- Test - lists.nanog.org

Mitigating HTTP DDoS attacks?
by Mike Lyon 25 Mar '08

25 Mar '08

Howdy all, So, i'm kind of new to this so please deal with my ignorance. But, what is common practice these days for HTTP DDoS mitigation during an attack? You can of course route every offending ip address to null0 at your border. But, if it's a botnet or trojan or something, It's coming from numerous different source IPs and Null0 routes can get very cumbersome. obviously. How do you folk usually deal with this? Any input would be greatly appreciated. Cheers, Mike

12 13

Re: rack power question
by Patrick Shoemaker 25 Mar '08

25 Mar '08

Joe Abley wrote: > > > On 25 Mar 2008, at 09:11 , Dorn Hetzel wrote: > >> It would sure be nice if along with choosing to order servers with DC >> or AC power inputs one could choose air or water cooling. >> >> Or perhaps some non-conductive working fluid instead of water. That >> might not carry quite as much heat as water, but it would surely carry >> more than air and if chosen correctly would have more benign results >> when the inevitable leaks and spills occur. > > The conductivity of (ion-carrying) water seems like a sensible thing to > worry about. The other thing is its boiling point. > > I presume that the fact that nobody ever brings that up means it's a > non-issue, but it'd be good to understand why. > > Seems to me that any large-scale system designed to distribute water for > cooling has the potential for hot spots to appear, and that any hot spot > that approaches 100C is going to cause some interesting problems. > > Wouldn't some light mineral oil be a better option than water? > > > Joe > With IT systems, the equipment being cooled would likely reach thermal overload and trip offline before the cooling water could flash to steam. Of course a properly designed system would have relief valves anyway. One problem with mineral oil is the specific heat. Water has a specific heat of 4.19 kJ/kg-degC. Light mineral oil is 1.67 kJ/kg-degC. That means much higher mass flow rates (bigger pumps, tubing, more dynamichead loss, etc) for oil than water to transfer the same amount of heat. Oh, and if you want to see whether mineral oil burns, check out this video: http://www.youtube.com/watch?v=YZipeaAkuC0 (that transformer is filled with mineral oil). Sun has some good concepts going with its green datacenter initiative. Their approach of using extremely scalable power and cooling distribution systems that are customizable at the rack level allows for a wide variety of densities and configurations throughout the room. Check out the tour at this link: http://www.sun.com/aboutsun/environment/green/datacenter.jsp -- Patrick Shoemaker President, Vector Data Systems LLC shoemakerp(a)vectordatasystems.com office: (301) 358-1690 x36 mobile: (410) 991-5791 http://www.vectordatasystems.com

1 0

Re: rack power question
by Paul Vixie 25 Mar '08

25 Mar '08

Matthew Crocker <mcrocker(a)crocker.com> wrote: > Seal off the room so you can control your replacement air source. Put a > series of cyclone dust collectors (think huge Dyson Vacuum) on your inbound > air. > > http://www.proventilation.com/products/ProductsView.asp?page=1&gclid=CKyD04… neat stuff. isc's neighbor has got one of these (for an industrial process). they are noisy, and not 100% duty cycle rated, but it's an interesting idea. > Then distribute your air through some electrostatic dust collectors > > http://www.dustcollectorexperts.com/electrostatic/ two of the ESP Disadvantages listed on that page are fatal in my application: o High initial cost o Materials with very high or low resistivity are difficult to collect however, this page also mentions "baghouse" filters, which i'd also heard in a private reply, and am now investigating. > Then run it through HEPA filters. :-). my servers don't have asthma. HEPA is hellishly expensive, annually, due to the number of filter replacements you need when the duty cycle is 100%. > How do you manage your humidity when you are pulling in 1% humidity 30 > degree air? It is more expensive to add water to the air then it is to cool > it sometimes. redwood city, california has signs over several streets leading to its oldtown that say (and i'm not making this up) "climate best by government test". what this appears to mean is, we have about three 30F weeks per year, and we have three four 100F weeks per year, and the rest of the time, it's between 50F and 70F, during which time the humidity is perfect for servers.

1 0

Re: Mitigating HTTP DDoS attacks?
by Roger Marquis 25 Mar '08

25 Mar '08

Mike Lyon wrote: > So, i'm kind of new to this so please deal with my ignorance. But, > what is common practice these days for HTTP DDoS mitigation during an > attack? You can of course route every offending ip address to null0 at > your border. But, if it's a botnet or trojan or something, It's coming > from numerous different source IPs and Null0 routes can get very > cumbersome. obviously. How do you folk usually deal with this? Depends a lot on the size of the network. If it's more than a few colos I highly recommend Arbor Peakflow (http://www.arbornetworks.com/) Not cheap but it works and scales well. -- Roger Marquis Roble Systems Consulting http://www.roble.com/

1 0

Looking for Clue at Earthlink
by Rob Szarka 24 Mar '08

24 Mar '08

If someone here is from Earthlink, or knows someone who is, please get in touch with me off-list. I have a mail-related issue to resolve. (Sadly the ARIN-listed contact is not valid and mail to postmaster seems to go into the same black hole as mail to abuse.) Specifically, the issue relates to the servers in 209.86.89.0/24, in case anyone here is already aware of an issue with the servers in this block and can help. -- Rob Szarka, Bizgrok Inc. http://bizgrok.com/ 860-887-5600 800-954-INET

2 2

Re: rack power question
by Scott Weeks 24 Mar '08

24 Mar '08

----- eddy+public+spam(a)noc.everquick.net wrote: -------- PG> (We are not worried about cooling due to the special circumstances PG> of the space.) ixp.aq? ;-) ----------------------------------------------------- Back in 2000-2002 I exchanged email several times with a guy responsible for a (the?) datacenter in Antartica and funny enough they had heat problems there. scott

1 0

Re: rack power question
by Lamar Owen 24 Mar '08

24 Mar '08

On Monday 24 March 2008, Robert E. Seastrom wrote: > Lamar Owen <lowen(a)pari.edu> writes: > > While this discussion might seem out of the ordinary for a network > > operator's group, it is a very good discussion. > > The sad part is the extraordinariness of discussions that are so > solidly on-topic as this one. Thanks for your contribution; I (at > least) really appreciate it. You're quite welcome. There is a whole 'nother side to this, too, especially for those who run DC power. The ampacity of conductors is quite a bit higher for DC; I have a copy of the best book on that subject, written by a telco engineer. Let's see: "DC Power System Design for Telecommunications" by Whitham D. Reeve, Wiley is the publisher. This is an expensive book; about $100 from Wiley; low price on Amazon right now is $75.75. This one goes over EVERYTHING when it comes to DC power distribution design and implementation. It was worth the price I paid, that's for sure. We have two 200A Lorains here, with A battery being 450Ah of C&D flooded cells, and B battery being a bank of 4 135Ah 12V sealed AGM batteries. Our core switches and all but one of our core routers have DC power supplies. Incidentally, all of this is fresh to me primarily because I'm in the process of building a new datacenter and moving our existing equipment into it, primarily for RFI mitigation reasons. -- Lamar Owen Chief Information Officer Pisgah Astronomical Research Institute 1 PARI Drive Rosman, NC 28772 (828)862-5554 www.pari.edu

1 0

ARIN & CAIDA IPv6 Survey Is Now Closed
by Member Services 24 Mar '08

24 Mar '08

ARIN wishes to thank the 300+ people who completed the IPv6 survey. CAIDA will analyze the results and present them on 7 April during the ARIN XXI Public Policy Meeting in Denver. The results will be posted on the ARIN website in the IPv6 Information Center and on the IPv6 wiki at www.getipv6.info. ARIN thanks NANOG for the opportunity to announce the survey on its mailing list and appreciates the participation by many in the operator community. When available, ARIN will post a link to the survey results on the NANOG mailing list. Regards, Member Services American Registry for Internet Numbers (ARIN)

1 0

Re: v6 subnet size for DSL & leased line customers
by Brian Dickson 24 Mar '08

24 Mar '08

>> As to "there must be better knobs" I think it may be a little late for that; by design (or as a consequence of it) the set of IPv6 knobs is the same as the set of IPv4 knobs. > The trouble is that BGP doesn't have a meaningful inter-AS metric. (Although there is something that is called that.) If I want to increase my path length by 10% through a certain neighboring AS, I don't get to do that. I only get to double or triple it. (Unless I was doing very heavy prepending to begin with.) Actually, while it isn't a true metric as such, there *is* just such a knob. The "origin" attribute, can act as a fractional AS-path-length. It's mandatory and transitive. It gets evaluated after as path length, but before other attributes. It has three possible values (internal, external, unknown), and as such, gives the limited ability to influence path choice at third-party locations quite distant. The only caveat is, that some parties may mess with it on prefixes they receive. I've used it in the past, with considerable success. Brian Dickson

6 6

default routes question or any way to do the rebundant
by ann kok 24 Mar '08

24 Mar '08

Hi ls it possible to have 2 default routes? or how can I do the rebundant when the route is still working either eth1 or eth2 down? Router2 192.168.0.2/20 eth1 192.168.0.18/20 eth2 10.0.0.1 eth3 ip route 0.0.0.0/0 192.168.0.1 ip route 0.0.0.0/0 192.168.0.17 or ip route 0.0.0.0/0 192.168.0.1 ip route 0.0.0.0/0 192.168.0.17 2 Router1 192.168.0.1 eth 192.168.0.17 eth2 172.16.0.1 eth3 host1 10.0.0.2 connects R2 couldn't ping host2 172.16.0.2 connects R1 when the link 192.168.0.1 is down host1-----R1--Switch---R2-----host2 --Switch--- i am using freebsd router Thank you for your help ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

18 25