April 2003 - Test - lists.nanog.org

Zebra Router???
by Tom Daly 25 Apr '03

25 Apr '03

Hi All, I'm trying to find out what peoples experiences regarding the throughput of Zebra on a FreeBSD Box. My configuration is as follows: Intel Pentium III 1.40G 1 Gig RAM 2x <Intel Pro 10/100B/100+ Ethernet> (one internal, one external) on board. This box is running as a simple static router, i.e. one subnet on the inside, Internet feed on the other side. No BGP, no RIP, no OSPF. Pretty simple, eh? So the goal is to know the bandwidth limitation of this router. Any ideas? I've heard numbers of 35Meg, 40 Meg, etc, however, I have not recieved a good reason backing it up. Can anyone offer some input on this? Regards, Tom Daly -- Tom Daly tom(a)dyndns.org Chief Infrastructure Officer Dynamic DNS Network Services http://www.dyndns.org/

14 14

Re: Open relays and open proxies
by Joe St Sauver 25 Apr '03

25 Apr '03

Hi Adi, #I am seeing an increasing number of hosts on our network become an open #proxy. So far the response to this has been reactive, once I receive #complaints from spam victims I deal with the source of the problem. The sheer act of having an abuse address and acting on reports received on it puts you a leg and a half up on a number of other service providers who have chosen to studiously ignore abused open proxies on their networks. #Is there an accepted way of blocking open proxy and open relay traffic at #the network edge? I think this is going to be an increasingly difficult problem to attack via blocks on specific ports; that is, while some folks may suggest blocking 1080/tcp, 3128/tcp, 5490/tcp, 6588/tcp, 8080/tcp, etc., you should be aware of an emerging class of viruses which are designed to create open proxies on uncommon and non-standardized high numbered ports which can then be exploited by the party controlling that virus (sort of a "make proxy hosts to order" operation). Jeem is probably the canonical example of this. The sheer magnitude of the problem also argues against manual construction of ACL's on a host-by-host basis; to date, having looked at this issue for maybe six months now, I believe the number of *known* open proxies is on the order of 120K hosts, few of which are sequentially disposed into nice CIDR-able netblocks (unless you're okay with the concept of lumping sheep with goats in the case of some thoroughly larded ISPs, if I may mix my metaphors). What's really needed is some way to take open proxy DNSBL data and instantiate a dump of that data onto a suitable appliance. It is probably too much state to burden a reasonable sized border route with, but you could imagine other devices that could probably handle it (at least for moderate speed flows), much as there are currently middle boxes which rip open packets to target peer to peer traffic. If you're interested in the issue of open proxies, you may want to see the paper I presented this April in Arlington VA at the Internet2 Member Meeting entitled "The Open Proxy Problem." Since that was a "suit" meeting, the talk backfills a bit about proxies at the start, but you can flip through the bits that are old news pretty easily. PDF and PowerPoint versions are available online at http://darkwing.uoregon.edu/~joe/proxies/ Regards, Joe St Sauver (joe(a)oregon.uoregon.edu) University of Oregon Computing Center

11 20

Re: 60 Hudson
by Jeffrey Meltzer 25 Apr '03

25 Apr '03

As someone who uses FiberNet in 60 Hudson (and ethernet link back to 25 Broadway) i'd say avoid them like the plague. In the ~6 months that i've had this circuit (aparently it's provisioned over an OC48), it's gone down at least 4 times, possibly more, sometimes for upwards of 12 hours at a time (starts at 10% packet loss, then just keeps growing). Their answer every times has been "bad OC48 card". I don't know whether that's just the line they're feeding me (I have a feeling it is), or their hardware vendor is just garbage, but they don't appear to have the ability to keep this circuit up for more than 3 weeks at a time. At one point they sold us on upgrading it from Ethernet to FastE, we said ok maybe that will be better. However, they took down the 10M link at around 9pm on a Friday night, and by 7pm Sunday night they hadn't had the 100M link up yet so we just told them to forget it... Since the circuit is just backup, i've been testing FiberNet as fo late. Yesterday, after I started seeing packet loss I waited at least 2 hours to call them, to see if they'd notice the issue themselves. Of course as usual they didn't. I'm fairly sure i'm the only customer they are providing this service to between 25B and 60H, otherwise for sure they'd know by know (unless they are dedicating a full OC48 to my 10M link, which would be a whole other story itself). I'm unsure, however, if this is how they provision service inside (suite to suite) 60 Hudson, it'd be fairly strange if they did, but FiberNet is turning out to be a fairly strange company. ..just my experience :) JEFF -- Jeffrey Meltzer Network Services Manager ICS/VillageNet 631-218-0700 On Wed, 16 Apr 2003, Simon Lockhart wrote: > Speaking to Level3, they're saying that the Fibernet suite on the 1st floor > is the best place for interconnects to other suites in the building.

1 1

is anybody filtering their root-ns sources?
by Paul Vixie 25 Apr '03

25 Apr '03

the table at http://www.root-servers.org/ intends to make it possible to filter out bad aspaths toward root servers. is anybody using it?

1 0

Re: Open relays and open proxies
by Jeffrey Race 25 Apr '03

25 Apr '03

On Fri, 25 Apr 2003 09:03:15 -0700 (PDT), Joe St Sauver wrote: >approach, you'll need to convince AS9929's upstreams, Sprint and Cable and >Wireless, to pull the plug (which they probably won't do) or at least >convince them to enforce an acceptable use policy on their customers (which You can *eventually* get Sprint to shut down offenders, but you have to be extremely persistent and you have to get the name of a human at the firm. I never managed to do via their abuse function. I succeeded when I found a Sprint human on a discussion group, whom I shamed into contacting the abusedroids internally. It still took weeks :( Jeffrey Race

1 0

RE: Open relays and open proxies
by Mike Damm 24 Apr '03

24 Apr '03

Block port 25 inbound and outbound, and setup a cluster of managed, authenticated, secure, mail relays (both in and out) for your customers. You're never going to get all the proxy ports, but regardless to send spam they have to hit port 25 on the outbound. I don't want to stir up old debates about SMTP filters on the edge, but I do think it's a viable solution if you provide a simple to use alternative for your userbase. (God knows I have had enough problems with sales staff plugging laptops into foreign networks and trying to get back to our mail boxes) --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Adi Linden [mailto:adil@adis.on.ca] Sent: Thursday, April 24, 2003 12:11 PM To: nanog(a)merit.edu Subject: Open relays and open proxies I am seeing an increasing number of hosts on our network become an open proxy. So far the response to this has been reactive, once I receive complaints from spam victims I deal with the source of the problem. Is there an accepted way of blocking open proxy and open relay traffic at the network edge? Adi

1 0

RE: Cogent Problems?
by McBurnett, Jim 24 Apr '03

24 Apr '03

Core routers down all over the backbone? If anyone gets more details, I would be curious.. >-----Original Message----- >From: Basil Kruglov [mailto:basil@cifnet.com] >Sent: Thursday, April 24, 2003 9:58 AM >To: nanog(a)merit.edu >Subject: Re: Cogent Problems? > > > >On Thu, Apr 24, 2003 at 08:39:11AM -0500, Basil Kruglov wrote: >> >> On Thu, Apr 24, 2003 at 09:20:55AM -0400, Brian S. Adelson wrote: >> > >> > Cogent is stating they are aware of a network outage but they are >> > unaware of duration or cause. They have opened up master >TT: HD26558. >> >> According to the person I just talk to, at 0837CST, the Core >router in >> Chicago went down and it will be up momentarily...obviously >no sign of that >> yet. > >It's up and passing packets now, I called again after 5m of >waiting and I've >been told they're tracking it under HD26558; some of their >core routers went >down all over the backbone, reason is still unknown. > >-Basil @ CIFNet >

1 0

Low AS - Number
by Dwight Ringdahl 24 Apr '03

24 Apr '03

Just a quick FYI, I am no longer with WebUseNet ASN 19151. I'll be starting to build a new network over the next several months. Does anyone have a low ASN I can buy/transfer as to not have one up in the 30,000s... My new contact info for now is, dwightringdahl(a)yahoo.com, contact me off list if you have any questions. Thanks Dwight Ringdahl

26 37

Traffic broken down by application protocol?
by Matt Larson 23 Apr '03

23 Apr '03

I'm looking for statistics on the composition of Internet backbone traffic broken down by application protocol. Ideally, I'd be interested in a list showing the relative percentage of packets by TCP and UDP destination port of some large sample of Internet traffic. But I'll take any statistics related to application protocol traffic distribution that I can get. If anyone has information that they would be willing to share publicly or privately, I would be grateful for it. Alternately, if anyone is aware of such information publicly available, I would be grateful for pointers to that, too. Thanks, Matt Larson

3 2

Re: chep snmp temperature sensors
by Michael.Dillon＠radianz.com 23 Apr '03

23 Apr '03

>I am looking for a small, cheap, simply device, that can measure temp and >be polled via SNMP. POE would be a plus. Hmm... small, cheap, simple, pick any two? If it's small and cheap that are most important, you could try building your own like this: http://www.brianlane.com/dthardware.php Of course, that's not so simple unless you have some experience with getting custom PCBs made and you have some sort of UNIX server at each site to act as the SNMP agent. But it is about the smallest and cheapest that you will find. --Michael Dillon

3 2