- NANOG - lists.nanog.org

Re: [Re: Bin Laden Associate Warns of Cyberattack]
by Joshua Smith 19 Nov '02

19 Nov '02

and millions of others hacking at everything else.......sounds like fear mongering to me - guess we will probably be seeing a 'new' cyber security bill soon Dan Hollis <goemon(a)anime.net> wrote: > > On Mon, 18 Nov 2002 sgorman1(a)gmu.edu wrote: > > Might be of interest: > > http://www.computerworld.com/securitytopics/security/story/0,10801,76000,00… > > "There are millions of Muslims around the world involved in hacking the > Pentagon and Israeli government sites," said Bakri." > > Uh huh. > > -Dan > -- > [-] Omae no subete no kichi wa ore no mono da. [-] > "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

Re: some of these are worse than others
by Paul Vixie 18 Nov '02

18 Nov '02

> Which signature database you use to match these or just log the 404's ? i wrote my own. since it's only 247 lines long, i'll include it here. /* httpk - killer of http requests * vixie 05aug01 [from netperf 14jan92 [original]] * * $Id: httpk.c,v 1.5 2002/11/18 21:33:33 vixie Exp $ */ #include <setjmp.h> #include <stdio.h> #include <stdlib.h> #include <signal.h> #include <sys/errno.h> #include <sys/fcntl.h> #include <sys/mman.h> #include <sys/stat.h> #include <sys/time.h> #include "inetlib.h" #include <arpa/inet.h> extern int optind, opterr; extern char *optarg; static char *host = "localhost"; static char *serv = "http"; jmp_buf timedout; static int timelim; struct { char *base; size_t size; } content; static int sndbuf = 16*1024; static void setcontent(const char *); static void httpk(const char *, const char *); static void timeout(int); #define outc(Ch) \ if (isascii(Ch) && (isprint(Ch) || Ch == '\n')) \ putchar(Ch); \ else \ printf("\\%03o", (u_char)Ch) static void usage(const char *msg) { fprintf(stderr, "usage error: %s\n", msg); fprintf(stderr, "usage:\thttpk\t[-h host] [-s serv] [-t timelim] [-f file] [-l]\n"); exit(1); } main(int argc, char **argv) { int c; while (EOF != (c = getopt(argc, argv, "h:s:t:f:l"))) { switch (c) { case 'h': host = optarg; break; case 's': serv = optarg; break; case 't': timelim = atoi(optarg); break; case 'f': setcontent(optarg); break; case 'l': setlinebuf(stdout); break; default: usage("unknown option"); } } httpk(host, serv); } static void setcontent(const char *filename) { struct stat sb; int fd; char *cp; if ((fd = open(filename, O_RDONLY)) < 0) { perror(filename); exit(1); } if (fstat(fd, &sb) < 0) { perror("fstat"); exit(1); } content.size = sb.st_size; content.base = mmap(NULL, content.size, PROT_READ, 0, fd, 0); if (content.base == NULL) { perror("mmap"); exit(1); } } static void httpk(const char *host, const char *serv) { void *sockaddr; int server, client, i, tsize, rsize; long rtt; struct sockaddr_in sa; socklen_t sa_len; struct timeval whenrcvd; struct pkt *rbuf, *tbuf; sockaddr = InetSockAddr(host, serv, "tcp"); if (!sockaddr) { perror("InetSockAddr"); exit(1); } server = TcpServer(sockaddr, 0); if (server < 0) { perror("TcpServer"); exit(1); } signal(SIGALRM, timeout); loop: sa_len = sizeof sa; client = accept(server, (struct sockaddr *)&sa, &sa_len); if (client < 0) { if (errno == ECONNABORTED) goto loop; } else { struct sockaddr_in me; socklen_t me_len; char ch, lch; time_t now; FILE *fp; int n, l; me_len = sizeof me; if (getsockname(client, (struct sockaddr *)&me, &me_len) < 0) { perror("getsockname"); exit(1); } now = time(0); printf("src [%s].%u; ", inet_ntoa(sa.sin_addr), ntohs(sa.sin_port)); printf("dst [%s].%u; ", inet_ntoa(me.sin_addr), ntohs(me.sin_port)); printf("%s", ctime(&now)); fp = fdopen(client, "r+"); if (!fp) { perror("fdopen"); close(client); exit(1); } if (setjmp(timedout) != 0) { printf("*TIMEOUT*\n\n"); } else { enum { out, in, num } state; int conlen_p = 0; u_long conlen; if (timelim != 0) alarm(timelim); while (ch = getc(fp), !feof(fp)) { n = 0; state = in; do { if (isascii(ch) && isupper(ch)) lch = tolower(ch); else lch = ch; if (state == in) if (lch=="content-length:"[n]){ if (lch == ':') { state = num; conlen = 0; conlen_p = 0; } } else state = out; else if (state == num) { if (!isascii(ch)) ; else if (!conlen_p && isspace(ch)) ; else if (isdigit(ch)) { conlen *= 10; conlen += (ch - '0'); conlen_p = 1; } else state = out; } if (ch == '\n') break; if (ch != '\r') { outc(ch); n++; } } while (ch = getc(fp), !feof(fp)); if (n == 0) break; putchar('\n'); } if (conlen_p) { putchar('+'); putchar('\n'); n = 0; while (n < conlen && (ch = getc(fp), !feof(fp))) { outc(ch); n++; } if (n > 0 && ch != '\n') putchar('\n'); } putchar('\n'); if (timelim != 0) alarm(0); } shutdown(client, SHUT_RD); setsockopt(client, 6, SO_SNDBUF, &sndbuf, sizeof sndbuf); fcntl(client, F_SETFL, fcntl(client, F_GETFL) | O_NONBLOCK); if (content.base != NULL && content.size != 0) { fprintf(fp, "HTTP/1.1 404 %s\r\n", "You are digging in the wrong place"); fprintf(fp, "Connection: close\r\n"); fprintf(fp, "Content-Length: %d\r\n", content.size); fprintf(fp, "Content-Type: text/html\r\n"); fputs("\r\n", fp); fflush(fp); writev(client, &content, 1); } else { fputs("HTTP/1.1 204 Zilch\r\n", fp); fputs("Connection: close\r\n", fp); fputs("Content-Length: 0\r\n", fp); fputs("\r\n", fp); } fclose(fp); goto loop; } perror("accept"); signal(SIGALRM, SIG_DFL); } static void timeout(int foo) { longjmp(timedout, 1); }

1 0

Re: [Re: PAIX]
by Joshua Smith 18 Nov '02

18 Nov '02

for my voip network/peers, i can withstand rtt's of around 600ms - granted the quality sucks at that sort of latency, but data/ip routes into some of the less-than-developed places in the world are crap at best, and any phone is better than none Jared Mauch <jared(a)puck.Nether.net> wrote: > > On Mon, Nov 18, 2002 at 10:13:48AM -0800, Jere Retzer wrote: > > > > > > Stephen Sprunk wrote: > > > > >>>Any point in the US is within 25ms RTT (or less) of a major exchange; eliminating this 25ms of latency will have no effect on VoIP unless you're already near the 250ms RTT limit for other reasons.<<< > > > > > > 25 MS is assuming that the only delay is due to the speed of light. Add equipment, especially routers or other gear that requires manipulating packets and the delays add up quickly. I once read that the most people wil tolerate on a regular basis is around 150-180 ms. I think that is much too high for regular use > > True. > > As far as VoIP goes, take 2 (digital/pcs/gsm/whatnot) cell phones > (preferably on different carriers, or even the same if you want to see it) > and call the other phone. Check out the delay in there. People who > think that VoIP needs low delay don't realize the [presumably compression > and other dsp related] delays introduced that people will be able to > withstand. > > - jared > > -- > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > clue++; | http://puck.nether.net/~jared/ My statements are only mine. "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

Re: PAIX
by Jere Retzer 18 Nov '02

18 Nov '02

Vadim Antonov wrote: >>>People are doing various kinds of video over Internet 1; works fine.<<< Then I must be doing it all wrong because I've never had much luck. Maybe it is a function of the origin and destination location + network. Since Portland is not a top 25 market our service has never been very good ― that's why we started an exchange

5 4

Re: PAIX
by Jere Retzer 18 Nov '02

18 Nov '02

Some thoughts: - Coast-to-coast "guaranteed latency" seems too low in most cases that I've seen. Not calling CEOs and marketers liars but the real world doesn't seem to do as well as the promises. As VOIP takes off "local" IP exchanges will continue/increase in importance because people won't tolerate high latency. What percentage of your phone calls are local? - Yes, we do various kinds of video over Internet2. Guess what? Packet loss is very important. Fewer hops mean fewer lost packets. Local exchanges, if there were lots of them with lots of peering reduces the theoretical number of hops. Who will most of the videoconferences involve in the future ― I think mostly people who see each other face-to-face periodically. Leading this are telework and telemed. Broadband is getting to the point that people will want to call up their doc/clinic rather than jump in the car just to be told to go home and go to bed, and get exposed to someone who has a contagious disease. Nursing homes, assisted living facilities, emergency rooms in mall towns should be key targets for this technology. - While we're on the topic of local video, what happens when television migrates to IP networks? Seems like the "local" news should want to originate somewhere close. Most of our local TV and radio stations are part of chain today and their corporate headquarters have decided to host their web site at a central location without even worrying about Akamai or other local caching. - Unfortunately, these applications do not work with today's local broadband networks ― one reason being the lack of local interconnection. People have quit believing the Radio Shack ads. We have the technology to make these applications work if we'd stop arguing that no one wants to use them. Of course no one wants to use them ― they know they won't work! >>> David Diaz <techlist(a)smoton.net> 11/14/02 05:52PM >>> Voice of reason... The only possible reason I can think of is if these data networks replace the present voice infrastructure. Think about it, if we really all do replace our phones with some video screen like in the movies, then yes, most of those calls stay local within the cities. Mom calling son etc etc So we can think of these "peering centers" as replacements for the 5-10 COs in most average cities. Otherwise what apps require such dense peering. At 14:44 -0800 11/14/02, Vadim Antonov wrote: >On Thu, 14 Nov 2002, David Diaz wrote: > >> 2) There is a lack of a killer app requiring peering every 100 sq Km. > >Peering every 100 sq km is absolutely infeasible. Just think of the >number of alternative paths routing algorithms wil lhave to consider. > >Anything like that would require serious redesign of Internet's routing >architecture. > >--vadim

17 31

Re: [RE: free network monitoring/management tools]
by Joshua Smith 18 Nov '02

18 Nov '02

wayne, i actually already had that link, and had gone through the archives, but was looking for some 'reviews' of different products (if i wasn't clear on that point, please accept my apologies) - i have gotten some great info and recommendations thus far (thank you to everyone). i will do a write-up when i get some testing done later this week joshua "Gustavus, Wayne" <wgustavus(a)gnilink.net> wrote: > Joshua, > > Hate to give the std answer, but I suggest a review of the archives over the > past 2 months--this thread was just recently re-hashed. Also, there was a > presentation on "Managing IP Networks with Free Software" at NANOG 26. > Check it out here: > > http://www.nanog.org/mtg-0210/ppt/stephen.pdf > > -Wayne > > > -----Original Message----- > From: Joshua Smith [mailto:joshua.ej.smith@usa.net] > Sent: Wednesday, November 13, 2002 10:56 AM > To: nanog(a)merit.edu > Subject: free network monitoring/management tools > > > > hello to all, > > i would appreciate your your knowledge and experiences regarding freely > available tools for network monitoring and management (all cisco now, some > other stuff later). i would prefer free tools as i have no budget :) > > i am looking for the following (it will be running on either freebsd or > redhat): > > AAA - i have been trying to find a tacacs+ daemon/program that doesn't > require me to also learn *sql to set up the backend database (if this is > the only choice, then i can learn it) > > config monitoring/management - rancid or rtrmon are the two that i have > found. any preferences on one over the other in terms of ease of use, > ability to modify/improve, efficiency, etc? > > network/syslog monitoring - some of the likely candidates i have found are > nagios or netsaint, jffnms, nmis, opennms, or maybe snip (formerly nocol) > - i need something that is fairly easy to setup and use, and it doesn't > have to do a whole lot (just some basic notifications for now). decent > documentation is also necessary, and a pretty map would be nice for my > noc, but this isn't a prereq. > > my scripting/programming skills are rudimentary, so it would be ideal if > it was at least partially plug-and-play (i know i know, sorry). i would > appreciate any input (i am still reading through the archives for useful > tidbits), and i, of course, will gladly summarize for the list. > > thanks in advance > > joshua > > > "Walk with me through the Universe, > And along the way see how all of us are Connected. > Feast the eyes of your Soul, > On the Love that abounds. > In all places at once, seemingly endless, > Like your own existence." > - Stephen Hawking - "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

Re: PAIX
by Jere Retzer 18 Nov '02

18 Nov '02

David Diaz >>> Actually the way it seems to work is head over to the local server, and the radiologist goes through several patients at a time, taking not of any notations the techie made on the film. I do not think most are emergencies or code blues, just someone coming in with a pain etc. 5min probably wont make a difference. If they are really showing those kind of problems then of course the doctor is called in from home by the attending. Still for remote clinics etc, it's a powerful resource. Maybe for second opinions when something isnt clear when surgery is needed immediately or not. I also know that certain places do not have good health care like indian reservations say in Alaska. This way an expert can really help even if not local. The internet.... it's not just for spam anymore.... ;-)<<< In Internet2, we're starting to see the Internet used for real time distributed "tumor board" meetings. The way this works, you have some oncologists (cancer specialists) and radiologist, and the attending physicians for some cancer patients. The group consults on the appropriate treatment program for the patients. Using the Internet, it is possible to bring some pretty heavy expertise to the discussion, which is important for smaller communities that do not have access to these experts.

1 0

Re: PAIX
by Jere Retzer 18 Nov '02

18 Nov '02

David Diaz >>> I just asked, and "you can video clip images,...85megs is typical" At 12:46 -0500 11/18/02, David Lesher wrote: >Any idea how large these images are? I seem to recall that >they are massive, given ultra-hi-rez data.... > >(Are they attaching them to lookOut mail ;-?) > >And the radiologist may look for a few seconds at best so he >is NOT going to want to wait.... Try asking any radiologist, cardiologist, oncologist how much quality is good enough and they will probably say "it depends." Digital mammography is potentially hundreds of megabytes ― and you sure don't want to miss (or insert any extra) white spots! What we're seeing is higher and higher resolution combined with "longitudinal" (ie, over time) recording and in some cases additional 'dimensions' added using color and so on, and on top of that the ability to look at various depths, rotate, three spatial dimensions. So, for example a live echocardiogram today will use color as an indication of the "force" of the heart beat. MRIs typically record data at three dimensions. As we approach micron-level resolution the file size grows into the petabytes. No, I did not make a mistake there. Currently, no one even stores these but they will want to in time. Given our demands for instant feedback on our health these kinds of applications will eventually become more real time. One internationally recognized teaching hospital in the upper midwest advertises that all their x-rays are read by a radiologist within 30 minutes.

1 0

Internet Software Consortium expands DNS ''Root Server'' Footprint
by Paul Vixie 18 Nov '02

18 Nov '02

http://www.businesswire.com/cgi-bin/f_headline.cgi?day0/223210010&ticker=

3 2

Re: PAIX
by Jere Retzer 18 Nov '02

18 Nov '02

David Diaz replied to my comments Concerning latency >>>Well the bingo latency number used a lot in voice is 50ms. Im simplifing without getting into all the details, but that's an important number. As far as VoIP goes, I think higher latency is ok, it's more important to have "consistent" latency. Fluctuating latency really affects VoIP more then a higher consistent latency. There are a lot of people doing VoIP and traditional voice on satellites and the latency there is huge.<< Here's an example. Without naming networks, I recently subscribed to DSL at the Oregon coast because the local phone company, which is also a national network provider advertised that they use a particular ISP, who we have in the NWAX exchange in Portland. I thought, well I should be able to get a good connection back to Oregon Health and Sciences University (OHSU), and if so this will be a good path for the physicians in that coastal community who have wanted to particpate in our grand rounds and other continuing medical education programs. They also have wanted to let the public participate in our "healthy chats" program. These events are live and interactive. So, I was very optimistic and set up my connection. I was shocked to learn, however that the DSL provider routes all the bits from that location to Dallas/Fort Worth, Texas before letting them find their way to their eventual destination. Rather than a nice direct route to OHSU, the route was 19 hops via Texas and Silicon Valley (Palo Alto and San Francisco) before getting to Portland. The average latency, which I duplicated consistently with multiple destinations in the Portland area is 180 msec and I have seen packet loss hitting 30% every minute or two. There is absolutely no way that this connection would be able to handle an interactive application. Yes, people have tolerated 500 msec latency on satellite links ― but only because they really had no choice. Dave Diaz continued >>>Fewer hops = less packet loss? There has been a lot of discussion on the list about that. I still dont see it although it does push latency up a bit. Truth is that there are a lot of tunnels or express routes build in, so we arent seeing all the hops nowadays. I think that's more for sales and marketing as people keep judging networks by hops in a traceroute.<<< See above. Partly, I think it is just the odds of encountering congestion goes up exponentially with the number of hops. No engineering reason other than if you have 5% likelihood of hitting congestion on any one hop and then you have 19 your odds of hitting congestion are much higher. Combine that with a persistent connection for an interactive video session and you will find, as I did that every couple minutes you have a spike that causes fits with your video. Dave Diaz continued >>>An IP backbone is a bad place for live TV. Delayed or on demand tv yes. Live tv plays to the benefits of One to Many broadcast ability of satellite as Doug Humphrey will tell you. So a feed from a DSS dish into your local cache would work well. It still can be done at a per city peering point to better feed the broadband users. <<< If we fix the IP backbones for interactive TV then broadcast should be a piece of cake. While I agree with a later post that questioned convergence for the sake of convergence, the benefits of IP+Ethernet are that it is an order of magnitude cheaper and you eliminate the need for any local "head end" equipment, manipulation by local stations, etc, etc. Ultimately, the only stuff that will originate locally is local news and content. Jere

1 0