November 2001 - Test - lists.nanog.org

CNN glitch (was Re: Plane crash in Queens
by Sean Donelan 13 Nov '01

13 Nov '01

On 11:01 AM 11/12/2001 -0500, JC Dill wrote: > From a "network operations" viewpoint, it appears that yet again all > paths to www.cnn.com are overloaded. Can you reach www.cnn.com from your > network? According to a CNN spokesperson, they had an "internal glitch" which prevented some people from reaching their site for about an hour this morning. No word on what the glitch was, or if it involved a human.

2 1

Re: ISIS Monitoring & Visualisation Requirements
by Matt Duggan 13 Nov '01

13 Nov '01

Peter (and anyone else), Sorry if the sig caused offence, please ignore it in the context of this discussion. Sig removed... Can we now keep to the subject please. Matt. -------------- Matthew Duggan, World Data Systems Ltd. mailto:matt.duggan@world-data-systems.com www: http://www.world-data-systems.com -------------- _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

ISIS Monitoring & Visualisation Requirements
by Matt Duggan 13 Nov '01

13 Nov '01

Hi, I am currently doing some research into the monitoring and visualisation requirements for networks running ISIS. I am primarily interested in what you feel are the key requirements for monitoring and viewing ISIS within a network and why? (I guess it would include stuff like Adjacency and DR changes & area, mesh group, DR visualisation etc). If you could let me know your thoughts that would be most useful. regards, Matt. -------------- Matthew Duggan, World Data Systems Ltd. mailto:matt.duggan@world-data-systems.com www: http://www.world-data-systems.com -------------- This e-mail including any attachments is confidential and may be legally privileged. If you have received it in error please advise the sender immediately by return email and then delete it from your system. The unauthorised use, distribution, copying or alteration of this email is strictly forbidden. _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

2 1

Network operation security forums
by Sean Donelan 13 Nov '01

13 Nov '01

With the ICANN meeting opening this week, and the unusual focus on network security, I assume most network operators have been deluged with Internet security questions from all sources. The public discussions I know about have focused on "popular" subjects such as root servers, ddos, viruses. While interesting, and challanging topics, are they really the biggest security problems facing Internet operators? I don't think so. But that's just my opinion. Where are Internet operators discussing the common risks they all have? What are the biggest security risks Internet operaters need to manage? I'm concerned about route integrity, multi-provider facility risks, and multi-provider restoration deadlock. Why do I worry about them, because they are risks no single provider can manage alone.

2 1

DNS Host Handles/Registrations
by measl＠mfn.org 12 Nov '01

12 Nov '01

Good afternoon! This may sound like a dumb question, but... The last time I registered a DNS host it was still being done by NetSol/InterNIC (yeah, a *long* time ago). I need to add another DNS host, and cannot seem to find the appropriate place to do this. InterNIC.net, ICANN, IANA all come up blank. Anybody out there done one of these recently? Thanks! -- Yours, J.A. Terranson sysadmin(a)mfn.org If Governments really want us to behave like civilized human beings, they should give serious consideration towards setting a better example: Ruling by force, rather than consensus; the unrestrained application of unjust laws (which the victim-populations were never allowed input on in the first place); the State policy of justice only for the rich and elected; the intentional abuse and occassionally destruction of entire populations merely to distract an already apathetic and numb electorate... This type of demogoguery must surely wipe out the fascist United States as surely as it wiped out the fascist Union of Soviet Socialist Republics. The views expressed here are mine, and NOT those of my employers, associates, or others. Besides, if it *were* the opinion of all of those people, I doubt there would be a problem to bitch about in the first place... --------------------------------------------------------------------

15 22

Genuity help needed with peering session - Contact off-list please..
by Rich Sena 12 Nov '01

12 Nov '01

-- Rich Sena - ras(a)thick.net ThickNET Consulting "On the way to understanding; you understand, and forget."

1 0

Summary: Reportable Metrics
by Murphy, Brennan 12 Nov '01

12 Nov '01

Here is a summary of a recent query I posted to the list. Reportable Metrics: Original Query: to identify a list of network metrics to compile and report to management on a monthly basis. (Emphasis is on metrics and not the tools used to gather them.) My original list: 1. Uptime per WAN or Internet circuit 2. # and average length of outages 3. Bandwidth utilization per WAN/Internet circuit and "important" VLANs 4. Overall Network Latency, RTT measured from various parts of network (cisco IPM)to various other parts 5. Top talkers per WAN circuit 6. Top destinations per WAN circuit 7. Top 10 most utilized WAN circuits (% burst above CIR, etc) 7. Protocol distribution per WAN circuit 8. Syslog/Sniffer alarms by severity 9. Application Response time for key Apps (eg, SAP, HTTP) 10. Security Incidents 11. TACACs reports on number of logins, changes, etc 12. Bandwidth/Latency trending Vince Mulhollan's additions: 1. acceptable use policy violations 2. number/severity of externally reported abuse complaints 3. IOS deployments: upgrades, schedules, risk/rewards of IOSs in use 4. Installations completed: hw and circuit changes. Time to implement each. 5. RFO: reasons for outages and remedies employed 6. Employees % of time spent on: upgrades, installs, security incidents, etc. Headcount in line with workload? 7. Any hardware related trends:, ie particular devices burning out frequently, etc. Establish loose figure of likelihood of failure per type of device Joe St Sauver's recommendations: 1. Don't overwhelm management with large quantity of data 2. Implement "management by exception" by tracking/reporting "material statistical deviations from expected values wherever possible. " 3. "The other key concept is to give management gauges that will help them drive the plane, rather than historical data that will tell them when/where/how badly they crashed (last month). E.G., make the data timely and operationally relevant." a. -- What's broken? b. -- Where am I vulnerable? c. -- Where am I running out of capacity? d. -- Where do I have performance problems? e. -- What are we doing really well? f. Where can I increase my return on already deployed assets? (e.g., where do I have underutilized capacity?)Look longitudinally (over time), geographically (spatially), and at snapshots (cross sectionally). 4. Focus on downtime as opposed to uptime and only report those that exceed some acceptable threshold. Focus on cause of outages and responses to those outages and whether there are ongoing problems in solving the issues. 5. Tie all measurements to realities of the business: stats that bear out billing expenses, those that might help marketing, or those that help in planning, etc 6. Dial-ins 7. A list of URLs for more ideas a. Compare and contrast: http://hydra.uits.iu.edu/~abilene/traffic/ http://monon.uits.iupui.edu/abilene/dnvr.html http://monon.uits.iupui.edu/abilene/dnvr/index.html http://monon.uits.iupui.edu/abilene/dnvr/uoreg-bits.html http://www.itec.oar.net/abilene-netflow/ b. Latency, packet loss, route changes: i. http://amp.nlanr.net/active/amp-uoregon/HPC/body.html ii. http://www.advanced.org/surveyor/ iii. http://www.caida.org/cgi-bin/skitter_summary/main.pl iv. http://www.ncne.nlanr.net/nimi/ c. Possible breakdown on top WAN talkers: i. Single flow? Aggregate traffic? By protocol? By port? Per dotted quad? Per network block? Per ASN? Measured by octets? Flow count? Flow duration? From flow data? Passive monitoring with OCxMON type tools? Privacy issues? ii. Sample report: http://www.canet3.net/stats/reports.html 8. :-) "Keep it brief." Iljitsch van Beijnum: 1. Interface stats a. CRC errors, (helps identify lower layer problems) b. collisions, if you use any non-switched ethernet 2. router CPU load Joe Provo: 1. Errors: CRCs, queue drops/depth (eg, RED vs tail-drop queues) 2. Routing protocol transitions where relevant, eg, BGP route table size 3. "You should look at SNIPS [formerly NOCOL] for examples of good stuff to monitor [&*therefore trend]. David Newman: 1. For delay-sensitive, include: a. jitter (latency variation) b. histograms (latency distribution) Thanks to everyone who responded! If you have more suggestions for this list, please email me directly. -BM

1 0

Plane crash in Queens
by Ryan Tucker 12 Nov '01

12 Nov '01

Within the last hour, an American Airlines jetliner (Airbus A300, flight 587) crashed into Queens, apparently on departure from JFK. Details are sketchy (as usual), but news sites are very overloaded (as usual). It does not immediately appear to be a terrorist attack. NYC has gone into lockdown mode. -rt -- Ryan Tucker <rtucker(a)netacc.net> Network Operations Manager, NetAccess, Inc. http://www.netacc.net/ • (585)419-8252

7 7

Afghan phone links
by Sean Donelan 12 Nov '01

12 Nov '01

Since the 1991 Gulf War news stories about the net and communication links during the war have been common. Afghanistan has a limited wireless network, but it continues to function. There have only be a few press articles on the subject of communications this time. They New York Times has an article about the Afghan Wireless network. http://www.nytimes.com/2001/11/12/international/asia/12CELL.html US Military forces destroyed the international wireline office in Kabul last month. I don't know of any web site or host currently operating within the physical borders of Afghanistan. Afghan Wireless, like all the other Afghan web sites, are hosted in other countries.

1 0

wireless traffic
by Art Houle 11 Nov '01

11 Nov '01

Does anybody know where I can locate a list of MAC address prefixes that belong specifically to wireless NIC cards? I am looking for a method of discovering what devices on my network are wireless devices. Art Houle e-mail: houle(a)acns.fsu.edu. Academic Computing & Network Services Voice: 850-644-2591 Florida State University FAX: 850-644-8722

9 11