- NANOG - lists.nanog.org

RFC2544 Network Benchmark Testing
by Stephen Perciballi 10 Dec '03

10 Dec '03

Hi, Does anyone have or know of any open source software for RFC2544 testing? IXIA boxes are nice but I don't plan on buying one right now. All other tools I've looked at seem to be lacking in one way or another. They have been really good at flooding the link ~or~ setting frame sizes etc. Any help would be appreciated. -- Stephen (routerg) irc.dks.ca

1 0

Re: Evolution of the U.S. Peering Ecosystem v1.1
by William B. Norton 09 Dec '03

09 Dec '03

At 06:23 PM 12/5/2003 -0500, alex(a)pilosoft.com wrote: > > 1) The Cable companies are peering (with Tier 2s and each other) in a > > *big* way >That's probably why ATDN depeered ~20 networks over last few months, >while Comcast and Charter do not peer at all. I had not heard that. As for Comcast and Charter, I would add the word "yet." > > 2) The Large Network Savvy Content Companies are getting into peering in > > a *big* way >With transit bandwidth at 20k$/GE, and Equinix shared fabric now priced at >nearly half that, I don't see that many "content companies" peering all >that much. The phrase, "You get what you pay for" comes to mind. There is real difference between transit services IMHO. Also, you rarely use the full gigE in these types of arrangements, so you need to be a little careful doing the "simple math." Having said all that, the transit price pressures are certainly there and it does make the peering financial argument a little tougher. I've heard the argument that "Peering is better than transit. It ought to cost more." > > 3) The Large Network Savvy Content Companies are getting their content > > directly onto the Cable companies eyeball networks by peering > > relationships. >I wish. Well then you shall receive. The large guys do peer (Yahoo!, MSN, Google, EA, Sony Online, etc.) in a very big way. I expect too these guys are simply leading the charge - those content companies large enough to employ a network engineering staff that can do the math will be following as well. It is not only a financial motivation; peering provides greater control over routing and is often seen as a performance enhancing strategy. Folks like Yahoo! seem to emphasize the end-user performance improvements over the financial savings these days. >Out of big eyeball networks, only SBC has reasonably open policy, rest are >attempting to force "content networks" into paid peering arrangements >using restrictive ratio requirements Hmm. SBC has what I call a "Selective Peering" inclination; they will peer with you if you meet certain criteria. The cable companies are all different of course but generally seem to have migrated from a "No Peering" inclination (when @Home ran things for them the cable companies didn't peer) to an "Open Peering" inclination to reduce costs (and to deal with Kazaa traffic), to a "Selective Peering" inclination. I see this last step as an operations sanity motivation; peer with those who have at least 10M of traffic to exchange on a couple coasts. If you don't have that much traffic it may not be worth the time to configure the session, and when things break it may be more hassle than it is worth. The ones who are a bit different are the "Restrictive Peering Inclination" folks; those who have a peering policy articulated solely so they can say "No" with a reason. Rather than deal with the hassle of peering requests, some of these guys don't articulate their Peering Inclination in the form of a Peering Policy. "We have all the peering that we need" is the attitude, and, not to open a can of worms here, but it is a business rational attitude. Bill >-- >Alex Pilosov | DSL, Colocation, Hosting Services >President | alex(a)pilosoft.com (800) 710-7031 >Pilosoft, Inc. | http://www.pilosoft.com

2 1

tracking down subnet announcement disappearing / dropping to a single provider
by Eric Kagan 09 Dec '03

09 Dec '03

I apologize if this is off-topic - I rarely post, mostly just monitor. I am not posting this to [nsp] or [isp-bgp] for I don't believe the following is a configuration problem on my side, but an operational one of a certain provider. I am not going to sling dirt or put actual names / ASN, etc for now. I want to list the problem and if it is relevent I can post more specific data or be contacted offlist with suggestions or from the provider. The problem is completely intermittent. 99% of the time everything works fine. I have begged the customer to get their ASP's ISP involved since I believe that is where the problem lies. They claim it is my problem since we connect to them.....(Don't want to start a war here...I know) I am Provider A and my customer cannot connect to an ASP through Provider X. The problem lasts for what seems to be exactly 10, 15 or 30 minute intervals. I am announcing my /19 broken up into multiple /22 and /21's. It is only 1 of the /22 that has the problem. One of my links is not going down and I do back backup routes through multiple providers. It took me almost a month to confirm the problem because they would call be *after* it happened and everything would look fine. I put some monitors on the destination site and it will never test bad since the monitors were on other subnets. They finally called me while it was occuring and I did confirm I could not reach the site from any of the IP's in that certain /22 subnet. So, my point and questions: Has anyone ever heard of such a problem ? I tried to search some archives and google - but I can't really figure out what to search on that won't result in 1000 + matches. Is there any function or problem that might exist for exactly 10, 15 or 30 minutes (i.e. BGP Flap, subnet block filter / ACL ?) over and over ? Should I contact provider X dircectly ? Will they work directly with me ? I believe my customers ASP opened a ticket with their ISP but with all the layers and short time frame of the issue I don't think it will get resolved quickly or easily. Responses online or offline welcome. If anyone wants more specific info posted to the forum (IP subnet blocks, Provider X, ASN, etc) please let me know. Thanks Eric Eric Kagan Commrail, Inc. dba Access Northeast support(a)axsne.com 978-562-4475

2 1

Re: Cisco GSR logging issue
by Richard Welty 08 Dec '03

08 Dec '03

just a quick note to say thanks to those who have responded, off list and on. i've got some useful stuff, but haven't had time to sort through and reply to everything. i'll likely be putting up a web site on "safe" ways to configure logging on various types of routers so that you can trap the data needed for AUP/TOS enforcement against proxy hijackers and other network abusers w/o accidentally bringing down your network. richard -- Richard Welty rwelty(a)averillpark.net Averill Park Networking 518-573-7592 Java, PHP, PostgreSQL, Unix, Linux, IP Network Engineering, Security

1 0

Re: Need Contact at RoadRunner
by Michael.Dillon＠radianz.com 08 Dec '03

08 Dec '03

>Unless you like playing whack-a-mole, you need a smarter hammer, not a >bigger one. Email peering *IS* a smarter hammer. If all the cluefull email administrators would set up peering agreements with each other and exchange contact information, there would be fewer of these situations. Part of the problem is that there are no agreed rules of engagement for email abuse issues. By setting up email peering agreements in advance, we could put those rules of engagement in place and we could ensure that our email peers have the *RIGHT* contact information. Domain registry whois listings and INOC-DBA are not the right contact information because they are too general. Now, an email peering agreement could very well specify that certain whois contact listings should be used as a second resort and that agreement would make them the right contact info. Also, the email peering agreement could specify that INOC-DBA phone number ASNUM*999 is the number one choice of contact method and then it would become the right way to contact email peers. The fundamental problem is not that there isn't technology in place to solve these problems; it is that there aren't *AGREEMENTS* in place to solve these problems. Organizations like CAUCE are happy to just bitch and moan instead of working to bring all email operators together to set up working agreements for *MANAGING* the email abuse problems instead of always letting the abusers take the first steps and drive the whole issue. Anyone for a joint NANOG/CAUCE meeting? http://www.cauce.org In fact, given the past experience with two joint ARIN/NANOG meetings could the best way forward be to have more joint meetings that combine a NANOG meeting with some other non-BGP/routing operational forum? Perhaps something jointly with a security organization like CIS? http://www.cisecurity.org/ Suggestions? --Michael Dillon

5 4

Cisco GSR logging issue
by Richard Welty 08 Dec '03

08 Dec '03

i'm working with some folks to try and develop evidence about proxy hijackers on or transiting their networks. i have useful notes about doing this with non-GSR Cisco routers, but right at the moment all i have for the GSRs is a note indicating that netflow is needed. i have no personal experience with the GSRs and am looking for one of two things: 1) someone experienced in capturing this stuff on a GSR or 2) a pointer to a cisco oriented list where i can get 1) above. thanks in advance, richard -- Richard Welty rwelty(a)averillpark.net Averill Park Networking 518-573-7592 Java, PHP, PostgreSQL, Unix, Linux, IP Network Engineering, Security

2 1

Re: Router with 2 (or more) interfaces in same network
by Rosen Adam J NPRI 08 Dec '03

08 Dec '03

Hi. This topic was discussed about a month ago, but I just found this mail list while doing a search. I have the same question that was discussed before. However, this is the first router I have ever set up, so I could be completely wrong about how I am doing things, but I'll explain to the best of my ability. I am setting up a router/firewall (Nokia IP380). For redundancy, I want 2 interfaces on the same subnet. The IP380 will be connecting to a pair of routing switches which are running VRRP. I am trying to use static routes, due to the fact that network topology will not be changing outside of hardware failure, and to keep speed as high as possible. How can I set up static routing to the virtual router if I can't have a second interface on the same subnet to pick up the floating IP address in case the VRRP master fails? Am I misunderstanding VRRP here? If anyone can give me some helpful hints, I would appreciate it. Thanks Adam Adam J. Rosen Code 2233 Naval Undersea Warfare Center 1176 Howell St. Bldg. 1171-2 Newport, RI 02841 Phone: 401-832-4740 Toll Free: 800-669-6892 x24740 Fax: 401-832-2130 Email: rosenaj(a)npt.nuwc.navy.mil

1 0

IP Address Management Software Again
by Brennan_Murphy＠NAI.com 08 Dec '03

08 Dec '03

Hi, I'm evaluating IP address management software. Looking for the following: 1) Pointers to online reviews. 2) Views on what is the absolute best package out there. 3) Views on useful free software if it's worth considering. 4) Contact info of sales persons of commerical software. 5) Insights on processes followed to manage addressing. 6) Also specifically looking for software that aids in re-IP-ing portions of a network. 7) Strong views on particular packages that drove you nuts. (offline emails may be best) If I get enough info together, I'll post a follow-up compilation email. I've looked at past threads on NANOG concerning this topic and see only bits/pieces of what I am looking for. Hoping to obtain a more comprehensive set of data. Thanks! -BM

3 2

AOL rejecting mail from IP's w/o reverse DNS ?
by Christopher X. Candreva 07 Dec '03

07 Dec '03

Since I'm 99% sure the idea (or stupidity thereof :-) of blocking SMTP servers without reverse DNS came up here in this discussion, I just ran a manual queue run to clean out a queue, and saw this come up: ... Connecting to mailin-04.mx.aol.com. via esmtp...220-rly-xn05.mx.aol.com ESMTP mail_relay_in-xn5.9; Wed, 03 Dec 2003 09:59:55 -0500 220-America Online (AOL) and its affiliated companies do not 220- authorize the use of its proprietary computers and computer 220- networks to accept, transmit, or distribute unsolicited bulk 220- e-mail sent from the internet. Effective immediately: AOL 220- may no longer accept connections from IP addresses which 220 have no reverse-DNS (PTR record) assigned. >>> EHLO westnet.com I don't know if this is new -- I don't recall seeing it before, but it doesn't say they WILL refuse, just they may. If they do start blocking -- this WILL be an operational issue. ========================================================== Chris Candreva -- chris(a)westnet.com -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/

18 38

Explanation on recently noticed increase of udp 1026-1031 traffic
by william＠elan.net 07 Dec '03

07 Dec '03

The original notice about all this I received came through dshield announce. I followed up the information and thereafter came upon the message on the popadstop website, its rather interesting how they claim they did not intend their software to send a "pop-ad" advertisement of that same software (to random other systems) that is supposedly supposed to block such ads. Of course this was all just a "test" before they start selling their anti-spam software (which would probably act like a mail worm in advertising itself)... http://isc.sans.org/diary.html?date=2003-12-04 "Handlers Diary December 4th 2003 Updated December 5th 2003 06:39 EDT PopAdStop.com Scanning Component For over a week, we had been tracking an increase in port 1026-1031 UDP traffic. More detailed investigation revealed a component in this traffic with the following characteristics: (*) The payload consisted of two zero bytes (*) A large number of sources participated in these scans (*) the scans came from valid IPs, and the source port did not appear to be crafted This is different from most popup spam sent to this port. Most popup spam is sent by only a small number of sources. And usually uses a fixed source port. While popup spam in itself is not any more dangerous then e-mail spam, and more of an annoyance, the large number of sources hinted to the fact that it is likely sent from unsuspecting exploited systems ("Zombies"). The connection with popup spam was made later, by allowing a honeypot to respond to the two byte probe. The result was an ad sent by the probing host. ... The advertised site, "www.popadstop.com" does offer a program for download, which promises to stop future popup spam. We downloaded the application, and installed it in an isolated lab network. During install, the application checks for updates by requesting: www.neweststuff.com/versinfo.dat. Recent version of the application do not show any further outbound traffic. However, earlier version of the application did start to send the typical two zero bytes and popup spam. Summary An earlier version of the software distributed by PopAdStuff did actively scan and send popup spam from unsuspecting user's system." http://www.popadstop.com "NewestStuff.com LLC Official Statement PopAdStop has been discontinued... PopAdStop was a free product, and better than some similar products that others have sold for up to $40 in the past. The offering included a Messenger popup blocker, as well as a separately downloadable free web popup blocker. Free products or services are apparently not always appreciated... Bug report: Multiple indepentant reports indicate that the first few versions *MAY* have been affected by a modular advertisment component that had been accidentally inserted into the first version, apparently. This may possibly have caused PopAdStop to advertise itself from a few systems (providing a new form of Internet 'word of mouth' advertising, providing much greater distribution of PopAdStop in a much shorter time than we intended, and *MUCH* greater cost to *US*, because so many people downloaded PopAdStop from our website!!!), but was not part of the design. This possible bug was fixed ON ALL AFFECTED SYSTEMS with an automatic update, and no longer occurs. Very embarrassing indeed. Please accept our appologies if you experienced anything like this, but please do not slander us for it!!! The resulting public backlash and slander caused by this suspected bug seriously reduced our ability to use PopAdStop as a marketing tool for our SpamBurner product, and turned PopAdStop into nothing more than a huge waste of our time... Valuable lesson from the PopAdStop project: Do not let the same programmer develop two different pieces of software at the same time, and probably giving stuff away for free is a bad idea too..."

1 0