- Test - lists.nanog.org

RE: protocols that don't meet the need...
by Tony Hain 23 Feb '06

23 Feb '06

I am not going to speak for the IETF, but why would they? Their meetings are already open, and to be globally fair the proposed coordinators would have to attend 3-5 extra meetings a year to cover all the ops groups. Tony > -----Original Message----- > From: Eastgard, Tom [mailto:tom.eastgard@boeing.com] > Sent: Tuesday, February 14, 2006 1:01 PM > To: Tony Hain; nanog(a)merit.edu > Subject: RE: protocols that don't meet the need... > > > -----Original Message----- > > From: Tony Hain [mailto:alh-ietf@tndh.net] > > Sent: Tuesday, February 14, 2006 12:35 PM > > To: nanog(a)merit.edu > > Subject: protocols that don't meet the need... > > > > > > A thought I had on the plane last night about the disconnect > > between the NANOG and IETF community which leaves protocol > > development to run open-loop. > > > > Rather than sit back and complain about the results, why not > > try to synchronize meeting times. Not necessarily hotels, but > > within a reasonable distance of each other so the issue about > > ROI for the trip can be mitigated. > > This will mean that people who regularly attend both will > > have overlap issues, but if one meeting every year or two is > > joint there is an opportunity for those who can't justify the > > extra trips to at least have some feedback to try and close > > the loop on protocol design. > > Would it make sense to ask IETF to provide a focal or coordinate(s?) to > NANOG who would host a BOF(s?) on IETF issues --- not to debate, explain > or > work them but to board the issues and concerns of the operating community? > Point being to provide a lightly structured and cost effective mechanism > for > operators to give feedback without having to attend three more meetings > per > year? > > T. Eastgard

28 64

The Domain Name Service as an IDS
by Gadi Evron 23 Feb '06

23 Feb '06

"How DNS can be used for detecting and monitoring badware in a network" http://staff.science.uva.nl/~delaat/snb-2005-2006/p12/report.pdf This is a very interesting although preliminary work by obviously skilled people. I haven't learned much but I am extremely happy others work on this than the people I already know! They also weren't too shy with credit, mentioning Florian Weimer and his Passive DNS project already at the abstract (quoted below). They even mention me for some reason. Great paper guys! Moving past Passive DNS Replication and blacklisting, they discuss what so far has been done for years using dnstop, and help us take it to the next level of DNS monitoring. Someone should introduce them to Duane Wessels' (from ISC OARC) follow-up dnstop project, DSC. :) http://dns.measurement-factory.com/tools/dsc/ https://oarc.isc.org/faq-dsc.html http://www.caida.org/tools/utilities/dsc/ [Duane's lecture on the tool at the 1st DNS-OARC Workshop] http://www.caida.org/projects/oarc/200507/slides/oarc0507-Wessels-dsc.pdf There has been some other interesting work done in this area by our very own David Dagon from Georgia Tech: [Presentation from the 1st DNS-OARC Workshop] Botnet Detection and Response - The Network is the Infection: http://www.caida.org/projects/oarc/200507/slides/oarc0507-Dagon.pdf [Paper] Modeling Botnet Propagation Using Time Zones: http://www.cs.ucf.edu/~czou/research/botnet_tzmodel_NDSS06.pdf ----- Abstract SURFnet is looking for technologies to expand the ways they can detect network traffic anomalies like botnets. Since bots started using domain names for connection with their controller, tracking and removing them has become a hard task. This research is a first glance at the usability of DNS traffic and logs for detection of this malicious network activity. Detection of bots is possible by DNS information gathered from the network by placing counters and triggers on specific events in the data analysis. In combination with NetFlow information and IP addresses of known infected systems, detection of bots of network anomalies can be made visible. Also the behavior of a bot can be documented and additional information can be gathering about the bot. Using DNS data as a supplement to the existing detection systems can give more insight in the suspicious network traffic. With some future research, this information can be used to compile a case against particular types of bot or spyware and help dismantling a remote controlled infrastructure as a whole. Note We started this research project with the question if the Passive DNS Software of Florian Weimer was useful for bot detection. We immediately found out that the sensor of the Passive DNS Software strips the source address from the collected data for privacy reasons, making this software not useful at all for our purpose. We deviated from the Research Plan (Plan van Aanpak) and took a more general approach to the question; ”Is gathered DNS traffic usable for badware detection”. ----- Gadi. -- http://blogs.securiteam.com/ "Out of the box is where I live". -- Cara "Starbuck" Thrace, Battlestar Galactica.

4 4

RE: How do you (not how do I) calculate 95th percentile?
by Russell, David 23 Feb '06

23 Feb '06

I think that we have two (partially) unrelated issues in this thread: 1) how often you should sample and 2) what do you do with the results. I personally think that 5 minute sampling is so last century because it is better suited for batch load types that do not change very quickly than for interactive web applications. If your users' web performance is being affected by a particular link, they are going to notice it in the 10 second range. Congestion events lasting 1-3 minutes can be a problem. After five minutes they have forgotten what they were doing:) How often you check the counter should be driven by how granular you want to measure the network. Pick the right counter so that it does not wrap on you during your sampling interval. The initial downside is that you have 10-30 times as much data. Network data has chaotic (aka self-similar) characteristics that make simple statistics such as max, min or average somewhat useless. My understanding of the reason to calculate a 95th percentile is to try to reduce the dataset size and to make some sense out of the random performance data. For example, I could take some range of data and figure out the 95% threshold and save that as a data point. (eg. 95% of the samples are less than X Mbps). Read the counter value, compute the rate for the interval, then compute the 95th % threshold for 20+ samples and save that as the value for that longer period. The basic assumption is that you can ignore or not bill the 5% of the time that you had higher values. Its 6 minutes during a 10 hour business window or 15 minutes over a 24 hour period. One could argue that 95 should be 98 or 92 or it matters if the 5% is a continuous. But its a reasonable starting point for making a decision about whether link utilization is too high. David Russell ________________________________ From: owner-nanog(a)merit.edu on behalf of Jo Rhett Sent: Wed 2/22/2006 1:12 PM To: nanog(a)merit.edu Subject: How do you (not how do I) calculate 95th percentile? I am wondering what other people are doing for 95th percentile calculations these days. Not how you gather the data, but how often you check the counter? Do you use averages or maximums over time periods to create the buckets used for the 95th percentile calculation? A lot of smaller folks check the counter every 5 min and use that same value for the 95th percentile. Most of us larger folks need to check more often to prevent 32bit counters from rolling over too often. Are you larger folks averaging the retrieved values over a larger period? Using the maximum within a larger period? Or just using your saved values? This is curiosity only. A few years ago we compared the same data and the answers varied wildly. It would appear from my latest check that it is becoming more standardized on 5-minute averages, so I'm asking here on Nanog as a reality check. Note: I have AboveNet, Savvis, Verio, etc calculations. I'm wondering if there are any other odd combinations out there. Reply to me offlist. If there is interest I'll summarize the results without identifying the source. -- Jo Rhett senior geek SVcolo : Silicon Valley Colocation Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. ThruPoint, Inc.

2 1

The dissention grows towards AOL and pay per message
by Nicole 23 Feb '06

23 Feb '06

This was sent to me on another mailing list. I am on a number of smaller and or community mailing lists who feel very threatend by this. Nicole -- Hi, I just signed an important online petition because the very existence of online civic participation and the free Internet as we know it are under attack by America Online, and we need to fight back quickly. The petition's at: http://civic.moveon.org/emailtax/ AOL recently announced what amounts to an "email tax." Under this pay- to-send system, large emailers willing to pay an "email tax" can bypass spam filters and get guaranteed access to people's inboxes-- with their messages having a preferential high-priority designation. Charities, small businesses, civic organizing groups, and even families with mailing lists will inevitably be left with inferior Internet service unless they are willing to pay the "email tax" to AOL. The petition says: "AOL, don't auction off preferential access to people's inboxes to giant emailers, while leaving people's friends, families, and favorite causes wondering if their emails are being delivered at all. The Internet is a force for democracy and economic innovation only because it is open to all Internet users equally--we must not let it become an unlevel playing field." AOL's proposed pay-to-send system is the first step down the slippery slope toward dividing the Internet into two classes of users--those who get preferential treatment and those who are left behind. We must preserve the Internet for everybody. Can you sign this emergency petition to America Online? http://civic.moveon.org/emailtax/ Thanks! -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ "The term "daemons" is a Judeo-Christian pejorative. Such processes will now be known as "spiritual guides" - Politicaly Correct UNIX Page

3 2

RE: How do you (not how do I) calculate 95th percentile?
by Greenhagen, Robin 23 Feb '06

23 Feb '06

Database triggers are a marvelous thing. Is this wrong? ((InOctetsCurrent-InOctetsLastTime)*8) --------------------------------- (TimeCurrent-TimeLastTime) = Inbound bits/sec We chose this because it doesn't matter if it is 30 seconds or 8 minutes between sample points, it is all normalized in that period. I do realize that it is an average within that window, but all we need to do is tune the cron job (how often we poll) to increase resolution. ________________________________________ Robin

1 0

How do you (not how do I) calculate 95th percentile?
by Jo Rhett 22 Feb '06

22 Feb '06

I am wondering what other people are doing for 95th percentile calculations these days. Not how you gather the data, but how often you check the counter? Do you use averages or maximums over time periods to create the buckets used for the 95th percentile calculation? A lot of smaller folks check the counter every 5 min and use that same value for the 95th percentile. Most of us larger folks need to check more often to prevent 32bit counters from rolling over too often. Are you larger folks averaging the retrieved values over a larger period? Using the maximum within a larger period? Or just using your saved values? This is curiosity only. A few years ago we compared the same data and the answers varied wildly. It would appear from my latest check that it is becoming more standardized on 5-minute averages, so I'm asking here on Nanog as a reality check. Note: I have AboveNet, Savvis, Verio, etc calculations. I'm wondering if there are any other odd combinations out there. Reply to me offlist. If there is interest I'll summarize the results without identifying the source. -- Jo Rhett senior geek SVcolo : Silicon Valley Colocation

5 6

anybody here from verizon's e-mail department?
by Paul Vixie 22 Feb '06

22 Feb '06

last week i became unable to send mail to verizon users: Diagnostic-Code: X-Postfix; host relay.verizon.net[206.46.232.11] said: 550 You are not allowed to send mail:sv18pub.verizon.net (in reply to MAIL FROM command) (the above was from me trying to ask postmaster(a)verizon.net about it) i'd hate to think that i've simply sent too many why-are-you-spamming-me complaints and have been blacklisted.

9 12

MLPPP over MPLS
by Jon R. Kibler 22 Feb '06

22 Feb '06

Greetings all, Would anyone who has every done MLPPP over MPLS care to share their experiences with this type of network? We have a customer that is implementing an MPLS network that will have 2 to 6 T1 feeds at some locations that will be using MLPPP for channel bonding. This is a telco provided network that will be customer managed. The routers will be customer managed because the same equipment will have interfaces to another telco's network as a backup to the MPLS network. Needless to say, no telco will support equipment that interfaces competitors networks. The customer is being told by their router vendor that an MLPPP/MPLS network is 'too complex' to be managed by anyone except for the router vendor's VARs or the telco. They indicated that it would be impossible for the customer's router vendor certified network person to come up to speed on MLPPP/MPLS configurations and manage such a network -- that it takes years to adequately learn how to manage that type of network configuration. This doesn't sound like rocket science to me -- it should be simple and rather straight forward, I would think: The telco specifies its requirements for the router configuration, the customer implements that configuration on the required router interfaces, the telco monitors line quality, and the customer does basic router monitoring. Am I missing something here, or is the router vendor just blowing a lot of smoke to try to provide business for some of his clients that provide managed services? Thanks in advance for your feedback! Jon Kibler -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

7 10

Re: a radical proposal (Re: protocols that don't meet the need...)
by Michael.Dillon＠btradianz.com 21 Feb '06

21 Feb '06

[[pushed the wrong button last time. This is the complete reply]] > - join a local IXP, which may be a physical switch or > virtualized by a set of bilateral agreements. Why should they join an IXP if they already have private peering arrangements? > - outside the region, they advertise the prefix of the > regional authority Mixing government with operations? If you favor doing that then why not just give IPv6 addresses to the various national governments and let the UN sort it out? Personally I disagree with any scheme which calls for national or municipal governments to assign IPv6 addresses to end users. Dressing it up as a "regional authority" does not make it any nicer. Forcing people to join an unecessary IX is not the way to solve the problem of regional aggregation of routes. This is a purely technical problem which can be solved by the RIR practices in allocating IPv6 addresses. If they would allocate addresses in a geo-topological manner then end users and ISPs would be free to aggregate routes outside of their region without any involvement of governments or any requirement to join consortia or IXes. It does require the users of such geo-topological addresses to ensure that in THEIR region, there is sufficient interconnectivity (physical and policy) between ISPs for the addressing to work. But that does not need to be determined or managed centrally. Geo-topological addressing refers to RIRs reserving large blocks of designated addresses for areas served my large cities (over 100,000) population. When end users are located in fringe areas roughly equidistant between two or more such centers, the RIR simply asks the end user (or ISP) which is the center to which they want to connect (communicate). This addressing scheme operates in parallel with the existing provider-oriented IPv6 addressing scheme but uses a different block of IPv6 addresses out of the 7/8ths that are currently reserved. No hardware or software changes are required for this to work, merely some geographical/economical research to determine the relative sizes of the address pool to be reserved for each of the world's 5000 largest cities. > Whenever I have talked about the model with an ISP, I have gotten > blasted. Basically, I have been told that > > (1) any idea on operations proposed in the IETF is a bad idea because > the IETF doesn't listen to operators This is true. Top-down does not work in Internet operations. We need bottom-up, i.e. customer demand. The IETF needs to view their role as enablers of customer demand. If the IETF can create something that will work for ISP customers, then ISPs will be happy to go along, once the customers demand the service. > (2) the ISPs aren't going to be willing to make settlement payments > among themselves in accordance with the plan Wait until this starts appearing as a requirement in custome RFPs. > I'm not sure how to proceed, given the level of invective I get in > any discussion with anyone on the topic. Perhaps the IETF needs to seek input, not just from ISPs, but also from ISP customers, the end users of the network. > Note 2: Provider-provisioned addresses continue to make sense for > folks that don't plan to multihome. Indeed they do. But the current IPv6 addressing model is completely slanted towards provider-provisioned addresses for single-homed entities. Calling a small block of these provider-provisioned addresses PI (provider independent) does not really make the addresses provider independent and does not help small enterprises to implement meaningful multihoming. The IETF has imposed this provider-provisioned model on IPv4 and is thus directly responsible for the ISP cartel which now exists. --Michael Dillon

4 4

Re: Quarantine your infected users spreading malware
by Scott Weeks 21 Feb '06

21 Feb '06

----- Original Message Follows ----- From: Michael.Dillon(a)btradianz.com > > Oh geez, here we go again... Search the archives and > > read until you're content. It's a non-thread. This > > horse isn't only dead, it's not even a grease spot on > the road any more. > > Are you saying that the problem of spreading worms > and botnets is fading? Where do you get your data on > this? > > I mean, it's all well and good to express an opinion > but if you want to be believed you have to be prepared > to back it up with data from another source. I'm not saying that at all and that'd be the silliest position to support anyway. We all know better than that. All I was saying is *every* position on the subject was expressed about two months ago in the thread that wouldn't die even in the clear evidence of an exponential decrease in quality of responses on the subject and I don't things have changed significantly since then. No biggie, I can delete when the quality of respones degrades below my threshold of ability to carry on reading... :-) scott

1 0