- Test - lists.nanog.org

Re: Some truth about Comcast - WikiLeaks style
by Backdoor Parrot 16 Dec '10

16 Dec '10

Earlier this morning a Comcast peering manager had the following things to say about the recent NANOG thread, in a public IRC channel with many witnesses: my management is pretty disgusted with the badmouthing and accusation slinging on nanog.org btw the demands to disclose confidential data on the blog aren't helping either the budget for hosting will be impacted I guarantee because it came out of folks who are being hassled's budget there is a meeting today to discuss the value of supporting the NANOG community Apparently Comcast's support and sponsorship of NANOG has actually been a ploy to buy our silence, and if we keep talking poorly of them they're going to cut off the funding. Shhhhh don't tell anyone.

15 16

Re: Some truth about Comcast - WikiLeaks style
by dooser＠gmail.com 16 Dec '10

16 Dec '10

It would certainly serve to make customers angry. They have a choice of video provider netflix vs hulu, but only one isp. In this case the customer drops netflix in an angry huff and goes to hulu. That customer is gone forever. ------Original Message------ From: Patrick Giagnocavo To: nanog(a)nanog.org Subject: Re: Some truth about Comcast - WikiLeaks style Sent: Dec 16, 2010 11:05 AM On 12/16/2010 10:54 AM, Mikel Waxler wrote: > But in that scheme, Comcast looses in the long run, when the FCC gets around > to them, but Netflix looses customers immediately. > > " I pay Netflix 10$ a month and they wont let me use their service cause I > am on Comcast? I am taking my money to Hulu!" > > Sure netflix is "right" but by the time it matters they are out of business. > Surely serving a "bumper" video at the beginning - "Comcast is trying to charge you more for Netflix - see http://www.netflix.com/comcastripoff/" - would be enough? --Patrick Sent via BlackBerry by AT&T

1 0

Alleged backdoor in OpenBSD's IPSEC implementation.
by Wil Schultz 16 Dec '10

16 Dec '10

http://thread.gmane.org/gmane.os.openbsd.tech/22557 This appears to be some serious FUD, but if true could have some serious implications for IPSEC stacks in all kinds of equipment. -wil

14 15

Re: Some truth about Comcast - WikiLeaks style
by Mikel Waxler 15 Dec '10

15 Dec '10

It seems you are making some false assertions. 1) "If you were a Comcast customer attempting to stream Netflix via this connection, the movie would be completely unwatchable." This is a false conclusion. Bandwidth is not allocated in static blocks on a first come first serve basis. It is shared across all users. So adding a single user only slows the speed of all connections proportionally. In a pool roughly 16 million customers (across all regions) a single new connection would not noticeably effect others. 2) "Comcast claims that a good network maintains a 1:1 " I have never heard them assert that. I have heard them assert that they have peering agreements with other providers. Those agreements assert that if the bandwidth ratio remains the same, or close that neither party will charge the other. For a end user network like comcast, that will never be 1:1. For a larger network connecting to Level3 or TaTa, that might be 1:1. Having a peering agreement does not in any way imply a ratio. 3) You assert that the bandwidth is capped and if Comcast purchased more bandwidth it would not hit the cap. With 16 million customers and ~20mbit connections average they would need a 320 terabit connection to ensure that they never hit the cap. The reality is that most customers do not make uncapped connections. File servers cap bandwidth per user and certain services, like gaming or streaming media have a maximum rate. As long as the average data rate allocated per customer is close to the usage then customers will not notice the difference. Does it matter if it takes 10 seconds or 15 seconds to download a 5 minute youtube clip? Could Comcast purchase more bandwidth and speed up a percentage of their users? Probably yes. Would it drive up the cost of monthly internet? Yes. Is your Comcast internet connection to slow to perform reasonable tasks at a decent rate? Mine is not. I am not asserting that Comcast has enough bandwidth, just that some of your assertions are not valid.

8 8

Re: Some truth about Comcast - WikiLeaks style
by dooser＠gmail.com 15 Dec '10

15 Dec '10

Again, I was not commenting on the state of comcast's pipe. God knows I want it bigger. I was saying that some of the assumptions upon which he made based points were false. ------Original Message------ From: Nathan Angelacos To: nanog(a)nanog.org Subject: Re: Some truth about Comcast - WikiLeaks style Sent: Dec 15, 2010 5:34 PM On 12/15/10 14:13, Valdis.Kletnieks(a)vt.edu wrote: > On Wed, 15 Dec 2010 15:51:05 EST, Mikel Waxler said: > >> The reality is that most customers do not make uncapped connections. File >> servers cap bandwidth per user and certain services, like gaming or >> streaming media have a maximum rate. As long as the average data rate >> allocated per customer is close to the usage then customers will not notice >> the difference. Does it matter if it takes 10 seconds or 15 seconds to >> download a 5 minute youtube clip? > > The problem starts when that the choke point is congested enough that the > question isn't "10 seconds or 15", it's "4 mins 30 or 5 mins 30 for that 5 > minute clip". Buffer underruns are incredibly annoying. > Or, from personal experience: The movie stops because the buffer was exhausted, Netflix informs you "Your network connection has changed", shows a progress bar while it buffers /at a lower bitrate/. Then you get to watch the rest of the movie like it was 1995. Sent via BlackBerry by AT&T

1 0

Windows Encryption Software
by Brandon Kim 15 Dec '10

15 Dec '10

Hey guys: This is most definitely OT so please contact me off list. (don't want to annoy anyone) I come to you all because of all your wisdom. =) I want to know if there's software out there that will encrypt files on win2k3, winxp, win7, so that if someone decides to steal the computer and plug the harddrive into a USB external case, they won't be able to read the files on the harddrive. I know windows has bitlocker, but I don't know if that is available for Win2003? And it always seems like 3rd party apps seem to do a better job than what Microsoft gives you. Encryption needs to be done on the fly so if at anytime the harddrive is stolen, there's no way to read the data... Thoughts?? Brandon

12 14

Net-Neutrality or Net-Neutered?
by Beavis 15 Dec '10

15 Dec '10

I come across this interesting link. http://blogs.techrepublic.com.com/security/?p=4828&tag=nl.e036 Is ICANN really that susceptible to govt. pressure? I only see chaos ahead specially with ipv6 coming into the scene. -- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments Disclaimer: http://goldmark.org/jeff/stupid-disclaimers/

5 5

TCP congestion control and large router buffers
by Jim Gettys 15 Dec '10

15 Dec '10

As I'm attempting to lay out in my posts, there are are a plethora of problems, end-to-end in the network. Would that there was only one problem. Excessive, unmanaged buffers afflict the user's OS's (Windows, Mac and Linux alike), particularly on recent hardware. Home routers and the broadband connections (as shown by netalyzr) all have problems. The bottleneck may be anywhere in the path; with the (sometimes) exception of Windows XP, all edge equipment now routinely congests the edge. Multiple seconds of latencies, in both directions, are dismaying commonplace. Retail operators have had a hidden major support problem: how many of the "bad service" calls have been due to the problem? It tends to be transient in behavior, and I've chased the problem personally at least 5 times in the last 3 years. I've placed service calls I now believe likely due to bufferbloat. I've caught problems with crash dumps being uploaded to the net; backup and downloads can all cause trouble. Courtesy of the Netalyzr team, I've been able to post color versions of their results on http://gettys.wordpress.com/2010/12/06/whose-house-is-of-glasse-must-not-th…; they first reported results at the NANOG meeting last summer. Disentangling broadband data from home router and operating system bufferbloat is difficult; I've found bufferbloat is present in all of them. The power of two bufferbloat sizes are almost certainly all broadband gear (since the OS buffer sizes are quantised in packets, not bytes). In the downstream direction, one of the possible causes is be failure to run any AQM in the broadband head-ends; this is certainly also the case in home routers. Also, as outlined in: Characterizing Residential Broadband Networks http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.65.6825&rep=rep1&t… we have good reason to believe this is taking place. Since I became aware that bufferbloat might have become a generic problem last summer from anecdotal data and personal experiments, I've probed networks wherever I've travelled. Some of what I've seen was clearly broadband bufferbloat; but more disturbingly, I've also seen other evidence further into several of the networks I've probed (from hotels *not* using broadband for their service), further confirming the initial anecdotal data I was given that queue management is far from universal (and essentially unheard of in the home). If the idea that the buffers have destroyed congestion avoidance doesn't scare you, I don't know what will. It's a major problem. Best Regards, - Jim Gettys

1 0

DNS "Fake" Authority for hidden forwarders?
by Leland Vandervort 15 Dec '10

15 Dec '10

Hi All, Apologies if off topic, but hoping that one of you gurus out there might have some tips on this. I have a rather "unusual" application for DNS which I need to figure out a way to make it work, but running into authority issues. Basically, I have a "fake" server running on a private network which can respond to PTR and A requests dynamically, with their details extracted from a database. In front of that in the public network, I have two servers (load-balanced) which can handle the queries from the "world" for these zones. The problem is that the backend "dummy" server doesn't not actually generate a zone as such, and does not set the AA bit (it's a python script, actually...). I'm trying find a way for the front-end servers to declare themselves as authority for the zones in question, but obtaining the details of the records via forwarder to the dummy server behind, then of course caching the response for the stated TTL in the response. I have looked at various configuration options of BIND and nothing really works, be it a forward, split-horizion, hidden-master, hidden-slave, etc. Is there another daemon somewhere out there that can do something along lines of this pseudo configuration: zone "1.168.192.in-addr.arpa" { type master; // actually a "fake" master to pretend to be the authority allow-query { any; }; recursion no; file "/etc/bind/zones/1.168.192.in-addr.fake-master.zone"; // file contains an SOA and NS record of the zone // pointing to the "public" visible servers (i.e. myself) // actual records (PTR, A, AAAA, etc.) are dynamically retrieved // from a "record-forwarder", but works the same way as // a standard forward type zone: record-forwarders { 10.1.1.2; }; }; When an external query arrives for the zone, the front-end server declares itself to be authoritative for the zone, but obtains the actual A/PTR/AAAA record via the back-end forwarder, and stuffs it into the response as if it was locally configured. It then keeps it in cache. For the moment, I have it setup simply as a forwarder, and it does indeed respond to queries for the dynamically generated queries, but only if queried DIRECTLY (dig -x 1.1.1.1 @frontend-server) , but it responds without authority. As such, this configuration cannot be used for "live" deployment. (the front-end servers are of course fully delegated for the zones in question, so they need to be authoritative). Is there anything out there that can do such authority masquerading/proxying? Thanks in advance Leland

3 2

NANOG Server Maintenance
by Michael K. Smith - Adhost 14 Dec '10

14 Dec '10

Hello All: This Friday morning, December 17, at 5:00 a.m. EST, Merit staff will relocate the server that operates the NANOG mailing lists and website. This will result in a list outage that should last not more than two hours. If you have any questions, please send them to admins(a)nanog.org. Regards, Mike On behalf of the Communications Committee -- Michael K. Smith - CISSP, GSEC, GISP Chief Technical Officer - Adhost Internet LLC mksmith(a)adhost.com w: +1 (206) 404-9500 f: +1 (206) 404-9050 PGP: B49A DDF5 8611 27F3 08B9 84BB E61E 38C0 (Key ID: 0x9A96777D)

1 0