- NANOG - lists.nanog.org

RE: Ethernet EP - MAC Address Filtering
by Deepak Jain 11 Feb '02

11 Feb '02

I assume you mean a non-peer defaulting to you, yes? With wirespeed ACLs one could filter packets not terminated on your network at your point of ingress. Deepak Jain AiNET -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of David McGaugh Sent: Friday, February 08, 2002 3:59 PM To: nanog(a)merit.edu Subject: Re: Ethernet EP - MAC Address Filtering Actually, I was more speaking in terms of applying the filters to your router port as an Exchange Point Member to prevent another unscrupulous exchange point member from default routing you or other things nasty. -Dave Deepak Jain wrote: > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > David McGaugh > Sent: Friday, February 08, 2002 3:18 PM > To: nanog(a)merit.edu > Subject: Ethernet EP - MAC Address Filtering > > Just curious if anyone is performing MAC Address Filtering at any of > the Ethernet Exchange Points. If so has it been found to be easy to > administer or difficult where by peers may be changing Layer 3 devices > or Interfaces without notice? Alternately is MAC Address Filtering > considered an unneeded security measure? > > Thanks, > Dave > > ---- > > Speaking of this, is MAC Address filtering [at an IX] really designed to > eliminate the possibility of new hardware showing up on the port or is it > more the idea of keeping lots of boxes from showing up directly [like > hanging another switch off the port]. If its the latter, a seemingly > sensible approach would be to limit the number of unique MAC addresses to > like 2-4 per port. > > This way you can change your equipment without prior notice, but you can't > (as easily) violate the integrity of the switching fabric. > > I know for our network ports we limit to no more than 2 unique MACs in a > certain time period [~5 minutes or so] which again, allows swapping of > equipment without compromising anything that MAC layer filtering is supposed > to protect. > > Deepak Jain > AiNET

1 0

Re: Reducing Usenet Bandwidth
by Jonas M Luster 11 Feb '02

11 Feb '02

Quoting Paul Vixie (vixie(a)as.vix.com) > ...which is why my proposal didn't involve multicast and assumed that each What are your concerns with mcntp? http://sourceforge.net/projects/mcntp/ jonas

1 0

testing sprint (fwd)
by David Lesher 11 Feb '02

11 Feb '02

> The question is, does sprint.net have the balls to terminate Sprint long > distance for spamming? During the height of the 84 MFJ negotiations, then C&P Tel. disconnected the ATT lobbying office for non-payment. (It made the Wall Street Journal.) -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

RE: Reducing Usenet Bandwidth
by Vadim Antonov 11 Feb '02

11 Feb '02

On Fri, 8 Feb 2002, Deepak Jain wrote: >> Another area which needs improvement is making L2 >> switches similarly aware of community TOS in IP packets. > > Why would an L2 switch need or even want to be aware of TOS? Wouldn't this > be a Class 3/4..7 issue? If community TOS is supported, those guys that > would benefit from awareness of it in their internal network would address > this at a higher level switch I'd think. Well, maybe, but L2 switches do queueing and drops as well, so there should be some way to indicate which packets to drop, and which to keep. This means that they should be able to look deeper inside frames to extract information for frame classification. (Of course, a cleaner architecture would simply map L3 TOS into some L2 TOS bits at the originating hosts, but this just didn't happen...) One may argue that L2 switches typically are not bottlenecks, and the Internet access circuits effectively limit Ethernet utilization for the exterior traffic. However, there's a potential class of applications in clustered community computing (quite a lot of scientfic simulations, actually) which can generate very high levels of intra-cluster traffic. > I took your suggestion as a "best effort" below "normal" effort for > "community" TOS. I could be mistaken. That is exactly what i had in mind. --vadim

1 0

RE: Reducing Usenet Bandwidth
by Deepak Jain 11 Feb '02

11 Feb '02

-----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Vadim Antonov Sent: Monday, February 04, 2002 7:18 PM To: nanog(a)merit.edu Subject: Re: Reducing Usenet Bandwidth [deleted, lots of good ideas and suggestions. I agree with essentially all of it] Another area which needs improvement is making L2 switches similarly aware of community TOS in IP packets. --- Why would an L2 switch need or even want to be aware of TOS? Wouldn't this be a Class 3/4..7 issue? If community TOS is supported, those guys that would benefit from awareness of it in their internal network would address this at a higher level switch I'd think. I took your suggestion as a "best effort" below "normal" effort for "community" TOS. I could be mistaken. Deepak Jain AiNET

1 0

Re: COM/NET/ORG/EDU Registry Informational Message
by Doug Barton 11 Feb '02

11 Feb '02

On Thu, 7 Feb 2002, Brad Verd wrote: > > To All, > > VeriSign GRS will be making several changes to the COM, NET, ORG and EDU > zone files. I think the proposed changes are an excellent idea, providing of course that the proposed new zone format is adequately tested for interoperability before it's deployed. > 2. Eliminate Orphan A Records > > The current zone generation process publishes A (address) records (also > called glue records) regardless of whether the name server is referenced > by any NS (name server) records. Put another way, an A record is > published even if no zone delegations reference it. These A records are > called orphans, and their presence in the COM/NET/ORG zones is > undesirable for both administrative and technical reasons Again, an excellent suggestion. In fact, our organization has been trying for months to get you guys to delete some host records for old name servers we've retired, and haven't gotten a whole lot of cooperation. Can you give me a contact person who would be willing to work with me on this? I have two sets of servers to delete, those with no domains delegated to them, and those with rogue, unauthorized domains who have listed my name servers without permission. I can provide more information in private. Doug

1 0

Re: zebra/ospf issue
by Josh Gentry 11 Feb '02

11 Feb '02

On Fri, Feb 08, 2002 at 09:38:01PM -0500, Mark Radabaugh wrote: > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > > Josh Gentry > > Sent: Friday, February 08, 2002 1:38 AM > > To: nanog(a)merit.edu > > Subject: zebra/ospf issue > > > > > > > > Folks, > > > > I'm experimenting with using Zebra running on a Debian box to > > do OSPF with > > the Ciscos on our network. The zebra box has 2 interfaces, each in a > > different area. This is the first time we have tried to impliment > > multiple areas on our network. Right now, area 51 consists > > only of the > > zebra box and a Cisco 2500, and is just for testing. > > > > The zebra box is forming a full adjacency with the Cisco in > > area 51 with > > no problems. It will not, however, become fully adjacent > > with the DR and > > BDR in area 0. This seems to be preventing the distrobution > > I think this is normal behavior (without really analyzing things...). > See if this helps any: http://www.cisco.com/warp/customer/104/11.html > > Mark Radabaugh > It is normal for it to be in 2-way adjacency with with all the routers in area 0 _except_ the DR and BDR. Indeed, my Zebra forms a 2-way adjacency with all the routers in area 0, except DR and BDR, but it never even makes it to 2-way adjacency with the DR and BDR, let alone the full adjacency needed for the Zebra box to receive and inject routes into the OSPF routing table. Thanks for the link. Good info, even though not the answer to this problem. Thanks, Josh jgentry(a)swcp.com

1 0

Hyperflow load balancer.
by Daniel F. Chief Security Engineer - 11 Feb '02

11 Feb '02

I have been looking around for documentation on these this and cannot find any. Its a Hyperflow 2 made by Holontech. thats about all I know i can get to a user like shell but cannot figure out how to reset the password. does anyone know how to reclaim or reset the root/admin pass on these things. We got them second hand no docs no passwords. and have to make them work :) TIA -- Chief Security Engineer | Daniel Fairchild danielf(a)supportteam.net Unix is like a wigwam -- no Gates, no Windows, and an Apache inside.

1 0

zebra/ospf issue
by Josh Gentry 11 Feb '02

11 Feb '02

Folks, I'm experimenting with using Zebra running on a Debian box to do OSPF with the Ciscos on our network. The zebra box has 2 interfaces, each in a different area. This is the first time we have tried to impliment multiple areas on our network. Right now, area 51 consists only of the zebra box and a Cisco 2500, and is just for testing. The zebra box is forming a full adjacency with the Cisco in area 51 with no problems. It will not, however, become fully adjacent with the DR and BDR in area 0. This seems to be preventing the distrobution of routes to the zebra box. Distrobution of routes in area 51 works fine. Here is my config, minus auth info. ! Zebra configuration saved from vty ! 2002/02/02 16:35:11 ! hostname ospfd log file /var/log/zebra/ospfd.log service password-encryption ! ! interface lo ! interface eth1 ip ospf authentication-key <password> ! interface eth0 ip ospf message-digest-key <keyid> md5 <password> ip ospf priority 5 ip ospf hello-interval 10 ip ospf dead-interval 40 ! router ospf ospf router-id 216.184.8.55 ospf abr-type cisco ospf rfc1583compatibility network 198.59.115.0/24 area 0 network 216.184.8.0/24 area 51 area 0 authentication message-digest area 51 authentication redistribute static Any insight would be appreciated. Thanks. Josh jgentry(a)systemstability.org

1 0

Re: route-views.oregon-ix.net
by David Meyer 11 Feb '02

11 Feb '02

There was some problem with it. I wasn't on site but Joel handled it. Thanks for the report. Dave On Thu, Feb 07, 2002 at 10:11:13AM -0500, Peter Rohrman wrote: >> >> I cant get to route-views.oregon-ix.net. Is this route server >> decommissioned or is this just an outage? >> >> Pete >> >> ************************************************************************** >> Peter Rohrman One Executive Dr. >> Network Engineer Fort Lee, NJ 07024 >> Everest Broadband Networks (201) 905-8491 >> **************************************************************************

1 0