- NANOG - lists.nanog.org

Re: ISMS working group and charter problems
by Eliot Lear 06 Sep '05

06 Sep '05

Daniel, All solutions will use a different SSH port as part of the standard just so that firewall administrators have the ability to block. Eliot Daniel Senie wrote: > At 02:00 PM 9/6/2005, Dave Crocker wrote: > > >> Eliot, >> >>> I need your help to correct for an impending mistake by the ISMS >>> working group in the IETF. >> >> >> >> Your note is clear and logical, and seems quite compelling. >> >> Is there any chance of getting a proponent of the working group's >> decision to post a defense? >> >> (By the way, I am awestruck at the potential impact of changing SNMP >> from UDP-based to TCP-based, given the extensive debates that took >> place about this when SNMP was originally developed. Has THIS >> decision been subject to adequate external review, preferably >> including a pass by the IAB?) > > > I agree the argument is well laid out, and would be interested in > hearing the thinking of ISMS in response. > > I'm more than a bit concerned, however, when folks start talking about > solutions that will permit things to pass through firewalls without > configuration. Those in charge of firewalls are often purposely setting > policy. If there is a perceived need for a policy that prevents SNMP > traffic, then it should remain possible for the administrator of that > network element to make that call. I must say I have some concern with > overlaying SNMP on SSH, since that precludes the firewall knowing > whether the traffic is general SSH keyboard traffic or network management. > > Let's hear more about the thinking involved. >

1 0

P2P Darknets to eclipse bandwidth management?
by Fergie (Paul Ferguson) 06 Sep '05

06 Sep '05

Interesting article, and something I think that will certainly becaome an issue for ISPs. Is this a real issue ISPs are thinking about? Via The Register: [snip] Encrypted P2P networks will soon make bandwidth management based on deep packet inspection obsolete, says Staselog, a Finnish appliance outfit. Around 80 per cent of all traffic in the Internet is already P2P. This traffic will increase 1,000-fold in the next five years and most of it will be encrypted P2P, according to a study by Staselog and researchers at Finnish Universities. [snip] http://www.theregister.co.uk/2005/09/01/darknets_fox_traffic_manage_tech/ Overlooking the point that this kind of smells like a pitch for Staselog, I'd be curious to hear of this is an issue on ISP bandwidth management radar... or already is... - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

6 5

Any issue with www.cisco.com
by Hyunseog Ryu 06 Sep '05

06 Sep '05

Last night I had a maintenance so I use www.cisco.com for testing the network connectivity. But it seems that I'm seeing about 20% packet loss from www.cisco.com. I did same test from various points including my home cable modem connection, which is not my company's network, but I'm getting same result. Are you guys seeing same thing or different result? Is there any issue with cisco.com network? Hyun

7 6

RE: level3.net in Chicago - high packet loss?!?
by Min Qiu 06 Sep '05

06 Sep '05

Stef, > -----Original Message----- > From: Network Fortius [mailto:netfortius@gmail.com] > Sent: Tuesday, September 06, 2005 10:25 AM > To: nanog(a)merit.edu > Subject: Re: level3.net in Chicago - high packet loss?!? > > > > And how exactly would you interpret the number returned by net_loss > (int), in a column called "LOSS", in reference to reachability of a > "hop" between two end points: > > int net_loss(int at) > { > if ((host[at].xmit - host[at].transit) == 0) > return 0; > /* times extra 1000 */ > return 1000*(100 - (100.0 * host[at].returned / (host[at].xmit - > host[at].transit)) ); > } ? This piece of code is modified by me (all mistake is mine). It converts the the drop to percentage. x 1000 was a trick to handle none int returned by the function. This was an issue I did not have a clear answer. Regarding to you original post. Your trace end2end (last hop) has 0.0% drop proved the entire path was free of packet loss. The drop in the middle of the path could be related to ICMP rate limit or other things. Should it was a congestion in the X hop, every hop after X would be impacted by it. Thus X+1, X=2... has to be > 0.0%. Hope this help, Min > > Thanks, > Stef > Network Fortius, LLC > > > On Sep 6, 2005, at 7:45 AM, Robert E.Seastrom wrote: > > > > > Network Fortius <netfortius(a)gmail.com> writes: > > > > > >> Anybody having any idea why such a high packet loss on lever3's > >> network, in Chicago? > >> > > > > End-user misinterpreting output from MTR. This network does not > > appear to have any packet loss end-to-end. > > > > ---Rob > > > > > > > >> Stef:~ scm$ mtr -r www.yahoo.com > >> ... > >> tbr1-p010802.cgcil.ip.att.net 0% 16 16 15.12 > >> 24.21 49.26 > >> ggr2-p310.cgcil.ip.att.net 0% 16 16 13.18 > >> 42.66 118.99 > >> so-1-1-0.edge1.chicago1.level3.net 0% 16 16 14.48 > >> 35.84 126.48 > >> so-2-1-0.bbr1.chicago1.level3.net 63% 6 16 14.44 > >> 43.74 79.97 > >> > > >> ^^^^^^^ > >> as-1-0.bbr2.sanjose1.level3.net 0% 16 16 61.95 > >> 80.64 176.01 > >> ge-10-2.ipcolo3.sanjose1.level3.net 0% 16 16 63.37 > >> 95.61 148.46 > >> unknown.level3.net 0% 16 16 63.34 > >> 86.46 168.62 > >> unknown-66-218-82-217.yahoo.com 0% 16 16 62.09 > >> 88.91 127.58 > >> p4.www.scd.yahoo.com 0% 16 16 64.51 > >> 89.96 183.79 > >> > >> TIA, > >> Stef > >> Network Fortius, LLC > > > >

1 0

$400 to $600 million Bellsouth repairs
by Sean Donelan 06 Sep '05

06 Sep '05

A map showing the geographic span of the disaster. It extends far beyond New Orleans, across Mississippi and Alabama. Some service in the worst areas may not be restored for months. http://www.nytimes.com/2005/09/06/business/06telecom.html

1 0

Cisco crapaganda
by J. Oquendo 06 Sep '05

06 Sep '05

http://www.networkworld.com/news/2005/080805-cisco-routers.html /* ARTICLE Among the developments last week: Cisco continually revised its security bulletin, adding details as to how versions of unpatched IOS software could be undermined by a "specifically crafted IPv6 packet." Sources at Cisco say testing will continue indefinitely and could include findings related to more than simply IPv6-related exploits. */ Ironic the marketing and disinformation coming out of Cisco Systems in relation to not disclosing what really occurred and labeling the vulnerability as "IPv6 based.... but" after they initially stated it as "IPv6 only!" /* ARTICLE The researcher who touched off the uproar, Michael Lynn, says he is now the subject of inquiries by FBI agents, and he continues to defend the propriety of his actions. */ Since when did the FBI decide to play "Corporation Superherosaviour" so blatantly. Mr. Lynn's disclosure while a double edged sword can possibly save the industry from a catastrophe, and while yes it can also cause one, I believe he did the right thing. /* ARTICLE Experts and users say the hole in IOS appears not to be an immediate concern based on what is public knowledge at the moment, since patches are available. But what concerns some is that Lynn's exploit techniques take router hacking to a new level, which eventually could have security implications for Cisco customers. */ This same attitude from vendors is what causes those releasing POC (proof of concept) code to release information on how things break. I recall posting here a while back information on how it would be possible to break neighbors in BGP by causing flaps. I did not post the information with the intent on anyone using that information to cause damage nor was it malicious. I did it under the impression someone in the industry would take a look at it and see what I saw and come up with a solution. To date however... It's been more or less the same: "You're an ass for doing that..." /* ARTICLE While Lynn has settled one lawsuit with Cisco and ISS, agreeing not to disclose anything he knows about the exploit, his problems don't seem to be over. The FBI is investigating him and interviewing friends and roommates, he says. */ Spin spin sugar... Looking at this current situation I'm wondering when did it become a federal offense to break a non disclosure agreement. I can look at this two possible ways now... Are the feds looking at Mr. Lynn because they have something vested in the IOS of Cisco (Carnivore, Magic Lantern), or are they going after him under the guise of "National (in)Security". If it's national (in)security, then why not go after Cisco for allowing this problem to go unresolved when they knew of it months in advance. Anyhow, sorry for the rants... The article is pseudo-worth the read if you can filter out marketing and crapaganda. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

9 9

Hurrican Katrina situation report
by Sean Donelan 05 Sep '05

05 Sep '05

Electric power Peak outages in Alabama, Louisiana and Mississippi: 2.7 million meters Remaining outages as of September 5: 1 million meters Alabama: 2% customer meters without power Louisiana: 56% customer meters without power Mississippi: 30% customer meters without power New Orleans: restoration to emergency, governmental and special needs customers including portions of the west bank of Jefferson Parish, including West Jefferson Hospital, Entergy's Gretna Control Center, Jefferson Parish EOC, Gretna Police Department, Gretna Fire Station, Gretna Water Works and Jefferson Parish Sewer Plant. On the east bank of Jefferson Parish, power has been restored to East Jefferson General Hospital, Ochsner Clinic Foundation and the Louis Armstrong International Airport. Natural gas (Entergy): Extensive damage to gas distribution system in New Orleans. Will need to shut off natural gas service in many areas of New Orleans to make repairs. Cellular (Verizon, Cingular): Alabama: majority of service restored with a few areas of limited service Mississippi: Gulf coast outages and spotty service. Cell on Wheels (COWs) deployed to support relief operations in several areas. Biloxi service partially restored. Louisiana: Central New Orleans wide spread outages with limited service. Outside of New Orleans, have good service with only a few areas of limited coverage. Rooftop COWs being deployed to locations in New Oreleans. Roaming service: Evacuees with cell phones with numbers from the affected areas found their service did not work elsewhere in the country because the cell phone could not register on the network. Cellular carriers have worked to re-deploy new databases and re-route registration messages to provide service to evacuees. Note: Mobile VOIP services could have the same problem in the future. Wireline (Bellsouth): Lousiana: Approximately 54% of the access lines out of service. Mississippi: Approximately 39% of the access lines out of service. Alabama: Approximately 5% of the access lines out of service. Long Distance and Internet: Sprint Nextel has rerouted long-distance traffic around New Orleans enabling customers to make long-distance calls in the Tallahassee area and in the Florida Panhandle, including Ft. Walton Beach. Sprint Nextel teams continue to work to restore dedicated Internet access to corporate customers in northern Florida. Qwest fiber optic line along the gulf coast was damaged. Services for shelters and evacuees in other states Essentially every service provider is providing emergency and free services to shelters and evacuees as new shelters are being opened througout the country.

1 0

katrina damage
by Andrew D Kirch 05 Sep '05

05 Sep '05

This isn't quite network related, though if you have facilities in New Orleans, it might be of use to assist in assessing damage in your area. http://maps.google.com/maps?q=New+Orleans&t=e has satellite images from Katrina's damage path specifically in the New Orleans Area. -- Andrew D Kirch | Abusive Hosts Blocking List | www.ahbl.org Security Admin | Summit Open Source Development Group | www.sosdg.org Key At http://www.2mbit.com/~trelane/trelane.asc Key fingerprint = 4106 3338 1F17 1E6F 8FB2 8DFA 1331 7E25 C406 C8D2

1 0

Re: Update on Wireless Katrina Response
by W.D.McKinney 05 Sep '05

05 Sep '05

>-----Original Message----- >From: Fergie (Paul Ferguson) [mailto:fergdawg@netzero.net] >Sent: Monday, September 5, 2005 08:35 AM >To: nanog(a)merit.edu >Subject: Update on Wireless Katrina Response > > >"On Friday, the FCC held a conference call with wireless >internet service providers and representatives of tech >companies including Intel, Cisco, and Vonage -- the goal >was to urgently coordinate private and public sector resources >to get communication systems up again in areas devastated by >Katrina." > >http://www.boingboing.net/2005/09/05/update_on_wireless_k.html > >- ferg > > The list at part-15.org has information on the Wisps setting up Wireless service ASAP. Also some VoIP services. -Cheers Dee

1 0

Update on Wireless Katrina Response
by Fergie (Paul Ferguson) 05 Sep '05

05 Sep '05

"On Friday, the FCC held a conference call with wireless internet service providers and representatives of tech companies including Intel, Cisco, and Vonage -- the goal was to urgently coordinate private and public sector resources to get communication systems up again in areas devastated by Katrina." http://www.boingboing.net/2005/09/05/update_on_wireless_k.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0