- NANOG - lists.nanog.org

effects of NYC power outage
by Craig Partridge 24 Jul '02

24 Jul '02

Anyone got good data comparing the effects on the Net (BGP reachability, etc) of this weekend's NYC power outage with the effects power outage late on September 11th. I'm on a National Academy of Sciences committee looking at how the Internet fared on 9/11 and we're always in search of good comparative data. Thanks! Craig Partridge Chief Scientist, BBN Technologies

9 9

Re: PSINet/Cogent Latency
by Joe Loiacono 24 Jul '02

24 Jul '02

Actually RRDTool interpolates any late replys to the nearest specified collection timepoint (e.g., every 5th minute.) It doesn't really resample. Joe Matt Zimmerman To: nanog(a)merit.edu <mdz cc: @csh.rit.edu> Subject: Re: PSINet/Cogent Latency Sent by: owner-nanog 07/23/2002 09:46 AM On Mon, Jul 22, 2002 at 10:50:03PM -0700, Doug Clements wrote: > I think the problem with using rrdtool for billing purposes as described > is that data can (and does) get lost. If your poller is a few cycles late, > the burstable bandwidth measured goes up when the poller catches up to the > interface counters. More bursting is bad for %ile (or good if you're > selling it), and the customer won't like the fact that they're getting > charged for artifically high measurements. RRDtool takes into account the time at which the sample was collected, and if it does not exactly match the expected sampling period, it is resampled on the fly. See: http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/tutorial/rrdtutorial.html under "Data Resampling" for more information. RRDtool has some quirks when used for billing purposes, but it is not guilty of the error that you describe. -- - mdz

2 1

Cisco questions
by Ralph Doncaster 24 Jul '02

24 Jul '02

A couple people pointed out cisco-nsp would be more appropriate for questions like the one I posted about packet loss. http://puck.nether.net/lists/ Ralph Doncaster principal, IStop.com

1 0

packet loss source
by Ralph Doncaster 24 Jul '02

24 Jul '02

Thanks to those who suggested improper duplex negotiation between the 2621 and the 2900. Although "show int" on the 2621 (running 12.0.7T) indicates full-duplex, "sh controller" indicates BCR9 =0x00000000 (half-duplex). Ralph Doncaster principal, IStop.com

1 0

RE: Security of DNSBL spam block systems
by Brad Knowles 24 Jul '02

24 Jul '02

At 2:29 AM -0400 2002/07/23, Phil Rosenthal wrote: > IMHO Even the really large DNSBL's are barely used -- I think > (much) less than 5% of total human mail recipients are behind > a mailserver that uses one... Not true. There are plenty of large sites that use them (e.g., AOL), and many sites use them to help ensure that they themselves don't get added to the black lists. IMO, there is a serious risk of having DNSBL servers attacked and used as a DoS. The easiest way would be to check to see if the servers being used are open public caching recursive servers, in addition to their authoritative services. If so, then they would be open to cache poisoning attacks. That said, I think the bigger black list services are run by people who have at least half a clue as to how a nameserver should be operated, and therefore they should be relatively secure. However, they would still be at risk if one of their parent zones is served by a nameserver that mixes both authoritative service & caching/recursive service, and therefore would be easily subject to cache poisoning. -- Brad Knowles, <brad.knowles(a)skynet.be> "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania.

3 2

New NANOG traceroute (fixes -T compromise)
by Ehud gavron 23 Jul '02

23 Jul '02

The new NANOG traceroute (also known as TrACESroute) is now available. It fixes the latest "security" compromise detailed on Bugtraq and on SUSE security focus at http://online.securityfocus.com/advisories/2740 Ehud Gavron gavron(a)wetwork.net Directory: ftp://ftp.login.com/pub/software/traceroute/beta/ Code: ftp://ftp.login.com/pub/software/traceroute/beta/traceroute.c Directions: ftp://ftp.login.com/pub/software/traceroute/beta/0_readme.txt

1 0

OT: If you thought Y2K was bad, wait until cyber-security hits
by Rowland, Alan D 23 Jul '02

23 Jul '02

(shooting self in foot...) Just eliminate tech support and proprietary software! "A list of our settings is available at www.domain.com/settings. And don't call us with tech problems. We don't do tech support." I know of at least one ISP out there already doing this. Not that they're highly successful, but imagine not having to tell someone, "Yes, your username and password are case sensitive and must be spelled exactly as supplied. And it's .net, not .com" ever again. Or alternately just require registration through a BBS system as a clue test. :) (Waiting for visit from the sales/marketing/shareholder folk...) Best regards, _________________________ Alan Rowland -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Saturday, July 20, 2002 10:03 PM To: Scott Francis Cc: nanog(a)merit.edu Subject: Re: If you thought Y2K was bad, wait until cyber-security hits Snip... I'll personally nominate for sainthood anybody who figures out how to make it work for an ISP's terms of service. ;) -- Valdis Kletnieks Computer Systems Senior Engineer Virginia Tech

21 47

debugging packet loss
by Ralph Doncaster 23 Jul '02

23 Jul '02

I'm seeing 2-5% packet loss going through a Cisco 2621 with <10mbps of traffic running at ~50% CPU. (packet loss based on ping results) Pinging another box on the same catalyst 2900 switch gives no packet loss, so it seems the 2621 is the source of the packet loss. I need help figuring out why it is dropping packets, and how to stop it. The odd thing is that the interface stats don't show any dropped packets: Full-duplex, 100Mb/s, 100BaseTX/FX ARP type: ARPA, ARP Timeout 00:01:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters 00:10:16 Queueing strategy: fifo Output queue 0/40, 0 drops; input queue 1/512, 0 drops 5 minute input rate 5257000 bits/sec, 1383 packets/sec 5 minute output rate 5692000 bits/sec, 1448 packets/sec 845743 packets input, 392733148 bytes Received 403 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast 0 input packets with dribble condition detected 887446 packets output, 430245866 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collision, 22694 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out Ralph Doncaster principal, IStop.com

6 5

Level3 Fiber Cut
by German Martinez 23 Jul '02

23 Jul '02

Somebody affected by a Level3 fiber between Boston and New York ? Thanks German

2 1

password stores?
by Daniska Tomas 23 Jul '02

23 Jul '02

hi, i'm wondering how large isps offering managed cpe services manage their password databases. let's say radius/tacacs is used for normal cpe user aaa, but there is some 'backup' local user account created on the cpe for situations when the radius server is unreachable. for security reasons, this backup account (as well as snmp communities, radius key etc.) is unique per cpe to avoid frauds caused by end-users (even if one does password recovery on the cpe, they still don't have the password for other cpe's). if there are hundreds or thousands of these cpe's that could mean storing of tens thousands of password. are there any crypto-based products available or do the people use their own stuff? thanks -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first.

2 1