November 2002 - Test - lists.nanog.org

NOC equipment checklist
by Dan Lockwood 13 Nov '02

13 Nov '02

Group, I'm looking to get input on a moring checklist for NOC equipment. What I would like to put together is a list that I can give to my techs and have them check things like power supply alarms, hard disk alarms, etc. I guess somewhat like a colocation taking care of customer equipment. Does anyone have input or possibly an example of what is being done throughout the industry? TIA Dan Lockwood Microsoft Certified Professional CompTIA Network+ Certified Cisco Certified Network Associate

2 1

New FTC report on anti-spam actions
by just me 13 Nov '02

13 Nov '02

A new FTC report titled "Federal, State, and Local Law Enforcers Tackle Deceptive Spam and Internet Scams" was released today. It is available at http://www.ftc.gov/opa/2002/11/netforce.htm While not as swift and brutal as many would prefer- there were no stormings of buildings by jack-booted SWAT teams- it's a great step for them, and its good to know that they are dedicating resources towards fighting the problem. Recognition is the first step, and all. I hppened on the release while looking for how to submit a complaint- which you can do at https://rn.ftc.gov/dod/wsolcq$.startup?Z_ORG_CODE=PU01 [slightly off-topic rant follows] I've been plagued for months by 7 to 10 random spams a day, sent to an address I have only given to "lanstreet.com". The spam comes from Brazil, Mexico, Japan and Hong Kong, as well as various US DSL sources. To Lanstreet's credit, their whois information is up to date. I called and spoke to their contact, Tseng Lo, at (626) 810-8341. I called and asked him if they were selling customer information, contrary to their privacy policy (http://www.lanstreet.com/privacypolicy.cfm) He stated several times that under no circumstances did they sell or release customer information voluntarily. How, then, did this email address become known to random spammers across five countries and several continents? His explanation was simple. He let me know that because they host their site on NT machines, it is highly probable that the information was obtained by unknown parties hacking into their systems. He told me that while he was aware of unauthorized intrusions, he was not able to give me a number of incidents. The moral? Stay away. I found lanstreet.com through a pricewatch search for wireless networking products. They lie about their privacy policy and have no interest in keeping customer information safe. Sorry for the rant, but I wanted to spare you folks the potential for a credit fraud nightmare. matt ghali --mghali(a)snark.net------------------------------------------<darwin>< Flowers on the razor wire/I know you're here/We are few/And far between/I was thinking about her skin/Love is a many splintered thing/Don't be afraid now/Just walk on in. #include <disclaim.h>

1 0

Re: all the mails on Filtering
by Harsha Narayan 13 Nov '02

13 Nov '02

Hi, So what happens to multihoming assignments made by the ISP? That means the multihoming assignment can't be used as a backup. If the customer's connection to the ISP which made the multihoming assignment gets lost, then it can't use its multihoming assignments (say a /24) to get traffic from some other ISP?! Thanks to all, Harsha. On Wed, 13 Nov 2002, Buddy Bagga wrote: > Greets, > > Look at <http://www.nanog.org/filter.html>. If I remember correctly, Verio > used to filter prefixes longer than /19s in classful A range. Apparently > this isn't the case anymore. But it would be naive to think that ISP only > filter prefixes longer than /24. > > Cheers, > > On Wed, 13 Nov 2002, Harsha Narayan wrote: > > > Are there some ISPs who filter prefixes longer than /19 or a /20?. I > > thought they filtered only prefixes which are longer than /24? > > ~ > Buddy Bagga > Genuity | BBN >

4 4

PAIX/Switch and Data News
by Daniel Golding 13 Nov '02

13 Nov '02

http://biz.yahoo.com/djus/021113/1031000599_1.html Looks like S&D is closing in on PAIX.

1 0

None
by Harsha Narayan 13 Nov '02

13 Nov '02

Hello, Are there some ISPs who filter prefixes longer than /19 or a /20?. I thought they filtered only prefixes which are longer than /24? Harsha.

4 3

LACNIC ASN allocation
by Rob Thomas 13 Nov '02

13 Nov '02

Hi, NANOGers. IANA has allocated a range of AS numbers to LACNIC, the new Latin American and Caribbean RIR, http://lacnic.net. This allocation was made as of 12 November 2002. The new LACNIC range is: 27648 - 28671 Allocated by LACNIC (November 2002) This changes the formerly IANA held range as follows: (was) 27648 - 32767 Held by the IANA (now) 28672 - 32767 Held by the IANA You may wish to adjust any filters accordingly. I have updated my bogus ASN monitoring, which can be found here: http://www.cymru.com/BGP/asnbogusrep.html The master list of ASNs can be found here: http://www.iana.org/assignments/as-numbers Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

qwest<->bbnplanet problems this morning?
by Marius Strom 13 Nov '02

13 Nov '02

Is anyone else seeing occasional flapping between qwest and bbn this morning? I've got TT's open w/Qwest and since the ticket-taker I spoke to had 0 clue, I assume my T1's will go down for testing anytime. *sigh* -- /-------------------------------------------------> Marius Strom | Always carry a short length of fibre-optic cable. Professional Geek | If you get lost, then you can drop it on the System/Network Admin | ground, wait 10 minutes, and ask the backhoe http://www.marius.org/ | operator how to get back to civilization. \-------------| Alan Frame |---------------------->

1 0

Hello, Earthlink?
by Drew Linsalata 13 Nov '02

13 Nov '02

If anyone with a clue at Earthlink is listening, please email me off-list. Drew Linsalata The Gotham Bus Company Server Co-Location and Dedicated Access Solutions http://www.gothambus.com

1 0

free network monitoring/management tools
by Joshua Smith 13 Nov '02

13 Nov '02

hello to all, i would appreciate your your knowledge and experiences regarding freely available tools for network monitoring and management (all cisco now, some other stuff later). i would prefer free tools as i have no budget :) i am looking for the following (it will be running on either freebsd or redhat): AAA - i have been trying to find a tacacs+ daemon/program that doesn't require me to also learn *sql to set up the backend database (if this is the only choice, then i can learn it) config monitoring/management - rancid or rtrmon are the two that i have found. any preferences on one over the other in terms of ease of use, ability to modify/improve, efficiency, etc? network/syslog monitoring - some of the likely candidates i have found are nagios or netsaint, jffnms, nmis, opennms, or maybe snip (formerly nocol) - i need something that is fairly easy to setup and use, and it doesn't have to do a whole lot (just some basic notifications for now). decent documentation is also necessary, and a pretty map would be nice for my noc, but this isn't a prereq. my scripting/programming skills are rudimentary, so it would be ideal if it was at least partially plug-and-play (i know i know, sorry). i would appreciate any input (i am still reading through the archives for useful tidbits), and i, of course, will gladly summarize for the list. thanks in advance joshua "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

Re: new bind vuln
by Steven M. Bellovin 13 Nov '02

13 Nov '02

In message <20021113044904.GA6374(a)alcove.wittsend.com>, "Michael H. Warfield" w rites: > > >On Tue, Nov 12, 2002 at 06:10:14PM -0500, Gerald wrote: > >> Haven't seen mention of this yet today and DNS affects most everyone in >> some way. The advisory was released a day early according to FreeBSD >> security officer. > > Just to reiterate (I realize, in my haste, I forgot to include >a reference or a quote in my earlier message)... > > Here is a quote from Vixie on Slashdot: > >] "ISS and ISC worked together on this. ISS found the >] vulns, ISC worked with the vendors, and both of us >] worked with CERT and coordinated the announcements. >]=20 >] Paul Vixie >] Chairman, ISC" > > Doesn't sound like "released a day early" to me. > CERT said that the ISS advisory was to be released on 13 November, and that the patch would be available from ISC next week. There was no indication about when CERT itself was going to issue an advisory, but clearly someone said something a day earlier than had been expected. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com ("Firewalls" book)

3 4