- Test - lists.nanog.org

here are some postfix patterns i found useful today
by Paul Vixie 31 Jan '04

31 Jan '04

what you do is, install postfix 2.0 or later, set header_checks to some filename (in your main.cf), and in that file, you put the following: /^Subject: Anti-Virus Notification/ REJECT av01 /^Subject: BANNED FILENAME/ REJECT av02 /^Subject: File blocked - ScanMail for Lotus/ REJECT av03 /^Subject: InterScan NT Alert/ REJECT av04 /^Subject: Message deleted/ REJECT av05 /^Subject: NAV detected a virus)/ REJECT av06 /^Subject: Norton AntiVirus detected/ REJECT av07 /^Subject: RAV AntiVirus scan/ REJECT av08 /^Subject: Symantec AntiVirus/ REJECT av09 /^Subject: VIRUS (.*) IN MAIL FROM YOU/ REJECT av10 /^Subject: VIRUS IN YOUR MAIL/ REJECT av11 /^Subject: Virus Detected by Network Assoc/ REJECT av12 /^Subject: Virus Notification:/ REJECT av13 /^Subject: Virus found in a message you sent/ REJECT av14 /^Subject: Virus found in sent message/ REJECT av15 i guess this isn't something you can cut&paste into an IOS box, but it's sure saving my ass here today, so i thought i'd share. i'm getting MUCH MORE E-MAIL TRAFFIC today from antivirus adware servers than from worms. see also <http://www.attrition.org/security/rant/av-spammers.html>.

1 0

AOL web troubles.. New AOL speedup seems to be a slowdown
by Nicole 30 Jan '04

30 Jan '04

Any AOL people around? In the past few days our AOL users have been reporting serious problems accessing images to their accounts on our picturesharing site Picturetrail.com The images show up as broken images (red x) in their browsers about 30% of the time. They also report almost total failure when trying to upload images to their accounts. We however are seeing a slow AOL low data network that we feel is causing the problems. We have not received any such complaints from non-aol users. We have replicated the problems using our AOL test accounts. No such problems occur when using a non-AOL internet connection. Below is the traceroute from an AOL users IP to the Abovenet datacenter in San Jose California where our servers are located. I just heard that they are now offering some new speedup technology.. Hence probobly more web caching. Anyone else having these types of issues? And 20 hops to get to a proxy.. at that speed? traceroute to 64.12.96.107 (64.12.96.107), 30 hops max, 40 byte packets 1 inside.fw1.sjc2.mfnx.net (208.184.213.129) 0.359 ms 0.276 ms 0.427 ms 2 99.ge-5-1-1.er10b.sjc2.us.above.net (64.124.216.11) 0.529 ms 0.564 ms 0.538 ms 3 so-1-0-0.mpr3.sjc2.us.above.net (64.125.30.97) 0.547 ms 0.581 ms 0.578 ms 4 so-0-0-0.pr1.sjc2.us.above.net (64.125.30.30) 0.594 ms 0.708 ms 0.572 ms 5 sl-gw19-sj-3-0.sprintlink.net (144.228.44.145) 1.146 ms 1.185 ms 1.114 ms 6 sl-bb23-sj-4-0.sprintlink.net (144.232.0.249) 1.509 ms 1.307 ms 1.227 ms 7 sl-bb24-sj-14-0.sprintlink.net (144.232.3.222) 17.685 ms 16.042 ms 5.352 ms 8 sl-bb20-ana-6-0.sprintlink.net (144.232.20.100) 11.036 ms 11.128 ms 11.208 ms 9 sl-bb24-ana-13-0.sprintlink.net (144.232.1.138) 11.110 ms 12.263 ms 11.081 ms 10 sl-st21-la-14-0.sprintlink.net (144.232.20.126) 14.179 ms 12.567 ms 14.047 ms 11 pop1-las-P5-2.atdn.net (66.185.150.253) 10.689 ms 10.538 ms 10.596 ms 12 bb2-las-P0-0.atdn.net (66.185.137.130) 10.704 ms 10.541 ms 10.737 ms 13 bb2-sjg-P7-0.atdn.net (66.185.152.23) 10.442 ms 10.565 ms 10.469 ms 14 bb1-sjg-P2-0.atdn.net (66.185.153.26) 54.948 ms 125.951 ms 227.168 ms 15 bb1-ash-P14-0.atdn.net (66.185.153.58) 286.153 ms 83.629 ms 83.592 ms 16 bb1-rtc-P4-0.atdn.net (66.185.152.157) 216.817 ms 132.213 ms 201.491 ms 17 pop1-rtc-P14-0.atdn.net (66.185.140.97) 83.479 ms 83.383 ms 83.268 ms 18 dar1-mtc-S0-0-0.atdn.net (66.185.143.114) 83.535 ms 83.708 ms 83.631 ms 19 172.21.44.66 (172.21.44.66) 83.718 ms 83.729 ms 83.749 ms 20 cache-mtc-af06.proxy.aol.com (64.12.96.107) 83.886 ms 83.982 ms 84.020 ms -------------------------------------------------------------------------------- Thanks for any assistance!! Nicole

8 11

RE: CIsco 7206VXR w/NPE-G1 Question
by Matt Ryan 30 Jan '04

30 Jan '04

The Juniper software is great, very stable under testing (for 2 weeks in the lab). But as with all routers there are pro's and con's and it also has some issues. What is unfortunate is that the poster runs (by their own admission) neither Cisco or Juniper in their network and yet make unfounded claims about the performance of the Juniper under any conditions. Clearly this will never be true as the cost of developing such a box would be prohibitive and the delivery timescales far too long. I'm as happy as the next person to give Cisco a bashing but I also like to see some balance when unrealistic claims are made. Matt. -----Original Message----- From: Alex Yuriev [mailto:alex@yuriev.com] Sent: 30 January 2004 14:45 To: Matt Ryan Cc: nanog(a)merit.edu Subject: RE: CIsco 7206VXR w/NPE-G1 Question > It's not the Cisco bashing I was referring to, but the all singing all > dancing Juniper performance claim. That would not have anything to do with Juniper sucking the least? Alex ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

1 0

RE: CIsco 7206VXR w/NPE-G1 Question
by Matt Ryan 30 Jan '04

30 Jan '04

It's not the Cisco bashing I was referring to, but the all singing all dancing Juniper performance claim. Matt. -----Original Message----- From: Petri Helenius [mailto:pete@he.iki.fi] Sent: 30 January 2004 17:43 To: Matt Ryan Cc: nanog(a)merit.edu Subject: Re: CIsco 7206VXR w/NPE-G1 Question Matt Ryan wrote: >Do you get commission from Juniper? > > > Where do I get my comission then? I´ve described inferior product as such many times and so far I haven´t seen deposits from vendors in my bank account? !!OT warning!! Pete ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

3 2

RE: CIsco 7206VXR w/NPE-G1 Question
by Matt Ryan 30 Jan '04

30 Jan '04

Do you get commission from Juniper? Matt. -----Original Message----- From: alex(a)pilosoft.com [mailto:alex@pilosoft.com] Sent: 30 January 2004 16:51 Cc: nanog(a)merit.edu Subject: RE: CIsco 7206VXR w/NPE-G1 Question Keep in mind, 72xx is still flow-based, so you need to count *both* shared fabric capacity (aka PCI buses) and capacity of NPE to establish flows (aka pps rate). NPE-G1 might probably route 3*GE, without any services and if all 3GE are in a single flow, but will melt down at a face of one-packet-per-flow DDoS (read: "Nachi" worm) at a far lower rate (I'd be surprised if it sustains 200kpps DDoS traffic, which can be as low as 150Mbit bandwidth). That is of course, as opposed to Juniper, which is truly line-rate at any interface, with any services, at any composition of traffic. -alex On Fri, 30 Jan 2004 Jack.W.Parks(a)alltel.com wrote: > > Does anyone have definitive speed results on the 3 "built-in" Gig ports > on the NPE-G1? I know that they aren't attached to the PCI Buses, and > don't consume bandwidth points, but all of that is mute. Can all three > of the ports do line rate Gig? The Gig PA is limited to 400Mbps. I > have seen posts that allude to the fact the max throughput on the 3 Gigs > are 800Mbps. It's is like a big mystery that cannot be solved. With a > "J" M7i, I know I'm going to get line rate per port up to the total > forwarding capacity of the FPC. > > We are trying to create a comparison matrix and any info you have would > be great. > > Jack > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Simon Hamilton-Wilkes > Sent: Friday, January 30, 2004 9:36 AM > To: nanog(a)merit.edu > Subject: RE: CIsco 7206VXR w/NPE-G1 Question > > > > One more interesting feature - if you need a 4th GigE port, you can add > the GigE I/O card which still uses none of the bus bandwidth points. > The buses are fine for OC3 and below... > > > Simon > > **************************************************************************** ************** > The information contained in this message, including attachments, may contain > privileged or confidential information that is intended to be delivered only to the > person identified above. If you are not the intended recipient, or the person > responsible for delivering this message to the intended recipient, ALLTEL requests > that you immediately notify the sender and asks that you do not read the message or its > attachments, and that you delete them without copying or sending them to anyone else. > ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

3 2

RE: CIsco 7206VXR w/NPE-G1 Question
by sthaug＠nethelp.no 30 Jan '04

30 Jan '04

> Keep in mind, 72xx is still flow-based, so you need to count *both* shared > fabric capacity (aka PCI buses) and capacity of NPE to establish flows > (aka pps rate). Why do you say it is flow-based? You *do* use CEF, don't you? In which case 7200 with NPE-G1 is a prefix-based architecture, with software forwarding. > NPE-G1 might probably route 3*GE, without any services and if all 3GE are > in a single flow, but will melt down at a face of one-packet-per-flow DDoS > (read: "Nachi" worm) at a far lower rate (I'd be surprised if it sustains > 200kpps DDoS traffic, which can be as low as 150Mbit bandwidth). It's the pps that counts, not whether it is one packet per flow or many. We actually tested NPE-G1 a bit today with small (64 byte) packets, and we reached considerably higher pps numbers. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

2 1

updated root hints file
by Coppola, Brian 30 Jan '04

30 Jan '04

In preparation for tomorrow morning's B-root IP change from 128.9.0.107 to 192.228.79.201 we have posted updated root hints files. They are available from the following URLs: ftp://rs.internic.net/domain/db.cache ftp://rs.internic.net/domain/named.cache ftp://rs.ineternic.net/domain/named.root and will be available from: ftp://ftp.internic.net/domain/db.cache ftp://ftp.internic.net/domain/named.cache ftp://ftp.ineternic.net/domain/named.root Brian Brian Coppola Manager, Resolution Systems Verisign Operations and Infrastructure (O&I)

14 17

RE: CIsco 7206VXR w/NPE-G1 Question
by Simon Hamilton-Wilkes 30 Jan '04

30 Jan '04

One more interesting feature - if you need a 4th GigE port, you can add the GigE I/O card which still uses none of the bus bandwidth points. The buses are fine for OC3 and below... Simon

1 0

RE: Misplaced flamewar... WAS: RE: in case nobody else noticed it, there was a mail worm released today
by Michel Py 30 Jan '04

30 Jan '04

> kenw(a)kmsi.net wrote: > But, regardless, Win2K and WinXP do have restricted-user > modes that tie this stuff down quite well. They tend to > be used in corporate environments. Indeed, and the one reason being that the last thing the IT staff wants is users installing apps, because even if the user is not installing a worm or Trojan, installing software inevitably generates incompatibilities and demand for more support. > But for home users, it gets to be a pain in the butt, > because it prevents a lot of things users want to do, > like installing games, multimedia apps and spyware. Yep. In XP home, it's easy to have several users on the same machine but by default they all have administrative rights. > doug(a)nanog.con.com wrote: > Microsoft software is inherently less safe than > Linux/*BSD software. > This is because Microsoft has favored usability > over security. > This is because the market has responded better > to that tradeoff. > This is because your mom doesn't want to have to > hire a technical consultant to manage her IT > infrastructure when all she wants to do is get > email pictures of her grandkids. Exactly. Michel.

4 3

Re: An analysis.
by Michael.Dillon＠radianz.com 30 Jan '04

30 Jan '04

>Which one of you guys took down the world? >We have separate carriers for internet, ATM, and Phone Whenever you get simultaneous outages for multiple telecom services at the same time it's almost always due to a local issue like a major cable cut or a central office fire. Sounds like a SONET ring that was either unprotected or both legs cut. After 10 minutes someone manually rerouted the circuits. --Michael Dillon P.S. Larry, what do you think? Leading by example?

1 0