- NANOG - lists.nanog.org

Re: Distributed sniffer products
by Greg Maxwell 04 Sep '03

04 Sep '03

> Does anyone have a *GOOD* screenrc example config? I was VERY confused by > the info file. > (OT, I know, but...) Here is one we find useful for monitoring the behavior of a firewall: split split screen -t desktop 0 tcpdump -ni desktop not port 22 focus screen -t external 1 tcpdump -ni external not port 22 focus screen -t server 2 tcpdump -ni server not port 22

1 0

AOL people on list?
by Drew Weaver 04 Sep '03

04 Sep '03

Contact me off-list please. -Drew

1 0

AT&T NYC
by Bryan Heitman 04 Sep '03

04 Sep '03

Anyone seeing any problems with ATT in new york? Best regards, Bryan Heitman Interland, Inc.

10 11

On the back of other 'security' posts....
by Matthew Sullivan 03 Sep '03

03 Sep '03

Hi All, On the back of the latest round of security related posts, anyone notice the 50% packet loss (as reported to me) across the USA -> NZ links around lunchtime (GMT+10) today? Yet more spoofed traffic aimed at the SORBS nameservers - this time enough to crash a core router of my upstream... Hopefully the commercial damage now may insite people getting damaged by these DDoSes to start proceedings against those ISPs whom continue to show a lack of respobsibility and allow unfiltered spoofed DDoS traffic from their networks. Certainly I have been told to talk to various US authorities about the problem, and will be doing so as soon as I have the nessesary information. In the mean time a plea to people on this list in all countries - watch for the DDoS attacks (particually against 203.15.51.33, 203.15.51.35, 203.15.51.44 & 203.101.254.254) and stop the damn traffic before you are held responsible for your customers actions. There is still a 10k pps SYN flood occuring 8 hours later - this is being rate limited upstream. ..and if the perps are on this list, keep going if you want, the more you do the more likely you'll get caught. You will not force SORBS off the net like you have Osirusoft. I and SORBS will leave when we are good and ready, and not because of some infantile spotty faced 15 year old nerd without a clue on life. / Mat

14 22

RE: Distributed sniffer products
by Braun, Mike 03 Sep '03

03 Sep '03

We've been playing with Wildpackets http://www.wildpackets.com/. They sniff LAN to Gig and some WAN as well. The Distributed model is still vaporware, but is said to be out soon. The expert analysis is comparable if not better than NAI. Mike Braun -----Original Message----- From: Brennan_Murphy(a)NAI.com [mailto:Brennan_Murphy@NAI.com] Sent: Wednesday, September 03, 2003 1:02 PM To: owen(a)delong.com; JAustad(a)temgweb.com; nanog(a)merit.edu Subject: RE: Distributed sniffer products The cost benefit analysis on Ethereal/etc vs Sniffer on anything but the smallest of networks is usually very easy to make. The fundamental issue is what questions do you have and should you have about your network and what tool answers those questions efficiently and reliably. Good protocol analyzers sell because they save time in answering important questions. Sniffer recently released a SMB Sniffer called Netasyst...worth a look if cost has been an issue in the past. So ends this biased response. :-) -----Original Message----- From: Owen DeLong [mailto:owen@delong.com] Sent: Wednesday, September 03, 2003 2:50 PM To: Austad, Jay; 'nanog(a)merit.edu' Subject: Re: Distributed sniffer products Etherial and other libpcap tools work reasonably well, can be easily deployed using commodity hardware, and would cost you a lot less than NetAssoc. Owen --On Wednesday, September 3, 2003 1:07 PM -0500 "Austad, Jay" <JAustad(a)temgweb.com> wrote: > > Anyone have any experience with these? I'm looking for something > similar to Network Associates Sniffer product. > > Are there any open source projects that are decent? What are others > using? > > ---------------- > Jay Austad > Senior Network Analyst > Travelers Express / MoneyGram > e: jaustad(a)temgweb.com p: 952.591.3779

1 0

RE: Distributed sniffer products
by Brennan_Murphy＠NAI.com 03 Sep '03

03 Sep '03

The cost benefit analysis on Ethereal/etc vs Sniffer on anything but the smallest of networks is usually very easy to make. The fundamental issue is what questions do you have and should you have about your network and what tool answers those questions efficiently and reliably. Good protocol analyzers sell because they save time in answering important questions. Sniffer recently released a SMB Sniffer called Netasyst...worth a look if cost has been an issue in the past. So ends this biased response. :-) -----Original Message----- From: Owen DeLong [mailto:owen@delong.com] Sent: Wednesday, September 03, 2003 2:50 PM To: Austad, Jay; 'nanog(a)merit.edu' Subject: Re: Distributed sniffer products Etherial and other libpcap tools work reasonably well, can be easily deployed using commodity hardware, and would cost you a lot less than NetAssoc. Owen --On Wednesday, September 3, 2003 1:07 PM -0500 "Austad, Jay" <JAustad(a)temgweb.com> wrote: > > Anyone have any experience with these? I'm looking for something > similar to Network Associates Sniffer product. > > Are there any open source projects that are decent? What are others > using? > > ---------------- > Jay Austad > Senior Network Analyst > Travelers Express / MoneyGram > e: jaustad(a)temgweb.com p: 952.591.3779

1 0

Cisco Service Provider code - Any good?
by Jason Frisvold 03 Sep '03

03 Sep '03

All, It was requested that I post this email to the Nanog list as the person in question does not have posting ability... :) Hello All, We're currently looking into migrating our Cisco 72xx and 75xx routers to Service Provider IOS and I was wondering if anyone has had any good luck with a certain version? We've seen that 12.0(25)S1 seems to be an ok version but I have also heard some gripes about it. The PAs that we run in most of the units are the following: ATM-OC3-MM ATM-OC12-MM FastE GigE The IOS would also have to support RFC-1483 connections (Preferrably RBE), BGP, IS-IS and any other basic services of the such. Thanks in advance… -- --------------------------- Jason H. Frisvold Backbone Engineering Supervisor Penteledata Engineering friz(a)corp.ptd.net RedHat Engineer - RHCE # 807302349405893 Cisco Certified - CCNA # CSCO10151622 MySQL Core Certified - ID# 205982910 --------------------------- "Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world." -- Albert Einstein [1879-1955]

2 2

Automatic shutdown of infected network connections
by Sean Donelan 03 Sep '03

03 Sep '03

Some universities such as Vanderbilt University are automatically shutting down network ports when they detected signature worm traffic. Almost 25% of the students' computers were detected as infected when they connected to the university network. http://www.vanderbilthustler.com/vnews/display.v/ART/2003/08/29/3f4eb4b3537… How many ISPs disconnect infected computers from the network? Do you leave them connected because they are paying customers, and how else could they download the patch from microsoft?

9 12

Re: Automatic shutdown of infected network connections
by Omachonu Ogali 03 Sep '03

03 Sep '03

On Wed, Sep 03, 2003 at 10:55:47AM -0400, bscott(a)ntisys.com wrote: > On Wed, 3 Sep 2003, at 10:41am, nanog(a)missnglnk.com wrote: > > And if you just bought a new system, it should have the big update (SP2) > > installed on the machine already ... > > Service Pack 2 for Windows XP has not been released yet. Weird, when I go to Add/Remove programs, I see "(SP2)" next to the hotfixes I applied, from that I assumed SP2 was out or something. > As of 1 Sep 2003, there are 21 post-SP1 security-related hotfixes posted > for Windows XP. The total download size is quite large, if you are on a 56 > kilobit modem. Most of my updates were done on this same modem, and if I recall correctly, most of them varied in size from 300KB to 2MB. Then again, I haven't done a fresh XP install ever since I installed it on this laptop so I don't know how big the initial lump is right now. > > ... unless you're dealing with an incompetent PC > > manufacturer/reseller/whatever that likes to cut corners ... > > Like, say, most of them? Eek. :( Hate to rehash the responsibility debate...but shouldn't the manufacturers/whatever slap the latest service packs on their products that they're selling? If GM puts out a recall on their vehicles for a GE lamp. Yeah, I'm sure GE takes the blame and a hit to their stock, but the dealers go to GM (the aggregator) for the replacement and fix the vehicles they have on the lot before another one gets sold, right? Subtract one level of hierarchy (the dealer, or you could leave it in, since most system builders are rolling out their own stores...Apple, Dell, Gateway, etc.) and you have the common relationship of Microsoft-OEM-End User. Shouldn't the OEM be responsible for any product coming off their shelf that's been "recalled" up until the point of the "recall"?

3 2

NANOG 29 (Chicago) Meeting Information
by Carol Wadsworth 03 Sep '03

03 Sep '03

Registration is now open for NANOG 29, October 19-21, in Chicago. The meeting will be hosted by Server Central. Call for Presentations (submit by September 8): http://www.nanog.org/mtg-0310/call29.html Additional meeting information: http://www.nanog.org Of special note, vendor sponsors can now display equipment during the continental breakfasts and afternoon breaks. Vendor sponsor information: http://www.nanog.org/vendor.html See you there!

1 0