- NANOG - lists.nanog.org

Split flows across Domains
by Glen Kent 25 Jan '06

25 Jan '06

Hi, Are there any ISPs that do, or desire, splitting traffic across different ASes for prefixes learnt via an exterior gateway protocol (say BGP)? For example, an ISP can learn two different equal cost routes to a foo.com server via two different autonomous domains. It can thus split different flows (based on src-dest IP, src-dest Port, TOS, etc) across these two paths. Do operators currently do this? Folks can send me replies offline in case this constitues a "trade secret"! Thanks, Glen

7 13

NANOG 36 (Dallas)
by Carol Wadsworth 25 Jan '06

25 Jan '06

If you are planning to attend NANOG 36, hosted by Yahoo! in Dallas, Feb. 12-15, please note the upcoming deadlines: Friday, January 27: the discounted group room rate at the Fairmont Hotel-Dallas expires. Monday, January 30: the meeting registration fee will increase $50. For additional meeting details, please see www.nanog.org See you there!

1 0

Terminal server problem
by Kim Onnel 25 Jan '06

25 Jan '06

Hi, I got a CCM1650 Avocent terminal server, if i use windows to login to their console, upon hitting enter, the password prompt is bypassed because another enter is also hit, so i get a wrong password everytime. But if i do the same from a linux machine, that doesnt happen and i get to log in fine, which tells me that windows telnet is the problem, but i dont know which knob i need to fix ? Microsoft Telnet> set ? bsasdel Backspace will be sent as delete crlf New line mode - Causes return key to send CR & LF delasbs Delete will be sent as backspace escape x x is an escape charater to enter telnet client prompt localecho Turn on localecho. logfile x x is current client log file logging Turn on logging mode x x is console or stream ntlm Turn on NTLM authentication. term x x is ansi, vt100, vt52, or vtnt Avocent CCM1650 S/W Version 2.1 Username: noc Password: ************ Authentication Complete (DEC-VT100) Connected to Port: 1 9600,8,N,2,NONE Login: cisco password: login incorrect Login: cisco password: login incorrect Login:

2 1

BlackWorm: updated snort signatures
by Gadi Evron 25 Jan '06

25 Jan '06

Can be found: http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/sigs/VIRUS/WORM_Nyxem?rev=… Thanks, Gadi.

1 0

BlackWorm infected IP's reporting
by Gadi Evron 25 Jan '06

25 Jan '06

Hi. In the next day or so some of us will cooperate to bring to the attention of all effected AS's information about infected users in their net-space. This will be coordinated with several groups and organizations. Please expect these emails, thanks. Gadi.

2 2

Re: cctld server traffic
by Gustavo Lozano 25 Jan '06

25 Jan '06

At 10:42 AM 1/22/2006 +0900, Randy Bush wrote: >any cctld ops seeing unusual traffic in the last hours? Nope at .mx. Gustavo >randy gus

4 3

Router upgrade for small colo provider
by josh harrington 25 Jan '06

25 Jan '06

Hello, hope this isn't too far offtopic here but being a troller for a long time here I've realized there is a great knowledge base so I wanted to at least see if i could get some tips. I help run a small colocation company in California and I am in the middle of recommending a new 'core router' platform for our network. We offer mainly colo and dedicated servers, and several of our clients use our space for VOIP services so quality even under high peak usage is a must. We are not huge, but as we have had near 200% growth in the past 12 months and need to expand our network asap to keep up. Simply put, I'd love to hear feedback and/or suggestions from any of you guys who have gone through this already. Our network map is real simple: [Carrier 7609] --> 100 mbit --> Our cisco 7206 --> 100 mbit --> racks [the racks on our end are a series of switches, mainly 2948gl3's] We push about 60 mbit to/from our (1) carrier at peak right now, and the router keeps up fine [its a cisco 7206 npe 150 btw, very low end on the 7206 line], and at peak we have under 50,000 packets per second, and our 7206 has little/no features enabled [just static routes and passing all traffic between 2 Ethernet 100 mbit interfaces]. To date we have had 2 problems, both were DOS attacks launched FROM one of our customer's servers flooding a full 100 mbit wire with more packets per second than the router could handle (the 2948gl3's spiked to about 50% cpu load during the attack but the 7200 literally just died for 3 minutes as the interface(s) all rebooted]. So our main goal to grow is something that can handle a lot more in this arena against a DOS, and handle our future growth. In then next 12 months we plan to add a 2nd carrier, at t3, 100mbit, or possibly oc3 speed, and possibly upgrade our main carrier to a GigE connection. Probably maxing combined in the 300 mbit range, more likely closer to half that in 12 months. ==== Problems/Requirements ==== - Budget is in the $5k to $20k range ($20k if its going to outlast me even past my 12 month projections) - must not 'collapse' under simple packet flow DOS attack - must handle BGP4 from 2 carriers with full route tables - We plan to buy used, prices below are based on USED, 30 day warranty ebay postings ===== Choices/Options that we have looked at: ==== Option #1: Cisco VXR 7206 [$4k to $12k] Option #2: Cisco 12008 [$7k to $14k] Option #3: Cisco 6509 [$10k to $15k] Here are the 3 main options, broken down a bit more in depth. [I have not ruled out juniper all together, but not enough experience with them and lots of experience with cisco, makes cisco our better option i think, especially since its easier to find used cisco gear than it is to find used juniper gear at a decent price]. [option #1 - Cisco 7206 VXR] -------------------------------- Estimated: $4,000 [$6,000 with 400 mhz, $12,000 with the 1 ghz cpu upgrade] 1 Cisco 7206 VXR NPE 300 mhz w/max ram 2 AC Power 2 Fast Ethernet Adapters (1 included on the NPE) + lots of experience on this unit + lots of spare cards (most compatible) + can keep old 7200 as a hot standby, minimizing long term downtime - END OF LIFE/sale/support on most of the 7200 product line over 5 years ago! The VXR model is darn close to end of life i suspect - minimal horse power here for the money, prone to death by packet attack [option #2 - Cisco GSR (12008)] -------------------------------- Estimated: $7,000 to $14,000 [varies if I start with GigE or just 100mbit] 1 Cisco12008 GSR 40Gbps 1 Clock Scheduler Card (GSR8) 3 Switch Fabric Card (GSR8) 2 AC Power 1 4 port OC-3c/STM-1 Single Mode 1 GE card or a 4 port x 100 mbit + much higher total bandwidth/packet processing power compared to 7200, for similar money - product is long since obsolete and outclassed by the 760x cisco router, as well as just about any juniper router in the m20+ tier. - I'd bet if i buy this, cisco will classify it end of life within 3 months :) - over priced 'blade cards' to add any other functions/circuits (high costs) [option #3 - Cisco 6509 switch'router' w/MSFC2] ------------------------------------------------------------ Estimated: $10,000 - $15,000 (and up depending on config) 1 WS-C6509 Cisco Catalyst 6500 9-Slot Chassis 1 WS-C6K-9SLOT-FAN Catalyst 6000 Fan Tray for 9-Slot Systems 1 WS-C6X09-RACK Catalyst 6x09 Rack Mount Kit 2 WS-CAC-1300W 1300W AC Power Supply 1 CAB-7513AC AC Power Cord 1 WS-X6K-S1A-MSFC2 Catalyst 6500 Supervisor Engine-2, 2GE, plus MSFC-2 / PFC (WS-X6K-S1A-2GE + MSFC-2 & PFC) 1 MEM-C6K-FLC24M 24MB Flash Card 1 WS-X6408A-GBIC Catalyst 6500 8-Port Gigabit Ethernet Module (Req. GBICs) 1 WS-X6348-RJ-45 Catalyst 6500 48-Port 10/100 RJ-45 Module + could consolidate router/switch into 1 [i.e. replace my 48 port switches in each rack] + still a major product with sales/support, no end of life 'soon', this is still a primary flag ship product - 'not a router' as some would say [though this one is as good as it gets for a switch with router ability built in, so i read at least] - bgp4 support appears limited in previous versions, but the MSFC2 processor supposedly can handle (2) bgp4 sessions properly [makes me nervous] - no support for anything but 100mbit, or gigE links, wont work with t3, or oc3 lines [since i don't know what ill buy from my next carrier this is a draw back since i may very well get a circuit this switch/router can't use] - 'all eggs in 1 basket' theory, if it breaks you loose all your ether switches! [at least with separate routers/switches i can swap in an old 7206 router spare and get back online fast in a worst case scenario. -- OK so if you read this far, you probably wonder why the heck am i asking you guys and not calling cisco and juniper, and others? Well I have, and I have, they all gave me their input- but I'd love to hear from some real people in the field rather than sales engineers and bloated brochures claiming much more capacity than true world usage will produce etc. - Josh Harington jharington68(a)hotmail.com _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

3 2

T1 bonding
by Matt Bazan 25 Jan '06

25 Jan '06

Can someone shed some technical light on the details of how two T1's are bonded (typically). We've got two sets of T's at two different location with vendor 'X' (name starts w/ an 'A') and it appears that we're really only getting about 1 full T's worth of bandwidth and maybe 20% of the second. Seems like they're bonded perhaps using destination IP? It's a vendor managed solution and I need to get some answers faster than they're coming in. Thanks. Matt

5 7

RE: Password Security and Distribution
by (nanog) Brian Battle 25 Jan '06

25 Jan '06

>Our company is starting to grow rather quickly and we are starting >to have growing pains. We are in the need for a better mechanism for >sharing passwords between our engineers. I wish there was a system that let you do the following: * Store and encrypt logins/passwords and access logs in a database * Assign permissions (add new logins/passwords, change password...) to those passwords on a per user/group basis, based on an existing authentication scheme (Windows AD, LDAP, Kerberos...) * SSL web frontend * Reporting. If a user leaves and you want to know which passwords he had access to or has ever accessed so you can change them, this would be really really nice. I've been playing around with Network Password Manager from www.sowsoft.com. It seems like the best product available in this area that I could find that makes sharing passwords kinda easy, but it's a service that runs on Windows, requires a Windows client software installation, and lacks any sort of reporting.

2 1

BlackWorm naming confusing [CME entry now available]
by Gadi Evron 24 Jan '06

24 Jan '06

The CME entry should appear on their site shortly: http://cme.mitre.org Gadi.

1 0