- Test - lists.nanog.org

RE: QOS or more bandwidth
by Frank Coluccio 29 May '01

29 May '01

>>>But what QOS features are included in the standard product offerings?<<< Most competitive vendors now provide native and upgrade provisions for QoS in one form or another. The problems most often encountered revolve around multi-vendor cos/qos feature implementation incompatibilities. The "least common denominator features" that are needed for basic interworking usually do not extend to 'differentiating' features that vendors like to hold close to the vest, such as prioritization and cos/qos features. Not without much grief, in any event. It forces one to seriously consider single vendor solutions. fwiw. ------Original Message------ From: Sean Donelan <sean(a)donelan.com> To: nanog(a)merit.edu Sent: May 29, 2001 6:17:46 AM GMT Subject: QOS or more bandwidth While its generally more effective to add more bandwidth than rationing it with QOS, with the recent downturn in capital markets will QOS become more popular? If your budget for bandwidth has been cut, I'm not sure people will have any budget for QOS either. But what QOS features are included in the standard product offerings?

1 0

Re: VPN Solution (WAS: ORBS (Re: Scanning))
by Andy Bradford 28 May '01

28 May '01

Thus said "Patrick W. Gilmore" on Mon, 28 May 2001 01:24:58 EDT: > The VPN solutions I have used (e.g. Bay Networks, MS PPTP) send *every* > packet from the end user machine to the VPN end-point, not just selected > packets (like with SSH tunneling). This should be configureable, if it isn't then maybe it's time for a switch in protocols/software. :-) > So, does anyone know of a VPN that does selective forwarding like SSH > tunneling? FreeS/Wan does this by default. Only traffic defined by the tunnel security association is encrypted, the rest goes through untouched. Very optimal. :-) I don't believe this is specific to FreeS/Wan either, as most IPSEC implementations I have seen do something similar. (including hardware solutions). Andy [-----------[system uptime]--------------------------------------------] 3:43pm up 19 days, 18:20, 6 users, load average: 1.00, 1.01, 1.00

1 0

RE: EMAIL != FTP
by Roeland Meyer 28 May '01

28 May '01

> From: Scott Francis [mailto:scott@virtualis.com] > Sent: Friday, May 25, 2001 4:03 PM > Oh give me a break - is there ANY modern browser that will > not prompt you to > save the file if it does not recognize it as a displayable > format? Your > reasoning is going downhill ... Have you ever setup an Apache web server (or any other)? Create a random binary file and call it something.xyz (or any other extention not defined in your mime-type) and see if ANY browser will load it as something other than garbage.

11 14

RE: Layer4 Re: VPN Solution (WAS: ORBS (Re: Scanning))
by Roeland Meyer 28 May '01

28 May '01

> From: Jon Mansey [mailto:jon@interpacket.net] > Sent: Monday, May 28, 2001 7:37 AM > > Does anyone know of a way to put layer 4 switching in front of a VPN > client such that (for example) email and nntp dont get tunnelled > while everything else does, or vice-versa? Depending on requirements, isn't the whole idea to put the email into the tunnel? That's why this thread came up in the first place. BTW, SSH tunneling can drop every packet through the tunnel with a forward-all config. it isn't even very hard and can be done with a Win client, using F-Secure. In fact, sometimes that works, when PPTP doesn't, in Windows-hostile environments (*nix bigots sometimes do everything they can to screw up Win machines). However, none of it works when port 22 is blocked by the firewall. > We're probably talking Windows software here I know...... > > > > The VPN solutions I have used (e.g. Bay Networks, MS > PPTP) send *every* > >> packet from the end user machine to the VPN end-point, > not just selected > >> packets (like with SSH tunneling). > > If you want a commercial solution that does selective > tunnelling - the > >FW-1 addin (VPN-1) exports a "topography" file to the client > at setup; this > >really consists of a list of subnets that the VPN will > handle, and is set at > >the server side. anything not on the topography list goes > out via the dialup > >adaptor or network card as normal.

1 0

Possible solution? (e-mail parcel vs. FTP)
by E.B. Dreger 28 May '01

28 May '01

Here are my "givens": * Average users cannot, and will not, tolerate FTP * HTTP and FTP are more efficient than SMTP * New protocols (IM2000) might be nice, but we need interoperability * Attachments are usually MIME, with a few uuencoded ones now and then. Methinks that it's proxy time. Why not hack the popular MTAs so that they take attachments, spool them in a Web-accessible directory, then modify the message. Just like e-cards... ATTACHMENTS: 1. http://some.domain.tld/path/to/sample/file.jpg 2. http://another.place.tld/second-attachment.doc Go to the link, receive a warning that they must save the file after download, that it will be deleted after successful download. Or delete it after a few days. Or maybe users could manage their Web spool, deleting messages as they please. There are some details to work out, but is the "FTP upload" not a task that we could automatically perform for users? Eddy --------------------------------------------------------------------------- Brotsman & Dreger, Inc. EverQuick Internet Division Phone: (316) 794-8922 --------------------------------------------------------------------------- Date: Mon, 21 May 2001 11:23:58 +0000 (GMT) From: A Trap <blacklist(a)brics.com> To: blacklist(a)brics.com Subject: Please ignore this portion of my mail signature. These last few lines are a trap for address-harvesting spambots. Do NOT send mail to <blacklist(a)brics.com>, or you are likely to be blocked.

5 5

cnn.com name servers all in one AS
by Daniel Senie 28 May '01

28 May '01

Lookup on cnn.com reveals a response of 4 name servers: NS-01A.ANS.NET 199.221.47.7 NS-01B.ANS.NET 199.221.47.8 NS-02A.ANS.NET 207.24.245.179 NS-02B.ANS.NET 207.24.245.178 All 4 of these are in AS 1673. This situation has existed for a long time. CNN has their actual servers multihomed, and (I think) uses Akamai for content delivery. However, the core name servers remain on a single AS, so any routing problem within that AS, or peering issues affecting that AS will result in CNN.COM disappearing. Microsoft appears to have spread their DNS servers across multiple ASs after their disappearing act a while back. Though I've seen issues with CNN.COM reachability affected by ANS.NET issues as far back as 3 years ago, their DNS strategy remains unchanged. ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com

2 1

RE: Stealth Blocking
by Roeland Meyer 28 May '01

28 May '01

> From: David Schwartz [mailto:davids@webmaster.com] > Sent: Wednesday, May 23, 2001 4:18 PM > > > I'm getting seriously confused here. I thought that the > > open-relay issue was irelevent to MAPS. > > No. I hate to be pendantic here, but from your own email and what other sources have told me, this is inaccurate. MAPS does NOT do pre-emptive open-relay testing. I consider this to be a very important distinction. If I thought this was the case, I would stop using MAPS five minutes ago. > > That MAPS only black-holed confirmed SPAM > > sites (a little > > tougher, but more granular, charter). > > Yes, but open relays can easily become confirmed SPAM > sites. All that has > to happen is one spammer chooses to use that particular open relay. That is orthogonal to the point. > I hope this qualifies as clarification. This was actually the type of post that was muddying the waters quite severely. So no, it does not qualify as clarification. From other sources, and what I originally knew to be true, if MAPS blocks an open-relay, it is entirely incidental to the fact that it was a PROVEN spam origination point. Open relays that are NOT used by spammers never make it into MAPS. Ergo, a site's open-relay status is irrelevent to MAPS. I'm only interested in spanking spammers, not innocents, at any clue level. In the PURE war, one ONLY shoots confirmed bad-guys and has ZERO collateral damage.

13 21

Re: Strange IPSEC activity over UUNet..
by Andy Bradford 27 May '01

27 May '01

Thus said "Craig Holland" on Fri, 25 May 2001 11:01:24 PDT: > have any problems. Then a couple of days ago, my Ricochet connection > stopped working. The only common denominator is any connection that passes > through UUNet/AlterNet doesn't work. Crazy? I dialup to a Telia pop, no I can confirm that there are problems when routing IPSEC traffic through the UUNet/AlterNet networks. At work, I have setup VPNs between our main corporate offices using FreeS/Wan and the setup run without problems for months. Then a few months ago, the routes that were directing the traffic through the broadwing.net network switched to route through UUNet/AlterNet---this essentially killed all VPN traffic. We have been working with our upstream provider to discover what the problem is, but have not yet been successful at determining the problem. > problem. I dial up to a WorldCom POP, no problem. I connect with a Ricochet > (which goes through UUNet in this case)...broken. I dialup to a UUNet > pop...broken. I don't get it. Yep, same for us. Everything is fine until the route goes through UUNet/AlterNet, at which point it drops to almost nothing. > The client reports that it is receiving fragmented packets, and that it > doesn't have the other fragment in its cache. Its almost like the packets > are getting fragmented, and then some of those fragments are getting lost. This also sounds familiar, but I can't confirm this much yet. This basically means that all the packets will have to be retransmitted, however, it only does that intermittently. I have monitored TCP traffic closely and it seems that the Window Size never changes, and in fact, the outgoing queue for traffic on the port (as displayed with netstat -vatn on linux) is very high and very close to the Window Size. In addition, I am seeing a few TCP retransmits of the packets, so apparently something is taking a long time to ACK. Eventually, the stream stalls and just sits there with a full outbound queue (full window). > I've checked all my MTUs and circuits. I've reduced my MTU on the client to > attempt to stop this from happening. I'm running clean as far as I can tell, > and the good connections through other ISPs tells me my system is working > OK. I've pinged my host from the destination network with large packets and > don't lose any. Does anyone have any idea what this might be about? If Same here. I have attempted to reduce the MTU on all of our interfaces, but it doesn't seem to affect anything. ping shows decent latency and even large ICMP packets go through fine (with the exception of a few). As of yet, I don't have any more information, but I'm sure this is something that will have to be fixed because we just can't go forward with a VPN that transfers at 200bps. Andy -- [-----------[system uptime]--------------------------------------------] 2:59pm up 18 days, 17:36, 4 users, load average: 1.07, 1.16, 1.19

1 0

RE: ORBS (Re: Scanning)
by Roeland Meyer 27 May '01

27 May '01

> From: Derek Balling [mailto:dredd@megacity.org] > Sent: Sunday, May 27, 2001 11:20 AM > > At 11:10 AM -0700 5/27/01, Roeland Meyer wrote: > > > I'm not sure I understand this logic: > >> > >> 1.) They test positive for orbs... so they ARE an open relay > >> 2.) That system is using MAPS, which means that there is > some subset > >> of systems the open relay itself rejects mail from > > > >I somehow missed your logic here. A MAPS blocked system is, > by definition > >NOT an open-relay, since it IS MAPS-blocked. Yet, ORBS will > list it as an > >open-relay. I agree, there is a disconnect here. Your second premis > >invalidates the first. This may be a semantic issue, please > examine and > >clarify. > > I think this is all a phrasology thing. I'm sorry. I hate hare-splitting too. > Assuming "a MAPS-blocked system" means a system that is > listed/blocked by MAPS as a spam source. > > Then your statement makes no sense because in all > likelihood, that > host IS an open relay. My bad. What I meant was a MAPS-blocked system as a subcriber to MAPS. Not a MAPS-known spam source. > Assuming "a MAPS-blocked system" means a system that is partaking of > the MAPS lists to block inbound mail to it > > Then your statement further makes no sense, because any > non-MAPS-listed host could (in theory) send mail to/through that > system. If the system using MAPS is an open relay, then > non-MAPS-listed hosts could quite happily/easily pump mail through > that system regardless of whether or not it is using MAPS. Not true, I'm assuming that MAPS isn't the only anti-spam measures being implemented. > >I might point out that, since MAPS has been running for a > few years, most if > >not all, the spammer sources are now listed. > > I think my personal evidence (that about 90-95% of my spam that is > blocked is NOT from MAPS sources) does not seem to bear that out. You bear out my assumptions that other methods, besides MAPS and ORBS, are being deployed as well. Feeding such data into MAPS would improve MAPS accuracy.

4 3

Re: ORBS (Re: Scanning)
by Steve Sobol 27 May '01

27 May '01

Steve Sobol wrote: >abitrariness (if that's > a word) of some of the ORBS listings. Arbitrariness. -- Tired of Earthlink? Get JustTheNet! Nationwide Dialup, ISDN, DSL, ATM, Frame Relay, T-1, T-3, and more. EARTHLINK AMNESTY PROGRAM: Buy a year, get two months free More info coming soon to http://JustThe.net, or e-mail me! B!ff: K3wl, w3'v3 r00t3D da N@vy... 0h CrAp, INC0M!Ng $%^NO CARRIER

1 0