- Test - lists.nanog.org

RE: NLB Recommendations
by Gordon, Michael 09 Jun '04

09 Jun '04

I have experience with F5 BigIP, Foundry, Cisco CSS, Nortel Alteon and the Inkra VSS. F5 is great for ease of use. It's built on BSD, so the CLI is exactly unix with special commands to manipulate the load balancing features. I think you can only used this box in routed-mode LB, but someone speak up if you can use it in bridged-mode. They have an iRule feature where you can filter and route traffic based on many parameter, such as various http headers. If you have a lot of layer 7 switching to do, you can configure it easily on the F5. Their support, however, needs work. I haven't called in a year, so it may have improved. The Foundry is very good at many sessions per second. I've used these mostly in DSR (direct server return) mode and have had good luck with them. For basic layer 4 switching they're very good. I've never used any layer 7 features on the Foundry. Foundry's documentation needs help, though. The Cisco Content Services Switch is ok, but overpriced. I don't care for the interface. I've never loaded this one up, so I'm not sure how it performs under heavly load. The Nortel Alteon is pretty good. I've seen some odd issues with the VMA architecture, but they're usually addressed in the latest patch. The cli takes a burn-in period, but once you know it you can fly on the box. Configuring layer 7 features can be cryptic, however. Use they're application guides for help. I've used the Alteon in routed-mode and bridged-mode load balancing. Lastly, the Inkra. I've been using the Inkra for a few years, but it's relatively new compared to the others listed above. They market it as a virtual services switch which means it not only does load balancing, but also firewall, ssl acceleration, ids/idp, etc. We've seen big improvements in the past six months with load balancing performace due to the release of 2.0 code. I'm eagerly awaiting their 3.0 due out in mid summer. NOTE: I may be biased since the company I work for has been helping Inkra develop and test it for several years. You may want to join the list lb-l(a)vegan.net for more load balancing advice and help. Mike -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Mike Lyon Sent: Wednesday, June 09, 2004 11:07 AM To: James Baldwin Cc: North American Network Operators Group Subject: Re: NLB Recommendations I have had nothing but good luck with Foundry's ServerIron. Very versatile. Cisco-like CLI. I have always had good support with Foundry's TAC too. -Mike On Tue, 8 Jun 2004 19:32:44 -0400, James Baldwin <jbaldwin(a)antinode.net> wrote: > > > I'm looking for recommendations for network load balancers. These, at > this time, will primarily be used to attach to a cluster of webservers > although I would like a solution which can be repurposed to other > applications later. I am looking at F5's Big IP, Cisco's SLB, and > Foundry's ServerIron at this time. > >

1 0

Verizon IP's and ARIN Records
by Dennis Dayman 09 Jun '04

09 Jun '04

ARIN has dropped all registry information for 206.46.0.0 - 255.255.0.0. This range includes our residential and business mail customers. We are aware of the issue and are addressing this NOW to have our ARIN records re-published again. We are not sure why this has happened at this time. Any sender verification that checks for PTR records will fail on outbound mail from Verizon Online. -------------------------- Dennis Dayman Verizon Internet Services Operations Security and Legal Compliance --------------------------

6 7

Re: Whitelists for email going to hotmail/msn/yahoo?
by crayola＠optonline.net 09 Jun '04

09 Jun '04

>Your company should . . . 1st explore using or getting your "own" Domain Name >Servers for your spamming as we have seen your mailers probing for recursive >servers on our networks and abusing other servers. 2nd apply for your own IP >space so that you can control your own PTR reverse records. Lastly, post in plain >site, your company's legal name(s) , addresses, telephone numbers and "Real" >contact points. Raise lots capital to pay for bandwidth and legal fees. Folks, I dont work for Optimum online or a company that is using optimum online to do business as some of you have assumed. I happen to have a personal account there which I use for personal email (like nanog) but also security related email (my primary job focus is computer/network security) because I am not about to ask questions about security from my company email address. That would be stupid. My company does have its own DNS servers, owns its own IP space, has PTR records for all externally accessible systems including email servers, has correct whois data, and has a dedicated DS3 to our provider (Sprint). Its a legit place. Can anyone point me to other providers beside AOL that may be offering whitelist services to legitimate businesses using email to send requested email traffic to their clients? Thanks, Mike

1 0

Meeting stats from SF
by Susan Harris 09 Jun '04

09 Jun '04

NANOG 31 May 23-25, 2004 San Francisco, CA Host: CNET Attendees: 584 (up from 488 at NANOG30) NAPs represented: 12 Asia, Pacific, Africa: 19 South, Central America: 1 Europe: 23 Countries represented: 12 Largest simultaneous # of wireless users: 375 Concurrent RealMedia viewers: up to 72 Meeting coordination: Merit IPsec, Squid, DNS, DHCP: The Measurement Factory Multicast: University of Oregon Sponsors: Switch and Data, IP Networks, 365 Main, Cloudshield, Alcatel, Arbor, Cariden, Cisco, Internap, Juniper, Laurel, Packet Design, Redback, Seranoa

1 0

"zero day" exploit...?
by Matthew Sullivan 09 Jun '04

09 Jun '04

In case you haven't seen it... http://www.computerworld.com.au/index.php?id=117316298&eid=-255 / Mat

4 3

Today's Internet
by John Obi 09 Jun '04

09 Jun '04

Hello, Are we part of the Today's Internet mess? http://www.internetnews.com/bus-news/article.php/3365491 -J __________________________________ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger. http://messenger.yahoo.com/

3 2

Re: alert tool for out-of-norm bandwidth?
by Hannigan, Martin 09 Jun '04

09 Jun '04

Check NANOG website for faq. I think its in the faq, but if not, MRTG standalone has threshold alarms and Cricket front end does too. Ill check and if not add something in. Regards, -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 <http://www.verisign.com/> -----Original Message----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: nanog(a)merit.edu <nanog(a)merit.edu> Sent: Tue Jun 08 16:52:40 2004 Subject: alert tool for out-of-norm bandwidth? I'm looking for some sort of tool that tracks bandwidth on a switch port and when the bit rate "suddenly" changes from the baseline alerts me. I'm playing with Team Cymru's darknet project and basically need an automated way of noting darknet traffic increase and then trigger a nagios alert. If there isn't something like this, I'll have to write it I guess. thanks. -- matthew zeier - "Curiosity is a willing, a proud, an eager confession of ignorance." - Leonard Rubenstein

3 2

IT security people sleep well
by Sean Donelan 09 Jun '04

09 Jun '04

Survey: Despite dangers, IT personnel sleep well By Bill Brenner, News Writer 27 May 2004 | SearchSecurity.com Security practitioners know hackers are working overtime to attack their networks; that they're relying on outdated and unreliable security protocols. Despite it all, many still get a good night's rest. Of 337 IT managers and administrators surveyed April 26-30, 32% worry about "the next virus/worm" and an equal percentage fear "a security breach to the enterprise's network." But 34% said they have "no worries" at all and "sleep like a baby," according to results published this week by a Michigan research firm. http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci9673… And the press release http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104&STORY=/www/story/05-2… Two issues tied as being of prime concern to those network administrators surveyed: 32% responded that they worry most about "the next virus/worm" and an equal percentage answered they worry most about "a security breach to the enterprise's network." The big surprise was that 34% of survey respondents said they had "no worries and sleep like a baby."

25 48

windowsupdate servers
by Petri Helenius 09 Jun '04

09 Jun '04

I´m looking for clueful contact responsible for windowsupdate.microsoft.com servers, contact would be appreciated offlist. (regular channels have failed) Pete

1 0

RE: Verizon IP's and ARIN Records
by Bil Herd 09 Jun '04

09 Jun '04

Hopefully we are the type of organization considered to be somewhat clueful but we have yet to figure out how to get Arin to remove our swip info from a former customer's netblock. It has been years, many many times filling out their forms and more emails then I can count. It was less work to get my /18 assigned then to convince them that I would like my information removed from a /24 that belongs to someone else. :/ And of course these are the kind of (ex)customers who like to get and keep viruses resulting in a continuing effort to get our name off their block. Bil -----Original Message----- From: Steven Champeon [mailto:schampeo@hesketh.com] Sent: Tuesday, June 08, 2004 10:57 AM To: 'Nanog' Subject: Re: Verizon IP's and ARIN Records on Tue, Jun 08, 2004 at 01:00:55AM -0700, william(at)elan.net wrote: > I'm not sure what will need to happen for ARIN to understand that > validity and security of whois data is important and people rely on > that all the time and they can't just ignore these issues. > Unfortunetly most people who actually use their data also the ones who > really dont have time or interest to participate in ARIN political process and as such are not heard at all. Well, one thing that has to happen is that ISPs and co-lo providers (such as Inflow, our former - note /former/ - provider) need to "understand that validity and security of whois data is important and people rely on that all the time and they can't just ignore these issues". Which, unfortunately, is what Inflow refused to understand the entire time we were co-lo'd with them, and continue to ignore to this day. I'm not surprised to find that our old netblock is still tagged with my company's name, despite requests to have it updated: Request: 66.45.6.196 connected to whois.arin.net [192.149.252.43:43] ... Inflow NFLO-AR-2 (NET-66-45-0-0-1) 66.45.0.0 - 66.45.127.255 Hesketh INFLOW-55125-5697 (NET-66-45-6-192-1) 66.45.6.192 - 66.45.6.223 # ARIN WHOIS database, last updated 2004-06-07 19:15 # Enter ? for additional hints on searching ARIN's WHOIS database. ...because Inflow didn't give a damn when we were paying them, I can't imagine they'd give a damn now that we've decided to pay someone else. We tried for six months to get them to add an abuse contact field to our ARIN record and they wasted dozens of hours explaining that because it was optional they didn't have to do it, when the point was that it was /necessary/, or at least /being actively requested/, and that the way to keep customers isn't to explain how you don't have to do something, but rather to do what the customer asks. I'm glad that RFCi listing didn't have any real effect on our ability to send mail. :-/ But, as I've said, Inflow is our /former/ co-lo provider, so they can go to hell for all I care. But I really wish they, or someone, would clean up our old ARIN records so that the next spammer they host, or netblock that gets hijacked, doesn't suggest, via ARIN, that my company has anything to do with it. Steve -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nos im/

3 2