- Test - lists.nanog.org

Circuit for Cisco Long Reach Ethernet
by Ken Yeo 31 Jan '02

31 Jan '02

What kind of circuit I should order if I want to use Cisco Long Reach Ethernet between two buildings that is 3000 feet? Thanks. Suan Jong Yeo Network Engineer Aurum Technology

1 0

RE: SlashDot: "Comcast Gunning for NAT Users"
by Daniel Senie 31 Jan '02

31 Jan '02

At 01:59 PM 1/31/02, Steven J. Sobol wrote: >On Thu, 31 Jan 2002, Greg Pendergrass wrote: > > > It doesn't make sense that an ISP should complain that customers use > 100% of > > what they pay for. > >So you think that dialup users should be allowed to stay online 24/7 for >$20/month on an account advertised as unlimited? If not, then the use of the word "unlimited" is more than a bit misleading, no? Be careful what you market, as people (and the FTC) will be happy to hold you to your word. ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com

1 0

Re: Fwd: SlashDot: "Comcast Gunning for NAT Users"
by Conrad A. Rockenhaus 31 Jan '02

31 Jan '02

Rowland, Alan D" <alan_r1(a)corp.earthlink.net> said: > > I've seen a lot of good responses since this post but none that points out > the obvious, most broadband providers offer 'residential' and 'business' > products. The former at ~$50/month for a 'single connection,'the latter for > ~$120/month including most of the services at issue in this thread. You get > what you pay for. Yes this is true. However, you have some Broadband ISPs (RR, Speakeasy) that will offer additonal ips for an extra fee without having to pay for business access. Many broadband ISPs also do not offer business access to residential areas. Everytime I've asked one, they couldn't give me a good reason why. > > Some day case law will catch up to this new media enough that when a > 'residential' service customer seeks remedy for $X,000 in 'lost business' > the defense will be that if they want a 'business' connection, then that is > what they should have signed up for/been paying for. Exactally. However, that's why you have a "Service Level Agreement." Can't really win a lawsuit that easily without on, one either side. I don't know if many broadband providers offer a SLA for business connections as well, unless its something more economical to provide a SLA for, such as a T-1. I do know when I signed up for a business cable modem once, it said in fine print on the contract "You will not hold RoadRunner responsible for down time due to network issues, etc." I'm pretty sure most broadband providers stick a clause like that into the contract. > > When 1% of your users are sucking down %50+ of your bandwidth you may need > to discuss AUPs with that 1%. Don't expect your shareholders to cut you any > slack on this issue. > How could 1% of your users suck down %50+ of bandwidth in such a scenario? Even though they are running NAT, they only have one address, one MAC address from the cable modem, and one system doing the rate limiting off of that ip/mac address. When someone's running NAT, the bandwidth is distributed between the users behind the NAT device. If someone's assigned 512K, they can only use up to 512K, be it one computer, or several behind a NAT device. --conradr > -Al > > Just my 2¢, feel free to use your delete key. > > -----Original Message----- > From: Martin J. Levy [mailto:mahtin@mahtin.com] > Sent: Thursday, January 31, 2002 7:58 AM > To: nanog(a)merit.edu > Subject: Fwd: SlashDot: "Comcast Gunning for NAT Users" > > > > > I got this forwarded to me. I'm not impressed. > > Based upon the general desire for providers to have NAT'ed users and to > reduce IP-space usage where appropriate, does this make sense? I can > understand the providers desire to increase revenue, but I don't believe > this is a good way to do it. > > Besides the technical difficulties of detecting a household that is running > a NAT'ed router, why not win over the customer with a low-cost extra IP > address vs: the customers one-time hardware cost for the router. There are > people who would be willing to pay some amount monthly vs: (let's say) $100 > for a NAT box. > > Does anyone know what percentage of home broadband users run NAT? Does > anyone have stats for IP-addresses saved by using NAT? > > Martin > > ------ Forwarded Message > From: Ward Clark <ward(a)joyofmacs.com> > Date: Sat, 26 Jan 2002 15:00:32 -0500 > To: "NetTalk" <nettalk(a)sustworks.com> > Subject: SlashDot: "Comcast Gunning for NAT Users" > > Today's MacInTouch links to a report that appeared in SlashDot on > Thursday: > > "A co-worker of mine resigned today. His new job at Comcast: Hunting down > 'abusers' of the service. More specifically, anyone using NAT to connect > more than one computer to their cable modem to get Internet access- > whether or not you're running servers or violating any other Acceptable > Use Policies. Comcast has an entire department dedicated to eradicating > NAT users from their network. ... did anyone think they'd already be > harassing people that are using nothing more than the bandwidth for which > they are paying? ..." Earthlink and Comcast have both been advertising > lately their single-household, multi-computer services (and additional > fees) -- probably amusing to many thousands of broadband-router owners, > at least until the cable companies really crack down. > > There's a huge number of responses (691 at the moment), which I quickly > scanned out of curiosity. I'm not a Comcast or Earthlink user. > > You can start here: > > http://slashdot.org/articles/02/01/24/1957236.shtml > > -- ward > > > -------------------- > To unsubscribe <mailto:requests@sustworks.com> with message body > "unsubscribe nettalk" > > ------ End of Forwarded Message >

2 1

Re: representativeness of flow data based on samples
by Jennifer Rexford 31 Jan '02

31 Jan '02

> There are a few vendors who now provide traffic export from high-speed > interfaces by sampling those interfaces at a particular rate, and > using the sampled packets to populate the per-flow counters, rather > than looking at every packet. Folks might be interested in the Internet Draft on "A framework for passive packet measurement" that focuses on packet sampling. See http://www.ietf.org/internet-drafts/draft-duffield-framework-papame-00.txt There's a public mailing list at listname : psamp(a)ops.ietf.org subscribe: psamp-request(a)ops.ietf.org (with "subscribe" as the message) archive : https://ops.ietf.org/lists/psamp/ The goal is to define a minimal set of requirements that need to be supported in routers (or line cards) to meet the needs of folks that operate networks. Feedback more than welcome! -- Jen

1 0

distributed attack, high or not
by Joseph T. Klein 31 Jan '02

31 Jan '02

I saw what appears to be a distributed attack against a single IP address that reached nearly 500Mbs. I was thinking that this is high. Are people seeing any random attacks of this magnitude? -- Joseph T. Klein jtk(a)titania.net

4 3

Re: representativeness of flow data based on samples
by Mark Allman 31 Jan '02

31 Jan '02

> Does anybody here know of recent research with real internet > traffic which compares different sample rates wrt the > representativeness of the resulting flow data? You might take a look at: Nick Duffield, Carsten Lund, Mikkel Thorup. Charging from Sampled Network Usage. ACM SIGCOMM Internet Measurement Workshop, November 2001. http://www.icir.org/vern/imw-2001/imw2001-papers/03.pdf It may be along the lines your thinking about. allman --- Mark Allman -- BBN/NASA GRC -- http://roland.grc.nasa.gov/~mallman/

1 0

Re: WEF cyber-protest (was Re: distributed attack, high or not)
by Steven M. Bellovin 31 Jan '02

31 Jan '02

In message <Pine.GSO.4.40.0201310238250.16671-100000(a)clifden.donelan.com>, Sean Donelan writes: > >We're entering protest season. The World Economic Forum opens >today in New York City. Some protesters have launched what they >call a cyber-protest using several different tools. So far it >appears directed at a few selected, although well-known, corporations. > >http://www.geocities.com/net_strike_net/english_active.html > Right -- but an attack that lasts exactly an hour is much more like a zombie-based DDoS tool. Of course, the two aren't mutually exclusive. --Steve Bellovin, http://www.research.att.com/~smb Full text of "Firewalls" book now at http://www.wilyhacker.com

1 0

representativeness of flow data based on samples
by Joe Abley 31 Jan '02

31 Jan '02

Traffic measurement techniques such as NetFlow work by associating some characteristics of inbound packets on an interface with a flow, e.g. some tuple like (source addr, source port, dest addr, dest port, protocol). Counters per flow are incremented, and the numbers are exported periodically or when flows become inactive. There are a few vendors who now provide traffic export from high-speed interfaces by sampling those interfaces at a particular rate, and using the sampled packets to populate the per-flow counters, rather than looking at every packet. Does anybody here know of recent research with real internet traffic which compares different sample rates wrt the representativeness of the resulting flow data? For example, if I am trying to rank the top traffic sinks for my network beyond an attached peer (i.e. an ordinal rather than cardinal measurement), will I get different answers if I use a sampling rate of 1:1000 compared to 1:50, given a statistically "long enough" measurement period? Intuitively, it seems to me that the answers should be the same. However, it also seems to me that statistics are frequently non- intuitive. Joe

3 2

Re: distributed attack, high or not
by Joseph T. Klein 31 Jan '02

31 Jan '02

I define it as random because the traffic rise could be seen coming in from multiple providers and looked to be the same percent from all sources (separate routers with separate interfaces to separate ASNs in separate geographic locations). The traffic was inbound and not backsplash from randomized source addresses. It looks to me like a infection with someone turning a control knob. Is this common or a precusor of a bad thing? The anomaly was exactly one hour long. First I have seen of something like this in a relativly short time of gathering stats ... which I'm doing for another project. --On Thursday, 31 January 2002 02:09 +0000 Avleen Vig <lists-nanog(a)silverwraith.com> wrote: > On Thu, 31 Jan 2002, Joseph T. Klein wrote: > >> I saw what appears to be a distributed attack against a single IP >> address that reached nearly 500Mbs. I was thinking that this is >> high. Are people seeing any random attacks of this magnitude? > > Please define random :) > If you mean the source is random, then yes this attack is of a high > magnitude and I've seen one other this bad. > The addresses could be real, or spoofed - depending on the circumstance > and exact nature of the attack it'll vary. > > If you mean the target appears to be random, then you're probably just > very very unlucky :( > Attacks of this size are normally aimed at large IRC servers or large / > popular websites. > > -- > Avleen Vig > Network Security Officer > Smurf Amplifier Finding Executive: http://www.ircnetops.org/smurf -- Joseph T. Klein jtk(a)titania.net

1 0

RE: distributed attack, high or not
by LeBlanc, Jason 31 Jan '02

31 Jan '02

juno2? > -----Original Message----- > From: Joseph T. Klein [mailto:jtk@titania.net] > Sent: Wednesday, January 30, 2002 4:12 PM > To: nanog(a)merit.edu > Subject: distributed attack, high or not > > > > I saw what appears to be a distributed attack against a single IP > address that reached nearly 500Mbs. I was thinking that this is > high. Are people seeing any random attacks of this magnitude? > -- > Joseph T. Klein > jtk(a)titania.net >

1 0