Back in the day when we started out routing networks for customers, generally the practice was to route a whole Class C (or /24 now-a-days, this was before CIDR  was widely deployed as well), or maybe 2 or 4 depending on how many IP addresses that customer, or larger department needed. Large companies didn’t have connected networks, each workgroup or department was usually separate, or if they were really big, we’d help get them a Class B network with the Internic.

There wasn’t the prevelant use of firewalls, these connections were directly on, or if there was a firewall, it was a proxy type, with the stations having the ports blocked and needing to proxy out for things like FTP or HTTP if that was even a consideration. It was pretty apparent even than that having a total of about 2 million Class C’s available wasn’t going to be able to service a lot of customers with these types connections. Especially when you look now-a-days and see a large ISP like Comcast easily having 2 million subscribers in one larger metro area. So, out came CIDR which saved us from handing out /24s in every case and it certainly cut down on handing out IP addresses wastefully.

It took a while for people to get the concept of CIDR and even longer for gear to fully support it properly but it helped.

In the meantime NAT was created.

At first it was more one-to-one translation so that if some workstations were in an unfortunate range they could be translated to another range of IP addresses that worked better. Then PAT (aka NAPT) came about that actually let us hide a range of machines behind one IP address on the outside. This was starting to look a lot more like what the current crop of residential routers allows today; hide a whole range of networks behind one public IP address so that we can go back to the model of having one IP address per customer. Finally what allowed that was modifying existing protocols that broke with NAT to be more NAPT friendly, recognizing that something can still be in the middle. IPSec got NAT-T transport, and enterprise class firewalls got things like ALG which allowed more deeper inspection into protocols to help things along like FTP, SIP, and H.323 which do weird things embedding raw IP addresses inside the protocol itself rather than just the headers.

The only reason the Internet could grow at the rate it did was that NAT saved the ISPs from having to deploy huge tracts of IP addressing that wasn’t going to be used (do you have 256 devices connected up in your home network? Multiple your home by millions of others in your metro area). Now that we have exhausted IPv4 it seems like they should have done more, but really at the time, nobody envisioned 78% (240 million) of the US population to be connected on the Internet, let alone the adaption rates around the globe.

What is broken now.

When I was working with these large enterprise companies they had deployed NAT to all their borders.

They’ve totally isolated themselves off from the world, anything going out and going in has to be NAT thus when we needed to get into their networks with the VPN tunnels it produced all sorts of interesting problems that never ever was imagined way back when the Internet was first launching.

Since NAT was required talking even back to us over the VPN tunnel, we determined that things like terminal server (TS) gateway which our customer was trying to deploy would be failing because of the NAT requirements. I don’t know of any firewall that has an ALG for TS gateway but even if there was one, it most likely wouldn’t have been deployed by these large dinosaur of an enterprise company in their IT department.

Thankfully we weren’t doing any VoIP connections for these people but those would have broken too, as SIP and H.323 and MGCP all require ALGs on the firewall level to deal with NAT. Since we were hidden behind NAT things would have broken pretty hard getting these types of packets back to them.

Finally, since they NAT everything in and out, any and all external DNS are broken too, so they have to take over DNS deployments for our customers machines, further isolating them off from the rest of the Internet. Normal DNS entries and domains don’t work in the large IT enterprise enviornment, custom DNS has be requesitioned, setup, tested and deployed at each site, negating any benefit for a single authoritative source (which when DNSSec takes off, will be promptly ignored because it won’t be used).

The future.

Since the widespread rollout of IPv6 recently it has been so nice to get back to the roots of the concepts of unique IP addressing for end-to-end communication. Unfortunatly, these kinds of mindsets that have isolated the large enterprise off the Internet directly are pushing IPv6 deployments to have the same sort of NAT in, NAT out mentality matching what IPv4 rollouts they have already.

NAT66 has several drafts going through the IETF process now. I was really hoping that we could do away with all the nastiness of NAT and we certainly will in the general deployment for most people. But I fear the driving force behind these large enterprise IT will again make things so convoluted and isolated that we will be dealing with NAT issues for quite some time to come.

What is IPv6 you ask? Well, that topic won’t be discussed in this posting as it has been discussed all over the Internet already. You can test your readiness by going to http://test-ipv6.com/ and checking your results.

This post is about what services are running IPv6 dual-stack on the ipHouse network today.

Many of our services have been operating in a dual-stack IPv4/IPv6 configuration since the middle of last year but since most connectivity is still only IPv4, most people would never see nor notice the IPv6 network capabilities we have already built into our network. Our network itself has been IPv4/IPv6 dual stack for what seems like forever with quite a few customers connected with native IPv6 connectivity via DSL, T1, metro-ethernet, and colocation.

Services at ipHouse that are IPv6 capable and enabled:

Web-hosting on our UNIX cluster is fully IPv6 capable and enabled, though only ipHouse sites currently have IPv6 addresses. If you are a web-hosting customer of ipHouse and would like to have your site enabled for IPv6, please email webmaster@iphouse.net with your request so we can make the necessary configuration changes in our load balancers..

Email inbound (greylisting servers), outbound (SMTP, POP, IMAP) are all IPv6 capable and enabled.

ipMom and webmail.iphouse.com are fully IPv6 capable and enabled.

DNS servers (caching resolvers and authoritative) are IPv6 capable and enabled.

T1, DS3, metro-ethernet, and colocation connectivity is all fully IPv6 capable and enabled (if you would like to request IPv6 connectivity, please send email to noc@iphouse.net with your request so we can work with you).

DSL service is IPv6 capable and enabled, though customer premise equipment gear is very lacking in IPv6 capabilities. See our previous blog post regarding this issue.

ipshell.com services are IPv6 capable and enabled.

MICE exchange connectivity is IPv6 capable and enabled – we are a full routing peer.

This blog site is IPv6 capable and enabled.

Our conference rooms and guest WIFI networks are IPv6 capable and enabled.

noc.iphouse.com is IPv6 capable and enabled.

Services at ipHouse that are IPv6 capable but not enabled, many of these will be enabled soon and this post will be updated to reflect the changes:

news.iphouse.com is IPv6 capable but not enabled.

lists.iphouse.net is IPv6 capable but not enabled.

stats.iphouse.com is IPv6 capable but not enabled.

Dial-up services are IPv6 capable though I don’t think we will be enabling it unless by customer request.

Microsoft IIS hosted websites are IPv6 capable but not enabled.

Services at ipHouse that are not IPv6 capable:

The Mailfoundry anti-spam systems, neither the web interface nor the SMTP services.

Our offsite DNS authoritative servers are not IPv6 capable at this time

I’m sure I missed a few things and I’ll update this as I find them (or remember, as the case may be).

In 1997 I spent some time lobbying at the Minnesota Legislature and the Minnesota Public Utilities commission about the differences between a data connection and data communications.  The differences may seem plainly obvious to those of us in the Internet / Cable / Telephone industries, but for those milling around on the hill, they can’t quite grasp the difference between a carrier pigeon and the message tied to it’s leg.  This analogy was too esoteric for those who were approaching dementia so I changed the analogy to a letter carried by a postal service.  They seemed to understand that governments should regulate the postal service, but not the contents of the letter.  You tell me, which part of that analogy resembles a connection and which resembles information?  Pretty obvious, huh?

While it has been obvious for a long time that a telecommunication service is HOW you connect, I think the codgers on the hill got fouled up in the language. The word telecommunication contains that magic word, communication.  When you hear communication, you immediately think of what you DO with a voice service, a cable television service or the Internet.  But we in the industry all know that the Internet, voice, cable television, or anything you DO with a telecommunications service is an information service.

We all use telecommunications services AND information services everyday.  Honestly, it’s difficult to think of a reason to have a telecommunications service without an information service laid on top of it.  I admit that they are so closely tied together that most often you need one to utilize the other.  But there are so many methods of delivering information services that there really is a need for separation.

And that’s how we buy most of our services.  We buy an Internet LINK/PORT and we buy Internet BANDWIDTH.  These are two line items on one invoice.  Sounds like the telecommunications companies already realize these are separately regulated items.

Way back in 2002 the FCC ruled that cable modem service was an information service.  This was dismaying to many ISPs.  Cable companies could legally block ISPs from delivering Internet on cable networks and this new ruling spelled out a path for the ILECs to shut the ISPs out of the DSL / high-speed Internet access market too!  And that’s exactly what happened.

Today Qwests third generation DSL offering is FTTN DSL, with dramatically higher connection speeds than the prior Qwest DSL offerings.  That’s a mixed blessing for consumers.  If consumers really want faster speed for their Internet access and want to stay on DSL, they have but 1 choice, buy from Qwest.  Consumers must buy a bundled telecommunications service and information service from Qwest if they want the higher DSL speeds.  Sadly, that means customers who want to remain loyal to ipHouse cannot.

Prior to 2002 consumers had dozens of ISPs to choose from.  Those same ISPs have been squeezed out of the market by a simple “reclassification” of broadband by the FCC.  Today, if you listen closely you can hear ISPs across the country rejoice at the thought of being able to buy connections again if the FCC is successful at retracing it’s steps.  It might take another 8 years or even longer, but I think that progress is worth waiting for.

Peace.

Bil

New media is much more unpredictable, it’s hard to maintain a consistent image without fading into the ether. It’s harder,still to control information, good or bad, that can effect your company. While there is a high amount of passion with the participants of new media,  this can lead to a low signal-to-noise ratio. You’re competing with a lot of people out there and if your stuff isn’t interesting, it’ll just be a ripple in the ocean.

The advantage of new media is simple: Access

Anyone with an internet connection can access a blog and make comments, or start a Twitter or Facebook account. With a small investment in web hosting, a person can start his or her own blog. Using content management systems makes updating and managing your message trivial.

The disadvantage of new media is also simple: Access

Since more and more people are participating more and more time to new media, that means that older forms of information exchange are withering away. Sooner or later, If you’re not out there, you’re nowhere. Pretty soon, we won’t submit resumes, HR firms will simply look to LinkedIn. Pretty soon, we won’t have television or radio ads, it’ll be far more economical to buy blurbs on Facebook or Google Ad Words. Newspapers and magazines are already feeling the pinch as Craigslist has sapped up most of their ad revenue, and subscriptions are dwindling. Television is next.

As more and more people get online, the lure of newer/interactive mediums will surpass passive ones. Broadcast television is the next big target, followed by cable. As high speed gets more ubiquitous, who wouldn’t rather watch a show stream on their TV via a home theater PC (HTPC) or some sort of internet connected box that plays only what you want whenever you want to see it? The networks and cable companies understand that. They take tentative steps via services like Hulu so that people can watch TV on their computers. What they fear is that people will start watching what they want on their TV. They take steps to restrict their services from playing on devices that are connected to a television. Pretty soon they won’t have a choice. Look for shows to start appearing exclusively online. “The Guild” did it, “Dr Horrible” did as well.

For a small company, a presence online is critical, and participation in new media is almost mandatory if they want new customers to find them. They have to interact with their customers as well, and try to build communities. They have to draw positive attention to themselves.

A small company with a relatively large new media footprint can reach a lot more potential customers than they used to. For a small company, the rewards far outweigh the risks. A larger company has a reputation to defend, and in many cases, undo. A smaller, newer company can control their message and image a lot easier.

In my opinion, a small company would benefit by having a PR person on speed dial, and a competent designer to unify their image across the board; from print to their website, to new media outlets. They will probably see a greater ROI than traditional or web advertising alone.

But hey, what do I know? I’m a tech guy, a consumer of this new media.

I hope that helps!

Because it isn’t cheap to bring broadband service to rural areas, knowing which areas are most in need is necessary to determine where to best spend limited resources. The Minnesota Commerce Department is working with Connect Minnesota to map Internet connection speeds throughout the state and is promoting the Connect Minnesota Speed Test as a way for consumers to check on the truthfulness of their ISPs. While this is a great goal, there are significant technical problems with the Connect Minnesota Speed Test.

The first problem is the coding and assumptions present in all Ookla speed tests. Because the speed tests assume you are on a DSL or cable connection, they automatically assume a huge asymmetry in upload and download speeds. Therefore, they give false results for any type of connection other than DSL and cable connections. Don’t use this to test the connectivity for your servers colocated at an ISP or your office T1 or Metro Ethernet connection. Our engineers have pulled down 230Mbps to their workstations here at the office and Ookla speed tests are unable to calculate that type of speed.

The second problem is that the Connect Minnesota Speed Test site itself is clearly limited by a 10Mbps connection. No Internet connection ever performs at 100% and there is always going to be some routing and other overhead wrapped around the actual data itself. This type of speed test will always underestimate the actual speed of any given connection. This is an old speed test issue. Internet routing hasn’t changed and all the caveats Peter John Harrison wrote about in his 1999 SpeedTest still apply.

Finally, and here is my major problem with the Connect Minnesota Speed Test, it is coming from a provider and machines in Texas! This means that it isn’t really testing the speed of your Minnesota Internet connectivity (even with all the above provisos) it is testing the speed of your connectivity to some provider in Texas. There is a lot of network between here and Texas. The packets for the speed test are traversing different networks and providers on their way to and from the server in Texas. They may be affected by various routing issues on networks that have nothing to do with your ISP and that your ISP has no control over.

If the Minnesota Commerce Department wants a more accurate picture of broadband connectivity within Minnesota, they need to locate the speed test on a well-connected server within Minnesota.

Of course, anyone who really wants an idea of the speed of their connection should not just be using an Ookla speed test. Basic FTP gives you a much better test to determine how fast you can pull down a file from a remote site. In fact, ipHouse has files on our servers specifically for customer speed tests. More accurate tools exist for calculating bandwidth but they aren’t easy for the average consumer to use. They almost always require command line access on two machines on each side of the connection you are testing. If you are an ipHouse customer and want to know the speed of your connection, just contact our support team and we will let you know the test options available for your connection and how to see bandwidth usage throughout our network.

David is a math and statistics expert, implementing many of his solutions using his background in software development and database design. He consults primarily for small to medium-sized businesses and helps his clients with all their computer needs from software installation to network security. He has worked with individuals to setup their home offices with efficient, secure connections to their work places.

David describes himself as being, “vocal and tenacious about raising hell when a client’s vender doesn’t deliver.”  His clients appreciate this dedication. Thus far, all his clients have come from word-of-mouth referrals.

David shared with me that he wants to be equally vocal when a vender does a good job. He thinks that, “Many ISPs do not do good work. ipHouse has delivered. It seems like you guys can do no wrong.”  David is impressed with the breadth of knowledge of ipHouse staff. “It is nice to have a vender whose technical support team is savvy about issues beyond the traditional support call.”