- NZNOG - lists.nznog.org

Shocking iptables performance
by Jasper Bryant-Greene 19 Jan '07

19 Jan '07

We currently have a pair of Linux iptables firewall boxes that are being replaced in a month's time with a pair of Cisco ASA firewalls. Recently during testing we noticed transfer rates through the Ciscos (attached to the same Cisco routers on the other side) is over 30x faster than through the iptables firewalls. I know that iptables isn't hugely fast, there's a reason you pay for Ciscos etc etc, but the resources I have read usually indicate that iptables slowness is related to massive rulesets. We have 2415 rules, which I don't consider to be *that* many... The boxes aren't heavily loaded (about 10% system, 90% idle), and have plenty of free memory. They aren't swapping. I've tested turning off logging, which had virtually no effect. Anybody encountered anything similar? Is it likely to simply be related to the number of rules? Cheers Jasper -- _________________________________________ http://www.digiweb.co.nz Webhosting, Dedicated Servers, E-commerce Phone: (64 3) 351 6713 Fax: (64 3) 351 6705 Free: 0800 DIGIWEB (0800 344-493) Email: jasper(a)digiweb.co.nz PLEASE NOTE: The information contained in this email message and any attached files may be confidential and subject to privilege. The views expressed may not necessarily be the official view of Digiweb New Zealand Limited. All technical advice and opinions are offered on a 'no-liability' basis. If you are not the intended recipient, you are notified that any use, disclosure or copying of this email is unauthorised. If you have received this email in error, please notify us immediately by reply email and delete the original. Thank you.

12 16

NZNOG 2007: DRAFT Network Systems Miniconf Programme
by Ewen McNeill 18 Jan '07

18 Jan '07

For those of you that are wondering which tutorial stream to go to, here is the _draft_ Network Systems Miniconf Programme (subject to change, but hopefully close to what it will be like on the day). Ewen -=- cut here -=- 08:00-09:00 - Registration 09:00-09:15 - Welcome 09:15-10:00 - Martin Kealey: From routers to Unix: shell tips for the network admin (45 minutes) 10:00-10:30 - Spare (BOF discussion on using Unix shell for automation?) 10:30-11:00 - Morning Tea 11:00-11:45 - Jonny Martin: Asterisk by Example... Doing useful VoIP things (45 minutes) 11:45-12:30 - Ewen McNeill: 42 hosts in 1U: Using virtual machines (45 minutes) 12:30-13:30 - Lunch 13:30-14:15 - Andrew McMillan: Using Debian packages for system administration (45 minutes) 14:15-15:00 - Matt Brown: Configuration Automation using CFengine (45 minutes) 15:00-15:30 - Server configuration management BOF 15:30-16:00 - Afternoon Tea 16:00-16:45 - Sam Sargeant: DNS registration services, and the .govt.nz 2LD (45 minutes) 16:45-17:15 - Martin Kealey: Mail debugging: how to talk to SMTP, POP & IMAP servers (30 minutes) 17:15-17:45 - Mail Server Best Practices BOF -=- cut here -=-

1 0

Re: [nznog] WISP Technology - Trango?
by Alex Hague 18 Jan '07

18 Jan '07

Hi Jack, You may also wish to check out http://meraki.net/ - this is a commercialization of the MIT Roofnet project. Will probably be a lot cheaper than Trango. Cheers, Alex -----Original Message----- From: Jack Pivac [mailto:email(a)delphinus.co.nz] Sent: Friday, 19 January 2007 3:12 p.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] WISP Technology - Trango? Hi all, Currently planning on setting up a community wireless project in South Taranaki. Range is looking to be up to 10km from the AP's. At the moment I'm looking at using Trango Radio Units [1] and was after thoughts/comments on this choice... Cheers, Jack [1] http://www.trangobroadband.com/

1 0

WISP Technology - Trango?
by Russell Tester 18 Jan '07

18 Jan '07

If you are setting up a community wireless project the very least you should consider is an open standard (such as 802.11) for the wireless. This will make it much easier for others to join / extend the project as well as provide neumorous other benefits! Russell Tester Serverworks Ltd Tel +64 3 9771750 Cell 021 478 611 -----Original Message----- From: Jack Pivac [mailto:email(a)delphinus.co.nz] Sent: Friday, 19 January 2007 3:12 p.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] WISP Technology - Trango? Hi all, Currently planning on setting up a community wireless project in South Taranaki. Range is looking to be up to 10km from the AP's. At the moment I'm looking at using Trango Radio Units [1] and was after thoughts/comments on this choice... Cheers, Jack [1] http://www.trangobroadband.com/ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Re: [nznog] Shocking iptables performance
by Mark Seward 18 Jan '07

18 Jan '07

On 1/19/07, Jasper Bryant-Greene <jasper(a)digiweb.net.nz> wrote: > [root(a)firewall1 root]# mii-tool > eth0: negotiated 100baseTx-FD flow-control, link ok > eth1: negotiated 100baseTx-FD flow-control, link ok > > Looks ok to me. Fixing it with mii-tool -F 100baseTx-FD makes no > difference to transfer rates. What devices are connected to each interface on this firewall and what do they say about duplex and collisions / otherwise errored packets? 100Mb NICs and switches are notorious for misbehaving in ways that cripple throughput as you describe. Mark.

1 0

DNS problems yesterday?
by Patrick Mchale 18 Jan '07

18 Jan '07

Hey There, I was wondering if anyone noticed an odd external DNS problem happening yesterday, the National Library's main website was affected for several hours. We could resolve internally but nothing from outside would get resolved. Nothing was changed on our DNS servers. Vodafone seemed to be affected also. Default Server: planet.natlib.govt.nz Address: 192.122.171.130 > server 210.55.131.76 Default Server: jupiter.natlib.govt.nz Address: 210.55.131.76 > www Server: jupiter.natlib.govt.nz Address: 210.55.131.76 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server defiant.netgate.net.nz Default Server: defiant.netgate.net.nz Address: 202.37.245.17 > www.natlib.govt.nz Server: defiant.netgate.net.nz Address: 202.37.245.17 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server reliant.net.nz *** Can't find address for server reliant.net.nz: Non-existent host/domain > server reliant.netgate.net.nz Default Server: reliant.netgate.net.nz Address: 202.37.245.20 > www.natlib.govt.nz Server: reliant.netgate.net.nz Address: 202.37.245.20 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server 203.96.152.4 Default Server: rachel.paradise.net.nz Address: 203.96.152.4 > www.natlib.govt.nz Server: rachel.paradise.net.nz Address: 203.96.152.4 *** rachel.paradise.net.nz can't find www.natlib.govt.nz: Non-existent host/domain > server 202.73.198.15 Default Server: isdn1ldv.vodafone.co.nz Address: 202.73.198.15 > www.natlib.govt.nz Server: isdn1ldv.vodafone.co.nz Address: 202.73.198.15 *** isdn1ldv.vodafone.co.nz can't find www.natlib.govt.nz: Non-existent host/domain Cheers Patrick McHale National Library of New Zealand.

8 11

Re: [nznog] DNS problems yesterday?
by Patrick Mchale 18 Jan '07

18 Jan '07

Thanks for the responses, We kinda thought there was a bit of fiddling going on but at to who and finding a definitive answer, this problem may be a total mystery forever. We are though inquiring into one particular DNS provider to check if anything went astray yesterday. The report was very interesting and a very useful website for finding out about a particular sites DNS issues and security. I need to read up more on the info it presented and sort out some changes. Cheers Patrick McHale >>> "Patrick Mchale" <Patrick.Mchale(a)natlib.govt.nz> 19/01/2007 9:26 a.m. >>> Hey There, I was wondering if anyone noticed an odd external DNS problem happening yesterday, the National Library's main website was affected for several hours. We could resolve internally but nothing from outside would get resolved. Nothing was changed on our DNS servers. Vodafone seemed to be affected also. Default Server: planet.natlib.govt.nz Address: 192.122.171.130 > server 210.55.131.76 Default Server: jupiter.natlib.govt.nz Address: 210.55.131.76 > www Server: jupiter.natlib.govt.nz Address: 210.55.131.76 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server defiant.netgate.net.nz Default Server: defiant.netgate.net.nz Address: 202.37.245.17 > www.natlib.govt.nz Server: defiant.netgate.net.nz Address: 202.37.245.17 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server reliant.net.nz *** Can't find address for server reliant.net.nz: Non-existent host/domain > server reliant.netgate.net.nz Default Server: reliant.netgate.net.nz Address: 202.37.245.20 > www.natlib.govt.nz Server: reliant.netgate.net.nz Address: 202.37.245.20 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server 203.96.152.4 Default Server: rachel.paradise.net.nz Address: 203.96.152.4 > www.natlib.govt.nz Server: rachel.paradise.net.nz Address: 203.96.152.4 *** rachel.paradise.net.nz can't find www.natlib.govt.nz: Non-existent host/domain > server 202.73.198.15 Default Server: isdn1ldv.vodafone.co.nz Address: 202.73.198.15 > www.natlib.govt.nz Server: isdn1ldv.vodafone.co.nz Address: 202.73.198.15 *** isdn1ldv.vodafone.co.nz can't find www.natlib.govt.nz: Non-existent host/domain Cheers Patrick McHale National Library of New Zealand. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Malware used to spam pump and dump scams
by matthew＠auscert.org.au 17 Jan '07

17 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings all, As above - anyone aware of what particular bit of malware is being used to spam pump and dump scams? Also seeing similar usage for mule recruitment. Subjects may have the stock symbol CBFE for the stock P&D or "Managers opened - GAPFG Co" for the mule recruitment. Any feedback appreciated. Thanks for your time, - -- Matthew McGlashan -- Coordination Centre Team Leader | Hotline: +61 7 3365 4417 Australian Computer Emergency Response Team | Direct: +61 7 3365 7924 (AusCERT) | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert(a)auscert.org.au -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) Comment: http://www.auscert.org.au/render.html?it=1967 Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRa7T0Ch9+71yA2DNAQLKHAP/U0x1SudRh4BRtg+mxxkry6YifNUPFD+J 6sYjwErVf1N4N+Y6WN5zmU9JuXO+HqrMf79JiZ9eff3fC/2xd7jK1wJWr1GzNO5w jw8jZmO0QAC/2UzrEQuC9q4eDbogk/mHCLzSpg2qyzY6+cdN6IFGcnmgnkL0ycUk eTRO+t+6PQE= =AijR -----END PGP SIGNATURE-----

1 0

IGMP testing - thanks
by Ian Batterbee 16 Jan '07

16 Jan '07

Thanks all for the suggestions. That C source code, (the setting of theIP_ADD_MEMBERSHIP socket option in particular), led me to this rather useful document: http://tldp.org/HOWTO/Multicast-HOWTO-7.html ...which describes how it is the kernel's task to send IGMP out for sockets set as above, and not the application's problem, which explains why there aren't many apps around that send IGMP. And using 'tcpdump -n igmp', on the client end, I can see that it's doing what it should be doing :) Thanks.

1 0

Re: [nznog] IGMP test tools
by chris＠chrishellberg.com 16 Jan '07

16 Jan '07

Hi Ian, What about using a media application like vlc (videolan) and joining a multicast group? I think you might be able to run it in command line mode, if you don't have an X server listening. This'll trigger your IGMP membership reports and respond to group queries. /Chris ----- Original Message ---- From: Ian Batterbee <ian.batterbee(a)aut.ac.nz> To: nznog(a)list.waikato.ac.nz Sent: Tuesday, January 16, 2007 10:45:30 PM Subject: [nznog] IGMP test tools Hi all, I'm looking for some linux test tools that I can run that will send IGMP join commands and that will respond to IGMP queries (to keep the group alive), that I can use to prove or disprove a sparse mode pim configuration. There's such a blatent lack of matches for anything like this on google that I wonder if I'm overlooking some basic utility that is already included with most distros or is built into the kernel, but I can't come up with anything on that front either. Using a Cisco router or switch as a multicast group member is a possibility, but I'd rather use linux hosts if I can do so. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1