March 2005 - Test - lists.nanog.org

Intradomain DNS Anycast revisited
by Joe Shen 28 Mar '05

28 Mar '05

Hi, I'm trying to set up a anycast DNS server farm for customer service. In order to improve availability, we plan to install those servers in one LAN which has the similar structure like : server-(1,3)---switch1---router-1---(outside) | | server-(2,4)---switch2---router-2---(outside) The four unix servers are all unix boxes, switch-1 & switch-2 are interconnected to guarantee the availability. BIND is to be used as DNS cache server software, Quagga OSPFD is used to be routing software. According to above configuration, both routers will know multiple paths to dns cache server, while dns cache server should know two paths to outside network. Here comes my questions: 1) should each dns cache server be configured a static default route (0.0.0.0/0.0.0.0)? If server-(1,3) is configured statically to use router-1 as default router, will Quagga make it use router-2 when router-1 is not reachable? 2) If each server is configured two default router ( router-1 & router-2), or each server learn route 0.0.0.0/0.0.0.0 by OSPF ( our border router inject default route into OSPF ); there should be two equal cost path to 0.0.0.0/0.0.0.0 on each DNS server, the DNS server should disperse any outgoing packets onto the two paths, will that do harm to DNS service ? 3) Is there any requirement on BIND to fit to such multipath routing situation? Joe __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

7 8

Re: DNS cache poisoning attacks -- are they real?
by Suresh Ramasubramanian 28 Mar '05

28 Mar '05

On Mon, 28 Mar 2005 16:40:22 +0100, Brad Knowles <brad(a)stop.mail-abuse.org> wrote: > If you want to use your own resolver remotely like this, I can't > really say too much about that. However, in that case I would > encourage you to ensure that the server is closed to queries from > outside sources unless those sources are cryptographically > authenticated. Not even mine as a matter of fact. My DSL ISP's. :)

1 0

Re: Clearwire May Block VoIP Competitors
by Robert Bonomi 28 Mar '05

28 Mar '05

> Date: Mon, 28 Mar 2005 06:27:56 -0500 > From: Chip Mefford <cpm(a)well.com> > Subject: Re: Clearwire May Block VoIP Competitors > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Robert Bonomi wrote: > |>From owner-nanog(a)merit.edu Sat Mar 26 12:37:15 2005 > |>Date: Sat, 26 Mar 2005 13:35:31 -0500 > |>From: Eric Gauthier <eric(a)roxanne.org> > |>To: "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> > |>Cc: nanog(a)merit.edu > |>Subject: Re: Clearwire May Block VoIP Competitors > |> > |> > |> > |>>http://www.advancedippipeline.com/news/159905772 > |>> > |> > |>"...In what the company claims is an effort to preserve the performance > |> of its pre-standard WiMAX network, Clearwire says it reserves the right > |> to prohibit the use of a wide range of bandwidth-hungry applications, a > |> list that apparently includes VoIP as well as the uploading or > |> downloading of streaming video or audio, and high-traffic Web site > |> hosting." > |> > |>Hrm... Isn't a VoIP call realtively low bandwidth? > | > | > | "*ALL* things are relative." <grin> > | > |> I haven't studied > |>this, but Vonage's site seems to imply that the maximum data rate is > 90Kbps > |>(http://www.vonage.com/help_knowledgeBase_article.php?article=190) I > |>typically see speeds greater than this from my web browser... > | > | > | There's a big difference. web browser activity is typically *very* > bursty. > | 'Average' data rate for a any single user is probably in the range of > 1%-3% > | of the burst peaks. > | > | VoIP, on the other hand, has an "average" utilization that > approximates 50% > | of the burst rate. In _both directions. > | > | I suspect that that latter factor is a fair part of the "problem". That > | the cable company has allocated fairly limited bandwidth for the > 'upstream' > | direction (from the customer to the head-end). That that 'available' > | bandwidth is *grossly* over-subscribed, on the "presumption" that traffic > | in that direction would generally be "small", and "infrequent". When > those > | assupmtions get violated, _everything_ goes to h*ll. <wry grin> > | > | Not just for 'he who' commits the violation, but everybody else who is > | sharing that over-subscribed link. > > Well, > > Since I run an ISP that is very small time, > has (at this time) only a single T1 upstream, > all my "subscribers" are wireless clients, > I guess if I have more than 2 subscribers, > I am over subscribed? I'd be willing bet that you do over-subscribe. That's how virtually _every_ provider makes it's money. Selling more downstream bandwidth than it has upstream bandwidth. "On the presumption" that not everybody will be using _all_ the bandwith they 'bought' at the same time. Dunno where you got the 'more than 2 subscribers' bit as defining over- subscribed. Unless you mis-read/mis-interpreted my remark about "50% utilization" for VoIP data. Active VoIP transmission is about 80kbps. on average, somebody is talking about half the time, and listening the other half the time. so you get an "average" of about 40kbps. In each direction. 50% of the 'burst' level. For web traffic, the burst peaks (going downstream) may be a lot higher. but the _average_ traffic level for a customer is a much smaller percentage of the peak level. the bursts are, in effect, much more extreme. And, of course, the upstream traffic is usually 'as nothing', compared to the downstream direction. Unless you've got customers running servers, that is. I'd be surprised if 'requests' from a web client averaged 400 bps for an average customer. Or 1% of a typical VoIP conversation. If somebody designed their system with asymmetric allocation of bandwidh resources between the upstream and downstream direction -- based on the presumption of web-like traffic; VoIP traffic is wildly contrary to 'expectations'. And performance can "go to h*ll". Not only for the VoIP caller, but for everybody else, too. It's not necessarily a result of "bad" network design. Just the usual case of "the world changed out from under you". Implementing the necessary engineering changes, "to make things work right again", can take a while, and cost beaucoup dollars. Which means it may not be _feasable_ to do it, at the price-point of the present service.

1 0

Re: Clearwire May Block VoIP Competitors
by Robert Bonomi 28 Mar '05

28 Mar '05

> From owner-nanog(a)merit.edu Sat Mar 26 12:37:15 2005 > Date: Sat, 26 Mar 2005 13:35:31 -0500 > From: Eric Gauthier <eric(a)roxanne.org> > To: "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> > Cc: nanog(a)merit.edu > Subject: Re: Clearwire May Block VoIP Competitors > > > > http://www.advancedippipeline.com/news/159905772 > > > > "...In what the company claims is an effort to preserve the performance > of its pre-standard WiMAX network, Clearwire says it reserves the right > to prohibit the use of a wide range of bandwidth-hungry applications, a > list that apparently includes VoIP as well as the uploading or > downloading of streaming video or audio, and high-traffic Web site > hosting." > > Hrm... Isn't a VoIP call realtively low bandwidth? "*ALL* things are relative." <grin> > I haven't studied > this, but Vonage's site seems to imply that the maximum data rate is 90Kbps > (http://www.vonage.com/help_knowledgeBase_article.php?article=190) I > typically see speeds greater than this from my web browser... There's a big difference. web browser activity is typically *very* bursty. 'Average' data rate for a any single user is probably in the range of 1%-3% of the burst peaks. VoIP, on the other hand, has an "average" utilization that approximates 50% of the burst rate. In _both directions. I suspect that that latter factor is a fair part of the "problem". That the cable company has allocated fairly limited bandwidth for the 'upstream' direction (from the customer to the head-end). That that 'available' bandwidth is *grossly* over-subscribed, on the "presumption" that traffic in that direction would generally be "small", and "infrequent". When those assupmtions get violated, _everything_ goes to h*ll. <wry grin> Not just for 'he who' commits the violation, but everybody else who is sharing that over-subscribed link. This is what happens when you sell "up to $BIGNUM" connectivity, without discussing a minimum CCIR promise. IF a customer does get throttled/blocked, they might have some fun with a false advertising assertation.

2 1

[feldman@twincreeks.net: NANOG 34: Call for Presentations]
by Steve Feldman 28 Mar '05

28 Mar '05

Reminder: program submissions for NANOG 34 are due by Monday, April 4. If you have any questions or comments, feel free to ask the program committee at nanogpc(a)nanog.org or the administrative staff at nanog-support(a)nanog.org. We look forward to hearing from you! * * * * * * * * * * * * * * * * * CALL FOR PRESENTATIONS NANOG 34 May 15-17, 2005 * * * * * * * * * * * * * * * * * The North American Network Operators' Group (NANOG) will hold its 34th meeting May 15-17, 2005, in Seattle, Washington. The meeting will be hosted by Switch and Data and held at the Westin Seattle. NANOG conferences provide a forum for information exchange among network operators, engineers, and researchers. Meetings are held three times each year, and include presentations, tutorial sessions, and BOFs. The meetings are informal, with an emphasis on relevance to current engineering practices. NANOG solicits presentations highlighting issues relating to technology already deployed or soon to be deployed in the Internet. Vendors are encouraged to work with operators to present deployment experiences with the vendor's products and interoperability. The community is invited to present talks or tutorials on: - VOIP architectures and deployment - Peering/collocation coordination issues - Security attacks/mitigation, tools, and analysis - Content provider issues - MSO IPTV deployment and operations - Backbone operational case studies - Exchange point technologies and implementation - Non-telco, last-mile technologies (metro/rural, broadband, radio, and optical) - Implementation experience with Ethernet, e.g., TLS, VPLS, Ethernet private line, and VPWS. - Wavelength use by enterprises - Large-scale wireless deployment - Experiences with native IPv6 transport rollout - State of OAM tools for IP and MPLS networks - Options for blackhole and discard routing - BGP/MPLS layer 3 VPNs - Other interesting network technologies Topics for short (10-20 minute) lightning talks will be solicited on-site in Seattle. Researchers are invited to present short (10-minute) summaries of their work for operator feedback. Topics include routing, network performance, statistical measurement and analysis, and protocol development and implementation. Studies presented may be works in progress. Researchers from academia, government, and industry are encouraged to present. How to Present -------------- Submit an abstract and draft slides for the presentation in email to nanog-support(a)nanog.org. See http://www.nanog.org/presentations.html for submission guidelines. The deadline for abstracts and slides is April 4, 2005. While the majority of speaking slots will be filled by April 4, a limited number of slots may be available after that date for topics that are exceptionally timely, important, or critical to the operations of the Internet. Submissions will be reviewed by the NANOG Program Committee, and presenters will be notified of acceptance by April 18. Final drafts of presentation slides are due by May 4, and final versions May 11.

1 0

Program survey results
by Steve Feldman 28 Mar '05

28 Mar '05

I have posted the final results of the 2005 program survey at http://www.nanogpc.org/public/pcsurvey.html There were a total of 85 responses. Steve

1 0

Re: DNS cache poisoning attacks -- are they real?
by Suresh Ramasubramanian 27 Mar '05

27 Mar '05

On Sun, 27 Mar 2005 18:22:15 +0100, Brad Knowles <brad(a)stop.mail-abuse.org> wrote: > > Abusing someone else's poorly configured resolvers is not the way > to solve this problem, and it's a bad habit to get into. > Er, I forgot to mention that it was my ISP whose resolver I used, and I have a perfect right to use their resolver when necessary. I try not to, when I am traveling, given the latency. But it is not like, for example, using an open relay, or even using John Gilmore's open by design relay at toad.com. I dont know how, but dns requests to those resolvers worked, whereas my local resolver got proxied through their dns .. if it was a transparent proxy that'd not be the case. -srs

1 0

Re: Sorbs.net
by Dean Anderson 27 Mar '05

27 Mar '05

> o could this be used as a dos and then become extortion? > has this actually happened, or is it just black heli? It has happened, in a legal sense anyway. See Exactis V. MAPS. One of Exactis' claims was civil extortion. (Claim 4 on complaint). Exactis also claimed that MAPS could block 40% of their email, an that this was a denial of service and interference with communications in violation of Colorado's electronic communication privacy act. MAPS moved for dismissal but was denied. Exactis was granted a temporary restraining order (TRO). This is significant, given the case was settled. The standard for granting such an order is that the stated case, if the asserted facts are assumed true, must be able to win on the stated law. In other words, it has state enough facts to fulfill the claimed statutory requirements. To explain TROs, let me put it this way: Imagine you have a washing machine where you have to put the right coins in the right slots to get it work. For the TRO, if they have all the right coins (assuming they are real), for all the right slots in the law, (and they pay bond), they get it. The trial is where the judge checks to see that the coins are real. Getting a TRO is a strong indicator of the technical merits of their case. If the defendant can't show some of the asserted facts false, they will almost certainly lose. > o the ts&cs would seem to indicate that the donation is > voluntary, and proportional to the spam generated. e.g., > if you generated no spam, no donation. do i understand > this correctly? Its "voluntary" except that the subscribers are misled as to the purposes of the blacklist. The abuse of by blacklist is not something subscribers voluntarily agreed to. No subscribers agreed to have their non-spam mail intentionally blocked. Demanding payment for "generated spam", in return for de-listing is pretty plainly extortion. Here is the Colorado statute: (Caps from state page) (1) A PERSON COMMITS CRIMINAL EXTORTION IF: (a) THE PERSON, WITHOUT LEGAL AUTHORITY AND WITH THE INTENT TO INDUCE ANOTHER PERSON AGAINST THAT OTHER PERSON'S WILL TO PERFORM AN ACT OR TO REFRAIN FROM PERFORMING A LAWFUL ACT, MAKES A SUBSTANTIAL THREAT TO CONFINE OR RESTRAIN, CAUSE ECONOMIC HARDSHIP OR BODILY INJURY TO, OR DAMAGE THE PROPERTY OR REPUTATION OF, THE THREATENED PERSON OR ANOTHER PERSON; AND (b) THE PERSON THREATENS TO CAUSE THE RESULTS DESCRIBED IN PARAGRAPH (a) OF THIS SUBSECTION (1) BY: (I) PERFORMING OR CAUSING AN UNLAWFUL ACT TO BE PERFORMED; OR (II) INVOKING ACTION BY A THIRD PARTY, INCLUDING BUT NOT LIMITED TO, THE STATE OR ANY OF ITS POLITICAL SUBDIVISIONS, WHOSE INTERESTS ARE NOT SUBSTANTIALLY RELATED TO THE INTERESTS PURSUED BY THE PERSON MAKING THE THREAT. Seems like the victim is induced against their will to perform or refuse to perform a lawful act, Seems like a blacklist is a 'substantial threat to cause economic hardship'. Thats a) I'm not sure I understand b)I. I don't know if an "Unlawful act" here means something that is civilly unlawful, such as unlawful participation in a group boycott, or unlawful interference in a contract. Or if it requires criminally unlawful act, like threatening physical harm. Seems like the actions of the subscribers of the blacklist fullfill b)II because their interests are different from those of the blacklist. Subscribers interests in in blocking spam, not ham. Spam doesn't usually come from companies that would sue for extortion, like Exactis. CAN-SPAM establishes a definition for what can be considered spam. --Dean -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000

1 0

Re: DNS cache poisoning attacks -- are they real?
by Florian Weimer 27 Mar '05

27 Mar '05

* Brad Knowles: > It only takes a little while to figure out that domains can be > fake-hosted using open caching recursive resolvers. Someone creates > a domain with very small TTLs for the real authoritative servers. > Within the zone, they do lame delegations to a lot of known public > caching recursive servers, with much longer TTLs. > > The lame delegators do what they think is their duty to serve the > data they are requested for, and they are the ones who effectively > serve that data to the world. In fact, the real IP addresses of the > authoritative servers could be changed every five minutes, with the > new policies and procedures in place from NetSol. I doubt this will work on a large scale. At least recent BIND resolvers would discard replies from the abused caching resolvers because they lack the AA bit, so only clients using the resolvers as actual resolvers are affected. You can more easily seed open resolvers, sure, but with a reasonably sized botnet, you can do the same thing with closed ones.

1 0

ICANN on the panix.com theft
by David Lesher 27 Mar '05

27 Mar '05

ICANN Blames Melbourne IT for Panix Domain Hijacking Panix had its domain hijacked over the weekend of January 15-16. Its domain was registered with Dotster, a registrar based in Washington. By January 17, the domain had been restored. Melbourne IT has admitted that it was to blame for the incident as one of its resellers failed to follow the process for seeking authorisation for a domain name transfer request. <http://www.smh.com.au/news/Breaking/ICANN-asked-to-probe-all-transfer-probl…> I used lynx to avoid registration hassles. obdisclaimer: Happy Panix customer... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

3 4