- NANOG - lists.nanog.org

multilink frame relay
by c johnson 20 May '02

20 May '02

I was wondering if there was any online / hardcopy information about multilink frame relay that you have found useful. I was also wondering if there was any online / hardcopy information comparing multilink frame relay to standard frame relay that you have found useful as well. replies appreciated _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com

1 0

route statistics
by Ralph Doncaster 20 May '02

20 May '02

I'm trying to collect statistics on how many routes match certain patterns. So far I've been using zebra, set term len 0, and then sh ip bgp regexp, and wait for the total prefixes count at the end of the list. I figure there must be a better way than this, but so far haven't found one. Any ideas? Ralph Doncaster principal, IStop.com div. of Doncaster Consulting Inc.

4 5

Re: "portscans" (was Re: Arbor Networks DoS defense product)
by Crist J. Clark 20 May '02

20 May '02

Dan Hollis <goemon(a)anime.net> wrote: > On Sat, 18 May 2002, Scott Francis wrote: > > On Sat, May 18, 2002 at 11:05:34PM -0400, woods(a)weird.com said: > > > attacked any host or network that I was not directly responsible for. > > > If you don't want the public portions of your network mapped then you > > > should withdraw them from public view. > > Agreed there. Defense is important. It might be good to note that I'm not > > giving a blanket condemnation of all portscans at all times; but as a GENERAL > > RULE, portscans from strangers, especially methodical ones that map out a > > network, are a precursor to some more unsavory activity. > > And what the critics keep missing is that it will take several landmine > hits across the internet to invoke a blackhole. Just scanning a few > individual hosts or /24s won't do it. > > There are three aims of the landmine project: > > 1) early warning > 2) defensive response > 3) deterrence > > I realize such a project won't be absolutely, positively perfect in every > aspect, and it won't satisfy 100% of the people 100% of the time. But > that's hardly an excuse to not do it. IMO the positives outweigh the > negatives by far. Not that this neverending thread hasn't been an absolute blast, but I was thinking maybe if I pointed out that this has been and is already being done by several commercial and non-commercial groups, we could put an end to the "landmine" discussion? For example, see, http://isc.incidents.org/top10.html For a list of naughty hosts and nets. And there are any number of commerical solutions. For example, I believe SecurityFocus's ARIS does this kind of thing, http://www.securityfocus.com/corporate/products/tmsFAQ.shtml Pretty much all of the big IS security companies do. NIDS data from various sites is shipped off to a central database where the data is crunched, and then the distilled information is pushed back out. Pretty much the same concept? -- Crist J. Clark | cjclark(a)alum.mit.edu | cjclark(a)jhu.edu http://people.freebsd.org/~cjc/ | cjc(a)freebsd.org

1 0

Metromedia Fiber Network files for bankruptcy
by Mitch Halmu 20 May '02

20 May '02

As predicted: http://biz.yahoo.com/prnews/020520/nym120_1.html --Mitch NetSide "I am here to bury Caesar not to praise him".

1 0

Re: "portscans" (was Re: Arbor Networks DoS defense product)
by Scott Gifford 20 May '02

20 May '02

Scott Francis <darkuncle(a)darkuncle.net> writes: [...] > And why, pray tell, would some unknown and unaffiliated person be scanning my > network to gather information or run recon if they were not planning on > attacking? I'm not saying that you're not right, I'm just saying that so far > I have heard no valid non-attack reasons for portscans (other than those run > by network admins against their own networks). Before choosing an onling bank, I portscanned the networks of the banks I was considering. It was the only way I could find to get a rough assessment of their network security, which was important to me as a customer for obvious reasons. I'm not sure if I would have been impressed or annoyed if they had stopped accepting packets from my machine during the scan. :-) -----ScottG.

8 9

Re: "portscans" (was Re: Arbor Networks DoS defense product)
by Tim A.Irwin 20 May '02

20 May '02

> > From: Mitch Halmu <mitch(a)netside.net> > Date: 2002/05/19 Sun PM 11:32:20 EDT > To: Dan Hollis <goemon(a)anime.net> > CC: "'nanog(a)merit.edu'" <nanog(a)merit.edu> > Subject: Re: "portscans" (was Re: Arbor Networks DoS defense product) > > > > On Sun, 19 May 2002, Dan Hollis wrote: > > > netside has been a long time lunatic opponent of RBLs Wait for it... wait for it... here it comes... > First they came for the Communists, > and I didn't speak up, > because I wasn't a Communist. > Then they came for the Jews, > and I didn't speak up, > because I wasn't a Jew. > Then they came for the Catholics, > and I didn't speak up, > because I was a Protestant. > Then they came for me, > and by that time there was no one > left to speak up for me. > > (Rev. Martin Niemoller, 1945) > > --Mitch > NetSide > SCORE!!! And the point is awarded to Dan!

2 1

Peering BOF V - Call for Participants
by William B. Norton 20 May '02

20 May '02

Hi all - NANOG is only three weeks away and Monday evening at NANOG there will be another Peering BOF ; thanks to those that suggested this on the survey forms! We'll do this the same way as last time / the same way the Peering Personals ran at the last GPF: *Peering Coordinators*: Send me the completed RSVP form below. I'll assemble these into logos, icons, AS#s and contact info With this backdrop, each of you in turn get a chance to stand up and a) introduce yourself, your network, b) what you are looking for in a peer, c) why folks should want to peer with you, and d) which locations you currently or plan to peer. Making the initial contact with the potential peer is (oddly enough) the most difficult parts of peering, and the Peering Personals has proven to be an effective (and lively!) way to make those initial contacts. So *Peering Coordinators* - send me those RSVPs ! Since we only have 90 minutes I'm going to limit the number of Peering Coordinators to 25 or so. If there is time remaining we'll use the rest of the time for ad hoc Peering Personals as we did last time. A couple comments: I noticed on the thread "Interconnects" folks were talking about willingness to peer and MLPAs. At least from the conversations I had during my research on Peering, I found relatively little interest in MLPAs. For those using contracts for peering, folks preferred to control peering using their own contracts written by their lawyers, stating their evolving peering terms and conditions, and generally felt somewhat like they were losing control by signing up to a MLPA document. At the same time, I have found from running these Peering Personals and talking with these Peering Coordinators, that maybe 80% of all Peering Coordinators had a relatively open peering policy. By "Relatively Open" I mean that they would peer in any single location or multiple location with companies that they would not consider to be a prospective customer. This openness was surprising given all the huff and puff on mailing lists over the years about *not* being able to get peering. We'll see if my 80% figure rings true at the Peering BOF, and I'll share a couple anecdotes about an emerging set of significant traffic open peers at the Peering BOF. Bill ------------------ RSVP FORM ------------------------------ Clip Here --------------------------- Please Fill out and e-mail to wbn(a)equinix.com with Subject: Peering BOF V Name: ______________________ Email: ______________________ Title: ______________________ Company: ___________________ AS#(s): _____________________ Check each that applies: ___ We are an ISP (sell access to the Internet) -- OR -- ___ We are a Non-ISP (content company, etc.) ___ We are Content-Heavy -- OR -- ___ We are Access-Heavy ___ We generally require peering in multiple locations -- OR -- ___ We will peer with anyone in any single location ___Peering with Content Players or Content Heavy ISPs is OK by us ___ We have huge volumes of traffic (lots of users and/or lots of content) (Huge: > 1 Gbps total outbound traffic to peers and transit providers) ___ We have a global network ___ We require written contracts for peering ___ We have a U.S. Nation-Wide Backbone (East Coast, West Coast, and at least one location in the middle) ------------------------------------------- snip ------------------------------------------------

1 0

Re: Network Reliability Engineering
by Nigel Clarke 20 May '02

20 May '02

Try the "The Art of Testing Network Systems" ISBN: 0-471-13223-3 --- Nigel Clarke Network Security Engineer nigel(a)forever-networks.com

1 0

Re: "portscans" (was Re: Arbor Networks DoS defense product)
by Scott Gifford 19 May '02

19 May '02

"Stephen J. Wilcox" <steve(a)opaltelecom.co.uk> writes: > On 18 May 2002, Scott Gifford wrote: > > > > > Scott Francis <darkuncle(a)darkuncle.net> writes: > > > > [...] > > > > > And why, pray tell, would some unknown and unaffiliated person > > > be scanning my network to gather information or run recon if > > > they were not planning on attacking? I'm not saying that you're > > > not right, I'm just saying that so far I have heard no valid > > > non-attack reasons for portscans (other than those run by > > > network admins against their own networks). > > > > Before choosing an onling bank, I portscanned the networks of the > > banks I was considering. It was the only way I could find to get > > a rough assessment of their network security, which was important > > to me as a customer for obvious reasons. > > I would argue that this is not good practice and you dont have the > right to intrude on the workings of the banks network just because > you have the technology to do so.. if a telnet port was open would > you also check that you were unable to brute force your way in? That > is to say.. what exactly were you hoping to find and then do with > the results? I'm not arguing it's good practice. I'm giving it as an example of a reason why somebody might scan your network, even though they were not planning on attacking. ----ScottG.

2 1

Re: Re[2]: "portscans" (was Re: Arbor Networks DoS defense product)
by JC Dill 19 May '02

19 May '02

On 07:50 AM 5/19/02, Ralph Doncaster wrote: > >> RD> I often like to know if a particular web server is running Unix or >> RD> Winblows. A port scanner is a useful tool in making that determination. >> >> [allan@ns1 phpdig]$ telnet www.istop.com 80 >> Trying 216.187.106.194... >> Connected to dci.doncaster.on.ca (216.187.106.194). >> Escape character is '^]'. >> HEAD / HTTP/1.0 >> >> HTTP/1.1 200 OK >> Date: Sun, 19 May 2002 01:47:57 GMT >> Server: Apache/1.3.22 (Unix) FrontPage/4.0.4.3 PHP/4.1.2 mod_fastcgi/2.2.8 > >Sure, it works on some servers, but try it on yahoo.com, cnn.com, ... <http://uptime.netcraft.com/up/graph/?mode_u=off&mode_w=on&site=www.cnn.com> Works for me, works from any system that has a browser. At any given time I'm *far* more likely to have a browser running than port scanning software, so this solution is also IMHO faster. jc

2 1