July 2000 - Test - lists.nanog.org

RE: exodus.net
by Jamie Rishaw 05 Jul '00

05 Jul '00

888 2EXODUS, option #1 to get to their global response center. | -----Original Message----- | From: Morris Allen [mailto:moe@vidnet.net] | Sent: Wednesday, July 05, 2000 11:29 AM | To: Nanog Mail List; Nanog | Subject: exodus.net | | | | Does anyone have a contact name and number for exodus.net. I | have sent the | normal e-mails to abuse@ and root@? I have a hacker that has | been hitting | my T1 for 5 hours doing UDP probes and ICPM echo frames from | behind their | firewall or proxy server. | thanks | Morris Allen | VidcomNet, Inc. | |

1 0

RE: bad idea?
by Karyn Ulriksen 05 Jul '00

05 Jul '00

Has foundry figured out how to introduce persistence in their LB's yet? I like their switches and have been waiting for them to get persistence going on. I think I'll jump on that LB list you cited below. Wasn't aware that one was around now. Great idea! Thanx! -Karyn -----Original Message----- From: tony bourke [mailto:tony@vegan.net] Sent: Wednesday, July 05, 2000 11:11 AM To: Jeremiah Kristal Cc: nanog(a)merit.edu Subject: Re: bad idea? actually, Foundry has a global solution based on BGP, check them out. There is a load-balancing mailing list, which addresses such issues. http://vegan.net/lb is the info to sign up. Tony On Wed, 5 Jul 2000, Jeremiah Kristal wrote: > > Given a small, globally routable netblock to be used for front-end web > servers, and a strong aversion for using DNS for any type of load > balancing, would it be reasonable to build two identical servers farms > with the same public IP addresses and rely on the BGP sessions with the > hosing providers to remove one advertisement in the event of a problem? > I've been looking at ways to ensure that the webservers are always > available, short of building a network connecting hosting facilities. > > Jeremiah > being a customer stinks > -------------- -- ---- ---- --- - - - - - -- - - - - - - Tony Bourke tony(a)vegan.net

1 0

RE: bad idea?
by Karyn Ulriksen 05 Jul '00

05 Jul '00

If all the DNS servers really adhere to the RFCs and really do cache using the TTLs stated by the zone's SOA server, this might be less of a headache than it is in reality. Unfortunately not every ISP is using BIND8, and some are using much worse than DNS server implementations that the wintel services out there which completely disregard TTL's in the zone records and make up there own mind on how long they'll cache. Besides if you are going to go through the trouble and cost oof building out web services in multiple locations, any downtime to any enduser due to the architecture is unacceptible. Think about it... Imagine .... You (yourself) are shelling out somewhere in the neighborhood of a grand a month for shelf space, then throw on bandwidth, all the programming and configuration investment (500 - $10,000 [depending on your sucker level]) for the set up... And you gone thru all this trouble... As a businessman, are you *really* comfortable with an occasional 30-60 minute down time for RFC compliant DNS caches and 24-72 hour for non-compliant DNS caching? I've seen the happiness levels of quite of few big sites over this type of approach go to hell. It's cheap going in, but they end up digging in their pockets for that ole F5 solution afterwards. Don't get me wrong, I think F5 is WAY overpriced and as soon as GNU gets hold of it and maybe Vixie pushes some of it into BIND we can all sleep without our pagers with a little less trepidation. -Karyn -----Original Message----- From: Richard A. Steenbergen [mailto:ras@e-gerbil.net] Sent: Wednesday, July 05, 2000 10:39 AM To: Karyn Ulriksen Cc: 'nanog(a)merit.edu' Subject: RE: bad idea? On Wed, 5 Jul 2000, Karyn Ulriksen wrote: > Riigghhhttttt..... But if the server goes down and the IP is unreachable, > DNS will never know and all his structure goes for naught... Thats actually a good thing, at least for the short-term. If the IP is down hard and isn't coming back up (for example, the server crashed), thats a different story. A short TTL works, if you don't mind it offsetting the benefits of DNS caching. Its an all around grody hack, but its still better then other alternatives. It also helps if the DNS "server" for this load balanced sub-domain is integrated with the box, for example a Foundry ServerIron which can perform health checks, and withdraw the announcement if its no longer viable to get answers from this server. As long as the grody-ness stays restricted to this confined area, and doesn't break anything else... I can live with it. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

RE: NSI to make (simple) change to domain-change procedures effec tive 8Jul00.
by Jamie Rishaw 05 Jul '00

05 Jul '00

Looks like they finally got BEFORE-USE/BEFORE-UPDATE to work? and are taking out MAIL-FROM authentication. Funny, it all worked for a short term during beta (I was part of the beta herd). Same with PGP. PGP worked flawlessly, till Eric Eden left. Then nobody really knew how to fix it. Now, it's a crap-shoot. I have had my PGP key registered with NSI since the Guardian project beta'd, same thing, it worked great for a while and then stopped. Some say it's a problem scaling, but others inside NSI say that the percentage of people actually *using* PGP are very, very small compared to the other Guardian methods. This new policy will make things slower, but in the interest of security, I suppose it's a good thing. Besides, recently, NSI has improved their turnaround times on properly-formatted templates significantly.. Let's just hope they implement this correctly. -jamie | -----Original Message----- | From: rdobbins(a)netmore.net [mailto:rdobbins@netmore.net] | Sent: Friday, June 30, 2000 3:09 PM | To: nanog(a)merit.edu | Subject: NSI to make (simple) change to domain-change procedures | effective 8Jul00. | | | | | | It's better than nothing, I guess. Too bad they can't seem to get PGP | working. | | http://www.securityfocus.com/templates/article.html?id=54 | | ----------------------------------------------------------- | Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice | |

1 0

Re: bad idea?
by Richard A. Steenbergen 05 Jul '00

05 Jul '00

On Wed, 5 Jul 2000, Jeremiah Kristal wrote: > Given a small, globally routable netblock to be used for front-end web > servers, and a strong aversion for using DNS for any type of load > balancing, would it be reasonable to build two identical servers farms > with the same public IP addresses and rely on the BGP sessions with the > hosing providers to remove one advertisement in the event of a problem? > I've been looking at ways to ensure that the webservers are always > available, short of building a network connecting hosting facilities. In the event of a route flap, or other instability, you could potentially have traffic shifted to another server without the established TCP state, which would prompt that server to generate an RST and end the connection. If the route then comes back, you end up resetting your connection for nothing. Actually, DNS works very well for this kind of thing. Since its a stateless protocol it isn't affected by this, and once your client has its answer it continues to use the same IP, which is routed normally. I believe this is how's Akamai load balancer works (try looking up www.yahoo.com from a name server on the left coast and on the right coast). I see absolutily nothing wrong with using DNS in this manner. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 1

RE: bad idea?
by Karyn Ulriksen 05 Jul '00

05 Jul '00

Riigghhhttttt..... But if the server goes down and the IP is unreachable, DNS will never know and all his structure goes for naught... -----Original Message----- From: Richard A. Steenbergen [mailto:ras@e-gerbil.net] Sent: Wednesday, July 05, 2000 10:24 AM To: Jeremiah Kristal Cc: nanog(a)merit.edu Subject: Re: bad idea? On Wed, 5 Jul 2000, Jeremiah Kristal wrote: > Given a small, globally routable netblock to be used for front-end web > servers, and a strong aversion for using DNS for any type of load > balancing, would it be reasonable to build two identical servers farms > with the same public IP addresses and rely on the BGP sessions with the > hosing providers to remove one advertisement in the event of a problem? > I've been looking at ways to ensure that the webservers are always > available, short of building a network connecting hosting facilities. In the event of a route flap, or other instability, you could potentially have traffic shifted to another server without the established TCP state, which would prompt that server to generate an RST and end the connection. If the route then comes back, you end up resetting your connection for nothing. Actually, DNS works very well for this kind of thing. Since its a stateless protocol it isn't affected by this, and once your client has its answer it continues to use the same IP, which is routed normally. I believe this is how's Akamai load balancer works (try looking up www.yahoo.com from a name server on the left coast and on the right coast). I see absolutily nothing wrong with using DNS in this manner. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 1

RE: bad idea?
by Greene, Dylan 05 Jul '00

05 Jul '00

Jeremiah, Hey there.. What you're describing is basically anycast, (rfc 1546) which is useful for single packet, connectionless UDP type things (dns lookups), but can make connection oriented / statefull protocols break. If you are advertising what appears to be two ways to get to the same prefix, you're relying on having stable paths through the internet to always deliver a packet via the same path the one before it took. If something outside of your control breaks / changes, you may end up changing paths and could start sending packets towards your 'other' (same destination) site mid session. Another thing to be careful of is inconsistent-as. If you plan to have multiple sites advertising the same prefix, they either need to be all part of the same asn, or you need to advertise a separate anycast asn padded w/ unique per-site asns. (Also a good way to withdraw routes is necessary, using gated or something..) I think the anycast rfc mentioned setting aside a block of space for this purpose. ..Dylan | -----Original Message----- | From: Jeremiah Kristal [mailto:jkristal@on2.com] | Sent: Wednesday, July 05, 2000 11:17 AM | To: nanog(a)merit.edu | Subject: bad idea? | | | | Given a small, globally routable netblock to be used for front-end web | servers, and a strong aversion for using DNS for any type of load | balancing, would it be reasonable to build two identical servers farms | with the same public IP addresses and rely on the BGP | sessions with the | hosing providers to remove one advertisement in the event of | a problem? | I've been looking at ways to ensure that the webservers are always | available, short of building a network connecting hosting facilities. | | Jeremiah | being a customer stinks |

2 1

San Bruno cable fire half repaired/BART claim forms
by Sean Donelan 05 Jul '00

05 Jul '00

Pacific Bell announced passing the half-way point splicing cables damaged by a cable fire caused by BART construction near the San Francisco airport San Bruno. 12,000 lines still need to be repaired. Pacific Bell hopes to complete repairs by Friday. BART officials have begun accepting claim forms from those affected by the accident. Forms can be obtained by calling (650) 689-8357, or (650) 689-8358.

1 0

RE: PGP kerserver infrastructure
by L. Sassaman 03 Jul '00

03 Jul '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Mon, 3 Jul 2000, Dave Del Torto wrote: > >Unlike an X.500 directory, it is very difficult to segment PGP keys > >into directories. How would one do this? Using DNS? > > Right. DNSsec defines KEY and SIG records, so you could > theoretically have a key associated with every IP address. DNS is extremely ill-suited to serving as a key distribution method. This has been discussed multiple times, and the people who have actually worked on keyservers all generally agree that there must be better means for doing this. > >Which domain would one choose to use for cataloging the keys? (ex.: > >My key has multiple email addresses, including quickie.net and > >pgp.com. Which domain would it be under?) ... > > Both. Availability is a primary design criteria. How about keys like the PGP Employee Certification Key, which has no email address? What if quickie.net was an ISP that did not want to run a keyserver? Have you ever actually tried to use bind to serve keys? (I think not, or else you would not be suggesting it.) > >Multiple servers only exist for redundancy and performance benefits. > >... > > They also provide rapid access for local users. It's the same as when > I plug a new device onto my network and it's IP and FQDN get sucked > into the DNS, then someone can do a DNS "DIG" for the machine's > address based on some protocol need. > > Draw the analog in key management to DHCP, and build that. Again, trying to shoehorn PGP key serving into an existing technology might be a good thing, but only if that existing technology will be suitable. DNS is not. __ L. Sassaman System Administrator | Technology Consultant | "Common sense is wrong." icq.. 10735603 | pgp.. finger://ns.quickie.net/rabbi | --Practical C Programming -----BEGIN PGP SIGNATURE----- Comment: OpenPGP Encrypted Email Preferred. iD8DBQE5YU0nPYrxsgmsCmoRAu/TAKCfUtg4Mv+4tq39VAINQRyEtoHCrACg8EHt MvxJ5QSrjxHZazWZn6IsGmE= =q9eF -----END PGP SIGNATURE-----

1 0

Re: PGP kerserver infrastructure
by L. Sassaman 03 Jul '00

03 Jul '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Fri, 30 Jun 2000, Michael Helm wrote: > "L. Sassaman" writes: > > X.509 is a much older and cruftier standard. PGP is recognised by most to > > be the superior method for handling email and file encryption and signing. > > X.509 is designed to satisfy situations where there is a complex heirarchy > > in an X.500 setting. > > I don't know about the first claim; PGP certainly developed partly > in response to PEM, which was based on hierarchies. Which standard is better > I think is up to customers to decide. I think customers *have* decided. Where is PEM now? (And Phil Z. wasn't aware of the existance of PEM until very shortly before he released PGP, btw.) - --Len. __ L. Sassaman System Administrator | Technology Consultant | "Common sense is wrong." icq.. 10735603 | pgp.. finger://ns.quickie.net/rabbi | --Practical C Programming -----BEGIN PGP SIGNATURE----- Comment: OpenPGP Encrypted Email Preferred. iD8DBQE5XcDFPYrxsgmsCmoRAgEYAJ9Lhxvy2v1Pm6BWMqOEdCz04shIswCg8nBT A7xQbEKRW8/ZFr3vGc/I5Qs= =RJ5B -----END PGP SIGNATURE-----

4 14