- NANOG - lists.nanog.org

Re: [cee4@packet-pushers.com: Slides for NANOG31 IPsec tutorial]
by Paul Wouters 24 May '04

24 May '04

> Subject: Slides for NANOG31 IPsec tutorial > > If you plan to attend Sunday's hands-on tutorial for using the IPsec > server at NANOG, you may want to have a look at the slides in > advance. You can find them at: http://www.packet-pushers.net/NANOG/ipsec/ Unfortunately, I won't be there. But I looked at your slides, since we are doing a lot of things with IPsec and wireless as well. > The slides contain URLs for sample configuration files and startup > scripts. Those files are also available at the above URL. I wonder why you made your configuration so complex. Why tunnel an extra IP address to the laptops? Why use L2TP when you can fix this with simple X.509 certificates. Why use PSKs when you can trivially use a Certificate Agency and roll out certificates over a webserver on the 'hotspot'? You might want to have a look at the WaveSEC deployment we did at BlackHat in Amsterdam last week. It worked fine for linux, windwos and macosx (racoon) based systems. It provides an easy to use windows interface for adding a X.509 certificate (PKCS12) file into the registry for WinXP/2K. It seems a lot less complex then your setup where everyone has to manually tunnel a single ip address onto their laptop. My slides, as well as the server prototype code (which in its turn provides the client code for windows when needed), are available at: http://www.blackhat.com/html/bh-media-archives/bh-archives-2004.html#EU-2004 Near the end, you will also see a few problems that Windows users can fall into. This does not list the latest problem that has been found yet, that any packet from source port 98 is considered 'secure' by windows, and is allowed to hit the machine regardhless of IPsec policies (but as you said, IPsec is not a firewall) Paul

2 1

FW: Corporate Fax Solution
by Kaveh Sheikholeslami 24 May '04

24 May '04

Hello, Can anyone provide suggestions/recommendations regarding a practical, cost effective corporate fax solution for small/medium size companies? The environments include Microsoft Exchange servers and Windows 98/2000/XP clients. Any input is greatly appreciated. Thanks Best regards, Senior Network Administrator MIS, Inc. "This message (including any attachments) constitutes a confidential communication and/or contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, please notify the sender by return email and delete this message and any attachments. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited."

1 0

Re: Lots of big web sites broken...SPOF
by Simar 24 May '04

24 May '04

Here is the latest we got: An isolated issue occurred Monday May 24, 2004 (roughly during the period of 8:00 a.m. - 9:30 a.m. ET), where multiple Akamai customers experienced intermittent performance and availability degradation. This degradation was the result of a bug within one of Akamais backend content control management tools, which allows the expiration of content on the Akamai network. The degradation was not a result of any outside interference with Akamais network (such as Denial of Service or hacking). Upon identification of the bug, Akamai quickly took corrective action which returned customers to normal service levels. Akamai is currently putting measures in place to return the content management tool to its normal working order and is adding safeguards such that the issue will not occur in the future. In the meantime, Akamai customers are able to serve their content through the Akamai Network normally. -- Simar cisco(a)snickers.org

1 0

Lots of big web sites broken...SPOF
by cisco 24 May '04

24 May '04

looks like they are recovering now, akamai noc said its resolved. -- Simar cisco(a)snickers.org

3 2

Lots of big web sites broken...SPOF
by Jon Lewis 24 May '04

24 May '04

Ok...who turned off Akamai? :) Sites that use Akamai for serving their images all seem to be pretty much broken this morning. From here, I'm seeing multiple Akamai servers on multiple networks just not responding to HTTP. They accept connections (some after much delay), but don't reply to requests. ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

4 3

Re: Spring time fiber cuts (was Re: fiber cut 19 May/PM -> 20 May /AM)
by David Lesher 24 May '04

24 May '04

Speaking on Deep Background, the Press Secretary whispered: > > > > It's worth noting that just because you have a working protect > doesn't mean it isn't wdmed or muxed onto the same fiber. If it is > supposed to be a widely divergant path, latency can provide a clue, > but in the majority of cases as the customer you can't really tell if > they've given you the protect you asked for or not. WhatHeSaid. A friend runs an important netverk for Uncle Sam. They spend [BIG $$$] every ?year? forcing this issue with Ma's Bastard Kids and other Usual Suspects. It's a Royal PITA to do so, but they do the deed. (One way is contract language requiring that diversity, then demanding actual trunk # data... and pointing out the defn of "fraud"... In case anyone thinks otherwise, let me say you do NOT want to commit provable fraud against Mr. Suspenders. You can well go Up The River and I don't mean for visiting day. Not likely you say? That depends on who you do it to, and how serious the issue is.) -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1

Roadrunner network human contact?
by Alan Sparks 24 May '04

24 May '04

Can anyone tell me the best way to contact a real network person at Roadrunner? I need to talk to someone about a problem with their DNS servers, but trying to get a real person via hostmaster, postmaster, or abuse addresses seems futile. Get autoresponders and no human responses for last two weeks. Thanks. -Alan -- Alan Sparks, Sr. UNIX Administrator asparks(a)quris.com Quris, Inc. (720) 836-2058

1 0

RE: Lots of big web sites broken...SPOF
by netadm 24 May '04

24 May '04

Just got off the phone with their NOC. It is a system-wide problem that "looks like it may be a DOS attack". They have no ETA as to a resolution yet. -----Original Message----- From: Joseph Nuara [mailto:joe@moorecap.com] Sent: Monday, May 24, 2004 9:09 AM To: nanog(a)merit.edu Subject: Re: Lots of big web sites broken...SPOF Any idea on the cause or the ETA to restoration of service? On Mon, 24 May 2004, Jon Lewis wrote: > > Ok...who turned off Akamai? :) > > Sites that use Akamai for serving their images all seem to be pretty > much broken this morning. From here, I'm seeing multiple Akamai > servers on multiple networks just not responding to HTTP. They accept > connections (some after much delay), but don't reply to requests. > > ---------------------------------------------------------------------- > Jon Lewis *jlewis(a)lewis.org*| I route > Senior Network Engineer | therefore you are > Atlantic Net | > _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________ >

1 0

ntp config tech note
by Randy Bush 24 May '04

24 May '04

sorry to take you away from discussing spam with an actual tech note, but twice this morning i have hit incidents where much needed ntp clients were blown. so, as i was gonna have to write it up, i figured i would bore you all with it. --- ntp config hint 2004.05.20 ntpd will not work if your clock is off my a few minutes. it just sits there forever with its finger in its ear. so, at boot, before you start ntpd, use ntpdate to whack your system's time from a friendly low-numbered strat chimer. do not background ntpdate with -b, because, if it is slow to complete, ntpd can't get the port when you try to start it next in the boot sequence. if ntpdate takes a minute and thus adds to your boot time, then something is wrong anyway; fix it. in case your dns resolver is slow, servers are in trouble, etc. have an entry for your ntpdate chimer in /etc/hosts. yes, i too hate /etc/hosts; but i have been bitten without this hack; named is even more fragile than ntpd. once ntpdate has run, then and only then, start your ntpd. and read all the usual advice on configuration, selection and solicitation of chimers with which to peer, ... and then, if having accurate time on this host is critical, cron a script which runs `ntpq -c peers` and pipes it to a hack which looks to be sure that one of the chimers has a splat in front of it. run this script hourly, and scream bloody hell via email if it finds problems. --- now back to your regular spam discussion. /* yes, spam is an important issue. but, if your local organization, this mailing list, ... gets swamped with discussions of spam, then the spammers have won. you have to compartmentalize it, in your organization and in the general net culture. that's why there are separate mailing lists for spam, ddos, and other net crap with which we have to deal. that's why we have more than one mailing list in the world, to compartmentalize so we can focus. */ randy

23 35

RE: Spring time fiber cuts (was Re: fiber cut 19 May/PM -> 20 May /AM) (fwd)
by Hannigan, Martin 24 May '04

24 May '04

..and you can deploy SONET without a protect. -M -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Stephen J. Wilcox Sent: Sunday, May 23, 2004 4:48 PM To: nanog(a)merit.edu Subject: Spring time fiber cuts (was Re: fiber cut 19 May/PM -> 20 May/AM) (fwd) On Thu, 20 May 2004, Dan Armstrong wrote: > Forgive me, but > > Isn't Sonet usually deployed in a ring? Why the heck would a fiber this > important not be? Fibre != Sonet (L1 vs L2) Fibre is deployed in strands Steve

3 2