March 2000 - Test - lists.nanog.org

Re: Alternative to BGP-4 for multihoming?
by Andrew Bender 16 Mar '00

16 Mar '00

Gary E. Miller wrote: > And I sure hope that HOP count is not used, Singapore has a > mixture of very fast and very slow links to foreign countries > so hop count is a useless measure of "closeness". Quite possibly, if used by itself. Dr. Jacobsen's method (http://www.caida.org/Pathchar) is a proven strategy that could provide some relief here, but may be impractical interactively. Then again, isn't any interactive measurement going to be impractical? Andrew Bender tns-inc.com

4 4

Re: Cisco Netflow Analysis Software
by Simon Leinen 16 Mar '00

16 Mar '00

>>>>> "dh" == David Hares <dhares(a)networktwo.net> writes: > Does anyone have or know of a cisco Netflow collector/reporter > available in the public domain? I maintain a couple WWW pages about NetFlow and similar systems. One of them has references to such software packages: http://www.switch.ch/tf-tant/floma/software.html Additions, corrections, praise or flames are all welcome. > Cisco used to have a basic one available on their website, but now > that that they have a commercial product using Netflow, the free > software is gone. Actually there is still some C code on ftpeng, which is also referenced from the abovementioned page. Hope this helps, -- Simon Leinen simon(a)babar.switch.ch SWITCH http://www.switch.ch/misc/leinen/ Who is General Failure & why's he reading my disk?

1 0

Cisco Netflow Analysis Software
by David Hares 15 Mar '00

15 Mar '00

Does anyone have or know of a cisco Netflow collector/reporter available in the public domain? Cisco used to have a basic one available on their website, but now that that they have a commercial product using Netflow, the free software is gone. Dave ----------- David Hares NetworkTwo Communications Phone: 734.827.3620 650 KMS Place FAX: 734.827.3690 Ann Arbor, MI 48108 Email: dhares(a)networktwo.net

5 4

RE: Cisco Netflow Analysis Software
by Hallgren, Michael 15 Mar '00

15 Mar '00

You might want to look at http://www.caida.org/Tools/Cflowd/ mh -----Message d'origine----- De: David Hares [mailto:dhares@networktwo.net] Date: mercredi 15 mars 2000 18:04 À: nanog(a)merit.edu Objet: Cisco Netflow Analysis Software Does anyone have or know of a cisco Netflow collector/reporter available in the public domain? Cisco used to have a basic one available on their website, but now that that they have a commercial product using Netflow, the free software is gone. Dave ----------- David Hares NetworkTwo Communications Phone: 734.827.3620 650 KMS Place FAX: 734.827.3690 Ann Arbor, MI 48108 Email: dhares(a)networktwo.net

1 0

Re: Alternative to BGP-4 for multihoming?
by Andrew Bender 15 Mar '00

15 Mar '00

Marc Slemko wrote: > This will normally be a caching nameserver that may or may > not be the same as the nameservers for the domain. In theory, > it should be "close" to the client network wise for other > reasons. Is it always? No. But it is a more reasonable > metric. Have any substantive empirical studies been perfromed that validate this assumption? The degree to which it is true seems to be the gating factor for the effectiveness of this method... Andrew Bender tns-inc.com

1 0

Remove
by Charles E. Yow 15 Mar '00

15 Mar '00

Remove

1 0

Re: Alternative to BGP-4 for multihoming?
by Paul Vixie 15 Mar '00

15 Mar '00

> They sit on /28's and smaller in some cases. I'm certainly not going to > be successful in acquiring ASN's for these people to do proper load > balancing between multiple ISP's and most major ISP's see little benefit > in modifying route tables to include our small netblock. Right on man! > Its these cases I'm concerned with. In my mind, irrespective of the > comments on the functionality of DNS for this purpose, I see little other > choice. DNS is not the droid you're looking for. Using DNS response times to predict likely TCP performance is silly for at least as many reasons as using BGP aspath lengths to predict likely TCP performance is silly. > That being said, if anyone has better ideas on how to provide for high > availability to millions of web sites worldwide, please let me know. TCP performance is affected by congestion symmetry, since TCP uses the spacing of ACK packets to control the spacing of data packets. While there's no way to guarantee congestion symmetry, one of the leading indicators of whether you will have congestion symmetry is "whether you have path symmetry." Furthermore, the leading indicator of whether you have path symmetry is "whether the outbound flow's first hop is the same as the incoming flow's last hop." Thus http://www.vix.com/pub/vixie/ifdefault/. Try it. If you don't know how to apply patches to your kernel, then have a consultant do it. I wrote this for a pornography distributor whose pageviews-per-second went up by a factor of 1.7 peak and 1.25 average just as a result of using "interface defaults" rather than speaking BGP and trying to run defaultless.

8 10

Hi, we're from the government and we're here to help
by Sean Donelan 14 Mar '00

14 Mar '00

Operational, only in the sense it disrupts our operations http://www.usatoday.com/life/cyber/tech/cth523.htm An interesting article which reviews some of the history and some perspective on the government response to the denial of service attacks. Unfortunately, its even worse. Before the FBI created the NIPC, the NTIA/Department of Commerce was tasked with Internet protection. I went to one of the meetings at DOC. It felt like a cold war contractor unemployment office. The NTIA eventually appointed three groups to represent the interests of the Internet in cyber-security. Anyone know/remember who those groups were? Earlier, the government created the Critical Infrastructure Assurance Office. Before that there was a commission, but the Internet wasn't really considered an "interesting" infrastructure at that time. The US Government as been amazingly pro-active in this area, or at least some small groups have been. They've also consistently said the government can't protect the Internet. The infrastructure is owned by private companies and individuals; and industry has to work together to protect it. The question is does industry think its worthwhile to work together? After several major disruptions received at lot of media attention, IOPS was formed. Later members like UUNET dropped out. After the DOS attacks, several providers announced their Gold Ribbon initiative. Have any providers actually taking concrete steps to change their networks? The IESG has a last call for a Best Common Practice on Internet security. Will any provider actually follow it? There is a barely used $50 million center in Washington we can probably buy real cheap if folks think we'll ever need an emergency response coordination center in the future.

7 12

Re: San Jose Telephone Problems 3/10-3/17
by Dan Bustillos - Datalink Computer Services 14 Mar '00

14 Mar '00

Sean/list, I was watching the news this morning re: This issue. A Pacbell spokesman was talking to a reporter and here is what he had to say ( My memory is a bit foggy) " Pac bell is also the victim here. We did not cause this. It was a private contractor that caused this ACCIDENT" At the point he said accident it sounded like he was getting ready to start yelling at the reporter. I just thought you all might find this funny.. Please no flames! PS: I am going to Vancouver BC on Thursday for a week. Anyone know anything fun to do in the area? Sean Donelan allegedly stated on 3/13/00 19:28: > >I'm sure this has absolutely nothing to do with me moving to >the San Jose area :-) > >On friday a contractor cut four major Pacific Bell cables. About >11,000 circuits were affected. The affected area is roughly bordered >by Interstate Highways 880 and 680 and Trimble and Berryessa roads. >Pacific Bell estimates it won't have the cables repaired until Friday >March 17. > >One cable I can understand. Two cables, ok you didn't realize the first >strange noise was a cable. Three cables, accidents come in threes. Four >cables? > > > Thank you, Dan Bustillos Datalink Computer Services (530) 897-6400 (888) 327-4638 ******************* "First rule of Government Spending: Why build one when you can build two at twice the price"

6 5

Re: Alternative to BGP-4 for multihoming?
by Gary E. Miller 14 Mar '00

14 Mar '00

Yo Joe! On Tue, 14 Mar 2000, Joe Loiacono wrote: > >Checking the path to my DNS servers tells you NOTHING about the > >path to my hosts. > > Right. But your situation is not the one being looked at, as you don't have > geograpically distributed web servers. But of course I DO (and that is a different question again... :-) > I believe for that situation 3DNS, > et. al., can work. Once the client's DNS request has worked its way over to > the primary DNS for the distributed web-servers, 3DNS has each of the other > 3DNS boxes (located adjacent to the other distributed servers) ping the > *clients* primary DNS. 3DNS then returns the URL for the web-server whose > 3DNS machine is 'closest' (fewest hops) to the clients DNS machine. Thus, > for example, clients in Asia can get to a server in Asia. > > I think that's the gist of it, if not the specifics... Let us take a client example. I manage a DNS with clients (users) in Singapore, California, New York and UK. DNS servers in Singapore and California and mirrored Web servers in Singapore in California. The DNS servers in Singapore do forward, and reverse for all zones in use (except ISP roaming) AND cacheing for ALL hosts in use. All hosts worldwide use our in house master DNS servers and not the local ISP servers. This allows the users to get DNS access for hostnames that are behind our firewalls on private addresses. It also allows inhouse tech support to more easily troubleshoot PCs remotely. I have seen this setup in use by many companies with firewalls. All laptops given to employees are shipped preset to use the 2 main corporate DNS servers for their DNS cacheing servers. Now let us say that a user (client) in UK connects to one of our corporate DNS cacheing server in Singapore or California. That DNS server connects to the 3DNS in New York. Now how does the 3DNS in New York decide the nearest web server to UK by checking DNS servers in California or Singapore? And I sure hope that HOP count is not used, Singapore has a mixture of very fast and very slow links to foreign countries so hop count is a useless measure of "closeness". Now it gets worse. Our users in Singapore take their laptops home but still use the DNS cacheing from the office servers. At home they are on a local ISP network that connects to the US by a very different path! Some ISPs in Singapore connect directly from Singapore to LA, some directly to Palo Alto and some to Japan and then Seattle. When our user goes home all that changes about his configuration is his IP address and reverse DNS. But his connectivity to the US is totally changed. Some ISPs connect directly to Malaysia and some need to go to LA and back. Picking the server based on DNS could add a second of extra round trip time! I have a few other clients with totally different configurations that also break the 3DNS, but that is another discussion... RGDS GARY --------------------------------------------------------------------------- Gary E. Miller Rellim 20340 Empire Ave, Suite E-3, Bend, OR 97701 gem(a)rellim.com Tel:+1(541)382-8588 Fax: +1(541)382-8676

1 0