- Test - lists.nanog.org

OT? Device to limit simultaneous connections per host?
by David Hubbard 18 Aug '05

18 Aug '05

Hello everyone, I'm curious if anyone knows of a device that can throttle or limit a remote host's simultaneous connections or requests per second for web traffic on a per-IP basis. So I don't want to say web server X can only have 100 simultaneous connections and 10 requests per second. I want to say that for any given IP connecting to web server X, any one IP can have no more than 5 open connections and should be throttled if it starts making more than ten requests per second. If it could even be url-aware in that it could only apply the rules to specific types of web requests, that would be even better. The motivation here is to find a piece of equipment that can protect compute-intensive, database-driven websites from overly aggressive proxies, firewalls, search engines, etc. which like to hammer a given site with 50+ simultaneous requests against pages that could potentially need a few seconds of processing time per request. I've looked at a Packeteer PacketShaper running in reverse of what it normally would, trying to throttle and shape requests against the server rather than optimizing traffic for a low speed link like it was designed, but that didn't really work out as it could not have the policies applied on a per remote IP basis. Thanks, David

3 2

Re: What application runs on port 8094?
by Fergie (Paul Ferguson) 18 Aug '05

18 Aug '05

Hi Joe, A quick Google search renders: Cisco SSG TCP Redirect http://www.cisco.com/en/US/products/hw/routers/ps133/products_configuration… ...but it apparently runs on tcp/8094, so no idea here. 4662 sounds like eDonkey2000, a P2P application, but... http://www.iana.org/assignments/port-numbers says: oms 4662/tcp OrbitNet Message Service oms 4662/udp OrbitNet Message Service # Roy Davies <rdavies(a)daq.net> August 2005 - ferg -- Joe Shen <joe_hznm(a)yahoo.com.sg> wrote: Hi, Using netflow based monitor tool, I noticed there is a lot of traffic on 8094/UDP and 4662/TCP( both exceed 1Gbps, and exist all the time) What application use that port? Is there any P2P application use UDP as transportation protocol? thanks in advance. Joe -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: OT? Device to limit simultaneous connections per host?
by Fergie (Paul Ferguson) 17 Aug '05

17 Aug '05

WFQ/wRED? :-) - ferg -- "David Hubbard" <dhubbard(a)dino.hostasaurus.com> wrote: Hello everyone, I'm curious if anyone knows of a device that can throttle or limit a remote host's simultaneous connections or requests per second for web traffic on a per-IP basis. So I don't want to say web server X can only have 100 simultaneous connections and 10 requests per second. I want to say that for any given IP connecting to web server X, any one IP can have no more than 5 open connections and should be throttled if it starts making more than ten requests per second. If it could even be url-aware in that it could only apply the rules to specific types of web requests, that would be even better. The motivation here is to find a piece of equipment that can protect compute-intensive, database-driven websites from overly aggressive proxies, firewalls, search engines, etc. which like to hammer a given site with 50+ simultaneous requests against pages that could potentially need a few seconds of processing time per request. I've looked at a Packeteer PacketShaper running in reverse of what it normally would, trying to throttle and shape requests against the server rather than optimizing traffic for a low speed link like it was designed, but that didn't really work out as it could not have the policies applied on a per remote IP basis. Thanks, David

1 0

recommendations for 3rd party web site monitoring
by Matt Bazan 17 Aug '05

17 Aug '05

In need of external 3rd party site monitoring solution. Nothing fancy. Need to be alerted if site (HTTP/S, SMTP, TCP connect based) goes down (email, pager). Off list fine, thanks. Matt

3 2

RE: zotob - blocking tcp/445
by Erik Amundson 17 Aug '05

17 Aug '05

I've always been kind of conflicted with this issue. I mean, providers blocking traffic at all. On the one hand, I'm a corporate customer, and if I'm being DOSed or infected, I would want to be able to call my ISP and have it blocked. On the other hand, I truly feel that I pay my ISPs to pass traffic, not block it. I guess it only bugs me when something is blocked and I didn't even ask for it to be blocked...and then other stupid things are seeping through, but are not blocked even when I ask! If ISPs really wanted to make the Internet better for Corporate America, I guess they'd unplug most of Asia...not block a port here and there (but that isn't exactly acceptable). Anways, like I said, I'm conflicted...I change my mind every now and then because both arguments make logical sense. - Erik -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Gadi Evron Sent: Tuesday, August 16, 2005 12:58 AM To: Christopher L. Morrow Cc: nanog(a)merit.edu Subject: Re: zotob - blocking tcp/445 [snip arguments] > Do not become the internet firewall for your large customer base... > it's bad. > Okay, so please allow me to alter the argument a bit. Say we agreed on: 1. Security is THEIR (customers') problems, not yours. 2. You are not the Internet's firewall. That would mean you would still care about: 1. You being able to provide service. 2. Your own network being secure (?) In a big outbreak, not for the WHOLE Internet, I'd use whatever I can. It can easily become an issue of my network staying alive. Blocking that one port then might be a viable solution to get a handle on things and calm things down. Naturally though you are right again, it is a case-by-case issue and can not be discussed in generalities. Gadi.

7 6

FCC Rules For VoIP E911 Challenged
by Eric A. Hall 17 Aug '05

17 Aug '05

http://www.advancedippipeline.com/168602003?cid=RSSfeed August 16, 2005 FCC Rules For VoIP E911 Challenged Nuvio files appeal of FCC's order for VoIP providers to implement emergency calling systems. By The Associated Press WASHINGTON (AP) -- A provider of Internet phone calls is challenging new Federal Communication Commission rules requiring the company to ensure reliable 911 emergency call service. Nuvio Corporation, which has about 10,000 subscribers, has filed a motion with the U.S. Court of Appeals for the District of Columbia asking the court to hear the case, company spokeswoman Heather Carmichael said Monday. ``We have worked diligently to provide our users with 911 access,'' said Jason Talley, president and chief executive of Nuvio. But, he said, ``the 120-day requirement imposed by the FCC is arbitrary and capricious and without support in the record.'' Nuvio, based in Overland Park, Kan., is a provider of Voice over Internet Protocol, also known as VoIP. The company asked the court to expedite the case and rule by Nov. 7. If there's no decision by then, Nuvio warned it will have no choice but to start suspending some customers. In May, the FCC ordered Nuvio and other providers of Internet-based phone calls to certify that their customers will be able to reach an emergency dispatcher when they call 911. Dispatchers also must be able to identify the caller's phone number and location. The companies were given until Nov. 28 to comply. The FCC declined to comment on Nuvio's appeal. -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

1 0

Re: India cites security concerns, blocks Huawei bid to expand their indian ops
by Brandon Butterworth 17 Aug '05

17 Aug '05

> The Huawei probe illustrates the uneasy relationship between China and > India. They don't have much choice who to trust when India owns most of the fibre and China supplies most of the kit brandon

1 0

Fixing .com DNS glue records - who to contact?
by Matthew Elvey 17 Aug '05

17 Aug '05

A glue record for a .com domain (nextbus.com) is wrong, and I'm running into a brick wall trying to get it fixed. Do I need to switch to a more clueful registrar than GoDaddy**? Contact Network Solutions? Have I screwed up the domain's bind config? Everything looks right when I _dig_ around the authoritative NS*... I futzed with the record (deleted and re-added ns.nextbus.com as an authoritative NS (nameserver(s))), and the glue became correct for several days (dnsreport.com even reported all was well) AND THEN WENT BACK TO BEING BROKEN AGAIN. http://www.dnsreport.com/tools/dnsreport.ch?domain=nextbus.com currently says: ns.nextbus.com.: Parent server (f.gtld-servers.net) says A record is 64.164.28.194, but authoritative DNS server (209.204.159.20) says it is 64.142.39.200 ns.nextbus.com.: Parent server (f.gtld-servers.net) says A record is 64.164.28.194, but authoritative DNS server (64.142.88.72) says it is 64.142.39.200 ns.nextbus.com.: Parent server (f.gtld-servers.net) says A record is 64.164.28.194, but authoritative DNS server (69.9.186.104) says it is 64.142.39.200 ALSO: Since 3 of the 4 NS don't have the wrong glue, and 4 of the 4 NS are answering appropriately, and there's no NS at the IP indicated by the wrong glue, this problem shouldn't have any user-visible impact, right? I think there are many ISPs (I've found Earthlink and SBC to be guilty of this in the past) who have broken their resolver configurations so that they sometimes don't work if one, but not all of a domain's NS don't answer. Anyway, I'm getting complaints (from a gov't agency) of mail bouncing with '450 Client host rejected: cannot find your hostname' errors. TIA. This is my first post here; please be gentle. Oh, and if I do need a new registrar, I'm taking suggestions here or here: http://wiki.fastmail.fm/index.php/GoodRegistrarSearch *dig nextbus.com MX dig nextbus.com MX @ns.nextbus.com. dig nextbus.com MX @a.auth-ns.sonic.net. dig nextbus.com MX @b.auth-ns.sonic.net. dig nextbus.com MX @c.auth-ns.sonic.net. **edited to conform to normal attribution. WARNING: C&C. Subject: [Fwd: Please fix this Mismatched glue problem for domain nextbus.com [Incident: 050729-000962]] Me: > Go Daddy: >> Me: >>> Please fix this Mismatched glue problem for domain nextbus.com: >>> >>> ERROR: Your nameservers report glue that is different from what the >>> parent servers report. This will cause DNS servers to get confused; >>> some >>> may go to the IP provided by the parent servers, while others may >>> get to >>> the ones provided by your authoritative DNS servers. Problem >>> record(s) are: >>> >>> ns.nextbus.com.: >>> Parent server (m.gtld-servers.net) says A record is 64.164.28.194, but >>> authoritative DNS server (208.201.224.11) says it is 64.142.39.200 >>> ns.nextbus.com.: >>> Parent server (m.gtld-servers.net) says A record is 64.164.28.194, but >>> authoritative DNS server (208.201.224.33) says it is 64.142.39.200 >>> >>> The glue in the parent servers is wrong. >> >> Thank you for contacting customer support. >> >> I have tested your site and everything is resolving properly. This >> error message you are getting is not on our end. >> >> Please let us know if we can help you in any other way. >> >> <Advertisement for GoDaddy services removed> >> >> Sincerely, >> >> Beth P. >> GoDaddy.com >> Customer Service Representative > > Please have this issue reviewed by someone technical - someone who knows > what DNS glue is, so they can understand the error in my initial email. > See > http://www.menandmice.com/online_docs_and_faq/glossary/glossarytoc.htm?glue… > > or http://www.centralnic.com/support/glossary > > http://www.dnsreport.com/tools/dnsreport.ch?domain=nextbus.com > shows quite clearly IN RED that there is something seriously wrong. > The problem exists. It is NOT my imagination. > Just because you're able to bring up www.nextbus.com does NOT mean > there's nothing wrong. Thank you for contacting customer support. I have looked into this situation and found that the domain name in question is not hosted with us. This being the case you may wish to speak with your hosting provider regarding the "glue" situation. Please let us know if we can help you in any other way. <Advertisement for GoDaddy services removed> <https://www.godaddy.com/gdshop/hosting/landing.asp?isc=webxpf> Sincerely, Kade P. -- Matthew http://wiki.fastmail.fm/index.php/MrElvey

6 7

Facing problem useing v.92 modem with As5300 access server
by Md. Kamal Hossain 17 Aug '05

17 Aug '05

Dear all we are using a As5350 access router.Everything is running well with old modem like v.90 or v.34 but with v.92 modem it is not working well.When we using v.92 modem its connect speed is verry slow and the connection disconnect every 5 min.If any one who have idea pls advice me how i will solve the problem. Thanks in advance Md. Kamal Hossain System Administrator -- This message has been scanned for viruses and dangerous content, and is believed to be clean.

1 0

RE: zotob - blocking tcp/445
by Church, Chuck 17 Aug '05

17 Aug '05

On Mon, 15 Aug 2005, Church, Chuck wrote: > > > >'enterprise security folks' are probably not the issue... The fact > remains > >that lots of folks DO do this :( There are quite a few folks between > >'consumer' and 'enterprise' that do all manner of dumb things on the > >Internet (where 'dumb' is equivalent to running smb shares across the > >public network minus encryption/ipsec). It's their choice to do that, > and > >their network providers are expected/demanded to pass those packets for > >them. > > >-Chris > > Surely the ratio of 'useful' traffic compared to 'junk' for a particular > protocol must be considered. What percentage of netbios entering a on your piece of the network you can consider the ratio of pigs to birds, or good to bad traffic or phases of the moon, it's your network do what you will. I can say that if you have a vocal enough customer the blocks won't last very long, or the customer will find another network to connect to... *** Rules are going to be different for residential vs. business customers. Business customers who aren't on crack probably know better to block netbios in and out. But residential customers, I think you'll win more customers than lose by taking some proactive blocking measures. > service provider's edge is intentional? 1%? 0.1%? I'm guessing much > less than that. If 5 or 6 nines worth of a particular protocol entering > or leaving an ISP's network is unintentional, and highly susceptible to > viral activity, isn't it in our best interest to block it? With proper your best interest might be to do that sure... 'your network, your call'. > notification to subscribers and instructions on setting up host-to-host > PPTP/whatever, blocking netbios can solve a large bunch of issues.... > please send my instructions for host-to-host pptp that my grandmother can follow without help of techsupport. *** Well, if you grandmother is already familiar with mapping drives and modifying her lmhosts file.... :)

4 3