January 1999 - Test - lists.nanog.org

RE: flow export stuff
by Barry Raveendran Greene 05 Jan '99

05 Jan '99

Ticket Number: ECRC-TT-0005859 Ticket Status: Open Ticket Type: Problem Site/Line: Ticket Scope: Customer Problem Started: Ticket Owner: ECRC NOC Ticket Opened: 1998.12.14 10:19 Ticket Source: ECRC Network Services Down Time: Problem Fixer: noc(a)ecrc.de Problem Ended: Ticket Priority: Medium Ticket Closed: Hello Alex, I've attached the answer I usually send out in Asia. If you hear of anymore tools, please let me know and I'll add them to the list. My usual advice to ISPs is to start with cflowd (the new CAIDA version) and NetFlowMet. In fact, CAIDA is looking for a site to try the new version of cflowd on a LINUX box - hint hint ;-) Barry ======================= General Information page for Cisco Netflow services --------------------------------------------------- http://www.cisco.com/warp/public/732/netflow/ Cisco's NetFlow FlowCollector v2.0 and NetFlow FlowAnalyzer v2.0 ---------------------------------------------------------------- http://www.cisco.com/warp/public/732/netflow/netan_ov.htm 3rd Party Solutions ------------------- Belle Systems http://www.belle.dk Solect http://www.solect.com XACCT Technologies http://www.xacct.com Apogee Networks, Inc. http://www.Apogeenet.com RODOPI http://www.rodopi.com Joint press releases between 3rd Party vendors and Cisco: + Cisco Systems and Solect Technology Group Provide Usage Based Billing Solution http://wwwin.cisco.com/Mkt/cc/corp/mkt/pr/solec_pr.htm + Cisco Systems and Belle Systems Develop Billing System http://wwwin.cisco.com/Mkt/cc/cisco/mkt/servprod/gen/bell_pr.htm Bottom-up develop tools and scripts can be found at: NETRAMET/NETFLOWMET The old one and one of the best for TCP/IP flow analysis. NetFlowMet is a version of the Unix NeTraMet. It's an RTFM meter which takes its data from a Cisco router using Cisco's NetFlow data. We used NeTraMet by many ISPs using a simple on an Intel PC with BSD UNIX and a Digital FDDI card. The results are dumped to a box that did all the flow analysis and posted the results on an internal Web server. http://www.auckland.ac.nz/net/Accounting/ntm.Release.note.html CFLOWD cflowd is a package for collecting data from Cisco's flow-export. Its primary motive is collection of data for capacity planning and similar activities in a network service provider environment. However, it can been used effectively in other areas, including usage tracking for Web hosting as well as security-related investigation activities. This tool was developed by our customers for their own use. It is free and located at: http://www.caida.org/Tools/Cflowd/ Other scripts based on cflowd are located at: http://engr.ans.net/cflowd/index.html http://buckaroo.xo.com/CFLOWD/ The key Cisco documents on NetFlow are constantly updated (because we are adding new features and functionality all the time). Do a keyword search on CCO to find all the documentation on NetFlow. NetFlow tools (flowdata.h, fdrecorder.c, fdplayback.c, fdg.c) that were used to build cflowd are located on the Cisco's FTP site: ftp://ftp-eng.cisco.com/ftp/NetFlow/fde/README > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > alex(a)nac.net > Sent: Monday, November 30, 1998 9:56 AM > To: nanog(a)merit.edu > Subject: flow export stuff > > > > I asked this a while ago. > > I asked if anyone knew of any good cisco netflow flow collection and > analyzation tools. > > I played with cflowd, and while archaic, it did work. > > So, todays question is, is there anything new/gooder/faster that anyone > knows about? > > > -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- > Atheism is a non-prophet organization. I route, therefore I am. > Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member > Father of the Network and Head Bottle-Washer > Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 > Don't choose a spineless ISP; we have more backbone! http://www.nac.net > -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- > > ------------- End Forwarded Message -------------

1 0

Please be nice... (Was Re: Exodus?)
by David Diaz 05 Jan '99

05 Jan '99

Gentlemen, In the last 6 weeks I have noticed a major drop off in nanog postings. Im not complaining as we all know how many posts we go a day. Recently I almost miss the number of posts :). What I am a great deal concerned about is that a request numerous times to "watch what you post" as well as scoldings on the list have made people gunshy. I for one would rather have someone concerned about an outage post it. It may just be the one network such as exodus or it may be related to a large problem and concern several backbones. I have found that the NANOG list often has better and quicker information during an outage then many telcos. Maybe the exodus post was or was not off topic. But I'd rather see that then a bunch of posts discussing whether or not it was on/off-topic. As for on-topic maybe we could now start a few threads on backbone issues. So with the holiday spirit I say just be just a "little" kind... David At 5:59 PM -0500 1/3/99, Chris Mauritz wrote: >Personally, I think it's useful to report outages with any outfit that meets >the nebulous moniker of "Tier 1" provider as it can have far reaching >consequences. While it's still important to contact the affected network's >NOC, I don't see how it's out of line to post a short note about it here. >I'd certainly value that a lot more than the Alistat circle jerkage and I >suspect it wouldn't add a lot of traffic to the list. > >Chris > >Chris Mauritz >Director, Systems Administration/Network Engineering >Rare Medium, Inc. >chrism(a)raremedium.com > > > >-----Original Message----- >From: Derek Balling >To: Stephen Stuart >Cc: nanog(a)merit.edu >Sent: 1/3/99 5:24 PM >Subject: Re: What is NANOG used for? (Was Re: Exodus?) > >>In the last week, there have been discussions of telco issues (the >>"DACS failure" thread) and tools (the "System And Network Monitoring" >>thread) that seem to have been generally received as on-topic. > >But why WAS the System and Network Monitoring thread on-topic? As the >"creator" of that topic, I'd like to think it was, but in reality, all >it >would really "affect" is a single provider. Asking how someone else >monitors their internal network is very similar to asking someone how >they >configure their DNS server. > >I'm not saying that you're WRONG. My point here is that we really don't >have any clear-cut guidelines. The old adage about "if I can't program >it >into my router, its not valid" would certainly flunk out the Monitoring >topic, that's for sure, since the main thrust of the request was how to >monitor individual servers (albeit about a thousand of them). > > >>I'd MUCH prefer two meaningful messages to a dozen complaints from >>people who don't know how to contact a NOC or configure DNS. > >Agreed. I'd much prefer low-volume-high-signal to the opposite. > >I just think we have a "charter" as it were that is a little too vague, >and >leaves too much up for debate as to what is on/off-topic. > >I mean, you can state what you did about what you think is on/off-topic, >and I might agree with you, but the charter is much more vague, and >leads >itself to ambiguity. > >I hate rules and regulations as much as the next guy, but I think it >needs >to be spelled out somewhere much more clearly than it already is. That's >all. > >My point wasn't to claim that the Exodus topic necessarily WAS on-topic, >but that there's nothing that clearly states it WASN'T. Ya follow? > >D Thank you, David Diaz Chief Technical Officer Netrail, Inc email: davediaz(a)netrail.net pager: 888-576-1018 office: 888-NETRAIL Fax: 404 522-2191 Colo facilities: Atlanta-NAP, Miami, Arlington, Chicago, San Francisco -------------------------------------------------

6 5

RE: Cisco config checker
by S.J.Brannon 05 Jan '99

05 Jan '99

The problem we have with this product is the support features. First it was no OSPF only EIGRP, then OSPF but no virtual links. Virtual links would be needed to solve OSPF area connectivity problems that this tool would find. Then it was no BGP, or BGP but no confederations, route reflectors. Now I need multi point GRE tunnels and NHRP. This product could save me a lot of time in a lab with a lot of Cisco boxes connect together You are write a product reflects what some one else thinks you need, a tool kit lets you build what you need. We have suggest to Cisco that if this tool is to be usable it must be in step with the IOS releases and regression tested. A AI prof I know said "the only real model of the real world is the real world" This tool can never tell if the real network will work ---------- From: Alex P. Rudnev[SMTP:alex@Relcom.EU.net] Sent: Monday, January 04, 1999 17:16 To: Lawrence A. Deleski Cc: nanog(a)merit.edu Subject: Re: Cisco config checker It's good product, but (1) it's expancive, and (2) we do not need product, we does need tools to build our own systems. On Sun, 3 Jan 1999, Lawrence A. Deleski wrote: > Date: Sun, 03 Jan 1999 23:55:04 -0700 > From: Lawrence A. Deleski <lad(a)inficad.com> > To: Pete Kruckenberg <pete(a)kruckenberg.com> > Cc: nanog(a)merit.edu > Subject: Re: Cisco config checker > > Pete, > > Take a look at: > > http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/netsys/index.htm > > ...for the connectivity tools and ... > > http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/netsys/nt/index.htm > > ...for the Baseliner tools. > > The Netsys Connectivity and Baseliner tools may have the features you're > looking for. Verification of Cisco configs is a feature of the tool. > > /lad > > > >Is there such a thing as a Cisco config checker, to allow off-line editing > >of Cisco configs and check them before they're uploaded to the router? > >Preferrably something that could be used in a Web/Unix environment as a > >filter. > > >Pete > Aleksei Roudnev, Network Operations Center, Relcom, Moscow (+7 095) 194-19-95 (Network Operations Center Hot Line),(+7 095) 239-10-10, N 13729 (pager) (+7 095) 196-72-12 (Support), (+7 095) 194-33-28 (Fax)

3 2

Re: Please be nice... (Was Re: Exodus?)
by Lawrence A. Deleski 05 Jan '99

05 Jan '99

>Not to mention even the Exodus post was relevant to some of us smaller >operators. By listening to the threads ... > ...personally I find that very relevant to my current and future network operations. > >Tim Agreed, but the question remains whether threads like the one I posted (Exodus) or ones similar to that have a place on NANOG. After all that I'm not so sure. Threads on NANOG usually deal with issues that affect *all* providers globally, not just one. Randy summed it up nicely in three or four bullet points last night, which I won't repeat here, but if you read his email you'll get the point. I went way out of my way last night to give Randy Bush and at least one other person a hard time about this while all along they were right. For this I would like to publicly apologize to them both, as well as anyone else I may have tweaked. All you have to do is read the NANOG Charter & AUP (which I did) and then lurk around here for awhile to see what *does* get discussed here and you quickly (not quickly enough for me) come to the conclusion that posts like the Exodus post do not really fit into this list as well as they would in other places. /lad

2 1

'nic whois warning
by Rodney Joffe 05 Jan '99

05 Jan '99

Be cautious if you're relying on the nic's whois servers... Consecutive queries of the same domain are showing update dates of Database last updated on 1-Jan-99 03:27:16 EST. thru Database last updated on 4-Jan-99 03:35:21 EST. /rlj

4 4

Re: Cisco config checker
by Enke Chen 04 Jan '99

04 Jan '99

Hi, Randy: > when given a new configuration, > does not thrash all your bgp sessions etc., but slides smoothly to the new > state. We have fixed several bugs related to several BGP commands that would cause unnecessary reset of BGP sessions. If you find any new bugs in this area, please let us know and we will fix them. Thanks. -- Enke > ------- Forwarded Message > > Date: Mon, 04 Jan 1999 07:20:55 -0800 > From: Randy Bush <randy(a)psg.com> > To: "Alex P. Rudnev" <alex(a)Relcom.EU.net> > cc: nanog(a)merit.edu > Subject: RE: Cisco config checker > > for two+ years, i have been asking cisco for a simple text-based tool that > can take two configs and generate the command set to get from the first to > the second. i.e. a semantic differ. > > as syntax (and occasionally semantics) changes release to release, a version > of the code would have to come with each image set. > > note that this would go a way to compete with the really nice behavior of > gated-like systems, e.g. juniper, which, when given a new configuration, > does not thrash all your bgp sessions etc., but slides smoothly to the new > state. > > randy > > ------- End of Forwarded Message >

1 0

Re: Cisco config checker
by Tony Tauber 04 Jan '99

04 Jan '99

On Jan 4, 7:20am, Randy Bush wrote: > Subject: RE: Cisco config checker > for two+ years, i have been asking cisco for a simple text-based tool that > can take two configs and generate the command set to get from the first to > the second. i.e. a semantic differ. > > as syntax (and occasionally semantics) changes release to release, a version > of the code would have to come with each image set. > Moreover, it'd be nice if Cisco would post concise rules of the CLI interpreter (ie. what commands work in what context(s)) or even license it to third parties who want to write their own config checkers. This would be a vast improvement to poring through gobs of tedious (and out of date) documentation to tease out what you want. Of course, publishing for the various builds would be necessary for such an approach to be worthwhile. They wouldn't even have to reveal the "hidden" commands. ;-) Tony

2 1

Re: What is NANOG used for? (Was Re: Exodus?)
by Adam D. McKenna 04 Jan '99

04 Jan '99

From: Dave Crocker <dcrocker(a)brandenburg.com> :perhaps a web page which 'charters' the nanog list and defines the :scope/nature of its intended discussions will help to avoid future :misunderstandings? There's already a charter. http://www.nanog.org/aup.html The problem with this is that it's ignored by 99% of the people on this list, and only loosely enforced. The absolutely useless bicker about what is appropriate for this list takes up about ten times the volume of the inappropriate threads. I think the best way of dealing with an off-topic post would be to ignore it, reply privately, or complain to the people who run the list. By the way, is anyone else seeing dups? I seem to be getting up to four copies of every post. --Adam --- bash: syntax error near unexpected token `:)' Adam D. McKenna adam(a)flounder.net

2 1

Re: Cisco config checker
by Lawrence A. Deleski 04 Jan '99

04 Jan '99

Pete, Take a look at: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/netsys/index.htm ...for the connectivity tools and ... http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/netsys/nt/index.htm ...for the Baseliner tools. The Netsys Connectivity and Baseliner tools may have the features you're looking for. Verification of Cisco configs is a feature of the tool. /lad >Is there such a thing as a Cisco config checker, to allow off-line editing >of Cisco configs and check them before they're uploaded to the router? >Preferrably something that could be used in a Web/Unix environment as a >filter. >Pete

3 2

OUTAGE/WEATHER: severe winter weather and mci worldcom
by David Lesher 04 Jan '99

04 Jan '99

(More things to start off the year worrying about....) Another one I bet your EOP's does not cover: LAS VEGAS (AP) -- Three men wearing ski masks broke into a Sprint telephone office, tied up workers and stole computer equipment, leaving an estimated 75,000 customers without phone service Sunday. I've mentioned in years past that any kind of unmanned NOC/POP needs an alarm system. Just add up what all those boxes cost, and ponder what 'time to restore' will be if your backbone router goes away. Now, protecting against armed invaders is another kettle of fish, but one that you should at least ponder. How many of you have a back room in some otherwise-totally abandoned-all weekend industrial building/park? What kind of access control does it have? If nothing else, does your 911 dispatch center know where you are? [Don't laugh!] You're in a forest of FX lines, CLEC served perhaps. Does their database reflect the floor you are on? Fire inspections are a different topic. If/when you are big enough, they'll be by whether or not you ask 'em. But if you are not on the local FD's radar yet, you might wonder what your fire insurance policy says. Will they pay off if they knew what you do about that mess back there? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0