November 1997 - Test - lists.nanog.org

ATM Switches (was: New MAE-EAST)
by Tim Salo 24 Nov '97

24 Nov '97

A long time ago, Kent wrote: > Date: Sat, 08 Nov 1997 06:58:56 -0800 > From: "Kent W. England" <kwe(a)6SigmaNets.com> > Subject: Re: New MAE-EAST > [...] > ... Find a co-lo where you can > cross-connect without being robbed or build your own NAP, just don't use > DEC-designed Gigaswitches and FDDI. Use full duplex 100 Mbps Ethernet > switch or find an old Fore switch cheap. Building an interconnect around a first-generation ATM switch is a lot like building an interconnect around a first-generation router, (think Cisco AGS or even Bridge GS/3). The first FORE switch (the ASX-100), as well as its contemporaries, didn't have the buffering necessary to adequately support wide-area traffic. I suggest that, if you intend to use ATM as a medium, you look at the current FORE switches, perhaps the ASX-1000. Such a switch would provide the buffering necessary for wide-area connections as well as support for newer ATM features. An ATM switch might also allow you to connect it directly to wide-area ATM services. This might, depending on your particular circumstances, allow some interesting configurations, such as a wide-area interconnect. Also, I suggest: o Don't use ATM DSUs, (ADSUs). They simply weren't designed for the sort of load likely to be experienced at a successful interconnect. o If you are the first to construct an interconnect with a particular class of equipment or a specific product, try to test the configuration under load before committing to production. - Believe your test results. If things don't work while testing, they probably won't work in production. -tjs

1 0

Re: Land and Cisco question
by Sean Donelan 24 Nov '97

24 Nov '97

>I'm sorry - but the Right Thing (tm) to do is to >ingress filter, as I have already evangelized. > >Like it or not. Paul is correct. Various vendors will update their systems to handle this packet of death, but someone will discover another packet of death. Anti-spoofing filters don't prevent them, but they do act as fire stops to slow their spread. Topology may prevent you from creating perfect screens, but even with the 80/20 rule, anti-spoofing would impede many DOS attacks; or speed up the tracking of the source. Just because there are good reasons for not doing it in the 20%, you should still try to do it for the 80% it would help. Single-homed networks, even broad networks like MCI's backbone, rarely have legitimate packets with their source address originated by hosts not directly on those networks and routed through parts unknown. As an added bonus, anti-spoofing filters also block several cases of people pointing default at your network. Think about it. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: Land and Cisco question
by owen＠DeLong.SJ.CA.US 24 Nov '97

24 Nov '97

> Randy Bush said: > > for each interface on a router > > block tcp which is both to and from that interface > > I don't think that's sufficient. What about spoofed packets arriving via > interface A, with IP source and destination both set to the address of > interface B? > > --apb (Alan Barrett) > > If you do it with an access-list in then it doesn't matter. Even a spoofed packet will be blocked prior to arriving where it can do harm. Owen

2 1

CERT mailing list
by Sheryl Chapin 24 Nov '97

24 Nov '97

Hi all, Does anyone know how I would subscribe to the CERT mailing list? Thanks, Sheryl Chapin CommTel Internet 207.377.3508 schapin(a)ctel.net

3 2

RE: GB Ethernet switches
by Rodney Joffe 23 Nov '97

23 Nov '97

Some private responses I have already received have indicated a poorly scoped question.... I am interested in a gbE *platform*. The key element is the backplane itself. The interfaces for now, and the near future would still be Fast Ether to the routers. The problem I am attempting to solve is the one that currently manifests itself in the DEC GigaSwitch - HOL blocking. The solution lies in a multilayer array of gbE switches - but I am interested in what is available and real *today*, not next summer - hence my question. The Matrix of switches would communicate with each other via gbE , but most of the gbE switches I know of also have FEC and ATM interfaces, which is how they would communicate with the 75XXs etc. Input still very welcome... Rodney Joffe Chief Technology Officer Genuity Inc., a Bechtel company http://www.genuity.net

1 0

GB Ethernet switches
by Rodney Joffe 23 Nov '97

23 Nov '97

Does anyone have any direct experience with gbE switches in an ISP environment? Specifically using them as a switching platform between 7500 class routers? TIA Rodney Joffe Chief Technology Officer Genuity Inc., a Bechtel company http://www.genuity.net

1 0

Slides from the Interprovider Ops BOF at NANOG-11
by Jake Khuon 23 Nov '97

23 Nov '97

Although we ran out of time during the BOF and never got to complete the agenda, all of the slide presentations were given and can be retrieved as either HTML/JPEG or PostScript from: http://www.rsng.net/presentations/nanog11/ The notes from the BOF will also be put up as soon as I retrieve them from the notetaker. As for the future of this BOF, we hope to continue it during the next NANOG and address the portions of the agenda that we were unable to cover due to time constraints. I'll also be looking for new topics and presenters. Hopefully I will be mindful enough next time around to announce the agenda well in advance instead of the morning before. |8^) P.S. -- I would also like to apologise for the small size of the room we had. We didn't expect such a turnout. -- /*====================[ Jake Khuon <khuon(a)Merit.Net> ]=====================+ | Systems Research Programmer, IE Group /| /|[~|)|~|~ N E T W O R K | | Vox: (313) 763-4907 Fax: (313) 747-3185 / |/ |[_|\| | Incorporated | +==[ Suite C2122, Bldg. 1 4251 Plymouth Rd. Ann Arbor, MI 48105-2785 ]==*/

1 0

Re: Geographic v. topological address allocation
by Sean M. Doran 23 Nov '97

23 Nov '97

Vadim Antonov <avg(a)pluris.com> writes: > Sean Doran wrote: > > > As tli pointed out the top of the hierarchy is not > > arbitrary, it must be default free. > > Sorry for the nitpicking, but this definition has at least two > flaws: > > a) there's a bi-partite backbone configuration, where each half > has default pointing to the other half. Both do not have to > carry full routes. (Of course, this scheme has problems with > packets destined to the blue, or can be extended to more than > two partitions). In effect, this entails the synthesis by equivalent areas of a superior level into which each party can default. I touched on this briefly in my previous message. With variable length addressing this kind of joint level-n-plus-one synthesis is easy; the new area simply encompasses sufficient bits to distinguish each level-n/level-n-plus-one IS participating in it. > b) multihomed non-transit networks may want to be default-free > and carry full routing to improve load sharing of outgoing > traffic. Since they are non-transit, they cannot be considered > "top of hierarchy". Yes, I believe I also mentioned Yakov's "pull" (did you see his slides at the IETF (and NANOG?) with which he presented his push/pull definitions?) can be used to optimize routing when strict hierarchical routing is inefficient. > Bingo. We are in sync, Vadim. Surprise surprise. Sean. P.S.: > Note that IXPs are not "top" of the hierarchy, but just > aggregators for essentially point-to-point links between > tier-1 backbones. This is a good way of putting it. I will steal it and use it myself from time to time.

1 0

looking to solve a business problem
by Jim Brackman 22 Nov '97

22 Nov '97

I am looking to solve a business problem. Scenario: I have just started a small business that provides Medic-Vac services, via helicopter. My company will be fully operational by April 2, 1998. Currently I have two helicopters with 8 pilots and 10 crewmembers Nurses and EMT. I have a staff of ten that provide admin services. The main office is operational 24 hours a day. Shift workers monitor calls, flight assignments and daily logs. I have one accountant that manages payroll, general billing, and medical billing. One secretary responsible for general office duties and one mechanic that handles helicopter maintenance and manage inventory. Plus myself, who oversee the company operations. There are 3 buildings, co-located. One is a 1500sq-f t office, second is a 20,000sq-ft hanger, and the third is sleeping quarters, 1500sq ft equipped with kitchen, bedrooms, rec room, and rest rooms. Issues: Office Automation I need help in deciding the best approach in automation. I have some experience in todays information systems and a general knowledge of networks and telecommunications. I am looking for one server that is capable of handling the bulk of the automation Accounting, Office Applications, Backups, Network, File and Print services, Email, Fax, Internet, etc. I need computers that can provide a smooth intergradesition with the server and have the horse power needed for todays business applications. I am looking for a network design that will be able to sustain growth for the next 4 to 5 years. Our expected growth will include adding 3 more helicopters, crewmembers will triple, and two additional mechanic. I am looking for telecommunications ideas. Hospitals have asked me to provide video and voice capabilities that would allow assistance to crewmembers while if flight. Ideas on bandwidth, for Internet and inter-office activitys. I am looking for solutions to business applications that is standard and easy to manage. If any one out there has suggestion or is interested in group brain storming, please let me know. You can email at jb(a)ceres.ca.gov or we can use nanog. Thank you, Jim brackman, Ph.D.

1 1

Land and Cisco question
by Hank Nussbacher 22 Nov '97

22 Nov '97

Does BGP use TCP or UDP? If TCP then we are in trouble. Almost everyone has access to the Internet via BGP. The line IP address is usually made up of a pair of addresses in the same subnet. You can IP spoof block all your internal IP addresses but if you block the IP address of your BGP connection to your BGP peer and BGP uses TCP, then the examples jbash gave out will stop BGP updates as well. -Hank

2 1