October 1996 - Test - lists.nanog.org

Excellent host SYN-attack fix for BSD hosts
by Avi Freedman 11 Oct '96

11 Oct '96

I've been running Jeff Weisberg's SunOS patches for a day now without trouble on my news and web boxes. He's come up with an implementation of the not-going-into-the-SYN_SENT-or-SYN_RCVD state hack. It appears to be working fine. No state is kept locally; when a SYN is received, an ISS is generated that contains a few bits for reference into a table of MSS values; window size and any initial data is discarded; and the rest of the ISS is the MD5 output of a 32-byte secret and all of the interesting header info. ftp.op.net:/pub/src/syn-prophylactica/ Has sun3 and sun4 patches (the sun4 patches work so far on sun4, sun4c, and sun4m architectures). The hypothetical-this-should-work-on-other-BSD- based-systems source code in the 'net2-src' still hasn't actually been tested, I think. Tremendous thanks to Jeff for implementing what is still my favorite SYN defense. Hopefully Sun will incorporate this into their security announcement, which basically says you're screwed if you run SunOS, though it does describe how to increase the queue and decrease the SYN-holding timeout (if you have source...). Object files that do that are still described at http://www.netaxs.com/~freedman/syn/, though I think the approach implemented by Jeff is much better, and if you use that approach, increasing the queue and decreasing the SYN-holding timeout are as useless as a command-line interface on a Bay router. Again, MANY thanks to Jeff. Avi

1 0

Re: Intra/Inter - was Inet-II
by swolff＠cisco.com 11 Oct '96

11 Oct '96

Vadim is right, in that peering and transit restrictions are *address-based* and hence enforceable by routers, whilst AUPs are *content-based* and so absolutely unenforceable by technical means. In this regard, AUPs are like *most* laws in the non-virtual world - e.g., laws against speeding, unleashed dogs, homicide, fraud, etc. - in that the behavior which they proscribe cannot in even the most elementally free society be prevented; they rely instead for their observance on a (largely unwritten) social contract between netizens and network providers, and infractions can only be punished not prevented. And just as only a fraction of all crimes are noticed and reported, and only a fraction of them in the end punished, so it is with AUP violations. Corporate intranets generally have exceedingly strict AUPs, and some infractions can be punished by dismissal; AUPs are in fact very common. The remarkable feature of the old NSFNET AUP was NOT the number of times it was violated, but rather the lengths to which an extraordinary number of decent corporate and private netizens went to ensure its observance. I promulgated it and I know. *Whenever* there is public funding of *any* activity, an AUP is attached to oulaw the misuse of taxpayer money. Internet II is not exempt. Some say that acceptance of an AUP is too high a price to pay in circumscription of personal liberty for the benefits of public funding. I understand and respect that view, but I don't agree. -s Stephen Wolff Business Development ciscoSystems 202 337 1213

1 0

RE: Internet II is coming...
by Jim Browning 10 Oct '96

10 Oct '96

>From: Sean Doran[SMTP:smd@cesium.clock.org] >Sent: Wednesday, October 09, 1996 5:11 PM > >WRT your list, I don't think that either videoconferencing >or connectivity to the PSTN is a particularly interesting thing >to do with the Internet, in that I don't see either as being >a fundamentally important Internet application. I think that any and all services my customers want are at least interesting, if not extremely important. I also think it is very interesting to leverage those customers' local loop circuit investments by providing as many services over the same infrastructure as possible. >Various people, including a Sprint Canada reseller, will tell >you that ALGs exist that convert various voice-over-Internet >things into signals that can be dealt with by PBXes and other >telephony equipment. There are at least two SS7<->IP gateways >in development with what appears to be short times-to-market ahead. > >One of these is being built along the lines of what PNO like an >RBOC or a PTT or a cable company might want to deploy in their >own facilities. > >These are neat hacks which will do fun things to international >and national long-distance tariffs worldwide, in that you may >suddenly have two QOSes for voice: one which is a side-effect >of IP connectivity and which is of iffy-to-tolerable-to-good >quality, and one which has metered, often distance-and-time-of-day- >sensitive charging and a generally predicatably very-good-to-excellent >quality. And I have in fact seen a demonstration of "Internet Phone" over a cable modem, through a gateway, and into the PSTN. I would of course like my customers to have access to _both_ levels of quality, and all of it through the same infrastructure. I'm one of the evil, greedy, money grubbing capitalists who, while willing to invest millions of dollars in network infrastructure, want to sell its use in a variety of ways. >We're now down to 155Mbps medium speed to the desktop. >I imagine that we can avoid arguing about the small details >of cell tax and the like, and start looking at Gbps ethernet >and other forthcoming LAN issues. They really are LAN issues; >the Internet vs global ATM really isn't a factor here, nor is >really IP vs ATM on a protocol-to-protocol basis. I accepted your 'today' challenge, but agree about the LAN orientation. I don't agree that there must be a "vs" between IP and ATM, cell taxes and the impact of either infinite or perpetually constricted bandwidth notwithstanding. >| Oh, and by the way, given that the local loop provider has OC-48 SONET >| provisioned to this particular location, we could just as easily have >| provisioned the connection to our backbone at OC12 as opposed to OC3. Did >| I miss the Cisco announcement of an OC12 IP-SONET card? > >You may wish to discuss an NDA presentation on the forthcoming >generation of routers from each of Cisco, Juniper and Bay Networks. Again, my post was based upon your assertion that this could be done today. I sincerely hope that a new generation of routers is forthcoming asap that can match ATM speeds. >So, just to clarify things, I don't discount ATM as a technology >entirely, I just think that its time as something between IP and >SONET for big-I Internet applications (other than *maybe* for >customer aggregation and the like), is ticking away... Time will tell, and meanwhile, there is ample room for a variety of network architectures and business models. Clearly the arguments on both sides have resulted in new technology which falls somewhere in between. This can only be A Healthy Thing (TM). -- Jim Browning

3 2

Re: Internet II is coming...
by Paul Ferguson 10 Oct '96

10 Oct '96

Potentially, yes. - paul At 05:20 PM 10/9/96 -0400, Fletcher E Kittredge wrote: > >So a 10Mbps fiber ATM circuit translates, after the cell tax and >packet stredding, to 6Mbps on a real link. Is this not slow enough to >be a bottleneck? > >regards, >fletcher > >

1 0

RE: Internet II is coming...
by Vadim Antonov 10 Oct '96

10 Oct '96

Sean Doran <smd(a)cesium.clock.org> wrote: >Moreover, you will note that lightweight private lines is not >something that can be done only by ATM... It can be done with IPv4 as-is. Build an IP-in-IP tunnel. Have the gateways doing encapsulation to slap higher priority on the packets, so there won't be any loss. Place a rate limitation on traffic entering the tunnel. Much better than CBR SVC in many ways. I know of at least one company which plans to offer that kind of functionality, at wire speed :) --vadim

1 0

Re: Internet II is coming...
by Vadim Antonov 10 Oct '96

10 Oct '96

Stephen Wolff wrote: >It **is** one IP infrastructure. The difference between a corporate >intranet and the academic version - I-II - is the stringency of AUP >observance and enforcement. Oh, no, not AUP again! What a mess. --vadim

1 0

RE: Internet II is coming...
by Sean Doran 10 Oct '96

10 Oct '96

| would you mind expanding a bit on why SVCs would do the job? | We're trying to determine if it's a service worth offering anytime | soon, who would use it, etc., Well, you have to remember that I'm not a marketing expert, so my advice has to be taken with a few kilograms of salt. Also, I was distracted for long periods of time between paragraphs, and had little revision time... Essentially, I could see some applications where one might want to nail up an SVC for a day or two, essentialy like ordering a private line. One obvious application might be putting some facility into well-known conference venues; from time to time one would want to nail up a gaggle of bit pipes to various places. Whether this is done as a virtual circuit using ATM or some other VC protocol, or mapping a "real" circuit through some SONET fabric(s) is probably less material than that it work reliably and not cost arms and legs in terms of time and in terms of money to set up and tear down. Another likely application might be to set something up between a supercomputer centre and a big data-storage or data-collection facility for some relatively short period of time. For instance, if a bunch of oil exploration data is suddenly going to be processed on some crunchy site, one would want a bunch of bandwidth available for some period of time as something along the lines of a dedicated circuit. Again, how this is done is less important than doing it relatively inexpensively and reliably. Could this be done with SVCs? Yes, certainly, but your routers will have to deal with shoving IP down the new SVCs, and your SVCs will therefore more likely want to be more like short-term PVCs than anything else. The 'S' part is probably useful for pricing and billing; your customers get to bring up a "circuit" when they want it and tear it down when they're through, and if one thinks in terms of hours or days or something as a billing period, rather than seconds, or milliseconds or whatever, this is relatively nifty stuff, potentially. If you are having to think in short time units, you get into ugly SVC setup times and having to deal with when to bring up an SVC and when to tear it down, more dynamic rather than static routing and the like. Could this be done with PVCs? Sure, no problem, but you lose some potential functionality and flexibility. For instance, if I were an ISP or an ISP's client, I'd like to be able to guarantee an X kbps path to somewhere specific for some period of time, which roughly translates to a CBR PVC, if one is disinclined to use a "real" private line. The problem is that PVCs typically are set up by telcos (which are not known to be ultraresponsive), and likely the SVC mechanism will allow one to acquire more or less bandwidth as necessary, under the control of the telco's customer, rather than the telco itself, within configured maximum and minimum bounds. This is pretty much the only REALLY interesting feature left in ATM: ideally you get to play TDM games at the endpoints rather than having to muck with things through a cloud or series of clouds. If one could do this with SONET, or one could do this at some other level that is more data-friendly than ATM, it would be a plus. (BTW, RSVP is not a good way to do this at the IP layer, but hybrid level-2/level-3 switch/routers (think of tags) might be...) Essentially, SVCs *could* offer some flexibility in terms of finding out what one wants as a PVC or in terms of having "temporary" PVCs. SVCs are not, however, remotely useful for building a connection-oriented network with the way the Internet works now, except in very very small niche markets. Thinking of SVCs and the equivalent as lightweight private lines might well be a good marketing and engineering position to take, although it is not precisely what canonical ATM hype seems to believe in. Moreover, you will note that lightweight private lines is not something that can be done only by ATM... Sean.

1 0

Welcome to nanog
by Majordomo＠merit.edu 10 Oct '96

10 Oct '96

-- Welcome to the nanog mailing list! If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo" with the following command in the body of your email message: unsubscribe nanog web(a)typo.org nanog Here's the general information for the list you've subscribed to, in case you don't already have it: North American Network Operators Group

3 2

Re: Internet II is coming...
by Vadim Antonov 10 Oct '96

10 Oct '96

That only shows they have little clue. 10 times, ha! That's less than two years growth of the Internet. Somehow it looks exactly like more pork. --vadim > As described in the Oct. 11 issue of The Chronicle of > Higher Education, the new network is intended to deliver > the vastly higher speeds needed to allow the ... > "What everybody needs is > something on the order of 10 times more bandwidth."

3 2

Re: Internet II is coming...
by Sean Doran 10 Oct '96

10 Oct '96

2 1