May 2002 - Test - lists.nanog.org

RE: Certification or College degrees? Was: RE: list problems?
by Pistone, Mike 22 May '02

22 May '02

Not to toot the horn of my Alma Mater too much, but Ohio University's Communication Systems Management program (www.csm.ohiou.edu) is also along the lines of a network engineering degree. It also focus on other aspects of the industry (regulation, comm theory, security, etc) but they all sort of flow together. They were just getting into more hands on networking labs when I graduated, I am sure they have greatly improved since then. Mike -----Original Message----- From: John Kristoff [mailto:jtk@depaul.edu] Sent: Wednesday, May 22, 2002 3:52 PM Cc: nanog(a)merit.edu Subject: Re: Certification or College degrees? Was: RE: list problems? On Wed, 22 May 2002 16:40:27 -0400 "Kristian P. Jackson" <kahuna(a)krisjackson.net> wrote: > network engineers, just as a bunch of network engineers are no more > qualified to program. Perhaps a bachelors in network engineering is in > order? We actually have that - or something close to it. We are slowly building a bigger networking lab with router-ish stuff for students to learn from. In fact, I'll be handing off full BGP table for them to see and play with in the lab. If you want to help us educate, we'll gladly accept any donations, particularly gear, we can get. :-) http://www.cs.depaul.edu/programs/2002/BachelorNT2002.asp http://ipdweb.cs.depaul.edu/programs/lan/index.html http://condor.depaul.edu/~jkristof/tdc375/ http://condor.depaul.edu/~jkristof/2001Spr365/ John

2 1

Re: Re: list problems?
by John Neiberger 22 May '02

22 May '02

To be honest, I recall that particular language and it made me wonder if it was an AUP violation. I don't know that I'd equate enforcing an AUP with censorship. We are, after all, professionals and it shouldn't be difficult to maintain a certain level of decorum. Speaking for myself, my choice of words at home can be considerably different from what I'd choose to use at work or when dealing with other professionals in a public forum. The sort of language that I sometimes use at home or with friends is not acceptable here at work so I would presume that it wouldn't be acceptable when communicating in an open professional forum. Just my $.005 after taxes, John ---- On Wed, 22 May 2002, Ralph Doncaster (ralph(a)istop.com) wrote: > > On Wed, 22 May 2002, Andy Dills wrote: > > On Wed, 22 May 2002, Jeffrey Meltzer wrote: > > > > > > I've gotten at least 5 messages from you on this list today... > > > > Yeah, maybe NANOG implemented WFQ... > > Further tests seem to indicate that every message posted to the list is > read/approved by a human. > http://ns.istop.com/~ralph/censored.txt > > -Ralph > > > >

1 0

Re: Linux routing
by Valdis.Kletnieks＠vt.edu 22 May '02

22 May '02

On Wed, 22 May 2002 09:20:41 EDT, Valdis.Kletnieks(a)vt.edu said: > it incorrectly to a process - I seem to remember some handwaving in either > the Keifler&McKusic or Bach books about how interrupt time is charged against Argh. I knew that didn't look right... ;) Leffler, McKusic, Karels, Quarterman: "Design and Implementation of the 4.3BSD Unix Operating System" Addison-Wesley That will teach me to not cite unless I have either book or caffeine ;)

1 0

The market must be coming back
by Christopher J. Wolff 22 May '02

22 May '02

Everyone's so busy there hasn't been a peep on here in weeks. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories http://www.bblabs.com

11 20

RE: Cisco 7200 VXR with NPE-400 (was RE: The market must be coming back)
by Daniska Tomas 22 May '02

22 May '02

did you do netflow switching or cef + netflow accounting that time? -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first. > -----Original Message----- > From: Ralph Doncaster [mailto:ralph@istop.com] > Sent: 22. mája 2002 16:15 > To: Heath_Dieckert(a)Dell.com > Cc: nanog(a)merit.edu > Subject: RE: Cisco 7200 VXR with NPE-400 (was RE: The market > must be coming back) > > > > > Based on our testing it looks like it all has to do with > packet size. With > > small packets the throughput is very low. With what Cisco calls an > > "internet mix" of packet sizes throughput is much better. > When doing max > > MTU packets, the throughput is of course the best. > > The other thing I've found about traffic type is how sensitive > netflow is. I was running it for a while, then I got a co-lo customer > that had a lot of UDP traffic with small packet sizes and > rarely more than > a few packets between the same src/dest ip/port (much like DNS > queries). It was enough to flatline the box and cause it to crash. > > -Ralph > >

2 1

RE: Cisco 7200 VXR with NPE-400 (was RE: The market must be comin g back)
by Heath_Dieckert＠Dell.com 22 May '02

22 May '02

Based on our testing it looks like it all has to do with packet size. With small packets the throughput is very low. With what Cisco calls an "internet mix" of packet sizes throughput is much better. When doing max MTU packets, the throughput is of course the best. Also remember that Cisco as well as most other vendors advertise one way traffic only. If you have traffic on the return path, that counts against their numbers. So 400000 pps one way is the same to them as 200000 pps both ways. Interesting thread Thanks. -----Original Message----- From: Gary [mailto:garyb@foundrynet.com] Sent: Tuesday, May 21, 2002 12:12 AM To: Adam Rothschild Cc: nanog(a)merit.edu Subject: Cisco 7200 VXR with NPE-400 (was RE: The market must be coming back) Adam: > [...] Sort of like buying a GbE interface for a 7200 (It only get's > > 10% throughput... Why waste the money, just buy FE!). > > How did the Foundry test lab arrive at those figures, and what > substances were consumed at the time? I used a Cisco 7200 VXR with NPE-400. I used two different 7200's with the exact same results. Bidirectional throughput on 1GbE is a fraction above 10%. Unidirectional is a bit better (23%). Singl line ACL drops it to 8% (permit ip any any). FE performance doesn't start to drop below line rate until you put more than two in the box. I have a powerpoint if you'd like it, but it is not meant to slander Cisco, just to convince my customers NOT to put GbE in a 7200! It is not a GbE platform!

2 1

Linux routing
by Ralph Doncaster 22 May '02

22 May '02

I don't really trust the vmstat system time numbers. Based on some suggestions I received, I ran some CPU intensive benchmarks during different traffic loads, and determined how much system time was being used by comparing the real and user times. The results seem to show that if I want to do 50Mbps full-duplex on 2 ports (200M aggregate) that the standard Linux 2.2.20 routing code won't cut it. Unloaded Duron 1G root@TO-VS ~# time bzip2 /tmp/words real 0m0.414s user 0m0.400s sys 0m0.010s 750Mhz Duron, ~20Mbps traffic, 8K int/sec vmstat reported CPU idle: 98% (2% system) root@tor-router ~# time bzip2 /tmp/words real 0m0.628s user 0m0.380s sys 0m0.160s CPU load ~= 40% root@tor-router ~# time bzip2 /tmp/words real 0m0.552s user 0m0.460s sys 0m0.090s CPU load ~=16% 750Mhz Duron, ~60Mbps traffic, 20K int/sec vmstat reported CPU idle: 95% (5% system) root@tor-router ~# time bzip2 /tmp/words real 0m1.071s user 0m0.370s sys 0m0.690s CPU load ~= 65% root@tor-router ~# time bzip2 /tmp/words real 0m1.041s user 0m0.440s sys 0m0.600s CPU load ~= 58%

4 4

'SQLsnake' Worm Blamed For Spike In Port 1433 Scans
by blitz 22 May '02

22 May '02

> 'SQLsnake' Worm Blamed For Spike In Port 1433 Scans >http://www.newsbytes.com/news/02/176701.html > >By Brian McWilliams, Newsbytes >SAN MATEO, CALIFORNIA, U.S.A., >21 May 2002, 11:04 AM CST > >A mounting trail of evidence has security experts warning that a new >Internet worm targeting Microsoft SQL servers could be on the loose. > >Since Monday, a sharp spike in remote probes of TCP port 1433, which >commonly is used by Microsoft's SQL database, has been reported by >many server administrators, according to SecurityFocus, which operates >an incident-reporting system called ARIS. --snipped for brevity, full article at url above.

1 0

Spammers could face fines
by blitz 21 May '02

21 May '02

We can hope cant we? Forward from another list: >Spammers could face fines > >Reuters >May 17, 2002, 12:20 PM PT > >A bill aimed at limiting unwanted junk e-mail was approved and sent >to the floor by the Senate Commerce Committee on Friday with >unanimous support from Democrats and Republicans. It would strengthen >the Federal Trade Commission's enforcement authority by allowing it >to impose fines of up to $10 each on e-mails that violate existing >laws against spam, with a cap of $500,000. > >Sen. Conrad Burns, a Montana Republican and co-sponsor of the >legislation, said the bill would help both e-commerce and consumers >burdened by unsolicited junk or pornographic e-mails. "Rampant >pornography and fraudulent credit deals were never the destiny of the >Internet, but they have become commonplace fixtures in in-boxes >everywhere," he said. > >No similar measure is pending in the U.S. House of Representatives. > >New Mexico Republican Rep. Heather Wilson's bill requiring spammers >to use a legitimate return address--so unwanted e-mail can more >easily be blocked--has not yet been scheduled for a vote. > >Twenty-two states have passed anti-spam legislation. Spam has >especially been a problem for rural consumers, many of whom pay >long-distance charges for Internet connections and waste time and >money erasing their unwanted e-mails, Burns said. > >The Senate Commerce Committee on Friday approved an amendment by Sen. >Barbara Boxer, a California Democrat, that would prohibit >transmitting unwanted e-mails to addresses that were illegally >obtained from Web sites. > >Co-sponsor Sen. Ron Wyden, an Oregon Democrat, said moving the bill >would help the FTC deal with thousands of complaints it has received >about spam. > >"The problem is, the technology is on the side of the spammer," Wyden >said. > >The proposal would also require e-marketers to include a working >return address to allow recipients the option of refusing further >e-mails, and give Internet service providers the ability to bring >suit to keep unlawful spam off their networks. > >It would also subject spammers who intentionally disguise their >identities to misdemeanor criminal penalties.

1 0

DoS on ftp port
by Brian Wilson 21 May '02

21 May '02

Just wondering if anyone else has seen this happen recently: https://uni01nf.unity.ncsu.edu/ncsu/usage/io-fps-service-daily.html We maxed out at about 10,000 flows/sec. I'm currently going back through our argus logs and collecting a list of source hosts (all appear to be spoofed of course). In a 15 minute period we had 4.2 million unique hosts pounding one of our servers. The only reason I post this is that on some other off-campus machines I maintain, I've seen an increase in ftp connections. So, I was wondering if this is some new worm, ddos, or something of that nature. If anyone would care to comment, I'm all ears. Brian -- Brian Wilson wilson(a)ncsu.edu Network Analyst W: 919.513.3472 Communication Technologies F: 919.513.1893 North Carolina State University http://www.ncstate.net

5 5