- Test - lists.nanog.org

RE: RBL-type BGP service for known rogue networks?
by rdobbins＠netmore.net 12 Jul '00

12 Jul '00

ORBS forge headers (thereby violating the RFC) to look as if they're coming from domains you host, then if it goes through, they put you in their little black book for being an 'open relay'. No notice, nothing. The problem with this is that for hosting-only providers like my firm, it's blatantly unfair. We have thousands of users residing on networks (lots of dynamic addresses) all over the world who have domains hosted with us; they also have email aliases for the domains they host here. And while we encourage them to use IMAP, it's like herding cats to get any substantial percentage doing anything other than basic POP and SMTP. POP-before-SMTP isn't viable for the same reason that it's extremely difficult to get people to use IMAP; to wit, users tend to resist change. In a corporate environment, you can force remote users to use additional authentication mechanisms, as long as you're willing to set them up and train the users. Out here in the world, though, if you come down on people over something which forces them to change the way they do things in any substantial way, they vote with their feet and go to some other provider who not only doesn't secure his mail relay, but ignores spam complaints, as well. Our NOC staff act -immediately- upon any complaints of spam or forged mail - no one has ever acused us of being a spam-house or anything other than spammer-*unfriendly*. And yet, due to the current well-known limitations of SMTP as currently defined in the standard, their blatant adoption of RFC-violating spammer tactics, and their unwillingness to acknowledge that not every provider offers transport to his userbase (thereby rendering address-based validation unworkable), the ORBS folks decide to tar my organization with the same brush as, say, rr.com. No discussion, no examination of our track record and response-times, nada. Where's the equity in that, I ask you? ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice -----Original Message----- From: Peter van Dijk [mailto:petervd@vuurwerk.nl] Sent: Saturday, July 08, 2000 10:15 AM To: nanog(a)merit.edu Subject: Re: RBL-type BGP service for known rogue networks? On Sat, Jul 08, 2000 at 12:35:14PM -0400, Greg A. Woods wrote: > > [ On Saturday, July 8, 2000 at 08:42:41 (-0700), Randy Bush wrote: ] > > Subject: Re: RBL-type BGP service for known rogue networks? > > > > > ORBS lists open relay by policy. As simple as that. If ORBS is aware that > > > you are an open relay, you get listed. ORBS is 100% objective. > > > > as we all know, this is utter horsepucky. orbs goes vigilante crazy and > > blackholes entire isp blocks over political poweplay nonsense. > > Listing a net-block that has several proven open relays within it but > which will not allow testing, is not "going vigilante crazy" -- it's a > very very reasonable and well thought out reaction (i.e. there is no > lesser action possible since the originally tested open relays have been > moved to new address space within the block). Let me explain some things: - ORBS does not blackhole. It lists hosts and sometimes complete netblocks. $administrator can then choose to take any action (or not!) based on these listings. - ORBS lists hosts in several categories. One is 'open relay inputs'. Another is 'open relay outputs' (most open relays will be both). Yet another is 'untested/untestable'. Hosts/netblocks can end up in this last category in two ways: - by request from the admin of that host/netblock - when ORBS finds out that they are being blocked specifically. It is therefore incorrect to state 'ORBS blackholes whole netblocks'. These netblocks are listed *different* from open relays. The admin that decides to use ORBS has a choice to block *only* open relays, or also block hosts that do not want to be tested by ORBS. I hope this clears things up. > It is critically important to also realise that "ORBS" itself doesn't > "go crazy" and do these things -- such "rogue net-block" listings are > directly a result of pressure from ORBS users. Such users who continue > to get spam from relays they've reported to ORBS for testing will > complain and put pressure on the ORBS administrators until there is no > other choice but to list the entire offending net-block. Nope. ORBS doesn't do 'user pressure'. Such net-block listings (as 'untestable', not as 'open relay') are only done based on actions/requests by admins responsible for these netblocks. > Use of the term "blackhole" in this context is not only wrong but also > misleading. It is very important to understand that ORBS users are free > to programmatically ignore, in real time, that section of the ORBS > database which lists the so-called "rogue" net-blocks and only use the > section of the database which contains actually verified relay results. Correct, this is what I explained above. > In my humble opinion any admin who permits their mailer to receive any > e-mail from a known open relay (even so-called legitimate e-mail, since > there's absolutely no way to identify legitimacy at the protocol level) > is an accessory to any theft-of-service attack perpetrated on the relay, > and is furthermore "guilty" in part of allowing known spam to reach > their end users (assuming of course that they are willing to do anything > at all in the first place to protect their users from unsolicited junk > e-mail). To this end an impartial and independent testing service such > as ORBS is critical to the success of such efforts. The other services > you mention are valuable, but nowhere near as powerful, and they are far > more susceptible to unnecessary delays (time is critical in spam > fighting!), and by definition they are more susceptible to human error. Yes. On the other hand, one might say that you as an admin do not have the right to block *any* mail for your users. This is solved by for example just inserting headers based on ORBS-listing and not outright rejecting mail, and then leaving the choice to your users thru procmail or other per-user filtering means. > Finally it cannot be pointed out enough times that the administrators of > the so-called "rogue" blocks need only change their attitudes and > co-operate with ORBS in order to make this issue completely go away. Correct. > Any SMTP service administrator who believes that SMTP port is totally > private property is sadly mistaken and should firewall it if they really > want it to be private. Being irrational about public testing of public > services is, frankly, insane. Public testing by a known independent > non-profit agency should be vigorously welcomed by all network admins! Correct again. AboveNet blackholing ORBS is therefore an action I do not understand, especially since they host MAPS. I see 2 possibilities: - MAPS doesn't test if a reported spamhouse is really an open relay, and is therefore susceptible to forgery. - MAPS does do open relay testing and therefore performs the same 'unsolicited traffic' as ORBS, which would mean they're hypocritic. Greetz, Peter. -- petervd(a)vuurwerk.nl - Peter van Dijk [student:developer:ircoper]

22 43

abov engineers(network)
by jamie＠next.hway.net 11 Jul '00

11 Jul '00

All, sorry for the slightly-non-technical post, I'm looking for an ABOV engineer who has a few minutes to engage me in some technical (and non-technical) chatter regarding ABOV and its data centers. You can only get so far through normal channels, and I'm not really getting the 'real' answers I'm looking for. I won't quote you on anything, just looking for more realistic things. Please reply privately. Thanks, -jamie

1 0

Multiple providers w/o BGP (was: Re: Arrowpoint Load Balancing Devices)
by Timothy Brown 11 Jul '00

11 Jul '00

> Thank you for your interest in ArrowPoint Communications > On June 23, 2000, Cisco Systems completed its acquisition of ArrowPoint > Communications. > ... > > No Cisco's, eh? (-; The company I work for has its offices in a building Cisco mostly occupies. There have been Arrowpoint engineering staff in and out all week getting badges for a move-in within the next 2-3 weeks. As an aside containing actual internet operational content, are there any pointers onna web to redundancy and load-balancing solutions NOT using BGP? I'm pretty much talking about two different providers with different addressing schemes trying to connect to a third party who is a customer of both providers, but who cannot justify a /20. What are my primary options here for connectivity to the customer (short of adding three or four completely seperate production networks to the justification request)? > Alan -- Timothy Brown tcb(a)ga.prestige.net

2 1

Re: RBL-type BGP service for known rogue networks?
by Sean Donelan 11 Jul '00

11 Jul '00

On Thu, 6 Jul 2000, Dan Hollis wrote: > tin.it obviously fits all 3 criteria and thus would be blackholed. it > might not get them to change their behaviour, but at least people who > subscribe to the blackhole list wouldnt be rooted by tin.it customers While this might seem to be a belt and suspenders approach, anyone who cares about their machines being rooted spends their time securing their machines. After securing your machines, RBL'ing tin.it is just extra work. On the other hand, RBLing tin.it is of limited prophylactic value since, if you haven't secured your machines, the script kiddies will just root your machine from elsewhere.

16 36

RE: Arrowpoint Load Balancing Devices
by Karyn Ulriksen 11 Jul '00

11 Jul '00

>I seem to remember the folks over at Andover being disgusted with the >Arrowpoint boxes after a recent denial-of-service attack. You might try >searching on Slashdot; I think they posted a pretty fair criticism of the >boxes. Yeah, Jeremy Noetzelman, over at People dug up the links and I read through them. http://slashdot.org/articles/00/05/17/1318233.shtml and http://slashdot.org/articles/00/05/18/1427203.shtml It looks like they had to jump to the CS800 to get stability after the CS100's died. I looked at doing this, but it looked like I would end up with a 16u (size?) chassis serving 6 to 8 servers with no where to move up. Try and sell *that* to a Board of Directors... Karyn

1 0

RE: Arrowpoint Load Balancing Devices
by Karyn Ulriksen 11 Jul '00

11 Jul '00

The CS800 chassis is a pretty big box, about the size of a Cisco 7507. Last I checked it had 4x RAM capability of the CS100 (and 2x of the CS150). Since the major source of my woes appeared to be memory related, it didn't look like a good jump $-wise and u-wise (I'm guessing at 16u ?) to serve the same number of devices. As I remember, it's a 10 slot chassis - two for the management modules. How many slots do you have populated on your chassis? Are they all GigE or 10/100s or a mix? Karyn -----Original Message----- From: Jeremy Noetzelman [mailto:jjn@peoplelink.com] Sent: Monday, July 10, 2000 5:40 PM To: Karyn Ulriksen Subject: RE: Arrowpoint Load Balancing Devices Never saw any problems like that, but the key there is that you were running on a -100 and not an -800 ... the arrowpoint guys were very candid with me that there were some issues with the -100 ... but since the -100 is far too small for the amount of data I push, I didn't even consider it. Incidentally, the articles Larry was referring to can be found at: http://slashdot.org/articles/00/05/17/1318233.shtml and http://slashdot.org/articles/00/05/18/1427203.shtml J --- Jeremy Noetzelman Director of Network Operations PeopleLink -----Original Message----- From: Karyn Ulriksen [mailto:kulriksen@publichost.com] Sent: Monday, July 10, 2000 5:37 PM To: 'Jeremy Noetzelman' Cc: 'nanog(a)merit.edu'; 'lb-l(a)vegan.net' Subject: RE: Arrowpoint Load Balancing Devices What version of code were you running on those Arrowpoints? I'm starting to wonder if I didn't just get fed some bad hardware. I ran one of the leading software publisher's FTP servers on our CS100 and it got real ugly. I had the techs and engineers at Arrowpoint go over the configuration from top to bottom. It would hit around 250 connections, crash, and reboot. It wouldn't reactivate the service until after we did a cold reboot. Did you ever see anything like that? The issue persisted from their Version 2 code thru Version 3. Karyn -----Original Message----- From: Jeremy Noetzelman [mailto:jjn@peoplelink.com] Sent: Monday, July 10, 2000 5:22 PM To: Karyn Ulriksen Subject: RE: Arrowpoint Load Balancing Devices See inline responses --- Jeremy Noetzelman Director of Network Operations PeopleLink -----Original Message----- From: Karyn Ulriksen [mailto:kulriksen@publichost.com] Sent: Monday, July 10, 2000 5:12 PM To: 'Jeremy Noetzelman' Cc: 'nanog(a)merit.edu'; 'lb-l(a)vegan.net' Subject: RE: Arrowpoint Load Balancing Devices I keep getting these vague responses. But, I _really_ interested in what was done with them. I hate to ask this level of detail (and I'm not some marketing wig), but I _really_ want to know. Could you answer the following questions? How come you wouldn't consider the Cisco, Alteon or F5? ---- I've used Alteon before. Never again. A chore to configure, and atrocious performance in a live environment. F5 has a solid product, but I dislike the architecture they have for a high volume site. It's certainly something worth considering for a lower volume site that doesn't mind having a PC do the load balancing, but I prefer something ASIC based. Cisco provides similar performance to the F5 in tests I ran a while back, and is a cross between a PC and a switch ... I don't like the architecture, and the price you pay for the Cisco logo is a little steep too. ---- What tests did you run? ---- Initially we ran basic stress testing, followed by more in depth stress testing using custom built tools running on 20 Linux boxes. Once those were passed, we did the ultimate test and ran them in the production network for a short time. ---- Which services did you configure and how many rule sets? ---- We loadbalance everything from web and ftp to email, dns, instant messaging, persistant chat connections, and some other internal stuff that we do. I don't recall the exact number of rulesets, but we have about 30 virtual servers and about 150 real servers being load balanced. ---- Did you run a moderately high volume of FTP service across it (say 500 simultaneous over 2 servers)? ---- Our FTP services run on 3 boxes and we get about 300 simul with no problems. Testing the arrowpoint boxes, we were able to easily get 3000 simultaneous FTP connections across 3 servers. Hope this helps J -----Original Message----- From: Jeremy Noetzelman [mailto:jjn@peoplelink.com] Sent: Monday, July 10, 2000 5:04 PM To: Karyn Ulriksen Subject: RE: Arrowpoint Load Balancing Devices I'm in the process of switching from Foundry to Arrowpoint. I wouldn't even consider Cisco, or Alteon, or F5. Foundry and Arrowpoint both make an excellent product, it came down to the GS-800 fitting my needs more precisely. I eval'd them both over a period of a couple months (and I had originally been using ServerIrons) .... decided to make the switch based on performance and scalability that the SI just can't match up to right now. J --- Jeremy Noetzelman Director of Network Operations PeopleLink -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Karyn Ulriksen Sent: Monday, July 10, 2000 4:54 PM To: 'lb-l(a)vegan.net' Cc: 'nanog(a)merit.edu' Subject: Arrowpoint Load Balancing Devices I'm wondering how other ISPs are using Arrowpoint devices in their networks. They must be successfully implemented in some networks with out many gotchas, considering that Cisco bought them. After six months of testing Arrowpoint, I ended going with another LB solutions. But I can't help but wonder what others are doing with them. Have they made enough changes in their product that I should take a look at them again? --------------------------------------------------------------------- Best regards, Karyn Ulriksen Director of Network Operations PublicHost, A SiteStream Company 22 Mauchly, Suite 200 Irvine, California 92618 USA Phone: (949) 743-2000 email: kulriksen(a)publichost.com URL: http://www.publichost.com

2 1

RE: Arrowpoint Load Balancing Devices
by Karyn Ulriksen 11 Jul '00

11 Jul '00

What version of code were you running on those Arrowpoints? I'm starting to wonder if I didn't just get fed some bad hardware. I ran one of the leading software publisher's FTP servers on our CS100 and it got real ugly. I had the techs and engineers at Arrowpoint go over the configuration from top to bottom. It would hit around 250 connections, crash, and reboot. It wouldn't reactivate the service until after we did a cold reboot. Did you ever see anything like that? The issue persisted from their Version 2 code thru Version 3. Karyn -----Original Message----- From: Jeremy Noetzelman [mailto:jjn@peoplelink.com] Sent: Monday, July 10, 2000 5:22 PM To: Karyn Ulriksen Subject: RE: Arrowpoint Load Balancing Devices See inline responses --- Jeremy Noetzelman Director of Network Operations PeopleLink -----Original Message----- From: Karyn Ulriksen [mailto:kulriksen@publichost.com] Sent: Monday, July 10, 2000 5:12 PM To: 'Jeremy Noetzelman' Cc: 'nanog(a)merit.edu'; 'lb-l(a)vegan.net' Subject: RE: Arrowpoint Load Balancing Devices I keep getting these vague responses. But, I _really_ interested in what was done with them. I hate to ask this level of detail (and I'm not some marketing wig), but I _really_ want to know. Could you answer the following questions? How come you wouldn't consider the Cisco, Alteon or F5? ---- I've used Alteon before. Never again. A chore to configure, and atrocious performance in a live environment. F5 has a solid product, but I dislike the architecture they have for a high volume site. It's certainly something worth considering for a lower volume site that doesn't mind having a PC do the load balancing, but I prefer something ASIC based. Cisco provides similar performance to the F5 in tests I ran a while back, and is a cross between a PC and a switch ... I don't like the architecture, and the price you pay for the Cisco logo is a little steep too. ---- What tests did you run? ---- Initially we ran basic stress testing, followed by more in depth stress testing using custom built tools running on 20 Linux boxes. Once those were passed, we did the ultimate test and ran them in the production network for a short time. ---- Which services did you configure and how many rule sets? ---- We loadbalance everything from web and ftp to email, dns, instant messaging, persistant chat connections, and some other internal stuff that we do. I don't recall the exact number of rulesets, but we have about 30 virtual servers and about 150 real servers being load balanced. ---- Did you run a moderately high volume of FTP service across it (say 500 simultaneous over 2 servers)? ---- Our FTP services run on 3 boxes and we get about 300 simul with no problems. Testing the arrowpoint boxes, we were able to easily get 3000 simultaneous FTP connections across 3 servers. Hope this helps J -----Original Message----- From: Jeremy Noetzelman [mailto:jjn@peoplelink.com] Sent: Monday, July 10, 2000 5:04 PM To: Karyn Ulriksen Subject: RE: Arrowpoint Load Balancing Devices I'm in the process of switching from Foundry to Arrowpoint. I wouldn't even consider Cisco, or Alteon, or F5. Foundry and Arrowpoint both make an excellent product, it came down to the GS-800 fitting my needs more precisely. I eval'd them both over a period of a couple months (and I had originally been using ServerIrons) .... decided to make the switch based on performance and scalability that the SI just can't match up to right now. J --- Jeremy Noetzelman Director of Network Operations PeopleLink -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Karyn Ulriksen Sent: Monday, July 10, 2000 4:54 PM To: 'lb-l(a)vegan.net' Cc: 'nanog(a)merit.edu' Subject: Arrowpoint Load Balancing Devices I'm wondering how other ISPs are using Arrowpoint devices in their networks. They must be successfully implemented in some networks with out many gotchas, considering that Cisco bought them. After six months of testing Arrowpoint, I ended going with another LB solutions. But I can't help but wonder what others are doing with them. Have they made enough changes in their product that I should take a look at them again? --------------------------------------------------------------------- Best regards, Karyn Ulriksen Director of Network Operations PublicHost, A SiteStream Company 22 Mauchly, Suite 200 Irvine, California 92618 USA Phone: (949) 743-2000 email: kulriksen(a)publichost.com URL: http://www.publichost.com

1 0

Arrowpoint Load Balancing Devices
by Karyn Ulriksen 11 Jul '00

11 Jul '00

I'm wondering how other ISPs are using Arrowpoint devices in their networks. They must be successfully implemented in some networks with out many gotchas, considering that Cisco bought them. After six months of testing Arrowpoint, I ended going with another LB solutions. But I can't help but wonder what others are doing with them. Have they made enough changes in their product that I should take a look at them again? --------------------------------------------------------------------- Best regards, Karyn Ulriksen Director of Network Operations PublicHost, A SiteStream Company 22 Mauchly, Suite 200 Irvine, California 92618 USA Phone: (949) 743-2000 email: kulriksen(a)publichost.com URL: http://www.publichost.com

2 1

RE: Arrowpoint Load Balancing Devices
by Karyn Ulriksen 11 Jul '00

11 Jul '00

Thanx Larry. I'll see if I can track it down and also look up some people I know at Exodus who might have worked with them. I remember seeing the blurb in Network World about Exodus running them somewhere in their net and I think I read that Time Warner put them in use somewhere on their cable modem (Roadrunner) network. I wonder where they used them? -----Original Message----- From: Larry Snyder [mailto:larrys@lexis-nexis.com] Sent: Monday, July 10, 2000 5:24 PM To: kulriksen(a)publichost.com Subject: RE: Arrowpoint Load Balancing Devices It appears to have fallen off the end of the world, but there was an article on /. about their move to exodus hosting and arrowpoint l/b, along with a description of a dos attack on them. They use an 800 (or at least they did at the time). The initial 100 didn't handle the attack well, but the 800 did, IIRC. Sorry I can't point you to the article. -ls- Karyn Ulriksen <kulriksen(a)publichost.com> wrote: > > I keep getting these vague responses. But, I _really_ interested in what > was done with them. > > I hate to ask this level of detail (and I'm not some marketing wig), but I > _really_ want to know. Could you answer the following questions? > > How come you wouldn't consider the Cisco, Alteon or F5? > What tests did you run? > Which services did you configure and how many rule sets? > Did you run a moderately high volume of FTP service across it (say 500 > simultaneous over 2 servers)? > > > > -----Original Message----- > From: Jeremy Noetzelman [mailto:jjn@peoplelink.com] > Sent: Monday, July 10, 2000 5:04 PM > To: Karyn Ulriksen > Subject: RE: Arrowpoint Load Balancing Devices > > > I'm in the process of switching from Foundry to Arrowpoint. > > I wouldn't even consider Cisco, or Alteon, or F5. > > Foundry and Arrowpoint both make an excellent product, it came > down to the GS-800 fitting my needs more precisely. I eval'd them > both over a period of a couple months (and I had originally been using > ServerIrons) .... decided to make the switch based on performance > and scalability that the SI just can't match up to right now. > > J > > > --- > Jeremy Noetzelman > Director of Network Operations > PeopleLink > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Karyn Ulriksen > Sent: Monday, July 10, 2000 4:54 PM > To: 'lb-l(a)vegan.net' > Cc: 'nanog(a)merit.edu' > Subject: Arrowpoint Load Balancing Devices > > > > I'm wondering how other ISPs are using Arrowpoint devices in their networks. > They must be successfully implemented in some networks with out many > gotchas, considering that Cisco bought them. After six months of testing > Arrowpoint, I ended going with another LB solutions. But I can't help but > wonder what others are doing with them. Have they made enough changes in > their product that I should take a look at them again? > > --------------------------------------------------------------------- > Best regards, > > Karyn Ulriksen > Director of Network Operations > PublicHost, A SiteStream Company > 22 Mauchly, Suite 200 > Irvine, California 92618 USA > Phone: (949) 743-2000 > email: kulriksen(a)publichost.com > URL: http://www.publichost.com >

1 0

RE: Arrowpoint Load Balancing Devices
by Karyn Ulriksen 11 Jul '00

11 Jul '00

I keep getting these vague responses. But, I _really_ interested in what was done with them. I hate to ask this level of detail (and I'm not some marketing wig), but I _really_ want to know. Could you answer the following questions? How come you wouldn't consider the Cisco, Alteon or F5? What tests did you run? Which services did you configure and how many rule sets? Did you run a moderately high volume of FTP service across it (say 500 simultaneous over 2 servers)? -----Original Message----- From: Jeremy Noetzelman [mailto:jjn@peoplelink.com] Sent: Monday, July 10, 2000 5:04 PM To: Karyn Ulriksen Subject: RE: Arrowpoint Load Balancing Devices I'm in the process of switching from Foundry to Arrowpoint. I wouldn't even consider Cisco, or Alteon, or F5. Foundry and Arrowpoint both make an excellent product, it came down to the GS-800 fitting my needs more precisely. I eval'd them both over a period of a couple months (and I had originally been using ServerIrons) .... decided to make the switch based on performance and scalability that the SI just can't match up to right now. J --- Jeremy Noetzelman Director of Network Operations PeopleLink -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Karyn Ulriksen Sent: Monday, July 10, 2000 4:54 PM To: 'lb-l(a)vegan.net' Cc: 'nanog(a)merit.edu' Subject: Arrowpoint Load Balancing Devices I'm wondering how other ISPs are using Arrowpoint devices in their networks. They must be successfully implemented in some networks with out many gotchas, considering that Cisco bought them. After six months of testing Arrowpoint, I ended going with another LB solutions. But I can't help but wonder what others are doing with them. Have they made enough changes in their product that I should take a look at them again? --------------------------------------------------------------------- Best regards, Karyn Ulriksen Director of Network Operations PublicHost, A SiteStream Company 22 Mauchly, Suite 200 Irvine, California 92618 USA Phone: (949) 743-2000 email: kulriksen(a)publichost.com URL: http://www.publichost.com

1 0