- NANOG - lists.nanog.org

IDS experience's
by Brandon Knicely 28 Jun '02

28 Jun '02

IDS's have been around awhile but recently became interested in their usefulness. I was wondering if I could get some group feedback on the following: 1. How many folks have actually deployed either a NID, NNID or HID system? 2. Have they been useful or just generated noise and excess cycles? (1 - waste of time, 10 - water walker) 3. Any 'real-world' comparative/useful data and/or opinion on different approaches...ie pattern matching, anomoly detection and/or data mining approaches? 4. Any feedback on Snort, ISS, Cisco or Symantec? Or other newer/different approaches ie Okena? 5. Other general good information, ie issues, gripes, etc.? I would appreciate any help, feel free to contact direct or list and will summarize. thanks, Brandon

4 4

RE: How do I log on while in flight?
by Mansey, Jon 28 Jun '02

28 Jun '02

Does anyone else find this too hard to believe? I cant be the only one who has inadvertantly forgotten to power off their cell phone while flying. This must happen all the time, but we don't hear about horrible DoS of cell networks. Or is this why cell service sucks so badly in some places? ;-) Jm > To add to it, it is not system specific. Depending on the > size of the MSA (metropolitin service area) or RSA (rural > service area) footprint, there may be as many as 4 or 5 > cellular network carriers effected in this cascading failure > by a SINGLE airborne mobile. > > So, now you know one of the more UNKNOWN reasons why it is > not legal to use a cell phone while airborne. It is a great > way to DoS the network and the carriers, subscribers, and FCC > don't want that.

4 4

RE: How do I log on while in flight?
by James Smith 28 Jun '02

28 Jun '02

> -----Original Message----- > From: Mansey, Jon [mailto:Jon_Mansey@verestar.com] > > Does anyone else find this too hard to believe? I cant be the > only one who > has inadvertantly forgotten to power off their cell phone > while flying. This > must happen all the time, but we don't hear about horrible DoS of cell > networks. > Not a problem. Your cell phone is on your hip, buried in the seat with another body next to it. Great shielding. You are in a giant metal tube, which also has great shielding properties. It is most likely a small one, and incapable of great power output. You would have to get it and bring it up closer to the window level to really get a signal out line of sight to a tower. It would be instructive to see FCD alarm stats plotted by time and location... James H. Smith II NNCDS NNCSE First Call Response Center Professional Services - Network Engineer The Presidio Corporation

1 0

RE: Bellsouth DSL in Chattanooga - Whose Lines?
by Steve.Smith＠sarcom.com 28 Jun '02

28 Jun '02

BellSouth only has a co-lo with KMC in Chatt. They can give you full service IF the building is lit with Bell fiber. Most of the buildings are KMC though. Atlanta is their closet full facility. Steve -----Original Message----- From: CARL.P.HIRSCH(a)sargentlundy.com [mailto:CARL.P.HIRSCH@sargentlundy.com] Sent: Friday, June 28, 2002 9:39 AM To: nanog(a)merit.edu Subject: Bellsouth DSL in Chattanooga - Whose Lines? Does Bellsouth use its own infrastructure for consumer/business ADSL (specifically in Chattanooga, TN), or does it rely on someone else's lines to get from the local central office to the nearest peering exchange? I've seen outfits like Covad use Exodus/C&W, but I'm imagining a RBOC like BellSouth prefers to use its own infrastructure. What is the closest peering point that would be used in Chattanooga, anyhow? thanks, -carl hirsch

1 0

Re: Worldcomm network question
by Eric Brandwine 28 Jun '02

28 Jun '02

>>>>> "b" == blitz <blitz(a)macronet.net> writes: b> For that and other reasons, Wcom will be bailed out, at taxpayer expense if b> necessary, for national security reasons. WorldCom still "runs" UUNET as well. We carry a significant portion of the backbone, and have many customers that have no other connections. With the bandwidth glut, I'm sure the core could survive the sudden lack of UUNET, but there's a lot of edges that would get unhappy. There's no way they'd let us go Chapter 7, even if we wanted to. ericb b> At 18:19 6/26/02 -0400, you wrote: >> Anyone have any ideas, speculation, or info on how adverse future of WCOM >> would play out for ISPs and such? Among other things, WCOM is the preferred >> provider of long-haul pipes for DoD.....that can't be good!! -- Eric Brandwine | Microsoft treats security vulnerabilites as public UUNetwork Security | relations problems. ericb(a)uu.net | +1 703 886 6038 | - Bruce Schneier Key fingerprint = 3A39 2C2F D5A0 FC7C 5F60 4118 A84A BD5D 59D7 4E3E

2 1

[Henk.Steenman@ams-ix.net: NOTIFICATION: KPNQWEST disconnection]
by Peter van Dijk 28 Jun '02

28 Jun '02

FYI. ----- Forwarded message from Henk Steenman <Henk.Steenman(a)ams-ix.net> ----- Subject: NOTIFICATION: KPNQWEST disconnection From: Henk Steenman <Henk.Steenman(a)ams-ix.net> To: AMS-IX Discussion list for technical issues <tech-l(a)ams-ix.net>, GRX Tech mailing list <grxtech(a)ams-ix.net> Date: Wed, 26 Jun 2002 10:43:42 +0200 This is to inform you that KPNQWEST has been unable to further fulfill its financial obligations towards AMS-IX, despite their repeated promises to do so over the last couple of days. We have therefore decided that the KPNQWEST ports will be disabled (both on the Internet and the GRX VLANs) at 12.00AM CET today. To allow some further time for rearranging traffic, we will allow a single KPNQWEST port to remain in use for a few more days, i.e. until July 1st. This one remaining port will be: switch 4 port 6/5 IP 193.148.15.140 (Internet VLAN) In order to avoid large amounts of broadcast traffic created by ARP requests, we request all parties currently peering with KPNQWEST to shut down their peering sessions with KPNQWEST with other IP addresses than the above mentioned one. Kind Regards -- - Henk Henk Steenman tel: +31 205 141 711 Amsterdam Internet Exchange mobile: +31 651 312 774 http://www.ams-ix.net e-mail: Henk.Steenman(a)ams-ix.net _______________________________________________ tech-l mailing list tech-l(a)ams-ix.net http://melix.ams-ix.net/mailman/listinfo/tech-l ----- End forwarded message ----- Greetz, Peter -- MegaBIT - open air networking event - http://www.megabit.nl/

4 4

Sprint peering policy
by Ralph Doncaster 28 Jun '02

28 Jun '02

Someone was kind enough to forward me an outline of the peering policy they received from Sprint. It seems to be the toughest one I've seen - >=OC48 in 14 US cities, >=OC12 to Europe. To find out the traffic minimums and ratios it looks like an NDA is required... Ralph Doncaster principal, IStop.com

8 12

How do I log on while in flight?
by Scott Weeks 28 Jun '02

28 Jun '02

I was wondering if any of y'all could give me pointers to services I could use to log into a network during flight on a private airplane. For example a person is in flight cross-country and needs to do a videoconference, send email from his network to interested parties, or any of the normal things we do from the ground. Is this possible or would it interfere with the plane's other systems? scott

14 18

Savvis? 14:00 CDT change?
by Larry Rosenman 28 Jun '02

28 Jun '02

Around 14:00 CDT (GMT -0500), we noted most of our traffic ingress was through Savvis, not it's normal path. Turning down our BGP session with them, traffic returns to it's normal path. Anyone else seeing weird stuff from Savvis? -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 972-414-9812 E-Mail: ler(a)lerctr.org US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749

1 1

FW: How do I log on while in flight?
by Jacob M Wilkens 28 Jun '02

28 Jun '02

This was very informative... not to mention interesting. (see below) -----Original Message----- From: John Fraizer [mailto:nanog@Overkill.EnterZone.Net] Sent: Thursday, June 27, 2002 9:01 PM To: Jacob M Wilkens Cc: nanog(a)merit.edu Subject: RE: How do I log on while in flight? On Thu, 27 Jun 2002, Jacob M Wilkens wrote: > > I'm fairly certain the cell networks won't crash - as demonstrated in some > calls made last fall. It's more like they won't be able to bill for the time > or keep track of your calls. > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Scott Weeks > Sent: Thursday, June 27, 2002 5:01 PM > To: Leigh Anne Chisholm > Cc: nanog(a)merit.edu > Subject: RE: How do I log on while in flight? > > > I was mainly thinking of satellite systems, but failed to remember the > latency problems associated with them so the videoconferencing example > wouldn't work. (not enough coffee today... :) So for latency tolerent > apps does satellite work well when traveling at air speeds? If the > footprint doesn't cover the entire area traveled how well does hand off > from one 'cell' to another work? What do the big boys like the president > and corporate execs use? > > Also, that the cellular network could crash if cell phones are used at > altitude seems like a big security hole to me. > > scott > > Jacob, Since Sue H. has my posting privs nuked (since last fall), I can't post this to the entire list but, I can explain the reasoning behind not using cell phones on aircraft from the cellular carrier point of view. In a previous life, I was an engineer for a very large cellular carrier in the southern US. It has absolutely NOTHING to do with not being able to track the call or bill for the time. If the mobile and the MTSO (mobile telephone switching office) are able to agree on which site has the call during call initiation, the call can be established. If it is establisted, it is logged. Once it is logged, it can be billed. On the analog cell system, the cell site has one of more signaling channel and what is called a scanning receiver. In addition to these, there are regular channels. The signaling channel is used to initiate calls to/from the mobile. The MTSO keeps track of the LKA (last known area) of the mobile. When a call is placed to that mobile, the MTSO will send a message on the signaling channel of the cellsite that the mobile was last known to be in. This message says "mobileID #nnn-nnn-nnnn, I have a call for you. If you're there, TX on channel XXX with a SAT tone of YYY." The cellsite then listens on channel XXX for a carrier with a SAT tone of YYY. If it hears the mobile there, it then says "OK. I hear you there. Cause the mobile phone to ring and let the guy know he ha a call." The phone rings. If the user answers the call, it tells the cellsite over channel XXX, which in turn tells the MTSO. The MTSO then tells the cellsite, over the signaling channel, "OK. You listen on channel ZZZ for me with a SAT tone of QQQ. If you hear me, let me know over the signaling channel and we'll establish a two-way link and tie your call up." The "handoff" process is very similar. The MTSO is asking all of the surrounding cellsites to listen for you on channel XXX with a SAT tone of YYY and tell it how strong it hears you. When there is a cellsite that claims to hear you better than the site you're currently using, the whole "listen for me, I'll listen for you and we'll use these SAT tones to authenticate ourselfs" process goes on to hand your call off to the new cellsite. This is all fine and dandy and will work, although sub-optimum, with the mobile airborn. The problem comes from a process called "foreign carrier detect." If a cellsite hears someone on its scanning receiver, it reports this to the MTSO. The MTSO knows what calls it is tracking and which cellsites should be adjacent to and hearing those calls. If a cellsite is hearing a call that, by design, it should NOT be hearing, the MTSO will alarm for "foreign carrier detect" and shut that channel down on that cellsite. The reason is that the MTSO thinks that it is some "foreign carrier" that could cause problems for a REAL call. It doesn't want that so, it shuts that channel down with a FCD alarm to prevent it. Since the original analog system consisted of 600-so channels, divided equally between the A-wireless and B-wireline carriers, the systems were designed to share channels. It re-used channels throughout the network, only it did so at distances at which two cellsites using the same channels would not hear each other or each others client mobiles. Now, you put one of those mobiles in the air and not only can it hear every cellsite that is using the particular voice channel but, every scanning receiver at every cellsite in a network is most likely going to hear the airborne mobile and start a cascading foreign carrier detect shutdown of channels, network-wide. As the mobile is handed off from site to site, it is likely that it is going to use a different channel and then THAT channel gets put out of service because of a FCD alarm. To add to it, it is not system specific. Depending on the size of the MSA (metropolitin service area) or RSA (rural service area) footprint, there may be as many as 4 or 5 cellular network carriers effected in this cascading failure by a SINGLE airborne mobile. So, now you know one of the more UNKNOWN reasons why it is not legal to use a cell phone while airborne. It is a great way to DoS the network and the carriers, subscribers, and FCC don't want that. I would greatly appreciate it if you would post this to the list since, as I stated to begin with, I don't have post access to NANOG. --- John Fraizer EnterZone, Inc

1 0