Hendrianto Muljawan 19 Jul '04

19 Jul '04

Hello, the discussion here is getting interesting for me, because people are talking about not only capping the Bandwidth but also capping the volume of the traffic sent by a customer. So far people are used to do the capping of bandwidth with a Bandwidth Manager device, which does traffic shaping based on e.g. application/protocols, etc. Now, since we are talking about capping on the volume, what is the product available on the market which can do both bandwidth and volume capping ? thanks, Muljawan -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Michel Py Sent: Saturday, July 17, 2004 3:28 AM To: sthaug(a)nethelp.no Cc: nanog(a)merit.edu Subject: RE: Regional differences in P2P > Steinar Haug wrote: > Telenor, the largest Norwegian service provider, capped their ADSL > customers at a ridiculously low 1 Gbyte/month for a while. Presumably > they lost sufficient business to other > (uncapped) providers that they noticed - the cap has now been removed. Ridiculous is the word here. Download two service packs and you're done for the month? I can understand this happening in Brazil or India, where caps are a tool to attract enough customers so they bring revenue that in turn will be re-injected in much needed backbone upgrades, but in Norway or the US it does not make a lot of sense to me. >> Michel Py wrote: >> I agree, but see above: a 40GB/mo cap is not something that I care >> about. Granted, I'm not a hardcore file swapper but 40GB/mo are more > Mikael Abrahamsson wrote: > I don't know of any capped service over here, nobody dares take the > first step. The largest 10meg provider here launched a new 100 meg > full duplex service for their approx 200.000 household reach at > USD$110 a month with a 300G cap (their 10 meg service for $45 a month > is uncapped) and there has been a fair amount of users complaining > about 300G not being nearly enough. When you start swapping DVDRs it > just isn't. There is a need for capping 10 and 100 meg residential though; if you want to run your 100 Mb/s pipe full all the time it represents 26TB per month in each direction; you can't give 2/3rds of an OC-3 to a customer for $110/mo. A 300GB/mo cap means that the customer is using their line an average of 1.15%, which brings the interesting question of what a reasonable speed/cap ration should be. 1.5 Mb/s = 389 GB/mo 10 Mb/s = 2.6 TB/mo 100 Mb/s = 26 TB/mo Speed/cap ratios: 1.5 Mb/s capped at 1 GB/mo = 0.25% ridiculous IMHO 10 Mb/s capped at 40 GB/mo = 1.54% 100 Mb/s capped at 300 GB/mo = 1.15% Thoughts, anyone? Michel.

3 2