- Test - lists.nanog.org

Re: Internet Backbone Index
by garyz＠savvis.com 14 Jul '97

14 Jul '97

Sean, we only have 805 Mbps of possible bandwidth to other networks. I not sure what you mean by a better engineered network. If you only have a routed network, not sure this is the best way to engineer a network today. Switch technology can do alot of good things. The model does fall apart if you say you are only going to buy from these three to five, but it does not fall apart if you watch your traffic and you buy from whom your traffic is going to. The idea is not to engineer poor peering in the MAEs and NAPs with a bunch of networks. Buy and manage from the networks you are going to and you will engineer a better product. I still think that if you really looked at a normal NSP traffic that the bulk of it is with 5 to 8 networks. I some what agree with some of what you say, that a peer could be a good thing if it is private and not in a shared peering in the MAEs and NAPs. You talk about engineering good networks, why then use something that is unmanaged and uses poor technology and poor engineer designs in a MAE or NAP? Where is most of the packet lost on the internet? MAEs and NAPs. Where does most of the latency come from? Routers. MAEs and NAPs are yesterdays ideas that everyone who has bought into the concept now has to live with it, they did not build the business around the fact they had to pay and manage to provide good service. The time is almost upon us that you pay for what you get on the internet and you must pay for the bandwidth that you use, not what you can over subscribe until your customer begin to leave. This is a tough model, few will make it. Some day the internet will use measurements, such as QOS and customer will be willing to pay for those who have engineered their networks to provide QOS. I only have one more question for you; how many router hops, on your network, from New York to Los Angeles? If it is more than 1, then tell me what your latency is from end to end. Let's compare, shall we. Gary Zimmerman V.P. of Network Engineering Savvis Communications Corp. email: garyz(a)savvis.com http://www.savvis.com Office: 314.719.2423 Address: 7777 Bonhomme Suite 1000 St. Louis, MO 63105 ---------- > From: Sean Donelan <SEAN(a)SDG.DRA.COM> > To: nanog(a)merit.edu > Subject: Re: Internet Backbone Index > Date: Wednesday, July 09, 1997 5:45 PM > > >SAVVIS. Fortunately Our target markets are not just libraries and other > >information providers, it's EVERYONE that needs a T1 and above connection > >to the Internet. How many cities are you in Sean, where are DRA's POPs for > >customers to access? How much bandwidth does DRA have to get these > >customer to other network? Let's compare bandwidth shall we. > > DRA tries to do one thing well, rather than a lot of things not so well. > > Like all things, the correct answer is "It depends." If you are interested > in the DRA network geography, a pretty picture of the DRA North American POPs > is at <http://dranet.dra.com/dranet.html>. BTW, all those locations are up, > operational, and have DRA owned and operated equipment in place. DRA's > international offices are located in Montreal Canada, Paris France, and > Melbourne Australia. The primary NOC is in St. Louis, MO and backup NOC > operates out of Monterey, CA. > > Since DRA also has a lot of private connections (in the old NSFNET AUP days > these were called 'backdoor' connections) calculating total bandwidth is a > bit confusing. If you follow the AGIS bandwidth counting method, DRA has > about 268 Mbps of possible bandwidth to other networks through public and > private inter-connects, although DRA doesn't have any single link faster > than 45 Mbps. However, bandwidth is rarely the problem. I've found a > well engineered 56Kbps connection outperformed a DS3 port into a poorly > engineered network. > > >When 80 to 90 percent of the Internet traffic is to MCI, SPRINT and UUNET > >then our model is the right way to build this, not to try and see how many > >peering agreements one can get. > > Except the model falls apart if 50% percent of the your Internet traffic > isn't just to MCI, Sprint and UUNET, as in DRA's case. If you want to > get anywhere off the commercial beaten path, like many of our customers > do, things quickly get very bad if you stick with just those three > providers. Most of our backdoor connections exist exactly for that reason. > > Look at the KEYNOTE test sites. Although it might appear heavly weighted > towards MCI, SPRINT, and UUNET (23 out of 35 sites), the network is never > so simple. It works well as long as you are in a US city going to another > US city. But looking at the Bell Canada graph, things don't work as well. > Hint: If you are trying to reach a Canadian audience, don't put your web > server in a US city. We've had a private 'backboor' connection to the > University of Toronto for years for precisely this reason. > > Further, about half the Keynote test sites seemed to have alternate > connections. I couldn't figure out the numbers until I started doing > traceroutes, and then things started making more sense. You'll discover the > best route isn't always through MCI, Sprint or UUNET. Those little exchange > points can make a difference. > > St. Louis, MO MCI 207.230.62.16 Cybercon/Internet 1st > $ traceroute 207.230.62.16 > traceroute to 207.230.62.16 (207.230.62.16), 30 hops max, 38 byte packets > 1 StLouis22-e3.dra.net (192.65.218.2) 200 ms 10 ms 0 ms > 2 stlouix.starnet.net (198.32.132.12) 10 ms 20 ms 0 ms > 3 e0-1-2.starnet2.starnet.net (199.217.255.97) 70 ms 10 ms 10 ms > 4 router.cybercon.com (199.217.252.58) 10 ms 20 ms 10 ms > 5 207.230.62.16 (207.230.62.16) 20 ms 10 ms 10 ms > > It is amusing to look at AGIS's chart in the Boardwatch directory. The > graph dramatically demostrates how badly AGIS's tough-line peering policy > hurt it in this test. Refusing to peer with CRL or Goodnet wouldn't have > changed CRL's or Goodnet's performance very much, but it does appear to > hurt AGIS's performance. Maybe Sprint and MCI might want to re-think their > peering policies also. On the other hand, I've never heard of CompuServe > turning down an opportunity to inter-connect their network with other > networks. > > I'm a pragmatic person. DRA has connections to several exchange points, > and has many more private 'backdoor' connections to other networks. DRA > even buys (gasp) service from a few other providers, and also sells service > to a few other providers. All work well, customers are happy, and DRA is > profitable. Let's compare balance sheets shall we? > -- > Sean Donelan, Data Research Associates, Inc, St. Louis, MO > Affiliation given for identification not representation

10 16

Re: Internet Backbone Index
by Scott Bradner 14 Jul '97

14 Jul '97

> Doesnt an IP Switch have lower latency and higher pps? well, since many of the backbone routers have been able to fill their pipes for quite a while what difference would the "higher pps" make? If you are already limited by the wire... as far as latency goes, a rather slow router has a few hundred micro seconds processing latency - and a "level 3 switch" might have half that but even if it had 0 latency (kinda hard to do but for the sake of argument) you would only save a few hundred microseconds per hop it would take rather many hops to equal one transit latency on most networks - and could not be found in the interupt-to-application latency on the reciveing end. buffering, which is common between switches & routers, has a far larger impact. Scott

1 0

RE: Internet Backbone Index
by Rodney Joffe 13 Jul '97

13 Jul '97

Heh..... To throw more oil on this fire, here's what one of our customers is using to beat us over the head with! http://www.internetweather.com Rodney Joffe Chief Technology Officer Genuity Inc., a Bechtel company http://www.genuity.net

1 0

Re: NSPs and filters
by Vadim Antonov 13 Jul '97

13 Jul '97

Daniel Senie <dts(a)proteon.com> wrote: >Would you care to explain just exactly WHY a CAM type architecture could >not filter packets WHILE BEING RECEIVED from a given type of wire? This >is NOT an unsolveable problem. Perhaps you've been blinded by the >current architecture of the equipment you've invested in to date. I didn't say this problem is not "solveable". I said that the solution is known, but to my knowledge nobody implemented or plans to implement it in hardware (and for several good reasons, too). --vadim

1 0

Re: NSPs and filters
by Vadim Antonov 13 Jul '97

13 Jul '97

randy> So, at POP X, I take in maybe 100 prefixes, with maybe 1000 randy> at some POPs. How do I build and maintain that filter list, alan(a)mindvision.com (Alan Hannan) wrote: > The same way you build and maintain routing filter lists for the > prefixes you take in. Bzzt. Routing filter lists are applied to routing updates. Packet filter lists are applied to packets. Big difference. 1000-entry packet filter will slow any existing router down to crawl, and practically all future boxes won't do any better. --vadim

3 2

Re: NSPs and filters
by ice9 13 Jul '97

13 Jul '97

On Fri, 11 Jul 1997, Jon Lewis wrote: > Why is it that the NSPs I've encountered refuse to do any sort of sanity > filtering on their customer connections? i.e. If UUNet knows that FDT has > only 205.229.48/20 and 208.215.0/20, why should they let me send traffic > through their network with random source addresses? > > FDT has been the target of forged source address UDP attacks for the past > 2 days. It's all being stopped at our router that takes our UUNet T1, but > the extra T1 traffic is causing UUNet's usually unreliable network to be > even less reliable, and we've lost connectivity to UUNet several times > this evening. Its not feasible to filter packets on customer gateway routers. When you impose a packet filter on a GW router customer interface, all packets destined to that customer have to be matched to an access-list and then forwarded down the pipe or dropped. This increases the load on the router CPU, because it is used to switching the packets. Now you have to analyze each packet which takes up CPU time. This is not a nice thing to do to a router, especially while the router is trying to keep up with 50 other customers... And if more than 1 customer wants this type of service, you start really feeling the load. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ice9(a)paranoia.com http://www.paranoia.com/~ice9 My opinion may not reflect that of any living person, but its the only one that counts!! main() {for(;;fork());} =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

7 8

More on ingress filtering
by Daniel Senie 13 Jul '97

13 Jul '97

I'd encourage folks to read the draft that Paul Fergusen and I have written on this subject. We talk about some things that COULD be implemented that would greatly help with source address problems. One of these would be a change to your remote access servers, and would be quite straightforward for vendors to implement: For DIALUP users, provide an option (would need to be per user) to require the packets arriving from that dialup user have the IP address that was assigned by the RAS server when the user dialed up. At modem or ISDN speeds, the packet rate is QUITE low, and this filtering should NOT be a CPU overhead problem. A SINGLE compare of a 32 bit integer is ALL we're talking about here. The reason to make this configurable per-user is to allow dialups by remote routers that are routing separate nets or subnets behind them. In those cases, a more complex filter would be desirable, but perhaps somewhat less necessary. It is my suspicion that a vast majority of the intentional source IP address trouble comes from dialup users who can leap from provider to provider. Filtering should be done as close to the actual customers as possible. I do understand the difficulty with the present core routing equipment when trying to filter large amounts of traffic, but that doesn't apply to routers at the periphery of the net. As someone else suggested, even if some of the core networks can't do all of their own filtering, they COULD add that as a requirement for those networks that are fed from them, and they from their downstreams, etc. until the T1 line, or 56K leased line, or dialup modem line at the periphery IS FILTERED. Daniel Senie OpenROUTE Networks, Inc. -- ------------------------------------------------------- Daniel Senie dts(a)openroute.com OpenROUTE Networks, Inc. http://www.openroute.com/ 508-898-2800

1 0

Re: NSPs and filters
by Vadim Antonov 13 Jul '97

13 Jul '97

randy(a)psg.com (Randy Bush) wrote: >So, at POP X, I take in maybe 100 prefixes, with maybe 1000 at some POPs. >How do I build and maintain that filter list, and how long does it take each >packet to get through it with a router that also does real routing? That can be done, and is relatively easy. Not in cisco's or any other hardware-assisted box, though (figuring out why is left as an excercise to the reader :) My estimate is that the total filtering overhead is at about 2.5% for a "software" router. And, yes, i do plan to implement that kind of filtering. --vadim PS. Hint: i described the technique for doing that in a mailing list, year ago.

1 0

Re: NSPs and filters (fwd)
by Michael 13 Jul '97

13 Jul '97

>> This is not a nice thing to do to a router, especially while the router is >> trying to keep up with 50 other customers... And if more than 1 customer >> wants this type of service, you start really feeling the load. > >I'm not saying UUNet should install whatever filters I want on their >routers. I'm just saying the net would be a MUCH nicer place if NSP's all >did ingress filtering on their customer connections. If current routers >can't handle the load this would create, then NSP's need to find vendors >willing to deliver the necessary power, or they need to rethink the way >they design their networks. Then couldn't the net also be a nicer place if the 'customer' filtered their outbound packets? Of course this involves trusting the engineer's of the downstream network to actually DO the filtering. Why have an NSP drop several customers off of the net because of one pre-pubescent ping flooder, when the offending customer himself can be dropped (unless his network is administered by pre-pubescent ping flooders) and not affect anyone else? Michael

2 1

NSPs and filters
by Jon Lewis 13 Jul '97

13 Jul '97

Why is it that the NSPs I've encountered refuse to do any sort of sanity filtering on their customer connections? i.e. If UUNet knows that FDT has only 205.229.48/20 and 208.215.0/20, why should they let me send traffic through their network with random source addresses? FDT has been the target of forged source address UDP attacks for the past 2 days. It's all being stopped at our router that takes our UUNet T1, but the extra T1 traffic is causing UUNet's usually unreliable network to be even less reliable, and we've lost connectivity to UUNet several times this evening. 5 minute input rate 1326000 bits/sec, 318 packets/sec 5 minute output rate 469000 bits/sec, 286 packets/sec PUNet suppost says there's nothing they can do, and that I should talk to their security people about buying a firewall for FDT on monday...like a firewall on our side of the T1 is going to do us a lot of good.... ------------------------------------------------------------------ Jon Lewis <jlewis(a)fdt.net> | Unsolicited commercial e-mail will Network Administrator | be proof-read for $199/message. Florida Digital Turnpike | ________Finger jlewis(a)inorganic5.fdt.net for PGP public key_______

5 6