September 2001 - Test - lists.nanog.org

RE: route-map match clause for existance of a BGP session?
by Bulger, Tim 21 Sep '01

21 Sep '01

Several people have requested that I post my findings.. The idea here was to utilize multiple transit providers as backup paths for VPN connectivity between remote locations by redistributing static host routes into the IGP based on the availability of a particular peer. Initially, the route announcements for each location were not being advertised to us by our peers at each other location, which made looking for the specific announcement difficult, hence my question about looking specifically for the presence of the session. Correcting for this made it simple to implement a standard route-map that looks for the announcement itself, rather than the session. route-map VPNpath match ip address prefix-list Site1 match ip route-source 10 set metric 50 router ospf 1 redistribute static subnets route-map VPNpath When latency or packet loss or what-have-you are affecting a provider, but the announcement is still present, it is simple to go to the router with the best connectivity and tweak the metric value to prefer that path. I know that there are multiple other ways of achieving the same results, but I kinda like this one. :) Thanks again, Tim -----Original Message----- From: Bulger, Tim [mailto:TBulger@ea.com] Sent: Thursday, September 20, 2001 6:13 PM To: 'nanog(a)merit.edu' Subject: RE: route-map match clause for existance of a BGP session? Thanks all for the replies.. I managed to find a solution that works for my purpose. -----Original Message----- From: Bulger, Tim [mailto:TBulger@ea.com] Sent: Thursday, September 20, 2001 10:25 AM To: 'nanog(a)merit.edu' Subject: route-map match clause for existance of a BGP session? Sorry for the non-operational content, but looking for some Cisco advice. Does anyone happen to know a trick for a route map match clause that will only match if a BGP session is established with a given peer? The idea being to only redistribute a particular static route based on the availability of the peer through which the next hop of the static would be configured... Thanks in advance, Tim

1 0

BGP Instabilities and Worm Propagation?
by Tim Griffin 21 Sep '01

21 Sep '01

See http://www.renesys.com/projects/bgp_instability for data showing that there may be a correlation between worm propagation and BGP routing instabilities. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Timothy G. Griffin AT&T Labs Research 973 360 7238 http://www.research.att.com/~griffin ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

DS3 encapsulated in OC3c?
by Simon Lockhart 21 Sep '01

21 Sep '01

All, I'm about to bring up a transatlantic 622M circuit, and am stuck with an annoying SDH/SONET problem. We use the Cisco 15454 SONET mux on our network, and although we'd ordered a SONET OC12 circuit, we've since been told that it'll actually be an SDH STM-4 circuit. This shouldn't be a problem, as the carrier can convert from SDH to SONET at their handoff, or we can convert from SDH to SONET on the way into the 15454. However, unfortunately both solutions leave us in the situation where the smallest SONET unit we can use is an STS-3c - and we need at least one DS3 circuit running over this. So, I'm stuck trying to carry a DS3 in an STS-3c carrier (or, another similar solution). Does anyone have any suggestions for a "cheap" box that will do this - without getting into buying a full SDH mux? Thanks, Simon -- Simon Lockhart | Tel: +44 (0)1737 839676 Internet Engineering Manager | Fax: +44 (0)1737 839516 BBC Internet Services | Email: Simon.Lockhart(a)bbc.co.uk Kingswood Warren,Tadworth,Surrey,UK | URL: http://support.bbc.co.uk/

2 1

how are backups implemented?
by Ratul Mahajan 21 Sep '01

21 Sep '01

[posting this message after having looked for answers elsewhere including the archives, but found no satisfactory answers] i wanted to ask the operations community about how backups are typically implemented. i am more interested in backup implementations, in which a failure would expose a different origin AS (this would exclude prepending based backups). 1. when a network is multihomed, and one of the links fails, would you expect a smooth transition (as seen in the bgp tables of a remote AS) from one origin AS to another (modulo convergence effects)? 2. can a failure (anywhere in the network) ever expose another origin AS for some AS's while it stays the same for some? i guess it can, when the network is being persistently announced from both origins, and under normal scenario one origin could be hidden from some AS's. would this also hold for a routing table as rich as routeviews? 3. can a failure ever cause more-specifics with a different (from the origin of the less-specific) origin AS to appear (again, as seen from a remote AS)? this might depend on how backups are implemented - so what i am asking is, is this a common/possible case? thanks, -- ratul

2 2

RE: route-map match clause for existance of a BGP session?
by Bulger, Tim 20 Sep '01

20 Sep '01

Thanks all for the replies.. I managed to find a solution that works for my purpose. -----Original Message----- From: Bulger, Tim [mailto:TBulger@ea.com] Sent: Thursday, September 20, 2001 10:25 AM To: 'nanog(a)merit.edu' Subject: route-map match clause for existance of a BGP session? Sorry for the non-operational content, but looking for some Cisco advice. Does anyone happen to know a trick for a route map match clause that will only match if a BGP session is established with a given peer? The idea being to only redistribute a particular static route based on the availability of the peer through which the next hop of the static would be configured... Thanks in advance, Tim

1 0

Re: My DB of Nimda infected Hosts
by Ulf Zimmermann 20 Sep '01

20 Sep '01

On Thu, Sep 20, 2001 at 03:23:10PM -0500, bonk(a)webchat.chatsystems.com wrote: > On Thu, 20 Sep 2001, Ulf Zimmermann wrote: > > Hello, > > > > I am doing a major rewrite of the scrips and going to do a reorg > > of the DB between 3pm and 5pm PDT. This reorg will allow easier > > searching and viewing. Also with that I should be able to get > > easier statistics. With the new scripts the password for submitter > > will be used to modify or delete entries. > > > I applaud what you've done with this as it's extremely useful. However, I > see many duplicates of IP's submitted. Is there a way you can code the > script so that doesn't happen ? The current layout this was intent to show multiple entries for IPs which could be dynamic (dialup user, etc.). I am working right now on a complete rewrite, which still allows multiple entries but it can set to only display it once. > > > Regards, Ulf. > > ================================================ > Travis > Email: Bonk(a)Undernet.Org | Bonk(a)cyberabuse.org > ================================================ > > -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

1 0

Nimda Online DB, addition
by Ulf Zimmermann 20 Sep '01

20 Sep '01

The online DB has been switched to Postgres and the field holding the IP is of type "inet" now. I also added another script to allow single automatic submission: http://seven.alameda.net/~ulf/nimda/addsingle.php?ip=<someIP>&email=<someemail> In addition to the above parameters there are the following possible: logdate=<somelogdate> Usual a string like: 2001/09/19:15:08:10 passwd=<somepassword> If not set this will be empty and you won't be able to edit or delete entries when I bring that function up comment=<Some comment> Like for example: "Added by log2DB script v0.1" -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

3 4

was Virus fix---Network Associates' fixes/filters, etc
by Murphy, Brennan 20 Sep '01

20 Sep '01

Network Associates' Mcafee business unit has released a stand alone tool to remove the nimda virus/worm. See this web page for more information: http://vil.nai.com/vil/virusSummary.asp?virus_k=99209 <http://vil.nai.com/vil/virusSummary.asp?virus_k=99209> Obviously, existing anti-virus software DATs have also been released. Network Associates' Sniffer business unit has released Sniffer filters to assist with identifying infected machines. There is even a way to set up an alert to send an email once the worm's signature traffic is detected on a network. See this web page for the filter and more information: http://www.sniffer.com/other/jump/nimda-filter.asp <http://www.sniffer.com/other/jump/nimda-filter.asp> I am not authorized/~/able to answer software specific support questions--so please do not contact me with those. :-) However, if I see a generic question posted to this list about the worm that I can answer, I will do so...time permitting. Thanks, -BM -----Original Message----- From: Eric Germann [mailto:ekgermann@cctec.com] Sent: Thursday, September 20, 2001 7:53 AM To: Indra PRAMANA; Andras Bellak Cc: Steve Smith; nanog(a)nanog.org Subject: RE: Trend Micro FIX_NIMDA.EXE - was Re: Virus fix -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Indra PRAMANA Sent: Wednesday, September 19, 2001 11:56 PM To: Andras Bellak Cc: Steve Smith; nanog(a)nanog.org Subject: RE: Trend Micro FIX_NIMDA.EXE - was Re: Virus fix Andras, At 07:46 PM 9/19/01 -0700, Andras Bellak wrote: Norton released a definition file yesterday that cleaned everything but the .eml files and made the systems resistant to re-infection. They released an update today that got the .eml files as well. Yes, but this requires us to install the antivirus software as well. Do you know any tools like FIX_NIMDA.EXE that can fix the problem automatically without having to use the antivirus software? I still haven't seen anything that cleans up the htm, html, asp, etc files, but there are a few utilities that work fine for doing that one. What are the utilities? Where can I get them? Norton Antivirus will clean most of the htm, html, asp, etc files. http://www.symantec.com Thank you for your help. Cheers.

1 0

Cable cut in Singapore
by Lloyd Taylor 20 Sep '01

20 Sep '01

ZDNet reports cable cuts in Singapore: SINGAPORE--Internet traffic from Asia to the United States has slowed to a snail's pace due to two impaired undersea cables. "There appears to be a damage to some circuits on the China-US and SEA-ME-WE3 cables, about 30 km off Shantou in China," said telecommunications service provider Reach Communications spokesperson Martin Ratia. http://dailynews.yahoo.com/h/zd/20010920/tc/cable_snag_slows_asian_access_t…

1 0

Re: Pattern matching odd HTTP request
by Karsten W. Rohrbach 20 Sep '01

20 Sep '01

Noah(sitz@onastick.net)@2001.09.20 10:36:17 +0000: > On Thu, 20 Sep 2001, Bill McGonigle wrote: > > > > > Thanks for all your work on this one, Karsten, and I hope you had a good > > nap. :) > > > > mod_throttle looks like it will stop a DOS from one client effectively, > > though the configuration is a bit complex for just that use of it. I > > plan to implement it for that. It doesn't appear to be useful though > > for the type of DDOS that seems to be brewing (which I hope fizzles and > > dies). > > I haven't tried it myself (yet... it's on the plate), but mod_tsunami > (http://bert.tuxfamily.org/mod_tsunami/) may work better. It limits the > number of connections on a per-directory basis, using the apache > scoreboard. The primary issue I had with mod_throttle when I was looking > at it (a few months back) was that it was fairly CPU intensive. This may > or may not be an issue depending on how much traffic you push on a > "normal" day (whatever that is). ALL modules that use directory/location base config for resource limiting won't work, because they start processing the reuqets after the request is in. to be more verbose: 1 client connects to server 2 when socket is connected, client send http headers (accept/host/...) 3 client issues a request (see rfc2616 for that) like GET / HTTP/1.1 followed by two carriage returns 4 server starts processing the request (filtering headers and uri information through the stack of configured modules) richt after step 2, there is no per-directory/per-location handler trigger, since the request has not yest triggered the corresponding handler because it was not issued by the client. the malicious client would just open a lot of sockets and wait. mod_throttle is the only implementation that could process those connections because it has an additional 'fixup' handler that gets called _before_ request processing has begun. the ideal location for some logic limiting incoming dead connections is in the core itself, because the api is somewhat limited in what you can do before the request processing an a module. i hope this shed a little light on the issue. take care, /k -- > Q: What do you get when you cross Dracula with a used car dealer? > A: autoexec.bat KR433/KR11-RIPE -- WebMonster Community Founder -- nGENn GmbH Senior Techie http://www.webmonster.de/ -- ftp://ftp.webmonster.de/ -- http://www.ngenn.net/ karsten&rohrbach.de -- alpha&ngenn.net -- alpha&scene.org -- catch(a)spam.de GnuPG 0x2964BF46 2001-03-15 42F9 9FFF 50D4 2F38 DBEE DF22 3340 4F4E 2964 BF46 Please do not remove my address from To: and Cc: fields in mailing lists. 10x

2 1