- NANOG - lists.nanog.org

NMS/OSS commercial software : short summary from NANOG replies - here it is
by m.rapoport＠completel.fr 30 Oct '02

30 Oct '02

Sorry for my previous mail that was sent empty, due to a mouse clicking bug ;-) So, at last, here is the summary of the answers, plus additional information resulting from meetings I had with some vendors in the last days : First of all, one contributor emphazises on the fact that focusing on people and process is at least as important as on the tools used for NMS. Now the products : - Infovista : According to someone (Hi Mike,see you on rs-sp ;-) ), the product is considered to be flexible to build SLA reporting package, and very customizable to specific needs. According to another one: "Our NOC uses it and it just is not useful in any way, it usually is not common sense, the implementation is not straight- forward, it is awkward, and makes shortcuts that shall not be made". no comments .... >From a meeting I had with Infovista recently, my personal feelings are a mix of both opinions : It is surely a powerful tool, very customizable and scalable, but quite complex and heavy to deploy, and it costs a fortune (multiple hundreds of K$, not to say more). - Concord : >From one contributor :"horrible in multi-vendor environments" I have briefly met a Concord integrator, the product seems quite straight and simple to deploy, but very limited in terms of customization (all changes require C developpment). - Proviso : I have met the people from Quallaby today, the product looks both simple to install and powerful in terms flexibility and scalability. It might be a good product for perfs monitoring and customer SLA reports, but I had some rumors of possible bankrupcy of Quallaby ... I need to check more about it. - Netcool : seems to be quite a reference on the market, I only had good but not detailed opinions on it. - Cisco Works: not recommended by some people, or to be used for Natkit, which requires the NSA (Network supported account) level of support from Cisco (which is not cheap at all ;-). Quite an interesting doc recommended on NOC topics in general : http://www.cisco.com/networkers/nw02/presos/pws/docs/PS-510.pdf Other products that have been recommended by people on the list : - Smarts : http://www.smarts.com/ . The product looks interesting, and it was recommended by several persons on the list. Regarding my personal needs, I am not sure how well it is supported in Europe, and especially in France .... - LINMOR : www.linmor.com : a Canadian product. >From the contributor :"They are the prefered vendor for both Cisco & Micromuse when it comes to performance management" I might have the same problem that with Smarts in terms of finding here a reseller and appropriate support ... - SpiderMon, from Pathway Communication (a Canadian ISP reselling its in house NM tool) : It seems to be an all-in-1 product covering the whole FCAPS range. I can give more details on the product for person requesting it. An interesting article comparing Spectrum, Patrol, Netcool, and Smarts : http://www.networkcomputing.com/1316/1316f2.html All comments welcomed. ________________________ Marc Rapoport Architecture Dpt Completel tel : +33 1 72 92 25 38 fax: +33 6 09 76 56 79 m.rapoport(a)completel.fr ________________________

1 0

tiscali please:)
by Scott Granados 30 Oct '02

30 Oct '02

Can someone with Tiscali write to me off list concerning as9105.net Thanks Scott

1 0

Lame reports - thanks!
by Rob Thomas 30 Oct '02

30 Oct '02

Hi, NANOGers. My thanks to the increasing number of you who submit lame delegation logs to me. This helps to increase the reach and usefulness of the Weekly Lame Name Server Report page: http://www.cymru.com/DNS/lame.html If you have logs you can share, anonymously or with full credit, feel free to send them to lamer(a)cymru.com. Be the first on your block to fill my lamer file system. :) Thanks! Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

IANA IPv4 allocation list format change
by Rob Thomas 30 Oct '02

30 Oct '02

Hi, NANOGers. For those of you who don't know, the format of the IANA IPv4 allocation list has changed. It now lists each prefix as a distinct /8, instead of hyphenated ranges of prefixes. This change took place on 25 October. If you are parsing this file automagically, you may wish to modify your scripts. My own script claimed that several new allocations had been made. It's fixed now. :) http://www.iana.org/assignments/ipv4-address-space My thanks to the IANA folks for this change! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

Re: ICANN Targets DDoS Attacks
by Jared Mauch 30 Oct '02

30 Oct '02

On Tue, Oct 29, 2002 at 06:00:06PM -0500, Ken Chase wrote: > On Tue, Oct 29, 2002 at 04:11:49PM -0500, Jared Mauch's all... > > > Once again, i'd like to see (other than a performance > > checking customer) generate more than 2Mb/s of icmp.echo and icmp.echo-reply > > packets that are legit and not part of a DoS. This is quite rare. > > little blip in the internet, and all your intelligent customers running > linux use their leet tools to figure out whats wrong. They all run > mtr vs their preferred sites. Mtr generates one ICMP packet (~80 bytes?) > of traffic PER hop in the trace. A route of 20+ hops, means 1600 bytes/s > per customer (thats 12.8Kbps). 150 customers later you got 2Mbps of > traffic (2Mb/s is 2 megaBIT per second right? you didnt mean 2 mega BYTES > per second? in which case *8). > > Is 150 customers a large number? > > And there are lots of nice graphical traceroute tools for windoze as well > of course, dont know their packet load in full operation however. > > Silly me, sometimes I leave mtrs running. I've found 2-3 going all at > once at times. <slap!/> > > Why is ICMP rate limiting on ECHO and ECHO reply going to stop all DOS > attacks? What are they going to do about UDP floods? (Are they proposing I don't recall saying it will stop all DoS attacks. It will help minimize them. Please discontinue imagination. You obviously don't understand how traceroute works by sending udp packets and getting icmp ttl expired messages back which are not icmp {echo,echo-reply}. Come back when you do understand how it works. /sigh > that DDOS attacks are all smurf based? They've just found a solution to 1996's > problems? Amazing!) They're not, but there is still a large amount of things that just do ping -f <10.2.3.4> and similar types of attacks. If you know what your usual patterns are, it's easy to notice what is out of place. > [ hopefully this post makes it to nanog. my posts've been going to /dev/null > with previous attempts ] > > /kc > > > > > Do your own stats and test your hardware. > > > > - jared > > > > -- > > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > > -- > Ken Chase, math(a)velocet.ca * Velocet Communications Inc. * Toronto, CANADA -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

3 2

ATM service classes
by Dan Lockwood 30 Oct '02

30 Oct '02

I'm in a knock down drag-out with my RBOC about some ATM DS3s and an OC3. Proceeding on the advice of a Cisco engineer I requested that the circuits be provisioned with UBR+. After the Bell failed to have the circuits provisioned correctly, they installed UBR, and discovering that they could not support UBR+ I have requested that the circuits be reprovisioned with VBR-NRT. These circuits are primarily used for non time sensitive data, but may be used for VOIP in the future. What suggestions does the group have regarding selecting ATM service classes with the Bell and Cisco IOS/hardware. As always, the expertise of the group is unsurpassed and GREATLY appreciated. Dan Lockwood Microsoft Certified Professional CompTIA Network+ Certified Cisco Certified Network Associate

1 0

RE: ICANN Targets DDoS Attacks
by Dan Lockwood 29 Oct '02

29 Oct '02

Would anyone be willing to post an operational example of CAR for ICMP. I would like to see what others are doing to combat the problem. Dan -----Original Message----- From: Jared Mauch [mailto:jared@puck.Nether.net] Sent: Tuesday, October 29, 2002 13:12 To: Jeff Shultz Cc: nanog(a)nanog.org Subject: Re: ICANN Targets DDoS Attacks On Tue, Oct 29, 2002 at 01:03:52PM -0800, Jeff Shultz wrote: > >> On 10/29/2002 at 3:40 PM Valdis.Kletnieks(a)vt.edu wrote: > >> >On Tue, 29 Oct 2002 22:25:44 +0200, Petri Helenius > >> ><pete(a)he.iki.fi> > >> said: > >> > > >> >> Why would you like to regulate my ability to transmit and > >> >> receive > >> data > >> >> using ECHO and ECHO_REPLY packets? Why they are considered > >> >> harmful? > >> > > >> >Smurf. > >> > > >> > >> Okay. What will this do to my user's ping and traceroute times, if > >> anything? I've got users who tend to panic if their latency hits > 250ms > >> between here and the moon (slight exaggeration, but only slight). > >> > >> I just love it when I've got people blaming me because the 20th hop > on > >> a traceroute starts returning * * * instead of times. > > > > that's icmp ttl expired messages. > > I know that, and I try to explain it to my customers... but it doesn't > answer the first part of the question - what will throttling ICMP do > to ping and traceroute times? My gut reaction is that it will a. slow > them ICMP? Or only icmp echo and icmp echo-reply messages? In a well behaved router, nothing. Obviously if you have a 7500 or older GSR linecards that are incapable of doing this due to design problems from day one in pps rates and feature path, there may be a hit. I'm not saying rate-limit anything other than echo+reply. > down and/or b. discard a lot of them making the circuit look > unreliable to ping. But I don't know enough about the underlying > technology to be sure of that. Once again, i'd like to see (other than a performance checking customer) generate more than 2Mb/s of icmp.echo and icmp.echo-reply packets that are legit and not part of a DoS. This is quite rare. Do your own stats and test your hardware. - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

2 2

URLs (IPv6 ISP situations in Japan)
by itojun＠itojun.org 29 Oct '02

29 Oct '02

from the last page of my slide, in case you have missed it. itojun http://www.kame.net/ http://www.v6pc.jp/ http://www.wide.ad.jp/ http://www.wide.ad.jp/nspixp6/ http://www.iij.com/

1 0

Re: How to secure the Internet in three easy steps
by Paul Vixie 29 Oct '02

29 Oct '02

> Not only that, but unless _everyone_ implements 2 and/or 3, all the bad > people that exploit the things these are meant to protect will migrate to > the networks that lack these measures, mitigating the benefits. not just the bad people. all the people. a network with 2 or 3 in place is useless. there is no way to make 2 or 3 happen. > This seems to be a catch-22; no one will implement these for the good > of the net because it costs money, and ignorant competitors that don't > implement them will not share in that expense. Have any such ideas > been implemented in the modern internet? How? neither 2 or 3 would be for the good of the net. 1 would be. the problem with 1 is that the person who feels pain when ISP "A" doesn't do 1 is most likely to be ISP "B". therefore people confuse 1 with "internet altruism" rather than the "rational selfishness" that it is.

14 15

RE: ICANN Targets DDoS Attacks
by H. Michael Smith, Jr. 29 Oct '02

29 Oct '02

If we take Marc Sachs' presentation at face-value, the Gov't is asking us to provide such definitions (as well as anything else we can do to help). -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of bob Sent: Tuesday, October 29, 2002 10:26 AM To: fingers Cc: H. Michael Smith, Jr.; nanog(a)merit.edu Subject: Re: ICANN Targets DDoS Attacks I would point out that if we were to define it and provide the definition to the proper authorities, it would go a long way towards getting a definition that makes sense. I, (and many others here I would imagine) can help get the definition to the right ears if ya'll come up with it. iii fingers wrote: >>Agreed 100%, but Gov't (being run by lawyers) is well accustomed to >>defining what the meaning of 'is' is. If they dictate that ISPs employ >>"DDoS Protection", they will define what "DDoS Protection" means 'for >>the purposes of this policy'. >> > >ah ok > >the point I was trying to make is, there are steps that can be taken to >mitigate/reduce the affects of DDoS. I do not believe there is any >complete way to "protect against a DDoS". perhaps I'm just being pedantic. >perhaps the clarity you mention would be a good thing for other areas too >:) >

1 0