- NANOG - lists.nanog.org

ddos?
by Dan Hollis 09 Dec '04

09 Dec '04

Anyone aware of ddos affecting savvis, level3, or qwest at the moment? -Dan

3 2

Re: Peering best practices advice needed.
by Richard Irving 08 Dec '04

08 Dec '04

acennami(a)neupath.com wrote: > That is what he is doing, however if he is advertising the two /19's, >from two disconnected sites with the same ASN, > they will not be able to reach each other as BGP will >interpret this as a path loop. Yup. I would presume, as they aren't connected, nor running iBGP, they would be running different ASN's. Anything else hurts. > On Wed, Dec 08, 2004 at 12:56:13PM -0500, Richard Irving wrote: > >>Rolo Tomassi wrote: >> >>>Hi all, >>> >>>Please forgive the simplistic nature of the query.. >>> >>>Basically my company is multi-homed with 2 different providers in the >>>UK, and advertising a /18. Now some colleaguges in another part of the >>>world want to break that /18 into two /19's and advertise one /19 and we >>>advertise the other. This is fine, however we are NOT running IBGP in >>>the core, therefore the UK customers in the /19 will not be able to >>>reach the other /19 as there would be a loop detected through EBGP. >> >> Pardon my simplistic solution, try dropping the /18, and -only- >>advertise the corresponding /19 from each region. >> >> >>>Now someone mentioned that we could use AS-LOOP-IN feature which will >>>overcome this problem and allow us to route to each other via EBGP. I >>>really think this is a bad idea but until we get an internal link - I >>>dont see a way forward. So... anyone doing this currently in their >>>network or have any "best practices" way round this. I want our company >>>to be good Netizens but still be able to pass traffic between the 2 /19's. >> >> See above. K.I.S.S. (No offense intended ;) >> >> >>>Any help would be greatly appreciated. >>> >>>Rolo ! >>> >>>_________________________________________________________________ >>>Stay in touch with absent friends - get MSN Messenger >>>http://www.msn.co.uk/messenger

1 0

wi.rr.com
by Jeffrey Sharpe 08 Dec '04

08 Dec '04

Could someone from Roadrunner contact me off-list please? ------------------------------------------------ Jeffrey Sharpe CyberLynk Helpdesk and Support 414.858.9335 or 800.942.8022 jsharpe(a)cyberlynk.net ------------------------------------------------

1 0

Trojan poses as Lycos Europe screensaver
by Fergie (Paul Ferguson) 08 Dec '04

08 Dec '04

This article made coffee come out of my nose. :-) - ferg http://news.com.com/Trojan+poses+as+Lycos+Europe+screen+saver/2100-7349_3-5… -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

Enterprise syslog management and alert generation.
by Bill Nash 08 Dec '04

08 Dec '04

Some people call this 'Netcool' or products of a similiar stripe. I'm ramping up a project to rebuild some previous work done on this front with an open source distribution in mind (those of you on the syslog-ng list have seen mention of it), so I'm fishing for requirements I may not have already covered. I currently have: Perl regexp engine for applied rules. Tokenization and extraction of data from inbound syslog data. Assigning (single|multiple) customized event handlers to rule matches Ability to run multiple analyzers concurrently Optional linear rule application versus weighted optimization SQL storage of rules for centralized management and redistribution. Fully customized alert generation. My current production implementation has handled over 20 gigs a day, at peak, on a single analyzer (dual amd 2800+), using syslog-ng as a transport mechanism (forked socket transport with local disk logging for backup). Every network is different, as are particular requirements. Who's got wish lists? I personally wouldn't mind an on-list discussion about this, as it applies to standard operations toolsets, but if that's not kosher, feel free to contact me off-list. - billn

2 2

RE: Enterprise syslog management and alert generation.
by Chad Skidmore 08 Dec '04

08 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Bill Nash [mailto:billn@billn.net] > Posted At: Tuesday, December 07, 2004 11:07 PM > Posted To: NANOG > Conversation: Enterprise syslog management and alert generation. > Subject: Re: Enterprise syslog management and alert generation. > > The X over time is a new one, it's been mentioned a couple > times today, and I can certainly account for it. I've added > it to my rapidly growing list. > > - billn > > As a current Netcool user that is one of several things that we've really come to like with their product. As Alexi says flexability in rules is HUGE, and is one of the reasons we've been very pleased with Netcool Omnibus. If there was an open source alternative I think it would be very attractive. I would agree that the rules engine is key. Oddly enough every operator is a little different and a solid (and easy to use) rules engine can make all the difference in the world. If you can be as good as Netcool then that is pretty impressive. Regards, Chad - ---------------------------- Chad E Skidmore One Eighty Networks, Inc. - AS12111 http://www.go180.net 509-688-8180 -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQbabgU2RUJ5udBnvEQJ9EgCfWpWU4L8cevOJLAy41dtYp0+q3uwAniE8 nqR+/s921KzHs/OkXNMdLUDn =efKB -----END PGP SIGNATURE-----

1 0

RE: Enterprise syslog management and alert generation.
by Paul Jasa 08 Dec '04

08 Dec '04

This is a topic near and dear to my heart. I've been using SEC for a while now, been very happy with it. If you like Perl and its regular expressions, SEC will do the trick. It has a very complex log correlation capabilities, and multiple action methods, strongly recommend it especially if used with syslog-ng http://sourceforge.net/projects/simple-evcorr BTW, the README and instructions on how to set it up and all the options is extremely well-written and thorough, you'll like it. pj ====================================== Paul ====================================== -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Alexei Roudnev Sent: Wednesday, December 08, 2004 12:52 AM To: Bill Nash; nanog(a)merit.edu Subject: Re: Enterprise syslog management and alert generation. In such products, only 20% value is in engine; 80% are in rules, because I can not wrire rules myself - I have not event until it happen, and I can not filetr out noice until it happen. We use a few syslog analyzers (using syslog-ng as a transport), some with simple logcheck, other with database for rules and hosts; and every time problem is the same - writing rules is 90% of the problem. But... do you have rules, such as fort example _send alert if any system began to generate 10 times logs / hour more vs. average? Or saying _single PCI ERROR on Solaris - ignore, 10 in a straight line - send warning... ----- Original Message ----- From: "Bill Nash" <billn(a)billn.net> To: <nanog(a)merit.edu> Sent: Tuesday, December 07, 2004 12:48 PM Subject: Enterprise syslog management and alert generation. > > > Some people call this 'Netcool' or products of a similiar stripe. I'm > ramping up a project to rebuild some previous work done on this front with > an open source distribution in mind (those of you on the syslog-ng list > have seen mention of it), so I'm fishing for requirements I may not have > already covered. > > I currently have: > Perl regexp engine for applied rules. > Tokenization and extraction of data from inbound syslog data. > Assigning (single|multiple) customized event handlers to rule matches > Ability to run multiple analyzers concurrently > Optional linear rule application versus weighted optimization > SQL storage of rules for centralized management and redistribution. > Fully customized alert generation. > > My current production implementation has handled over 20 gigs a day, at > peak, on a single analyzer (dual amd 2800+), using syslog-ng as a > transport mechanism (forked socket transport with local disk logging for > backup). > > Every network is different, as are particular requirements. Who's got wish > lists? I personally wouldn't mind an on-list discussion about this, as it > applies to standard operations toolsets, but if that's not kosher, feel > free to contact me off-list. > > - billn The information contained in this e-mail and any attached documents may be privileged, confidential and protected from disclosure. If you are not the intended recipient you may not read, copy, distribute or use this information. If you have received this communication in error, please notify the sender immediately by replying to this message and then delete it from your system.

1 0

Setting up DS-3 and 2 4xT1
by Joshua Brady 07 Dec '04

07 Dec '04

My apologies if some may find this a little off-topic. However, here is my issue. I need a router, which can take 2 4xT1's and a DS-3, while handing a Gbit for internal use. Now to complicate the entire situation, this needs to go into a 3 bedroom apartment, so I need to keep the power bills down if I can :) What would everyone recommend? Off-List replies are fine, I will summarize at the end. Thanks, Joshua Brady

6 5

Intelligent Automation of network tasks
by Ejay Hire 07 Dec '04

07 Dec '04

In my opinion, every network with more than a dozen or so routers needs an automated method to distribute massive configuration changes. There is a lot of fear that something will break during updates, but with some intelligence, that risk can be minimized. Related to this, here is how I distribute Bogons, cognizant of the fact that the system has to be smart enough not to break anything in the event a telnet session breaks. So, here is what I send to my routers.. No ip prefix-list bogons ip prefix-list bogon seq 1 permit 0.0.0.0/0 Ip prefix-list bogon deny 0.0.0.0/7 le 32 Ip prefix-list bogon deny 2.0.0.0/8 le 32 <snip> Ip prefix-list bogon deny 197.0.0.0/8 le 32 Ip prefix-list bogon deny 223.0.0.0/8 le 32 ip prefix-list bogon permit 0.0.0.0/0 le 27 No ip prefix-list bogon seq 1 permit 0.0.0.0/0 Worst case scenario, I break my bogon filters... and that happens very very rarely. The same logic can be applied to access-list using named access lists. Hopefully that will help someone. -ejay

4 3

RE: Intelligent Automation of network tasks
by Hannigan, Martin 07 Dec '04

07 Dec '04

Call me sentimental, but I was using/making my previous staff use rtrmon in the absence of big OSS systems. I believe it's still up at ISC somewhere. I can't remember if it has a "glob all" function. I do remember it would probably be easy enough to integrate. -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan(a)verisign.com > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Tuesday, December 07, 2004 1:54 PM > To: Ejay Hire > Cc: nanog(a)merit.edu > Subject: Re: Intelligent Automation of network tasks > > > > On Tue, Dec 07, 2004 at 12:39:25PM -0600, Ejay Hire wrote: > > > > In my opinion, every network with more than a dozen or so > routers needs > > an automated method to distribute massive configuration > changes. There > > is a lot of fear that something will break during updates, > but with some > > intelligence, that risk can be minimized. > > juniper and cisco both support taking machine generated > configurations generated by a non-router device (eg: unix host). > > http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/product s_feature_guide09186a00801d1dc2.html it's not just in 12.3T, it's also in 12.2S.. on your juniper, try something like "config, load override" - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0