October 2007 - Test - lists.nanog.org

Any help for Yahoo! Mail arrogance?
by Tuc at T-B-O-H.NET 30 Oct '07

30 Oct '07

Background: We MX for a domain, and turn it right around to Yahoo! Mail. I know others have run into this before. Because a fair amount of it is spam, Yahoo stops accepting the mail, yadda yadda yadda. Problem: I jumped through all the hoops, and they tell me I'm denied. When I ask what part I fail on, I get : "Unfortunately, we cannot provide you with specific information other than to suggest a review of the questionnaire we supplied and try to determine where your mailing practices may be improved upon." WTF is that all about?! How can I improve on getting an email, spam filtering the best I can, and turning it around to it intended recipient. Anyone have any clues? Thanks, Tuc

8 12

Re: What can you use DSCP for?
by BELLEVILLE Ray 30 Oct '07

30 Oct '07

Triple play Solutions use DSCP all over the place. Lots of differenciated services, especially when subscriber management comes into play. Triple play is turning into 4 and 5xplay, then add the varying degrees of service and bundles available across the different services, and different requirements between the different data services (vodn internet, content storage, backup, sharing). Very useful tool. ----- Original Message ----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: John Kristoff <jtk(a)ultradns.net> Cc: nanog(a)merit.edu <nanog(a)merit.edu> Sent: Tue Oct 30 07:04:52 2007 Subject: What can you use DSCP for? On Mon, 29 Oct 2007, John Kristoff wrote: > How much has really changed? Do you (or if someone on these big nets > wants to own up offlist) have pointers to indicate that deployment is > significantly different now than they were a couple years ago? Even > better, perhaps someone can do a preso at a future meeting on their > recent deployment experience? I did one a couple years and I haven't > heard of things improving markedly since then, but then I am still > recovering from having drunk from that jug of kool-aid. :-) Once you get past the religious debates, DSCP can be very useful to large, complicated networks with many entry and exit points. Think about how large networks use tools such as BGP Communities to manage routing policies across many different types of interconnections. You may want to consider how networks use similar tools such as DSCP to mark packets entering networks from internal, external, source address validated, management, etc interfaces. There are limited code-points so you can't be too clever, but even knowing on the other side of then network that a packet entered the network through a spoofable/non-spoofable network interface may be very useful.

1 0

Re: Dynamically Changing Exit Policy (iBGP)
by Benjamin Howell 30 Oct '07

30 Oct '07

On Mon, Oct 29, 2007 at 04:53:50PM -0400, Deepak Jain wrote: > You can "nail" down your announcements to external peers by tying their > network blocks to a route-of-last resort on one of your loopbacks. This > will prevent flapping externally. Point taken, but it's actually difficult to nail down all of our routes. We have some lone /24's that are not subnetted and thus cannot be used with an 'ip route ... null0' statement. When WAN connectivity drops, the routes flap if we don't have a stable iBGP session. Thus I'd like to steer well clear of severing the iBGP session. > The weights can be added/removed automatically by using a route-map on > the routes that will be added/removed by the interface going down. Only a single internal /30 route will be removed when an interface goes down. I can't come up with a route-map implementation that would add/remove the weights to the routes already received from our eBGP neighbors. If I'm missing something, please let me know. > Normally, however, you wouldn't use iBGP for this and you'd use a > heavier, link-aware internal routing protocol like ISIS or OSPF. We use OSPF internally, but it just carries internal infrastructure addresses. I understand that OSPF is link-aware and can carry knowledge of link bandwidth, but I don't see how it would fit into our exit path policies. We accept full routes from our eBGP neighbors and it's not advisable to inject those into OSPF. Our normal policy must be best-exit, which leaves iBGP as the decision-maker unless I'm missing something. Is there a better IGP-based method of choosing a network exit path that would solve these problems? I ask because I'm curious, not because I know the answer. -- Ben Howell > Benjamin Howell wrote: > >Is there a generally accepted method of automatically altering exit > >policies within an AS? > > > >I'd like to dynamically change from best-exit to a "hot potato" exit > >policy when an internal DS3 fails. We fail over to a much lower > >bandwidth link and would like to avoid sending anything but internal > >traffic over that link. If it's not already clear, this change needs to > >happen automatically. > > > >I realize that there are two means of accomplishing this: > > > >(1) Set a weight on all routes received from the eBGP peer at each > > location so that it prefers the direct eBGP peer. > >(2) Sever the iBGP session by tying the iBGP session to an interface > > IP address rather than a loopback IP. When the DS3 goes down, so > > will the knowledge of the remote exit point. > > > >The devil's in the details however. I can't figure out how to make the > >weight approach work on routes that were received prior to the circuit > >failure or how to remove the weights once the circuit comes back up. > > > >Severing the iBGP session seems drastic to me, and I'm worried that our > >advertised routes will be dampened by peers if the internal DS3 starts > >flapping. > > > >Any input from wiser peers would be greatly appreciated. > > > >-- > >Ben Howell

3 3

Can P2P applications learn to play fair on networks?
by Sean Donelan 30 Oct '07

30 Oct '07

Much of the same content is available through NNTP, HTTP and P2P. The content part gets a lot of attention and outrage, but network engineers seem to be responding to something else. If its not the content, why are network engineers at many university networks, enterprise networks, public networks concerned about the impact particular P2P protocols have on network operations? If it was just a single network, maybe they are evil. But when many different networks all start responding, then maybe something else is the problem. The traditional assumption is that all end hosts and applications cooperate and fairly share network resources. NNTP is usually considered a very well-behaved network protocol. Big bandwidth, but sharing network resources. HTTP is a little less behaved, but still roughly seems to share network resources equally with other users. P2P applications seem to be extremely disruptive to other users of shared networks, and causes problems for other "polite" network applications. While it may seem trivial from an academic perspective to do some things, for network engineers the tools are much more limited. User/programmer/etc education doesn't seem to work well. Unless the network enforces a behavor, the rules are often ignored. End users generally can't change how their applications work today even if they wanted too. Putting something in-line across a national/international backbone is extremely difficult. Besides network engineers don't like additional in-line devices, no matter how much the sales people claim its fail-safe. Sampling is easier than monitoring a full network feed. Using netflow sampling or even a SPAN port sampling is good enough to detect major issues. For the same reason, asymetric sampling is easier than requiring symetric (or synchronized) sampling. But it also means there will be a limit on the information available to make good and bad decisions. Out-of-band detection limits what controls network engineers can implement on the traffic. USENET has a long history of generating third-party cancel messages. IPS systems and even "passive" taps have long used third-party packets to respond to traffic. DNS servers been used to re-direct subscribers to walled gardens. If applications responded to ICMP Source Quench or other administrative network messages that may be better; but they don't.

18 44

Dynamically Changing Exit Policy (iBGP)
by Benjamin Howell 29 Oct '07

29 Oct '07

Is there a generally accepted method of automatically altering exit policies within an AS? I'd like to dynamically change from best-exit to a "hot potato" exit policy when an internal DS3 fails. We fail over to a much lower bandwidth link and would like to avoid sending anything but internal traffic over that link. If it's not already clear, this change needs to happen automatically. I realize that there are two means of accomplishing this: (1) Set a weight on all routes received from the eBGP peer at each location so that it prefers the direct eBGP peer. (2) Sever the iBGP session by tying the iBGP session to an interface IP address rather than a loopback IP. When the DS3 goes down, so will the knowledge of the remote exit point. The devil's in the details however. I can't figure out how to make the weight approach work on routes that were received prior to the circuit failure or how to remove the weights once the circuit comes back up. Severing the iBGP session seems drastic to me, and I'm worried that our advertised routes will be dampened by peers if the internal DS3 starts flapping. Any input from wiser peers would be greatly appreciated. -- Ben Howell

1 0

Re: Can P2P applications learn to play fair on networks?
by Sean Donelan 29 Oct '07

29 Oct '07

On Sat, 27 Oct 2007, Mohacsi Janos wrote: > Agreed. Measures, like NAT, spoofing based accelerators, quarantining > computers are developed for fairly small networks. No for 1Gbps and above and > 20+ sites/customers. "small" is a relative term. Hong Kong is already selling 1Gbps access links to residential customers, and once upon a time 56Kbps was a big backbone network. Last month folks were complaining about ISPs letting everything through the networks, this month people are complaining that ISPs aren't letting everything through the networks. Does this mean next month we will be back the other direction again. Why artificially keep access link speeds low just to prevent upstream network congestion? Why can't you have big access links?

7 12

114/8 and 115/8 allocated to APNIC
by Leo Vegoda 29 Oct '07

29 Oct '07

Hi, The IANA IPv4 registry has been updated to reflect the allocation of two /8 IPv4 blocks to APNIC in October 2007: 144/8 and 115/8. You can find the IANA IPv4 registry at: http://www.iana.org/assignments/ipv4-address-space Please update your filters as appropriate. Regards, Leo vegoda Manager, Number Resources - IANA

1 1

IPv6 firewall support
by michael.dillon＠bt.com 29 Oct '07

29 Oct '07

Some people have claimed that they cannot yet sell IPv6 Internet access because there is no IPv6 firewall support. According to this ICANN study: http://www.icann.org/committees/security/sac021.pdf this is not quite true. At least 30% of the 42 vendors surveyed, had IPv6 support. According to this talk <http://www.guug.de/veranstaltungen/ecai6-2007/slides/2007-ECA-I6-Status -IPv6-Firewalling-PeterBieringer-Talk.pdf> many open-source and commercial firewalls supporting IPv6 are available. IPCop is based on Linux <http://www.ipcop.org/index.php?module=pnWikka&tag=IPCopScreenshots> m0n0wall is based on FreeBSD <http://m0n0.ch/wall/screenshots.php> pfSense is also based on FreeBSD <http://pfsense.com/index.php?id=26> FWBuilder is a management tool that builds filter setups for several different firewalls. <http://www.fwbuilder.org/archives/cat_screenshots.html> Checkpoint FW1 NGX R65 on SecurePlatform supports IPv6 FortiGate supports IPv6 in FortiOS 3.0 and up. Juniper SSG (formerly Netscreen) supports IPv6 in ScreenOS 6.0 and up. Cisco ASA (formerly PIX) supports IPv6 in version 7.0 and up. I suspect that the people complaining about IPv6 support are partially complaining because they have older hardware that the vendor does not plan to upgrade to IPv6 support until they have all features implemented in their newer products, and partially complaining because their vendor has not implemented some feature which they happen to use. Commercial firewall support may be lagging behind OS and router support, but not by much. And if commercial vendors are not responsive, maybe you should try pricing out an open source solution with a consultant. I believe there is a gap here that startup firewall companies could fill if they understand the enterprise market. --Michael Dillon

9 9

Comcast Contact
by Gary Stanley 27 Oct '07

27 Oct '07

Can someone clueful from comcast.net contact me offlist please? Thank you. -G

1 0

OT: Vendors Using NANOG for a Sales Channel
by Scott Weeks 27 Oct '07

27 Oct '07

--- davidu(a)everydns.net wrote: From: David Ulevitch <davidu(a)everydns.net> Often times when I get these (and it's pretty often) I just take their email address and add it to my list of people we send out RFQs to. The worst thing that happens is that they come back with a good price, good service and boom, I've found a new vendor. ------------------------------------------ I would suggest that no one should buy from vendors who get email addresses from NANOG or other technical mailing lists. It will only encourage them to do it more and ruin the value of the mailing list in question. You obviously haven't had the experiences that some have had with sales folks that use this method. Some are like the little Chihuahua that won't quit trying to hump your leg. No matter how many times you tell them you're not going to "do it" they keep trying. However, the company in this case did redeem themselves and I respect a company like that. scott

7 6