October 2001 - Test - lists.nanog.org

Re: WSJ: Trade Center Attack Highlights Problem
by Frank Coluccio 20 Oct '01

20 Oct '01

re: >One interesting thing I found during my research since September 11 is the Internet held up well because of its extensive use of alternate providers. < Lest we forget, there were considerable problems bringing certain IXs back on line that were in the affected zone back on line for a over a week after the day of the attacks, due to problems assoicated with on-site power generation. But ignoring those exceptions... ... yes, the Internet held up nicely, like you say, but for many reasons, including its use of alternate providers. Another reason, if we're to look at this in a comparative sense (which I've inferred is the case), that is, how the 'Net fared versus how 140 West Street did, was because none of the Internet's main exchanges or hubs took direct hits. ISPs and NSPs were spared a tremendous amount of grief, imo, but only as a result of serendipitous consequences, because the Twin Towers were NOT located just a couple of blocks closer to 60 Hudson Street. Even as it was, there was ongoing speculation that structural damage did exist at 60 Hudson, but fortunately those were _only_ speculations, as it turns out (and as far as I know). But had the towers been an 8th of a mile closer to 60 Hudson things would have turned out far differently for the 'Net, not only domestically, but internationally as well. Has anyone assessed the level of risk that exists to the 'Net due to the high levels of traffic concentration at 60 Hudson. Or, 1 Wilshire in LA, for that matter? Curious. -FAC > > > Tommorrow's edition (Oct 19) of the Wall Street Journal > has yet another article about Verizon's 140 West Street > office. > > "Others say the extensive damage to Verizon's hub demonstrated that it > is dangerous to rely on one company. They point out that only with the > help of smaller competitors did parts of New York get their dial tones > back. > > "We have buildings that would have been waiting for Verizon to get the > service up if there were not alternatives," says Agostino Cangemi, the > New York City commissioner in charge of telecom franchising > > One interesting thing I found during my research since September 11 > is the Internet held up well because of its extensive use of alternate > providers. Verizon tends to be very expensive, so ISPs needing lots > of "cheap" bandwidth purchased service from a variety of competitors. > Much of this was not planned, nor did ISPs have a clue where their > circuits ran. It just happened due to Adam Smith's invisible hand. > > That's not to say CLECs didn't have problems. AT&T/TCG was walloped > hard, and several ISPs have essentially abandoned some TCG facilities > because they won't be repaired for a long time. MFN lost a huge > amount of fiber. Worldcom won't say how bad MFS/Brooks/etc was hit > but Worldcom customers report their circuits were out for 3-4 weeks > and may not be repaired until the end of the year. > >

2 1

Content filters
by J.D. Falk 20 Oct '01

20 Oct '01

...that reply to the sender are inappropriate for public lists which allow such words (though, admittedly, that's not as bad as the ones that'll respond to the entire list.) ----- Forwarded message from System Attendant <MAIL-SA(a)syndesis.com> ----- Return-Path: <MAIL-SA(a)syndesis.com> Received: from MAIL.syndesis.com (sky.syndesis.com [206.221.244.80]) by unagi.cybernothing.org (8.11.3/8.10.1/JDF) with ESMTP id f9K3wK516479 for <jdfalk(a)cybernothing.org>; Fri, 19 Oct 2001 20:58:20 -0700 (PDT) Received: by mail.syndesis.com with Internet Mail Service (5.5.2653.19) id <QJHH61N6>; Fri, 19 Oct 2001 23:46:55 -0400 Message-ID: <E8484D0D9B25D511915B00D0B77419D90131C42B(a)mail.syndesis.com> From: System Attendant <MAIL-SA(a)syndesis.com> To: "'J.D. Falk'" <jdfalk(a)cybernothing.org> Subject: ScanMail Message: To Sender, sensitive content found and action t aken. Date: Fri, 19 Oct 2001 23:46:51 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain X-MD5-Body-Hash: 03a731afec1b89b05b34f6e14ec9f4ed Trend SMEX Content Filter has detected sensitive content. Place = nanog(a)nanog.org; ; Sender = J.D. Falk Subject = Re: NOC Question Delivery Time = October 19, 2001 (Friday) 23:46:50 Policy = Dirty Words Action on this mail = Quarantine message Warning message from administrator: Sender, Content filter has detected a sensitive e-mail. ----- End forwarded message ----- -- J.D. Falk "you can bomb the world to pieces, <jdfalk(a)cybernothing.org> but you can't bomb it into peace" -- Michael Franti

1 0

NOC Question
by Kath 19 Oct '01

19 Oct '01

Curious Question: What does your NOC look like (Or could you describe it any)? For some companies, it looks like NASA Mission Control (http://www.pihana.com/corporate/nocpictures-EN.htm) and for others it is like a closet with 2 guys inside with one watching DivX rips and the other running DOS ping. - James

13 16

RE: 12000 ACL issue
by Goodwin, Dustin T [IT] 19 Oct '01

19 Oct '01

Obey the power point presentation. 6513 with redundant sup and sfm gives you 9 usable slots. Each DFC card gives 15 Mpps forwarding and 16 GE ports. So that is in marketing land 144 GE ports and 135 Mpps. Plus netflow for accounting. Plus ACLs like the PFC2 has? Now throw in the new OSR line cards that can do traffic policing or shaping for thousands of flows at line rate using the PXF processor array. The goods news, it's real fast (maybe). The bad news, you can't afford to buy it. - Dustin -

1 0

What ISPs can do
by Sean Donelan 19 Oct '01

19 Oct '01

1. Keep the net running During any crisis keeping the lines of communications working is a key requirement. Almost every review of crisis and emergency response showed the importance of keeping communication systems working. (http://www.dtic.mil/ndia/2001wmd/scalingi.pdf) Unplugging things without reason seems to always make things worse. 2. Maintain the integrity of net data Implement procedures to assuring the integrity of the control data used in the net. This isn't the content of communications, but the routing and control data. This can be as simple as setting and synchronizing clocks used to generate timestamps, verifying IP address announcements, anti-spoofing filters, use routing passwords, patching known security holes. 3. Single point of contact A crisis is not the best time to learn that an ISP has decided to implement a voice mail system which won't allow any outside contact with their NOC until a 17 digit customer number is entered. All communciation providers need a reliable method to contact each other during a crisis. 4. Standardized law enforcement assistance forms Both law enforcement and ISPs need to work on specifying what the ISP needs from law enforcement and what law enforcement expects back from the ISP. There are a lot of language problems between the two groups, and often they don't understand what the other side is saying. It would also speed up the process of verifying the lawful authority for releasing the information if law enforcement knows ahead of time what ISPs expect. I understand we're not lawyers, that's why it needs to be decided ahead of time by the lawyers. But as engineers we can figure out what information is required to respond to specific, though generic, types of actions. It will also cut down on the mistakes which have happened.

1 0

Thoughts on BGP and Shared Hosting Environments
by Christopher J. Wolff 19 Oct '01

19 Oct '01

Had an interesting situation yesterday. Received a new /20 allocation. Split it into /19's and advertised it to two separate backbones via two separate routers. Users on the new /19's could get to about 75% of the available web hosts on the internet. I removed the /19's and advertised the entire /20 out of both servers, problem resolved. Any suggestions? Also, what are the groups opinions on web hosting customers who want to install custom ASP and COM components on a shared Windows 2000/IIS hosting server? I'm having a debate with a sales dude over this issue. My opinion is that it potentially destabilizes all of the virtual hosts on that system. When I hear "Can you install just a couple of ASP or COM components on my domain" my mind immediately goes to putting this customer in their own dedicated colo server. I don't think its right to jeopardize several hundred virtual domains because one $19.99/month customer wants to load up a special .dll. But that's just my rant, market conditions can dictate otherwise. Regards, Christopher J. Wolff, VP, CIO Broadband Laboratories, Inc. http://www.bblabs.com email:chris@bblabs.com phone:520.622.4338 x234

7 7

RE: 12000 ACL issue
by jhsu＠rathe.mur.com 19 Oct '01

19 Oct '01

: It seems like just yesterday everyone was blown away by an OC-48 capable : router. Now everyone is bitching that they can't apply access lists on 8 : port GE card. I am absolutely blown away by what a short memory everyone in : this industry has. The difference being, of course, that everyone wanted the OC-48, any way they could get it, more than they want GIGE, any way they can get it. And being blown away by OC-48 interfaces didn't stop *anyone* from complaining that they couldn't get OC-48 with ACLs- it was necessity that made them buy them anyway. Vendors have been plugging away at GIGE for three years now- they know what their customers want. They want ACLs. What is so wrong with that? _k

1 0

DOH! Thoughts on BGP and Shared Hosting Environments
by Christopher J. Wolff 19 Oct '01

19 Oct '01

DOH! I meant split a /20 into a /21, been a long week, sorry. -----Original Message----- From: Chris Cappuccio [mailto:chris@dqc.org] Sent: Friday, October 19, 2001 2:14 PM To: Christopher J. Wolff Subject: Re: Thoughts on BGP and Shared Hosting Environments My first suggestion would be to note that there is no way you can split a /20 into two /19s, but you can very easily split a /19 into two /20s. Maybe you should rethink your strategy. Christopher J. Wolff [chris(a)bblabs.com] wrote: > > Had an interesting situation yesterday. > > Received a new /20 allocation. > Split it into /19's and advertised it to two separate backbones via two > separate routers. > > Users on the new /19's could get to about 75% of the available web hosts on > the internet. > > I removed the /19's and advertised the entire /20 out of both servers, > problem resolved. > > Any suggestions? > > Also, what are the groups opinions on web hosting customers who want to > install custom ASP and COM components on a shared Windows 2000/IIS hosting > server? I'm having a debate with a sales dude over this issue. > > My opinion is that it potentially destabilizes all of the virtual hosts on > that system. When I hear "Can you install just a couple of ASP or COM > components on my domain" my mind immediately goes to putting this customer > in their own dedicated colo server. I don't think its right to jeopardize > several hundred virtual domains because one $19.99/month customer wants to > load up a special .dll. But that's just my rant, market conditions can > dictate otherwise. > > Regards, > Christopher J. Wolff, VP, CIO > Broadband Laboratories, Inc. > http://www.bblabs.com > email:chris@bblabs.com > phone:520.622.4338 x234 > -- Rev. Chris Cappuccio http://www.dqc.org/~chris/

1 0

12000 ACL issue
by James A. T. Rice <james_r-nanog＠jump.org.uk> 19 Oct '01

19 Oct '01

Does anyone else here use ACL's on subinterfaces of single GigE linecards on GSRs? As of 12.0(16S), the ability to type 'ip access-group' while in the subinterface configuration was removed, leaving me stuck on 12.0(15S3). Cisco seem to be under the impression that BBC are the only customer who used this feature, if anyone else ACL's on GigE subinterfaces, please get in touch so we can correct them. Apparently the feature was never supported as it was never documented. To me, hitting '?' in the config and seeing the option there, counts as documentation. I guess we should all throughly check the IOS command reference guides before we use any commands on ciscos, in case theyre unsupported. I wonder what they'll remove next, I've not yet checked to see if "ip routing" is a supported command! The other excuse for removing it was because 'it wasnt line rate'. This doesnt bother me - I'd never expected the GigE cards to be line rate anyway. Theyre now suggesting buy 35xxT switches and use them for layer 3 filtering. Below is the email, names removed to protect the guilty. -- James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk Internet Operations Engineer | Phone: +44 1737 839 737 BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. ---------- Forwarded message ---------- Date: Fri, 19 Oct 2001 09:35:13 +0100 From: Removed <@cisco.com> To: "James A. T. Rice" <jamesr> Cc: @cisco.com Subject: 12000 ACL issue Hi James, Having spoken to the guys in the US and worked through all the considerations of deploying a release of IOS code that supports the config you have it would seem that the most sensible route would be to consider the deployment of the Catalyst 3550T. The problem with simply restoring the functionality on the 12000 is that not only has it not been tested thoroughly (though expectation is that the performance will not be good) it will mean that the BBC are the only known customer using the functionality. Whilst Cisco would make every effort to support customer demands, the nature of software development and the current expectation in IOS development is that the 12000 is not suited to providing this functionality in the long term. This issue has been escalated highly within Cisco up to SE Director level and the consensus is that the most appropriate recommendation would be to consider a platform that can provide wirespeed ACL capability. The 12000 is unlikely to be able to provide this in the long term. Additionally the time required to develop and test stable code that can support all the 12000 features that will be required in the long term suggests that for the most immediate resolution to the problem an alternative platform should be considered. Cisco regret the confusion that led you to understand that this feature was supported and we will of course do our utmost to provide a satisfactory resolution. I have sent you through some collateral on the 3550T and i believe that this will provide you with the most scalable and best supported method of providing ACL's at high performance. The 3512T could well provide a more flexible solution in that it supports Vlan Maps. From the docs "VLAN maps can access-control all traffic. You can apply VLAN maps on the switch to all packets that are routed into or out of a VLAN or are bridged within a VLAN. VLAN maps are used strictly for security packet filtering. Unlike router ACLs, VLAN maps are not defined by direction (input or output)." This would make configuration of ACL's and providing access control at layer 2 and 3 easier. This could provide benefits not only in providing layer 2 security but also in simplifying Vlan design and saving on IP addressing (one vlan for all customers, security via VLAN Maps, port security and private vlans. Our thoughts are to deploy a 3550T as part of the 3500 stack that you already have. This would not only provide simplified management and the addition of only a single RU box, but would also provide an additional 10 Copper Gigabit ports for the addition of other servers. If you could let me know your thoughts on this, we can look at what is the best way to go forward. Thanks and Regards

5 4

RE: Network Tools
by Irwin Lazar 19 Oct '01

19 Oct '01

I've got an extensive collection of links to freeware NMS tools at www.itprc.com/nms.htm > -----Original Message----- > From: Marquez-Klaka, Daniel [mailto:Daniel.Marquez-Klaka@star-21.de] > Sent: Friday, October 19, 2001 3:30 AM > To: Mike Hyde > Cc: nanog(a)nanog.org > Subject: RE: Network Tools > > > > > > Does anyone know of a good program that I can run on my > > linux server that > > will monitor the ping response time between routers on my > > network? > > Take a look at "Scotty - Tcl Extensions for Network Management > Applications" > > http://wwwhome.cs.utwente.nl/~schoenw/scotty/ > > This will do what your looking for and many things more. > > > D. >

1 0