- Test - lists.nanog.org

RE: bad idea?
by Richard A. Steenbergen 06 Jul '00

06 Jul '00

On Wed, 5 Jul 2000, Dmitri Krioukov wrote: > > the major disadvantage of the foundry (bgp) > solution is longer prefix injection. > > the major problem with the dns-based solutions is > that they're not topology-aware (-> suboptimal > routing). attempts to make dns smart lead to > rather awkward reverse pinging configurations > and proprietary protocols running between load > balancers. (there was also rfc2052 by paul vixie > but it required modification of dns clients.) I don't think anyone sane would advocate a reverse pinging setup, but rather returning a DNS answer based on which DNS server you hit, and you hit the DNS server thats "closest" to you. I guess it depends what you value, short web traffic and instantanious failover regardless of the disruption of existing connections due to a route flap or metric change (remember this could be the fault of ANYONE's network, not necessarily yours), or guarenteed connections with possible non-instantanious failover. It also depends on the density of your server farms (one on the east coast, one on the west coast, it would take a fair amount of problems for the routes of the "majority" of people on either coast to change to the other). This is grossly generalized load balancing at its finest, take from it what you will. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

RE: PGP kerserver infrastructure
by L. Sassaman 05 Jul '00

05 Jul '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, 5 Jul 2000, Mat Butler wrote: > Which, incidentally, Thawte -did-. They offer PGP certificates as well, for > their Freemail members' personal cert members. Thawte offered PGP support so poorly that it was irrelevant. And they never had any commercial PGP services. See the thread on the UK-Crypto list ~ January 2000 with the subject of "Food for Thawte" if you really want to know why Thawte's PGP program is worthless. Note that this is probably moot now that Verisign has bought them. __ L. Sassaman System Administrator | Technology Consultant | "Common sense is wrong." icq.. 10735603 | pgp.. finger://ns.quickie.net/rabbi | --Practical C Programming -----BEGIN PGP SIGNATURE----- Comment: OpenPGP Encrypted Email Preferred. iD8DBQE5Y4k/PYrxsgmsCmoRAnymAJkBPVt4CYpv6XYN3fn/m9vEcc0PgwCaAvqK HlFfXipaEmlwUoD1irkEWIw= =5oMV -----END PGP SIGNATURE-----

2 1

exodus.net
by Morris Allen 05 Jul '00

05 Jul '00

Does anyone have a contact name and number for exodus.net. I have sent the normal e-mails to abuse@ and root@? I have a hacker that has been hitting my T1 for 5 hours doing UDP probes and ICPM echo frames from behind their firewall or proxy server. thanks Morris Allen VidcomNet, Inc.

2 1

RE: exodus.net
by Jamie Rishaw 05 Jul '00

05 Jul '00

888 2EXODUS, option #1 to get to their global response center. | -----Original Message----- | From: Morris Allen [mailto:moe@vidnet.net] | Sent: Wednesday, July 05, 2000 11:29 AM | To: Nanog Mail List; Nanog | Subject: exodus.net | | | | Does anyone have a contact name and number for exodus.net. I | have sent the | normal e-mails to abuse@ and root@? I have a hacker that has | been hitting | my T1 for 5 hours doing UDP probes and ICPM echo frames from | behind their | firewall or proxy server. | thanks | Morris Allen | VidcomNet, Inc. | |

1 0

RE: bad idea?
by Karyn Ulriksen 05 Jul '00

05 Jul '00

Has foundry figured out how to introduce persistence in their LB's yet? I like their switches and have been waiting for them to get persistence going on. I think I'll jump on that LB list you cited below. Wasn't aware that one was around now. Great idea! Thanx! -Karyn -----Original Message----- From: tony bourke [mailto:tony@vegan.net] Sent: Wednesday, July 05, 2000 11:11 AM To: Jeremiah Kristal Cc: nanog(a)merit.edu Subject: Re: bad idea? actually, Foundry has a global solution based on BGP, check them out. There is a load-balancing mailing list, which addresses such issues. http://vegan.net/lb is the info to sign up. Tony On Wed, 5 Jul 2000, Jeremiah Kristal wrote: > > Given a small, globally routable netblock to be used for front-end web > servers, and a strong aversion for using DNS for any type of load > balancing, would it be reasonable to build two identical servers farms > with the same public IP addresses and rely on the BGP sessions with the > hosing providers to remove one advertisement in the event of a problem? > I've been looking at ways to ensure that the webservers are always > available, short of building a network connecting hosting facilities. > > Jeremiah > being a customer stinks > -------------- -- ---- ---- --- - - - - - -- - - - - - - Tony Bourke tony(a)vegan.net

1 0

RE: bad idea?
by Karyn Ulriksen 05 Jul '00

05 Jul '00

If all the DNS servers really adhere to the RFCs and really do cache using the TTLs stated by the zone's SOA server, this might be less of a headache than it is in reality. Unfortunately not every ISP is using BIND8, and some are using much worse than DNS server implementations that the wintel services out there which completely disregard TTL's in the zone records and make up there own mind on how long they'll cache. Besides if you are going to go through the trouble and cost oof building out web services in multiple locations, any downtime to any enduser due to the architecture is unacceptible. Think about it... Imagine .... You (yourself) are shelling out somewhere in the neighborhood of a grand a month for shelf space, then throw on bandwidth, all the programming and configuration investment (500 - $10,000 [depending on your sucker level]) for the set up... And you gone thru all this trouble... As a businessman, are you *really* comfortable with an occasional 30-60 minute down time for RFC compliant DNS caches and 24-72 hour for non-compliant DNS caching? I've seen the happiness levels of quite of few big sites over this type of approach go to hell. It's cheap going in, but they end up digging in their pockets for that ole F5 solution afterwards. Don't get me wrong, I think F5 is WAY overpriced and as soon as GNU gets hold of it and maybe Vixie pushes some of it into BIND we can all sleep without our pagers with a little less trepidation. -Karyn -----Original Message----- From: Richard A. Steenbergen [mailto:ras@e-gerbil.net] Sent: Wednesday, July 05, 2000 10:39 AM To: Karyn Ulriksen Cc: 'nanog(a)merit.edu' Subject: RE: bad idea? On Wed, 5 Jul 2000, Karyn Ulriksen wrote: > Riigghhhttttt..... But if the server goes down and the IP is unreachable, > DNS will never know and all his structure goes for naught... Thats actually a good thing, at least for the short-term. If the IP is down hard and isn't coming back up (for example, the server crashed), thats a different story. A short TTL works, if you don't mind it offsetting the benefits of DNS caching. Its an all around grody hack, but its still better then other alternatives. It also helps if the DNS "server" for this load balanced sub-domain is integrated with the box, for example a Foundry ServerIron which can perform health checks, and withdraw the announcement if its no longer viable to get answers from this server. As long as the grody-ness stays restricted to this confined area, and doesn't break anything else... I can live with it. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

RE: NSI to make (simple) change to domain-change procedures effec tive 8Jul00.
by Jamie Rishaw 05 Jul '00

05 Jul '00

Looks like they finally got BEFORE-USE/BEFORE-UPDATE to work? and are taking out MAIL-FROM authentication. Funny, it all worked for a short term during beta (I was part of the beta herd). Same with PGP. PGP worked flawlessly, till Eric Eden left. Then nobody really knew how to fix it. Now, it's a crap-shoot. I have had my PGP key registered with NSI since the Guardian project beta'd, same thing, it worked great for a while and then stopped. Some say it's a problem scaling, but others inside NSI say that the percentage of people actually *using* PGP are very, very small compared to the other Guardian methods. This new policy will make things slower, but in the interest of security, I suppose it's a good thing. Besides, recently, NSI has improved their turnaround times on properly-formatted templates significantly.. Let's just hope they implement this correctly. -jamie | -----Original Message----- | From: rdobbins(a)netmore.net [mailto:rdobbins@netmore.net] | Sent: Friday, June 30, 2000 3:09 PM | To: nanog(a)merit.edu | Subject: NSI to make (simple) change to domain-change procedures | effective 8Jul00. | | | | | | It's better than nothing, I guess. Too bad they can't seem to get PGP | working. | | http://www.securityfocus.com/templates/article.html?id=54 | | ----------------------------------------------------------- | Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice | |

1 0

Re: bad idea?
by Richard A. Steenbergen 05 Jul '00

05 Jul '00

On Wed, 5 Jul 2000, Jeremiah Kristal wrote: > Given a small, globally routable netblock to be used for front-end web > servers, and a strong aversion for using DNS for any type of load > balancing, would it be reasonable to build two identical servers farms > with the same public IP addresses and rely on the BGP sessions with the > hosing providers to remove one advertisement in the event of a problem? > I've been looking at ways to ensure that the webservers are always > available, short of building a network connecting hosting facilities. In the event of a route flap, or other instability, you could potentially have traffic shifted to another server without the established TCP state, which would prompt that server to generate an RST and end the connection. If the route then comes back, you end up resetting your connection for nothing. Actually, DNS works very well for this kind of thing. Since its a stateless protocol it isn't affected by this, and once your client has its answer it continues to use the same IP, which is routed normally. I believe this is how's Akamai load balancer works (try looking up www.yahoo.com from a name server on the left coast and on the right coast). I see absolutily nothing wrong with using DNS in this manner. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 1

RE: bad idea?
by Karyn Ulriksen 05 Jul '00

05 Jul '00

Riigghhhttttt..... But if the server goes down and the IP is unreachable, DNS will never know and all his structure goes for naught... -----Original Message----- From: Richard A. Steenbergen [mailto:ras@e-gerbil.net] Sent: Wednesday, July 05, 2000 10:24 AM To: Jeremiah Kristal Cc: nanog(a)merit.edu Subject: Re: bad idea? On Wed, 5 Jul 2000, Jeremiah Kristal wrote: > Given a small, globally routable netblock to be used for front-end web > servers, and a strong aversion for using DNS for any type of load > balancing, would it be reasonable to build two identical servers farms > with the same public IP addresses and rely on the BGP sessions with the > hosing providers to remove one advertisement in the event of a problem? > I've been looking at ways to ensure that the webservers are always > available, short of building a network connecting hosting facilities. In the event of a route flap, or other instability, you could potentially have traffic shifted to another server without the established TCP state, which would prompt that server to generate an RST and end the connection. If the route then comes back, you end up resetting your connection for nothing. Actually, DNS works very well for this kind of thing. Since its a stateless protocol it isn't affected by this, and once your client has its answer it continues to use the same IP, which is routed normally. I believe this is how's Akamai load balancer works (try looking up www.yahoo.com from a name server on the left coast and on the right coast). I see absolutily nothing wrong with using DNS in this manner. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 1

RE: bad idea?
by Greene, Dylan 05 Jul '00

05 Jul '00

Jeremiah, Hey there.. What you're describing is basically anycast, (rfc 1546) which is useful for single packet, connectionless UDP type things (dns lookups), but can make connection oriented / statefull protocols break. If you are advertising what appears to be two ways to get to the same prefix, you're relying on having stable paths through the internet to always deliver a packet via the same path the one before it took. If something outside of your control breaks / changes, you may end up changing paths and could start sending packets towards your 'other' (same destination) site mid session. Another thing to be careful of is inconsistent-as. If you plan to have multiple sites advertising the same prefix, they either need to be all part of the same asn, or you need to advertise a separate anycast asn padded w/ unique per-site asns. (Also a good way to withdraw routes is necessary, using gated or something..) I think the anycast rfc mentioned setting aside a block of space for this purpose. ..Dylan | -----Original Message----- | From: Jeremiah Kristal [mailto:jkristal@on2.com] | Sent: Wednesday, July 05, 2000 11:17 AM | To: nanog(a)merit.edu | Subject: bad idea? | | | | Given a small, globally routable netblock to be used for front-end web | servers, and a strong aversion for using DNS for any type of load | balancing, would it be reasonable to build two identical servers farms | with the same public IP addresses and rely on the BGP | sessions with the | hosing providers to remove one advertisement in the event of | a problem? | I've been looking at ways to ensure that the webservers are always | available, short of building a network connecting hosting facilities. | | Jeremiah | being a customer stinks |

2 1