- Test - lists.nanog.org

GlobalCrossing issues in NYC around 17:00 EDT
by alex＠yuriev.com 15 May '03

15 May '03

Did anyone notice anything starange in GlobalCrossing network around 17:00 EDT today (especially in NYC)? I am staring at 30% traffic drop in a period of under 10 minutes... Alex

2 1

Re: identity theft != spam
by Steven M. Bellovin 15 May '03

15 May '03

In message <E19GMJA-0001Em-90(a)roam.psg.com>, Randy Bush writes: > > >this exemplifies the corporate and legislative attempt to confuse >spam == uce with forgery. if they can make the latter the issue, >this leaves the way completely clear for unsolicited commercial >email from the corporate sector which now fills our post boxes with >ground trees. > >randy > This is actually a follow-on to an article in the 7 May Wall Street Journal (http://online.wsj.com/article/0,,SB105225593382372600-search,00.html?collec… if you subscribe). A brief summary is that Earthlink was going crazy trying to stop his spam because of his other activities. Other mechanisms, like yanking his account for violating the AUP, were ineffective because of the identity thefts. Of course, I'm sure that no one on this list is surprised to hear that spammers break the law.... --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

1 0

Club-Internet/T-Online France
by Dan Hollis 15 May '03

15 May '03

Anyone have a clueful abuse contact at Club-Internet/T-Online France? The abusedroids there apparently dont believe they are responsible for the 212.194.0.0 - 212.194.191.255 netblock. -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

2 1

Is latency equivalent to RTT?
by Michael.Dillon＠radianz.com 15 May '03

15 May '03

Has it become common usage to define latency in an IP network as the round trip time in that network? I've always considered latency to be a one-way measure of delay and RTT to be the sum of the latencies in both directions. When I tried to find something to back up this view, I discovered that a number of companies define latency as equivalent to RTT in their SLAs. Assuming that one has measuring devices in every PoP, do you think it is harder to measure a full matrix of one way latency compared to measuring a full matrix of RTT? Does it even make sense to measure a full matrix of RTT when the measurement of A to B to A should be equivalent to the measurement of B to A to B? --Michael Dillon

6 5

Clocking Sources (was NTp sources that work in a datacenter (was Re: Is latency equivalentto RTT?))
by Spinka, Kristofer 14 May '03

14 May '03

The actual clock source, the time pulses, produced by BITS (Building Integrated Timing Systems) are not usually just a "re-feed" of the GPS source. Instead, contained within the clock system, BITS device, is some sort of highly resolvable, measurable, predictable, stable, oscillator such as Cesium, Rubidium or Quartz, depending on your budget. The GPS signal, being transmitted from orbiting Cesium clocks, is used to "discipline" or prevent your local oscillator drift from degrading your time code. This basically means that if the oscillator installed in the unit is supposed to oscillate exactly 10,255,432 times per second, and an interal or external condition has now caused it to oscillate at 10,255,434 times per second, your pulse generator will account for this and keep your time code stable. These GPS satellites have Cesium oscillators that drift also, and are in turn disciplined themselves against the "USNO Master Clock", which is an average time code calculated from a slew of cesium atomic and hydrogen maser clocks. So, why can't an entire bulding share the same GPS discipline source? It would save some roof space and money. If you are worried about someone kicking the antenna over, just make sure that your oscillator is reasonable enough to maintain your necessary accuracy without external discipline while they glue the antenna back on. For most applications a high quality, stable quartz based oscillator will be more than sufficient and is the least expensive. If you need to get fancy, and depending on your internal and external condition variables, the general rule is: Quartz < Rubidium < Cesium. /kristofer

1 0

Re: Is latency equivalent to RTT?
by Michael.Dillon＠radianz.com 14 May '03

14 May '03

>> Assuming that one has measuring devices in every PoP, do you think it is >> harder to measure a full matrix of one way latency compared to measuring a >> full matrix of RTT? >Your problem with 1-way is finding a way to do it thats reliable, for rtt ping >is about as simple as you can get and works a treat but for 1-way you have to be >a bit more creative.... I assume that it's fairly common for people to have Solaris or Linux boxes in every PoP to do measurements. In that case, the difficulty isn't in measuring one-way latency, it's in synchronizing the time on all the servers. And with fairly cheap GPS and CDMA clocks that is a lot easier/cheaper than it once was. I really think that there are a lot of people out there who do not understand that RTT is not the same thing as two times the one-way latency. In other words if you measure (A-to-B + B-to-A) / 2 then you have failed to learn anything about one-way latency on either path A-to-B or B-to-A. Yet that's precisely what people are doing when they measure RTT and then assume that RTT/2 is equal to the one-way latency A-to-B. --Michael Dillon

10 10

MFN fiber cut (Boston)?
by Scott Francis 14 May '03

14 May '03

I've been hearing things from various different folks around the Net (Hosting.com/ALGX) about a fiber cut in Boston yesterday (which may or may not be related to some kind of issue with an MFN/Above.net gateway - traces die at 208.185.139.1). Unfortunately, that is about as much information as I have, and I thought it odd that I hadn't heard anything here about it already (Sean is usually quicker on the fiber news than any other media outlet I know of :)). Anybody else have details, or am I hallucinating again? -- Scott Francis || darkuncle (at) darkuncle (dot) net illum oportet crescere me autem minui

2 1

Re: NTp sources that work in a datacenter (was Re: Is latency equivalent to RTT?)
by Steven M. Bellovin 14 May '03

14 May '03

In message <Pine.LNX.4.44.0305140802170.7544-100000(a)twin.uoregon.edu>, Joel Jae ggli writes: > > >Also if you just need a high level of syncronization between the time on >all your hosts you can just deploy one standalone ntp server, sync it >against public time sources and get everything synced against that. its >probably a 95% solution to most people's timeing needs. > If I recall correctly, NTP assumes that latency = RTT/2. You might make it work well for his application *if* you set up your tree so that your paths are each one hop, or at least symmetric over your network. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

3 2

Re: Fwd: Club-Internet/T-Online France
by Dan Hollis 14 May '03

14 May '03

On Tue, 13 May 2003, Thomas Kuiper wrote: > Well, what kind of abuse? > The whole 212.194.0.0/16 is customer ADSL access > and abuse(a)club-internet.fr works very well. No, it doesn't. The abuse(a)club-internet.fr denied that 212.194.0.0/16 belongs to them, and they told me to "talk to the real provider, not club-internet.fr". -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

4 5

Detection and preferential dropping of high bandwidth unresponsive flows
by Sean Donelan 14 May '03

14 May '03

The IEEE international conference on communications this week has several technical papers of interest to network security, although the most relevant weren't labeled network security. Detection and Preferential Dropping of High Bandwidth Unresponsive Flows by Chatranon, Labrador and Banerjee. Controlling Malicious Sources at Internet gateways by Chhabra, Joh, Saran and Shorey. But there are still issues about loading the bottleneck with even more processing during periods of extreme stress, handling distributed management domains, and handling distributed attacks. Scale affects everything on the Internet, including the response.

1 0