August 1998 - Test - lists.nanog.org

Re: New router technology you'll want to look into
by Curt Howland 03 Aug '98

03 Aug '98

> > Here's some new router technology that I think you'll want to look into. > > http://www.difference.com/tech.html > > route-map set-condiments 10 permit Don't forget to account for the encapsulation problem. Some routers use the CATSUP protocol, some KETCHUP. There are roumers that Bay is using something completely different, of course.... Curt-

2 1

Re: Network Abuse - Netblock x.x.x.x - IMPORTANT
by Jay Stewart 03 Aug '98

03 Aug '98

-----Original Message----- From: James Rishaw <jamie(a)dilbert.ais.net> To: nanog(a)merit.edu <nanog(a)merit.edu> Date: Thursday, July 30, 1998 10:20 AM Subject: FW: Network Abuse - Netblock x.x.x.x - IMPORTANT >A coworker's friend forwarded this to me.. kinda funny.. Kinda lame.. > > >-----Original Message----- >Sent: Thursday, July 30, 1998 7:36 AM >Subject: FW: Network Abuse - Netblock de.le.te.d - IMPORTANT > > >---------- >From: Andrew Shoemaker[SMTP:wrath@jerky.net] >Sent: Thursday, July 30, 1998 6:43 AM >Subject: Network Abuse - Netblock de.le.te.d - IMPORTANT > >Hello > >My name is Andrew Shoemaker and I am the head security consultant at JNS. We >recently were the target of a denial of service attack that saturated our >Internet connection. This attack, known as a 'smurf' attack, uses unknowing >relays to source the at >tack. By relaying the attack through your network the attack is made >anonymous and increases in strength. This type of attack causes degraded >performance on both the attacked and relay networks and is the result of an >improperly configured router at you >r site. I urge you to fix your routers. If you are unable to do so, or do >not know how I suggest you call a security consultant. JNS is willing to >fix your router permanently for a one time fee of $100 US. If you are >interested in this deal please co >ntact me and I will send you a copy of our security contract and an invoice. > >Netblock de.le.te.d was found to produce 11 replys for each packet sent. >This means if the attacker is sending at T1 speeds the amount of your >bandwidth used in relaying > the attack is equivalent to 11 T1s > >regards, >Andrew Shoemaker >JNS Security >wrath(a)jerky.net >617.442.5408 Did anyone take the time to look at this goober's web page? Here is a *nice* snippet. Jay Stewart Vice President OlyWa.Net - "Olympia's Premier Internet Service Provider" -=-=-=-=- from: http://www.jerky.net/smurf.html The Smurf Relay List This is a list of subnets that can be used for the "smurf" attack. If you find your subnet on this list FIX YOUR FUCKING ROUTERS! If you have subnets you wish to add to this list please email the wrath-mon. Once you fix your router email the above address to get your subnet removed. Until then....everyone feel free to completely FUCK these networks...and remember stupidity should never be tolerated. Updated: 07.29.98

4 3

Re: Q:Why router with ATM interface comes out earlier than pure SONET interface?
by Sean Donelan 03 Aug '98

03 Aug '98

>Then my question is: why 155M ATM interface is easier to make than 155M POS >interface? Although the net capacity of 155M ATM is less than 155m POS, >their capacity for IP packet is really close. I think its nearly the same >challenge to pump up a 155M ATM pipe as a 155M POS pipe with IP packet for >a router. The marketplace isn't always a neat and tidy place. When companies were trying to make business decisions how they should expend their resources, ATM appeared to be a much larger marketplace. The POS marketplace was viewed as just a few niche markets like ISPs, while ATM was viewed in terms of huge telecommunications market. So many companies first put their resources into making ATM interfaces. ATM interfaces can be much more complicated, but if the marketplace is larger you can afford to spend more money and still come out with a less expensive product. So even though an ATM interface may be 10%-20% less efficient, if the pricing was 30% better, ATM could still be a good choice. On the other hand, if you are paying the same price for the underlying physical facilities, you probally want to optimize for the goodput of user data. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

RE: "Packet Shapers"
by Christian Kuhtz 01 Aug '98

01 Aug '98

> > i'm not stating that the value is only at the edge. i'm stating that i > > don't think it is realistic to be sticking transparent devices that hold > > detailed state information on flows in the core. > > Inktomi's CTO has publicly stated that this is their objective, although > the phrase used was "super aggregation nodes" and not "core". If you're > interested, ask him for his 3W3 paper submission wrt handling 100 Gbs > links. I have seen Paul Gauthier's paper. Last time I spoke with Paul & Vince (VP Field Ops) when I was out in the bay area, that is precisely what we discussed, among other things. Sure, they can theoretically scale to those types of links. Their suggestion is to use policy based routing (PBR) instead of Alteon (or similiar L2/L4 technology) and the reliance of an Ethernet being avaiable for drop in of their technology. Anyone who knows anything about PBR knows that PBR is neither fault tolerant nor scalable nor something I want to be force to use for this type of stuff. Anyone who knows anything about technologies like WCCP knows that it is more than just plain PBR, because state is maintained in the L3 switching engine. The Alteon does maintain state of its cache farm memebers, but not of the sessions themselves. Other major issues (aside from their problematic network deployment strategy) that I see around Inktomi are in the current platform choice. It is neither cost effective nor does it make sense from a performance standpoint. I have discussed these with numerous people at Inktomi over the past months and not gotten a solution. > > there is enormous value in the core: some people get it right, > some get it > > horribly wrong. but lets face it - the core of a networks > primary function > > is to move packets fast, and move them well. > > Violently agree with this. Ditto. You need to do much more than just push packets fast. You need to be able to distinguish services on the network, perhaps on a per flow basis, and make sure your mission critical services or high end customers don't get trampled on. You need to be able to push packets fast _and_ do better than just plain best effort. You need to be able to do this fault tolerant and/or highly available. Cheers, Chris -- Christian Kuhtz, BellSouth Corp., Sr. Network Architect <ck(a)bellsouth.net> 1100 Ashwood Parkway, Atlanta, GA 30338 <ck(a)gnu.org>

1 0

Re: [nanog] Re: "Packet Shapers"
by Hank Nussbacher 01 Aug '98

01 Aug '98

On Fri, 31 Jul 1998, Stephen Balbach wrote: > > > 5) Topflows: In RMON there is the concept of Top 10. When the network > > slows down, you want the ability to see a list of the Top n users > > consuming bandwidth in the past 1 minute/10 minutes/hour. Packeteer > > does not have that capability. > > Packeteer has a "TopTalkers" and "Top Listeners" table for I believe the > last 5-minutes, and graphs can be generated on the fly for the past hour. That is correct, but from what I understood from their tech sales, you can't have TopTalkers and Top Listeners on *all* the bandwidth, but only on a per policy filter (i.e. if a pipe is defined for all port 80 you will see all the top www'ers but you won't see the top ftp'ers or the top GREs as well). > > Hank Nussbacher

1 0

New router technology you'll want to look into
by Michael Dillon 01 Aug '98

01 Aug '98

Here's some new router technology that I think you'll want to look into. http://www.difference.com/tech.html -- Michael Dillon - Internet & ISP Consulting Memra Communications Inc. - E-mail: michael(a)memra.com Check the website for my Internet World articles - http://www.memra.com

2 1