November 2005 - Test - lists.nanog.org

Akamai server reliability
by Roy 09 Dec '05

09 Dec '05

Hi, Many moons ago, we got a set of Akamai servers. Over the years I think they replaced every one of them at least once. Last August we got a another set of servers due to a move and now two of those three servers have failed. I still have the original server that started garlic.com in production after 11+ years so I know servers can last a long time. I don't understand why Akamai failure rates are so high Is anyone else seeing high failure rates of Akamai servers at their facilities? Roy

27 32

Re: BGP Security and PKI Hierarchies
by Sandy Murphy 07 Dec '05

07 Dec '05

Michael Dillon said: >The fees are not charged for past services that were >received for free, only for future services. So you are saying that legacy space holder who signed a memberhsip agreement would not owe the usual yearly fee associated with their legacy space holdings but only those fees associated with any future address space allocations/assignments? I imagine that would please the legacy space holders. Do you know that this would be the case? I'm not a registry canon law expert myself. --Sandy

9 12

Re: BGP Security and PKI Hierarchies (was: Re: Wifi Security)
by Sandy Murphy 07 Dec '05

07 Dec '05

>in operation, this means that there could be isp- (or ufo-)centric >isp identity certification (a la web of trust, for example) which >could have a very separate cert chain from that of address space >allocation, which, aside from the legacy issue, could come via the >rirs. So when one receives an update, which part is it that you verify with the certificate derived from the RIR chain and which part is it that you verify with the certificate derived from the web-of-trust? I'm guessing the answer in part is that there's a signature attesting to the prefix origination based on the RIR-rooted certificate, but I'm not certain what you are suggesting you would sign with the web-of-trust based ISP identity certificate (the origination announcement, indicating that it is not only authorization to originate but also source authentication?) If the RIR-rooted certificate says that ISP XYZ is allocated prefix P, does the web-of-trust ISP identify certificate have to say exactly "ISP XYZ"? Is that exact match the link between what the RIR-rooted cert is proving and what the web-of-trust identify cert is proving? --Sandy

8 19

QoS for ADSL customers
by Kim Onnel 06 Dec '05

06 Dec '05

Hello everyone, We have Juniper ERX as BRAS for ADSL, its GigE interface is on an old Cisco 3508 switch with an old IOS, its gateway to the internet is a 7609, our transit internet links terminate on GigaE, Flexwan on the 7600 The links are now almost always fully utilized, we want to do some QoS to cap our ADSL downstream, to give room for the Corp. customers traffic to flow without pain. I'm here to collect ideas, comments, advises and experiences for such situations. Our humble approach was to collect some p2p ports and police traffic to these ports, but the traffic wasnt much, one other thing is rate-limiting per ADSL customers IPs, but that wasnt supported by management, so we thought of matching ADSL www traffic and doing exceed action is transmit, and police other IP traffic. Doing so on the ERX wasnt a nice experience, so we're trying to do it on the cisco. Thanks

10 19

RE: Ethernet over SDH tutorial/concepts.
by Michael K. Smith 06 Dec '05

06 Dec '05

Hello: It could also just be a direct Ethernet path over a SONET circuit without the inherent 802.17 resiliency. You should ask them for more information about their infrastructure. Are they using 802.17? Is it path-protected on the SONET side? Mike -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Paul Khavkine Sent: Wednesday, November 30, 2005 12:05 PM To: MARLON BORBA Cc: nanog(a)merit.edu Subject: Re: Ethernet over SDH tutorial/concepts. This is most likely something like RPR/802.17 which is Ethernet over Sonet/SDH. Cheers Paul On Wed, 30 Nov 2005, MARLON BORBA wrote: > >Dear NANOGers, > >We are in process of choosing a new corporate ISP for our company. One of them offered us connection to their backbone using Ethernet over SDH. I'd like to find some introductory texts or prospects about that technology and some advice about its pros/cons when compared to traditional data circuits. > > > >Abraços, >Marlon Borba, CISSP. >-- >GTER 20/GTS 02.05 - Participe! >http://eng.registro.br/gter20/prog.html >-- > > ************************************************ Paul Khavkine Networks/Systems Planning and Engineering DISTRIBUTEL Communications. 740 Notre Dame West, Suite 1135 Montreal, Quebec, Canada, H3C 3X6 +1-514-877-5505 x 263 http://www.distributel.net ************************************************

2 1

Re: GoDaddy DDoS
by Sam Crooks 02 Dec '05

02 Dec '05

the source I have seen so far is: http://news.com.com/GoDaddy.com+suffers +outage/2110-7349_3-5977187.html?tag=nefd.hed So I was looking for more details.... On Wed, 2005-11-30 at 23:11 +0000, Christopher L. Morrow wrote: > On Wed, 30 Nov 2005, Sam Crooks wrote: > > > Does anybody have information regarding to size and scale of the DDoS > > attack purported to have happened against GoDaddy today? > > nope... but against their: > 1) dns servers? > 2) web servers? > 3) mail servers? > 4) networking equipment? > 5) none of the above? > > > CONFIDENTIALITY NOTICE: This message, and any attachments, are intended only for the lawful and specified use of the individual or entity to which it is addressed and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that you are STRICTLY PROHIBITED from disclosing, printing, storing, disseminating, distributing or copying this communication, or admitting to take any action relying thereon, and doing so may be unlawful. It should be noted that any use of this communication outside of the intended and specified use as designated by the sender, may be unlawful. If you have received this in error, please immediately notify us by return e-mail, fax and/or telephone, and destroy this original transmission and its attachments without reading or saving in any manner.

9 8

RE: SWIP and Rwhois in the Real World
by Greenhagen, Robin 01 Dec '05

01 Dec '05

Can someone summarize the alternatives to the ARIN recommended RWHOIS server bits (from rwhois.org)? A quick hit on Google and Freshmeat was fairly barren. Looking for one that is mostly or fully put together, or a cookbook to assemble one from parts (i.e. MySQL, PHP, Apache, 3 rubber bands, 2 gallons of perl, etc...). Regards, Robin Greenhagen GSI http://www.gsihosting.com/

4 3

GoDaddy DDoS
by Sam Crooks 30 Nov '05

30 Nov '05

Does anybody have information regarding to size and scale of the DDoS attack purported to have happened against GoDaddy today? CONFIDENTIALITY NOTICE: This message, and any attachments, are intended only for the lawful and specified use of the individual or entity to which it is addressed and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that you are STRICTLY PROHIBITED from disclosing, printing, storing, disseminating, distributing or copying this communication, or admitting to take any action relying thereon, and doing so may be unlawful. It should be noted that any use of this communication outside of the intended and specified use as designated by the sender, may be unlawful. If you have received this in error, please immediately notify us by return e-mail, fax and/or telephone, and destroy this original transmission and its attachments without reading or saving in any manner.

2 1

[Latest draft of Internet regulation bill]
by bmanning＠vacation.karoshi.com 30 Nov '05

30 Nov '05

Begin forwarded message: From: Brett Glass <brett(a)lariat.org> Date: November 9, 2005 10:43:40 AM EST Here's the latest draft of the Internet regulation bill, dated November 3rd. Note that, like earlier versions, it subjects all ISPs and VoIP providers to intensive Federal regulation and requires them to register before providing service. It also pre-empts state and local control over rights of way. For the draft text, see http://energycommerce.house.gov/108/news/11032005_Broadband.pdf --Brett Glass

27 86

RSTP - Foundry Chassis + Cisco + 802.1q + VRRPE
by Flint Barber 30 Nov '05

30 Nov '05

RSTP + 802.1q + VRRPE I have a couple of Foundry NetIron Chassis (Ironcore M4 blades, v9.0.x), Foundry SIs and some Cisco Workgroup switches 3750s(12.2). I will also be throwing a Cat 5509 into the mix at some point running 7.x code I am trying to run RSTP between them and keep having some arp aging problems (to Foundry SIXL loadbalancers from hosts attached to Cisco) and STP problems. Also running 802.1q between all of the above and VRRPE on the Foundrys. Anyone have some good resources for this mix of characters? General searches not very helpful. I can't upgrade hardware.. Also tell me if this is an irreconcilable or irreverent mix. Biggest issues seem to be arp info aging out when all hosts are on same 802.1q vlan including SIs. Thanks for any help.. -Flint

1 0