- Test - lists.nanog.org

Throttling mail
by Adi Linden 25 Mar '04

25 Mar '04

Does anyone have any resources on building a mail relay that would limit the amount of email a single user or ip address can relay over a given time period? I have a spam/virus problem that is getting out of hand. Adi

12 18

RE: Redirecting mail (Re: Throttling mail)
by Bil Herd 25 Mar '04

25 Mar '04

Not to sound like a commercial for Cisco, but their IDS stuff does rewrite ACL's based upon signatures. Bil Herd -----Original Message----- From: J.D. Falk [mailto:jdfalk@cybernothing.org] Sent: Thursday, March 25, 2004 4:30 PM To: nanog(a)merit.edu Subject: Re: Redirecting mail (Re: Throttling mail) On 03/25/04, Valdis.Kletnieks(a)vt.edu wrote: > On the other hand, it's probably more effective to find some way of > making the Cisco gear block outbound 25 from abusive machines. Inbound also. The spammers have been using triangular routing for a while. (They dial in someplace, get an IP, and use a broadband connection to send packets with a forged source address of that dialup IP.) -- J.D. Falk "be crazy dumbsaint of the mind" <jdfalk(a)cybernothing.org> -- Jack Kerouac

1 0

IP VPNs and Reliability
by John Neiberger 25 Mar '04

25 Mar '04

We've been researching various VPN options for past year or so and we're in discussions with yet another vendor regarding their MPLS-based solution. All but one of the vendors we've talked to suffer from a similar 'problem', but I'm curious to get your opinions on this. I'm wondering if I'm more concerned about this problem than I should be. Most of the vendors we've talked to only have a single POP in our area. It seems to me that if we were to choose an option like that we'd, in effect, have a network of point-to-point circuits terminating at that one POP. I'm not that familiar with the hardware but I suppose it's possible that all of those circuits would be terminating on just a couple of huge routers. My concern is that a problem in one POP could take down our entire network, whereas with our current frame relay vendor we have great geographic diversity with the frame/ATM switches. The vendors who have a single POP that we've looked at are MCI and Virtela. [I must say hello to Gene and Brice at Virtela since I know they'll get a copy of this. <g>] Given that these vendors seem to have rather robust infrastructure, am I more worried than I need to be that all of our connections might terminate at the same spot? I'm sure those POPs are almost bullet-proof, but I'm still a little leary to put all of our eggs into a single basket like that. Any opinions would be welcome, especially if my assumptions are wrong and you'd like to correct me. Regards, John --

2 1

Increase in SMTP connections?
by J.D. Falk 25 Mar '04

25 Mar '04

Any large-ish mail-receiving sites[1] seeing an increase in SMTP connections this week? I'm not necessarially talking about messages here, just connections. If so, please contact me off-list. Thanks. -- J.D. Falk "be crazy dumbsaint of the mind" <jdfalk(a)cybernothing.org> -- Jack Kerouac [1] if you handle fewer than half a billion inbound messages daily, you ain't anywhere near large-ish by today's standards. sorry.

2 1

Re: Publish or (gulp) Perish
by sgorman1＠gmu.edu 25 Mar '04

25 Mar '04

One of the downsides of peer reviewed journals is that it takes an awfully long time from submission to publication - typically a minimum of a year. In a quick moving area like network operations this can be especially problematic. One great intermediary to this are pre-print archives, especially the Arxiv archive run jointly between Cornell and Los Alamos - http://arxiv.org/ . They have a big computer science section with lots of good stuff. Also as far as journals the new Internet Mathematics is good if a bit more academically geared than operational. ----- Original Message ----- From: Michael.Dillon(a)radianz.com Date: Thursday, March 25, 2004 6:27 am Subject: Re: Publish or (gulp) Perish > > >> Powerpoints have a hard time matching the depth of a refereed > journal>> submission, because with the powerpoint, soundbites tend > to take > >> precedence over content. > > >Attention to sidebar on page 192 of the Columbia Accident > >Investigation Board report entitled "Engineering by Viewgraphs": > >http://www.nasa.gov/columbia/caib/PDFS/VOL1/PART02.PDF > > Everybody who makes slide presentations should read this. > I know it has influenced me in trying to make my presentations > clearer and shorter and more precise. If you read nothing > else from the report, have a look at this slide reproduced > below as close as possible to the way it originally appeared > including line breaks and bulleted indentation: > > > Review Of Test Data Indicates Conservatism for Tile > Penetration > --------------------------------------------------- > > * The existing SOFI on tile test data used to create Crater > was reviewed along with STS-107 Southwest Research data > - Crater overpredicted penetration of tile coating > significantly > * Initial penetration to described by normal velocity > - Varies with volume/mass of projectile(e.g., 200ft/sec for > 3cu. In) > * Significant energy is required for the softer SOFI particle > to penetrate the relatively hard tile coating > - Test results do show that it is possible at sufficient mass > and velocity > * Conversely, once tile is penetrated SOFI can cause > significant damage > - Minor variations in total energy (above penetration level) > can cause significant tile damage > - Flight condition is significantly outside of test database > * Volume of ramp is 1920cu in vs 3 cu in for test > > The Columbia investigators zeroed in on the words "significant" > and "significantly" used 5 times on the slide with meanings varying > from "detectable in largely irrelevant calibration case study" > to "an amount of damage so that everyone dies" to "a difference > of 640-fold." None of these 5 usages appears to refer to the > technical meaning of "statistical significance." > > They also noted that the low resolution of a slide promotes > the use of compressed phrases like "Tile Penetration" whose > meaning can be ambiguous and usually is never defined. > > The slide alludes to the idea of damage to the tiles > but often avoids saying it directly referring to "penetration" > or "it" and using unclear sentence fragments. > > If you do want to see the original it is on page 95 of the > PDF file linked above. > > --Michael Dillon > > > > >

1 0

EOF, Amsterdam, May - Call for Presentations
by Daniel Karrenberg 25 Mar '04

25 Mar '04

[apologies for duplicates, hint: they have the same message-id] Hi Network Operations Folk, NOW is the time to consider making a presentation at the European Operators Forum (EOF) to be held during the 48th RIPE meeting in Amsterdam on Monday 3rd and Tuesday 4th of May 2004. We would like to have as many practical, hands-on presentations as possible this time. Remember: They do not have to be long. We prefer an stand-up interesting 10 minute presentation over a well prepared 90 minutes explanation of something not so interesting to operators. Find some information about presenting below and think about all those experiences this year that might be interesting to other operators. Should you have questions, please do not hesitate to contact me by e-mail at any time. Thanks Daniel -------------------------------------------------------------------------- Information about the EOF and presenting there: http://www.ripe.net/ripe/meetings/ripe-48/eof.html Information about the meeting in general: http://www.ripe.net/ripe/meetings/ripe-48/index.html -------------------------------------------------------------------------- Guidelines for submitting abstracts: We expect to finalise the program in shortly. We will get back to you then with scheduling details. In the meantime please provide the information below. We place special emphasis on the abstract which should contain references to related material already available if possible. Please send this to eof-coord at-sign ripe.net. - Author(s) - Speaker - (Working) Title - Abstract - Draft Presentation (if available) - Relation to other known work and/or presentations if known - Time Requested It would be helpful if the abstract was written such that potential attenders will learn what to expect from the presentation, i.e. "The presentation will describe our experiences with the Red Packet Washer (http://www.netdet.net/RPW/) We have been using the device for half a year now. It helps us deliver more hygienic datagrams to our customers and peers. We will discuss problems with packet discolouring as well as increased throughput to our upstreams due to decreased clogging by dirty micrograms. We will compare performance with the hand-scrubbing of packets which we used previously. Currently we are optimising device management and getting bugs resolved. We will strive to include the latest experiences in our report." is much better than "The presentation will describe the Red Packet Washer made by Network Detergents."

1 0

Re: Publish or (gulp) Perish
by Michael.Dillon＠radianz.com 25 Mar '04

25 Mar '04

>> Powerpoints have a hard time matching the depth of a refereed journal >> submission, because with the powerpoint, soundbites tend to take >> precedence over content. >Attention to sidebar on page 192 of the Columbia Accident >Investigation Board report entitled "Engineering by Viewgraphs": >http://www.nasa.gov/columbia/caib/PDFS/VOL1/PART02.PDF Everybody who makes slide presentations should read this. I know it has influenced me in trying to make my presentations clearer and shorter and more precise. If you read nothing else from the report, have a look at this slide reproduced below as close as possible to the way it originally appeared including line breaks and bulleted indentation: Review Of Test Data Indicates Conservatism for Tile Penetration --------------------------------------------------- * The existing SOFI on tile test data used to create Crater was reviewed along with STS-107 Southwest Research data - Crater overpredicted penetration of tile coating significantly * Initial penetration to described by normal velocity - Varies with volume/mass of projectile(e.g., 200ft/sec for 3cu. In) * Significant energy is required for the softer SOFI particle to penetrate the relatively hard tile coating - Test results do show that it is possible at sufficient mass and velocity * Conversely, once tile is penetrated SOFI can cause significant damage - Minor variations in total energy (above penetration level) can cause significant tile damage - Flight condition is significantly outside of test database * Volume of ramp is 1920cu in vs 3 cu in for test The Columbia investigators zeroed in on the words "significant" and "significantly" used 5 times on the slide with meanings varying from "detectable in largely irrelevant calibration case study" to "an amount of damage so that everyone dies" to "a difference of 640-fold." None of these 5 usages appears to refer to the technical meaning of "statistical significance." They also noted that the low resolution of a slide promotes the use of compressed phrases like "Tile Penetration" whose meaning can be ambiguous and usually is never defined. The slide alludes to the idea of damage to the tiles but often avoids saying it directly referring to "penetration" or "it" and using unclear sentence fragments. If you do want to see the original it is on page 95 of the PDF file linked above. --Michael Dillon

1 0

Re: Publish or (gulp) Perish
by Michael.Dillon＠radianz.com 25 Mar '04

25 Mar '04

>I'm leaving off "news" publications like Light Reading and Network World. >Any thoughts? Have NANOG powerpoint presentations made these sorts of >journals obsolete? :) My favorite journal is the NANOG slide presentations. They are nice abstracts of someone's work, much better than the traditional journal abstract, and they almost always contain a URL that takes you to the author's website where you can download full papers and see the author's other work. Then it's off to citeseer which has recently moved to http://citeseer.ist.psu.edu/ There I can track down references and work by co-authors. --Michael Dillon

3 2

Re: Publish or (gulp) Perish
by Randy Bush 25 Mar '04

25 Mar '04

[ mark had posting problems and asked me to post for him ] To: Randy Bush <randy(a)psg.com> From: Mark Allman <mallman(a)icir.org> Reply-To: mallman(a)icir.org cc: "Matthew F. Ringel" <ringel(a)net.tufts.edu>, nanog(a)merit.edu Subject: Re: Publish or (gulp) Perish We are soliciting papers for an upcoming workshop on network troubleshooting (to be co-located with ACM SIGCOMM this year). We'd **love** to create a bit of synergy between the operator and research communities. The PC has some nanog folk. I hope everyone will consider writing a short paper or proposing a poster to be presented. The deadline for registering papers is 4/8 (basically providing the names of the authors and a very short abstract). The submission deadline for papers is 4/15. The call for papers is at: http://www.icir.org/mallman/NetTs/ The submission site is not quite ready, but will be linked from the above when it is (next week sometime). If you have questions, please direct them to trouble04-chairs(a)icir.org (which hits myself and Jon Bennett). Thanks! allman -- Mark Allman -- ICIR -- http://www.icir.org/mallman/

1 0

Broadwing opinions
by Steve Francis 25 Mar '04

25 Mar '04

Anyone care to share opinions on broadwing as an upstream? Responsiveness/cluefulness of noc and how well they manage their infrastructure (in terms of good change management, etc.) would be good to know. Thanks

2 1