- NANOG - lists.nanog.org

Out of band monitoring of equipment
by John Leong 22 Nov '00

22 Nov '00

Curious if any operator uses, or have interest in using, out of band network (e.g. modem, wireless etc.) for remote equipment (routers, switches, HVAC etc.) monitoring over and above doing it in band on the Internet. Regards, John Leong

10 9

RE: Does Jim Fleming provide IPv4CMRN?
by Kavi, Prabhu 21 Nov '00

21 Nov '00

Does Jim Fleming provide a IPv4 Clueful Message Related to NANOG? Nope. Give it up Jim. Prabhu > -----Original Message----- > From: JIM FLEMING [mailto:jfleming@anet.com] > Sent: Tuesday, November 21, 2000 2:33 PM > To: Susan R. Harris > Cc: nanog(a)merit.edu > Subject: Does MERIT provide, "end-to-end", IPv4 Header Transport > (IPv4HT) > > > > http://www.merit.edu/ > Merit Network, Inc. > Michigan's Leading Internet Provider > > Does MERIT provide, "end-to-end", IPv4 Header Transport (IPv4HT) > ....with the TOS field untouched ? > > Jim Fleming > http://www.unir.com/images/architech.gif > http://www.unir.com/images/address.gif > http://www.unir.com/images/headers.gif > http://www.ntia.doc.gov/ntiahome/domainname/130dftmail/unir.txt > http://msdn.microsoft.com/downloads/sdks/platform/tpipv6/start.asp > > > >

2 1

Does AT&T provide IPv4HT ?
by JIM FLEMING 21 Nov '00

21 Nov '00

Does AT&T provide, "end-to-end" IPv4 IP Header Transport ? ....with the TOS field untouched ? Jim Fleming http://www.unir.com/images/architech.gif http://www.unir.com/images/address.gif http://www.unir.com/images/headers.gif http://www.ntia.doc.gov/ntiahome/domainname/130dftmail/unir.txt http://msdn.microsoft.com/downloads/sdks/platform/tpipv6/start.asp ----- Original Message ----- From: Stephen Sprunk <ssprunk(a)cisco.com> To: Roeland Meyer <rmeyer(a)mhsc.com>; 'Shawn McMahon' <smcmahon(a)eiv.com>; <nanog(a)merit.edu> Sent: Tuesday, November 21, 2000 1:16 PM Subject: Re: ISPs as content-police or method-police > > Thus spake "Roeland Meyer" <rmeyer(a)mhsc.com> > > > > Please reference any suit regarding breach of contract. Examples > > abound. Port filtering may be construed as a material breach when the > > expectation is, that there is to be no port filtering. Access is > access, > > even when the customer doesn't know that they are being restricted in > > their access. That just assures you that they will go ballistic when > they > > find out. > > If filtering is in the contract, it's hardly breach of contract to > perform it. > > > Face it guys, you KNOW that this is basically dishonest. As such, it > is > > indefensible. I would almost bet <amount> that none of the transit > > providers mentions restrictions, on access, in their contracts. I > would > > almost bet <1/2 amount> that NONE of the access providers mention > > same in THEIR contracts. > > AT&T, I believe, was the first major provider to start filtering port > 25; here's the relevant part of their contract: > > http://www.att.net/general-info/terms.html > "AT&T reserves the right to block, filter or delete Unsolicited > E-Mails." > > While it doesn't explicitly state how they intend to "block, filter or > delete" spam, filtering port 25 by default can be reasonably construed > to fit that definition, and is therefore within the contract. > > Ths is also promising: > "don't send materials that contain viruses, worms, or any other > destructive elements; ... You may not use or attempt to use the Service > to violate its security or the security of systems accessible through > it, ... you should secure your computer equipment so that only > authorized users can gain access to your Service account." > > You could claim that these sections authorize blocking of QAZ et al, > since the activity of worms is prohibited. Also, customers are required > to secure their computers to prevent intrusion, so leaving any blatantly > insecure protocol like SMB enabled might be breach of contract. > Wholesale blocking of SMB might even be allowed. > > Of course, I wouldn't want to use that logic in court, but a good lawyer > could probably pull it off. I'd prefer to insert more specific wording > into the contract first. > > > The general expectation is for clear and open pipes. Put such > restiction > > into your contracts and you will lose customers. > > As long as a user can request the filters be removed (as in AT&T's > case), I doubt anyone will lose customers. In fact, I've seen many ads > for ISPs which promote their filtering service with the belief that it > will bring them more customers. > > > Don't put them in and start filtering anyway and you will lose > > court cases...big ones. > > If an ISP refuses to turn off unrequested filters, and the filters > aren't in the contract, I can see a lawsuit. I can also see the > customer simply taking their business elsewhere and persuing the matter > through the press. As AGIS proved, that turned out to be far more > effective than courts. > > Then again, nobody here seems to be suggesting mandatory filtering. Why > is there such a strong objection to opt-out filters, where a single call > or email can get the filters turned off? Is using a phone really that > difficult? > > S > > | | Stephen Sprunk, K5SSS, CCIE #3723 > :|: :|: Network Design Consultant, GSOLE > :|||: :|||: New office: RCDN2 in Richardson, TX > .:|||||||:..:|||||||:. Email: ssprunk(a)cisco.com > > > >

3 4

Does MERIT provide, "end-to-end", IPv4 Header Transport (IPv4HT)
by JIM FLEMING 21 Nov '00

21 Nov '00

http://www.merit.edu/ Merit Network, Inc. Michigan's Leading Internet Provider Does MERIT provide, "end-to-end", IPv4 Header Transport (IPv4HT) ....with the TOS field untouched ? Jim Fleming http://www.unir.com/images/architech.gif http://www.unir.com/images/address.gif http://www.unir.com/images/headers.gif http://www.ntia.doc.gov/ntiahome/domainname/130dftmail/unir.txt http://msdn.microsoft.com/downloads/sdks/platform/tpipv6/start.asp

2 1

Re: Out of band monitoring of equipment
by Scott Gifford 21 Nov '00

21 Nov '00

John Leong <johnleong(a)research.bell-labs.com> writes: > Curious if any operator uses, or have interest in using, out of band > network (e.g. modem, wireless etc.) for remote equipment (routers, > switches, HVAC etc.) monitoring over and above doing it in band on the > Internet. In past jobs, we have done this for both administration and some monitoring. For administration, we just used an old Annex3 terminal server as a serial connection mux. We plugged up to 64 serial cables into the consoles of various devices, and connected a modem to one of those serial cables. That worked really well. For monitoring, a team that I worked with had a machine that monitored the network and had a connection to a phone line to issue pages when things broke. I think these are both fairly common setups. Hope this helps, ------ScottG.

1 0

RE: ISPs as content-police or method-police
by Roeland Meyer 21 Nov '00

21 Nov '00

> From: Jason Slagle [mailto:raistlin@tacorp.net] > Sent: Tuesday, November 21, 2000 5:53 AM > > You basically have 3 choices here. > > 1) Filter known trojan ports to your customers (Which > argueably may or may > not include port 139) > > 2) Routinely scan your customer blocks and inform them of trojans they > could be infected with, and any open shares. > > 3) Do nothing and deal with the possible fallout which may > include turning > down the customers port, if they get compromised. > > Which do YOU view as the lesser of the evils here. > > Your arguing 1 isn't doable. 2 is possibly a no go, depending on the > contract and customer also, and 3 isn't very good either. There is a fourth that I'm surprised that only one or two of you picked up on (private mail). 4) Offer port filtering as an added premium service that adds to your revenue stream. That way it is customer choice. However, this only applies to access providers. Backbone providers don't have this option.

3 2

RE: ISPs as content-police or method-police
by Roeland Meyer 21 Nov '00

21 Nov '00

Please reference any suit regarding breach of contract. Examples abound. Port filtering may be construed as a material breach when the expectation is, that there is to be no port filtering. Access is access, even when the customer doesn't know that they are being restricted in their access. That just assures you that they will go ballistic when they find out. Face it guys, you KNOW that this is basically dishonest. As such, it is indefensible. I would almost bet <amount> that none of the transit providers mentions restrictions, on access, in their contracts. I would almost bet <1/2 amount> that NONE of the access providers mention same in THEIR contracts. The general expectation is for clear and open pipes. Put such restiction into your contracts and you will lose customers. Don't put them in and start filtering anyway and you will lose court cases...big ones. > -----Original Message----- > From: Shawn McMahon [mailto:smcmahon@eiv.com] > Sent: Monday, November 20, 2000 7:21 PM > To: nanog(a)merit.edu > Subject: Re: ISPs as content-police or method-police > > > On Mon, Nov 20, 2000 at 12:03:57PM -0500, Christian Kuhtz wrote: > > > > What doesn't make sense in that argument is why you > couldn't just simply > > upsell the customer to a managed fw solution etc if that's > the concern. > > Educate them, and let them decide based on the education > they received. > > Because it doesn't just affect them; it affects you, your customers, > and your business. > > > I wouldn't be so sure, particularly because of the legal exposure... > > Does anybody have a live example of this supposed legal exposure, to > counter all the many examples those of us who don't believe in it have > given? > >

6 5

RE: Server Monitoring
by Jeremy Furr 21 Nov '00

21 Nov '00

Another good monitoring tool is BigBrother, it can be found at www.bb4.com . A good site to check out for monitoring tools and other useful scripts and programs is www.freshmeat.net. Thanks Jeremy -----Original Message----- From: Jason Blakey [mailto:jblakey@playground.net] Sent: Tuesday, November 21, 2000 2:01 PM To: nanog(a)merit.edu Subject: Re: Server Monitoring You might want to check out netsaint... www.netsaint.org... very nice... we use it for monitoring our fair-size network, and i find it very robust and stable. Thanks, jason On Tue, 21 Nov 2000, Bora Akyol wrote: > > Does anyone out there have a set of scripts (or a commercial product) that is used to monitor a set of servers including sendmail, dns, etc and page/email people as necessary. > > I had written such a set of scripts a while back but that was too many years ago. > > Thanks > > Bora > > ---------------------------------------- Content-Type: text/html; name="unnamed" Content-Transfer-Encoding: quoted-printable Content-Description: ---------------------------------------- -- This email from Jason Blakey - jblakey(a)frogboy.net - www.frogboy.net "The luckiest man in the world"

1 0

IPv4HT - Re: Usage of IPv6 flow label
by JIM FLEMING 21 Nov '00

21 Nov '00

Thank you for your comment. In my opinion, there is a difference between a "service" and a bunch of routers, which may be in service or not. If the NANOG people want to focus on the "service" of having an end-to-end network with SIMPLE IPv4 (i.e. TOS not changed in transit)**, then they should be able to point out to people which companies (deploying the service, not building routers), abide by the policy of allowing a user to insert any 8 bit value into the IPv4 TOS field, and have that same value emerge on the other side of the cloud that NANOG claims to collectively "operate". Furthermore, I would think that companies engaged in deploying the "service" would want to make sure they point out to their customers that they provide, true, end-to-end, IPv4 IP Header Transport [IPv4HT]. (let's leave TCP and UDP out of this). I would also think that companies NOT providing this service would realize that there may be no motivation for those companies that do provide the service to deal with the headaches that non-conforming companies create. In short, they should stop routing to them. Also, I would think that the sales people from companies that DO provide IPv4HT, would want to point out to the current customers of those companies who do not, that they are using a NotWork, as opposed to a NetWork. As a service to the community, NANOG can easily run some tests to see which companies provide IP4HT and which do not. I have been personally surprised that some large companies, do not even know what their global policy is. As an aside, one could consider other fields of data communications, and consider what would happen if people walked up after the fact and "re-wrote the rules". Most people are probably familiar with 8-bit PCM voice streams, imagine an end-to-end "service" where for years people were able to get a clear-channel 8-bit PCM stream. Imagine, that everything worked fine, they place a 5 in one end and a 5 comes out the other end, they place the next sample, a 67 in one end and a 67 comes out the other. Now, imagine some equipment that comes along and randomly changes the 5 to a 6 or a 4, and the 67 to a 68 or a 66. Imagine what would happen if people had built software assuming a 5 in one end comes out a 5 at the other, not a 6 or a 4. Don't you think that network operators would come together and collectively realize that they have a major mess on their hands if they continue to change the values of the data stream that the CUSTOMER was told will be delivered, end-to-end, with a best effort, and not be changed from what the customer supplied ? There are not really that many bits in an IPv4 header. In my opinion, companies should FIRST focus on making sure they have a global cloud that can reliably transport the bits in the IPv4 header from "end-to-end". I think it is up to technologists to make sure that sales people know that they need to inform their customers that they provide IPv4HT, and if that differentiates them from another company that changes the customer's bits in transit, then so be it. At some point, it seems to me that we should be able to identify a collection of vendors who provide IPv4HT. For people that want IPv4HT service, I can not imagine why they would not want to use those vendors. Why by a "service" from companies who do not provide the service ? ** [Yes, folks...I know TTL and checksum change, please do not send me private mail describing your recent "ta-da" revelation, that those fields "change".] Jim Fleming http://www.unir.com/images/architech.gif http://www.unir.com/images/address.gif http://www.unir.com/images/headers.gif http://www.ntia.doc.gov/ntiahome/domainname/130dftmail/unir.txt http://msdn.microsoft.com/downloads/sdks/platform/tpipv6/start.asp ----- Original Message ----- From: Thomas Eklund <thomas.eklund(a)xelerated.com> To: 'JIM FLEMING' <jfleming(a)anet.com>; 'Jim Bound' <bound(a)zk3.dec.com>; 'Alex Conta' <aconta(a)txc.com> Cc: 'Steve Deering' <deering(a)cisco.com>; 'Michael Thomas' <mat(a)cisco.com>; 'Francis Dupont' <Francis.Dupont(a)enst-bretagne.fr>; 'Jun-ichiro itojun Hagino' <itojun(a)iijlab.net>; 'Hesham Soliman (EPA)' <Hesham.Soliman(a)ericsson.com.au>; 'Metzler Jochen' <Jochen.Metzler(a)icn.siemens.de>; 'Ipng (E-Mail)' <ipng(a)sunroof.eng.sun.com>; <bound(a)zk3.dec.com> Sent: Tuesday, November 21, 2000 10:27 AM Subject: RE: Usage of IPv6 flow label > > In my opinion, the IPv4 TOS should also be "e-2-e"... > > ...clients should set it....routers should leave it alone.... > > IPv4 ToS or IPv6 Traffic Class field is 8 bits and today most routers use 6 > bits for them for diffserv (DSCP) and then it is per defintion PER hop > behaviour and having possibility to re-write it at ingrees/egress router to > your domain > .. > > -- thomas > > > -------------------------------------------------------------------- > IETF IPng Working Group Mailing List > IPng Home Page: http://playground.sun.com/ipng > FTP archive: ftp://playground.sun.com/pub/ipng > Direct all administrative requests to majordomo(a)sunroof.eng.sun.com > -------------------------------------------------------------------- >

2 4

RE: ISPs as content-police or method-police
by Hank Nussbacher 21 Nov '00

21 Nov '00

At 09:42 20/11/00 -0800, Roeland Meyer wrote: >No, we cannot all agree to that. I cannot condone anyone else applying their >ideology, by force or default, on someone else, unless specifically >requested. As a downstream customer, the backbone is nearly unreachable from >a services perspective. If CERFNET started to do port-filtering then the >only means I (I assume that everyone here has sufficient clue to find my >upstream) have to change that is to either sue CERFNET or start looking for >an ISP that has a different backbone provider. CERFNET tech support will not >even talk to second or third level customers. In essence, it eliminates the >secondary re-seller market from contention. You risk getting sued, not only >from the downstream customer, but your own downstream as well. > >The ONLY one that should be even dreaming about doing something like this is >the direct upstream to the leaf nodes, and then ONLY with permission. >Otherwise, no ports should ever be filtered by any transit provider. Do you block traffic to broadcast addresses (inbound or outbound) - .255? Do you rate limit (CAR) ICMP or SYNs at your border routers? If so, you too are doing content filtering. Part of your AUP should be a full disclosure of what you block or rate limit and then let the customer ask for it to be opened. Your definition of content filtering is just one of many. Any blocking of *any* bit of IP data flow is some form of content filtering. In the end it comes down to a subjective analysis of what each ISP considers harmful traffic that can be used to disrupt their network. This differs from true content filtering (sex, hate, terrorism, etc.) and should therefore be renamed 'harmful network data' filtering. -Hank >By God, we PAY for open pipes and there are standard remedies when we don't >get what we pay for.

3 2