November 2010 - NANOG - lists.nanog.org

Cacti Bandwidth Monitoring
by Peter Rudasingwa 29 Nov '10

29 Nov '10

Hi, I have a cacti server running and it has been working fine so far except for one interface which has an average of 150Mbps going through it now. Before when I had less than 120Mbps I got proper graphs but of late it gives me graphs of 20Mbps when it should be giving me the correct reading (150Mbps). Is there a maximum bandwidth it graphs or can this be edited so that I get proper graphs? -- Best Regards, Peter Rudasingwa *ALTECH STREAM RWANDA Ltd* ICT Park Boulevard de L'Umuganda P.O.Box 6098 Kigali, Rwanda Telephone: (+250) 580532/5 Mobile: (+250) 0788406685 ------------------------------------ *Affordable Broadband Solutions*

9 9

Targeted Phishing Attack
by J.D. Falk 29 Nov '10

29 Nov '10

Last week, the security team at Return Path discovered that we were the source of a list of addresses used in a targeted phishing attack against a number of ESPs. We're sharing the results of our investigation with the larger community, in order to help others avoid similar attacks. I'm including NANOG in this distribution because, even though this particular attack was focused on mail operators, the same tactics could work equally well on network operators. http://www.returnpath.net/blog/received/2010/11/phishing-attack-an-open-let… -- J.D. Falk Internet Standards & Governance Return Path

1 0

Re: Cacti Bandwidth Monitoring
by jkrejci＠usinternet.com 29 Nov '10

29 Nov '10

Might also look into the fix64bit plugin for cacti to modify your existing 32bit graphs so you don't have recreate them and all the extra changes you may need such as adding to graph trees, updating reports, thresholds, etc. ------Original Message------ From: Peter Rudasingwa To: Bill Blackford To: nanog(a)nanog.org Subject: Re: Cacti Bandwidth Monitoring Sent: Nov 29, 2010 9:50 AM Thanks to all. I used the 64 bit template and it's now working fine. Peter R. Bill Blackford wrote: > Sounds like you need to use the 64 bit templates as your data may be > "rolling over". > -b > -- Best Regards, Peter Rudasingwa *ALTECH STREAM RWANDA Ltd* ICT Park Boulevard de L'Umuganda P.O.Box 6098 Kigali, Rwanda Telephone: (+250) 580532/5 Mobile: (+250) 0788406685 ------------------------------------ *Affordable Broadband Solutions* Sent via BlackBerry from T-Mobile

2 1

Facebook and Yahoo contact
by Roman 29 Nov '10

29 Nov '10

Hi, Is there anyone from Facebook and Yahoo dealing with hosting their mirror site in IX. Please contact off list. Thanks Rom

1 0

Network Planning Tool
by William Jobs 29 Nov '10

29 Nov '10

In terms of network planning tools three names appear to be at the top of the list namely: - Cariden MATE - Opnet SP Guru Network Planner - WANDL IP/MPLS View We are currently considering all of them and I would appreciate any feedback from those who have experience with any/all of them (whether on or off-list). Thanks.

1 0

Re: wikileaks unreachable
by andrew.wallace 29 Nov '10

29 Nov '10

Hi Nanog, Some more information here - http://www.reddit.com/r/netsec/comments/ecwnn/wikileaks_hacked_ahead_of_sec… The hacker has featured previously in a news article on his attack platform - https://www.infosecisland.com/blogview/3258-Hacker-Releases-Second-Video-of… Regards, Andrew ----- Original Message ----- From:Joel Esler <joel.esler(a)me.com> To:Marshall Eubanks <tme(a)americafree.tv> Cc:North American Network Operators Group <nanog(a)nanog.org> Sent:Monday, 29 November 2010, 1:56:34 Subject:Re: wikileaks unreachable I've heard it's a DOS (not DDOS) according to twitter. Allegedly according to the person doing the DOS: Just so we are all straight and clear - wikileaks hit is not a 'Distributed' DoS, its a simple DoS - I dont use intermediaries or botnets. Sun Nov 16 - 15:28 EST http://twitter.com/th3j35t3r Joel On Nov 28, 2010, at 6:42 PM, Marshall Eubanks wrote: > > On Nov 28, 2010, at 5:19 PM, Wil Schultz wrote: > >> DOS is probably because they released some more stuff. >> >> "Secret US Embassy Cables" >> http://cablegate.wikileaks.org/ >> > > DDOS according to this > > http://www.securityweek.com/wikileaks-under-denial-service-attack-ddos > > Regards > Marshall > >> -wil >> >> On Nov 28, 2010, at 1:38 PM, James Downs wrote: >> >>> >>> On Nov 28, 2010, at 1:34 PM, Randy Bush wrote: >>> >>>> anyone know why https://www.wikileaks.org/ is not reachable? nations >>>> state level censors trying to close the barn door after the horse has >>> >>> Reported they were under attack: http://bgg.lv/h2pmsd >>> >>> >> >> >> > >

2 1

Re: wikileaks unreachable
by Joshua.Klubi＠gmail.com 28 Nov '10

28 Nov '10

better late than never -- Sent from my Nokia N900 using Nokia Messaging ----- Original message ----- > I'm surprised it took this long for the DDoS train to pull into the > station. > > Jeff > > On Sun, Nov 28, 2010 at 4:38 PM, James Downs <egon(a)egon.cc> wrote: > > > > On Nov 28, 2010, at 1:34 PM, Randy Bush wrote: > > > > > anyone know why https://www.wikileaks.org/ is not reachable? nations > > > state level censors trying to close the barn door after the horse has > > > > Reported they were under attack: http://bgg.lv/h2pmsd > > > > > > > > > > -- > Jeffrey Lyon, Leadership Team > jeffrey.lyon(a)blacklotus.net | http://www.blacklotus.net > Black Lotus Communications - AS32421 > First and Leading in DDoS Protection Solutions >

1 0

Switches Configuration
by sharon saadon 28 Nov '10

28 Nov '10

Hi, An online Config generator for juniper Nortel and Cisco Switches ( My Develop :) ) You can see it at - http://www.sharontools.com/tools/ConfigGenerator/ConfigGenerator.php Sharon

2 1

<Free Ping services that test your servers Availability from the Internet>
by Michael Ruiz 28 Nov '10

28 Nov '10

Hey folks, I had a situation recently that our network went down and our Network Monitoring software did not notify us that the network was down because the internet connection went down. We had a problem with our carrier where they messed up on our /23(where our Network Monitoring software resides), when they did a maintenance. What transpired is our /23 was no longer routing to us. Is there a free ping internet service, or something that we can pay a company that just sends a ping to devices? If they fail to respond, then an email is sent to us? Thank you folks. M.A.R Senior Network Engineer

7 6

Re: Re: Network management software with high detailed traffic report
by Ivan Brunello 27 Nov '10

27 Nov '10

Sure it upsets. We have a bunch of average-populated 6500s, using the default max age (which was, as far as I remember, 5) made the switches very slow in responding to SNMP queries. set them to 10, and, Gotcha! everything works very well. ivan > Date: Tue, 23 Nov 2010 14:25:25 +0200 > From: Tassos Chatzithomaoglou <achatz(a)forthnet.gr> > Subject: Re: Network management software with high detailed traffic > report > To: nanog(a)nanog.org > Message-ID: <4CEBB2B5.5090507(a)forthnet.gr> > Content-Type: text/plain; charset=UTF-8; format=flowed > > There is also CSCsg23226 which might be related. > > -- > Tassos > > > Nick Hilliard wrote on 23/11/2010 01:35: >> On 22/11/2010 22:56, Tassos Chatzithomaoglou wrote: >>> Does "service counters max age" help in any way?* >>> *According to Cisco, setting it too low might upset the snmp counters.* >> >>> https://www.cisco.com/en/US/docs/ios/fundamentals/command/reference/cf_r1.h… >>> >> >> The "Usage Guidelines" are instructive. :-) >> >> Although the update interval defaults to 5 seconds, it still appears >> to update every 9 seconds on my boxes. >> >> Nick >> >>

9 16