- NANOG - lists.nanog.org

GiGE performance question(s)
by Scott Michel 13 Sep '00

13 Sep '00

Anyone out there have any Cisco GigE operational experience? I've got a customer who's evaluating GigE to 100 switched Ethernet, and they want a homogeneous vendor network (I don't know why, I just help them write the trade study...) So far, there's a huge question about Cisco GigE to 100 switched performance and I was wondering if anyone's willing to cough up numbers. Although, if there are numbers for other non-Cisco vendors, they'd be helpful ammo as well. -scooter

1 0

Re: Napster.com moved to 64.124.41.0/24?
by vern＠ee.lbl.gov 12 Sep '00

12 Sep '00

> Anyway, apart from the questionable practice of using these IPs for > access-lists, this information is useful for some of us in the > measurement community to write detectors that are less likely to get > false hits, such as might happen when counting Napster traffic based > solely on TCP port numbers. You might find the following paper interesting: Detecting Backdoors Yin Zhang (Cornell) & Vern Paxson (ACIRI) Proc. USENIX Security Symposium, August 2000 http://www.aciri.org/vern/papers/backdoor-sec00.ps.gz http://www.aciri.org/vern/papers/backdoor/index.html Along with security-oriented backdoors such as Telnet & SSH, we also developed backdoor detectors for Napster and Gnutella. We developed general detectors that run on reconstructed TCP streams (implemented in the Bro intrusion detection system) and also fast-cheap-and-definite-hack detectors that use just tcpdump filters. The tcpdump detector for Napster is: # look for "SEND" or "GET" in a # packet by itself (so payload of # 4 or 3 bytes, respectively) ((ip[2:2] - ((ip[0]&0x0f)<<2) - (tcp[12]>>2)) = 4 and tcp[(tcp[12]>>2):4] = 0x53454e44) or ((ip[2:2] - ((ip[0]&0x0f)<<2) - (tcp[12]>>2)) = 3 and tcp[(tcp[12]>>2):2] = 0x4745 and tcp[(tcp[12]>>2)+2]=0x54) and the one for Gnutella is: # look for "GNUTELLA " as first # 9 characters of payload tcp[(tcp[12]>>2):4] = 0x474e5554 and tcp[(4+(tcp[12]>>2)):4] = 0x454c4c41 and tcp[8+(tcp[12]>>2)] = 0x20 Another fun one to run (a total hack) is a root backdoor detector: # look for '# ' in a packet with # exactly 2 bytes of payload tcp[(tcp[12]>>2):2] = 0x2320 and (ip[2:2] - ((ip[0]&0x0f)<<2) - (tcp[12]>>2)) == 2 All of these work surprisingly well, and with kernel BPF can run at Gbps speeds. Vern

1 0

Re: MAE-ATM Wire Speed PVC Interest Poll
by Mike Leber 12 Sep '00

12 Sep '00

On Mon, 11 Sep 2000, Nick Gerber wrote: > I don't have any MAE-ATM access ports, but I would be interested in how > line rate ATM works. > I supported the Sprint ATM backbone for several years and never heard of > something like this before. Could you forward me some info or links? > Or am I misunderstanding the meaning in your email? A few people have asked me questions like this so I am clarifying to the list. BTW, I have had excellent positive response to my original email. If you are interested and haven't responded yet please do so. Currently MAE-ATM customers can only create what amounts to CBR PVCs to other peers by using a web interface called PeerMaker. This means that you must allocate a fraction of the capacity of your port to each of your peers which typically results in PVC sizes betweem 5 amd 10 Mbps if you have an OC3 port. Due the the configuration of the MAE-ATM switches, any traffic sent in excess of the configured PVC size is dropped (we have verified this repeatedly). This results in a large amount of wasted capacity and unecessary droppage of packets. Traffic tends to grow and shift; continual reconfiguration of PVCs is not realistic. By comparison, Pac Bell NAP and Ameritech NAP customers talk via wirespeed UBR PVCs, which generally results in better utilization of the service. Better in this case being measured by larger amounts of traffic being carried with less loss and less management cost. The benefit of using UBR vs CBR at an exchange for most users is based on the premis of connections not being saturated. Even in the case of a saturated connection CBR does not fix things; in fact it creates another bottleneck with a much lower saturation threshold. > > > mleber(a)he.net wrote: > > > > MAE-ATM users, if you are interested in having the option to set a PVC to > > wirespeed (like Pac Bell or Ameritech) (which can increase your effective > > utilization of your MAE-ATM port and reduce management costs) please send > > me email with your name, your company name, your phone number and your > > email address. I will pass the collected list onto this manager (email > > below) at Worldcom. The information will be used for that purpose only. > > > > Thank you, > > > > Mike. > > > > +------------------- H U R R I C A N E - E L E C T R I C -------------------+ > > | Mike Leber Direct Internet Connections Voice 510 580 4100 | > > | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | > > | mleber(a)he.net http://www.he.net | > > +---------------------------------------------------------------------------+ > > > > ---------- Forwarded message ---------- > > Date: Mon, 11 Sep 2000 13:11:42 -0400 > > From: Alla Reznik <Alla.Reznik(a)wcom.com> > > To: Mike Leber <mleber(a)he.net> > > Subject: RE: MAE OC40 requirements?? - Hurricane Electric (fwd) > > > > Would be very very helpful - please send if you could, thanks > > > > Alla Reznik > > Manager > > Int'l Internet/MAE/Paging/Packet > > WorldCom Business Markets > > V227-6441 or (703)343-6441 > > > > -----Original Message----- > > From: Mike Leber [mailto:mleber@he.net] > > Sent: Sunday, September 10, 2000 8:26 PM > > To: Alla Reznik > > Subject: RE: MAE OC40 requirements?? - Hurricane Electric (fwd) > > > > If I could give you a list (with contact names and phone numbers) of > > MAE-ATM customers that want this feature would it help? > > > > On Sun, 10 Sep 2000, Alla Reznik wrote: > > > > > Thanks for the feedback, Mike. > > > > > > Alla Reznik > > > Manager > > > Int'l Internet/MAE/Paging/Packet > > > WorldCom Business Markets > > > V227-6441 or (703)343-6441 > > > > > > > > > > > > > > > -----Original Message----- > > > From: Mike Leber [mailto:mleber@he.net] > > > Sent: Thursday, September 07, 2000 2:24 AM > > > To: Alla.Reznik(a)wcom.com > > > Subject: Re: MAE OC40 requirements?? - Hurricane Electric (fwd) > > > > > > > > > > > > Our number one request is for wirespeed PVCs like Pac Bell NAP or > > > Ameritech. This feature could be added with a checkbox in peermaker. > > > > > > > Date: Mon, 07 Aug 2000 15:17:41 -0400 > > > > From: Alla Reznik <Alla.Reznik(a)wcom.com> > > > > To: peering(a)he.net > > > > Subject: MAE OC40 requirements?? - Hurricane Electric > > > > > > > > Dear customer, our records indicate that you are using OC12 MAE ATM > > > service > > > > from WorldCom. We would like to find out from you if you have any plans > > to > > > > move up to OC48 level of service and what are your specific requirements > > > for > > > > such service would be. As you might already know Worldcom does not > > offer > > > > MAE service above OC12 level at this time, but we recognize it as a > > > > requirements going forward and have made plans to offer it next year. > > > > However, we would like to hear from you and learn more about your > > > > requirements as well as timeframe as to when you are planning to make > > such > > > > move, so that we can respond in the best manner possible with the > > service > > > > suitable to your requirements. > > > > > > > > Alexandra (Alla) Reznik > > > > WorldCom Business Markets > > > > Data and Enterprise Product Marketing > > > > Int'l Internet, MAE, and Packet Services > > > > (703) 343-6441 > > > > http://datamarketing.wcomnet.com/index.html > > > > > > > > > > > > > > +------------------- H U R R I C A N E - E L E C T R I > > > C -------------------+ > > > | Mike Leber Direct Internet Connections Voice 510 580 > > 4100 > > > | > > > | Hurricane Electric Web Hosting Colocation Fax 510 580 > > 4151 > > > | > > > | mleber(a)he.net > > http://www.he.net > > > | > > > > > +--------------------------------------------------------------------------- > > > + > > > > > > > +------------------- H U R R I C A N E - E L E C T R I > > C -------------------+ > > | Mike Leber Direct Internet Connections Voice 510 580 4100 > > | > > | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 > > | > > | mleber(a)he.net http://www.he.net > > | > > +--------------------------------------------------------------------------- > > + > > -- > Nick Gerber > Sprint Broadband Wireless Group > Voice: 913 534 7317 > Pager: 877 344 3821 > Email: nick.c.gerber(a)mail.sprint.com > +------------------- H U R R I C A N E - E L E C T R I C -------------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +---------------------------------------------------------------------------+

2 1

MAE-ATM Wire Speed PVC Interest Poll
by Mike Leber 11 Sep '00

11 Sep '00

MAE-ATM users, if you are interested in having the option to set a PVC to wirespeed (like Pac Bell or Ameritech) (which can increase your effective utilization of your MAE-ATM port and reduce management costs) please send me email with your name, your company name, your phone number and your email address. I will pass the collected list onto this manager (email below) at Worldcom. The information will be used for that purpose only. Thank you, Mike. +------------------- H U R R I C A N E - E L E C T R I C -------------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +---------------------------------------------------------------------------+ ---------- Forwarded message ---------- Date: Mon, 11 Sep 2000 13:11:42 -0400 From: Alla Reznik <Alla.Reznik(a)wcom.com> To: Mike Leber <mleber(a)he.net> Subject: RE: MAE OC40 requirements?? - Hurricane Electric (fwd) Would be very very helpful - please send if you could, thanks Alla Reznik Manager Int'l Internet/MAE/Paging/Packet WorldCom Business Markets V227-6441 or (703)343-6441 -----Original Message----- From: Mike Leber [mailto:mleber@he.net] Sent: Sunday, September 10, 2000 8:26 PM To: Alla Reznik Subject: RE: MAE OC40 requirements?? - Hurricane Electric (fwd) If I could give you a list (with contact names and phone numbers) of MAE-ATM customers that want this feature would it help? On Sun, 10 Sep 2000, Alla Reznik wrote: > Thanks for the feedback, Mike. > > Alla Reznik > Manager > Int'l Internet/MAE/Paging/Packet > WorldCom Business Markets > V227-6441 or (703)343-6441 > > > > > -----Original Message----- > From: Mike Leber [mailto:mleber@he.net] > Sent: Thursday, September 07, 2000 2:24 AM > To: Alla.Reznik(a)wcom.com > Subject: Re: MAE OC40 requirements?? - Hurricane Electric (fwd) > > > > Our number one request is for wirespeed PVCs like Pac Bell NAP or > Ameritech. This feature could be added with a checkbox in peermaker. > > > Date: Mon, 07 Aug 2000 15:17:41 -0400 > > From: Alla Reznik <Alla.Reznik(a)wcom.com> > > To: peering(a)he.net > > Subject: MAE OC40 requirements?? - Hurricane Electric > > > > Dear customer, our records indicate that you are using OC12 MAE ATM > service > > from WorldCom. We would like to find out from you if you have any plans to > > move up to OC48 level of service and what are your specific requirements > for > > such service would be. As you might already know Worldcom does not offer > > MAE service above OC12 level at this time, but we recognize it as a > > requirements going forward and have made plans to offer it next year. > > However, we would like to hear from you and learn more about your > > requirements as well as timeframe as to when you are planning to make such > > move, so that we can respond in the best manner possible with the service > > suitable to your requirements. > > > > Alexandra (Alla) Reznik > > WorldCom Business Markets > > Data and Enterprise Product Marketing > > Int'l Internet, MAE, and Packet Services > > (703) 343-6441 > > http://datamarketing.wcomnet.com/index.html > > > > > > +------------------- H U R R I C A N E - E L E C T R I > C -------------------+ > | Mike Leber Direct Internet Connections Voice 510 580 4100 > | > | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 > | > | mleber(a)he.net http://www.he.net > | > +--------------------------------------------------------------------------- > + > +------------------- H U R R I C A N E - E L E C T R I C -------------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +--------------------------------------------------------------------------- +

1 0

RE: PI or PA?
by James Cumming 11 Sep '00

11 Sep '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ray, You'd be better off getting the customer to apply for a /24 of PI space. It is entirely possible for a provider to advertise address space that belongs to a different provider although most providers will refuse to do this as it requires co-operation between providers to both set-up (and in future remove). Most providers tend to have a standard portfolio of 'products' and these do not normally include multi-homing clients with other service providers whilst using their own address space. A normal service to sell is transit, i.e.. routing a customers PI space (and their AS). This way you need not care which other provider the customer approaches, nor pay any attention to the set-up process with that ISP as they are done independently. James - -----Original Message----- From: Ray Davis [mailto:ray@carpe.net] Sent: 05 September 2000 20:51 To: nanog(a)merit.edu Subject: PI or PA? A customer needs a /24 which is to be announced by us and other ASes (including uunet). Should we just give them a /24 out of our space or would it be better to apply for a /24 PI space? Thanks, Ray -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> iQA/AwUBObY9XDyrtEQtecfwEQJeRACgmbpWVGaQ/Go28OratCo3c/m3uHsAn3oM Rfkxc28evO4gMEopGzsjS35R =AXKc -----END PGP SIGNATURE-----

2 1

RE: ISPs offering VPN service
by Christian Kuhtz 11 Sep '00

11 Sep '00

Hey Chris, I'm not sure we're actually arguing against each other, but just to clarify... nothing wrong with enforcing a topology (or rather traffic flow) inside the SP cloud. Neccessary, and very much needed from the SPs standpoint. What makes up a topology is much more dimensional (IMHO) than just hub-and-spoke etc. So, instead of one blindly taking from customers (stubborn as they may be about it) a topology, rather than a service definition and build the most suitable topology based on that definition.. definition = "SLA"/"OLA" or other type of contract. Ideally (hah!), customers should care about how much data (if they even know quantitive measures of their traffic) from where to where, and which what characteristics (qualitative is almost equally tricky, but more achievable) by giving customers guides etc, without actually limiting them to chosing those slots. Seems once you monitor, whether you monitor in buckets or raw is more a marketing question that technical. In my experience, most customers know little or nothing about their actual needs. Once "trained" by the telcos to order in arbitrary categories such as 56DDS, T1, T3, OC-x, they sometimes don't even know they're using up all available capacity. Some don't even care. And a service offering has to match all. So, you should be able to have a "quick order VPN" as well as an "a la carte VPN". So, that's where a service provider should step in and provide guidance and counseling, since it is truely in both best interest. As one can see, though, this does very quickly transcend the technical domain. Either way, MPLS VPNs do permit both, defaulting on any one mechanism appears to be a disservice, IMHO. Interaction is what's needed, rather than engineering in a vacuum. Cheers, Chris PS: To me, hub and spoke with a single link to the hub is no longer true hub and spoke, because of the aggregation performed. Anyways, semantics, I suppose. -- Christian Kuhtz, Sr. Net & App Architect Architecture, BellSouth.net <ck(a)arch.bellsouth.net> -wk, <ck(a)gnu.org> -hm Atlanta, GA "Speaking for myself only." > -----Original Message----- > From: Chase, Christopher J (Chris), ALNTK [mailto:chase@att.com] > Sent: Monday, September 11, 2000 1:40 PM > To: 'Christian Kuhtz'; 'mpls wg' > Subject: RE: ISPs offering VPN service > > > Enforcing a topology within the provider portion of the VPN makes perfect > sense, rather than expecting the VPN owner to enforce a topology. > > Customers may not have the capability to implement or manage TE tunnels to > enforce a topology on top of the any-to-any connectivity. In addition, that > would require running MPLS to the CE instead of providing a VPN service that > uses standard IP CE-PE interface (e.g., FR or PPP). > > Examples of wanting other topologies: inter corporate extranets, network > based firewall services, regional company gateways. > > One big advantage of the MPLS VPN hub-and-spoke topology over the > private-line/VC model is circuit aggregation. The hub or data center site > only needs to terminate a single logical connection independent of the > number of remote sites. I know a lot of large enterprise networks using the > PVC hub-and-spoke model having to spread those PVCs across many ports and > routers at the hub site. > > Chris Chase > AT&T IP Enabled FR Architect

1 0

Need contact for RAIN, AS3215
by Thomas Kernen 11 Sep '00

11 Sep '00

Hi, I'm trying to reach the NOC at RAIN but other than their automated e-mail noc(a)rain.fr I've had no success. Direct phone lines with voice mail doesn't seem to help. Anyone with a contact that deals with routing issues would really help. Thanks, Thomas

1 0

Napster.com moved to 64.124.41.0/24?
by Dave Plonka 11 Sep '00

11 Sep '00

Just FYI, Last week Friday (2000/09/08 ~0300 CDT), I noticed that Napster.com moved all of it's advertised server redirectors and servers to a different network: 64.124.41.0/24 I'm just guessing they're only within the "/24"... the current route NETBLK-ABOVENET is for 64.124.0.0/16. The "old" list that I had been working with for detecting Napster flows was this: 208.49.228.0/24, 208.184.216.0/24, 208.49.239.240/28, 208.178.175.128/29 208.178.163.56/29. Here's a useful source of info if you want to see where Napster and work-alike servers are located, a list of "open" servers by IP address: http://www.napigator.com/list.php Anyway, apart from the questionable practice of using these IPs for access-lists, this information is useful for some of us in the measurement community to write detectors that are less likely to get false hits, such as might happen when counting Napster traffic based solely on TCP port numbers. There's a post regarding the required change for FlowScan here: http://net.doit.wisc.edu/~plonka/list/flowscan/archive/0296.html General FlowScan Napster info is here: http://net.doit.wisc.edu/data/Napster/ Dave -- plonka(a)doit.wisc.edu http://net.doit.wisc.edu/~plonka ARS:N9HZF Madison, WI

1 0

I need an MLM PRO-Partner....,,
by melissa10＠postmaster.co.uk 11 Sep '00

11 Sep '00

1 0

Re: RE
by Masataka Ohta 11 Sep '00

11 Sep '00

Folks; If you want to see an example of variations of regular expressions, see man pages of *grep. Sometimes, '*' matches '*' only. If you want to discuss the definition of regular expressions to be used in research papers on formal language theory, do so outside of NANOG. Thanks in advance. Masataka Ohta

1 0