September 2001 - Test - lists.nanog.org

Where NAT disenfranchises the end-user ...
by Roeland Meyer 07 Sep '01

07 Sep '01

Hello all, In the recent multi-homing dicussions, many references were made, both public and private, to encouraging NAT and NAT techniques, in implementing local multi-homing. To be honest, even though I've used NAT myself and have implemented NAT for friends and clients, I would NEVER represent that a NAT'd address has the full connectivity to the Internet that a static address does. I've had many people ask me why. I've even gotten some hate-mail from members of this forum over this. The attached message is one instance-proof of where NAT is deficient. If you are selling transit and you are going to NAT them, then you cannot tell them that they have access to the full internet. There is a *lot* of stuff that will not transition a NAT boundary. A business that requires direct Internet access can't use NAT at the border. A business that delivers services to the internet can't use NAT, for their application servers, at all. BTW, I apologize if the subject-line appears inflammatory. |> -----Original Message----- |> From: ceo(a)vany.org [mailto:ceo@vany.org] |> Sent: Wednesday, September 05, 2001 10:39 AM |> To: announce(a)icann-ncc.org; ga(a)dnso.org |> Subject: [ga] Announcement: Invitation to remote participation in |> Non-Commercial Domain Names Holders Constituency in Montevideo |> |> |> The NCDNHC invites to all interested not able to attend our |> meeting in |> Montevideo to join us online. |> |> The meeting will be held on September 7 from 9:30 a.m. to |> 2:00 p.m local |> time (UTC -3). |> |> Details on remote participation are as follow: |> |> 1. Remote participation will be done through the VRVS system. To |> access it please browse http://www.vrvs.org |> 2. The Videoconference will take place in the Virtual Room Neptune, |> accesible from the World Wide Virtual Rooms. |> 3. To download the necessary software please access the |> DOWNLOAD sections at http://www.vrvs.org/ftp/ftp.html. All |> software is |> free of use |> 4. To learn more about how to use the VRVS tools, please |> access the DOC |> section at http://www.vrvs.org/Doc/doc.html |> 5. Don't forget to register your machine in the VRVS before use any |> tool installed. |> |> Connectivity requisites: |> 1. A public fixed IP address |> 2. A LAN must not be behing a NAT (Network Address Translation) |> 3. Machines should be properly registered in the DNS |> system. If you |> don't know what is this, please contact your network administrator. |> 4. Dialup users also can use VRVS (it is suppoused that |> your ISP have |> their DNS correctely setted-up) |> 5. H323 clients as Netmeeting, Polycom, and others works also with |> VRVS. Please read the documentation for more details. |> |> IMPORTANT: Try the VRVS software several days before the meeting to |> make sure that everything works properly. For this purpose, Vany |> Martinez will be in a test virtual room named CAFE, accessible from |> World Wide virtual rooms on September 6 from 10:00 a.m. to |> 12:00 p.m. local time (UTC -3). |> |> For any futher inquiry, please address them directly to Vany |> Martinez at |> ceo(a)vany.org |> |> |> -- |> Nilda Vany Martinez Grajales |> Information Technology Specialist |> Sustainable Development Networking Programme/Panama |> e-mail: vany(a)sdnp.org.pa |> http://www.sdnp.org.pa |> |> Nilda Vany Martinez Grajales |> Information Technology Specialist |> Sustainable Development Networking Programme/Panama |> http://www.sdnp.org.pa |> e-mail: vany(a)sdnp.org.pa |> Tel: (507) 230-4011 ext 213 |> Tel: (507) 230-3455 |> Fax: (507) 230-3646 |> __________________________________________ |> Get your free domain name and domain-based |> e-mail from Namezero.com |> New! Namezero Plus domains now available. |> Find out more at: http://www.namezero.com |> |> -- |> This message was passed to you via the ga(a)dnso.org list. |> Send mail to majordomo(a)dnso.org to unsubscribe |> ("unsubscribe ga" in the body of the message). |> Archives at http://www.dnso.org/archives.html |>

6 5

RE: Where NAT disenfranchises the end-user ...
by Roeland Meyer 06 Sep '01

06 Sep '01

|> From: Doug Clements [mailto:dsclements@linkline.com] |> Sent: Thursday, September 06, 2001 7:14 PM |> > A business that requires direct Internet access can't use |> > NAT at the border. |> |> Not true. While I expect you will take this as nitpicking, |> one:one NAT is very conveniently used for servers while |> one:many NAT can be used for generic workstation access |> while preserving a consistent LAN numbering scheme. |> Anything that a "full" internet connection gets you will |> also work with one:one NAT. Yes, one:one NAT has transitional uses. It is also good for many dial-up scenarios. But, it is not a full internet connection and users should be told so. |> > A business that delivers services to the internet can't |> use NAT, for their |> > application servers, at all. |> |> This is laughable. You're telling me that we can't use |> our Alteons or Arrowpoints that use NAT to provide |> (redundant and load balanced!) internet services? I |> guess we should just go back to the One Big Web Server |> days, and put all our MS SQL database servers out in |> "full" view of the internet. Now there's any idea. 'A' doesn't follow 'B'. Just because the app servers are visible, doesn't mean that the RDBMS servers have to be (and yes, I like F5's). That isn't even a NAT issue. The only RDBMS servers visible, on my LANs, are Oracle Enterprise Management servers and usually they are behind a VPN. There is no earthly reason to expose an RDBMS server to the internet. The only ones that need to see them are the (dual NIC) app servers and the VPN gateway. You can't run a IPSEC VPN from NAT'd space. But, we have gotten quite far from the original post, which was prompted by a scheme to implement multi-homing, using dual NAT interfaces (one to each provider). Thereby, allowing multi-homing without having to advertise the /24 in BGP. This makes a many:one relationship. Basically, you burn two static IP addrs for each host, just to avoid advertising the /24. That's 512 IP addrs where 255 would have done the job.

1 0

Re: 220v/50hz power rig
by Lincoln Dale 06 Sep '01

06 Sep '01

g'day, At 01:35 PM 6/09/2001 -0700, Vadim Antonov wrote: >On Thu, 6 Sep 2001, Lincoln Dale wrote: > > > HZ moving around causes far more problems -- makes peoples clocks go slow > > and fast. for that reason, HZ is very tightly regulated - if it goes over > > for a period, they'll make it go under to even it out. > >Sorry for the nit-picking... Grid AC frequency is tightly controlled for >entirely different reason - imagine what happens when you have two >generators on the same grid, out of phase from each other. (In really >large grids, like ex-USSR's United Energy System wave propagation delays >make the whole synchronization dance quite interesting, i tend to think of electricity grids in the form of "organised chaos". its really just one big phase-locked-loop setup where the producers are always second-guessing what the consumers want. in the four power-stations i've worked on the construction of (doing automated power-station controllers), we used automatic-phase-loop balancing that removed the "manual" part out of closing a circuit-breaker of a generator coming online - it'd do it for you, and it'd only do it when it was "in-phase". the hard part them comes dealing with a "black start" - ie. where there has been a total power failure and there is no phase to sync on to. i've also had the somewhat dubious honor of getting the automated power-station stuff wrong too. the somewhat dubious honour i can claim is that i caused a blackout of an entire nation. (the Kingdom of Tonga). its very difficult to physically close a circuit-breaker when its out-of-phase. if you do manage to do it (eg. you have a hydraulic or compressed-air based breaker that DOES have enough force to manage to close it out-of-phase), then obviously "bad things"(tm) happen to that generator. legend has it (and i don't know if this is true or not) that there is a generator (or, at least the Alternator) in the Swan River in East Perth (Western Australia) that 'jumped' >particularly >considering that turbines start rotating faster if load drops, etc). that is true of all engines. its always a supply/demand driven system, with the engine typically always operating at a fixed RPM. if supply exceeds demand, the engine spins faster (and HZ goes up). if demand exceeds supply, the engine slow down slightly (and HZ goes down). the role of the governor is to try to keep a stable frequency while governing the amont of fuel being added to the engine. >There other, as imprtant, reasons to keep frequency stable: for example, >phase difference determines the direction of energy flow in an inter-tie >transmission line! (see, for example, analysis of coupled oscillators in >Feynman's lectures on physics). And there's a whole can of worms in >keeping right the angle between voltage and current :) the kVARs, yes. :-) i've was also at one installation where the kVAR balancing was awry between generators in the same power-station. the [electronic] governors were basically 'battling' with each other but never getting in sync with each other. the net-effect there was that we had the HZ so far out (and oscillating) that it was evident by street lightbulbs pulsating. (thankfully, that didn't occur on a power-grid, but at an isolated mine-site). >Actually, a lot of what grid control automatics people do could be a very >well worth to learn for the network people. Grid control requires very >fast redistribution of the load to keep parts of grid in sync; miss the >time window, and you have to live in panic mode, effectively shutting down >and patritioning grid to protect equipment against cascading effects. power grids typically always have trip-alarms based on all sorts of things -- KVars out of sync, Frequency out of range. things tend to 'work' providing there is a large enough pool of producers and consumers. its large load-spikes and load-dips that cause things to break. i still find it incredible that power is as reliable as it is. (i don't live in Califormia, so i can make that statement. :) ). in either case, i think this discussion has probably exceeded its usefulness. cheers, lincoln.

1 0

220v/50hz power rig
by Randy Bush 06 Sep '01

06 Sep '01

you're gonna love this one. i have a piece of equipment i will be shipping to china that i want to test before i ship it over. it has a <gasp!> electric motor! so i need some kind of transformer/inverter setup that plugs into red blooded american 115v/60hz and can handle Power requirement: 1.5 kW Voltage requirement: 220 V Frequency: 50/60 Hz Current requirement: 10 A Current protection by user: 16 A (slow blow) Protection type: IP 54 Processor: C167, 20 MHz Spindle motor power: AC 380 Watts Brake: Electro-dynamic & mechanical any clues? thanks. randy

11 14

RE: Request for advice: tools
by Hunter, Jonathan 06 Sep '01

06 Sep '01

> -A DNS zone file editor. It must be CGI, allow for forward > and reverse > entries, and able to handle odd mappings (IE IN MX 32 > mail.foo.bar, etc). I've had good experiences so far with ProBIND. It automatically sorts out your forward and reverse entries for you (or you can override it), and has handled all the odd mappings I've needed so far. http://probind.sourceforge.net/ HTH, Jonathan

1 0

Re: 220v/50hz power rig
by Sean Donelan 06 Sep '01

06 Sep '01

On Thu, 06 September 2001, Alex Bligh wrote: > a wide frequency tolerance. The only problem you may run into > is that some boxes are too clever by half, and autosense input > frequency to determine output frequency. Actually, its not being clever, its being cheap. If you use the input frequency to drive the output frequency, you don't need an extra crystal oscillator. Its cheaper, and results in fewer customer service calls about the clock running fast or slow. It also means, you can't just take a 50/Hz european UPS and plug it into an US plug at 220vac, and expect to still get 50/Hz out of it. When you plug it into the US grid, you'll get 60/Hz out. I spent a day troubleshooting a problem, until someone explained to me what was happening. That's why I now use a bench power supply, which explicitily generates the type of "international" power I want, instead of using a Rube Goldburg setup.

3 2

Request for advice: tools
by Ben Browning 06 Sep '01

06 Sep '01

Greetings, all. I am looking to implement a few tools to make my life easier. I can't seem to find any good ones pre-written although I know they must exist, so I am toying with writing my own. I would love it if any of you would have any info or handy hyperlinks to help me find tools to perform the following functions. -A DNS zone file editor. It must be CGI, allow for forward and reverse entries, and able to handle odd mappings (IE IN MX 32 mail.foo.bar, etc). -A Cisco config builder. Preferably in CGI, but command line would be acceptable as well. Basically something that allows me to make changes in routers and either mirror them on a lot of other routers, as well as displaying stats and other things in a pointy-haired-boss-friendly manner. -Any kind of scripts designed with the abuse administrator in mind- IE log parsers, Code Red automailers/procmail scripts, etc etc. All of these tools would be preferred in a GNU or freeware form, but I am interested in all valid options. Thanks in advance for your time. ~Ben Browning (who speaks for himself, here) --- Ben Browning <benb(a)theriver.com> The River Internet Access Co. Network Operations 1-877-88-RIVER http://www.theriver.com

2 1

RE: Request for advice: tools
by Roeland Meyer 06 Sep '01

06 Sep '01

|> From: Ben Browning [mailto:benb@theriver.com] |> Sent: Thursday, September 06, 2001 10:43 AM |> I am looking to implement a few tools to make my life |> easier. I can't seem |> to find any good ones pre-written although I know they must |> exist, so I am |> toying with writing my own. I would love it if any of you |> would have any |> info or handy hyperlinks to help me find tools to perform |> the following |> functions. http://www.webmin.com/webmin/ |> -A DNS zone file editor. It must be CGI, allow for forward |> and reverse |> entries, and able to handle odd mappings (IE IN MX 32 |> mail.foo.bar, etc). It let's you edit the raw zone files. |> -A Cisco config builder. Preferably in CGI, but command line |> would be |> acceptable as well. Basically something that allows me to |> make changes in |> routers and either mirror them on a lot of other routers, as well as |> displaying stats and other things in a |> pointy-haired-boss-friendly manner. Much easier if you use Webmin as a platform and make a Webmin module for this. There is a SDK for Webmin. This is an opportunity to give back to the project.<g> |> -Any kind of scripts designed with the abuse administrator |> in mind- IE log |> parsers, Code Red automailers/procmail scripts, etc etc. Lots of pre-built options here, with sources that you can modify. |> All of these tools would be preferred in a GNU or freeware |> form, but I am |> interested in all valid options. It's now on SourceForge.

1 0

RE: ATM failure - No the other kind of ATM
by Roeland Meyer 06 Sep '01

06 Sep '01

|> From: Patrick W. Gilmore [mailto:patrick@ianai.net] |> Sent: Wednesday, September 05, 2001 3:17 PM |> |> At 06:13 PM 9/5/2001 -0400, Chris Woodfield wrote: |> >As a small clarification, when you say IP, do you mean |> over the public |> >internet, or on a private IP network? I'm going to guess |> the latter, but |> I have never set up an ATM that used the Internet. ... and you probably never will either. [looking fondly at the Wells Fargo listing on the trophy wall.]

2 1

Re: ATM failure - No the other kind of ATM
by Steven M. Bellovin 06 Sep '01

06 Sep '01

According to today's Wall Street Journal, Citibank is explaining the outage as "software", and declining to release further details. But the article also noted that many of the computer systems on which banking networks are based are aging -- and trouble-shooters who can fix problems quickly are becoming rarer. Indeed, most banks and Wall Street firms run on a mishmash of systems slapped together after years of computer upgrades and bank mergers. hey are made all the more confusing by the profusion of computer languages that run the Internet. Most of them are incompatible with their mainframe predecessors.

2 1