Re: [swinog] www.admin.ch / www.parlament.ch down?

2004-10-07 Thread Markus Wild
 Anyone else who cannot reach http://www.admin.ch/ and
 http://www.parlament.ch/ (I intended to see the last mile debate)

Perhaps they forgot admin.ch is already a customer of theirs and
want to force them to pay them for peering?:)

Markus
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: [swinog] Routing Problems to www.job.com

2004-09-21 Thread Markus Wild
 I wanna ask, if some other providers are encountering problems joining the
 site www.job.com .
 I have tried it out trough the Access, sunrise and cablecom line, but the
 page will not
 appear.

Works here, but perhaps the guys had a problem with their server?

Cheers,
Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: [swinog] Terminalservice recommondations

2004-08-27 Thread Markus Wild
 Anyone can suggest a good, small and cheap terminalserver box with
 4 ports?

Find a 2nd hand Livingston Portmaster (PM-2), can't beat those...

Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: [swinog] BBC Multicast peering

2004-08-20 Thread Markus Wild
If anyone is interested, the CIXP has a dedicated infrastructure
 for multicast traffic exchange (at no charge for CIXP members); some
 ISPs are alredy connected since a few months.

Any web page documenting this, and possibly also who is already
connected? I'm interesting in joining.

Cheers,
Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: [swinog] INOC-DBA

2004-08-18 Thread Markus Wild
 Has anyone got those Cisco phones to work with INOC-DBA? Whom must
 one contact? I have mailed {info,[EMAIL PROTECTED] but received
 no reply.

Uhm, has anyone received phones from ALSO? I've neither got an
acknowledgement of my order (by fax) nor received any phones
so far...

Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: AW: [swinog] S.HDSL modem

2004-08-12 Thread Markus Wild
 I was curious to know if there was products (or technologies) capable of 
 more that 2Mb on a copper pair ?

Check out 

http://www.tahoe.pl/eng/xdsl_modems.php

and the prices are good as well...

Cheers,
Markus
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: [swinog] Network Weather Map

2004-08-09 Thread Markus Wild
 There is a tool called mapserver that does a great job for rendering all
 kinds of maps. I wouldn't be surprised if some of the network weather

Do you know whether there is some free GIS data for Switzerland? I was once
looking for something that would go down to street/number level, but 
didn't find anything...

Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: [swinog] Squid problem

2004-07-29 Thread Markus Wild
 old clumsy CacheFlow in place. They won't accept something like Hey, do
 it like ftp://user:[EMAIL PROTECTED]/, because your browser stinks, or go
 and get a decent FTP client.

Hasn't M$ discontinued support for user:pass@ qualification in URLs with
recent IE updates/security-fixes? At least with http this no longer
works (had to fix own software there as well...).

Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: [swinog] Google problems

2004-06-15 Thread Markus Wild
 Same answer(no record available) for ns1-ns4.google.com, also for
 google.ch.

Hm, works for me?

;  DiG 8.3  @146.228.10.15 www.google.com 
; (1 server found)
;; res options: init recurs defnam dnsrch
;; got answer:
;; -HEADER- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr rd ra; QUERY: 1, ANSWER: 24, AUTHORITY: 4, ADDITIONAL: 1
;; QUERY SECTION:
;;  www.google.com, type = A, class = IN

;; ANSWER SECTION:
www.google.com. 2m11s IN A  66.102.9.99
www.google.com. 2m11s IN A  216.239.37.104
www.google.com. 2m11s IN A  216.239.39.104
www.google.com. 2m11s IN A  216.239.41.104
www.google.com. 2m11s IN A  216.239.51.104
www.google.com. 2m11s IN A  216.239.53.104
www.google.com. 2m11s IN A  216.239.57.104
www.google.com. 2m11s IN A  216.239.59.104
www.google.com. 2m11s IN A  66.102.11.104
www.google.com. 2m11s IN A  66.102.7.104
www.google.com. 2m11s IN A  64.233.167.104
www.google.com. 2m11s IN A  64.233.161.104
www.google.com. 2m11s IN A  66.102.9.104
www.google.com. 2m11s IN A  216.239.37.99
www.google.com. 2m11s IN A  216.239.39.99
www.google.com. 2m11s IN A  216.239.41.99
www.google.com. 2m11s IN A  216.239.51.99
www.google.com. 2m11s IN A  216.239.53.99
www.google.com. 2m11s IN A  216.239.57.99
www.google.com. 2m11s IN A  216.239.59.99
www.google.com. 2m11s IN A  66.102.11.99
www.google.com. 2m11s IN A  66.102.7.99
www.google.com. 2m11s IN A  64.233.167.99
www.google.com. 2m11s IN A  64.233.161.99

;; AUTHORITY SECTION:
google.com. 2d17h45m38s IN NS  ns1.google.com.
google.com. 2d17h45m38s IN NS  ns2.google.com.
google.com. 2d17h45m38s IN NS  ns3.google.com.
google.com. 2d17h45m38s IN NS  ns4.google.com.

;; ADDITIONAL SECTION:
ns1.google.com. 3d2h8m7s IN A   216.239.32.10

;; Total query time: 3 msec
;; FROM: janus to SERVER: 146.228.10.15  146.228.10.15
;; WHEN: Tue Jun 15 15:50:35 2004
;; MSG SIZE  sent: 32  rcvd: 504


-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: [swinog] Rechtsradikale spam mails

2004-06-10 Thread Markus Wild
 We recognise tons of rechtsradikale spam mails today. Do you have similar
 sightings?

Yup, looks like all Sober.G infected windows pcs are now used as
spam-relay for this junk...

Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: [swinog] ISP's share Anti-Spam rules ?

2004-05-31 Thread Markus Wild
 Could a spammer take legal actions if he finds out that his business horizon
 mails are getting blocked ? I think about websites and faxnumbers.

If you make blocking behavior customizable per customer, ie. the customer
can deliberately decide he doesn't want to receive any mail that matches
common swiss spam patterns (or however you'll call that ruleset), I don't
see how that could be illegal? Unconditional filtering of mail based on 
probability is not something I'd consider to enable...

Markus
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: [swinog] BGP Question, metric incoming route-map

2004-05-27 Thread Markus Wild
 sh ip bgp regexp _3320_ (next hop addrs removed)
 
 Network  Next Hop Metric LocPrf Weight Path
 * i81.201.32.0/20   x.x.x.x  90 50  0 702 3320 ?
 *i y.y.y.y 100 50  0 286 3320 ?
 
 We have:
 1. same local pref.
 2. equal as-path length
 3. metric on incoming (!) route map set manually to 90 for next hop
 x.x.x.x, and to 100 for y.y.y.y because I would prefer x.x.x.x over
 y.y.y.y if 1. and 2. are equal, because I learned once that
 smaller metric wins.

Metric on external routes really is the MED of the route. Ciscos 
by default compare MEDs only of routes among the same peer AS (so if
you had 2 uplinks with AS286, MED comparison would use the lower metric
among those two gateways). Note that this behavior is very reasonable,
because normally if you don't set your metric manually, you get whatever
IGP metric your peer attaches to the route. You can't really compare a
metric from ISP1's IGP to the IGP metric of ISP2, they could be completely
different (one running OSPF, the other ISIS). If you always override the
metric in route-maps, you could use bgp always-compare-med.

If you only want to do route-selection locally on this router, use weights
instead of metric. If you want to distribute the preference within your backbone, 
use local-pref.

Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: [swinog] Shame on you! - No-shows at SWINOG-8

2004-05-03 Thread Markus Wild
 How about this:   now shows will sponsor the next beer event ;-) or Dinner?

Then they'll probably not show there either :)

Markus
___
swinog mailing list
[EMAIL PROTECTED]
http://lists.init7.net/cgi-bin/mailman/listinfo/swinog


Re: [swinog] Mass mailing: how to do it nicely?

2004-02-16 Thread Markus Wild
 Just an idea btw: everybody seems to work on that problem alone in 
 its kitchen. Why not work a bit more together, for example on 
 Switzerland/Swinog-level, to setup a kind of dynamic Swinog RBL ?

As a start of working together, I've set up a small web site
that documents the changes I made (and that are active on our
mail servers). This is currently not for the faint of heart (you
should know a bit more then how to use pkg_add or rpm on your
system of choice...), but if you feel adventurous, have a look at
http://www.dudes.ch/spamtracker

I'll maintain this site (and the code changes) on my spare time, so if
you port the thing to postfix, idefix, or whatever your alternate
MTA is called, I'll happily add those.

Cheers,
Markus

BTW: since the whole discussion was started because a certain ISP 
started to block address ranges: we currently have 112 hi##ed.ch entries 
in the spamtracker...
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] Mass mailing: how to do it nicely?

2004-02-16 Thread POP KN 999999 /ON email/NONE Markus Wild
 nice page. note that qmail behaves substantially different: it accepts
 all recipients (well, for domains it is responsible for) and bounces
 them afterwards. This makes it more difficult to harvest for valid mail
 addresses, with the drawback of creating more traffic for accepting and

Uhm, is this a non-teakable behavior? In my eyes it is crucial to be
able to refuse SPAM at the earliest possible moment, because for every mail
you can refuse during the SMTP handshake phase, you don't have to do the
explicit bounce (and receive all the double bounces of non-valid 
sender addresses in the first place). With all the virii and worms in
the wild that just fake sender addresses, you don't really want to put
this burden upon your mail server. Your queues will grow and grow with
non-deliverable error bounces, slowing down your regular mail delivery.

 bouncing these mails. And most of these bounces go to postmaster,
 because the sender addresses are forged.
 
 PS: if you want collaboration, why not set up a wiki wiki?

Good idea, I'll look into this!

Markus

PS: sorry about the old email address, but this list server is pretty
picky in which addresses it accepts mail from.. ;-)
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] Mass mailing: how to do it nicely?

2004-02-16 Thread Markus Wild
 Just an idea btw: everybody seems to work on that problem alone in 
 its kitchen. Why not work a bit more together, for example on 
 Switzerland/Swinog-level, to setup a kind of dynamic Swinog RBL ?

As a start of working together, I've set up a small web site
that documents the changes I made (and that are active on our
mail servers). This is currently not for the faint of heart (you
should know a bit more then how to use pkg_add or rpm on your
system of choice...), but if you feel adventurous, have a look at
http://www.dudes.ch/spamtracker

I'll maintain this site (and the code changes) on my spare time, so if
you port the thing to postfix, idefix, or whatever your alternate
MTA is called, I'll happily add those.

Cheers,
Markus

BTW: since the whole discussion was started because a certain ISP 
started to block address ranges: we currently have 112 hi##ed.ch entries 
in the spamtracker...
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] cablecom antispam strategy

2004-02-12 Thread Markus Wild
 Using the existence or non-existence of an PTR RR for the legitimacy
 of sending email is completely bogus.

Ack. There's _tons_ of cable/DSL links with correct RR pointers
that are utter SPAM engines, and judging from the recent reaction
to CCs move, a _lot_ of valid MTAs that don't have matching or
even existing RRs. Rejecting these is not really going to avoid
a lot of spam, but it going to make you unreachable for a considerable
amount of (potential) customers, and customers of your customers. 
For us at least, that's completely unacceptable.

Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] Mass mailing: how to do it nicely?

2004-02-10 Thread Markus Wild
 Do big ISP have security systems, which blacklist or return a
 SMTP 55x after getting n*1000 mails from the same server?

You'll be automatically blocked for a day if you send us more than
a (low) amount of non-existant recipients (which easily happens if
your customer doesn't keep a clean list of email addresses, which is
unlikely if he has several thousand recipients). 

Markus
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] Mass mailing: how to do it nicely?

2004-02-10 Thread Markus Wild
  You'll be automatically blocked for a day if you send us more than
  a (low) amount of non-existant recipients (which easily happens if...
 
 nice concept, should be quite practical against dictionnary

Exactly, this was the prime reason for coming up with it, because I
was just sick of watching those guys essentially taking a dump of our
email configuration without us being able to do something about it.

 attacks. Have you implemented that by yourself, or was it already
 a feature of your MTA ? And what kind of blocking art, if I may
 ask: 4xx, 5xx or even iptable rule?

It's a custom modification to sendmail-8.12.10. My recent conversion
of the previous berkeley-db based approach to a central MySQL db for
storing the records of violating IP addresses is now in field trial
on two of our mail servers. If nothing goes wrong I should have all
of them on the new code by the weekend, and I'll then also publish the
code. Just as a quick summary:
- the modification triggers an insertion of a record into the database 
  with an expiration date and some detail information which comes in 
  handy for later analysis. It also kicks the current session out with
  a 421 error (this is RFC compliant behavior). Timeout and thresholds
  are configurable.
- the normal configuration file does all the rest. The check_relay
  function uses a map (backed with the same MySQL table) to determine
  whether the incoming call should be blocked, and if so, it is rejected
  using standard sendmail mechanisms.
- there's support for whitelist entries that will never be blocked (but
  sessions will still be dropped upon violation of the criteria)

 I'll try to setup the same kind of system for our servers
 (qmail-vmailmgr  qmail-ldap based).   

Don't know these, but what you need are these components:
- some place to wedge into your mail server where it counts the number
  of failed recipients. Perhaps (as sendmail does) it already has a
  feature to throttle (insert sleeps/delays) when exceeding a specific
  amount of failed recipients. That's a very good place to do more than
  just complain.
- some generic way of performing a map-/table-lookup for incoming
  connections, whether those should be allowed to proceed.
- we also use LDAP based mail routing internally, but I deliberately
  decided against putting these records into LDAP because LDAP sucks
  at write performance, and there can be potentially tons of inserts if
  one of the guys with a distributed spam network starts a mailing. This
  was the prime design decision to use MySQL for this purpose.

Cheers,
Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] Contacts Swissonline / Hispeed

2004-02-09 Thread Markus Wild
  Now the users think their mails have been succesfully delivered
  because they won't receive a bounce mail until the mail expires
  in the queue (1 week). Quite frankly, that sucks.

Uhm, normally they should get warning mails in between, unless
you have changed common settings? At least that would be the
behavior with sendmail.

  ~  451 Your mailserver has been blocked, please see
 This is not correct.  A 4xx error will keep the mail in the queue
 until it expires (just like blocking smtp connections).  What you
 want is an 5xx answer for an immediate bounce to the user.

Yes and no... I actually deliberately return 4xx errors for my
(temporarily!) blocked addresses, because I do want servers to 
retry submission (if the sender actually does use a normal,
queuing MTA, and not just a bulkmailer that will treat 4xx just like
5xx). Also, I find an odd kind of satisfaction to know that open
3rd party relays will then pile up SPAM :)

If you reject your peer at the beginning, and if you have some 
rate-limiting per client on your mail server (I recommend both),
they can try to hit you hard and it won't hurt that much (and you
do tie up some of their resources, which they then can't use to 
spam someone else at the same time).

Cheers,
Markus
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] Mailempfang wegen SPAM blockiert / Mail receipt becauseof Spam blocks

2003-10-29 Thread Markus Wild
 Next use either connection limiting features (such as FreeBSD ipfw2)

Just one word of caution on this one: I've had this activated on
our mail server (IPFW2 in 4.x-STABLE) a couple of months ago, and 
it lead to very odd memory corruption issues (panics that _all_ 
looked like hardware problems, like bogus memory, cpus, etc. Panics 
traced within the filesystem, traps, whatever, but never within 
firewall or just generally, networking  code). It took me quite a while
to figure out where these were coming from (after much hardware 
replaced...). Don't know whether this bug has been found/fixed, 
looked very hard to locate.

Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] OSPF Tuning...

2003-10-10 Thread Markus Wild
 RE: [swinog] OSPF Tuning... why do you want to tune ospf timers ?
 
 the default dead time is 120 sec. if a router crashs and the physical layer

Huh? Not in my case..:

GigabitEthernet0/0.4 is up, line protocol is up 
..
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
..

 doesnt go down for any reason (like bridged ethernet link with switches in
 the middle), you can sit down, take a coffee, smoke a cig, whatever, until

I've actually reduced timers in exactly such a setup (GE-ring based
on switches, with VLANs forming pseudo-WAN links for attached routers). 
In retrospect, I wouldn't do this again though, would probably rather
try to tweak STP to converge faster than to touch OSPF timers (reason: 
in DOS situations where links get saturated, having lower timers 
is a bitch...). I'm currently at hello=5 on this ring.

Cheers,
Markus

--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] delegation only patch?

2003-10-03 Thread Markus Wild
 Just a quick review: which providers have already installed the 
 Bind delegation only patch re. Verisign/Sitefinder (or similar 
 for their environment)?

Done this the last couple of days for VIA (some servers upgraded to latest bind9,
others bind8 forwarder-chained to the new bind9 ones as per the instructions
on www.isc.org). Only thing to watch out: there _are_ TLDs that include 
non-delegation records, so don't be too restrictive in your root-delegation-only 
clause. With the following setting from what I can tell in the logs there should
be no legit entries rejected, but I'll have to recheck in a while:

  root-delegation-only exclude { de; lv; museum; us; ch; biz; };

(I don't know about .ch - there at least USED to be MX records in there
directly in the good old UUCP times, don't know whether some survived;-)).

Markus
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] Speed Reduce a FE-Port

2003-09-02 Thread Markus Wild
 i do have just confused about bit/kbits...
 
 rate-limit input access-group 100 248000 1500 2000 conform-action transmit 
 1500 and 2000: here it seems to be kbits

 rate-limit input 2048000 256000 256000 conform-action transmit
 256000 seems to be bits.

They're bytes.. actually, they're sizes of virtual buckets used to implement
the policer. Essentially as far as I recall it, you have these:
  speed (bps)
  size of conforming bucket (Byte)
  size of burst bucket (Byte)

the speed defines your measuring interval (if your speed was the same as
the physical speed, your max size of the first bucket would be speed/8,
and so would be the burst bucket. This is a good value to start your tuning
numbers with). Since in this case your physical speed is higher, you _could_ 
get more data thru the link. IOS will make sure that on average, the given
speed is not exceeded, but with the bucket sizes you can tweak how quickly/
aggressively it actually drops packets that don't conform. I suggest you
read thru some of the Cisco documents on traffic shaping and policing, they
go into much more details on how these parameters play together internally.

Something you might consider for smoothest rate limiting:
- use traffic-shape for outgoing traffic
- use rate-limit for incoming traffic

This should be least disruptive for TCP connections.

Cheers,
Markus
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] Re: Short outage at TIX

2003-08-19 Thread Markus Wild
 We would wish to see a configurable option to allow STP information to
 be ignored, and filtered at the port, and/or the port to be disabled
 completely, on a per port basis.

We have:

interface e 1/4
 port-name TIX-Uplink-new
 no spanning-tree 

sh int e 1/4
...
  STP configured to OFF, priority is level0, flow control enabled

this is a Foundry switch, is there no equivalent for Cisco?

Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] Portmaster 2 or 2e for sale?

2003-08-02 Thread Markus Wild
 boxes with some network interfaces and red circle logos on them. No idea 
 what that was, and no idea what Portmaster is. 

Good site about portmasters: http://www.portmasters.com

Cheers,
Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] Portmaster 2 or 2e for sale?

2003-08-01 Thread Markus Wild
 KPN/Quest is closing the business in Switzerland, and they sell 

That's putting it somewhat mildly ;-)

 lots of equipment cheap. I've seen there some gears with Lucent logo on 

If you really saw equipment with Lucent logo on them, it must have been DSLMAX20
DSLAMs (1HU things), not Portmasters (we never bought them that late, ours all
still had Livingston logos). There might be a few DSLMAX20 left (nice little
SDSL concentrators, really!), but definitely no PM2(e).

Cheers,
Markus
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] CERN

2003-07-20 Thread Markus Wild
 Does the CERN have routing troubles?
 
 It seems all their peerings are down.
 Anyone got its peering to CERN/AS513 down?

Not everything's down at CIXP, but certainly the two 513 nodes.
Perhaps there's a partial either power or switch outage? Since I
had to reboot the router due to the IOS bug, I don't have a lot
of historic info, but so far, there's:
- 1 session up longer than 2days
- 6 sessions came up a bit more than 4h ago
- 4 sessions down since a bit less than 14h

Times are sufficiently close to suggest that some common event 
caused the sessions to go down (and for some to come back up
again). 

Markus
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] STM-1 Standard Interface?

2003-07-01 Thread Markus Wild
 Perhaps, this is a stupid question, but which
 interface is normaly used, when we buy stm-1 bandwith
 from a carrier or when we order a stm-1 connection
 to connect two pop of us?

We only use PA-POS-OC3SMI. Only exception would be if you
specifically order an ATM STM-1 service from a carrier.

Cheers,
Markus
-- 
VIA NET.WORKS (Schweiz) AG
Riedstrasse 1, CH-6343 Rotkreuz, Switzerland
Telefon: +41 41 798 2121 / Fax: +41 41 798 2122
Markus Wild, Manager Engineering, e-mail: [EMAIL PROTECTED]
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/


Re: [swinog] RFC1918 ip's within trace on normal provider-link

2003-06-16 Thread Markus Wild
 A null route will not stop you from getting those addresses on a trace.
 That's problem of your upstream provider's backbone. Well... not really
 a problem. Just some people don't like to see them on traces.

It can actually be a problem, since if that node would want to signal
back icmp messages (for example indicating a too large packet), such
a message could reasonably be filtered on its way back, since strictly
speaking private addresses are not supposed to appear in the open. 
Result: connectivity problems.

Cheers,
Markus
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/