December 2010 - Test - lists.nanog.org

Re: Some truth about Comcast - WikiLeaks style
by Mikel Waxler 15 Dec '10

15 Dec '10

It seems you are making some false assertions. 1) "If you were a Comcast customer attempting to stream Netflix via this connection, the movie would be completely unwatchable." This is a false conclusion. Bandwidth is not allocated in static blocks on a first come first serve basis. It is shared across all users. So adding a single user only slows the speed of all connections proportionally. In a pool roughly 16 million customers (across all regions) a single new connection would not noticeably effect others. 2) "Comcast claims that a good network maintains a 1:1 " I have never heard them assert that. I have heard them assert that they have peering agreements with other providers. Those agreements assert that if the bandwidth ratio remains the same, or close that neither party will charge the other. For a end user network like comcast, that will never be 1:1. For a larger network connecting to Level3 or TaTa, that might be 1:1. Having a peering agreement does not in any way imply a ratio. 3) You assert that the bandwidth is capped and if Comcast purchased more bandwidth it would not hit the cap. With 16 million customers and ~20mbit connections average they would need a 320 terabit connection to ensure that they never hit the cap. The reality is that most customers do not make uncapped connections. File servers cap bandwidth per user and certain services, like gaming or streaming media have a maximum rate. As long as the average data rate allocated per customer is close to the usage then customers will not notice the difference. Does it matter if it takes 10 seconds or 15 seconds to download a 5 minute youtube clip? Could Comcast purchase more bandwidth and speed up a percentage of their users? Probably yes. Would it drive up the cost of monthly internet? Yes. Is your Comcast internet connection to slow to perform reasonable tasks at a decent rate? Mine is not. I am not asserting that Comcast has enough bandwidth, just that some of your assertions are not valid.

8 8

Re: Some truth about Comcast - WikiLeaks style
by dooser＠gmail.com 15 Dec '10

15 Dec '10

Again, I was not commenting on the state of comcast's pipe. God knows I want it bigger. I was saying that some of the assumptions upon which he made based points were false. ------Original Message------ From: Nathan Angelacos To: nanog(a)nanog.org Subject: Re: Some truth about Comcast - WikiLeaks style Sent: Dec 15, 2010 5:34 PM On 12/15/10 14:13, Valdis.Kletnieks(a)vt.edu wrote: > On Wed, 15 Dec 2010 15:51:05 EST, Mikel Waxler said: > >> The reality is that most customers do not make uncapped connections. File >> servers cap bandwidth per user and certain services, like gaming or >> streaming media have a maximum rate. As long as the average data rate >> allocated per customer is close to the usage then customers will not notice >> the difference. Does it matter if it takes 10 seconds or 15 seconds to >> download a 5 minute youtube clip? > > The problem starts when that the choke point is congested enough that the > question isn't "10 seconds or 15", it's "4 mins 30 or 5 mins 30 for that 5 > minute clip". Buffer underruns are incredibly annoying. > Or, from personal experience: The movie stops because the buffer was exhausted, Netflix informs you "Your network connection has changed", shows a progress bar while it buffers /at a lower bitrate/. Then you get to watch the rest of the movie like it was 1995. Sent via BlackBerry by AT&T

1 0

Windows Encryption Software
by Brandon Kim 15 Dec '10

15 Dec '10

Hey guys: This is most definitely OT so please contact me off list. (don't want to annoy anyone) I come to you all because of all your wisdom. =) I want to know if there's software out there that will encrypt files on win2k3, winxp, win7, so that if someone decides to steal the computer and plug the harddrive into a USB external case, they won't be able to read the files on the harddrive. I know windows has bitlocker, but I don't know if that is available for Win2003? And it always seems like 3rd party apps seem to do a better job than what Microsoft gives you. Encryption needs to be done on the fly so if at anytime the harddrive is stolen, there's no way to read the data... Thoughts?? Brandon

12 14

Net-Neutrality or Net-Neutered?
by Beavis 15 Dec '10

15 Dec '10

I come across this interesting link. http://blogs.techrepublic.com.com/security/?p=4828&tag=nl.e036 Is ICANN really that susceptible to govt. pressure? I only see chaos ahead specially with ipv6 coming into the scene. -- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments Disclaimer: http://goldmark.org/jeff/stupid-disclaimers/

5 5

TCP congestion control and large router buffers
by Jim Gettys 14 Dec '10

14 Dec '10

As I'm attempting to lay out in my posts, there are are a plethora of problems, end-to-end in the network. Would that there was only one problem. Excessive, unmanaged buffers afflict the user's OS's (Windows, Mac and Linux alike), particularly on recent hardware. Home routers and the broadband connections (as shown by netalyzr) all have problems. The bottleneck may be anywhere in the path; with the (sometimes) exception of Windows XP, all edge equipment now routinely congests the edge. Multiple seconds of latencies, in both directions, are dismaying commonplace. Retail operators have had a hidden major support problem: how many of the "bad service" calls have been due to the problem? It tends to be transient in behavior, and I've chased the problem personally at least 5 times in the last 3 years. I've placed service calls I now believe likely due to bufferbloat. I've caught problems with crash dumps being uploaded to the net; backup and downloads can all cause trouble. Courtesy of the Netalyzr team, I've been able to post color versions of their results on http://gettys.wordpress.com/2010/12/06/whose-house-is-of-glasse-must-not-th…; they first reported results at the NANOG meeting last summer. Disentangling broadband data from home router and operating system bufferbloat is difficult; I've found bufferbloat is present in all of them. The power of two bufferbloat sizes are almost certainly all broadband gear (since the OS buffer sizes are quantised in packets, not bytes). In the downstream direction, one of the possible causes is be failure to run any AQM in the broadband head-ends; this is certainly also the case in home routers. Also, as outlined in: Characterizing Residential Broadband Networks http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.65.6825&rep=rep1&t… we have good reason to believe this is taking place. Since I became aware that bufferbloat might have become a generic problem last summer from anecdotal data and personal experiments, I've probed networks wherever I've travelled. Some of what I've seen was clearly broadband bufferbloat; but more disturbingly, I've also seen other evidence further into several of the networks I've probed (from hotels *not* using broadband for their service), further confirming the initial anecdotal data I was given that queue management is far from universal (and essentially unheard of in the home). If the idea that the buffers have destroyed congestion avoidance doesn't scare you, I don't know what will. It's a major problem. Best Regards, - Jim Gettys

1 0

DNS "Fake" Authority for hidden forwarders?
by Leland Vandervort 14 Dec '10

14 Dec '10

Hi All, Apologies if off topic, but hoping that one of you gurus out there might have some tips on this. I have a rather "unusual" application for DNS which I need to figure out a way to make it work, but running into authority issues. Basically, I have a "fake" server running on a private network which can respond to PTR and A requests dynamically, with their details extracted from a database. In front of that in the public network, I have two servers (load-balanced) which can handle the queries from the "world" for these zones. The problem is that the backend "dummy" server doesn't not actually generate a zone as such, and does not set the AA bit (it's a python script, actually...). I'm trying find a way for the front-end servers to declare themselves as authority for the zones in question, but obtaining the details of the records via forwarder to the dummy server behind, then of course caching the response for the stated TTL in the response. I have looked at various configuration options of BIND and nothing really works, be it a forward, split-horizion, hidden-master, hidden-slave, etc. Is there another daemon somewhere out there that can do something along lines of this pseudo configuration: zone "1.168.192.in-addr.arpa" { type master; // actually a "fake" master to pretend to be the authority allow-query { any; }; recursion no; file "/etc/bind/zones/1.168.192.in-addr.fake-master.zone"; // file contains an SOA and NS record of the zone // pointing to the "public" visible servers (i.e. myself) // actual records (PTR, A, AAAA, etc.) are dynamically retrieved // from a "record-forwarder", but works the same way as // a standard forward type zone: record-forwarders { 10.1.1.2; }; }; When an external query arrives for the zone, the front-end server declares itself to be authoritative for the zone, but obtains the actual A/PTR/AAAA record via the back-end forwarder, and stuffs it into the response as if it was locally configured. It then keeps it in cache. For the moment, I have it setup simply as a forwarder, and it does indeed respond to queries for the dynamically generated queries, but only if queried DIRECTLY (dig -x 1.1.1.1 @frontend-server) , but it responds without authority. As such, this configuration cannot be used for "live" deployment. (the front-end servers are of course fully delegated for the zones in question, so they need to be authoritative). Is there anything out there that can do such authority masquerading/proxying? Thanks in advance Leland

3 2

NANOG Server Maintenance
by Michael K. Smith - Adhost 14 Dec '10

14 Dec '10

Hello All: This Friday morning, December 17, at 5:00 a.m. EST, Merit staff will relocate the server that operates the NANOG mailing lists and website. This will result in a list outage that should last not more than two hours. If you have any questions, please send them to admins(a)nanog.org. Regards, Mike On behalf of the Communications Committee -- Michael K. Smith - CISSP, GSEC, GISP Chief Technical Officer - Adhost Internet LLC mksmith(a)adhost.com w: +1 (206) 404-9500 f: +1 (206) 404-9050 PGP: B49A DDF5 8611 27F3 08B9 84BB E61E 38C0 (Key ID: 0x9A96777D)

1 0

Re: TCP congestion control and large router buffers
by Mikael Abrahamsson 14 Dec '10

14 Dec '10

On Tue, 14 Dec 2010, Sam Stickland wrote: > But there's no need for AQM, just smaller buffers would make a huge > difference. Well, yes, buffering packets more than let's say 30-50ms on a 1 meg link doesn't make much sense. But doing some basic AQM would make things even better (some packets would see 0 buffering instead of 30ms). > Surely buffers that can store seconds worth of data are simply too big? FIFO with seconds worth of data is just silly, yes. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

2 2

peering, derivatives, and big brother
by Jeff Wheeler 14 Dec '10

14 Dec '10

A read through this New York Times article on derivatives clearing, and the exclusivity that big banks seek to maintain, would look very much like an article on large-scale peering, to someone who is not expert in both topics. The transit-free club and the "derivatives dealers club" may have other similarities in the future, and it's worth watching how further government regulation develops in this area. It may lead to insight into how government might eventually regulate ISPs seeking to become settlement-free. "“It appears that the membership criteria were set so that a certain group of market participants could meet that, and everyone else would have to jump through hoops,” Mr. Katz said." http://www.nytimes.com/2010/12/12/business/12advantage.html?pagewanted=1&_r… -- Jeff S Wheeler <jsw(a)inconcepts.biz> Sr Network Operator / Innovative Network Concepts

7 9

Re: TCP congestion control and large router buffers
by Mikael Abrahamsson 14 Dec '10

14 Dec '10

On Mon, 13 Dec 2010, Sam Stickland wrote: > Ironically though, wouldn't smaller buffers cost less thus making the CPEs 1 megabyte of buffer (regular RAM) isn't really expensive. > cheaper still? I believe the argument made in the blog post is that > cheaper RAM been causing the CPE manufacturers to mistakenly provision > too much buffer space, which in turn apparently means that TCP can't > stabilize at a rate less than available bandwidth (I.e. It's the old > 1980's congestion collapse problem all over again). Of course, you'll > only see this if a single TCP stream is actually capable of saturating > the link. Sam I would guess they're running standard OSes and haven't tuned the buffers at all. Implementing WRED or fair-queue (even if it just means turning it on) requires validation which the CPE manufacturers want to minimize. Also it's our fault as a business, how many ISPs have included AQM in their RFPs for CPEs and actually would pay USD5 more per device for this feature? I'm not very surprised at the lack of this though, it's hard to explain to the end customer with some kind of marketing, both for the ISP and the CPE vendor if they're selling to end customers. It's one of those "in the black box" things that should just work, but there is little upside in having it because it's hard to charge for. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

1 0