- NANOG - lists.nanog.org

MTU problems with GRE tunnels
by philip bridge 07 Jun '98

07 Jun '98

I'm experiencing problems with fragmentation due to Cisco GRE tunnel overhead: the way I understand it, the MTU if a GRE tunnel will always be less than the MTU of the underlying IP cloud (in our case 1500 bytes) due to the IP encapsulation overhead. So 1500 byte packets attempting to traverse the tunnel will be fragmented, or dropped if the DF bit is set, in which case an ICMP message is send back to the originating host We're trying to use GRE tunnels extensivly in some fancy added-value Internet services, and it seems that there is a small but significant amount of application traffic out there that has problems when traversing a GRE tunnel with MTU < 1500. We've seen two problems: - 1500 byte packets with DF set. This is either application traffic, or MTU path discovery is broken, because the same packets get sent repeatedly - 1500 byte packets get fragmented, but the destination host cannot cope with the fragmentation (firewall issues?) We see this on a variety of platforms (from 2500, 7507) and a variety of IOS releases (11.1(18)CC, 11.1(2), 11.2(5). Talking to another provider indicates that the same problem exists with other vendors, and is having the same severe impact. Thinking about it, this is a problem is to be expected with IP tunnels of all types, but I am surprised at the extent it's influence on our customer's applications (such as large emails). I do not want to overstate the proportion of traffic we see with this problem - but it does seem to be enough to render GRE tunnels very problematic - to say the least. But I know lots of people are using GRE for this or similar applications...so what am I missing here. thanks in advance for help/tips Phil ______________________________________________________________ Philip Bridge ++41 31 688 8262 bridge(a)ip-plus.net www.ip-plus.ch PGP: DE78 06B7 ACDB CB56 CE88 6165 A73F B703

3 2

Re: Load balancing/Multiple CNAME's (Was: Re: Beyond DNS...)
by shields＠crosslink.net 07 Jun '98

07 Jun '98

In article <357981AD.D7950B99(a)san.rr.com>, Studded <Studded(a)san.rr.com> wrote: > In any case, all this does is reinforce Paul Vixie's statement in the > FAQ that I quoted previously. Basically he said that multiple CNAME's > are allowed now, but may go away at some point in the future. That > doesn't mean it's not a valid tool now, especially since there aren't > any better tools yet. It's not wise to deploy more instances of something which is clearly deprecated. -- Shields, CrossLink.

1 0

Re: IP over SONET considered harmful?
by avg＠pluris.com 07 Jun '98

07 Jun '98

> Subject: IP over SONET considered harmful? > > I'd hoped that MPLS would solve this problem, but from reviewing > the drafts I believe that the LSRs _WILL_ decrement the TTL. I think this is a non-issue, considering that with the next generation of IP-only boxes ATM will become hopelessly useless. Better yet, the real big boxes are removing any need to do clustering, so the average number of IP hops for an NSP is going to be like 3 or 4. --vadim

6 5

Re: More smurf networks. FIX YOUR ROUTERS.
by Studded 06 Jun '98

06 Jun '98

Michael J. Freeman wrote: > > Stop the spam, why don't you send mail to this person directly, Actually, I did. He replied to the list. > I'm sure no one cares to hear about dal.net, at least I don't. I felt that if one person was interested others might be. Perhaps posting that response to the list was not appropriate, if so I apologize. At the same time, I would appreciate it if any further remonstrations were sent to me in private. It is arguably worse to chastise someone publicly for not sending a response in private than it is to post a public response to a public query. But I digress, Doug

1 0

Hello, Detriot! This is not an operational message...
by Al Reuben 06 Jun '98

06 Jun '98

So, we're here. If anyone is interested in having a beer, getting dinner, whatever, call me; 973.332.4016! -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP! We have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

1 0

Re: Load balancing/Multiple CNAME's (Was: Re: Beyond DNS...)
by shields＠crosslink.net 06 Jun '98

06 Jun '98

In article <35788244.55A2D71(a)san.rr.com>, Studded <Studded(a)san.rr.com> wrote: > > For the same reason you can't CNAME a zone's root to something else > > (meaning, if I am setting up the zone map for n.ml.org, I can CNAME > > web.n.ml.org to narnia.n.ml.org, > > Right. > > > but I can't CNAME n.ml.org to > > narnia.n.ml.org, nor can I CNAME n.ml.org to ftp.microsoft.com, or any > > other host), > > Why not? Because you cannot have CNAME RRs along with any other RR, including NS and SOA. DNSSEC RRs are excepted. > Finally, if you plan to disagree with anything in this post, please > quote chapter and verse from the relevant RFC. I've spent a lot of time > studying this topic and am quite sure of my facts. RFC 2181 section 10.1. -- Shields, CrossLink.

3 3

Re: More smurf networks. FIX YOUR ROUTERS.
by Studded 06 Jun '98

06 Jun '98

Jan Czmok wrote: > No Problem!The network 194.152.36.255 is NOT LONGER a SMURF AMPIFIER - we fixed it > completely. > I think all of our routes are clean now... Muchas gracias. :) > [NANOG OFF-TOPIC:] Another question: how about getting the ipf.net irc server > connected to dal.net ? http://www.dal.net/vote/server-app.txt We look forward to hearing from you. :) One note, we will shortly be amending the application to indicate that the minimum number of users your server would need to support is 1,500. Doug -- *** Chief Operations Officer, DALnet IRC network *** *** Proud designer and maintainer of one of the world's largest *** Internet Relay Chat servers with 5,328 simultaneous connections *** Try spider.dal.net on ports 6662-4 (Powered by FreeBSD)

1 0

Beyond DNS...
by Jim Fleming 06 Jun '98

06 Jun '98

On Monday, June 01, 1998 9:45 AM, Jared Mauch[SMTP:jared@puck.nether.net] wrote: @On Mon, Jun 01, 1998 at 09:23:38AM -0500, Jim Fleming wrote: @> On Monday, June 01, 1998 4:18 AM, James Rishaw[SMTP:jamie@dilbert.ais.net] <snip> @ @ Even *fewer* people understand how dns works, nor can configure @it properly. This is easy to tell, log lame delegations on your @nameserver. Or log the "invalid" hostnames stuff, folks with _/, etc.. @in their dns entries. @ The DNS could be used for much more than it currently is configured to handle. It is only a matter of time before people become better educated about the general purpose nature of the system. Some people think that A records can only contain 32 bit IP addresses when in fact they are generic containers for objects of class, Integer. Jim Fleming Unir Corporation - An H.323 GateKeeper for the IPv8 Network http://www.unir.net 0:196 .MALL

11 14

Re: PPP over Ethernet?
by Michael Nelson 05 Jun '98

05 Jun '98

>No, actually, this is a tool that a close friend wrote while working on a >test harness for the PPTP protocol. It seems that MS PPTP doesn't quite >work as advertized and it was necessary to sniff a ton of sessions to >determine the protocol and write the state machine to interface to >something other than Winblows as a client or server. I suppose that >"releasing" the crack will brings with it notoriety in the community if >that's what you're after. Personally, I find it more gratifying to know it >can be done and have the prowess to do it than to provide the code to every >bored 13y/o on the planet via anonymous ftp. > >>According to my Microsoft insider, "depends what the client is. If it's >>NT and uses the NTLM hash, it's quite secure. If it's 9x and uses the >>LM hash, it's easy to crack. Basically the deal is that 9x clients use >>a shitty old hash method that's really easy to sniff and crack." > >The session hijacked was NT<->NT. With 3DES/Blowfish/etc freely available, >why does MS feel the need to _attempt_ to write their own encryption? Who said they wrote their own encryption? They use RC4 (40 or 128 bit). The problems deal with authentication/key management, not encryption. -mike

1 0

PLANE TICKET
by Al Reuben 05 Jun '98

05 Jun '98

Hrmph. Turns out one of us nac.net types will not be able to go to NANOG. So, we have a spare ticket. The cost is $166, plus a $75 change fee. The flights: 6/6/98 Leaving Newark (EWR) 9:20am Arriving Detroit (DTW) 11:17am Flight Number: 1749 6/9/98 Leaving Detroit (DTW) 7:15pm Arriving Newark (EWR) 9:00pm Flight Number: 482 If you are interested, call me at 973.366.3000 or 973.989.5600. You'd need to be at Newark Airport at 8:30 am. -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP! We have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

1 0