- Test - lists.nanog.org

RE: New NAP Opening in Miami this week
by Sean Donelan 29 Jun '01

29 Jun '01

On Thu, 28 June 2001, "Daniel Golding" wrote: > Very little in Florida is much above sea level, especially in coastal areas. > 32 feet is plenty to avoid flooding, and the building is extremely solid, > and is certainly capable of surviving a storm surge. Of course, the many > structures in between the NAP and the beach would help with that as well. > It's not like the facility is actually on the beach. It's about two blocks > from the Miami Arena. I had equipment co-located in Florida during Hurricane Andrew. I didn't loose connectivity throughout the entire storm. The problem with having the well constructed building, great communications facilities and a backup generator? FEMA took over the building for about three weeks to use as their county emergency operations center. It makes sense, but I didn't think to check if the public library building was also a designated emergency shelter. Building a NAP is much like outrunning a bear, you don't have to be the fastest runner. Just faster than the other guy. It upsets the accountants, but there is not a fixed standard for NAPs. Locating the first NAP in a parking garage may not have been a problem. During its life-time, I never heard of a single problem at MAE-East due to it being located in a parking garage. All the problems could have occurred anywhere it was located. But as other people improved their exchange points, the bar was raised for everyone. As long as all the other NAPs in Florida are lower than 32 feet, it doesn't matter. If not, we'll get to add to the list of underwater "carrier-grade" facilities like Rochelle Park, NJ and East Houston, TX.

1 0

unscientific multi-homing survey: results
by Joe Abley 29 Jun '01

29 Jun '01

Results of my unscientific straw poll for multi-homed operators, as requested by a few people. Some people gave multiple answers to questions, and some didn't answer particular questions at all. Figures in brackets indicate frequency of particular responses. Like I said, unscientific :) Thanks to those who sent me mail. Joe On Tue, Jun 26, 2001 at 09:15:09AM -0400, Joe Abley wrote: > If you currently multi-home between two or more providers using IPv4: > > + why do you do it? What are the high-level goals you are hoping to achieve? > Are you finding that you are achieving them? redundancy (3) load-balancing (2) "shorter paths", performance, better throughput for users (4) geographic redundancy (2) provider redundancy (3) we are achieving these objectives (7) > + how often does your traffic shift between transit providers due to > a failure of some kind triggering a re-homing? a couple of times per day (1) once per week (1) once per month (1) a couple of times per month (2) we don't notice when it shifts (1) rarely (1) once per six months per circuit (1) > + how often do you manually shift traffic, and why? Just inbound traffic? > Or outbound too? never (1) normally never (1) once per month (1) occasionally (1) when we get complaints from specific netblock/asns that we can fix (1) when we need to due to transient heavy traffic loads (e.g. a promotion) (1) rarely (three or four times a year) (1) to rebalance costs after some kind of DoS attack (1) (never) because we are overprovisioned with capacity and traffic shifting isn't necessary (1) to optimise use of various peering links (1) manually setting best paths for various ASes (where BGP doesn't see the best path) (1) to avoid some specific poor connectivity on a short path (1) both inbound and outbound (2) > + what impact does a manual or automatic shift in traffic between providers > have to your users? Do their TCP sessions break? Or do you think they > normally stay alive, maybe after a delay? What makes you think this? people don't normally notice the transition (1) transparent if done right (1) stuff breaks a bit, but most TCP sessions remain up (1) minimal impact (1) for 90% of people the sessions sit for a while and then resume, based on feedback in a support forum (1) there is a several minute delay as the BGP tables across the internal core routers adjust (1) VPN users get kicked out when there is a transition, since we don't have provider-independent space and the addresses associated with the down provider become unreachable (1) most traffic is HTTP which is not really affected as long is there isn't too much flapping (1) assume all drop and take any that don't as a bonus (1) no detectable effect (1) we have never had a ticket opened which resolved to TCP session breakage due to a re-homing transition (1) > + what is *bad* about the way that multi-homing works in IPv4? need more control of incoming traffic (1) hard to limit incoming via upstream, although outgoing preference is easy (1) nothing that needs fixing at layer 3 (1) withdrawing and advertersing routes socks the network too much (1) synchronisation takes too long, and sucks up too much router cpu (1) nothing (1) bgp is unintelligent, and requires too much manual tweaking to find the "best" route (1) finding providers which will let you multi-home is hard (1) needing provider-independent address space (1) it can get ugly (1) router vendors need to make more boxes with more memory (1) i would like to have confidence in using RRs more (1) having to trust and cooperate with your peers (1) bgp convergence sucks (1) > + what is good about it? it works (4) it can be done using lots of devices "besides just cisco" (1) it's pretty obvious how it works, and even level-1 ticket takers at backbone providers understand it most of the time (1) it allows us to increase performance, and we like redundancy (1) "The redundancy! The multiple paths! The ability to choose." (1) reliability and shorter paths (1)

1 0

Re: Akamai Servers: Normal or Weird?
by rs＠seastrom.com 29 Jun '01

29 Jun '01

Have you contacted Akamai about this? ---Rob (not speaking for employer) Chris Rapier <rapier(a)psc.edu> writes: > Is something funny happening with them lately or is it normal to see > 45Mbps of UDP traffic between akamai servers (45Mps peak, average for > the past 24 hours is around 15Mbps. Prior to that it wasn't enough to > show up in our graphs). More information: Our akamai farm is the one > recieving all of the data - its coming into our various akamai hosts on > port 1455. > > I've never looked at this traffic before so I don't know if this is > normal or not. I understand that the servers have to talk to each other > to distribute content but why UDP and why consume so much bandwidth? > > Chris

2 1

Re: Cable Modem [really responsible engineering]
by Fletcher E Kittredge 29 Jun '01

29 Jun '01

On Tue, 26 Jun 2001 09:25:08 -0700 Ted Lemon wrote: > > Also, if the cable/dsl/wireless modem is a router, life > > becomes much simpler as one can just gather the necessary information > > via tracing. However, I am not sure requiring modems to be routers is > > a good thing... > > I think you should sit down and read the DOCSIS specifications > carefully before you say things like this. If implemented correctly, > it actually works, believe it or not. The modem does _not_ have to > be a router in order for it to work. Ted; Thank you so much!! I will set right out to do so! regards, fletcher

2 6

Re: Open Peers at PAIX
by Richard A. Steenbergen 29 Jun '01

29 Jun '01

On Thu, Jun 28, 2001 at 10:38:39PM -0700, Christian Nielsen wrote: > > On Thu, 28 Jun 2001, Pete Ashdown wrote: > > > It was neither a cheap nor an easy proposition for us to get our > > router into PAIX. In fact, its probably the most expensive bandwidth > > I run since the DS3 is way under utilized. The main reason I did it > > was to reduce network distance to major peers. My only wish is that > > peering at all exchanges was more open, as it increases their > > usefulness. Finding another peering point where I can get 20+ willing > > peers like PAIX is a struggle. > > if and when paix links to mae-west-ames, you can get a link to the FDDI > exchange. there is always PBNap and MAE-WEST-ATM (tho I dont know the > costs) Didn't he say he was trying to increase the quality of his connectivity? :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 1

Re: New NAP Opening in Miami this week
by owen＠dixon.delong.sj.ca.us 29 Jun '01

29 Jun '01

We have taller speed bumps in Oakland. :-) Owen > --- Larry Diffey <ldiffey(a)technologyforward.com> wrote: > > > > The highest point in Florida is 345 feet (Walton County). > > > > Mountain climbing anyone? > > > > Mountain climbing?!? That's more like pulling in the driveway in North > Georgia. :) > > -Jim P. > > __________________________________________________ > Do You Yahoo!? > Get personalized email addresses from Yahoo! Mail > http://personal.mail.yahoo.com/ >

1 0

RE: ISP's who filter ICMP during DoS?
by Los, Ralph 29 Jun '01

29 Jun '01

Hello all, Absolutely. I have some good answers for you. ::WILLING to filter (0) Savvis - Took them 10 minutes to drop the 254/255 port utilization of ICMP traffic on my T-1 I have from them. Their NOC (hats off to 'Chris') is super-responsive. (1) UUNet - They're helpful, if you can get through to an actual engineer, not a help desk drone...what is WITH these help desk people?? ::CLUELESS (0) PSINet - Sorry guys. Both our T-1's (Savvis and PSINet) on one segment got nailed....the Savvis boys loosened the noose, PSINet (help desk drone) asked me to submit logs to their 'help@' mailbox, wait up to 24-hours for a call back, and they'd go from there. Folks, I work for a financial-services corporation, in 24 hours, I'd lose, what $200 million in business? No wonder they're bankrupt. (Great engineers, less-than-intelligent drones at the 'help desk'). (1) Winstar - /chuckle/. They couldn't find me in their customer database, but by the time they firgured out who I was, I had hung up and cancelled the line. (We got this as a freebie, couldn't complain). (2) AT&T - I can't stand support drones that don't understand what an ICMP flood is, much less know what to do with it. I had to explain to them that ICMP flooding is a DDoS and that I needed someone from engineering. Wow...Kevin couldn't convince this half-wit I conversed with to get me to an engineer. I gave up and just let the router die. Cheers! Ralph M. Los Asst. Vice-President, Internet Systems and Security EnvestNet Advisory Corp. rlos(a)envestnet.com (312) 827-3945 (direct) (312) 296-9003 (wireless w/voicemail) -----Original Message----- From: ASV [mailto:lists-nanog@silverwraith.com] Sent: Thursday, June 28, 2001 5:50 PM To: nanog(a)merit.edu Subject: ISP's who filter ICMP during DoS? Does anyone have a list of which ISPs are willing to filter ICMP packets for you when your network is being (D)DoS'd, and which prefer to simply blackhole / disconnect you, and which will do absolutely nothing?? I'm finding it hard to gather this information and it occured to me that this is an obvious factor when choosing an ISP! Thanks,

2 1

RE: New NAP Opening in Miami this week
by Rowland, Alan D 29 Jun '01

29 Jun '01

I'd venture a significant portion of Florida is a mere 32 feet above sea level. -Al -----Original Message----- From: David Lesher [mailto:wb8foz@nrk.com] Sent: Thursday, June 28, 2001 12:38 PM To: nanog(a)merit.edu Subject: Re: New NAP Opening in Miami this week Unnamed Administration sources reported that Larry Diffey said: > > > > The facility is a whopping 32 feet above sea level! Err... I would say "mere" myself. The bigger question is how far out of reach of a storm surge is it? And is EVERYTHING 32' up? MPOE fiber junctions, power feeds, parking spaces for semi-truck generator? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

7 6

Network Riddle
by Chris Rapier 29 Jun '01

29 Jun '01

So, I've a problem which is probably best though of as a riddle... With an ip matrix containing src/dst ip and ports (of flows, not individual packets) distilled from a 60 second long tcpdump how can you determine who server and who is the client. Restrictions: 1) You cannot assume that you will have access to the syn, syn/ack or close packets. 2) You cannot assume that well known ports are actually well known. Ergo, seeing port 80 does not necessarily indicate the corresponding host is a server. 3) You are only seeing things half duplex. In other words, you only see inbound or outbound traffic at any one time but you can tell if what you are seeing is inbound or outbound. I've been banging my head against a wall with this for a while. None of the solutions I can think of seem terribly good. These include - looking for multiple flows with the same source or dst IP and tracking how many times any one port appears. If it appears in some percentage of the connections then you know that port is stable and probably a server. This doesn't work if you only have one flow. Looking at the size of the packets. If the average size indicates ACKs then you can at least determine directionality. Which may or may not be entirely worthless. Any ideas? Has anyone done anything on this before? Chris Rapier Network Programmer Pittsburgh Supercomputing Center

3 4

ISP's who filter ICMP during DoS?
by ASV 29 Jun '01

29 Jun '01

Does anyone have a list of which ISPs are willing to filter ICMP packets for you when your network is being (D)DoS'd, and which prefer to simply blackhole / disconnect you, and which will do absolutely nothing?? I'm finding it hard to gather this information and it occured to me that this is an obvious factor when choosing an ISP! Thanks,

4 3