- NANOG - lists.nanog.org

Predicting TCP throughput
by Glen Kent 28 May '15

28 May '15

Hi, I am looking at deterministic ways (perhaps employing data science) to predict TCP throughput that i can expect between two end points. I am using the latency (RTT) and the packet loss as the parameters. Is there anything else that i can use to predict the throughput? A related question to this is; If i see an RTT of 150ms and packet loss of 0.01% between points A and B and the maximum throughput then between these as, say 250Mbps. Then can i say that i will *always* get the same (or in a close ballpark) throughput not matter what time of the day i run these tests. My points A and B can be virtual machines spawned on two different data centers, say Amazon Virgina and Amazon Tokyo? So we're talking about long distances here. What else besides the RTT and packet loss can affect my TCP throughput between two end points. I am assuming that the effects of a virtual machine overload would have direct bearing on the RTT and packet loss, and hence should cancel out. What i mean by this is that even if a VM is busy, then that might induce larger losses and increased RTT, and that would affect my TCP throughput. But then i already know what TCP throughput i get when i have a given RTT and loss, and hence should be able to predict it. Is there something that i am missing here? Thanks, Glen

3 2

Atlanta Remote Hands needed for Server Move.
by Don Gould 28 May '15

28 May '15

I have half a dozen servers in the Netstream DC that I need moved to the Cyberwurx DC in Atlanta. I'm looking for some remote hands to assist with moving these machines. Cheers Don http://www.netstreamcom.net/ 200 Sandy Springs Place Atlanta, GA 30328 Cyberwurxhttps://cyberwurx.com/datacenter/ 55 Marietta Street -- Don Gould 31 Acheson Ave Mairehau Christchurch, New Zealand Ph: + 64 3 348 7235 Mobile: + 64 21 114 0699 Ph: +61 3 9111 1821 (Melb)

1 0

SAS Drive Enclosure
by Graham Johnston 27 May '15

27 May '15

I am looking for information about SAS drive enclosures, is there a list like NANOG that covers that area of IT? I am specifically looking for an enclosure that can handle 12 or more drives, I am looking to create a clustered file system between multiple servers and would like to avoid a drive enclosure that only works with a very small number of approved drives. I am looking to support traditional HDDs as well as SSDs. Thanks, Graham Johnston Network Planner Westman Communications Group 204.717.2829 johnstong(a)westmancom.com<mailto:johnstong@westmancom.com> P think green; don't print this email.

3 4

Indy Telcom Center
by Mike Hammett 27 May '15

27 May '15

Can anyone here tell a bit of a history on the Indy Telcom Center? What operators (network and datacenter) have occupied what properties over the years? There's about a dozen buildings that were all railroad related in the past. You can see abandoned tracks running through the property at different places. http://www.indytelcom.com/IndyTelcom%20Property%20Map.pdf For instance, At one point Avaya's name was attached to 740 W. Henry. I think it was through an acquisition that they did. The last name attached to that property appears to have been Zenality, but they appear dead. There didn't appear to be any activity (air conditioners, etc.) from the building the last time I was there. 730 W. Henry shows up in Google as SP Telcom. I think I saw a Verizon logo on the door when I was last there, but I didn't document it to be sure. 701 W. Henry is now 365 Datacenters, but was Equinix. Being Equinix and not in a major market, I assume it was a Switch and Data property. Not sure what else has or does operate out of there. 733 W. Henry is LifeLine DataCenter and seems to have been for quite some time. We've got a presence there. 731 W. Henry is Lightbound datacenter. I think they have another one as well on the NE side of the campus. Are 650 W. Henry and 550 S. Kentucky the same building? 710 S. Kentucky seems to now be an AT&T MSC, but not sure whose it was originally. 720 S. Kentucky, WilTel POP? 800 Oliver seems to be under a few hats including Paragon and GAP. Not sure what's going on there. Some of the remaining buildings are other datacenters or carrier POPs, but I have less on them. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest Internet Exchange http://www.midwest-ix.com

1 0

Re: gmail security is a joke
by Larry Sheldon 27 May '15

27 May '15

On 5/27/2015 03:17, Valdis.Kletnieks(a)vt.edu wrote: > On Wed, 27 May 2015 09:13:47 +0530, Anil Kumar said: >> that link, since I have two-step verification set up, I was presented >> with a demand for a number provided by the Google Authenticator >> app on my phone. I provided that number and only then was I allowed >> to reset the password. > > And you have to pre-register the phone number. > > Sounds about as secure as you're going to get when trying to scale to 10 > digits of users.... > > And as I said earlier - if your threat model involves needing more security > than that, you have bigger problems.. :) As they say, I no longer have a dog in this fight beyond myself and to an extent (advisory capacity) my wife, but I have been having trouble understanding the concept of organizations ("network operators") with large and legitimate concerns for security issues, using gmail. -- sed quis custodiet ipsos custodes? (Juvenal)

1 0

Prefix hijack by INDOSAT AS4795 / AS4761
by Randy 27 May '15

27 May '15

On Thursday March 26th 2015 at 12:18 UTC (and on-going) we are seeing more specifics on one of our prefixes. Anyone else seeing similar or is it just us? 198.98.180.0/23 4795 4795 4761 9304 40633 18978 4436 29889 198.98.182.0/23 4795 4795 4761 9304 40633 18978 4436 29889 -- Randy

12 20

Re: [SECURITY] Application layer attacks/DDoS attacks
by Steve 26 May '15

26 May '15

Application layer DDoS attacks , in most (all?) cases require a valid TCP/IP connection, therefore are not spoofed and BCP38 is irrelevant Sent from Steve's iPhone > On May 25, 2015, at 8:00 AM, nanog-request(a)nanog.org wrote: > > Send NANOG mailing list submissions to > nanog(a)nanog.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://mailman.nanog.org/mailman/listinfo/nanog > or, via email, send a message with subject or body 'help' to > nanog-request(a)nanog.org > > You can reach the person managing the list at > nanog-owner(a)nanog.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of NANOG digest..." > > > Today's Topics: > > 1. Re: [SECURITY] Application layer attacks/DDoS attacks > (Christopher Morrow) > 2. Re: [SECURITY] Application layer attacks/DDoS attacks > (Ramy Hashish) > 3. Re: [SECURITY] Application layer attacks/DDoS attacks (Randy Bush) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 24 May 2015 23:01:50 -0400 > From: Christopher Morrow <morrowc.lists(a)gmail.com> > To: jim deleskie <deleskie(a)gmail.com> > Cc: Ramy Hashish <ramy.ihashish(a)gmail.com>, NANOG list > <nanog(a)nanog.org> > Subject: Re: [SECURITY] Application layer attacks/DDoS attacks > Message-ID: > <CAL9jLaYf7v-NG_1qGEHtHhASOD6Vea5VJCSJcWhS29GPcRuzPg(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > On Sat, May 23, 2015 at 9:12 PM, jim deleskie <deleskie(a)gmail.com> wrote: >>> However, the trusted network initiative might be a good approach to start >>> influencing operators to apply anti-spoofing mechanisms. > > explain how you think the 'trusted network initiative' matters in the slightest? > > -chris > > > ------------------------------ > > Message: 2 > Date: Mon, 25 May 2015 06:48:41 +0200 > From: Ramy Hashish <ramy.ihashish(a)gmail.com> > To: morrowc.lists(a)gmail.com, nanog(a)nanog.org > Subject: Re: [SECURITY] Application layer attacks/DDoS attacks > Message-ID: > <CAOLsBOt_SOwHLZVRgb31nMMX5isiS8rkXojUpP9NyNVU05Dw9w(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > The idea of restricting access to a certain content during an attack on the > "trusted networks" only will make all interested ISPs be more "trusted" > > Ramy > > On Mon, May 25, 2015 at 5:01 AM, Christopher Morrow <morrowc.lists(a)gmail.com >> wrote: > >> On Sat, May 23, 2015 at 9:12 PM, jim deleskie <deleskie(a)gmail.com> wrote: >>>> However, the trusted network initiative might be a good approach to >> start >>>> influencing operators to apply anti-spoofing mechanisms. >> >> explain how you think the 'trusted network initiative' matters in the >> slightest? >> >> -chris > > > ------------------------------ > > Message: 3 > Date: Mon, 25 May 2015 15:18:43 +0900 > From: Randy Bush <randy(a)psg.com> > To: Ramy Hashish <ramy.ihashish(a)gmail.com> > Cc: North American Network Operators' Group <nanog(a)nanog.org> > Subject: Re: [SECURITY] Application layer attacks/DDoS attacks > Message-ID: <m2r3q5b2nw.wl%randy(a)psg.com> > Content-Type: text/plain; charset=US-ASCII > >> The idea of restricting access to a certain content during an attack >> on the "trusted networks" only will make all interested ISPs be more >> "trusted" > > don't the lawyers already have enough money? > > > End of NANOG Digest, Vol 88, Issue 25 > *************************************

3 3

Peering and Network Cost
by Rod Beck 25 May '15

25 May '15

Hi, As you all know, transit costs in the wholesale market today a few percent of what it did in 2000. I assume that most of that decline is due to a modified version of Moore's Law (I don't believe optics costs decline 50% every 18 months) and the advent of maverick players like Cogent that broker cozy oligopoly pricing. But I also wondering whether the advent of widespread peering (promiscuous?) among the Tier 2 players (buy transit and peer) has played a role. In 2000 peering was still an exclusive club and in contrast today Tier 2 players often have hundreds of peers. Peering should reduce costs and also demand in the wholesale IP market. Supply increases and demand falls. I thank you in advance for any insights. Regards, - R. Roderick Beck Sales Director/Europe and the Americas Hibernia Networks This e-mail and any attachments thereto is intended only for use by the addressee(s) named herein and may be proprietary and/or legally privileged. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this email, and any attachments thereto, without the prior written permission of the sender is strictly prohibited. If you receive this e-mail in error, please immediately telephone or e-mail the sender and permanently delete the original copy and any copy of this e-mail, and any printout thereof. All documents, contracts or agreements referred or attached to this e-mail are SUBJECT TO CONTRACT. The contents of an attachment to this e-mail may contain software viruses that could damage your own computer system. While Hibernia Networks has taken every reasonable precaution to minimize this risk, we cannot accept liability for any damage that you sustain as a result of software viruses. You should carry out your own virus checks before opening any attachment.

22 48

Re: [SECURITY] Application layer attacks/DDoS attacks
by Ramy Hashish 25 May '15

25 May '15

Yes Harlan, you are absolutely right, even if this won't stop the botnet-based DDoS attacks, but at least will significantly decrease the volume/frequency of the volume based attacks. On the other side, the DDoS protection now become a business where all-tiers ISPs make money of, and those ISPs is the exact place where the implementation of anti-spoofing make the best sense, conflict of interests now... However, the trusted network initiative might be a good approach to start influencing operators to apply anti-spoofing mechanisms. Salam, Ramy On 23 May 2015 10:48 pm, "Harlan Stenn" <stenn(a)ntp.org> wrote: Just to ask, what is the expected effect on DDoS attacks if folks implemented BCP38? How does the cost of implementing BCP38 compare to the cost of other solution attempts? H

6 8

Help Needed Segmenting Existing Network with Sophos UTM Cisco Catalyst switches and RHEL6 Hypervisors
by Sina Owolabi 24 May '15

24 May '15

Hi! I am in a bit of a planning and implementation quandary and I'm hoping to solicit implementation assistance on an already existing network which needs to have segmentation and security. I have only remote access to the network which comprises a number of Red Hat Linux 6-based hypervisor servers (hosting a multiplicity of virtual machines in different networks), a Sophos UTM gateway device (specifically ASG220) serving as a router, and two Cisco Catalyst 2960 switches (one on the internet side of the UTM gateway, and the other allowing access to the UTM from the RHEL6 hypervisors). There are a number of subnets defined on both the hypervisors and the virtual machines, all using the Sophos UTM as their gateway to each other, and to the internet. My task is to properly segregate access and traffic between the devices, which do not have VLANs defined on them. Remotely. My question is, can I create VLANs, and their trunk ports on the 2960 switches (especially on the LAN switch) that will segregate traffic between the networks defined on the UTM, the hypervisors and their guest machines, without causing network downtime? Is it best to attack the switches first, creating the VLANs there, before implementing VLANs on the UTM and the hypervisors? I would be grateful for any planning assistance. The data center is a long way away, and any downtime will be catastrophic. Thanks in advance!

3 4