January 2008 - Test - lists.nanog.org

RE: Level 3 (3356) issues?
by David Hubbard 15 Jan '08

15 Jan '08

Looks like this was localized to Tampa. I've received emails from two other people connected through Tampa, like us, who were having the same issues. I finally got TCAM on the phone after about an hour. They have a master ticket for a failure of "three DLM modules" lasting 47 minutes but it is showing believed to be resolved via reset but they have not yet diagnosed the cause. David > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of David Hubbard > Sent: Tuesday, January 15, 2008 11:45 AM > To: nanog(a)merit.edu > Subject: Level 3 (3356) issues? > > > Just curious if anyone is seeing issues with Level 3 > right now? Our session is still up but we can't > see any outside routes through them currently. I'm > guessing by the fact that I've been on hold for 25 > minutes that I'm not the only one having an issue with > them but wanted to double check. > > Thanks, > > David > >

1 0

Level 3 (3356) issues?
by David Hubbard 15 Jan '08

15 Jan '08

Just curious if anyone is seeing issues with Level 3 right now? Our session is still up but we can't see any outside routes through them currently. I'm guessing by the fact that I've been on hold for 25 minutes that I'm not the only one having an issue with them but wanted to double check. Thanks, David

4 3

RE: Looking for geo-directional DNS service
by Hank Nussbacher 15 Jan '08

15 Jan '08

On Tue, 15 Jan 2008, Eric Frazier wrote: Proximity checking is very important and I have run into cases as you have where it is needed. Even taking your example of a location in Toronto, peering arrangements would cause not all Toronto ISPs to act the same and therefore RTT could vary not just by 15ms but sometimes by 150ms. Now imagine I have a data center in Tokyo. Do I send all users from Hong Kong, Singapore, Korea, Taiwan and Australia to that data center in Tokyo or perhaps some would do better going to my data center in LA? In regards to the Neustar staticly defined IPs - I was only able to uncover that after digging. Thanks for the Netriplex lead. I like Neustar for their bullet proof DNS but not so much for their directional DNS service. -Hank > Hi Hank, > > I am curious, what makes proximity checking so important? I am also curious > about how you learned that UltraDNS uses a static list, even if it is a > 'static' list it is updated frequently and likely only contains the kinds of > errors that don't really affect you unless you have quite a few more than 4 > locations. For example, if your locations in north america are Toronto, > Seattle and DC, it doesn't matter too much if an IP in Atlanta is 90ms to DC > AND 75ms to Toronto, but it would matter if you had three other data centers > in the south to make that fine grained matching more worthwhile. > > I know with Quova one of the first things I asked them about was the case of > our own office IP which in their db returns Toronto and it kind of pissed me > off that they couldn't see that the round trip time clearly showed this IP > could not really be in Toronto, if you picked a few dozen known to 100% > IP/locations and tested latency from those you could get a pretty good fudge > factor to correct data or at least show it as being suspect. > > Anyway, I have used UltraDNS in the past, there is also a company called > Netriplex that is a newcomer in comparison, but their pricing is a lot > better, not too cheap, not as expensive. They don't have as good as a > network as UltraDNS either. > > > > > Eric Frazier > Senior Architect > 216 Main Street, Suite 312 > Bathurst, NB, E2A 1A8 > Canada > Phone : +1 506 546 8292 > Fax : +1 506 546 8092 > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Hank > Nussbacher > Sent: Tuesday, January 15, 2008 7:21 AM > To: jamie.baddeley(a)fx.net.nz > Cc: nanog(a)merit.edu > Subject: Re: Looking for geo-directional DNS service > > > At 12:14 AM 16-01-08 +1300, jamie baddeley wrote: > > Yes, but that would require them to run a DNS server at each of their 4 > locations. They do not want to run their own DNS. They want it outsourced. > > Thanks, > -Hank > >> Thought about anycasting? Broad as a barn door, but if you add health >> checking of the services and integrate that into what your DC router >> announces you get closer to what you want. >> >> jamie >> >> On Tue, 2008-01-15 at 12:55 +0200, Hank Nussbacher wrote: >>> I am looking for a commercial DNS service that provides >>> geo-directionality. Suppose I have 4 data centers scattered thruout >>> the world and want users to hit the closest data center based on >>> proximity checks (pings, TTLs, latency, load, etc.). I know one can >>> "roll their own", using various geo-locational data from companies >>> like Maxmind. I am >>> *not* interested in that. I am *not* interested in applicances like >>> the Cisco ACE GSS 4400 either (that do this as well): >>> http://www.cisco.com/en/US/products/hw/contnetw/ps4162/ >>> >>> What I am looking for is a commercial DNS service. >>> >>> Is the Akamai Edgescape service the closest to what I want: >>> http://www.akamai.com/html/technology/products/edgescape.html >>> Is anyone using it? Can you recommend it? >>> >>> Another service I know about is the Ultradns (now Neustar) Directional > DNS: >>> http://www.neustarultraservices.biz/solutions/directionaldns.html >>> But this service is based on statically defined IP responses at each >>> of their 14 sites so there is no proximity checking done. >>> >>> Thanks, >>> Hank >>> >

1 0

Re: Looking for geo-directional DNS service
by Hank Nussbacher 15 Jan '08

15 Jan '08

At 12:14 AM 16-01-08 +1300, jamie baddeley wrote: Yes, but that would require them to run a DNS server at each of their 4 locations. They do not want to run their own DNS. They want it outsourced. Thanks, -Hank >Thought about anycasting? Broad as a barn door, but if you add health >checking of the services and integrate that into what your DC router >announces you get closer to what you want. > >jamie > >On Tue, 2008-01-15 at 12:55 +0200, Hank Nussbacher wrote: > > I am looking for a commercial DNS service that provides > > geo-directionality. Suppose I have 4 data centers scattered thruout the > > world and want users to hit the closest data center based on proximity > > checks (pings, TTLs, latency, load, etc.). I know one can "roll their > > own", using various geo-locational data from companies like Maxmind. I am > > *not* interested in that. I am *not* interested in applicances like the > > Cisco ACE GSS 4400 either (that do this as well): > > http://www.cisco.com/en/US/products/hw/contnetw/ps4162/ > > > > What I am looking for is a commercial DNS service. > > > > Is the Akamai Edgescape service the closest to what I want: > > http://www.akamai.com/html/technology/products/edgescape.html > > Is anyone using it? Can you recommend it? > > > > Another service I know about is the Ultradns (now Neustar) Directional DNS: > > http://www.neustarultraservices.biz/solutions/directionaldns.html > > But this service is based on statically defined IP responses at each of > > their 14 sites so there is no proximity checking done. > > > > Thanks, > > Hank > >

1 0

ipflow/netflow appliance
by Stefan Hegger 15 Jan '08

15 Jan '08

Hi, thanks for all your answers it helped a lot, we will do a test with nProbe. Best Stefan -- Stefan Hegger Internet System Engineer Lycos Europe GmbH Carl-Bertelsmann Str. 29 Postfach 315 33312 Gütersloh Phone: Tel: +49 5241 8071 334 Fax: +49 5241 80671 334 Mobile: +49 170 1892720 Sitz der Gesellschaft: Gütersloh Amtsgericht Gütersloh, HRB 2157 Geschäftsführer: Christoph Mohn <http://www.lycos-europe.com/L/A/>

1 0

Anyone with clue at GBLX / AS3549 -- long duration fiber cut
by John van Oppen 15 Jan '08

15 Jan '08

Anyone have any detail on the apparent GBLX fiber cut between Seattle and northern California? The outage has been ongoing since mid-morning. Thanks, John van Oppen Spectrum Networks LLC 206.973.8302 (Direct) 206.973.8300 (main office)

2 1

Re: Asymmetrical routing opinions/debate
by Paul Ferguson 14 Jan '08

14 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Bill Stewart" <nonobvious(a)gmail.com> wrote: > >Essentially, if you don't control all the parts of the network that >your packet uses, you're not able to directly set optimization >parameters, so what you're doing to get symmetry is throwing lots of >hints at the network and hoping some will stick, and the parts of the >network that happen to cooperate with you may not be the best ones >that are otherwise available. > I wish I could remember who to attribute this quote (maybe Geoff Huston?), but paraphrasing: "Asymmetric end-to-end traffic paths in The Internet is a fact of life. Get over it." :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHjBWeq1pz9mNUZTMRAkW4AKCiIBfZtNamFrfrUY3ymOIhQcLr+ACeIVXP 7x/pIYWX1tqdicfaeFSOQzM= =LQxO -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Asymmetrical routing opinions/debate
by Drew Weaver 14 Jan '08

14 Jan '08

Pardon me if I am using the wrong term, I am using the term Asymmetrical routing to describe a scenario in which a request packet enters a network via one path and the response packet exits the network via a different path. For example an ICMP ping request enters a network via ISP A and the reply leaves via ISP B (due to multi-homing on both networks, and or some kind of manual or automatic 'tweaking' of route preferences on one end or the other). I haven't noticed too many instances of this causing huge performance problems, but I have noticed some, has anyone noticed any instances in the real world where this has actually caused performance gains over symmetrical routing? Also in a multi-homed environment is there any way to automatically limit or control the amount of Asymmetrical routing which takes place? (should you?) I have read a few papers [what few I could find] and they are conflicted about whether or not it is a real problem for performance of applications although I cannot see how it wouldn't be. Has there been any real community consensus on this issue published that I may have overlooked? Thank you, -Drew

5 4

ISPs slowing P2P traffic...
by Deepak Jain 14 Jan '08

14 Jan '08

http://www.dslreports.com/shownews/TenFold-Jump-In-Encrypted-BitTorrent-Tra… http://www.dslreports.com/shownews/Comcast-Traffic-Shaping-Impacts-Gnutella… http://www.dslreports.com/shownews/Verizon-Net-Neutrality-iOverblowni-73225 If I am mistakenly being duped by some crazy fascists, please let me know. However, my question is simply.. for ISPs promising broadband service. Isn't it simpler to just announce a bandwidth quota/cap that your "good" users won't hit and your bad ones will? This chasing of the lump under-the-rug (slowing encrypted traffic, then VPN traffic and so on...) seems like the exact opposite of progress to me (by progressively nastier filters, impeding the traffic your network was built to move, etc). Especially when there is no real reason this P2P traffic can't masquerade as something really interesting... like Email or Web (https, hello!) or SSH or gamer traffic. I personally expect a day when there is a torrent "encryption" module that converts everything to look like a plain-text email conversation or IRC or whatever. When you start slowing encrypted or VPN traffic, you start setting yourself up to interfere with all of the bread&butter applications (business, telecommuters, what have you). I remember Bill Norton's peering forum regarding P2P traffic and how the majority of it is between cable and other broadband providers... Operationally, why not just lash a few additional 10GE cross-connects and let these *paying customers* communicate as they will? All of these "traffic shaping" and "traffic prioritization" techniques seem a bit like the providers that pushed for ubiquitous broadband because they liked the margins don't want to deal with a world where those users have figured out ways to use these amazing networks to do things... whatever they are. If they want to develop incremental revenue, they should do it by making clear what their caps/usage profiles are and moving ahead... or at least transparently share what shaping they are doing and when. I don't see how Operators could possibly debug connection/throughput problems when increasingly draconian methods are used to manage traffic flows with seemingly random behaviors. This seems a lot like the evil-transparent caching we were concerned about years ago. So, to keep this from turning into a holy war, or a non-operational policy debate, and assuming you agree that providers of consumer connectivity shouldn't employee transparent traffic shaping because it screws the savvy customers and business customers. ;) What can be done operationally? For legitimate applications: Encouraging "encryption" of more protocols is an interesting way to discourage this kind of shaping. Using IPv6 based IPs instead of ports would also help by obfuscating protocol and behavior. Even IP rotation through /64s (cough 1 IP per half-connection anyone). For illegitimate applications: Port knocking and pre-determined stream hopping (send 50Kbytes on this port/ip pairing then jump to the next, etc, etc) My caffeine hasn't hit, so I can't think of anything else. Is this something the market will address by itself? DJ

15 25

RE: Stupid Question: Network Abuse RFC?
by Paul Ferguson 14 Jan '08

14 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 So, someone else (Thanks, by the way -- this is the one I was looking for) pointed me to RFC3013/BCP46: http://rfc-editor.org/cgi-bin/rfcdoctype.pl?loc=RFC&letsgo=3013&type=http&f ile_format=txt In addition to RFC2142, it would appear that these are largely ignored just as much as any other operational IETF documents. That's a shame. $.02, - - ferg p.s. Thanks to everyone for their replies. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHiarRq1pz9mNUZTMRAkF1AKDMzsJlzSLPPVkR2GMrUXN/CDFBXgCguQy4 C9PMJ0Jl9a9XJjEZ9aqLIUY= =G7gb -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4