- NANOG - lists.nanog.org

on network monitoring and security - req for monitoring tools
by travis+ml-nanog＠subspacefield.org 24 Aug '10

24 Aug '10

Hi, I'm putting together a book on security*, and wanted some expert input onto network monitoring solutions... http://www.subspacefield.org/security/security_concepts.html Nagios, Net-SNMP, ifgraph, cacti, OpenNMS... any others? Any summaries of when one is better than the other? Any suggestions on section 13-15? I imagine I'll offend some of you by not distinguishing between system and network adminsitration, but... it's a small section right now, maybe if it grows. OT: I had issues with understanding MIBs and SNMP tools... specifically, I wanted to query and graph the pf-specific MIB... any suggested places to ask? Do I ask on the Net-SNMP list, or is there a better place? Also, cacti... seemed to behave differently based on whether the target was Linux-based or BSD-based... I suppose the cacti-users is the right place to ask, but if anyone has any suggestions, please LMK. I hate the UI. -- My emails do not have attachments; it's a digital signature that your mail program doesn't understand. | http://www.subspacefield.org/~travis/ If you are a spammer, please email john(a)subspacefield.org to get blacklisted.

6 5

Re: IPv6 PMTUD and OS-X
by Vyto Grigaliunas 24 Aug '10

24 Aug '10

>> 1220? I am pretty sure the minimal IPv6 MTU is 1280 and that below it fragmentation should be handled by the medium that transports packets smaller than that.... Can you enlighten me >> Bill? :) Please correct me if I'm wrong, but last I heard IPv6 routers do not do fragmentation...it's up to the IPv6 end hosts to properly determine the path MTU. Thanks... Vyto Date: Sat, 21 Aug 2010 11:42:04 +0200 From: Jeroen Massar <jeroen(a)unfix.org> Subject: Re: IPv6 PMTUD and OS-X To: bmanning(a)vacation.karoshi.com Cc: nanog(a)nanog.org Message-ID: <4C6F9F6C.80609(a)unfix.org> Content-Type: text/plain; charset=UTF-8 On 2010-08-21 09:18, bmanning(a)vacation.karoshi.com wrote: > On Fri, Aug 20, 2010 at 11:34:23PM +0200, Jeroen Massar wrote: >> On 2010-08-20 23:27, Franck Martin wrote: >>> I'm trying to debug a pesky PMTUD issue with IPv6 on Mac OS-X 10.6. >>> >>> It happens only from home, on wireless, when connected to a mac >>> aiport that does an automatic tunnel (teredo) to IPv6 backbone. >> >> Welcome to the great world of Teredo/6to4 where the endpoints/relays >> of the tunnel are anycasted in both IPv4 and IPv6 and thus can be >> quite difficult to debug, it can be done but requires quite a lot of >> vision in the network on both IPv4 and which will be generally near impossible. >> >>> There are IPv6 web site that I cannot browse until I lower the MTU >>> to >> 1400. >> >> Why don't you just do 1280 which is the default? >> >> Do also note that you have two levels of PMTU, the IPv6 one and the >> IPv4 one. If you configure your MTU of the tunnel incorrectly >> compared to the relay that you are using you will not see the PMTU's >> coming through either or they might not accept your large packets. >> >> Both MTUs can be broken due to folks filtering ICMP which is >> generally a bad thing to do. >> >> Greets, >> Jeroen > > > or - if you are tunneled more than once, you might be ultra conservative > and drop your MTU to 1220 - that should weed out the edge cases where even 1280 > is too large. 1220? I am pretty sure the minimal IPv6 MTU is 1280 and that below it fragmentation should be handled by the medium that transports packets smaller than that.... Can you enlighten me Bill? :) Greets, Jeroen

1 0

Motorola Canopy & Prizm
by Alan Bryant 24 Aug '10

24 Aug '10

I'm looking for some help with Motorola's Prizm software which is used for provisioning of subscriber modules with their Canopy wireless products. We are having some issues with authentication of some customer's and I believe it to be related to the management software (Prizm). Is there anyone on this list with experience with this software? -- Alan Bryant | Systems Administrator Gtek Computers & Wireless, LLC. alan(a)gtekcommunications.com | www.gtek.biz O 361-777-1400 | F 361-777-1405

3 3

Real ops talking to future ops
by John Kristoff 24 Aug '10

24 Aug '10

I'm afraid this is only slightly operational and limited to a subset of the NANOG crowd. I apologize profusely in advance for abusing the list as I might, but I can't think of a more suitable group of people to approach. I think the essence of the request is in line with the spirit of NANOG. As some of you know, I teach networking classes at DePaul University in Chicago. What has gone over extremely well in the past is when I've had a real op come talk to the students, even if its just about what they do on a daily basis. If any of you are in or around the Loop in Chicago area on a Wednesday night between September and November of this year and wouldn't mind getting up in front a few geeky undergrads, I would be forever grateful if you do so with my class. I'm not asking for anything polished. If you've presented something recently that you think a computer science undergrad should be able to grasp or even if just have enable, your future ops want you to tell them about it. ...and yes, many of the other instructors they come into contact with are focusing only on class A, B, C addressing. So you'll be doing the world a favor and maybe even me, by saying some things I'm not the only one saying to them before they interview circuit. Here's what things looked like last quarter to give you an idea of the general topics covered: <http://condor.depaul.edu/~jkristof/tdc375/> Thanks, John

6 8

Tagged vlan inside isolated pvlan
by lorddoskias 24 Aug '10

24 Aug '10

Hello, I have a catalyst 6503 with sup32 and was trying to set a tagged vlan inside a pvlan. Basically I wanna have the behavior of: switchport mode access switchport access vlan 101 switchport protected. So that other machines connected to the 6503 won't be able to communicate with this port (apart from the uplink) and in the same time I want to have vlan 101 tagged in the isolated port. Regards, Nikolay

3 2

PacketShader
by Michael Painter 23 Aug '10

23 Aug '10

Researchers in South Korea have built a networking router that transmits data at record speeds from components found in most high-end desktop computers. A team from the Korea Advanced Institute of Science and Technology created the router, which transmits data at nearly 40 gigabytes per second--many times faster than the previous record for such a device. The techniques used by the researchers could lead to a number of breakthroughs, including the use of cheaper commodity chips, such as those made by Intel and Nvidia, in high-performance routers, in place of custom-made hardware. The software developed by the researchers could also serve as a testbed for novel networking protocols that might eventually replace the decades-old ones on which the Internet currently runs. http://www.technologyreview.com/communications/26096/?nlid=3423

9 9

web site counter-phishing services
by Tim Sanderson 23 Aug '10

23 Aug '10

My company has used Perimeter E-Security's CounterPhish service for a while but we are not completely happy with it. Is anyone familiar with any other vendors that provide such service and are you happy with it?

1 0

DNSSEC and SSL
by ML 23 Aug '10

23 Aug '10

Would a future with a ubiquitous DNSSEC deployment eliminate the market for commercial CAs? Would functioning DNSSEC + self signed certs be more secure/trustworthy than our current system of trusted CAs chosen by OS/browser developers?

12 15

Looking for suggestions for an internet content filtering appliance
by Frank Bulk - iName.com 23 Aug '10

23 Aug '10

We offer an optional internet content filtering service to our residential and business customers using M86's appliance (http://www.m86security.com/products/web_security/m86-web-filtering-reportin g-suite.asp). I've been in conversation with them since Q1 regards IPv6 support, but the update I received today was that IPv6 support won't be available until middle to late next year. That's not ideal, because the local college is a significant user and they started with IPv6 this summer. College students can easily bypass content filtering by using the IPv6 version of the site (i.e. http://www.playboy.com.sixxs.org) Wondering if anyone can point me to a similar appliance. I know that Barracuda has such an appliance but it has one limitation I don't like, and that Fortinet and Ironport have more expensive products. It must be able to operate in pass-by/SPAN mode, not inline, and handle traffic rates up to 1 Gbps. We currently move 400+ Mbps "by" it and internet usage only goes up. Thanks in advance for any suggestions you have. Kind regards, Frank

5 5

Re: PacketShader
by William Pitcock 23 Aug '10

23 Aug '10

Vyatta's commercial products (the bundles with OS+Hardware) come with adequate support in my experience. William (Sorry for topposting. The android email experience is depressingly lacking.) Andrew Kirch <trelane(a)trelane.net> wrote: > On 8/23/2010 1:17 PM, Joel Jaeggli wrote: >> What it really comes down to is packets per watt or packets per dollar, >> if it's cheaper to do it this way then people will, if not BFD. > >I disagree here. Core routing isn't purchased based on cost, it's >purchased based on support. People have not adopted Vayetta, or >Mikrotik or many of the other small routing platforms which are in fact >MUCH cheaper than the bridge or the tree (cisco or juniper), and the >reason is simply support. > >If my router breaks beyond my ability to fix it I have a certified >engineer (of some value or other) at my site with parts to fix it within >4 hours. This is why people go with Cisco and Juniper. It's also a >mechanism of CYA. Would we rather tell our boss that the company has >responded and dropped the replacement part in the mail, or that a >technician from the router supplier is on their way and will be here >very shortly, and ooh, by the way, you did recommend redundant hardware >when the piece that broke was purchased, and it was available at a discount. > >Andrew >

1 0