November 2000 - Test - lists.nanog.org

Re: Fire protection in ISPs and collocation facilities
by Sean Donelan 05 Nov '00

05 Nov '00

On Sun, 05 November 2000, "Howard C. Berkowitz" wrote: > Perhaps it's worth observing that fire is but one of the classic > Elemental Forces, and I've personally had far more problems with > water than with fire. In my experiences, the water came from > firefighting elsewhere in the building, but several instances of CO > flooding and the like have been mentioned in recent posts--New > Rochelle (?) AT&T vs. Verizon? Welcome to business reality. 1999 wasn't the first time the Rochelle Park central office flooded. It also flooded in 1977. New Jersey Bell decided not to move the central office after the first flooding incident. I think you will find it is more cost effective for Bell Atlantic to pay off a few subscribers every few decades than to move the central office. Bell Atlantic has 18 central offices located in 100 year flood zones. But BA/Verizon only pays refunds on complete loss of telephone service. For example, 37,000 people lost all phone service in Rochelle Park. If you assume BA paid each subscriber $4 compensation, its works out to about $148,000. A conservative estimate is $6-$10 million to move the central office. If you were a bean counter what would you do? > While I doubt it's practical to develop exhaustive water protection > measures to guard against large-scale flooding, unless there's a move > to convert surplus submarines to colo centers, I'd like to see the > fire protection code be more exhaustive about diverting water away > from unaffected faciities. This is an admirable goal, but I think the fire codes are the wrong place to put it. There is already too much junk in the fire codes, unsupported by scientific evidence. FEMA and the building codes cover flood plains. Although there is always something. If you literally followed every contingency site requirement people have, there is no place on earth which meets them all. I sometimes think companies focus too much on the hardware. You should talk to the techs and engineers keeping things going. A good set of people can keep things going even during the unexpected, unplanned, and unknown. Of course, you need to give them a fighting chance, but concrete won't keep the water out if the door is left open. Whether it is network engineers or building engineers, clue is important. I'm working with some facility engineers who were trained in the navy. Waiting for the field service engineer to show up sometimes isn't an option on a ship. Not only do they know how to deal with water, but they also know how to keep things going.

1 0

RADWare Linkproof? (or better ways to multihome)
by Mike Johnson 05 Nov '00

05 Nov '00

Back in March (looking through the archives) there was some discussion on this product as a replacement for BGP-4 for multihoming. I find myself in a situation where I'm going to be setting up a site that will be multihomed at a co-lo site. We're going to be connected to two separate ISPs via fast ethernet connections. I have only discussed BGP with one of the ISP's (we will not be getting IP services from the co-lo company), but they didn't seem to indicate that they had any issues with us using BGP. So, it seems that BGP-4 is an option. We've been speaking with RADWare about their Web Server Directors for server load balancing and they brought up the Linkproof (http://www.radware.com/content/products/link.htm) I was planning on just purchasing a big ole router and running BGP, but the idea of replacing the router with a pair of Linkproofs (high availability) is very attractive both from a cost standpoint and from an expertise standpoint (I'm the only one here who has run BGP-4 at all, and that was only in a lab, playing around -- ie, we have damned near no in house BGP-4 experience). I'm waiting to hear back from our salesdroid on other customers who currently use Linkproofs in this manner (he says there are several), but since this has been discussed here (but no conclusions seem to have been reached), I thought I would ask and see if anyone has experience with this product. In the end, I'm certainly willing to look at other solutions, but we're a bit iffy on BGP and we're already planning on running NAT, so the Linkproof looks like a good fit. Thanks, Mike -- Mike Johnson Network Engineer / iSun Networks, Inc. Morrisville, NC All opinions are mine, not those of my employer

8 10

RE: Fire protection in ISPs and collocation facilities
by Roeland Meyer 04 Nov '00

04 Nov '00

There are a lot of non-fire reasons that I like the presence of an EPO switch and I would design one in regardless. However, its requirement in the fire-code makes the expense easier to justify. I design framerooms with many smaller UPS's distributed throughout the racks, as opposed to a central pile of batteries. As a result, I have gel cells everywhere. I usually use Liebert GT's, every two racks, with power pod and interlock, at the bottom of the rack. Some of the non-fire reasons; Ground-faults placing 120VAC on the rack frames. Flooding event. Data intrusion prevention (Emergency SCRAM). > From: Sean Donelan [mailto:sean@donelan.com] > Sent: Saturday, November 04, 2000 5:56 PM > > Several people have asked where can they obtain a copy of the US > Air Force draft. > > Engineering Technical Letter (ETL) 00-3: Fire Protection Engineering > Criteria - Electronic Equipment Installations > > http://www.afcesa.af.mil/Publications/Drafts/ETL00-3Draft.pdf > > I find it interesting how the designs created by people who have to > operate an installation are different from the designs from > consultants > and vendors, or even the National Fire Protection Association. Or > commercials on television like those being run by Janus. > > But back to my original question. What is the real fire risk for > ISPs and collocation operators. Is it burned buttered popcorn in the > microwave setting off the FM-200 system? Is it home-made computers? > Is it the Emergency Power Off switch? > > State Farm Insurance has started a project to change the > National Electrical > Code for computer rooms and the requirement for an EPO > switch. Is this > something other ISPs and collocation providers would be interested in > seeing changed? If so, we need to collect data and evidence > to support > the change.

1 0

RE: Security on a home DSL Line
by Roeland Meyer 04 Nov '00

04 Nov '00

I did that ... too much work. Easier to install an appliance. > -----Original Message----- > From: Sean Figgins [mailto:sfiggins@mail.wcg.net] > Sent: Friday, November 03, 2000 7:33 AM > To: nanog(a)merit.edu > Subject: RE: Security on a home DSL Line > > > > Of course, for those that don't know how to install a OS > without the use of > GUIs, you can always install FreeBSD just about as easily as > Linux, and have > all the security of IPFilter over IPChains... I've used this > method to do > everything from a Dial on Demand NAT gateway, to a full fledged > firewall/router solution. > > Of course, my home network is behind more sophisticated > security now, but > if/when I ever change jobs and network providers, I'll be > going back to the > FreeBSD firewall/NAT method. > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Brandon Hume > Sent: Friday, November 03, 2000 9:07 AM > To: nanog(a)merit.edu > Subject: Re: Security on a home DSL Line > > > > >Otherwise, your idea is perfect; Linux or OpenBSD, whichever you're > >more comfortable with, will give you the most flexibility, > and Solaris x86 > >might work but will be dog-slow and unless you have a lot of RAM, > >completely unusuable. > > For such a weakly defined measure of "a lot of RAM", this statement is > inaccurate. Solaris 8 x86 will run comfortably, without X > and superfluous > processes (to say: a rational firewall/NAT box configuration) > within 12M > of RAM. A passing knowledge of Solaris would not let a > person know this to > be true, however, since Sun states its memory requirements on > the assumption > you'd be using X. > > That being said, OpenBSD is probably the best choice. It > requires more > skill > to install, but less skill to secure, and would probably run > better *by > default* on a minimal machine. After that I'd suggest > Solaris, since it > installs less crap than most of the Linux distributions (note: most). > Driver issues might force your hand to the Linuxes, of course. > > I also place OpenBSD and Solaris above Linux because they > both give you the > use of IPFilter, which I believe to be just flat-out superior > to IPChains. > > -- > Brandon Hume - hume -> BOFH.Halifax.NS.Ca, http://WWW.BOFH.Halifax.NS.Ca/ -> Solaris Snob and general NOCMonkey

2 1

Watch 500 Channels on your New Free Satellite System
by Ryan＠chems.co.kr 04 Nov '00

04 Nov '00

FREE Satellite T.V. System and FREE Installation For a limited time we'll give you this top of the line Digital Satellite System for FREE! We'll even include Free installation. Enjoy over 500 Channels of crystal clear digital picture and cd stereo sound on your FREE Satellite TV System. Why pay over $900 retail for these items, when we're giving you this satellite package for free. Call 888-514-6881 to be Guaranteed Your FREE Satellite Today This Innovative 20" Satellite includes a stereo receiver and an infrared remote. With this FREE offer you will have both Interactive Television Capability and an On Screen Program Guide. This limited time FREE offer is much less than the monthly cost of cable tv. All you have to do is call us to arrange delivery. If you call today, we'll throw in a second receiver for your second T.V. free. Call 888-514-6881 to Begin Surfing through 500 Channels Today! To be removed send email to youwannus2(a)yahoo.com

1 0

RE: Security on a home DSL Line
by Rishi Singh 04 Nov '00

04 Nov '00

Hmm.. Zone Alarm is a nice product, but I'd prefer to use BlackIce Defender for all my Wintel boxes. It does a fine job of protecting against many exploits and their databases are updated very frequently. BlackIce Defender available at: http://www.networkice.com -----Original Message----- From: J. Gilmore [mailto:reece0011@yahoo.com] Sent: Thursday, November 02, 2000 6:38 PM To: nanog(a)merit.edu Subject: Security on a home DSL Line I'm looking to beef up security on a home DSL line. Currently I am using ZoneAlarm (the freeware version). I'm thinking of taking an old Pentium 120, and setting that up as a firewall, but wanted to know if anyone else had a better idea. __________________________________________________ Do You Yahoo!? >From homework help to love advice, Yahoo! Experts has your answer. http://experts.yahoo.com/

7 6

BGP policy scripts
by Shah, Himanshu 03 Nov '00

03 Nov '00

Hi, Is there a repository where I can find BGP policy scripts (Cisco style) that I can use against our implementation? I am looking for complex examples of regular expressions, route maps, access lists, etc. If not, I would appreciate if someone would share examples of scripts that they commonly use and/or features they think would be useful to offer.. thanks, Himanshu

3 2

RE: Security on a home DSL Line
by Mathew Butler 03 Nov '00

03 Nov '00

Actually, I think it'd be nice if there was an "Expert Settings" mode that you were told how to get into in the manual... and that only that menu would be able to set it to ultra-paranoid (i.e., debugging) level. The default user interface should only be able to set it up to 'mildly paranoid'. (Incidentally, there was a roaring discussion about this over on grc.com's newsgroups, about a month back. Since Steve Gibson configured his newsserver to archive all messages into the archive.* hierarchy, you might/should be able to find it all... if you want to spend the time to do so.) -Mat Butler -----Original Message----- From: Joe Shaw [mailto:jshaw@insync.net] Sent: Friday, November 03, 2000 2:11 PM To: Rishi Singh Cc: 'Dennis Dayman'; 'nanog(a)merit.edu' Subject: RE: Security on a home DSL Line It still doesn't do things like list the source port of the offending attack. It still reports things like traceroutes as suspicious activity. It's not so much that BlackIce is a bad product, it's the fact that most of the users who use it and the other software packages like it are generally not very clued and will fly off the handle reporting all sorts of things as attacks or attempts to access their computer. I've actually spent an entire weekend being paged by our NOC to deal with someone who had BlackIce, and another program that would e-mail abuse@ for the IP address it considered to be attacking, in this case what it was saying was a UDP flood coming from various IP's of equipment we have. One thing led to another, and it turned out he was being UDP flooded by streaming media servers (RTSP anyone?), and his automated reporting facility was mailing these complaints out to the NOC. We had another person who was screaming bloody murder about being hacked, when he was tracerouted to twice over a 24 hour period. That hardly counts as an intrusion. Generally, if someone is having an issue and all they have to go in is BlackIce output, we need pretty evident proof that there's an actual problem. One cool feature is the fact that BlackIce can detect certain types of traffic, like nmap scans, queso, snmp queries, and the like. But if all I've got to go on is a 5 packet 'UDP flood,' the source IP, the destination IP, and the destination port, it gets old quick. Couldn't it just look at the source port and say "This looks like RTSP," or "This is only 5 packets, probably not a big deal." It really depends on how sensitive the person who has it sets it, but I've yet to see anyone who doesn't set it as high as it will go. A warning that says it might be as ultra-paranoid as a strung out conspiracy theorist at the highest settings might not be a bad idea. I think the last version we looked at was the latest version available in July/August. We were looking at it to use as a firewalling solution for our mobile users, but we just couldn't deal with the amount of calls people would make to us saying they were being scanned by all the local windows machines on the network while they were in the office, or countless other issues. We're still looking at other solutions, but few really have any sort of centralized monitoring/reporting ability. -- Joseph W. Shaw Sr. Network Security Specialist for Big Company not to be named because I don't speak for them here. I have public opinions, and they don't. On Fri, 3 Nov 2000, Rishi Singh wrote: > That was a very old version of BlackIce Defender you are referring to. I > know exactly which version you are talking about as I had similar problems > with it. However NetworkIce seems to be a pretty responsive company when it > comes to complaints and I beta test their products for them. > > All of the dev/null stuff has been eliminated in the last few releases, > including erroneous reports and extraneous information. You should try it > now, I think you will be more impressed than the experiences you had with > the older version.

1 0

RE: Security on a home DSL Line
by Rishi Singh 03 Nov '00

03 Nov '00

Dennis, That was a very old version of BlackIce Defender you are referring to. I know exactly which version you are talking about as I had similar problems with it. However NetworkIce seems to be a pretty responsive company when it comes to complaints and I beta test their products for them. All of the dev/null stuff has been eliminated in the last few releases, including erroneous reports and extraneous information. You should try it now, I think you will be more impressed than the experiences you had with the older version. -----Original Message----- From: Dennis Dayman [mailto:ddayman@mail-abuse.org] Sent: Friday, November 03, 2000 11:21 AM To: nanog(a)merit.edu Subject: RE: Security on a home DSL Line > Hmm.. Zone Alarm is a nice product, but I'd prefer to use > BlackIce Defender > for all my Wintel boxes. When I was Director at SBCIS we dev/null complaints coming in from BlackICE. It tends to report unnecessary information or attempts. It said things about TCP 80, it would report customers other windows boxes on the same home DSL line doing netbios, and sometimes depending on their mail client setup's would report them check their own E-Mail. --------------------------- Thanks Dennis Dayman Senior Consultant Consulting Services Group at MAPS http://www.mail-abuse.org ddayman(a)mail-abuse.org Voice/FAX 972-682-7556 ---------------------------------------------------------------------------- -- What goes up, must come down. Ask any system administrator. ---------------------------------------------------------------------------- --

3 2

The Cidr Report
by Tony Bates 03 Nov '00

03 Nov '00

This is an auto-generated mail on Fri Nov 3 12:00:00 PST 2000 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 03Nov00 0) General Status Table History ------------- Date Prefixes 281000 89474 291000 89460 291000 89478 301000 89458 311000 89649 011100 90189 021100 91627 031100 90444 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 8951 Number of ASes announcing only one prefix: 5138 (2860 cidr, 2278 classful) Largest number of cidr routes: 921 announced by AS701 Largest number of classful routes: 1178 announced by AS701 1) Gains by aggregating at the origin AS level --- 03Nov00 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 431 150 281 65.2% BCnet Backbone AS1221 604 450 154 25.5% TELSTRA-AS AS2609 128 8 120 93.8% EUnet-TN AS4755 201 101 100 49.8% Videsh Sanchar Nigam Ltd. India AS174 538 453 85 15.8% Performance Systems International AS4293 340 258 82 24.1% Internal ASN for C&W AS13999 91 9 82 90.1% UNKNOWN AS3908 252 173 79 31.3% Supernet, Inc. AS577 244 174 70 28.7% Bell Backbone AS5106 101 37 64 63.4% AADS-COLUMBUS AS3749 119 58 61 51.3% TECNET AS226 167 106 61 36.5% USC/Information Sciences Institut AS16758 63 6 57 90.5% UNKNOWN AS376 132 76 56 42.4% RISQ AS1727 135 82 53 39.3% MRMS-WEST AS11252 90 37 53 58.9% Idaho State University AS3602 294 242 52 17.7% Sprint Canada Inc. AS5102 74 24 50 67.6% AADS-CHAMPAIGN AS4740 312 262 50 16.0% Ozemail Pty Ltd (ASN-OZEMAIL) AS6429 149 101 48 32.2% FirstCom Internet AS1 631 583 48 7.6% GTE Internetworking AS209 272 227 45 16.5% Qwest Communications AS549 192 148 44 22.9% ONet Backbone AS1239 483 441 42 8.7% SprintLink Backbone AS6082 145 105 40 27.6% HarvardNet, Inc AS4151 89 50 39 43.8% USDA Internet Access Network AS12235 43 4 39 90.7% Cove Software Systems Inc AS1267 60 23 37 61.7% Infostrada S.p.A. AS14 50 14 36 72.0% Columbia University in the City o AS637 55 20 35 63.6% PENS-NET-AS For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0