- NANOG - lists.nanog.org

Re: Any 1U - 2U Ethernet switches that can handle 4K VLANs?
by ken emery 26 Jan '04

26 Jan '04

On Sun, 25 Jan 2004, Bill Nash wrote: > On Sun, 25 Jan 2004, ken emery wrote: > > > The point of using VLANs is that you don't need to route. There's > > > probably a good reason for switching instead of routing in the original > > > poster's scenario. (Perhaps a FTTH-like project?) > > > > Correct me if I'm wrong here, but at some point you will have to route > > all those VLAN's. To really answer the question about wether > 1000 > > VLAN's are necessary one would need to see the network design. > I would argue this point. I've got a production environment sporting > multiple vlans, none which will ever see an external subnet or even a > gateway (think databases.) The operative context inherent in the VLAN > acronym is, after all, 'local', and not every topology requires routing. This is correct, but then why spend the money on a L3 switch? Routing isn't needed so save the money and purchase a L2 switch. bye, ken emery

4 5

test
by Andre Chapuis 26 Jan '04

26 Jan '04

1 0

DNS Rootservers go international
by Hank Nussbacher 26 Jan '04

26 Jan '04

http://www.theregister.co.uk/content/6/35070.html -Hank

1 0

Re: Any 1U - 2U Ethernet switches that can handle 4K VLANs?
by sthaug＠nethelp.no 26 Jan '04

26 Jan '04

> 3550 runs IOS. That's an answer. I never allow any non-IOS router in > production environment (except high end devices, such as Juniper, when > benefits are very high). And 3550 is not expansive (yes, it is not cheap). If you believe that IOS solves all problems, we live on different planets. > PS. How much ethernet ports do you have in the office? Do you have 100 K > ports? If not, why do you need 128K MAC's? (I know only one case, when I > need so much - some kind of DSL service... Some kind of DSL service is indeed the background for my question. > In most cases, you have 500 - 5,000 ports in one building. If you have more, > it is unlikely that you use 3550 switches. So, it is enough for the tasks > (just as performance - it have _enough_ performance). Btw, I believed that > catalist swithes have not any limitations for the MAC tables (because they > use memory _on demand_); where did you get this limitations? /I may be wrong > here/ If you believe Catalyst switches have no MAC address limitations, I have a nice plot of land in Florida to sell you :-) Ethernet switches today use CAM to hold the MAC address tables - this CAM has a finite size. > PPS. I do not know for sure, but 3550 should support traffic shaping, which > makes bufferring. Technically, yes, CEF (with packet dropping) is not good > to provide 2 Mbit by 100 Mbit link. 3550 only supports policing. Yes, I have worked extensive with 3550 and it doesn't have the features I need right now. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

Interesting use of DNS glue records by spammers
by Suresh Ramasubramanian 26 Jan '04

26 Jan '04

Saw this elsewhere, sounds interesting enough to forward on. -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations > I just today got two spams that showed me a new spammer DNS trick (new > to me, at least). > > Rather than use fictitious domain names, I'll use the actual names from > one of the spams. The basic trick is the same either way. > > nepzzz.com is spamvertised. Its registration specifies nameservers in > nictxt.com. nictxt.com has been taken over by its registrar, > apparently for invalid contact info (and good for them). But they > didn't go quite far enough; while querying the gtld-servers.net servers > for nictxt.com returns NXDOMAIN, querying them for nepzzz.com returns > delegation NS records under nictxt.com _with glue A records_, thereby > defeating the registrar's attempted removal of the domain. > > The other spam was for ahottieiswhatiwant.com, with nameservers in > 9t5.net; the basic trick is the same. > > In each case, I sent a message suggesting that rather than just > pointing it at their own servers, they point the domain at the names > the spammers used (which require glue records) but supply glue pointing > to the registrar's server(s), thereby getting the glue the spammers > injected into the gtld-servers system replaced. > > So be careful when poking at the DNS while spamhaus-hunting. If you > query for the wrong thing you may be misled into thinking something has > been taken down when it hasn't.

1 0

Physical Layer Switches / Smart Optical Cross-Connect Panels
by Roldan, Brad 24 Jan '04

24 Jan '04

Hey Folks, I'm looking for physical layer switch that will allow me to remotely configure how two ports are cross-connected. The two main benefits would be that a site only has to be wired once and there is also a potential for a simplified disaster recovery plan (i.e. one of my boxes melts down, and I need to bring a standby online without dispatching a tech). If I could have the perfect box, it would: - Handle fiber (serial connections, ala DS3, would be a bonus) - Be protocol agnostic. I want to switch GigE and OC fiber cross-connects. I don't want GigE / POS inter-networking. - Be completely passive. If the power fails, all connections will remain active. I suppose this implies some sort of mechanical switching mechanism. - Text based CLI mandatory. Web GUI optional. - DC powered - Did I mention cheap? After Googling around this morning, it was unable to find anything that completely fits the bill. I was only able to come up with 3 vendors that come close to fitting the bill, each with their own set of pros and cons: RAM Electronics (http://www.ramelectronics.net/apcon/patchpanels.htm) MEMX (http://www.memx.com/cross%20connect.htm) MRV (http://www.mrv.com/product/MRV-FD-SFPMCC/) Anyone have experience with any of these vendors? Are there other vendors I should be looking at? Off-list replies from sales-droids welcome. (An invitation for punishment, I'm sure ;) Thanks! Brad -- +1-408-434-2048 broldan(a)covad.com

2 1

System security data about to be made public (Cobell v Norton)
by Eric Brunner-Williams in Portland Maine 24 Jan '04

24 Jan '04

The background is probably not of interest to many on NANOG, but the operational art of the Department of the Interior's network operators and security staff, and the host managers of the Indian Trust systems, which has been rated the worst in the Federal Goverment, is about to enter the public record, minus host and subnet identifiers, and any bits that "might jeopardize the security of individual Indian Trust Data". The text of the order is at this URL: http://www.indiantrust.com/_pdfs/20040121FileSMITReportsinRecord.pdf In a nutshell, its an Iraq-sized pile of thousands of individual trust accounts -- a major regional bank -- with no known audit trail, and an open access policy until quite recently. If I get the doc-u-boxen, I'll be happy to share with other NANOGers, as the DOI appears unable to move its operational art from an "F" to a "D" without assistance. Eric P.S. Triballaw list cc'd.

1 0

DRAFT agenda for NANOG 30
by Susan Harris 23 Jan '04

23 Jan '04

Greetings - here's a subject-to-change agenda for Miami: ------------------------------------------------------- NANOG 30 Agenda - 10th Anniversary Meeting ! February 8-10, 2004 Miami, Florida Sunday Tutorials ---------------- 1:30 - 3:00 p.m Customer-Triggered Real-Time Black Holes Level: Introductory Chris Morrow, UUNET; Tim Battles, AT&T 1:30 - 3:00 p.m. MPLS-Based Layer 2 VPNs Level: Intermediate Florin Balus and Mike Loomis, Nortel 3:00 - 3:30 p.m. BREAK 3:30 - 5:00 p.m. Provider-Provisioned Virtual Private Networks Level: Introductory Ina Minei, Juniper 3:30 - 5:00 p.m. MPLS Fast Reroute Level: Intermediate/Advanced Joe Soricelli, Juniper Monday, October 20 ------------------ 9:00 a.m. Welcome, Introductions Eric Aupperle, Merit Andy Burnette, Terremark Susan Harris, Merit 9:20 a.m. Implications of Recent Legislation on Provider Operations Diane Sidebottom, Dept. of Homeland Security 9:50 a.m. A Short History of the 'Net Scott Bradner, Harvard Univ. 10:30 a.m. BREAK 10:45 a.m. End-to-end, Spam, and DoS: Threats to the Model That Made the Internet Great Phil Karn, QUALCOMM 11:15 a.m. 10 Years of Corporate Change in the NANOG & IP Backbone Community Martin Levy, moderator;John Curran, XO Communication Doug Humphrey 12:00 p.m. LUNCH (on your own) 1:30 p.m. A Decade of Technology Pitfalls and Successes Dino Farinacci, Procket 2:00 p.m. Where Did the NAPs Come From and When Did They Turn Into Exchange Points? Steve Feldman, CNET 2:20 p.m. Anniversary Retrospective: Where We've Been & Where We're Headed Sue Hares, NextHop, Moderator Paul Francis, Cornell Univ. Steve Bellovin, AT&T Research Dino Farinacci, Procket 3:00 p.m. BREAK 4:20 p.m. Research Forum -------------- - Achievable Comprehensive Delay Reporting from Routers - Synchronising Software Clocks on the Internet Darryl Veitch, Sprintlabs - A Distributed Control Plane Architecture to Support Millisecond Routing Convergence Hormuzd Khosravi, Intel - IETF NETCONF Working Group Update Eliot Lear, Cisco - Nemecis: A Tool to Analyze the IRR Registries Georgos Siganos, UC Riverside - In-Progress Research Designing Support for Troubleshooting Complex Network Problems Barbara Mirel, Univ. of Mich. Monday Evening BOFs & Key Signing --------------------------------- 7:30 - 9:00 p.m. ISP Security and NSP-SEC BOF IV Barry Raveendran Greene, Cisco, moderator 9:00 - 10:30 p.m. Peering BOF VII Bill Norton, Equinix, moderator 9:00 - 10:30 p.m. Troubleshooting the Hardest Network Engineering Problems Barbara Mirel, Univ. of Michigan, moderator 9:00 p.m. PGP Key Signing Party Majdi Abbas, Lattice Networks, moderator Tuesday, October 21 ------------------- 9:00 a.m. Listen and Whisper: Security Mechanisms for BGP L. Subramanian, V. Roth, I. Stoica, S. Shenker, and R.H. Katz, UC Berkeley 9:20 a.m. Making Sense of BGP Tina Wong, Van Jacobson, Cengiz Alaettinoglu, Packet Design 9:50 a.m. Hot Potatoes Heat Up BGP Routing Renata Teixeira, UCSD; Jennifer Rexford, AT&T; Tim Griffen, Intel 10:20 a.m. BREAK 10:40 a.m. MPLS Over Various IP Encapsulations Mark Townsley, Cisco 11:10 a.m. IAB Concerns About Permanent Deployment of Edge-Based Filtering Itojun Hagino, IETF Internet Architecture Board 11:25 a.m. Regional Internet Registries Statistics and Activities Ray Plazk, ARIN 11:45 a.m. How to Kill Worms and Viruses with Policy Pontifications Scott Bradner, Harvard 12:00 p.m. LUNCH (on your own) 1:30 p.m. Real-time Global Routing Metrics Jim Cowie, Andy T. Ogielski, B.J. Premore, Eric A. Smith, & Todd Underwood, Renesys 1:50 p.m. Root Cause Analysis of Internet Routing Dynamics Matthew C. Caesar, L. Subramanian, Randy H. Katz, UC Berkeley 2:10 p.m. Airborne Contagion: Effects of a Worm on Wireless Networking Christopher Chin, UC Berkeley 2:30 p.m. Life on a University Network: An Architecture for Automatically Detecting, Isolating, and Cleaning Infected Hosts Eric Gauthier, Boston University 2:50 p.m. Analysis of the DDoS Attack Against SCO David Moore and Colleen Shannon, CAIDA 3:10 p.m. BREAK 3:30 p.m. BGP Testing: Why Be so Negative? Brent Imhoff, Wiltel; Scott Poretsky, Quarry 3:50 p.m. Exchange Point Update Celeste Anderson, USC LAAP, moderator Jay Adelson, Equinix Tom Bechly, MAE Services Itojun Hagino, DIX-IE Mike Hughes, LINX Christopher Quesada, Switch and Data Akio Sugeno, NYIIX/LAIIX 4:50 p.m. Adjourn Susan Harris, Merit

1 0

Re: network mapping and data viz.
by sgorman1＠gmu.edu 23 Jan '04

23 Jan '04

A useful set of references and links can be found here: http://www.cybergeography.org/mapping.html ----- Original Message ----- From: Chris Horry <zerbey(a)wibble.co.uk> Date: Friday, January 23, 2004 11:42 am Subject: Re: network mapping and data viz. > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Jamie Reid wrote: > | I have been looking for a tool that will visualize traceroute > data in > | a graph. Skitter looks ideal, but its availability is quite limited. > | > | I have tried Netmap (netmap.sourceforge.net) and have been > | mucking about with Graphviz (graphviz.org) in general. > | However, the problem of building a map from traceroute data > | (with graphviz anyway) is sorting out the unique paths. Technically > | possible, but I don't want to re-invent the wheel if I don't > have to. > | > | Tulip (tulip-software.org) is a framework that something like this > | could be written in, as is any other viz tool (opendx.org, etc...) > | The tools from Opte (opte.org) aren't available yet. > | > | Is there a tool that you are currently using to represent large > | traceroute graphs that is available under a gpl/bsd/open license? > | Even something based on Dot or Neato? > > You might want to try VisualRoute, www.visualroute.com. > > Chris > > - -- > Chris Horry "Winter is the season in which people > zerbey(a)wibble.co.uk try to keep the house as warm as it was > PGP: DSA/2B4C654E it was in the summer, when they complained > Amateur Radio: KG4TSM about the heat" --Author Unknown > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.4 (MingW32) > Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org > > iD8DBQFAEU7mnAAeGCtMZU4RAp+eAJ974r5L20XoIeJAr/FakiyAhuYzxACff9pZ > 2v8ZJOy1g8c0kBF8+8gwwUI= > =43qW > -----END PGP SIGNATURE----- > >

1 0

network mapping and data viz.
by Jamie Reid 23 Jan '04

23 Jan '04

I have been looking for a tool that will visualize traceroute data in a graph. Skitter looks ideal, but its availability is quite limited. I have tried Netmap (netmap.sourceforge.net) and have been mucking about with Graphviz (graphviz.org) in general. However, the problem of building a map from traceroute data (with graphviz anyway) is sorting out the unique paths. Technically possible, but I don't want to re-invent the wheel if I don't have to. Tulip (tulip-software.org) is a framework that something like this could be written in, as is any other viz tool (opendx.org, etc...) The tools from Opte (opte.org) aren't available yet. Is there a tool that you are currently using to represent large traceroute graphs that is available under a gpl/bsd/open license? Even something based on Dot or Neato? Thanks, -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324

3 2