- Test - lists.nanog.org

Re: HTTP Tunneling
by Mufti Ahmed 14 Jun '00

14 Jun '00

Hi Eric, this sounds like a hack or is this valid for certain services that you've seen. thanks Mufti Nayeem Ahmed Network Systems Engineer Market Data Networks Reuters America Inc. (212)-603-3595 Eric Vyncke <evyncke(a)cisco.com> on 06/14/2000 03:09:21 AM To: Mufti Ahmed/NYC/US/Reuters@REUTERS, nanog(a)merit.edu cc: Subject: Re: HTTP Tunneling Mufti, May be your director was thinking about tunneling a Telnet/SSH/IPSec/... session in a HTTP session. This is quite common to use HTTP (which is allowed through most firewalls configuration) to funnel other protocols through a firewall. If your firewall is a plain packet filter, sending Telnet traffic to a modified /etc/inetd.conf on port 80 will make the trick. If your firewall is a proxy firewall, you will have to add a HTTP header to it ;-) Basically, some trojans are using this technique. Other protocols used for tunneling are ICMP (remember loki ?), ... Hope this helps -eric At 18:38 13/06/2000 -0400, Mufti Ahmed wrote: >My Director was mentioning this phrase to me. Is this another term for >"TLS Within HTTP/1.1" RFC 2817. Maybe some one who works in the >ISP world is familiar with this term? Or do you think it's just a marketing >term for what i just mentioned? > >Thanks > >Mufti Nayeem Ahmed >Network Systems Engineer >Market Data Networks >Reuters America Inc. >(212)-603-3595 > > >----------------------------------------------------------------- > Visit our Internet site at http://www.reuters.com > >Any views expressed in this message are those of the individual >sender, except where the sender specifically states them to be >the views of Reuters Ltd. Eric Vyncke Consulting Engineer Cisco Systems EMEA Phone: +32-2-778.4677 Fax: +32-2-778.4300 E-mail: evyncke(a)cisco.com Mobile: +32-75-312.458 ----------------------------------------------------------------- Visit our Internet site at http://www.reuters.com Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Reuters Ltd.

1 0

Re: PMTU-D: remember, your load balancer is broken
by Steven M. Bellovin 14 Jun '00

14 Jun '00

In message <200006140405.e5E45UL12480(a)black-ice.cc.vt.edu>, Valdis.Kletnieks@vt .edu writes: Also, he said that ADSL uses just under 1500. >I don't have a Win98 or ADSL handy to check. ;) A lot of DSL providers use PPPoE, which shrinks the effective MTU... --Steve Bellovin

1 0

Detroit Power Failure
by Sean Donelan 14 Jun '00

14 Jun '00

The city of Detroit, Wayne County, Wayne State University, Redford and Livonia were hit by the power failure at 12:45pm. Detroit airport is operating on emergency power. Detroit Public Lighting's computer center also lost power. DPL is hooking up portable generators to its computer center so it can then determine the exent of the outage and when it will be repaired. Associated Press reports repeated calls to DPL resulted in a busy signal.

3 2

Re: PMTU-D: remember, your load balancer is broken
by brandon＠rd.bbc.co.uk 14 Jun '00

14 Jun '00

> > > Chances are that if you are using a load balancer for TCP connections, > > > then it does not properly handle Path MTU Discovery. > > > > Does anybody have any field experience on how much PMTU-D actually > > helps? Ours is only of the problems when it doesn't work. On the UK copy of http://news.bbc.co.uk/ they decided to play with load balancers (you may not have seen the effect of this as for the NY copy we said no). After an annoying trickle of complaints of site unreachability, which were dismissed as the net being a bit broken, we were brought in to diagnose a high profile case that couldn't be ignored (the Director General of the BBC (i.e. the boss) couldn't access the site as he went through a VPN). After a reasonably heated debate we were able almost convince them that the load balancer/PMTU-D were the problem. I say almost as instead of fixing the problem they swapped it for a different manufacturers box instead (RND replaced by Cisco). The problem isn't that they're stupid. It's hard to persuade people convinced by the marketing to buy the $20K magic 100% uptime box that it is the cause of 100% downtime for some. "Surely they wouldn't sell something that broken" and "it's your net that can't access the site that everyone else can so it is your net that's broken isn't it" are common responses. regards, brandon

1 0

DVB/IP from teleglobe (and/or others)
by Jim Mercer 14 Jun '00

14 Jun '00

i have a client that is looking to use DVB/IP to blast ip packets into various geographic areas. DVB/IP is basically piggy backing ip packets on Digital Video Broadcast satelite signals, allowing the end-users to collect the packets with a rather inexpensive receiving dish. the end-user will need some normal method of sending their packets out, typically via dial-up into a local ISP. this is nothing new, direct PC/ hughes have been doing it for a while, although i don't know if they are/were using DVB/IP, but a similar set up. teleglobe markets a service where they will advertise some subnets on your behalf, take the incoming packets and spew them into the areas you are looking to go. when investigating this, i initially thought it was great. i started discussing issues i had, like how it would be a good idea to have the ingress of the DVB/IP network-wise close to the client's internet egress. this would reduce some of the problems of asymetric routing. i also pointed out, that it would be a good idea to have some kinda system in front of the DVB/IP so that you could do some level of firewalling against DoS attacks and such. i then found out that teleglobe makes no provision for the customer to filter the packets before they hit the DVB/IP uplink. the best they offered was to allow an out-of-band (ie. almost paperbound procedure) configuration of an access list on their router. are their any other DVB/IP providers who will allow my clients to install a firewall/filter box in front of the DVB/IP uplink? -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Reptilian Research -- Longer Life through Colder Blood ] [ Don't be fooled by cheap Finnish imitations; BSD is the One True Code. ]

5 5

W2k Kerberos Secure Channel & Firewall
by Tom 14 Jun '00

14 Jun '00

Does anyone have a idea howto/where to find info on setting up a W2k Kerberos trusted domain through a PIX firewall. One of the Domain Controllers is statically NAT'd and the other is publicly routable. Kerberos it appears is not allowing a secure channel to be created (because of the NAT I think) is there a way to modify the Kerberos address info as it traverses the firewall? Any ideas/urls/thoughts/resources would be appreciated. Thanks Tom ps: they are both seperate Active Directory Domains.

1 0

Xedia router question.
by Hallihan, Ian 13 Jun '00

13 Jun '00

Hi all.. Still working on the Xedias' and have another "I hope" quick question..I'm trying to add a static arp entry onto the router for my Ethernet eth.1 interface. It's a multicast mac-address which I'm trying to force on the interface. I'm able to create a unicast mac addr but as soon as I try to change to multicast I get the following error: <error:bad value,var=253> I'm using the following command to attempt to add the arp cache entry and get an error each time >config eth.1 arp-cache.199.103.157.253 entry-type static mac-address 050a0b0c0d0e As always any help is greatly appreciated.. Thanks IanH. Ian Hallihan VERBIND, Inc. 319 A Street Boston, MA 02210 ihallihan(a)Verbind.com 617-239-4188 http://www.verbind.com

1 0

HTTP Tunneling
by Mufti Ahmed 13 Jun '00

13 Jun '00

My Director was mentioning this phrase to me. Is this another term for "TLS Within HTTP/1.1" RFC 2817. Maybe some one who works in the ISP world is familiar with this term? Or do you think it's just a marketing term for what i just mentioned? Thanks Mufti Nayeem Ahmed Network Systems Engineer Market Data Networks Reuters America Inc. (212)-603-3595 ----------------------------------------------------------------- Visit our Internet site at http://www.reuters.com Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Reuters Ltd.

1 0

Re: DVB/IP from teleglobe (and/or others)
by Jim Mercer 13 Jun '00

13 Jun '00

On Tue, Jun 13, 2000 at 01:08:50PM -0400, Jon Torrez wrote: > Harmonic Data, www.harmonicdata.net offers a device called the Enterprise > 1 DVB reciever/router yep, and that's all well and cool if you want to build an earth station to put behind it. teleglobe uses the harmonicdata unit. primarily, i'm looking for DVB/IP service suppliers. -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Reptilian Research -- Longer Life through Colder Blood ] [ Don't be fooled by cheap Finnish imitations; BSD is the One True Code. ]

1 0

RE: Broken 3640?
by Martin Taylor 13 Jun '00

13 Jun '00

wouldn't this question be better served at: comp.dcom.sys.cisco it doesn't seem to fit the NANOG charter. marty --- Jeff Wheat <jeff(a)cetlink.net> wrote: > > We have an almost identical problem. I have a 3640 > connected to a catalyst > 2924XL. I have the switch and router both locked at > 100/fdx. The crc error > counters increment on the switch. According to > cisco, this is related to > bug id CSCdm49462. In short, when using ISL, the > keeplives are not encap'd > so the switch sees this as a crc error. The > workaround is to disable > keepalives > on the router for that interface. Well we have tried > this and this does not > make a difference at all. We are still having > lockups and continous crc > errors. > Bug id CSCdm49462 is a duplicate of CSCdm31600, > which has been closed as > there > is a workaround (disable keepalives). If anyone can > offer anything else on > this > I would very much appreciate it. (We have done the > obvious and replaced > cables > and interfaces.) > > > 2924XL: > FastEthernet0/1 is up, line protocol is up > Hardware is Fast Ethernet, address is > 0001.4257.e241 (bia 0001.4257.e241) > Description: ISL Trunk Feed to RHSC Core > FastEthernet2/0 > MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, > reliability 255/255, txload 26/255, rxload > 9/255 > Encapsulation ARPA, loopback not set > Keepalive not set > Full-duplex, 100Mb/s, 100BaseTX/FX > ARP type: ARPA, ARP Timeout 04:00:00 > Last input 00:00:58, output 00:00:00, output hang > never > Last clearing of "show interface" counters > 21:28:28 > Queueing strategy: fifo > Output queue 0/40, 0 drops; input queue 0/75, 0 > drops > 5 minute input rate 3788000 bits/sec, 2043 > packets/sec > 5 minute output rate 10293000 bits/sec, 2302 > packets/sec > 144755645 packets input, 235743734 bytes > Received 154190 broadcasts, 0 runts, 0 giants, > 0 throttles > 89993 input errors, 89993 CRC, 0 frame, 0 > overrun, 585 ignored > 0 watchdog, 60165 multicast > 0 input packets with dribble condition detected > 153666041 packets output, 3705280485 bytes, 0 > underruns > 0 output errors, 0 collisions, 0 interface > resets > 0 babbles, 0 late collision, 0 deferred > 0 lost carrier, 0 no carrier > 0 output buffer failures, 0 output buffers > swapped out > > 3640: > FastEthernet2/0 is up, line protocol is up > Hardware is AmdFE, address is 00e0.1edf.8ba0 (bia > 00e0.1edf.8ba0) > Description: RockHill Main and Colo Lans > MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, > reliability 255/255, txload 10/255, rxload > 26/255 > Encapsulation ARPA, loopback not set > Keepalive not set > Full-duplex, 100Mb/s, 100BaseTX/FX > ARP type: ARPA, ARP Timeout 04:00:00 > Last input 00:00:00, output 00:00:00, output hang > never > Last clearing of "show interface" counters 1w2d > Queueing strategy: fifo > Output queue 0/40, 33091 drops; input queue 0/75, > 370786 drops > 5 minute input rate 10277000 bits/sec, 2335 > packets/sec > 5 minute output rate 4235000 bits/sec, 2078 > packets/sec > 1450782711 packets input, 3672702950 bytes > Received 6487551 broadcasts, 0 runts, 0 giants, > 0 throttles > 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 > ignored > 0 watchdog, 0 multicast > 0 input packets with dribble condition detected > 1373258222 packets output, 2317298953 bytes, 0 > underruns > 0 output errors, 0 collisions, 0 interface > resets > 0 babbles, 0 late collision, 0 deferred > 0 lost carrier, 0 no carrier > 0 output buffer failures, 0 output buffers > swapped out > > Regards, > Jeff > > > Lock the ports on the switch to 100FD, try a > different switch... > > > > > > > > Heres a followup. > > > > > > This is a show int on the interface. > > > > > > FastEthernet2/0 is up, line protocol is up > > > Hardware is AmdFE, address is 0050.547b.e8c0 > (bia 0050.547b.e8c0) > > > > __________________________________________________ Do You Yahoo!? Yahoo! Photos -- now, 100 FREE prints! http://photos.yahoo.com

2 1