Re: Verisign vs ICANN

2003-09-21 Thread Petri Helenius
Kee Hinckley wrote: Never mind that there isn't a standard format for the returned information between providers. The whois database is not a replacement for a DNS query. I´m sure Verisign will come up with a XML Schema for whois information soon. Pete

site finder performance

2003-09-19 Thread Petri Helenius
The redirect port 80 server seems to gain on performance, I wonder if that´s due to Verisign fixing issues or enough people blocking it so the load lowers? We´ve gone from 22 seconds average transaction time yesterday, to about two seconds so far today. Minimum achieved is 239 milliseconds, wh

Re: Worst design decisions?

2003-09-18 Thread Petri Helenius
David Barak wrote: Personally my issues are console-cable related: is there a benefit to the HUGE variety of console pinouts used by the various hardware vendors? Just look at vendor C as an example [...] Makes me remember when representatives from mentioned vendor made funny looks when I

Re: Worst design decisions?

2003-09-18 Thread Petri Helenius
Frank wrote: the orginal GSR blanks came without handles. They were also put in tight as ***. For days after, your fingers would have the imprints of the little screws on them. I once use my socks to protect my fingers when I was pulling them out. Some Cisco gear also arrived with the flash car

Re: Worst design decisions?

2003-09-18 Thread Petri Helenius
Matt wrote: Hello all, Was doing some upgrades on a UBR7246 (to a VXR), and I got to thinking about short sighted design considerations. I was curious if any of you had some pet peeves from a design perspective to rant about. I'll start with a couple. I've got a couple others in my head fro

Re: ICANN - Formal Complaint re Verisign

2003-09-17 Thread Petri Helenius
Jerry Eyers wrote: One thing I haven't seen mentioned in all this is the incredible business monopolizing effect this move will have on the TLD's in question. It dramatically shifts the domain playing field in Verisign's favor by pointing millions of potential customers to their site(s) specifical

Re: Change to .com/.net behavior

2003-09-17 Thread Petri Helenius
Paul Vixie wrote: I've implemented the official ISC Bind hack on every single one of my name servers and am pushing it and the configuration changes out to my customers as a *required* upgrade. that seems a bit extreme. shouldn't they get to decide this for themselves? How about rewriting

Re: IP telephony

2003-09-17 Thread Petri Helenius
Christopher Bird wrote: Does anyone here have any thoughts, experiences, etc. about the use of IP telephony in corporate environments? IP telephony works alright if you take the neccessary precautions for performance management, monitoring, rate-limiting unwanted traffic, etc. which you shoul

Re: Verisign insanity - Distributed non-attack

2003-09-17 Thread Petri Helenius
Måns Nilsson wrote: --On Tuesday, September 16, 2003 10:42:02 -0500 John Palmer <[EMAIL PROTECTED]> wrote: Do not listen to this man. He is trying to do more damage than Verisign. Actually. Most wars subscribe to the "mutual destruction" doctrine. Pete

Re: Verisign insanity - Distributed non-attack

2003-09-16 Thread Petri Helenius
Stephen J. Wilcox wrote: Alternatively: Improve your hits - Point the IP to your company webserver or add an A record to your local DNS servers to resolve to your site Or just expand your traffic-magnet by changing the A-records for www.yahoo.com, windowsupdate.microsoft.com, etc... (or do

Re: certified idiots

2003-09-15 Thread Petri Helenius
I wonder how many robots they get asking for their robots.txt since all mistyped links will lead to the black hole. Or maybe that was what they wanted? BTW, traceroute to 64.94.110.11 goes through from here but port 80 is very flaky. Pete

Re: Cisco IOS Failure due to Virus

2003-09-12 Thread Petri Helenius
Stephen J. Wilcox wrote: Hi, we've seen this.. yuo need to make sure you filter the nachi worm 92 byte icmp echo's on your interfaces and it will be fine. The problem seems to be input buffers which use all the memory up for some reason. This sounds vaguely similar to the recent IOS buffers stu

Re: Microsoft distributes free CDs in Japan to patch Windows

2003-09-09 Thread Petri Helenius
Jack Bates wrote: I fully expect malicious code and even users to disable the handshake. That's fine. If a user happens to become infected, then they can be suspended or transfered to *must* perform handshake. Not everyone uses antivirus software. Not everyone will patch the security holes in

Re: Microsoft distributes free CDs in Japan to patch Windows

2003-09-09 Thread Petri Helenius
Jack Bates wrote: At some point, patching and maintaining security needs to be handled at the connection. If the protocol is written, the ISP supports it, then those with connection software supporting the protocol will maintain security while those circumventing it with other connection metho

Re: Microsoft distributes free CDs in Japan to patch Windows

2003-09-09 Thread Petri Helenius
[EMAIL PROTECTED] wrote: Failing that, why can't they bundle up just the updates onto a CD that is released every few months and shipped out to all of their regular customers along with permission to copy and redistribute. That way more OEM's would ship out fully updated machines. Because M

Re: What were we saying about edge filtering?

2003-09-07 Thread Petri Helenius
Terry Baranski wrote: Is this progress? Or is this something that "seemed like a good idea at the time"? I would like to refer to my previous statement on this matter. "The road to hell is paved with good intentions." The other favourite which applies; "Ignorance often translates to increas

Re: What were we saying about edge filtering?

2003-09-04 Thread Petri Helenius
Sean Donelan wrote: It gets even worse. Cisco has hard-coded the list of Bogons into some of its latest low-end IOS versions as part of its "auto-secure" feature. Yes, Cisco includes warnings in the manual the user should check the official list at IANA; but I also know the power of defaults. Pe

Re: What do you want your ISP to block today?

2003-09-03 Thread Petri Helenius
Johannes Ullrich wrote: 90% + of internet users do use MSFT Windows. So I don't think you have a choice other than to "live with it". I wonder if there would be a market for "Windows Outside" ISP. Pete

Re: What do you want your ISP to block today?

2003-09-03 Thread Petri Helenius
Johannes Ullrich wrote: Well, if '100%' includes all the garbage traffic generated by the worm d'jeur. On my home cable modem connection, about 80% of the packets hitting my firewall are 'junk'. Maybe I would be able to actually share files unencrypted using MSFT file sharing. If I can manage to i

Re: What do you want your ISP to block today?

2003-09-03 Thread Petri Helenius
Johannes Ullrich wrote: So should everyone else be required to keep their doors open so they can offer the service? Who is wrong/right? Millions of vulnerable users that need some basic protection now, or a few businesses? That depends if you are buying the 100% internet or 99.993% internet se

Re: Sprint NOC? Are you awake now?

2003-09-02 Thread Petri Helenius
majority of ipv6 connections is through 6 bone and there you do have a latency and And you don´t find it even a little bit suspect that you are the only one having this problem? Pete nenad Jared Mauch wrote: On Tue, Sep 02, 2003 at 10:47:14PM +0300, Petri Helenius wrote: Nenad Pudar wrote

Re: Sprint NOC? Are you awake now?

2003-09-02 Thread Petri Helenius
Nenad Pudar wrote: OK The point is that ipv6 connection is not good enough to be used. And for the sites that have the same dns for ipv4 and ipv6 ipv6 in a way "blackhole" ipv4 connection. In this case puck.nether.net is timinig out from time to time (going over ipv6) instead of going over ipv4

Re: Sprint NOC? Are you awake now?

2003-09-02 Thread Petri Helenius
Nenad Pudar wrote: Jared Ido not understand what you consider as problem here (the problem is not the latency which is more or less normal thing for ipv6 at this time) "The problem" also showing on you box is that dns6 is resolved first forcing the connection to be ipv6 which is not something th

Re: Dealing with infected users (Re: ICMP traffic increasing on most backbones Re: GLBX ICMP rate limiting

2003-08-29 Thread Petri Helenius
Vadim Antonov wrote: It should be pointed put that the ISPs have their share of blame for the quick-spreading worms, beause they neglected very simple precautions -- such as giving cutomers pre-configured routers or DSL/cable modems with firewalls disabled by default (instead of the standard "end-

Re: Sobig.f surprise attack today

2003-08-28 Thread Petri Helenius
Damian Gerow wrote: Or potentially an artifact of wanting more IP space from ARIN, as opposed to assigning a static IP to every user we have, even the ones that are only connected for about an hour a month. But hey, that's just a minor detail. Sorry for momentarily phasing to our local la-la

Re: Sobig.f surprise attack today

2003-08-28 Thread Petri Helenius
Mike Tancsa wrote: I dont think this would work too well. The users who are infected often think something is wrong because their connection and computer are not working quite right. So they disconnect / reconnect / reboot so they burn through quite a few dynamic IP addresses along the way. T

Re: Fun new policy at AOL

2003-08-28 Thread Petri Helenius
Matthew Crocker wrote: Technically no, There is no reason for a customer to have direct access to the net so long as the ISP can provide appropriate proxies for the services required. It gets complex, it gets hard to manage but it can be done. There is a stigma against proxing because of the

Re: Fun new policy at AOL

2003-08-28 Thread Petri Helenius
Matthew Crocker wrote: SMTP & DNS should be run through the servers provided by the ISP for the exact purpose. There is no valid reason for a dialup customer to go direct to root-servers.net and there is no reason why a dialup user should be sending mail directly to AOL, or any mail server for

Re: Tier-1 without their own backbone?

2003-08-27 Thread Petri Helenius
Rick Ernst wrote: One of the providers we are looking at is Level-3. Any comments good/bad on reliability and clue? We already have UU, Sprint, and AT&T. I also realize that the "they suck less" list changes continuously... :) Look for one which has working abuse department which actually ta

Re: Force Majeure

2003-08-25 Thread Petri Helenius
Brian Cashman wrote: In the opinion of folks on this list, did the recent power failure in the northeast (started 8/14 and lasted several days in some places) constitute a force majeure event? Force Majeure is by definition an "unavoidable" event. One avoids power failures by installing and ma

Re: Sobig.f surprise attack today

2003-08-22 Thread Petri Helenius
Omachonu Ogali wrote: If you're responsible for any of the IPs on the list, better permanently remove them from your DHCP pools, IP assignments, dial-up pools, or anything else that assigns IP addresses, because these will be filtered and forgotten for the next 200 years. If the virus guys get

Re: Email virus protection

2003-08-20 Thread Petri Helenius
> > Perhaps, Outlook is a secure and performant email solution - in, say, 3 > to 4 years from now, but this means a drastic change of course for the > vendor. > In other news microsoft announced that they stopped development on Outlook Express. Pete

Re: Why do you use Netflow

2003-08-19 Thread Petri Helenius
> > > What are you looking at when you analyze this data? I've > > seen uses such as top 10 destination AS's for peering > > evaluations. What else? Billing? > > > > -Lance- > > Also to get some application-specific bandwidth utilization > numbers. > I wonder how do you map your netflow data to

Re: Virus emails from nanog mail list

2003-08-19 Thread Petri Helenius
> > The IP address (which may or may not be accurate) appears to be > [195.157.87.253]. > > Has anyone else noticed this recently? > I have received 100+ SoBig trojan emails in the last few hours from IP 12.107.153.212. It figures, seems to be located in AT&T land so there might also be conne

Re: East Coast outage?

2003-08-17 Thread Petri Helenius
> Use hydrogen. One solar panel (which will last forever unless you drop > something on it) can split H2O into H and O. Store the H for windless days > or at night. Feed this to a turbine for electricity and recover heat for hot > water, store it in a heat sink, ect. Or feed the H into a fuel

Re: East Coast outage?

2003-08-15 Thread Petri Helenius
> > subsidize) local power generation via renewable energy sources (e.g. > > solar, wind, hydro) it would go a long way towards solving this problem. > > Rubbish. > > If in order to make it viable such energy needs to be subsidized then it is > not "affordable". > And solar nor wind are good for b

Re: AOL breaking dns spoof protection

2003-08-14 Thread Petri Helenius
>i don't know who aol is going to be able to send responses to who won't >apply those same restrictions. NAT or "content switch" are the terms that come to mind. Pete

Re: Port blocking last resort in fight against virus

2003-08-14 Thread Petri Helenius
Mans Nilsson wrote: Subject: Re: Port blocking last resort in fight against virus Date: Tue, Aug 12, 2003 at 10:42:38PM -0400 Quoting Sean Donelan ([EMAIL PROTECTED]): I think filters/firewalls are useful. I believe every computer should have one. I have several. I just disagree on who shou

Re: Port blocking last resort in fight against virus

2003-08-14 Thread Petri Helenius
> > I've been looking at out traffic graphs and trying to decide if traffic > really is down 10-15% over the last 24 hours or it's just my imagination. > I would say 5-10% below where it should be taking into account seasonal variations, it´s within the error margin, but barely. Pete

Re: Port blocking last resort in fight against virus

2003-08-14 Thread Petri Helenius
> > In your world DoS traffic would be free to roam the networks as it pleased > without being throttled sensibly at ingress? > Throttling is a different from blocking. Sensible traffic management does not break applications nor network transparency. You are free to choose when to forward eac

Re: AOL breaking dns spoof protection

2003-08-14 Thread Petri Helenius
I´m constantly seeing responses to queries for AOL servers which come in from different IP addresses than the query was sent to. Pete > > anyone here having problems resolving americaonline.aol.com with spoof > protection enabled on their dns servers? It appears AOL via a series of > cnames is

Re: WANTED: ISPs with DDoS defense solutions

2003-07-31 Thread Petri Helenius
> > There's nothing wrong with low level languages, and with the proper > libraries, they gain some of the advantages of high level languages. > Personally, it'll be a long time before I'm convinced that I want my > routers running Java. (Like how I brought that almost back on topic > in the end,

Re: "The internet is slow"

2003-07-31 Thread Petri Helenius
I thought that procedure was patented. By who is left as an excercise for the reader. Pete - Original Message - From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, August 01, 2003 12:03 AM Subject: RE: "The internet is slow" Rebooting the Internet once a month might pre

Re: WANTED: ISPs with DDoS defense solutions

2003-07-31 Thread Petri Helenius
> What we need is a new programming paradigm, capable of actually producing > secure (and, yes, reliable) software. C and its progeny (and "program > now, test never" lifestyle) must go. I'm afraid it'll take laws which > would actually make software makers to pay for bugs and security > vulnera

Re: WANTED: ISPs with DDoS defense solutions

2003-07-31 Thread Petri Helenius
> If FreeBSD, OpenBSD, NetBSD, RedHat, Debian, SuSE were packaged and > and sold in stores, how would this be any different? Oh wait, They > are packaged and sold in stores! Just by comparing the OpenBSD security track record to the one of any Windows release would dismiss your point. > > People

Re: WANTED: ISPs with DDoS defense solutions

2003-07-31 Thread Petri Helenius
I would say that because backdoored hosts are easily available in large quantities, spoofing does not make sense and usually alarms various systems more quickly than packets from legitimate addresses. Pete - Original Message - From: <[EMAIL PROTECTED]> To: "Rob Thomas" <[EMAIL PROTECTE

Re: WANTED: ISPs with DDoS defense solutions

2003-07-30 Thread Petri Helenius
Paul Vixie wrote: lots of late night pondering tonight. the anti-nat anti-firewall pure-end-to-end crowd has always argued in favour of "every host for itself" but in a world with a hundred million unmanaged but reprogrammable devices is that really practical? The most popular applications tod

Re: WANTED: ISPs with DDoS defense solutions

2003-07-30 Thread Petri Helenius
> > 1) The OS/software/default settings for a lot of internet connected > machines are weak, making it easy to attack from multiple locations. > I´ll start looking for this to happen when Microsoft manages to release an OS version which does not contain remote exploitable flaw before the boxes hit

Re: North America not interested in IP V6

2003-07-29 Thread Petri Helenius
PM Subject: Re: North America not interested in IP V6 > > On Tue, 29 Jul 2003, Petri Helenius wrote: > > The mobile ip address demand is not going to be too great when > > a megabyte in most countries costs $10 to $20 to move around. > > Over here the monopoly Telcom char

Re: North America not interested in IP V6

2003-07-29 Thread Petri Helenius
So far I have yet to see a mobile network implementing IPv6, though I haven´t looked closely to the japanese ones. Despite all the hype, most mobile vendors don´t even have shipping wares that would do ipv6 in the first place. The usual implementations are ipv4 with "huge" NAT boxes, quite like m

Re: North America not interested in IP V6

2003-07-29 Thread Petri Helenius
> > Is there any truth to this anyway? Am I too idealistic to believe that > IP numbers will be equally alotted to APNIC, ARIN and RIPE and that this > has been the case all along? > > I mean, there are certain entities in the US with /8:s and these might > have a specific advantage, but is this r

Re: rfc1918 ignorant

2003-07-24 Thread Petri Helenius
By the way, doesn´t this break PMTU if the far end device has tunnels or such which have lower MTU than on the p2p link? (because the packets would be dropped by loose RPF external to sprintlink) Pete - Original Message - From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday

Re: rfc1918 ignorant

2003-07-23 Thread Petri Helenius
> > When the RFC's are broken, then what do you do? If negotiations fail, you revolt and overthrow the corrupt governing body. If applicable, add overseas occupation forces :) > > RFC's are to be followed if one can operate one's network > under those constraints. Often times, RFC's don't take

Re: rfc1918 ignorant

2003-07-23 Thread Petri Helenius
> > Unless of course I block ICMP for the purposes of denying traceroute but > still allow DF/etc. Then it's not "broken" as you say. > Sure, but people "blocking all ICMP" haven´t usually heard that there are different types and codes in ICMP. It´s surprising how many large www sites do not w

Re: rfc1918 ignorant (fwd)

2003-07-23 Thread Petri Helenius
So this, as many other discussions in the past, ends with the conclusion that ARIN did their share of breaking RFC´s and the Internet ? Pete - Original Message - From: "Dave Temkin" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, July 23, 2003 9:11 PM Subject: RE: rfc1918

Re: The status of consumer rate limiting?

2003-07-22 Thread Petri Helenius
> > Since some p2p programs now use well known port numbers allocated to other > things eg port 80, is it even possible to block/rate limit them? And have folks > attempts at blocking caused this move to use such port numbers which imho is not > a good thing.. > As long as there are some bits in t

Re: Cisco vulnerability on smaller catalyst switches

2003-07-18 Thread Petri Helenius
My testing with the exploit I initially created has no effect on L2 only catalysts, like 2924XL or so. I haven´t been able to figure out the right sequence if any to accomplish that. No effect even on the management interface. Pete > > As part of our vulnerability tests, we have been unable to c

Re: Infrastructure Filtering (was Re: Patching for Cisco vulnerability)

2003-07-18 Thread Petri Helenius
Some high-end boxes already have thing called "receive filter" which helps this a lot. Hope we see more of that or better yet router vendors stop processing packets they shouldn´t be processing anyway much earlier in the code path. "Be liberal what you accept" should not apply here. Pete -

Re: Patching for Cisco vulnerability

2003-07-18 Thread Petri Helenius
> > if (ifc->in_bps > ifc->phy_speed || ifc->out_bps > ifc->phy_speed) > { > crash_router(); > } > > If they added this code, they'd find these bugs in their > labs instead of in our networks. > I remember seeing an article claiming that Cisco´s automated regression testing does "more than 25

Re: Cisco IOS Vulnerability

2003-07-18 Thread Petri Helenius
> > cisco posted what the four 'bad' protocol types were in rev 1.3 of the > online doc - now it is just an academic exercise to get them crafted > correctlyno imagination necessary, only a router, a cco > login, and a traffic generator needed > With rev 1.0 it took me two hours. IP

Re: Cisco IOS Vulnerability

2003-07-17 Thread Petri Helenius
> > It should be: > > http://www.cisco.com/tacpage/sw-center/sw-ios.shtml > > The Advisory is being updated. It might even be out there. > Do you know if they are going to update the advisory with more detail? At least I´m able to generate packets which get stuck in the input queue on the vulnera

Re: Cisco IOS Vulnerability (going OT)

2003-07-16 Thread Petri Helenius
> > 1) I didn't make this > 2) I cna't remmber where i got it from > 3) please don't abuse my connection too much tonight > There is another thing to play when reloading boxes, above disclaimers 1 and 2 apply. http://www.he.iki.fi/favorites.mpeg Pete

Re: New Cisco Vulnerability

2003-07-16 Thread Petri Helenius
> > > I'm hearing similar rumors, and Genuity has a "planned emergency > > maintenance" tomorrow morning, and there's some major weirdness with > > our AT&T feed over the past half hour. > > > This might explain the (very!) high number of maintenance alerts from > QWest this week, as well

Re: New Cisco Vulnerability

2003-07-16 Thread Petri Helenius
It supposedly requires 75 packets which is the default amount of slots in the "process switched" input queue on an interface. There have been packets stuck in the input queue in previous occasions but I suspect this is readily exploitable remotely.   Pete   - Original Message -

Re: National Do Not Call Registry has opened

2003-07-01 Thread Petri Helenius
> > It was occasionally amusing to keep them on the phone for about half an > hour, and then say "of course, you realise this is an international > call, there's no way I can buy what you're selling, and in fact this is > costing you vast sums of money". Until I realised that they thought > "

Re: Router crash unplugs 1m Swedish Internet users

2003-06-24 Thread Petri Helenius
> > I've seen a case where a single error in the > configuration file of a $VENDOR_1 router was accepted > (due to an 'undocumented feature'), and this caused > the wholesale importation of BGP routes into the IGP, > which caused most of their $VENDOR_2 hardware to spaz > out. Locating the singl

Re: OT: question re. the Volume of unwanted email (fwd)

2003-06-18 Thread Petri Helenius
> Actually, I find that 1.3 and 1.4 still have issues with determining > spam. While fairly decent, one still has to go through looking for false > positives. The other issue is that spammers have been doing a good job > at designing emails to fool filters. I'm starting to see more and more > spam

Re: OT: question re. the Volume of unwanted email (fwd)

2003-06-18 Thread Petri Helenius
> value is dependant on the individual. Unfortunately, end user's cannot > just highlight and hit delete on spam. They must look at almost every Isn´t "highlight and hit delete" exactly what has been implemented since Mozilla 1.3 and works with almost perfect accuracy after you give it a few doze

Re: IPv6

2003-06-14 Thread Petri Helenius
7200 VXR does not by default have any dedicated packet switching hardware. If you are daring enough, you might buy NSE-1 (unless they EOLed it already) to get first generation PXF hardware which is a more or less mission specific CPU matrix/pipeline thingy. More robust and reliable generations

Re: IPv6

2003-06-12 Thread Petri Helenius
> > Why not use the highest-order 32 bits of an IPv6 address for > interdomain routing... i.e., "overlay" them on IPv4 addresses > and/or a 32-bit ASN? Yes, it smells of classful routing. Call > me shortsighted, but how many billion interdomain routing > policies do we really need? > One word

Re: IPv6

2003-06-12 Thread Petri Helenius
> > Unfortunately vendor C still ships nearly all of its L3 switches and core > routers with forwarding engines that don't grok IPv6 packets, even if said > vendor has supported IPv6 in software for several years now. > The inventors of tag-switching^H^H^H^H^H^H^H^H^H MPLS seem to be firm believer

Re: IANA reserved Address Space

2003-05-31 Thread Petri Helenius
> > As a related question I guess I'd ask what sort of simulation requires > more than 16.7 million discreet ipv4 adresses (1/256 of the whole) in > order too simulate a reasonable subset of the whole ipv4 internet. > Many products perform differently (though both performance levels might be ob

Re: IANA reserved Address Space

2003-05-31 Thread Petri Helenius
> RFC1884 sets aside fec0::/10 for IPV6 Private addressing. That's enough to > fit all of IPV4 addressing inside of the private addressing alone. (Anyone > have a total number of unique hosts on that one?) > 2^(128-10) 332306998946228968225951765070086144 Pete

Re: Seeking Advice: L2TPv3 vs. Martini Draft MPLS

2003-04-04 Thread Petri Helenius
>I'm currently comparing these two technologies in an effort to offer a >Layer 2 VPN service on our backbone. Our network is currently not MPLS >enabled. Below is what I perceive as the pros and cons of each >technology. If anyone has thoughts on or experience with either one of >these protocols

Re: RFC3514

2003-04-01 Thread Petri Helenius
The linux patch at http://www.version6.net/patches/linux-2.4.20-rfc3514.dif has also been out since early April 1st. Pete - Original Message - From: "Tomas Daniska" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Wednesday, April 02, 2003 9:36 AM Subject: RE: RFC

Re: State Super-DMCA Too True

2003-03-31 Thread Petri Helenius
ilar figures because these "net-mgrs" will be out there doing their thing and there is nothing you can do about them doing it. Pete > > Rubens > > > - Original Message - > From: "Petri Helenius" <[EMAIL PROTECTED]> > To: "Stephen Spru

Re: State Super-DMCA Too True

2003-03-31 Thread Petri Helenius
> Well, most p2p apps live on well-known ports, and Cisco's QOS mechanism > allows easy classification on ports. Yes, most of the p2p apps are > port-agile -- but only if they are completely blocked. My experience is > that if you let the p2p stuff through, it'll stick to its default port and >

Re: Using Policy Routing to stop DoS attacks

2003-03-28 Thread Petri Helenius
With Juniper gear there is no performance difference between what you propose and an ACL, both run at wire rate. So implementing "CPU saving measures" is pointless waste of time. Pete > > We could ask Cisco and Juniper to add a way of 'artificially' remove networks from > the CEF table (with an

Re: good networking

2003-03-27 Thread Petri Helenius
> > Despite very old recommendations, the Iraqi state provider Uruklink.net > kept all of its name servers on the same subnet. Although this is > recognized as a poor design, many domain name server operators worldwide > do the same thing. > > nic1.baghdadlink.net. 2D IN A 62.145.94.1 >

Re: Notebooks /w a serial port?

2003-03-21 Thread Petri Helenius
> > Seems like these are all but extinct, but does anyone know of a > 'new' notebook that has a serial port built onto it? I've found some that > have port replicators, but that can be a pain when you need to serial into a > router or some other device. What do you guys use? > USB serials work.

Re: OpenSSL

2003-03-18 Thread Petri Helenius
Note the smiley 10 lines down. You have been had. Pete - Original Message - From: "Matt Ryan" <[EMAIL PROTECTED]> To: "'Petri Helenius'" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Tuesday, March 18, 2003

Re: OpenSSL

2003-03-18 Thread Petri Helenius
> > While the timing attack is the attack against the SSL server, it is my > reading of the paper that the attacks' success largely depends on ability to > tightly control the time it takes to communicate with a service using SSL. > Currently, such control is rather difficult to achive on links ot

Re: Nortel SHASTA

2003-03-17 Thread Petri Helenius
> > Is there anyone out there in the NANOG community who uses the Nortel SHASTA > box for aggregation that would like to technically chat offline? > Didn´t nortel more or less kill or suffocate the product quite quickly after the aquiring the company? (as they did Promatory) Pete

Re: OT: Increasing Cell Phone Signal inside a NOC?

2003-03-12 Thread Petri Helenius
> Just call your cell operator customer service and ask for someone who is > able > to talk about coverage issues. > Practically no cell operator provides access to these people. They take "coverage reports" and if you´re lucky, tell you when it´s going to be fixed. And the subway coverage is far

Re: DNS records for routers

2003-03-01 Thread Petri Helenius
> Some traces show individual interface names, some just show > device names. Any particular reason to go one way or the > other for PTR records (doing a single device name for every > interface seems easier and less-likely to screw up to me)? Providing information where the packet went is much m

Re: Network monitoring/IDS rant - What's hot what's not?

2003-02-26 Thread Petri Helenius
> MRTG/RRDTool or RTG are nice packages for somethings, but you might have > to have a farm of pollers/graphers/displayers (and a few folks to care for > them/create displays that matter) to poll 100,000 interfaces, eh? > Polling 10 interfaces every five minutes is only 333 queries per second.

Re: VoIP over IPsec

2003-02-18 Thread Petri Helenius
> > On Crisco, if memory serves, default payload is 160 for G.711, not 40. The > sizing goes in multiples of 80s. > The increments go in 10ms. Default being 20ms or 30ms depending on your codec. Resulting data size obviously depends on this parameter and the codec. Quite many people compress

Re: VoIP over IPsec

2003-02-17 Thread Petri Helenius
or implemented way too long ago to make use of more recent technology in the most efficient fashion. Pete -Original Message- From: Petri Helenius [mailto:[EMAIL PROTECTED]] Sent: Monday, February 17, 2003 5:21 PM To: Iljitsch van Beijnum; Steve Feldman Cc: [EMAIL PROTECTED] Subject:

Re: VoIP over IPsec

2003-02-17 Thread Petri Helenius
> On Mon, 17 Feb 2003, Steve Feldman wrote: > > > through the corporate enterprise net, Cisco routers with IPSEC/GRE tunnels > > over the public Internet. > > Maybe a stupid question... why would you need GRE tunneling while IPsec > has a tunnel mode of its own? > Probably because a major route

Re: VoIP over IPsec

2003-02-16 Thread Petri Helenius
> Are Cisco routers not happy doing VoIP/IPsec/GRE in concert? Cisco routers (and some others) are somewhat jittery doing IPsec but if you keep your CPU utilization levels low enough, it shouldn´t pose a problem. I would expect to keep watching the performance as traffic levels increase. Pete

Re: VoIP QOS best practices

2003-02-10 Thread Petri Helenius
> > Reordering per se doesn't affect VoIP at all since RTP has an inherent > resync mechanism. Most VoIP implementations don´t care about storing out-of-order packets because they think that 20ms or 30ms late packets should be thrown away in any case. > > Reordering is also unlikely, since each p

Re: VoIP QOS best practices

2003-02-10 Thread Petri Helenius
> It works fine on 64k connections, okay on many 9600bps connections. T1 is > way more than is necessary. > The correct answer here is that "it depends". Most multimegabit connections are underutilized enough not to introduce significant jitter to change VoIP behaviour, however specially when goi

Re: routing between provider edge and CPE routers

2003-01-30 Thread Petri Helenius
> You don't say whether you're using Cisco, but recent IOSes have no trouble > with huge configurations. You may have to use 'service compress-config'. > Just stay with some specific items on large configurations though. Don´t for example dream of large access lists or your box will crash and bur

Re: OT: Re: FW: Re: Is there a line of defense against Distributed Reflective attacks?

2003-01-23 Thread Petri Helenius
> > The first MPEG-4 HD set top boxes are beginning to appear > > http://www.sigmadesigns.com/news/press_releases/030108.htm > > Watch this space > If you read the document carefully, you´ll figure that they support MPEG2 HDTV (1920x1080) and MPEG4 SDTV (640x480/720x576), which was my point ea

OT: Re: FW: Re: Is there a line of defense against Distributed Reflective attacks?

2003-01-22 Thread Petri Helenius
> Drifting off-topic, but those are 'raw' data rates. Compression algorithms > along with motion-estimation allow you to get full-screen video down to > ~1.5 Mbps with not much in the way of image quality loss. > Raw HDTV is about 1.2Gbps. RAW NTSC SDI bitstream is a few hundred. The 6 and 19.8

Re: FW: Re: Is there a line of defense against Distributed Reflectiveattacks?

2003-01-22 Thread Petri Helenius
Al Rowland wrote: Not to mention that fact that 99.99% of current consumer connections are not up to the task. Standard full-screen video digital stream is ~6Mbps, HDTV requires 19.4Mbps. Don't know many consumers with T3s. ;) VDSL or ADSL2+ would cut it, until fiber to the curb gets the nor

Re: MSN Messenger

2003-01-06 Thread Petri Helenius
> > Service status is available at > http://messenger.microsoft.com/support/status.asp > > But according to the page all is fine.. Which is NOT the case here either. > Here it gives: HTTP Error 500-13 - Server too busy Internet Information Services Which is probably caused by quite a few peopl

Re: Cogent and Level3 Peering Issues

2002-12-18 Thread Petri Helenius
[EMAIL PROTECTED] wrote: Thing is if your connection is completely full one way, it'll effect traffic the other way too. It should not be happening with syncronyous connections, but practical observation is that it does! I suspect router hardware is to blame (possibly packet cache is way full

Re: Risk of Internet collapse grows

2002-12-02 Thread Petri Helenius
> I had a look at your map of Ebone Europe through the browse button on your > website. This displayed a messy meshy network that connected all the major > cities of Europe. However, in fact, Ebone's network was a nice clean > ringed network connecting all the major cities of Europe. It's true tha

Re: PAIX

2002-11-23 Thread Petri Helenius
Michael C. Wu wrote: On Thu, Nov 14, 2002 at 10:00:48AM +0200, Petri Helenius scribbled: | | > I'm putting the number closer to 40 (the "NFL cities") right now, and | > 150 by the end of the decade, and ultimately any "metro" with population | > greater than 5

<    1   2   3   4   5   >