April 2005 - Test - lists.nanog.org

Re: Internet email performance study
by Crist Clark 28 Apr '05

28 Apr '05

Brad Knowles wrote: > At 3:05 PM -0700 2005-04-28, Crist Clark wrote: > >>> http://www.albury.net.au/netstatus/derouted.html >> >> >> No, it doesn't. Please read their paper. In the paper and as he stated >> again in the response above, their definition of a "loss" requires the >> message to be delivered successfully in the first place. The anti-spam >> measure described in the above URL causes the remote MTA to not accept >> mail at all from the blocked source. This would not be counted as a loss >> in their methodology, but possibly as an "error." > > > Yeah, but there are plenty of other places that will otherwise do > the same sort of thing, but instead of de-routing the address, they will > silently discard all messages from that IP address. > > AOL is one known big offender in that area, because I helped set up > the bounce processing system at AOL that did exactly that. > > > So, while albury.net themselves would not cause the kinds of results > that are being seen, they do have an otherwise good explanation for the > kinds of things that many sites tend to do when faced with excessive > probes or other activity that they believe is likely to be an indication > of spam or something that is spam-related. It's possible. Those with very sensitive threasholds that would pick up one email every fifteen minutes as a scan could produce drop rates between zero and one. Assuming the threashold detection is a well defined algorithm, however, one would expect the drops to be deterministic, e.g. after one hour (four sets) of attempts, they fall into black hole, come out after one hour, two hours, eight hours, or a day, and then the whole thing repeats. The authors couldn't find patterns, but that does not mean that there are not any patterns to find. I considered looking at their raw data myself until I saw it was a 100+ MB gzipped tarball. Anyone can test these kinds of theories if they are willing to download and slog through the data. -- Crist J. Clark crist.clark(a)globalstar.com Globalstar Communications (408) 933-4387

1 0

Re: FCC To Require 911 for VoIP
by Fergie (Paul Ferguson) 28 Apr '05

28 Apr '05

That's a good suggestion. :-) There's another article today on Advanced IP Pipleine that openswith the statement: "So far, new FCC chairman Kevin Martin isn't long on solutions -- in fact, he's becoming part of the problem." http://www.advancedippipeline.com/161601652 I prefer to remain nuetral on the topic. ;-) - ferg Owen DeLong <owen(a)delong.com> wrote: Someone should show them some of the 802.11 based "cellular-like" SIP phones and ask them how exactly they plan to get good geolocation data for 911 on those and the soft-phone in my laptop. Who exactly will I be talking to when I dial 911 from an internet cafe in Puerto Vallarta through my Virgina VOIP account with a California Billing address? Owen --On Thursday, April 28, 2005 4:45 PM +0000 "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: > > > A rather important turn of events. > > http://www.newsfactor.com/story.xhtml?story_id=33733 > > - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Internet email performance study
by Robert Beverly 28 Apr '05

28 Apr '05

Hi, (we previously posted this on the e2e mail list; apologies if you are reading it for the second time) We're looking for operational-types lurking on the list with experience running large mail servers. In particular, we have collected a large amount of data as part of an Internet email performance study that we cannot entirely explain. If you can help us or are simply curious about our findings, we'd love to hear from you. WHAT WE DID: Briefly, we used SMTP bounce-backs as the basis of an email active measurement survey. Using random addresses as unique identifiers, we measure latency, loss, paths, etc. to a large set of Internet MTAs. Approximately 1/3 of all servers we surveyed respond with bounce-backs. We've found some interesting results. For example latencies of days (30 days in once instance). WHAT WE DON'T UNDERSTAND: Most servers behave as we expect, either always replying with bounce-backs or never replying. However, some exhibit odd and seemingly non-deterministic behavior. For example, a server will respond to all emails for weeks, and then reply to only a fraction (e.g., 25-75%) of the emails in a seemingly random pattern for some period of time (e.g, 4 hours). Further, we often see these patterns correlated within a domain (e.g., a subset of the MTAs will enter and exist this loss mode at the same time). We are fairly certain that the loss is an artifact of the MTA behavior or local administration. While we can guess reasons this might occur, we have yet to find an administrator who can explain this behavior with an architecture used in practice. More details on the project including our exact methodology, plausible explanations for the loss and a FAQ are available on our web site: http://ana.lcs.mit.edu/emailtester Thanks! Rob Beverly / Mike Afergan

3 4

Fw: Internet email performance study
by aljuhani 28 Apr '05

28 Apr '05

Hi. Sorry there was a mistake in my previous post the subnet listed is 218.0.0.0/8 is not yours. thanks aljuhani ----- Original Message ----- From: "aljuhani" <info(a)riyadmail.com> To: <nanog(a)nanog.org> Sent: Friday, April 29, 2005 00:53 Subject: Re: Internet email performance study > On Thu, Apr 28, 2005 at 23:42, Robert Beverly" <rbeverly(a)rbeverly.net> > > ......snip > > Yes, our SMTP greetings are valid and up to spec. Again, it's the > > non-deterministic loss that we're most concerned about. If there > > were a problem with the SMTP exchange, we would see our emails > > always rejected (for instance). Our measurement study only includes > > emails that were successfully delivered (indicated by a complete > > series of successful status codes returned during SMTP exchange). > > > > Many thanks, > > > > rob > > Hi, > > Perhaps this explains it. > > http://www.albury.net.au/netstatus/derouted.html > > BTW your subnet (18.0.0.0/8) is listed there as well. > > Regards, > > aljuhani

1 0

Re: BT to offer six classes of service
by Fergie (Paul Ferguson) 28 Apr '05

28 Apr '05

Additionally: BT picks partners for network upgrade http://news.com.com/BT+picks+partners+for+21st+Century+Network/2100-1037_3-… - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: It will be interesting to see how this develops. BT to offer six classes of service http://www.techworld.com/networking/news/index.cfm?newsid=3574 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

BT to offer six classes of service
by Fergie (Paul Ferguson) 28 Apr '05

28 Apr '05

It will be interesting to see how this develops. BT to offer six classes of service http://www.techworld.com/networking/news/index.cfm?newsid=3574 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

using TCP53 for DNS
by Patrick W. Gilmore 28 Apr '05

28 Apr '05

In the thread about ns*.worldnic.com, many people were complaining about DNS responses/queries on TCP port 53. At least one DoS mitigation box uses TCP53 to "protect" name servers. Personally I thought this was a pretty slick trick, but it appears to have caused a lot of problems. From the thread (certainly not a scientific sampling), many people seem to be filtering port 53 TCP to their name servers. Is this common? Does anyone have stats on this (roots, GTLDs, other big name server farms)? Perhaps people could send what they do personally and I can summarize for this list. (Again, not a scientific sampling method, but better than trying to read into what people imply in a long, and probably not-well-read thread.) -- TTFN, patrick P.S. Sorry to post operational content, I know how everyone hates that. =)

5 9

The "not long discussion" thread....
by Jerry Pasker 27 Apr '05

27 Apr '05

I posted to NANOG: >Jerry Pasker <info(a)n-connect.net> wrote: > > >> fine. (after a few tries) I'm using BIND 9.2.4 without the eye pee >> vee six stuff compiled in. Because I don't want to start something; >> No discussion about me blocking port 53, ok? I got tired of gobs of >> log files of script kiddies trying to download my domains 5 years >> ago... Steve Sobol replied with: >I'm not going to enter into a long discussion with you. :) > >I'm just curious why you didn't restrict AXFR to certain IPs instead. And I'm posting back to NANOG: I did. And I had router ACLs doing the same thing. Allow to hosts that needed it, deny for everyone else. And I did this to ALL my DNS servers. I was getting DoSed one day, somewhere in the whereabouts of about 2001, and put in the ACLs, immediately expecting it to break things. (truncated responses needing TCP and/or other things that I didn't foresee). Much to my dismay, it broke nothing. Despite me looking for problems, and asking and pleading my techies to find trouble tickets related to this issue, it didn't happen. I revisited the issue periodically. Every time there was an unexplained DNS issue, I would think "it must be the port 53 block!" but alas, I was disappointed each and every time. I've removed and added the ACLs countless times over the years trouble shooting various DNS issues, but this is the first time that removing them actually solved anything. See, I *WANTED* there to be a problem in blocking port 53, I *BELIEVED* all the talk that it would cause problems, but that problem never showed up. Over the years, eventually I just slowly arrived at the conclusion that all the talk were from people who talked, not from people who were brave enough to try it in a production environment. 4 years later, I was proved "inconclusive": Blocking port 53 does break things to servers that are already (apparently?) broken. -Jerry

3 4

Re: Detecting VoIP traffic in ISP network
by Joe Shen 27 Apr '05

27 Apr '05

No, it's not for legislation. In fact, we're planning to collect information on how people use internet as Voice carrier and the Voice communication quality they got. By this way, it could be evaluated that what's the possible best way of resource provisioning & how NGN voice traffic should be carried at the best performance/cost rate. joe --- Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > Local telco concerned about voip eating into their > revenues, and wants > to push through legislation or something? :) > > On 4/27/05, Joe Shen <joe_hznm(a)yahoo.com.sg> wrote: > > > > we want to collect statistics in our backbone > > networks. > > > > Is there any good method to this? is there any > product > > for this ? > > > > Joe > > > > > _________________________________________________________ > > Do You Yahoo!? > > ÏÓÓÊÏäÌ«Ð¡£¿ÑÅ»¢µçÓÊ×ÔÖúÀ©ÈÝ£¡ > > > http://cn.rd.yahoo.com/mail_cn/tag/10m/*http://cn.mail.yahoo.com/event/10m.… > > > > > -- > Suresh Ramasubramanian (ops.lists(a)gmail.com) > __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

1 0

Re: Schneier: ISPs should bear security burden
by Bill Stewart 27 Apr '05

27 Apr '05

On 4/27/05, Owen DeLong <owen(a)delong.com> wrote: > I was referring to the article which contained the schneier quote, not > schneier. The article was written by someone at least pretending to be > a journalist, and, was put out as news, not editorial or advertising. > > As such, it should be held to the standard that should apply to news. > Instead, it was yet another example of advertising disguised as news. The standards of technology journalism involve writing about many different things you don't know much about, and sometimes a few that you do, and getting lots of press releases that were written by PR people who might or might not understand what the companies they're writing for are making, and trying to make it interesting enough that you sell enough advertising while meeting your deadlines. Often it gets better than this, and some journalists are really good, but often it doesn't, and sometimes they're doing well to spell the names right and pick the most relevant couple of sentences to quote. The standards for non-technology journalism are pretty similar - the big differences are that in fields you know something about, you're able to recognize bad fact-checking and lack of insight, and you might know some of the important things that got left out, whereas in non-technical journalism, such as political reporting, you might not know enough about what really occurred or who the people are who are getting quoted/interviewed to recognize bad fact-checking or differentiate between organized propaganda campaigns and naive me-too reporting. So be liberal in what you accept, and conservative in what parts of it you actually believe, and try to differentiate between people who have strong opinions vs people who are just being self-serving. I thought the VNUnet article was reasonable for something that short - it hit a couple of issues, and quoted at least one other person who had a somewhat different perspective. On the other hand, most of the other news articles reported on Schneier's criticism of the overuse of terms like "cyber-terrorism" by self-promoting or agency-agenda-promoting people. ---- Thanks; Bill Note that this isn't my regular email account - It's still experimental so far. And Google probably logs and indexes everything you send it.

1 0