September 2004 - Test - lists.nanog.org

Transit and backhaul, San Jose CA
by Thomas 07 Sep '04

07 Sep '04

Greetings, I apologise profusely for the off-topic nature of my posting. I am not having much luck with responses from people I've been trying to reach more directly. I am looking for transit, colocation space, and backhaul from the Southern Cross landing facility in San Jose, CA. I would like to hear from providers who are able to provide one or more of these things - the focus being on the third item. Looking for STM-4 to GigE of capacity. I'd be particularly interested in anyone who can also provide similar services in Sydney, Australia. Naturally, I would prefer responses to be kept off-list. Cheers, Thomas

1 0

QoS Service and montoring methods
by Joe Shen 06 Sep '04

06 Sep '04

Hi, I'm woring with QoS level analysis in ISP networks. But I don't know where could I find infomation on the following questions: 1. Is there a list of ISPs providing QoS in their networks? 2. Where could I find detailed infomation on QoS level parameters in those ISPs who do QoS? e.g.,( e2e bandwidth, e2e delay, e2e delay jitter, packet loss rate )for Real-time service level, Golden Service, Silver Service etc. 3. Is there any question on setting up QoS in current networks? 4. Is traffic engineering used for QoS ? 5. Is there any method to monitor amount of traffic on each service class? Each word will be highly appreciated. Joe __________________________________________________ Do You Yahoo!? Download the latest ringtones, games, and more! http://sg.mobile.yahoo.com

1 0

Re: Spammers Skirt IP Authentication Attempts
by Edward B. Dreger 06 Sep '04

06 Sep '04

JB> Date: Mon, 06 Sep 2004 13:42:22 -0600 JB> From: Jawaid Bazyar JB> 1) Domains spammers own will quickly become blacklisted. JB> Spammers will be forced to purchase register tons of JB> domains in order to continue spamming. However their Or use SPF-less domains. JB> 2) Pressure will quickly mount on domains that don't JB> facilitate authentication, with the effect snowballing JB> over time. This will ensure system-wide adoption of close JB> to 100% fairly quickly. There's a spark of optimism buried deep inside me that really wants to believe that. SAV has made me more cynical. :-/ JB> There's something else you're not granting here, however. JB> Once the domains that are commonly used for forged headers JB> get "protected" with an authentication mechanism, I as a JB> system administrator no longer have to spend excessive time JB> and effort trying to distinguish between spam with that JB> domain name and legitimate email with that domain name. Agreed entirely; IIRC, I think I said something similar a few weeks back. SPF is a useful data point -- we use ~19 RBLs as data inputs, and no one can authoritatively nail email as spam. Even if "SPF pass" is totally useless, I'd be surprised if "SPF fail" didn't indicate a high probability of spam. JB> Instead of lookups on numerous RBLs and numerous other CPU JB> and network-intensive checks, I can simply trust email from JB> aol.com, msn.com, hotmail.com, yahoo.com - and these comprise JB> enough of my email load that I will get an instant resource JB> utilization benefit from knowing that email from @yahoo.com JB> is really from @yahoo.com and short-circuiting all the spam JB> checks I usually do. Very good point. No disagreement here. However, I didn't like the article's overgeneralized "News flash! whitelisting all 'SPF pass' entries will let spam by!" attitude. Anyone whitelisting mail that has a valid SPF entry is nuts. JB> Thus even if authentication should never become 100% and even JB> if it doesn't stop spam, I still get a net benefit. Definitely. It's increased information... not enough for "perfect" decisions, but enough for "better" decisions. Eddy -- Everquick Internet - http://www.everquick.net/ A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita

1 0

Hurricane Frances impacts
by Sean Donelan 06 Sep '04

06 Sep '04

Since the FCC no longer makes outage reports public, folks will have to obtain their information from other sources. The networks in Broward, Palm Beach, Martin, Brevard counties appear to be the most impacted. Cellular had problems due to wireless sites being without power. The wireless industry brought in 500 new generators in advance of the hurricane, but needed to wait until the hurricane passed before sending them out to the cell sites. Miami and Orlando also have sites down due to power issues and connectivity to local carriers. The various local access line providers in Florida, Florida has a lot of tiny LATAs and phone companies, report some access lines are down but haven't published any counts. Cable networks have the same issues with local cable service. No reports of damage to telephone central offices or cable headends. Due to power outages and local access network problems, bank networks and cash machines are out of service in most of the affected counties. No reports of problems to any NAPs, POPs, data centers or fiber trunks. They generally have permanent generators. So if you have local connectivity, Internet access is working. Streaming audio/video from Florida television and radio stations over the Internet did not have any problems. Some WiFi providers are once again offering free WiFi service in the affected counties, if you can reach a working hotspot (with local power and local network connectivity).

2 4

Distributed Dictonary email slam
by Matt Hess 06 Sep '04

06 Sep '04

We are secondary mx for a specific domain that has been hammered since friday night. We've accumulated literally thousands of email messages in our queue while the primary mx at the customer site is out of service yet again. In looking at the queue it appears that it's one heck of a dictionary based slam. Interesting thing about this is that it is distributed.. entire dictionary destination addresses such as bene*(a)domain.com come from one host (apparently with a trojan on it or otherwise) while benf*(a)domain.com come from yet a different host.. and so on down the alphabet all the while constantly changing source hosts.. Now being as we are a secondary mx I'm dropping their record out of our email system as I write this, however, I am curious if other have gone through or are currently going through something of this magnitude (12K spam/dictionary msgs per hour destined to one domain and that's just what is getting past the blacklist checks). Normally I see my spam block daemon at around 10 - 15 concurrent requests.. right now it's tearing along at around 160 - 180 concurrent bad connections. And of course a few suggestions to mitigate this would be appreciated.. I currently employ multiple blacklists such as spamcop.net, abuseat.org, spews level 1 and 2, and spamhaus, plus my own blocklists for china and korea to check on incoming email source addresses.

6 8

RIPE "Golden Networks" Document ID - 229/210/178
by Rodney Joffe 06 Sep '04

06 Sep '04

Hello folks, This is actually NANOG applicable, despite referring to RIPE... ;-) How many of you who manage BGP speaking networks implement the RIPE "best practices" regarding dampening parameters for so-called "golden networks"? See: http://www.ripe.net/ripe/docs/routeflap-damping.html and http://www.qorbit.net/documents/golden-networks (thanks, Steve!) If you do, what parameters do you use, or do you not dampen the "golden networks" at all? If you don't implement ripe-229, why not? If there is enough interest/response (i.e if anyone besides me feels this is a real operational issue currently and wants to deal with it), I'll work on compiling the responses and producing a report. Note: A *significant* number of networks appear to *not* follow ripe-229 guidelines at all. Thanks, Rodney Joffe CenterGate Research Group, LLC http://www.centergate.com "Technology so advanced, even WE don't understand it"(R)

18 27

Re: OT- need a new GSM provider
by Paul Vixie 06 Sep '04

06 Sep '04

> You can get most of these phones unlocked from the sim lock > and then <british>flog</british> it on ebay - goes to the time > and effort costs of the aggrevation of dealing with mobile > operators. i plan to send the shattered remains of that phone back to AT&T in case they think that my small claims suit is a way to get myself a low-cost phone by proving that they violated the contract first. besides which, i hated the phone. i couldn't get it out of my pocket without hitting the voice-call button. the asynchronous nature of the java-based UI meant that the softkeys often changed what they meant while i was trying to press one. what a total piece of garbage.

3 2

Why do you use AS path prepending?
by Hui Wang 05 Sep '04

05 Sep '04

Hi, I learned from some measurement data that many ISPs are now using AS path prepending. I am very curious about the goal of these actions. Intuitively, I guess there are following reasons: 1. because of some business reasons, one ISP dislikes the traffic to some destination prefixes to go through it. Then this ISP prepends the routes to these prefixes. 2. for the traffic engineering purpose. The prepending is performed because ISPs want to balance the inbound load. 3. for performance purpose. Although the route via ASa has the shortest AS path, the performance of this path is not very good. Then the ISP prepends all routes via ASa. What do you think about this question? Why do you use AS path prepending? Best, Flora

1 0

RE: Best Practices for Enterprise networks
by Michel Py 04 Sep '04

04 Sep '04

>> Tracy Smith wrote: >> Specifically, to NAT or not to NAT? This is not much of an issue anymore. If you receive IP addresses from your ISP, not natting would be foolish. Even if you do own your own public IP space, the NAT issues are fundamentally no different than the firewall ones and since not having a firewall is not an option, most enterprises will indeed NAT some of their subnets in their firewalls, whether or not they have or could easily obtain public space. > At what point should NAT-ting be performed ... > exclusively at the Egress point If there is only one egress point, indeed (typically at the firewall that's between the outside router and the inside router). If there are multiple egress points it's more interesting. There are multiple designs. > about firewalling - centralized/decentralized? Greatly varies depending the design and requirements of a given enterprise. > Iljitsch van Beijnum wrote: > Fortunately, I've never been in the position > to make such decisions, That's when you understand the real meaning of FUD: when you @55 and/or your job are on the line ;-) > but I can tell you one thing: if you have multiple connections > to the internet, you had better make sure that your NATs and > firewalls are equipped to handle the case where you send a > packet out through connection A and the reply comes back > through connection B. Indeed. > Paul Ferguson wrote: > Asymmetric paths are a fact of life in the Internet. Not for enterprise operators except the largest ones. Asymmetric traffic does happen in the core, where there are no firewalls or NATs; as far as the edge is concerned though I know several companies that multihome to two or more ISPs but only in one location, largely because they don't want to deal with NAT/firewall issues. Although it can work, it requires extra engineering and most of the time a fat pipe to replicate state information between the sites. Michel.

2 1

RE: Senator Diane Feinstein Wants to know about the Benefits of P2P
by Michel Py 04 Sep '04

04 Sep '04

>> Michel Py wrote: >> In other words: as of today a large part of the bandwidth is >> allocated to building everyone's collection of files. This >> might gradually change to become bandwidth being used only >> for incremental updates as huge local file libraries become >> common place. > Peter Galbavy wrote: > But this possible assumes that production of new media will > either slow or stay at a constant rate. Not necessarily, IMHO. Maybe, maybe not. Number of Google hits for: Rock and Roll: 6,230,000 Jazz: 25,400,000 Disco: 11,600,000 Hard rock: 8,430,000 Heavy metal: 7,210,000 Pr0n: 102,000,000 (spelled the right way :-) There are only 24 hours in a day and I don't have 100 years to live. > The never-yet-realised side effect of all this distribution > capacity is that possible many more artists will have access > to the listeners / viewers and in more narrow niches than the > existing system allows. Indeed, but there are two limits to this and one personal observation: ymmv, but last time I walked into a record store I found way more records by people I haven't even heard the name before than from people I remotely heard about. I personally don't feel oppressed by the lack of diversity in the existing system; it is not totally fair, but the other side of the coin is that I have only that much time allocated to watching/listening to what most other people have dumped. Reality check: I never illegally downloaded any copyright-protected content, nor anybody reading this, heaven forbid; we all are saints. I am wondering though: among these criminals that illegally download music (possibly behind a NAT box, double crime in certain states), how many did download because they heard it on the radio (who does pay hefty royalties)? The two limits are: 1. How many songs can you listen to or how movies can you watch in a day? Let's put this a way everyone understand: how much good does it do to you if you can pirate 20 movies a day but only watch two? 2. Most people do develop tastes in certain genres and/or artists: for example you will not find any Britney Spears nor Metallica on my disks; I did download some due to the buzz factor, and I did not like it so I deleted it. Remember that what we are talking about is bandwidth: just because something becomes available on a P2P network does not mean that I will download it. There is actually some content that you would have to pay me in order to download watch/listen to. Information overload, anyone? To re-use your own word: niche. Niche markets do not shape an industry; what shapes our industry (which is moving packets, and sometimes makes people call us packet movers, short of box movers or carpet baggers) _is_ moving packets. Bittorrent and eDonkey means something to us, not two dudes FTPing a 40 year-old 15-minute b&w movie sampled at 10fps@160x100. Bittorrent and eDonkey used to swap pr0n in French or Swedish means more to us in terms of bandwidth than M$ XP SP2. What I was trying to say is this: I don't expect the majority of people to build a local library of anything that has been done by anyone for the last 900 years. What I think is possible though is that at some point every jazz lover might have every piece of jazz that is worth listening, every top50 listener might have every song that ever made it to the top50, and every Metallica or Britney Spears fan might have everything that they ever released (note I am not saying this is good, all I'm saying is that it could happen). If we do reach this point, there are only a handful of titles that makes it to the top50, and the bandwidth required to incrementally download them becomes irrelevant. Again, this is not an argument about "is P2P right or wrong". In the US, we don't pay for local calls. Does it mean we all spend the entire day talking on the phone just because it's free? No it does not, and the same applies to P2P. Michel.

1 0