- Test - lists.nanog.org

watchdog of BIND server
by Joe Shen 30 Apr '05

30 Apr '05

Hi , currently, I run named with -f option. As named is started at system boot time, a starting up script hang around console is a possible problem for system administration & security. Is there any configurable watchdog of BIND server deamon? E.g. once it found named is down, it will shutdown network interface to make the server out of anycast group. regards Joe __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

2 1

Internet impact of Apple Tiger
by Irwin Lazar 30 Apr '05

30 Apr '05

Some food for thought: -- http://www.gigaom.com/2005/04/28/rss-tiger-safari-and-the-bandwidth-bottlene ck/ RSS, Tiger Safari and the Bandwidth Bottleneck In less than 48 hours many of us will be installing Tiger OS-X and with it a brand new Safari browser that can read and display RSS feeds in a simple easy to understand manner. That upgrade while great for the consumers, could come as a big shocker for those blogs whose feeds are included as part of Safari¹s default starter package. Infact it could be the biggest stress test for RSS thus far! Most RSS readers are set to poll for updates every hour, and imagine when half-a-million Tiger Safari users who start hitting a server at the same time, pulling down RSS updates, because they have not changed the default settings. Server meltdown? Or an unintended denial of service? Apple says that most of the default feeds are going to be major news sites like CNN. New York Times, and LA Times. At this time they are not including any personal blogs as part of the default list. Even for them it is not going to be easy. Lets say if one of these news operations updated their site once an hour and each update results in a nominal 5 kilobytes of RSS generated data, then 500,000 simultaneous Safari users polling at top of the hour would mean a total data transfer of over 2 gigabytes per hour. Times 24, and you have over 48 gigabytes of data transfer every day just from Safari users alone. What if more than a million Tiger Safaris were on the loose. Oh boy! While an addition 48 gigabytes of traffic a day or 1.4 terabyte a month is not that much for large sites, but it will add up. Admittedly, since I don¹t have Tiger yet, not sure if Safari RSS does time-based check (every hour at :15) or checks related to when the computer/browser is started, which is relatively random and what other feed readers do. Clearly this is an imaginary scenario, but it could happen. So what¹s the fix? ³I certainly hope that Safari does conditional GET. I can¹t imagine it doesn¹t but I could be wrong,² says Brent Simmons, founder and the man behind hit feed reader, Net News Wire, ³With conditional GET you download the feed only if it¹s different from the last time you downloaded it this cuts way down on bandwidth use.² (More on conditional GET.) ³Conditional GET which NetNewsWire and most other aggregators support is hugely important,² says Simmons. But even that can go that far, since most of these news operations churn out headlines with monotonous regularity. Long term, I think RSS is going to become a clear bandwidth hog, unless the RSS people decide and come-up with an intelligent way to fix this problem. I have been tracking my own bandwidth consumption and RSS is just sucking up gigabytes like a parched man on a hot summer day. Some say that randomizing the whole RSS polling process is the answer. How about randomizing the whole RSS polling process? Instead of pulling down RSS feeds every hour, let the feeds download randomly. Okay that will help distribute the loads on the servers more evenly, but that still doesn¹t resolve the issue of inefficient use of network resources, especially for those who pay for those kind of things. Suggestions? Scott Rafer, CEO of Feedster says, ³ISPs can start caching feed URLs but if they do it with cached times of more than 10 min, then people will route around the caches.² Om Malik on Broadband 4/28/05 2:57 AM Om Malik Connected Home, Wired, Featured Comments

5 5

Re: OC3 to Gig-E conversion
by Miquel van Smoorenburg 30 Apr '05

30 Apr '05

In article <cistron.20050429230504.GH696(a)overlord.e-gerbil.net>, Richard A Steenbergen <ras(a)e-gerbil.net> wrote: > >On Fri, Apr 29, 2005 at 05:20:21PM -0400, Peering wrote: >> All, >> >> > Is there something out there (other than a router) that will convert >> > from OC3c to Gig-E? Feel free to answer offline, don't want to fill >> > everyone's inbox at once :) > >If you are looking for something that will actually convert native >ethernet frames to native sonet frames, you are pretty much SOL. If you have an OC3 circuit and just want to see GigE on both sides, use two RIC-155GE boxes - one on each side. http://www.rad.com/Article/0,6583,21840-GbE_over_STM-1_OC-3_Intelligent_Con… "The RIC-155GE is an intelligent converter enabling simple, efficient and cost-effective bridging of Gigabit Ethernet over STM-1/OC-3 lines." I have no idea how well this works or what the costs are .. Mike.

2 1

Re: Internet2
by Randy Bush 30 Apr '05

30 Apr '05

> Steve Casner's paper, which you cited, and Sue Moon's paper at > http://an.kaist.ac.kr/~sbmoon/paper/infocom2004.pdf, both report very > limited variation in delay within the ISP network. Sue's paper goes on > to describe points of variation on the order of ten and 100 ms in some > detail as well as reporting the general case of low variation in delay. > But most people don't live within the PE-PE domain, where these studies > were done - they connect to the backbone ISP through an access carrier > or through an enterprise network, or connect via some longer path. So > responding defensively "give me numbers" and citing as proof of your > case a paper that only looks at the path within the ISP has the effect > of shutting down and making an end-to-end discussion appear to be > invalid when Casner and Moon in fact only perform a measurement of a > part of the path. uh, fred. it was vicky who made the comparison i2 to internet, not i. i2 does not include site links, and some are good and some are bad. it is common wisdom today that the internet backbone is not where congestion occurs, but rather the customer tails. though one should always be suspicious of common wisdom, this particular bit seems pretty well supported, pings from uganda's makerere university notwithstanding. you/ve been pushing qos for a long time, fred. but, in the current situation, where the tails are the issue, signaling back from dest to source is still the big gap. imiho, from the ops perspective, only sally's ecn has made any useful approach. sadly, we may be able to judge the actual demand for e2e qos by ecn's very slow deployment. i think this is unfortunate, as ecn is pretty cool. but, in this community, the question would seem to be how long the current situation will prevail, where it is far simpler and less expensive to throw bandwidth at the backbone, as opposed to spending even more on opex-eating complexety and ever more complex and expensive routers. i suspect it'll be a while before we even see cotton balls being blown, and a very long while before new ducts. i.e., raw bandwidth costs will likely stay low. even the price of lighting it is declining. this has been discussed recently, both here and in simon lam's 2004 sigcomm award paper (recent ccr). so, i think we should o encorage i2 as the usg's way of subsidizing higher ed [0] and providing a playpen where big spikes and other traffic anomalies are not discouraged o encourage qos research o keep the real internet as simple as possible, after all, it is fools such as i who have to run it randy --- [0] - and i mean it. the lack of govt support for education in the us is a horrifying tragedy ever in the making

4 3

RE: Schneier: ISPs should bear security burden
by dlr＠bungi.com 30 Apr '05

30 Apr '05

[In the message entitled "RE: Schneier: ISPs should bear security burden" on Apr 29, 15:32, "Miller, Mark" writes:] > > Unfortunately, a lot of static "business" DSL IP space is still on > those lists and legitimate mail servers can get blocked. I usually use > the DUL as a "white list" to negate hits on the traditional dnsbls since > those are almost always stale. > We have worked very hard with the ISPs to ensure that legitimate static space isn't on the lists. We also do extensive amounts of work to ensure that isn't the case. You may be thinking of some other list, not the DUL. --

1 0

RE: Schneier: ISPs should bear security burden
by Miller, Mark 29 Apr '05

29 Apr '05

Unfortunately, a lot of static "business" DSL IP space is still on those lists and legitimate mail servers can get blocked. I usually use the DUL as a "white list" to negate hits on the traditional dnsbls since those are almost always stale. - Mark -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Dave Rand Sent: Friday, April 29, 2005 4:07 AM To: Steve Sobol; Mark Newton Cc: Owen DeLong; Bill Stewart; North American Networking and Offtopic Gripes List Subject: Re: Schneier: ISPs should bear security burden [In the message entitled "Re: Schneier: ISPs should bear security burden" on Apr 28, 10:20, "Steve Sobol" writes:] > There are some basic rules of thumb you can use. The problem is that > they're not guaranteed to work. The best solution was created years > ago (Gordon Fecyk's DUL, which lists IP ranges the ISPs specifically > register as dynamic/not supposed to host servers) and eventually came > under the purview of Kelkea/MAPS, but there wasn't a ton of ISP > buy-in. If we could create a similar list and actually get ISPs to > register the appropriate netblocks (and not mix in IPs where servers > are allowed, and IPs where they aren't, in the same block), that'd be great. Dunno what a ton of ISP buy-in is, but the MAPS DUL now contains about 190,000,000 entries. We've been working on it very hard for the last year or two. Most ISP-level subscribers figure it stops a pretty large percentage of the compromised-home-computer spam. --

3 2

OC3 to Gig-E conversion
by Peering 29 Apr '05

29 Apr '05

All, > Is there something out there (other than a router) that will convert > from OC3c to Gig-E? Feel free to answer offline, don't want to fill > everyone's inbox at once :) > > Thanks, > Diane Turley > Sr. Network Engineer > Xspedius Communications Co. > 636-625-7178 >

2 1

Hushmail DNS Attack Blamed on Network Solutions
by Fergie (Paul Ferguson) 29 Apr '05

29 Apr '05

http://www.eweek.com/article2/0,1759,1791152,00.asp - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: Schneier: ISPs should bear security burden
by Miller, Mark 29 Apr '05

29 Apr '05

Well, I have no influence on addressing here, so any comments are mine alone. A lot of addressing schemes were created in the day before there was a huge issue with hostile dynamic addresses and the need to be able to identify them. Addressing assignments, of course, were (and still are to a large part) driven by routing efficiency. - Mark -----Original Message----- From: Steven J. Sobol [mailto:sjsobol@JustThe.net] Sent: Friday, April 29, 2005 4:40 PM To: Miller, Mark Cc: nanog(a)merit.edu Subject: RE: Schneier: ISPs should bear security burden On Fri, 29 Apr 2005, Miller, Mark wrote: > Unfortunately, a lot of static "business" DSL IP space is still on > those lists and legitimate mail servers can get blocked. I usually > use the DUL as a "white list" to negate hits on the traditional dnsbls > since those are almost always stale. <assertion type="applies to USA, don't know about other countries"> That's because the ILECs, especially, don't feel the need to separate IPs on which servers are allowed, and IPs on which they aren't. SBC is the worst in this regard. No separation, no custom reverse DNS for DSL customers, no way to be absolutely certain if sending mail from a specific IP is a violation of SBC's TOS. </assertion> I've noticed that you work for Qwest. If the people designing your network DO have enough clue to separate IPs, bravo... but my experience is that many ISPs, especially ILECs/RBOCs, don't. -- JustThe.net - Apple Valley, CA - http://JustThe.net/ - 888.480.4NET (4638) Steven J. Sobol, Geek In Charge / sjsobol(a)JustThe.net / PGP: 0xE3AE35ED "The wisdom of a fool won't set you free" --New Order, "Bizarre Love Triangle"

1 0

Re: Schneier: ISPs should bear security burden
by dlr＠bungi.com 29 Apr '05

29 Apr '05

[In the message entitled "Re: Schneier: ISPs should bear security burden" on Apr 29, 17:23, "Steven J. Sobol" writes:] > On Fri, 29 Apr 2005, Dave Rand wrote: > > > Dunno what a ton of ISP buy-in is, but the MAPS DUL now contains about > > 190,000,000 entries. We've been working on it very hard for the last year or > > two. Most ISP-level subscribers figure it stops a pretty large percentage of > > the compromised-home-computer spam. > > Well, that's it then: "for the last year or two" - I don't recall a lot of > entries being on the DUL in its original incarnation. (Not for lack of > trying.) I'm sure there was more than one reason that it was not as large as it is today. Regardless, it's here, it's effective, and it is very widely used. --

1 0