November 2000 - Test - lists.nanog.org

Operational impact of filtering SMB/NETBIOS traffic?
by Scott Call 14 Nov '00

14 Nov '00

Due to an increasing number of intrusions into windows-based machines through unprotected shares, I've started filtering both incoming and outgoing traffic for our customers on ports 138/139. So far this has caught a fair amount of traffic coming from customers, but none have called to complain about a lack of connectivity. Because this traffic is IP traffic, I wanted to ask others on this list how they treat SMB traffic on their backbones? Thanks -Scott

8 7

Colo facilities @ 151 Front St, Toronto
by Jason Lixfeld 14 Nov '00

14 Nov '00

Does anyone know of, or work for a Company who can offer colocation facilities at 151 Front St. in Toronto? I need a cage between ~15'x15' to ~20'x20'. RACO has been giving me and many more of it's Toronto customers the runaround for the last 2 months on new space. Their promises have come up empty and I'm between a rock and a hard place right now because I have a few GSRs sitting in my warehouse but no place to install them. Thanks in Advance. Regards, -- Jason A. Lixfeld Senior Network Engineer Look Communications Inc. -- jlixfeld(a)team.look.ca

3 2

Does Exodus have a peering point in Toronto?
by Jason Lixfeld 14 Nov '00

14 Nov '00

I know they only have a couple of DS3s here but are they offering public/private peering? Anyone have a contact name/number/email so I can bounce a few questions off them? Thanks in advance. Regards, -- Jason A. Lixfeld Senior Network Engineer Look Communications Inc. -- jlixfeld(a)team.look.ca

2 2

STM-1 mux
by Simon Lockhart 14 Nov '00

14 Nov '00

All, Can anyone recommend a Mux for terminating STM-1 circuits? We use the Digital Link DL3100 for our DS3 circuits, and it does the job nicely, but now we need to look for something bigger. What we're looking for is something which will take a single STM-1 in, and break out into smaller chunks. I guess realistically we'll only get whole DS3's out. Looking for something not too big, and not too expensive. (Long term, we'd probably be looking to use the Cisco ONS15454, but that doesn't do STM-x yet). Suggestions? Simon -- Simon Lockhart | Tel: +44 (0)1737 839676 Internet Engineering Manager | Fax: +44 (0)1737 839516 BBC Internet Services | Email: Simon.Lockhart(a)bbc.co.uk Kingswood Warren,Tadworth,Surrey,UK | URL: http://support.bbc.co.uk/

1 0

Re: Trusting BGP sessions
by Sean Donelan 14 Nov '00

14 Nov '00

ANS used to filter every peering session they had. Other ISPs (I won't mention any names) don't seem to filter anything, peer, customer or other. This seems to have less to do with technical or trust, than how management decides to run their business. ANS's management decided to do one thing, and paid Curtis a lot of money to do it, other ISP's management decide its too much work. See http://www.academ.com/nanog/may1996/state-of-the-internet-nsps-qna.html On Tue, 14 November 2000, "Steven M. Bellovin" wrote: > In message <20001114202940.19022.cpmta(a)c004.sfo.cp.net>, Sean Donelan writes: > >On Mon, 13 November 2000, David Diaz wrote: > >> The cabal makes jokes "Officially there is no cabal." > >> In reality the fact is that peering is a trust event. You are > > > >Peering is a business decision. It is not an engineering decision > >nor a trust event. > > > >Technically, can a peer BGP session do any more or less damage to > >your network than a customer BGP session? The protocol is identical. > > Peer BGP is (often) worse because you can't filter it as aggressively. > You *know* what prefixes your customers can advertise, and you can > discard anything else. But if you have two or more peer sessions, you > don't in general know which prefixes can legally come from which > sessions.

1 0

Re: Trusting BGP sessions
by Steven M. Bellovin 14 Nov '00

14 Nov '00

In message <20001114202940.19022.cpmta(a)c004.sfo.cp.net>, Sean Donelan writes: > >On Mon, 13 November 2000, David Diaz wrote: >> The cabal makes jokes "Officially there is no cabal." >> In reality the fact is that peering is a trust event. You are > >Peering is a business decision. It is not an engineering decision >nor a trust event. > >Technically, can a peer BGP session do any more or less damage to >your network than a customer BGP session? The protocol is identical. Peer BGP is (often) worse because you can't filter it as aggressively. You *know* what prefixes your customers can advertise, and you can discard anything else. But if you have two or more peer sessions, you don't in general know which prefixes can legally come from which sessions. --Steve Bellovin

1 0

RE: Trusting BGP sessions
by Mark Borchers 14 Nov '00

14 Nov '00

Please do not say that in public unless you want to hasten the day when peering relationships are in the hands of sales persons and/or corporate bean counters and treated like commodities. (not to say that isn't already the case in certain places) > -----Original Message----- > From: Sean Donelan [mailto:sean@donelan.com] > Sent: Tuesday, November 14, 2000 2:30 PM > To: nanog(a)merit.edu > Subject: Trusting BGP sessions > > Peering is a business decision. It is not an engineering decision > nor a trust event.

1 0

Why I Love Verio
by jamie rishaw 14 Nov '00

14 Nov '00

On Mon, Nov 13, 2000 at 01:02:48PM -0800, Randy Bush wrote: > > i am told > o the problem only effected your prefix, 199.245.173.0 > o it was fixed > > please confirm. > > and, of course, sorry for any outage. > > randy $ ping 199.245.173.1 PING 199.245.173.1 (199.245.173.1) from 207.138.127.146 : 56(84) bytes of data. >From d3-2-0.a01.chcgil05.us.ra.verio.net (129.250.16.78): Destination Host Unreachable <sarcasm> Cool, thanks!

3 4

Re: UUNET security contacts
by Simon Leinen 14 Nov '00

14 Nov '00

>>>>> "dh" == David Harmelin <david.harmelin(a)dante.org.uk> writes: > Does anybody have a security-related email address at UUNET, which > is actually read by a human? The procedure is to call them on the phone (24/7 support), as has been explained recently on this mailing list: http://nic.merit.edu/mail.archives/html/nanog/msg05535.html Since you're a direct customer of UUnet this should definitely work. > Calling UUNET triggers a reply a few weeks later from help(a)uu.net, > asking to forward the request to security(a)uu.net, itself aliased to > /dev/null > Also, is anybody else having problems with UUNET adding IP blocks, > without notifying their customers? Do you mean they filter ("block") specific IP addresses? (Anyway, we haven't had any problems with UUnet lately ourselves :-) Regards, -- Simon.

4 4

UUNET security contacts
by David Harmelin 14 Nov '00

14 Nov '00

All, Does anybody have a security-related email address at UUNET, which is actually read by a human? Calling UUNET triggers a reply a few weeks later from help(a)uu.net, asking to forward the request to security(a)uu.net, itself aliased to /dev/null Also, is anybody else having problems with UUNET adding IP blocks, without notifying their customers? Cheers, DH. ___________________________________________________________________ * * David Harmelin Network Engineer * * DANCERT Representative * Francis House * 112 Hills Road Tel +44 1223 302992 * Cambridge CB2 1PQ Fax +44 1223 303005 D A N T E United Kingdom WWW http://www.dante.net ____________________________________________________________________

2 1