June 2000 - Test - lists.nanog.org

Re: UUnet blocking ICMP ECHO for select sources/destinations ?
by Mufti Ahmed 14 Jun '00

14 Jun '00

Kai what if UUnet is running some type of QOS mechanism in their core network that prevents massive amounts of icmp messages traveling through? Maybe they are rate-limiting everyone with CAR. Their infrastructure is interesting they use Cisco, Fore, and Juniper at least in production. And they claim they run an MPLS network; maybe this is where icmp traffic is killed.. Mufti Nayeem Ahmed Network Systems Engineer Market Data Networks Reuters America Inc. (212)-603-3595 ----------------------------------------------------------------- Visit our Internet site at http://www.reuters.com Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Reuters Ltd.

1 0

UUnet blocking ICMP ECHO for select sources/destinations ?
by Kai Schlichting 14 Jun '00

14 Jun '00

Greetings. How many people here are running their own ping/traceroute/wget tools and feed the resulting responses into some form of database (MRTG, if you will) to get an idea how ping times to certain points in the network are changing over time? It appears that UUnet is selectively blocking such probes (upon major customer request?), in this case: pings from a single host (and only that single host) in my network to 157.130.178.1 , a Seattle border router to Amazon.com . As it appears, the goal is not to prevent denial of service attacks (5 ping packets every 5 minutes is less than the traffic load of an average daily customer of Amazon), but to hinder legitimate QoS analysis of connectivity to Amazon (and as such through UUnet's network itself). I, and certainly others, deem it very necessary to know that major web sites are or have been unreachable or hardly reachable during certain times for customer service and quality-of-service control purposes (yes, this is driving buying decisions for connectivity). Outages/bad performance in multiple directions are a sure indication of larger problems. Are some UUnet border routers so busy that they can't afford even a miniscule amount of ICMP traffic? Blocking it for single source/ destination pairs just doesn't make sense, other than that there is something (QoS-related) to hide. What pisses me off the most is that while Amazon (along with Ebay and a couple of other high-profile sites) may have corporate brain damage bad enough to filter all ICMP, not just rate-limit it or limit it to certain parts of their infrastructure, but a major backbone provider doing the same? Input please. Comments like "well, use another machine, or use http GET instead of ping to measure performance" are not helpful: I am fully capable of doing an end-run around these blocks any day. Thanks, bye,Kai

1 0

PMTU-D: remember, your load balancer is broken
by Marc Slemko 14 Jun '00

14 Jun '00

This is your monthly PMTU-D horkage rant. Chances are that if you are using a load balancer for TCP connections, then it does not properly handle Path MTU Discovery. Examples of devices like the ones I am talking about that do not, last I knew, handle this properly are localdirectors and arrowpoints. F5 claimed that they fixed their big/ip product to do this properly some time ago (remember when they broke NSI's whois service this way?), but I haven't seen it in action yet or know what version is required, and their support channels don't seem to know much about it when asked and give nonsensical answers like "it is built into the BSD/OS system that our product is built on". I would love to know about any such load balanceres that actually do handle this right. For an explanation of PMTU-D, see http://users.worldgate.ca/~marcs/mtu/ What happens with most load balancers is that when the server behind them tries to use PMTU-D, the ICMP "can't fragment" that may come back from a router between the server and the client will not make it to the load-balanced server because the load balancer will throw it away. The result is that most users with a path MTU that is less than min(client MTU, server MTU) will be unable to receive data from the server. The fix is to bitch at your vendor to fix their broken system and to tell them to hire someone that knows something about how TCP works. If you are a vendor, then make sure your load balancing software works right. What it needs to do is either send the "can't fragment" on to just the backend servers that have connections from the remote IP, or to flood it to all of them. The workaround for the person using such load balancers is to disable PMTU-D on your backend servers. This is your only option if the vendor of your load balancer doesn't care or takes a while to release a fix. If you have complaints that small subset of clients that can open a TCP connection to your load balanced IP but can't receive any reponse to their request, this could be what is up. (yes, www.slashdot.org seems to be broken in this way as I type. Oh well, slashdot isn't always a good thing...) This has been your monthly PMTU-D horkage rant.

6 7

Cisco vs. Juniper
by Hank Nussbacher 14 Jun '00

14 Jun '00

FYI. Cisco, Juniper face-off on software Companies debate merits of each other's routing code. By JIM DUFFY Network World, 06/12/00 http://www.nwfusion.com/news/2000/0612infra.html

2 1

Re: HTTP Tunneling
by Mufti Ahmed 14 Jun '00

14 Jun '00

Hi Eric, this sounds like a hack or is this valid for certain services that you've seen. thanks Mufti Nayeem Ahmed Network Systems Engineer Market Data Networks Reuters America Inc. (212)-603-3595 Eric Vyncke <evyncke(a)cisco.com> on 06/14/2000 03:09:21 AM To: Mufti Ahmed/NYC/US/Reuters@REUTERS, nanog(a)merit.edu cc: Subject: Re: HTTP Tunneling Mufti, May be your director was thinking about tunneling a Telnet/SSH/IPSec/... session in a HTTP session. This is quite common to use HTTP (which is allowed through most firewalls configuration) to funnel other protocols through a firewall. If your firewall is a plain packet filter, sending Telnet traffic to a modified /etc/inetd.conf on port 80 will make the trick. If your firewall is a proxy firewall, you will have to add a HTTP header to it ;-) Basically, some trojans are using this technique. Other protocols used for tunneling are ICMP (remember loki ?), ... Hope this helps -eric At 18:38 13/06/2000 -0400, Mufti Ahmed wrote: >My Director was mentioning this phrase to me. Is this another term for >"TLS Within HTTP/1.1" RFC 2817. Maybe some one who works in the >ISP world is familiar with this term? Or do you think it's just a marketing >term for what i just mentioned? > >Thanks > >Mufti Nayeem Ahmed >Network Systems Engineer >Market Data Networks >Reuters America Inc. >(212)-603-3595 > > >----------------------------------------------------------------- > Visit our Internet site at http://www.reuters.com > >Any views expressed in this message are those of the individual >sender, except where the sender specifically states them to be >the views of Reuters Ltd. Eric Vyncke Consulting Engineer Cisco Systems EMEA Phone: +32-2-778.4677 Fax: +32-2-778.4300 E-mail: evyncke(a)cisco.com Mobile: +32-75-312.458 ----------------------------------------------------------------- Visit our Internet site at http://www.reuters.com Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Reuters Ltd.

1 0

Re: PMTU-D: remember, your load balancer is broken
by Steven M. Bellovin 14 Jun '00

14 Jun '00

In message <200006140405.e5E45UL12480(a)black-ice.cc.vt.edu>, Valdis.Kletnieks@vt .edu writes: Also, he said that ADSL uses just under 1500. >I don't have a Win98 or ADSL handy to check. ;) A lot of DSL providers use PPPoE, which shrinks the effective MTU... --Steve Bellovin

1 0

Detroit Power Failure
by Sean Donelan 14 Jun '00

14 Jun '00

The city of Detroit, Wayne County, Wayne State University, Redford and Livonia were hit by the power failure at 12:45pm. Detroit airport is operating on emergency power. Detroit Public Lighting's computer center also lost power. DPL is hooking up portable generators to its computer center so it can then determine the exent of the outage and when it will be repaired. Associated Press reports repeated calls to DPL resulted in a busy signal.

3 2

Re: PMTU-D: remember, your load balancer is broken
by brandon＠rd.bbc.co.uk 14 Jun '00

14 Jun '00

> > > Chances are that if you are using a load balancer for TCP connections, > > > then it does not properly handle Path MTU Discovery. > > > > Does anybody have any field experience on how much PMTU-D actually > > helps? Ours is only of the problems when it doesn't work. On the UK copy of http://news.bbc.co.uk/ they decided to play with load balancers (you may not have seen the effect of this as for the NY copy we said no). After an annoying trickle of complaints of site unreachability, which were dismissed as the net being a bit broken, we were brought in to diagnose a high profile case that couldn't be ignored (the Director General of the BBC (i.e. the boss) couldn't access the site as he went through a VPN). After a reasonably heated debate we were able almost convince them that the load balancer/PMTU-D were the problem. I say almost as instead of fixing the problem they swapped it for a different manufacturers box instead (RND replaced by Cisco). The problem isn't that they're stupid. It's hard to persuade people convinced by the marketing to buy the $20K magic 100% uptime box that it is the cause of 100% downtime for some. "Surely they wouldn't sell something that broken" and "it's your net that can't access the site that everyone else can so it is your net that's broken isn't it" are common responses. regards, brandon

1 0

DVB/IP from teleglobe (and/or others)
by Jim Mercer 14 Jun '00

14 Jun '00

i have a client that is looking to use DVB/IP to blast ip packets into various geographic areas. DVB/IP is basically piggy backing ip packets on Digital Video Broadcast satelite signals, allowing the end-users to collect the packets with a rather inexpensive receiving dish. the end-user will need some normal method of sending their packets out, typically via dial-up into a local ISP. this is nothing new, direct PC/ hughes have been doing it for a while, although i don't know if they are/were using DVB/IP, but a similar set up. teleglobe markets a service where they will advertise some subnets on your behalf, take the incoming packets and spew them into the areas you are looking to go. when investigating this, i initially thought it was great. i started discussing issues i had, like how it would be a good idea to have the ingress of the DVB/IP network-wise close to the client's internet egress. this would reduce some of the problems of asymetric routing. i also pointed out, that it would be a good idea to have some kinda system in front of the DVB/IP so that you could do some level of firewalling against DoS attacks and such. i then found out that teleglobe makes no provision for the customer to filter the packets before they hit the DVB/IP uplink. the best they offered was to allow an out-of-band (ie. almost paperbound procedure) configuration of an access list on their router. are their any other DVB/IP providers who will allow my clients to install a firewall/filter box in front of the DVB/IP uplink? -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Reptilian Research -- Longer Life through Colder Blood ] [ Don't be fooled by cheap Finnish imitations; BSD is the One True Code. ]

5 5

W2k Kerberos Secure Channel & Firewall
by Tom 13 Jun '00

13 Jun '00

Does anyone have a idea howto/where to find info on setting up a W2k Kerberos trusted domain through a PIX firewall. One of the Domain Controllers is statically NAT'd and the other is publicly routable. Kerberos it appears is not allowing a secure channel to be created (because of the NAT I think) is there a way to modify the Kerberos address info as it traverses the firewall? Any ideas/urls/thoughts/resources would be appreciated. Thanks Tom ps: they are both seperate Active Directory Domains.

1 0