- NANOG - lists.nanog.org

System and Network Monitoring
by Derek Balling 17 Dec '98

17 Dec '98

OK, I'm looking for "real world" data and not sales/marketing hype. I'm looking for a package to do network and system monitoring. It's a heterogenous environment consisting of all manner of routers, at least 700 servers (Mostly FreeBSD, but also Solaris and Network Appliance boxen). Requirements: 1.) Must support FreeBSD (obviously, its the platform of probably about 98% of the servers) 2.) Must scale well. Today we have (at best guess given by management) "somewhere between 500 and 1000 servers", but that number grows daily. Operations adds about 4-5 servers a week at the present time. 3.) Must support the ability to provide checks on custom situations (e.g., an external program which checks the output from an e-commerce server to check that the pricing/qty/etc. is accurate and not stale or outdated) 4.) Must provide a flexible escalation method including e-mail and paging. 5.) Provide a nice interface to quickly find and troubleshoot problems. Preferably this would be X based, so that the server itself could reside in our server rooms, exporting the display to whomever had a need to watch the network/servers, or troubleshoot their particular corner of the world. I know this product has to exist, but I've only so far found one product that claims to be able to do all of that (HP OpenView). I'm not against HP, but I'd like to have some more options than what I currently have available to me. Replies probably should be made off-list (and if anyone wants me to, I'll happily summarize to the list what I get). Thanks in advance. ====================================================================== Derek J. Balling | "Bill Gates is a monocle and a white dredd(a)megacity.org | fluffy cat from being a villain in the http://www.megacity.org/ | next Bond film." - Dennis Miller ======================================================================

3 2

Re: System and Network Monitoring
by Dean Anderson 16 Dec '98

16 Dec '98

I use OpenView 4 now have for several years (since Openview 3). It was the best thing going for a while anyway. The best/worst thing about OpenView is using vendor equipment management modules that only work with openview. Or HP LanProbes and such. These tend to be huge worksavers, if you can somehow accomodate the security limitations (or use oob sets, etc) At least, they used to be. Now, I'm not so sure. Instead of using snmp to actually change configuration, I am now mostly using it to monitor what's going on, and react to snmp traps when they are sent. Frankly, I don't think snmp monitoring is all that hard. OpenView is still incredibly expensive, and very difficult to buy. I think the freeware alternatives are just as good, and possibly better in some cases. But it depends though on what you are going to do. I'd check into mrtg and scotty first, and then look at OpenView. They also work on freebsd... --Dean At 02:52 PM 12/16/1998 -0600, Tim Salo wrote: >> Date: Tue, 15 Dec 1998 16:48:06 -0800 (PST) >> From: Derek Balling <dredd(a)megacity.org> >> To: nanog(a)merit.edu >> Subject: System and Network Monitoring >> >> OK, I'm looking for "real world" data and not sales/marketing hype. >> >> I'm looking for a package to do network and system monitoring. It's a >> heterogenous environment consisting of all manner of routers, at least 700 >> servers (Mostly FreeBSD, but also Solaris and Network Appliance boxen). >> [...] > >I would be interested to hear about your comparison of a commercial >package such as HP OpenView with free alternatives. > >My inclination is towards a commercial package. I even suspect that it >would be less expensive in the long run, plus it seems likely to free >up your technical talent for revenue-producing activities. > >-tjs > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

'best'
by Bill Becker 16 Dec '98

16 Dec '98

Is anyone else seeing this crap from best.com besides me? I complained to them last time and received no reply. So i decided to filter parts of them and it's looking like i did the right thing. Here are a few entries from 209K of ejectamenta. Someone checked through an entire /19 for a place to login. Dec 12 18:32:02 139o-4700 105: Dec 12 18:32:01: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.86.7.91(4783) -> 207.171.128.1(23), 1 packet Dec 12 18:32:06 139o-4700 106: Dec 12 18:32:05: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.86.7.91(4791) -> 207.171.128.9(23), 1 packet Dec 12 18:32:09 139o-4700 107: Dec 12 18:32:08: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.86.7.91(4800) -> 207.171.128.18(23), 1 packet Dec 12 18:32:13 139o-4700 108: Dec 12 18:32:12: %SEC-6-IPACCESSLOGP: list 101 denied tcp 206.86.7.91(4807) -> 207.171.128.25(23), 1 packet ...etc. Annoying. Bill

6 8

Re: System and Network Monitoring
by Tim Salo 16 Dec '98

16 Dec '98

> Date: Tue, 15 Dec 1998 16:48:06 -0800 (PST) > From: Derek Balling <dredd(a)megacity.org> > To: nanog(a)merit.edu > Subject: System and Network Monitoring > > OK, I'm looking for "real world" data and not sales/marketing hype. > > I'm looking for a package to do network and system monitoring. It's a > heterogenous environment consisting of all manner of routers, at least 700 > servers (Mostly FreeBSD, but also Solaris and Network Appliance boxen). > [...] I would be interested to hear about your comparison of a commercial package such as HP OpenView with free alternatives. My inclination is towards a commercial package. I even suspect that it would be less expensive in the long run, plus it seems likely to free up your technical talent for revenue-producing activities. -tjs

1 0

heads up ... another imapd attack source
by Phil Howard 16 Dec '98

16 Dec '98

Just a few minutes ago, another attempted IMAPD breakin. This one originated from rock.careers.csulb.edu [134.139.149.100]. It was logged at Dec 14 16:59:56 CST.

10 11

Re: heads up ... another imapd attack source
by Roeland M.J. Meyer 15 Dec '98

15 Dec '98

At 04:54 AM 12/15/98 , Dave Crocker wrote: >At 05:17 PM 12/14/98 -0800, Roeland M.J. Meyer wrote: >>FYI: Not that I sell shell accounts anyway, but I additionally block all >>non-http access, from *.EDU, with tcp_wrappers and my POP3 is wrapped up in >>SSH. IMAPD was shot and buried(deleted) a long time ago. > >this means that any user who is traveling, and happens to try to get their >mail while accessing from a .edu site won't be able to pick it up. Only if they are accessing mail on MHSC systems, from an *.EDU dial-up. There are other dial-up options and MHSC has direct dial-up ports available. Also, we do allow VPN tunnels from *.EDU, but only to directed hosts with no routing and on advanced arrangement. The user that does so, does it under our TOS and AUP. >since imap popularity is growing, lack of imap service is also problematic. It's balance of problems. We consider the rootkit risk more severe than the loss of business from *.EDU sites. We have secure POP3 and Web-based (SSL) mail, we are investigating POP3 over SSL. Those services are allowed to *.EDU, from MHSC. As has been shown by others, IMAPD attacks are on the rise. It would not do for a security advocate to get rootkit'd, just think of the publicity <grin>. It's one of the things that keep me up at night. Many of the vulnerable systems are in *.EDU, as has already been shown to my satisfaction. Granted, MHSC has always viewed *.EDU is a huge potential security risk. That is an unapologized bias on our part. It is the nature of the beast. When the reference code, for IMAPD, becomes better written, or we (MHSC) re-write it ourselves, we will reinstantiate the IMAPD service. Until then, it remains dead. A current example is a spammer that I've been tracing for weeks. They always come from a different host, but it's obviously the same guys, they are very good. Many of the relays they use have been root'd. The latest one I've found is at sun.soci.niu.edu. So a SAINT run against it yourself and see how vulnerable they are. If they aren't root'd now, they soon will be, IMHO. I am quickly gaining the unsupported suspicion that spammers may be behind many of the IMAPD attacks. They are looking for hosts to send their spew from. Note that this *is* an unsupported view/suspicion, I claim no solid evidence. _________________________________________________ Morgan Hill Software Company, Inc. Roeland M.J. Meyer, ISOC (RM993) President and CEO. e-mail: <mailto:rmeyer@mhsc.com>mailto:rmeyer@mhsc.com Web-pages: <http://www.mhsc.com/~rmeyer>http://www.mhsc.com/~rmeyer Web-site: <http://www.mhsc.com>http://www.mhsc.com Colorado Springs, CO - Livermore, CA - Morgan Hill, CA -----------------------------------------(legal notice)-------- Note: Statements made in this message do not necessarily reflect the position of MHSC. All forcasts and projections are to be considered as forward-looking and presume conditions which may not be referenced herein. -----------------------------------------(/legal notice)-------

2 1

NANOG 15 Hotel
by Pam Ciesla 15 Dec '98

15 Dec '98

Possible hotel shortage in Denver for NANOG 15. The hotel people informed me that they have several meetings going on at the same time as NANOG 15. If you are planning on attending the NANOG 15 Meeting in Denver book your hotel early. The room block for NANOG is available until January 8, after that it's on space available only. Hotel and other info can be found on the NANOG webpage http://www.nanog.org. Any questions please contact me. Thanks Pam Pam Ciesla Merit Network,Inc. 734-936-0172 - phone 4251 Plymouth Road 734-647-3185 Bldg.I, Suite C pam(a)merit.edu Ann Arbor, MI 48107

1 0

Anyone on this list from Australia?
by Pete Kruckenberg 15 Dec '98

15 Dec '98

Or are you familiar with ISPs in Australia? If so, would you please contact me privately so I might ask you a few questions about ISPs there? Thanks. Pete.

1 0

The Path to Fame and Riches -- NANOG Summer'99 Host
by Craig Labovitz 15 Dec '98

15 Dec '98

We are still looking for a NANOG Summer (sometime during the beginning of June'99) host. The main responsibilities of the host include: * Provide connectivity to the conference site (at least a T1) * Help provide ~10 PC/Macs and a printer for the terminal room (terminal room equipment is also often donated) * Provide staff to help with local logistics (e.g. identifying hotels) and conference setup (mainly wiring the terminal room and hubs in the conference room) All hotel costs (catering, lighting, room rental, cookies, etc.) are covered by the NANOG registration fees. In addition, the conference room hubs and wireless equipment are usually donated equipment (and some are owned by NANOG). The benefits of NANOG hosting include: * Reduced travel expenses for your staff to attend NANOG * Your company name forever engraved on the official NANOG t-shirt * Life-time, official membership in NANOG * Fame and riches Please send email to nanog-support(a)nanog.org if you are interested in hosting a future NANOG. - Craig -- Craig Labovitz labovit(a)merit.edu Merit Network, Inc. http://www.merit.edu/~labovit 4251 Plymouth Road, Suite C. (734) 764-0252 (office) Ann Arbor, MI 48105-2785 (734) 647-3185 (fax)

1 0

Spaghetti routes.
by Roeland M.J. Meyer 14 Dec '98

14 Dec '98

I seem to be getting one hell of a lot of hops between here and Toronto. It looks like they have a serious case of spaghetti routing in cerf.net. Does anyone know what's up? > ~ > traceroute www.mhsc.com >traceroute to falcon.lvrmr.mhsc.com (199.108.175.225), 30 hops max, 40 byte packets > 1 209.82.43.1 (209.82.43.1) 2.344 ms 2.176 ms 2.160 ms > 2 172.17.18.177 (172.17.18.177) 4.429 ms 4.436 ms 4.284 ms > 3 207.245.35.65 (207.245.35.65) 4.334 ms 4.411 ms 4.647 ms > 4 205.150.154.141 (205.150.154.141) 4.563 ms 13.403 ms 13.971 ms > 5 f000-10.bb2.tor2.f000-10.bb1.tor2.uunet.ca (205.150.242.109) 37.502 ms 190.594 ms 17.974 ms > 6 224.Atm4-0-0.GW3.NYC4.Alter.Net (137.39.75.21) 17.302 ms 18.527 ms 17.855 ms > 7 140.ATM2-0.XR1.NYC4.ALTER.NET (146.188.179.146) 17.266 ms 17.609 ms 22.412 ms > 8 189.ATM3-0.XR1.NYC1.ALTER.NET (146.188.178.86) 18.167 ms 19.935 ms 27.089 ms > 9 195.ATM11-0-0.BR1.NYC1.ALTER.NET (146.188.177.153) 20.739 ms 29.381 ms 34.891 ms >10 atm12-0.nyc-bb2.cerf.net (134.24.32.49) 24.081 ms 21.021 ms 19.815 ms >11 pos2-0-155M.nyc-bb4.cerf.net (134.24.29.162) 19.283 ms 22.170 ms 21.047 ms >12 pos12-0-0-155M.nyc-bb3.cerf.net (134.24.29.165) 20.439 ms 20.227 ms 20.116 ms >13 atm3-0-155M.phl-bb1.cerf.net (134.24.46.9) 549.826 ms 559.131 ms 507.581 ms >14 pos4-0-0-155M.nyc-bb1.cerf.net (134.24.46.169) 455.182 ms 454.303 ms 471.459 ms >15 atm9-0-3-155M.san-bb1.cerf.net (134.24.29.45) 1267.546 ms 1257.430 ms 1138.974 ms >16 pos0-0-155.san-bb6.cerf.net (134.24.29.130) 418.926 ms 410.702 ms 434.318 ms >17 atm6-0-622M.lax-bb4.cerf.net (134.24.29.142) 425.456 ms 362.121 ms 364.302 ms >18 pos3-0-0-155M.lax-bb1.cerf.net (134.24.29.133) 1190.588 ms 1130.962 ms 1180.913 ms >19 atm3-0-155M.sfo-bb1.cerf.net (134.24.29.42) 340.919 ms 297.623 ms 285.305 ms >20 fe9-0-0.sfo-bb2.cerf.net (134.24.29.118) 282.859 ms 287.957 ms 300.554 ms >21 atm3-0-155M.sjc-bb3.cerf.net (134.24.29.22) 337.961 ms 396.046 ms 412.056 ms >22 199.108.168.1 (199.108.168.1) 1133.342 ms 1299.682 ms 1149.291 ms >23 199.108.168.51 (199.108.168.51) 380.942 ms 307.255 ms 301.474 ms >24 falcon.lvrmr.mhsc.com (199.108.175.225) 309.010 ms 298.941 ms 309.333 ms > ___________________________________________________ Roeland M.J. Meyer - e-mail: mailto:rmeyer@mhsc.com Internet phone: hawk.lvrmr.mhsc.com Personal web pages: http://staff.mhsc.com/~rmeyer Company web-site: http://www.mhsc.com ___________________________________________________ Who is John Galt? - "Atlas Shrugged" - Ayn Rand

1 0