January 2008 - Test - lists.nanog.org

Re: ISPs slowing P2P traffic...
by David E. Smith 14 Jan '08

14 Jan '08

>It may. Some of those other things will, too. I picked 1) and 2) as >examples where things could actually get busy for long stretches of >time. The wireless ISP business is a bit of a special case in this regard, where P2P traffic is especially nasty. If I have ten customers uploading to a Web site (some photo sharing site, or Web-based email, say), each of whom is maxing out their connection, that's not a problem. If I have one customer running Limewire or Kazaa or whatever P2P software all the cool kids are running these days, even if he's rate-limited himself to half his connection's maximum upload speec, that often IS a problem. It's not the bandwidth, it's the number of packets being sent out. One customer, talking to twenty or fifty remote hosts at a time, can "kill" a wireless access point in some instances. All those little tiny packets tie up the AP's radio time, and the other nine customers call and complain. One customer just downloading stuff, disabling all the upload features in their P2P client of choice, often causes exactly the same problem, as the kids tend to queue up 17 CDs worth of music then leave it running for a week. The software tries its darnedest to find each of those hundreds of different files, downloading little pieces of each of 'em from multiple servers. We go out of our way to explain to every customer that P2P software isn't permitted on our network, and when we see it, we shut the customer off until that software is removed. It's not ideal, but given the limitations of wireless technology, it's a necessary compromise. I still have a job, so we must have a few customers who are alright with this limitation on their broadband service. There's more to bandwidth than just bandwidth. David Smith MVN.net

7 7

Re: Stupid Question: Network Abuse RFC?
by Paul Ferguson 14 Jan '08

14 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Randy Bush <randy(a)psg.com> wrote: >2142 > >but i am surprised you asked here instead of an ietf list. here we actually do the stuff, not tell other folk how they should do it. :) > Thanks for the pointer, and I even appreciate you snarky reply. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHiaT9q1pz9mNUZTMRAsUwAKDfzxtwp/OLvLgl+xnO1lmMV7bcjACgzpAz bDJjr/2v8tbWJep9AIAfxkk= =Puaa -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

6 5

Looking glass or web-tracerouter within Chinanet/AS4134 needed
by Gunther Stammwitz 14 Jan '08

14 Jan '08

Hello colleagues, I'm trying to optimize the latency & packet loss between CHINANET (AS4134) and our network. The outgoing traffic to china is fine now but I have no idea how they are routing towards us. This is why I'm looking for some sort of looking glass, route server or webtracerouter within AS4134. Any where to find one? Thanks, Gunther

1 0

Re: Stupid Question: Network Abuse RFC?
by Paul Ferguson 14 Jan '08

14 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Sean Donelan <sean(a)donelan.com> wrote: >MAAWG is useful for particular subjects, not as useful for other subjects. >I expect the same will be true for any forum. > What is the appropriate mechanism within NANOG? I mean, given previous topics covered in the NANOG security BoFs, it would appear that a lot of attention has been given to statistical analysis of DDoS flows traffic, securing infrastructure, etc. -- all of which are honorable & desired goals. But what about involvement of incident reporting (and responding?), that is inclusive of the Internet community at-large? NSP-Sec is clearly a "closed" community which excludes many of the organizations who could actually help contribute intelligence, work with law enforcement, and make a positive difference. My opinion is that the ISP community, by and large, tend to say that they are dealing with the situation, and are willing to address these issue, yet in reality they tend to minimize the issues and sweep it under the rug because it is not in their financial interests to enagage them, or it doesn't jive with their "existing processes". So I ask you, how do we address this situation? Instead of being an apologist for the problem, how would _you_ suggest we address these process, procedural, and organizational issues? I consider this to be way beyond the boiling point, and an issue that we all need to address -- and engage. Thanks, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHisZWq1pz9mNUZTMRAgahAJ9TxYI3q9FS+KlQvCLytVNqlEaHKQCg5Xev MzJItZoHM8rbUs3UbBewA2w= =SyBg -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

IP/MPLS Circuit Provisioning Software
by Gregory Urban 13 Jan '08

13 Jan '08

Currently, our network uses ATM to provide approximately 1200 virtual circuits to our subscriber base. We use the ATM switch manufacturer's management software (Marconi Service On Data) to manage both the ATM switches and all of the virtual circuits (mostly SVCs) we have provisioned. We are in the process of migrating off of ATM and provisioning these services as MPLS circuits (mostly pseudo-wire). But we need a tool to replace Service On Data, as configuring 1200 circuits manually on each router/switch isn't going to cut it. The network is primarily Juniper Routers at the core and Cisco 3750 Metro switches at the edge. Does anyone have any experience with a provisioning tool that can build MPLS circuits in a multi-vendor network? We're evaluating Dorado Red Cell, but I'm not sold on it yet. TIA. Gregory Urban Director, networkMaryland www.networkMaryland.gov <http://www.networkmaryland.gov/>

1 0

[Fwd: Unstable BGP Peerings?]
by Sue Joiner 13 Jan '08

13 Jan '08

Forwarding for Mohit Lad and Jonathan Park. -sue Sue Joiner Merit Network -------- Original Message -------- Subject: Unstable BGP Peerings? Date: Sun, 13 Jan 2008 17:49:44 +0000 From: ParkJonathan <j13park(a)hotmail.com> To: <nanog(a)merit.edu> CC: <smj(a)merit.edu>, <mohit(a)cs.ucla.edu> During our recent study on BGP routing instability, we found cases where lots of routes changed from one subpath to another subpath, repeating this kind of behavior over a few months . We do not know the cause of this repeated instability, but suspect the BGP peering between routers in two AS was unstable or had some problems and this caused routing changes seen by many observation points. Specifically, the peerings in question are 174 (Cogent) and 9121 (TTNet) 3257 (Tiscali) and 9121 (TTNet) 9304 (Hutchison) and 15412 (Flag Telecom) 1273 (Cable&Wireless) 4651 (Thai Gateway) 6762 (Seabone) and 7473 (Singapore Telecom) For details of events and timings, please find a short summary on the link below. http://irl.cs.ucla.edu/pca/active-links.html We would really appreciate if somebody from the ISPs involved in this activity (or anybody who might know what happened) would contact us and throw some light on the reasons for this behavior. Thanks Mohit Lad, Jonathan Park UCLA ------------------------------------------------------------------------ e벗 사귀기, 쪽지 보내기, 가젯 즐기기를 통해 전세계 친구들을 만나세요! 나 의 글로벌 인맥, Windows Live Space! <http://www.spaces.live.com >

1 0

Re[2]: Stupid Question: Network Abuse RFC?
by Paul Ferguson 13 Jan '08

13 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Randy Bush <randy(a)psg.com> wrote: >2142 > >but i am surprised you asked here instead of an ietf list. here we actually do the stuff, not tell other folk how they should do it. :) > Be careful when you say "we". Evidence points to the contrary. Thanks! - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHiaVlq1pz9mNUZTMRAilIAJ0SKnZXIDzCrpI96/oesndnuBYV/wCdH74g Fxjq6EveeEy92dIbniR0Qr4= =D+wu -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Stupid Question: Network Abuse RFC?
by Paul Ferguson 13 Jan '08

13 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I searched the RFC Editor archives for a few keywords to find what I was looking for, but apparently I'm brain-damaged at the moment. Can someone please point me to the RFC for network abuse reporting? Thanks! - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHiZ4kq1pz9mNUZTMRAur/AKDs5ltmLBuZqR4BxC8Tr89M7w0gswCePInw fdvfWNaeD0F6qy7jmVmEaVs= =+rGs -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Q: What do ISPs really think about security issues?
by Paul Ferguson 12 Jan '08

12 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 As some of you may know, my primary job these days is tracking down Bad Guys (tm), identifying threats, etc. But enough of that. One of my primary concerns has been, unsuccessfully, engaging the networking community. Why is that? This "issue" is not imagined, nor is it a scare tactic -- it has, for lack of a better analogy, grown in proportions only proportional to the lack of engagement from ISPs. ISPs have really, really been absent from the discussion, for various reasons. Is this a topic that the NANOG community would like to discuss in a serious manner? I'm just curious, because I'm considering submitting a "lightning talk" at the upcoming San Jose NANOG, just to gauge & present some of the major issues that we are seeing that could really use your assistance. Any input? - - ferg p.s. Oh, highly recommended video short (bigger bonus: Marcus Ranum cameo): http://www.youtube.com/watch?v=-5zxOLZ5jXM -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHheNKq1pz9mNUZTMRArb7AJ0ePkj+8rc88Z9V/3DP5OmnFvgdYgCeKSIa aqw3Qj3Kdl47LZqpjrdk/0E= =Iray -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

9 14

fyi: Supporting the Visualization and Analysis of Network Events
by ' =JeffH ' 11 Jan '08

11 Jan '08

of possible interest... =JeffH ------- Forwarded Message Date: Wed, 09 Jan 2008 16:41:56 -0800 To: pcd-seminar(a)lists.stanford.edu, colloq(a)cs.stanford.edu From: Terry Winograd <winograd(a)cs.stanford.edu> Subject: PCD 1/11/08 - Doantam Phan, Stanford HCI, Supporting the Visualization and Analysis of Network Events Mime-Version: 1.0 Cc: drussell(a)google.com ************************************************************* Stanford Seminar on People, Computers, and Design (CS547) see http://hci.stanford.edu/seminar for the quarter's schedule Gates B01 (NEC Classroom) and SITN, 12:30-2:00pm PDT (UTC 19:30) Video: http://scpd.stanford.edu/scpd/students/courseList.asp CS547 ************************************************************* Friday, January 11, 2008 Doantam Phan, Stanford HCI http://graphics.stanford.edu/~dphan/ Supporting the Visualization and Analysis of Network Events The flow of traffic among computers on the Internet and the exchange of goods between countries are examples of causally connected measurable events in a network. Understanding the behavior of such networks often requires the ability to discover temporal connections among the events in a large data set. One challenge is that the volume of data makes it difficult to explore the data and organize the events into a narrative sequence. This dissertation contributes new interactive visualization techniques for analyzing, organizing, and presenting network event data at multiple levels of detail for the purpose of forensic analysis - tracking down causal sequences of importance. The first contribution is a technique that supports event analysis, called progressive multiples. Our techniques are instantiated in a system for network incident investigation, Isis, which we validated with a long-term collaboration and deployment with the principal network analyst of the EE and CS departments. The second contribution is a technique for automatically generating flow maps, which present summaries of network topology and behavior at a higher level than event plots and timelines. Our technique has been adopted by a diverse group of users to depict the flow of computer networks, documents, and international ecological trade. ************************************************************** Doantam Phan has recently completed his Ph.D. in Computer Science at Stanford University. He studies Human-Computer Interaction, and was advised by Terry Winograd. ************************************************************** NEXT WEEK: January 18, 2008 -Dan Russell , Google How good Google searchers get to be that way http://hci.stanford.edu/seminar/abstracts/07-08/080118-russell.html ************************************************************** The mailing list for these seminar announcements is pcd-seminar(a)lists.stanford.edu, which is managed by an automated server. To subscribe or unsubscribe, go to http://mailman.stanford.edu/mailman/listinfo/pcd-seminar - --*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* pcd-seminar mailing list pcd-seminar(a)lists.stanford.edu https://mailman.stanford.edu/mailman/listinfo/pcd-seminar ------- End of Forwarded Message

1 0