- Test - lists.nanog.org

Re: Death knell for residential non-cable access?
by trall＠almaden.ibm.com 16 Jun '99

16 Jun '99

(I dropped domain-policy off of the distribution - this doesn't seem to have anything to do with that topic. And it may not be a good nanog topic either, but here I go anyway.) > Type bit-rate Monthly CKb > modems 33.6Kbps ~$25US $0.74US note:$25 telco + $0 ISP charges > modems 33.6Kbps ~$34US $1.01US note:$25 telco + $9 ISP charges > Cable 1024Kbps ~$49US $0.04US > DSL 1148Kbps ~$600US $0.52US > T1 1540Kbps ~$2500US $1.62US I think Roeland is ignoring a couple of pretty important issues to many customers: 1. Many folks are almost completely price-driven. A $25 service is preferred over a $49 service, regardless of capacity issues. 2. Some folks are very much part-time connectors. They use their normal voice line to talk to their ISP. They don't consider the cost of the line as part of the cost of the Ineternet connection. So their ISP service costs them 9 or 19 dollars (or even 0, if we reach that point). Tony Rall

2 1

security (was Re: Is anyone actually USING IP QoS?)
by Brett_Watson＠enron.net 16 Jun '99

16 Jun '99

On 06/16/99 12:00:16 PM Majdi Abbas wrote: > > Perhaps you should follow your own career advice. *i* have no problem being the first to admit when i'm not an expert at something. i most certainly do follow my own career advice. i simply don't think it's OK to say "this way is bad, just do this other thing and NO PROBLEMS". it's all about tradeoffs, it's not black and white. -brett

1 0

Re: Is anyone actually USING IP QoS?
by Vadim Antonov 16 Jun '99

16 Jun '99

Brett_Watson(a)enron.net wrote: >i'll give you that. however, caches tend to run under unix-like os's which >are multi-user and multi-service machines. they can be susceptible to DoS >attacks, and can be running services listening on a port which can >potentially be "hacked". my only point is that you are trading a set of >security issues in multicast for *different* security issues with a cache. A Unix machine can be secured a lot better than any commercial router. For one, you can get a source code from it and see what the hell it is doing and fix discovered security holes ASAP. Second, just run SSH or Kerberos. SSH on cisco, anyone? Nyah. --vadim

4 3

Re: Is anyone actually USING IP QoS?
by Brett_Watson＠enron.net 16 Jun '99

16 Jun '99

On 06/16/99 10:31:03 AM Vadim Antonov wrote: >Brett_Watson(a)enron.net wrote: > >>i'll give you that. however, caches tend to run under unix-like os's which >>are multi-user and multi-service machines. they can be susceptible to DoS >>attacks, and can be running services listening on a port which can >>potentially be "hacked". my only point is that you are trading a set of >>security issues in multicast for *different* security issues with a cache. > >A Unix machine can be secured a lot better than any commercial router. i don't believe that at all. i say this from operational experience, not just generalizing. >For one, you can get a source code from it and see what the hell it is >doing and fix discovered security holes ASAP. in some cases, yes you can. but the fact that i (someone who doesn't crack systems) can get source code to some flavors of unix doesn't stop the hackers from getting it either. no *real* gain here. and if you don't think that some of the more elite hackers in the world don't have access to proprietary source code, both systems and router vendors.... if you're not scared, you don't understand. >Second, just run SSH or Kerberos. SSH on cisco, anyone? Nyah. maybe i just misunderstand you but you seem to portray these issues as black and white. they're not. ssh has had known security problems, and kerberos, while i like it myself, is damned easy to misconfigure which opens all kinds of holes. -brett

3 2

Re: Is anyone actually USING IP QoS?
by Brett_Watson＠enron.net 16 Jun '99

16 Jun '99

On 06/16/99 10:55:40 AM Alex P. Rudnev wrote: >They (cisco) promised to realise ssh. Hope we'll see it in a few years, >For now, install IPSEC, tunnel, bla-bla-bla, and may be you'll have a >piece of security. cisco *has* released code with ssh (ok, not released in the cisco-sense but you can get it) >Unix machine... drop all services you don't need, run your services not >as the root, install secure level or read-onl.y file system - and no >problems. this is just rediculous. it's not as simple as "no problems". the things you state are rather obvious but for a system to be used as *anything* (cache, web server, video server, etc) you simply have to have certain ports open, many times simple udp ports. locking down down services/ports, and running anything you can as non-root certainly goes a long way in protecting the system but it's just not that cut and dried. i'll give you and vadim full credit for being math wizards, or scientists (which i clearly am not) but don't choose your next career in the computer/network security industry. :) -brett

2 1

Re: Is anyone actually USING IP QoS?
by Vadim Antonov 16 Jun '99

16 Jun '99

>maybe i just misunderstand you but you seem to portray these issues as >black and white. they're not. ssh has had known security problems, and >kerberos, while i like it myself, is damned easy to misconfigure which >opens all kinds of holes. The point here was not cisco or unix having some features but the fact that open systems are much easier to secure than proprietary stuff. SSH and kerberos were available on unix platforms for years. And if anyone thinks one can really secure cisco, try playing tricks with Internet protocols over CLNP :) --vadim

1 0

Death knell for residential non-cable access?
by Roeland M.J. Meyer 16 Jun '99

16 Jun '99

I'm getting more info, but it looks as if even access to the Internet may be offered for free. Free ISP services are being contemplated by AOL and MSN, as a response to low-cost offrerings from the RBOCS, and more notably, from TCI and other broadband cable operators. The battle-ground is the residential access market. Currently, dialup modem acces is dropping to $9US per month in order to compete with cablemodem offerings. Considering the cost per kilo-bit ratio (CKb), cable-modems are still a better value at this time, for residential customers. There are technical and contractual reasons why cable-modems are not suitable for business use. In that arena, xDSL is making serious in-roads and there is still a market, if you are a DSL re-seller/provisioner. As you can see in the accompanying chart, even at zero ISP cost, modems can no longer compete as an access media, unless the telco charges are dropped. This is not going to happen any time soon. Evenso, the local telco's are the only ones able to do it. This presents a serious threat to direct access providers like AOL and MSN, even the WebTV system is being threatened by this cable-modem roll-out, as they use dial-in modems to provide their services. Coupled with restrictive practices, by cable operators, it is difficult to even provide ISP services as a third-party on the cable-modem network. The cable-modem customer is required, contractually, to use the ISP services of the cable operator. What this means, for third-party access providers, is a serious loss in residential business. Possibly, a decimation of that market. The consideration, of the major players, in giving Internet access away, at no cost, should be viewed as an extreme measure on their part. The collateral damage in this attempt at saving their market is to utterly destroy the local access ISPs, whose primary revenue is local access services. Granted, they won't survive the cable-modem threat on their business, once cable-modems become available in their area, anyway. Note that in the following chart; Monthly costs are estimated, based on California rates, and include local telco service charges where appropriate. Type bit-rate Monthly CKb modems 33.6Kbps ~$25US $0.74US note:$25 telco + $0 ISP charges modems 33.6Kbps ~$34US $1.01US note:$25 telco + $9 ISP charges Cable 1024Kbps ~$49US $0.04US DSL 1148Kbps ~$600US $0.52US T1 1540Kbps ~$2500US $1.62US -------------------- Roeland M.J. Meyer, CEO Morgan Hill Software Company, Inc. http://www.mhsc.com/ mailto://rmeyer@mhsc.com --------------------

1 0

Re: Is anyone actually USING IP QoS?
by Brett_Watson＠enron.net 16 Jun '99

16 Jun '99

On 06/15/99 01:23:16 PM Vadim Antonov wrote: >Brett_Watson(a)enron.net wrote: > >>and how does caching magically negate security and scalability concerns? > >Caching is not employing any routing information exchange. Therefore >it is a) oblivious to the state of other caches or to the changes in >network topology and b) is invulnerable to the bogus routing information >and flap-like DoS attacks. i'll give you that. however, caches tend to run under unix-like os's which are multi-user and multi-service machines. they can be susceptible to DoS attacks, and can be running services listening on a port which can potentially be "hacked". my only point is that you are trading a set of security issues in multicast for *different* security issues with a cache. > >>what tools are you using to do content replication/management that scale to >>thousands of hosts/caches? > >99% of Web content is write-once. It does not need any fancy management. >The remaining 1% can be delivered end-to-end. it's very different in our network. we have lots of static content (on-demand real-video, mpeg, etc) which is injected to a set of distributed servers around the network from content originators. the content originators may be traditional content providers such as those found on the internet but they may be a 3-letter television networks (broadcast television), post-production video houses, etc. we have to do content management, aging, etc for large volumes of data. we also have to keep systems synchronized with content (contrary to your next statement which i don't agree with). > >In this case, i just do not care to go into details of implementations. The >L2/L3 mcasting is not scalable and _cannot be made_ scalable for reasons having >nothing to do with deficiencies of protocols. > >Caching algorithms do not have similar limitations, solely because they do >not rely on distributed computations. So they have a chance of working. >Of course, nothing "just works". right, they don't have "similar limitation" they have *different* limitations which wasn't what you seemed to be saying. -brett

1 0

RE: multicast seen as equivalent of caching packets
by Jamie Scheinblum 16 Jun '99

16 Jun '99

The problem I think is getting cooperation. If you do replication on top of the existing non-multicast internet you would have to build a network on top of existing routing. Which it seems to me would mean either a new hierarchy of data transport needs to be built (new peering, etc), or the source sender ends up sending content to n first level nodes on a small height tree, which offers no great advantage. I always thought the advantage of multicast was that it minimized the number of receivers the source sent content to. Packet caching in multicast seems to be at the advantage that if any multicast router had caching enabled, everyone in the tree would benefit, if I followed Sean's summary correctly. -jamie > -----Original Message----- > From: Alex P. Rudnev [SMTP:alex@Relcom.EU.net] > Sent: Wednesday, June 16, 1999 6:29 AM > To: smd(a)clock.org > Cc: avg(a)kotovnik.com; jamie(a)fast.net; nanog(a)merit.edu > Subject: Re: multicast seen as equivalent of caching packets > > > Sorry; it was my assertion in this tread -:). Through it change nothing... > > Why don't start fron the replication/reflection, then go to the > short-time-caching, may be to the long-time-caching, and then only to the > multicasting. Those who is playing around multicasting now looks amazing > - they build a complex, twisted routing schema with the PIM, etc etc to > deliver usially ONE data stream to the ONE customer -:). May be, to the > two customers. And then ask _why don't another want to play with them_. > > This was the issue - on the first stage, simple packet replication is > just the same as multicasting, but is much simpler to inplement globally. > And this is in fact caching with the zero time-to-expire. > > Alex. > > > If you think about it briefly, Vadim's assertion that "packet caching" > > and "multicast distribution" are indistinguishable if the packets are > > retained in the cache for essentially 0 time. > > > > > I think Vadim's point is that accepting the validity of the > > multicasting = caching assertion allows one to consider doing > > a better job of reducing the consumption of network resources > > by replayable content than the use of native multicast does. > Just right. > > > (This is perhaps why Peter Lothberg and company have been working > > fairly hard at enabling the inflation of the use of Internet multicast, > > since the deployment costs of native IP multicast are so small that > > the ultimate non-scalability of IP multicasting (or multicasting > > in general if you accept Vadim's argument) does not prevent people > > from turning on PIM/SM+mBGP+MSDP. First you roll (excuse the pun) out > Compare the multicsting listeners and RealVideo or RealAudio or MP3 > listeners; first are 1% of the last. What multicast deploying are you > talking about, it's a myth yet. > > > Aleksei Roudnev, Network Operations Center, Relcom, Moscow > (+7 095) 194-19-95 (Network Operations Center Hot Line),(+7 095) > 230-41-41, N 13729 (pager) > (+7 095) 196-72-12 (Support), (+7 095) 194-33-28 (Fax) >

1 0

McLeod fiber cut in Chicago
by Charley Kline 16 Jun '99

16 Jun '99

Our OC-3 to the AADS NAP went out at 13:10 UTC today. McLeod Communications reports there is a fiber cut in Chicago that is "affecting a lot of customers." They didn't have an ETR for me. /cvk

1 0