- NANOG - lists.nanog.org

decreased caching efficiency?
by Christian Kuhtz 24 Oct '00

24 Oct '00

Hey gang, Has anyone else around here noticed a decrease in caching efficiency over say, the past year or so? Seems we've seen a radical drop (order of magnitude). Seems popular sites are using more and more entirely dynamic, rapidly changing content.. If there's indeed a reduction in efficiency, caches simply introduce more transactional latency and provide no benefit to offset cost. What do people consider reasons to be to keep caching in the network? Have caching infrastructures materialized as starting points for content distribution, or have you guys ultimately rebuilt your infrastructure to serve that specific purpose? Faced with high hw cost, licensing fees, and reduced efficiencies, it appears business cases to keep the caches in the network (with all the effort and uglyness it takes to maintain exclude lists) seems difficult to make. Cheers, Chris PS: if you feel there's a place better suited to discussing this, shoot me a pointer. thx. -- Christian Kuhtz Architecture, BellSouth.net <ck(a)arch.bellsouth.net> -wk, <ck(a)gnu.org> -hm Atlanta, GA "Speaking for myself only."

16 40

PCMCIA Floppy required at NANOG20
by Simon Lockhart 24 Oct '00

24 Oct '00

Due to user error, I seem to have rendered my Libretto laptoipp unbootable. Does anyone have a pcmcia floppy drive (preferably toshiba) and a windows/ linux bootable floppy? If not, dpooes someone have a bootable CD I can use for a few minutes? Many tahhanks, Simon

1 0

DOS Attacks and reliable network contact data.
by Jason Slagle 24 Oct '00

24 Oct '00

I've seen an increase in DOS attacks over the past week or so, of a form I really haven't encountered before. Below are some logs. 22:30:52.821705 255.255.255.255.80 > 205.133.127.30.6667: R 0:0(0) ack 1062615418 win 0 22:30:52.821956 202.172.120.255.80 > 205.133.127.30.6667: R 0:0(0) ack 3046052966 win 0 22:30:52.822208 168.17.227.0.80 > 205.133.127.30.6667: S 21259901:21259901(0) ack 1412091198 win 2144 <mss 536> 22:30:52.822459 255.255.255.255.80 > 205.133.127.30.6667: R 0:0(0) ack 2473479669 win 0 22:30:52.822711 210.251.128.255.80 > 205.133.127.30.6667: R 0:0(0) ack 529389642 win 0 22:30:52.822962 195.53.123.0.80 > 205.133.127.30.6667: . ack 1625272127 win 9112 (DF) 22:30:52.823213 152.158.37.127.80 > 205.133.127.30.6667: R 0:0(0) ack 1362286194 win 0 Lots and lots of TCP ACK's from broadcast addresses. Looks like a new kind of indirect SYN/ACK flood based on broadcast addresses. Which led me to sort through my logs and do my best to get the amps shut down, which led me to my current problem/gripe. Their exists no reliable way to get the contact of a network without first querying arin, then apnic, then the .jp registry for instance. This is a royal PITA and is in no way scriptable that I can see. Am I wrong? Does such a thing exist? What can we do bout these attacks. Jason --- Jason Slagle - CCNA - CCDA Network Administrator - Toledo Internet Access - Toledo Ohio - raistlin(a)tacorp.net - jslagle(a)toledolink.com - WHOIS JS10172 -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GE d-- s:+ a-- C++ UL+++ P--- L+++ E- W- N+ o-- K- w--- O M- V PS+ PE+++ Y+ PGP t+ 5 X+ R tv+ b+ DI+ D G e+ h! r++ y+ ------END GEEK CODE BLOCK------

10 11

RE: Service Provider Exchange requirements
by Mike Duckett 24 Oct '00

24 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'll give a few more hints as to what I'm looking for.. How about ethernet versus ATM? With VLANs and high speed such as Gig/10Gig, I can get speed and one to many arrangements (at least for lower speeds). Should Ethernet be point to point or optionally multiaccess in nature? Or, what about MPLS? With MPLS, service provider connections can be established without concern for underlying media (e.g., ethernet, POS, ATM). Is Diff-Serv or ATM QoS a requirement or can 85-90% of requirements be met with loss/latency service as the baseline? What special arrangements should be made for hosting (e.g., local caching or streamers)? Yes, I'm stretching here a bit. - -----Original Message----- From: bmanning(a)vacation.karoshi.com [SMTP:bmanning@vacation.karoshi.com] Sent: Sunday, October 22, 2000 5:24 PM To: mduckett(a)bellsouth.net Cc: 'nanog(a)merit.edu' Subject: Re: Service Provider Exchange requirements > What switching and/or service characteristics would you require > such that an exchange point would be desirable (e.g., media types, > switch fabric, route servers, multicast services, SLAs, ..)? > Kind of depends on what you want out of your exchange and who your target marrket(s) are. Factor in budgets, (financial, space, environmental...) and you should have winnowed down the conceivable to the likely. Enjoy. - --bill -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBOfNoT5uyh6FekS+1EQI8VgCglnkgxLEuT5LYJAoqsYRFd67JejEAn1VJ jOz0O7zVxclHYHxuSQlqvskL =A7/Z -----END PGP SIGNATURE-----

6 8

Re: 64 Megs of Memory... and could this be the hacker?
by Mark Milhollan 24 Oct '00

24 Oct '00

>> >> ``maximum-prefix n p warning-only'' along with a log analyzer that >> >> recognizes the warning, are perhaps a better pair of friends. >> >How so? You recognize the warning, now what? >> Deliver the notice to NOC personel, via whatever means. Perhaps they'll >> terminate the session. Perhaps not. Granted in warning-only mode the >> session won't come back up by itself. > >And how exactly is this better than a maximum-prefix clause which drops >routes instead of dropping the session? The previous, unquoted, message said that having the session drop automatically wasn't always a desireable action. I provided an alternative. The external logic can be more complex than the logic present in IOS. I provided _one_ possible action. It could very well shutdown the session. It could do many things, any of which would be custom and could take into account the structure of the provider. It's also possible to drop the warning-only clause, allowing IOS to drop the BGP session _and_ have log watching tools do other things.

1 0

Re: 64 Megs of Memory...
by Mark Milhollan 23 Oct '00

23 Oct '00

[Sorry for the delay.] Dan Hollis writes: >On Fri, 13 Oct 2000, Mark Milhollan wrote: >> ``maximum-prefix n p warning-only'' along with a log analyzer that >> recognizes the warning, are perhaps a better pair of friends. > >How so? You recognize the warning, now what? Deliver the notice to NOC personel, via whatever means. Perhaps they'll terminate the session. Perhaps not. Granted in warning-only mode the session won't come back up by itself.

3 2

RE: Service Provider Exchange requirements
by Roeland M.J. Meyer 23 Oct '00

23 Oct '00

> As for jumbo frames, will someone remind me what the benefit > of using a > larger MTU on the edges than you have in the core is? Is the > edge device > going to aggregate 6 1500-byte packets into a single > 9000-byte jumbo frame > for me? It's an internal LAN system issue on the edge. In a distributed system environment, having app servers talk to data servers, using jumbo packets, makes for higher system throughput. The Jumbo packets should never be seen at the border, however. In fact, the data servers themselves should never be seen fromn the border <g>.

1 0

Re: Cheapest ethernet switch with monitor/mirror port?
by Henry Yen 23 Oct '00

23 Oct '00

On Sun, Oct 22, 2000 at 11:28:27AM -0400, Stewart MacLund wrote: > Hm. I looked at both the Cisco 3548 and the Intel 460T. In my case, > at least, the Cisco was cheaper per port, even with the Enterprise > software load on the Cisco... www.datacommwarehouse.com lists the 3548 with enterprise s/w at $3,630US. a 16-port 460t lists for $830US. a 24-port 460t lists for $1110US. cheaper out of the box as well as cheaper per port, or did i miss something? what price are you finding for a cisco3548? it appears allied telesyn has a 24-port fully managed switch for $740 (AT-8126XL-10), as well as a 16-port model (AT-8118), and although i'd be surprised if port monitoring weren't a feature, the a-t website doesn't seem to specifically mention it. > Henry Yen wrote: > > On Fri, Oct 20, 2000 at 05:51:25AM -0700, Dan Hollis wrote: > > > Looking for the cheapest ethernet switch with a monitor/mirror port. > > > > Intel 460T switch. http://www.intel.com/network/products/exp460t.htm > > 802.1p, 802.1Q, managed, link aggregation, gigabit or fiber module, > > embedded webserver, 1U size, around $830 (12-port). > > (well, ok, it may not be *the cheapest*, but...) -- Henry Yen Aegis Information Systems, Inc. Senior Systems Programmer Hicksville, New York

1 0

Reminder: Talk on Tuesday afternoon
by J. Scott Marcus 22 Oct '00

22 Oct '00

Sorry if this post is repetitive - I'm re-sending because some people seem not to have received the original. Cheers, - Scott >>>Date: Fri, 13 Oct 2000 05:48:10 -0400 >>>To: nanog(a)merit.edu >>>From: Ira Richer <richer(a)cnri.reston.va.us> >>>Subject: Invitation >>> >>> >>>The next IOPS meeting will be held "in tandem" with the upcoming >>>NANOG meeting in Washington, DC. At 4:00 pm on Tuesday, October >>>24, Scott Marcus of Genuity will give a talk on "Recent ITU Actions >>>on International Internet Charging." NANOG attendees are welcome. >>>The talk will be at the Renaissance Hotel, where the NANOG meeting >>>is being held. >>> >>>Also, if any ISP has potential interest in joining IOPS and in >>>attending the IOPS meeting on the 25th, please contact me. FYI, >>>some time at this meeting will be spent learning more about ISACs >>>(Information Sharing and Analysis Centers). ISACs for critical >>>infrastructure are encouraged by Presidential Decision Directive >>>PDD 63. They exist now for the banking/financial-services industry, >>>and for the telecommunications industry; others are being >>>considered by the electric power industry and by some "information >>>technology" companies. >>> >>>Ira Richer >

1 0

Service Provider Exchange requirements
by Mike Duckett 22 Oct '00

22 Oct '00

What switching and/or service characteristics would you require such that an exchange point would be desirable (e.g., media types, switch fabric, route servers, multicast services, SLAs, ..)?

2 1