- NANOG - lists.nanog.org

Maintenance modems and power failures
by Sean Donelan 10 Feb '99

10 Feb '99

Hopefully some people will find this related to the operations of their network. Ah, maintenance modems. Why do they always seem not to work just at the moment you need them. PG&E released their report on the San Francisco power outage in December. Most of it was the information previously reported. One interesting thing was PG&E lost access to three of their SCADA remote monitoring units because the modems were plugged into utility power instead of a UPS. Most network providers are aware of the secret hiding in most of our POPs. Those little sporters and courier modems stuffed into a rack somewhere plugged into the nearest available outlet, as the only out-of-band access. Has anyone come up with a solution for powering these forgotten pieces of equipment, which doesn't cost more than the modem itself? At first you might think it makes sense to power them off the UPS which is powering the rest of your equipment. The only problem is if you are using the maintenance modem to monitor your UPS. This is just one of those things which has bugged me for a few years, but I still haven't come up with a solution I really like. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

2 1

ping plot tool
by Vadim Antonov 10 Feb '99

10 Feb '99

Hi, for some reason i needed a prettily plotted PostScript output for the all-too-familiar ping, so i spent a few hours yesterday to write a filter. If you need one too, here it is: http://www.civd.com/~avg/ping.tar.gz (it was tested only under RedHat Linux, but there's no reason why it shouldn't work everywhere). I think Sprint folks will find the kludge's output to be quite familiar :) Cheers, --vadim

2 1

"How to assess your ISP's security policy" article
by Martin Cooper 10 Feb '99

10 Feb '99

For those of you that have not already seen it, I thought you might be interested to read my article published in Network Week (UK) today, "How to assess your ISP's security policy". You can find it in the RTFM section. Flames etc. to /dev/null please - I realise this article may not go down well with all service providers if their security needs some work - a possibility for which I make no apologies! Regards, Martin -- Martin Cooper <m.j.cooper(a)ucs.cam.ac.uk> /* Statements made above are my Network Systems Group, Network Division own and not those of the University Computing Service, Cambridge University Computing Service */

1 0

Multiple BGP sessions between the same router pairs at IXPs
by Alex Bligh 10 Feb '99

10 Feb '99

Anyone feel like sanity checking this for me: As far as I know, if you have this config RTRA BGP ID 4.4.4.4 ASN 4 2.2.2.4 / \ 3.3.3.4 2.2.2.0/24 | | 3.3.3.0/24 2.2.2.5 \ / 3.3.3.5 RTRB BGP ID 5.5.5.5 ASN 5 and you configure on router A router bgp 4 neighbor 2.2.2.5 remote-as 5 nieghbor 3.3.3.5 remote-as 5 and on router B router bgp 5 neighbor 2.2.2.4 remote-as 4 nieghbor 3.3.3.4 remote-as 4 then only one peering session will come up, as routers only support one BGP session with any given router ID. We hit this problem when renumbering the LINX, I think, in that you have to make sure you take down old sessions to get new sessions to work. This would also affect people who set up new peerings over the ATM MAE's, who also have existing peerings on the FDDI fabric between the same routers, right? -- Alex Bligh GX Networks (formerly Xara Networks)

3 2

Huh? Too early for this.
by alex＠nac.net 10 Feb '99

10 Feb '99

Network Next Hop Metric LocPrf Weight Path *>i2.52.228.144/32 209.83.160.97 100 0 6347 1239 i [root@netflow /root]# whois -h rs.arin.net 2.0 Internet Assigned Numbers Authority (IANA) (RESERVED) (NET-RESERVED-2) 10 sl-bb2-chi-4-0-0.sprintlink.net (144.232.0.142) 38.508 ms 48.093 ms 42.923 ms 11 144.228.252.11 (144.228.252.11) 93.257 ms 42.579 ms 95.072 ms 12 sl-paterno-2-0-128k.sprintlink.net (144.228.52.2) 99.467 ms 105.426 ms 115.518 ms 13 sl-gw11-chi-9-1-TS5-128k.sprintlink.net (144.228.52.1) 50.118 ms 41.066 ms 41.413 ms I'd be curious to know if this is the source of any spam. Hrm. Wait. Looking at 2.52.228.144 in the mirror = 144.228.52.2 [root@netflow /root]# whois -h rs.arin.net 144.228 Sprint (NET-SPRINT-INNET5) Government Systems Division 13221 Woodland Park Road Herndon, VA 22071 Netname: SPRINTLINK Netnumber: 144.228.0.0 What the hell is this? -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP; we have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

2 1

SMURF Detector Software
by prue＠ISI.EDU 10 Feb '99

10 Feb '99

Hi, I, as many of you have had to deal with various types of denial of service attacks or other attacks. A good number of these attacks can be characterized by one host sending to many destinations, many hosts on one subnet sending to one destination, one host sending to very similar or the same IP address (host/port scans) etc. Confronted with detecting this to warn my customers if they are victims, or admonish my customers if they are the culprits, I wrote a tool to give me some indication when this kind of thing is going on, while it is still happening using netflow data. I modified Ciscos' fdget program they make available on one of their ftp sites to look for self similar source or destination addresses in netflow data blocks. Thanks go to Cisco for leting me distribute this to the group. You can give it a try if you want. It is avaliable via anonymous ftp on venera.isi.edu in subdirectory mon. The file names you will need to know to retrieve by name are: smurfind.c C program README.smurfind documentation flowdata.h C program definitions (written by cisco folks) smurfind.rc sample data file You can't do an ls on the directory. I used version 5 netflow data to debug the code. I haven't tested it against version 1 or other versions. B.T.W. The program dumps legitimate data as suspect. If however the rate at which the program shows suspect data changes, that is when you need to look more closely. The output from the program is very valuable to confront the guilty party to demonstrate that something inapropriate is going on. Let me know what you think. Walt Prue Los Nettos

2 1

Discussing, or not discussing, major business outages
by George Herbert 10 Feb '99

10 Feb '99

I am not going to name names, but I have it on good authority that late this week a large hosting provider went out of business abruptly. So far, the news that it did so has not been discussed anywhere, that I can tell, which is starting to disturb me. There have been some significant dislocations related to this shutdown, obviously, and this sort of event seems to me to be something that involved parties should be at least sending warnings out on nanog or other appropriate discussion lists. I and a third party ISP executive discussed this lack of discussion some yesterday; their opinion is that businesses and ISPs formerly hosted at the now defunct site are loath to admit their connecitvity is down lest their customers defect en masse causing a snowball of business failures, when they will be up and stable via new providers shortly and are not themselves fundamentally unsound. I understand that logic but cannot entirely agree with it. I would like to see the issue discussed in general terms at least; what is appropriate for notifications, what are fair responsibilities to customers, the public, other ISPs etc. in terms of this sort of event. -george william herbert gherbert(a)crl.com I am not employed by, and do not speak for, CRL.

10 15

Re: info
by hypnotherapy254＠biocentricb.net 09 Feb '99

09 Feb '99

ACCEPT CREDIT CARDS ONLINE! INCREASE YOUR PROFITS! GO HERE--> http://www.merchantonline.com or http://www.creditco.com

1 0

ADMIN: reminder about posting procedures
by John Hensley 09 Feb '99

09 Feb '99

Hello everyone, There've been a ton of bounces because of this lately, so here's a reminder that to send mail to nanog(a)merit.edu, you need to be subscribed to nanog-post(a)merit.edu. See http://www.nanog.org/email.html. Another document to review while you're thinking of posting, especially in the wake of the "spam whore" fiesta, is the charter of this list, at http://www.nanog.org/aup.html. -- John Hensley <hensley(a)merit.edu> Merit Network, Inc.

1 0

FIBER CUT: South Bend Indiana
by Sean Donelan 09 Feb '99

09 Feb '99

MCI/Worldcom is reporting a fiber cut in South Bend Indiana as of 4:00pm CST 9-FEB-1999. Customer service recordings say techs are en-route. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0