- NANOG - lists.nanog.org

RE: Routers vs. PC's for routing - was list problems?
by Rowland, Alan D 24 May '02

24 May '02

AFAIK standard (non-proprietary) CompactFlash, SmartCards, Memory Stick, et al, are seen as (removable) storage with typical allowed attributes. I can set a file/folder/card to 'locked' in my camera but when plugged into the computer this will show as 'read only.' Then again, router manufacturers are infamous for jiggering as much as possible to proprietary. Might still be able to 'administer' the card in another machine then install it in the proprietary device but that might void your warranty. :) Hey, they're just protecting their market share, right? Worked for Apple, oh, wait a minute... (/mnt asbestos underwear) Just my 2¢. -Al -----Original Message----- From: Steven J. Sobol [mailto:sjsobol@JustThe.net] Sent: Thursday, May 23, 2002 2:39 PM To: Dan Hollis Cc: E.B. Dreger; Vinny Abello; nanog(a)merit.edu Subject: Re: Routers vs. PC's for routing - was list problems? On Thu, 23 May 2002, Dan Hollis wrote: > On Thu, 23 May 2002, Steven J. Sobol wrote: > > On Thu, 23 May 2002, E.B. Dreger wrote: > > > EIDE-based flash drives have become very inexpensive. Some > > > embedded systems use CompactFlash boards. > > Can you set flash drives to be write-only? > > Why would you want to do this? Duh. Sorry about the brainfart. I was about to launch into a long explanation of what I want to do when I realized I wrote "write-only" instead of "read-only." I meant "read-only." Note to self: Engage brain *before* fingers. -- Steve Sobol, CTO (Server Guru, Network Janitor and Head Geek) JustThe.net LLC, Mentor On The Lake, OH 888.480.4NET http://JustThe.net "In a 32-bit world, you're a 2-bit user/You've got your own newsgroup: alt.total.loser" - "Weird Al" Yankovic, "It's All About the Pentiums"

2 1

Need help GigE between Luxn<-->Cisco7500
by Arman 24 May '02

24 May '02

Hello, We have recently turned up a GigE link (~5 miles) between our two facilities. The carrier, Time W, is using Luxn 3202 optical access devices as termination gear on each end of the link. The luxns in turn connect via GigE to two cisco 7507 GEIP (we know about GEIP vs GEIP+). diagram 10 ft 5 mile 10 ft cisco7507----- Lyxn 200===CO=====Luxn 1019 ------cisco7507-1019 ^^^ ^^^ ^^^ multi-mode single-mode multi-mode The Cisco 7507 gigE port at 1019 sees alot of Giant packets and %OSPF-4-ERRRCV errors suggesting that the ethernet frames are getting corrupted. MTU on each cisco is 1500 and the link is forced to 1000. We consistently see packet losses of 10-20% with no load at all. If anyone has any experience with Luxn gear and/or Luxn-cisco interconnection please contact me off list. thanks ak -----------------details-------------------------- interface GigabitEthernet5/0/0 ip address X.X.X.1 255.255.255.252 ip route-cache distributed load-interval 30 no negotiation auto GigabitEthernet5/0/0 is up, line protocol is up Hardware is cyBus GigabitEthernet Interface, address is 0050.73a0.bda0 Internet address is X.X.X.2/30 MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex mode, link type is force-up, media type is SX output flow-control is unsupported, input flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:07, output 00:00:01, output hang never Last clearing of "show interface" counters 1d19h Queueing strategy: fifo Output queue 0/40, 0 drops; input queue 0/75, 0 drops 30 second input rate 0 bits/sec, 1 packets/sec 30 second output rate 1000 bits/sec, 1 packets/sec 351887 packets input, 43900564 bytes, 0 no buffer Received 34773 broadcasts, 0 runts, 1028 giants, 0 throttles 0 input errors, 0 CRC, 73419 frame, 0 overrun, 0 ignored 0 watchdog, 19308 multicast, 0 pause input 0 input packets with dribble condition detected 181113587 packets output, 2653176686 bytes, 0 underruns(0/0/0) 0 output errors, 0 collisions, 3 interface resets 0 babbles, 0 late collision, 0 deferred 2 lost carrier, 0 no carrier, 0 pause output 0 output buffer failures, 0 output buffers swapped out

1 0

Re: Routers vs. PC's for routing - was list problems?
by Dan Hollis 24 May '02

24 May '02

On Thu, 23 May 2002, Jason K. Schechner wrote: > On Thu, 23 May 2002, Dan Hollis wrote: > > On Thu, 23 May 2002, Steven J. Sobol wrote: > > > Can you set flash drives to be write-only? > > Why would you want to do this? > Logging. If a h@xx0r cracks your box he can't erase anything that's > already been written there. Often it takes a physical change (jumper, > dipswitch, etc) to change from write-only to read-only making it pretty > tough for the h@xx0r to cover his steps. Eh? Setting a flash drive to *write-only* would fix this how? Why would anyone want to make a flash drive *write-only*? -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

5 5

Re: Routers vs. PC's for routing - was list problems?
by E.B. Dreger 24 May '02

24 May '02

JKS> Date: Thu, 23 May 2002 17:34:29 -0400 (EDT) JKS> From: Jason K. Schechner JKS> > Why would you want to do this? JKS> JKS> Logging. If a h@xx0r cracks your box he can't erase JKS> anything that's already been written there. Often it takes BSD enforces append-only when running proper securelevel. AFAIK, Linux lacks this attribute, and root can disable the so-called "immutable" attrib. JKS> a physical change (jumper, dipswitch, etc) to change from JKS> write-only to read-only making it pretty tough for the JKS> h@xx0r to cover his steps. Why not log to an external bastion host? -- Eddy Brotsman & Dreger, Inc. - EverQuick Internet Division Phone: +1 (316) 794-8922 Wichita/(Inter)national Phone: +1 (785) 865-5885 Lawrence ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Mon, 21 May 2001 11:23:58 +0000 (GMT) From: A Trap <blacklist(a)brics.com> To: blacklist(a)brics.com Subject: Please ignore this portion of my mail signature. These last few lines are a trap for address-harvesting spambots. Do NOT send mail to <blacklist(a)brics.com>, or you are likely to be blocked.

3 2

RE: Routers vs. PC's for routing - was list problems?
by Rowland, Alan D 24 May '02

24 May '02

Most flash media includes read only 'tabs' similar to the legacy floppy variety. Steven may have hit on an interesting solution here... -Al -----Original Message----- From: E.B. Dreger [mailto:eddy+public+spam@noc.everquick.net] Sent: Thursday, May 23, 2002 2:38 PM To: FiXXiT(a)off-road.com Cc: Dan Hollis; Steven J. Sobol; Vinny Abello; nanog(a)merit.edu Subject: Re: Routers vs. PC's for routing - was list problems? JKS> Date: Thu, 23 May 2002 17:34:29 -0400 (EDT) JKS> From: Jason K. Schechner JKS> > Why would you want to do this? JKS> JKS> Logging. If a h@xx0r cracks your box he can't erase JKS> anything that's already been written there. Often it takes BSD enforces append-only when running proper securelevel. AFAIK, Linux lacks this attribute, and root can disable the so-called "immutable" attrib. JKS> a physical change (jumper, dipswitch, etc) to change from JKS> write-only to read-only making it pretty tough for the JKS> h@xx0r to cover his steps. Why not log to an external bastion host? -- Eddy Brotsman & Dreger, Inc. - EverQuick Internet Division Phone: +1 (316) 794-8922 Wichita/(Inter)national Phone: +1 (785) 865-5885 Lawrence ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Mon, 21 May 2001 11:23:58 +0000 (GMT) From: A Trap <blacklist(a)brics.com> To: blacklist(a)brics.com Subject: Please ignore this portion of my mail signature. These last few lines are a trap for address-harvesting spambots. Do NOT send mail to <blacklist(a)brics.com>, or you are likely to be blocked.

1 0

Technical Contact and Network Solutions (now Verisign)
by Spencer.Wood＠dot.state.oh.us 24 May '02

24 May '02

Good Morning: I was wondering, does anyone have a technical contact over at Verisign? We have a couple of domain names that we are trying to change the information on, and we are having technical problems changing the information (ie: which domain servers it should point to). I've called it into Verisign technical support earlier in the week, and they said "We have to send this over to engineering", and well, that's the last I've heard of it......everytime I call Verisign customer support, I get the same line "It's been sent over to engineering, and we can't find the status". I was hoping that someone might have a contact over a Verisign Engineering that could help us out... Thanks Spencer ************************************************************ Spencer Wood, Network Manager Ohio Department Of Transportation 1320 Arthur E. Adams Drive Columbus, Ohio 43221 E-Mail: Spencer.Wood(a)dot.state.oh.us Phone: 614.644.5422/Fax: 614.887.4021/Pager: 866.591.9954 *************************************************************

3 2

Re: operational: icmp echo out of control?
by Amgad Zeitoun 24 May '02

24 May '02

> Path latency doesn't change much, you can determine > this with very few probes. > . . . . > Much like web spidering, some simple common sense can help keep probes > from becoming a hassle: > . . . . > * Consider what is the smallest unit of "distinct network topology" you > need to map. A very reasonable number would be a /24. We have been studying these issues as part of the IDMaps project and have two reports quantifying our results. If interested, you can download our papers from: http://idmaps.eecs.umich.edu/papers/rtt.ps.gz http://idmaps.eecs.umich.edu/papers/ap.pdf Cheers, Amgad

1 1

Re: Routers vs. PC's for routing - was list problems?
by Dave Israel 24 May '02

24 May '02

Then why ot boot from a CD-ROM? Sure, it moves, but only for the few minutes it takes to boot. Then it spins down and sits idle for the n days/weeks/months until the next reboot. It would probably last as long as the solid state drive, and would be cheaper. The big problem here, of course, is software upgrades. Personally, I'd just use a hard drive and initrd (under linux) and leave the hd controller out of the kernel. When it comes time to upgrade, reboot to an alternate kernel that has the hd support code. But that's more of a discussion for a Linux list than here. -Dave On 5/23/2002 at 18:01:03 -0400, Steven J. Sobol said: > > On Thu, 23 May 2002, E.B. Dreger wrote: > > > SJS> a basic question, but the only EIDE mass-storage devices > > SJS> I've used are more traditional drives. > > > > Why not partition wisely, then mount the desired partition as > > read-only? Or I guess one _could_ mount each partition as RO... > > > > But why? > > The box I want to build is passing packets between the rest of my network > (and the public Internet) and one server that will hold sensitive data. > It'll be a Linux box with the TCP/IP stack running in bridged mode, with > two ethernet adapters installed. The box just needs to boot up and run. It > doesn't need to log anything. > > -- > Steve Sobol, CTO (Server Guru, Network Janitor and Head Geek) > JustThe.net LLC, Mentor On The Lake, OH 888.480.4NET http://JustThe.net > "In a 32-bit world, you're a 2-bit user/You've got your own newsgroup: > alt.total.loser" - "Weird Al" Yankovic, "It's All About the Pentiums" > > > -- Dave Israel Senior Manager, IP Backbone Engineering

4 3

Re: Routers vs. PC's for routing - was list problems?
by Vinny Abello 24 May '02

24 May '02

At 02:20 PM 5/23/2002 -0400, you wrote: >Vinny Abello wrote: > > > > I would have to say for any Linux/BSD platform to be a viable > > routing solution, you have to eliminate all moving parts or as much > > as possible, ie. no hard drives because hard drives will fail. Not > > much you can do about the cooling fans in various parts of the > > machine though which routers also tend to have. Solid state > > storage would be the way to go as far as what the OS is installed > > on. You have to have something to imitate flash on the common > > router. Otherwise, if you can get the functionality out of a PC, > > I say go for it! The processing power of a modern PC is far beyond > > any router I can think of. I suppose it would just be a matter of > > how efficient your kernel, TCP/IP stack and routing daemon would > > be at that point. :) > >I've several comments here. > >First off, you're right about moving parts generally being a bad thing. >However, it is not always necessary to eliminate the hard drive. Two >drives in a RAID-0 configuration may be reliable enough. Especially if >the failure of a single drive sets off sufficient alarms so that it can >quickly be hot-swapped for a new drive. I'm assuming you meant RAID-1. In RAID-0 if you 'swapped' any drive all your striped data is toast. ;) >The real problem with using PCs is bandwidth and hardware reliability. > >PCs generally don't have many hot-swappable parts. You can get hot-swap >hard drive assemblies without too much work, and redundant power >supplies can be purchased. A motherboard that allows hot-swapping of >PCI cards (usually by having multiple busses and a mechanism to turn >them off individually) is very rare. You can get dual-CPU motherboards, >but not with the processors being hot swappable. And I don't know if >any will allow the system to transparently fail over from one CPU to >another, should the primary fail. I agree with you on that. Hot swapability for various interfaces is something routers obviously have over PC's. >Then there's the issue of the PCI bus. Standard PCI (32-bit 33MHz) has >a theoretical maximum bandwidth of about 1Gbit/s. But you can never use >all of a PCI bus's bandwidth, so actual limits will be less than this. True... unless going for 64 bit PCI at 66MHz... still it's obvious that routers are designed for one simple purpose and generally have larger backplanes to handle that. >When you're doing software routing, every packet must cross the bus >twice - once for the receive and once for the send. So your standard >PCI bus (if used for nothing but packets) has a top speed of 500Mbit/s. >Which is less than three ports of full-duplex fast Ethernet at line >rate. Multiple busses and/or 64-bit 66MHz PCI can increase this limit, >but now you're talking about much more expensive motherboards. > >You can dramatically improve throughput if you can get line cards that >have on-board forwarding chips. If cards can forward packets between >each other without getting the CPU involved, then packets can cross the >PCI bus only once. But these kinds of line cards are not cheap, if they >can be found at all. And you will need some way of downloading your >kernel routing table into the cards, which may require some serious OS >hacking. > >In other words, a PC equipped to be as reliable and capable as a decent >router will likely end up costing as much as a router. And the reason >has nothing to do with the CPU speed or the operating system. I agree a router is probably more efficient in just routing packets, but in complex filtering or traffic manipulation/packet sniffing, a PC might have the edge. :) Don't get me wrong. I would never use a PC for a router, just as I wouldn't try to run my workstation as a 7206. ;) It's all just hypothesizing. Vinny Abello Network Engineer Server Management vinny(a)tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN

5 5

Re: Routers vs. PC's for routing - was list problems?
by Vinny Abello 23 May '02

23 May '02

At 04:17 PM 5/23/2002 -0400, you wrote: > > I agree with you on that. Hot swapability for various interfaces is > > something routers obviously have over PC's. > >Hot swap PCI is old news. True, but not widely implemented in the standard PC market. If you want a server that has hot swap capability, you're likely paying a premium price for a lot of extra other features. It's not something you can typically just build yourself, and if you can you'll need a case that allows you easy access to swap the PCI cards. By the time you pay for an enterprise level server with this capability, I would rather have put the money towards a good router. > > True... unless going for 64 bit PCI at 66MHz... still it's obvious that > > routers are designed for one simple purpose and generally have larger > > backplanes to handle that. > >However, $ for $, even when buying used cisco gear at 80% off from >dot-booms, a PC router will outperform any traditional router. At what speeds though? As you get into the higher gbic speeds, a PC doesn't have the backplane to cut it. Now if we're talking raw processing power, a PC can blow away a router in calculations per second any day. :) > > I agree a router is probably more efficient in just routing packets, but in > > complex filtering or traffic manipulation/packet sniffing, a PC might have > > the edge. :) > >Yes, ipfw/dummy is very very cool. Like, inducing a few 100 msecs of >latency to folks who don't pay on time :) Hehehehe... Interesting approach. I find it more fun to just shut them off. It makes them take you more seriously. Unfortunately I would say only a small percentage of users, may 20% or so would even notice the latency issues if they were having them. They're more likely to complain about slow transfer speeds. That is even more fun and can be done on any traditional Cisco... Traffic shaping is cool but hindered by being limited to controlling outbound traffic on an interface. Rate limiting even more fun. Hmm... [exceed action drop] Why is there so much damn packet loss on my connection when I put traffic across it??? ;) Vinny Abello Network Engineer Server Management vinny(a)tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN

1 0