- NANOG - lists.nanog.org

Catalyst 6500 High Switch Proc
by Philip L. 18 Nov '08

18 Nov '08

Hello. I've run into a bit of a snag and I hope some folks here may be able to enlighten. From time to time I check the 'sh platform hardware capacity' command on our Catalyst 6509s and have noticed this item: CPU Resources CPU utilization: Module 5 seconds 1 minute 5 minutes 5 RP 1% / 0% 3% 4% 5 SP 82% / 27% 62% 73% This is shown on two 6509 switches that we operate as Core layer devices. This value goes up to 85-90% during periods of peak traffic and I'm concerned that this may be a problem. Checking 'sh proc cpu' is usually 10% or less. I've gone over this document backwards and forwards and none of the situations outlined seem to apply here: http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note091… One thing to note, is that our main ACL for ingress traffic is applied here due to historical reasons. It's roughly 5000 single host entries at present. We also use these devices for NDE. I'm probably missing some other key details, but what could influence the SP like this? Any insight would be appreciated. -- Philip L.

5 7

134.17.0.0/16
by John Curran 17 Nov '08

17 Nov '08

Media Breakaway and ARIN have cooperatively reached an agreement whereby Media Breakaway will be returning to ARIN the legacy address space 134.17.0.0/16 originally issued to San Francisco (SF) Bay Packet Radio. Media Breakaway will be returning this space upon completion of renumbering to a new IPv4 allocation made based on their qualification under existing policy. ARIN is grateful for Media Breakaway's cooperation in this matter. Regards, /John John Curran Chairman, ARIN Board of Trustees

1 0

Re: Prefix Hijack Tool Comaprision
by Alexander Harrowell 17 Nov '08

17 Nov '08

It may be the North American NOG, but it's been said before that it functions as a GNOG, G for Global. I don't think Brazil is insignificant. I respect Todd's work greatly, but I think he's wrong on this point. - original message - Subject: Re: Prefix Hijack Tool Comaprision From: "Scott Weeks" <surfer(a)mauigateway.com> Date: 13/11/2008 7:42 pm --- todd(a)renesys.com wrote: From: Todd Underwood <todd(a)renesys.com> interesting, but it's not operationally significant. i would not consider the fact that PHAS and Watchmy didn't alert any particular criticism of them. but perhaps there was something else to which you were referring. ---------------------------------- I think he was just referring to and answering my question. I hope to see how these tools work in 'small' incidents as well as large-scale incidents. Knowing the tool's capabilities increases one's ability to assess the damage while troubleshooting. scott

5 4

godaddy spam / abuse suspensions?
by mike 17 Nov '08

17 Nov '08

Hi gang, I am looking into a dns problem. My resolvers are attempting to resolve various hosts under "axonplatform.net", but it's nameservers aren't responding, resulting in many many many repeated queries that end up going nowhere. I dug around a bit and the nameservers for the domain are "ns1.suspended-for.spam-and-abuse.com." and so forth. The domain registrar is godaddy and it doesn't make a whole lot of sense for them to point the nameservers for any domain at non-functioning hosts, and these have been dead for at least a few days now that I know about. Can anyone enlighten me as to what the deal might be here? Thank you. rslv1:~# dig -t ns axonplatform.net. ; <<>> DiG 9.2.4 <<>> -t ns axonplatform.net. ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42266 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;axonplatform.net. IN NS ;; ANSWER SECTION: axonplatform.net. 114343 IN NS ns1.suspended-for.spam-and-abuse.com. axonplatform.net. 114343 IN NS ns2.suspended-for.spam-and-abuse.com. ;; Query time: 0 msec ;; SERVER: 65.127.32.36#53(65.127.32.36) ;; WHEN: Sun Nov 16 18:12:00 2008 ;; MSG SIZE rcvd: 102

8 9

Rogers cluefuls
by Lyndon Nerenberg 17 Nov '08

17 Nov '08

Anyone from Rogers out there that can help me with port 587 proxy insanity? (Don't give me the 1-8xx numbers, thank you.)

1 0

McColo: Are the 'Lights On" at Telia?
by Paul Ferguson 16 Nov '08

16 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 If they are, then I sure wish that someone would explain reconnecting McColo: http://www.cidr-report.org/cgi-bin/as-report?as=as26780 With all of the evidence of criminal activity there, I would like to assume that this is just a case of ignorance. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFJH5Hiq1pz9mNUZTMRAjJpAKCHaM0OofsH67j44SQPdZAo+3poPQCg4bK0 r32lLCsm//pcaPC91wTmuiA= =QjCr -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/

7 12

Re: McColo: Are the 'Lights On" at Telia?
by Hank Nussbacher 16 Nov '08

16 Nov '08

At 07:22 PM 15-11-08 -0800, Paul Ferguson wrote: >If they are, then I sure wish that someone would explain reconnecting >McColo: > >http://www.cidr-report.org/cgi-bin/as-report?as=as26780 > >With all of the evidence of criminal activity there, I would like to assume >that this is just a case of ignorance. Some West Coast Telia salesman just hit his 2008 quota and is sitting home happy on Sunday. What don't you understand here? :-) -Hank

1 0

hosted PBX/VOIP thru VPN?
by Lorell Hathcock 15 Nov '08

15 Nov '08

All: My customer wants to try to improve performance to his ATAs by creating a VPN from his network to the VOIP provider's network through the internet. I have to admit, the idea caught me flat footed. At the outset, it seems like we would want to do it just to improve security for end users. However, my customer wants it because he thinks it will improve performance (i.e. voice quality). We are suffering from poor VOIP quality due to the Sprint / Cogent depeering and subsequent squirming by our vendors. The only reason I can think that VOIP thru a VPN would help is that *perhaps* routers in the middle on ASNs I have no control over *may* prioritize VPN traffic higher than regular traffic. They opposite could also be true. Specifically the ASNs in the middle are Level 3, Sprint and Time Warner. Thoughts? Should I try to dissuade him from this if performance is his main motivator? Thanks! Sincerely, Lorell Hathcock OfficeConnect.net | 832-665-3400 (o) | 713-992-2343 (f) | lorell(a)OfficeConnect.net ocbannerjoomla

7 7

NTP Md5 or AutoKey?
by Glen Kent 15 Nov '08

15 Nov '08

Hi, I was wondering what most folks use for NTP security? Do they use the low cost, light weight symmetric key cryptographic protection method using MD5 or do folks go in for full digital signatures and X.509 certificates (AutoKey Security)? Thanks, Glen

14 17

[funsec] McColo: Major Source of Online Scams and Spams Knocked Offline (fwd)
by Gadi Evron 15 Nov '08

15 Nov '08

---------- Forwarded message ---------- Date: Tue, 11 Nov 2008 18:22:42 -0800 From: Paul Ferguson <fergdawgster(a)gmail.com> To: funsec(a)linuxbox.org Subject: [funsec] McColo: Major Source of Online Scams and Spams Knocked Offline -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Via Security Fix. [snip] A U.S. based Web hosting firm that security experts say was responsible for facilitating more than 75 percent of the junk e-mail blasted out each day globally has been knocked offline following reports from Security Fix on evidence gathered about criminal activity emanating from the network. For the past four months, Security Fix has been gathering data from the security industry about McColo Corp., a San Jose, Calif., based Web hosting service whose client list experts say includes some of the most disreputable cyber-criminal gangs in business today. On Monday, Security Fix contacted the Internet providers that manage more than 90 percent of the company's connection to the larger Internet, sending them information about badness at McColo as documented by the security industry. [snip] More: http://voices.washingtonpost.com/securityfix/2008/11/major_source_of_online _scams_a.html Also, more details will become available real soon now... - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFJGj2hq1pz9mNUZTMRAsUaAJ4g4AzgLzD+NB9jvtlQu2kWwxY9UgCfakeM RzvY4TKA6HqN8jePb8AJlOY= =r3Oz -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/ _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.

20 24