March 2002 - Test - lists.nanog.org

Re: Let's talk about Distance Sniffing/Remote Visibility
by CARL.P.HIRSCH＠sargentlundy.com 28 Mar '02

28 Mar '02

Yeah, the device I've got in my head is a 1U server with 4 (or more?) interfaces... not so much to simultaneously pull 400Mbps of bandwidth for analysis but rather to just have a interface going to each switch I might want to monitor and then span traffic to the Ethereal box. Given that I'm trying to attain remote visibility, it might be nice not to need remote hands to be swapping patch cords back and forth. I'm imagining that even with a relatively speedy box, if you were trying to do analysis from multiple interfaces you'd at least choke the disk I/O. There's always stringent filters, I guess. thanks for the input, -carl "E.B. Dreger" <eddy+public+spam(a)noc.ever To: CARL.P.HIRSCH(a)sargentlundy.com quick.net> cc: nanog(a)merit.edu Sent by: Subject: Re: Let's talk about Distance Sniffing/Remote owner-nanog(a)merit.edu Visibility 03/28/02 09:02 AM "C" is close. Not sure what you mean by "a ton of interfaces". Most (all?) good managed switches have a "monitor port" or "mirror port" where they can blind copy traffic from other ports to the one that's set aside for snooping. Four-port ethernet cards are readily available. How many switches do you wish to monitor simultaneously? Even with only four ports (more in one box is certainly possible), you can have a fair amount of traffic to digest. -- Eddy Brotsman & Dreger, Inc. - EverQuick Internet Division Phone: +1 (316) 794-8922 Wichita/(Inter)national Phone: +1 (785) 865-5885 Lawrence -- Date: Mon, 21 May 2001 11:23:58 +0000 (GMT) From: A Trap <blacklist(a)brics.com> To: blacklist(a)brics.com Subject: Please ignore this portion of my mail signature. These last few lines are a trap for address-harvesting spambots. Do NOT send mail to <blacklist(a)brics.com>, or you are likely to be blocked.

3 4

RE: Exodus/C&W Depeering
by smd＠clock.org 28 Mar '02

28 Mar '02

the Invisible Hand said you should talk to the face instead. Go figure. A monk I met on the street, however, said: "Even stupid companies can make smart decisions sometimes, the trouble is that you can only tell in hindsight whether the choices made were the right ones". I was also given a copy of a book by Lao Tze before the monk was chased off by aggressive chanters and bongo-drummers from a rival sect. Central London is weird. Sean. | AS3561 (InternetMCI) was once the number 1 ISP, by almost every | measure that existed. The marketplace has not been kind to C&W | since they bought AS3561. Why isn't Adam Smith's Invisible Hand | rewarding C&W? Is C&W number 5 or 6 these days?

6 5

PowerDNS PDNS 1.99.6 first public release
by bert hubert 28 Mar '02

28 Mar '02

Of mild interest to readers of this list may be the first public release of what is to become PDNS 2.0 PDNS is an advanced high performance authoritative nameserver with a host of backends. Besides plain Bind configuration files, PDNS reads information from MySQL, Oracle, PostgreSQL and many other databases. Backends can easily be written in any language, a sample perl backend is provided. PDNS powers http://express.powerdns.com, a Web-based DNS maintenance site and the toplevel domain .TK. The not-for-profit release can be found on http://www.powerdns.com/pdns , documentation is on http://downloads.powerdns.com/documentation/html/ or included in the distribution. This is not yet a mature release, so your comments are appreciated. We will not spam this list further and instead invite you to join our 'pdns-users' mailinglist: http://mailman.powerdns.com/mailman/listinfo/pdns-users Thanks for your attention. Regards, bert hubert -- http://www.PowerDNS.com Versatile DNS Software & Services http://www.tk the dot in .tk http://lartc.org Linux Advanced Routing & Traffic Control HOWTO

1 0

Exodus/C&W Depeering
by Chris Parker 27 Mar '02

27 Mar '02

Well, another round of the depeering battles. We received notice this morning that Exodus is depeering at all US public exchanges on Friday ( gotta love that notice by the way ). They are also not accepting any requests for private peering ( despite meeting the requirements still listed on the peering page ): http://bengi.exodus.net/external/peering.html They will happily continue to sell transit at said exchanges though, and all C&W peering contacts forward to sales ( ain't that cute! ). Should be interesting to see how this impacts the ability to reach sites hosted at Exodus. -Chris -- \\\|||/// \ StarNet Inc. \ Chris Parker \ ~ ~ / \ WX *is* Wireless! \ Director, Engineering | @ @ | \ http://www.starnetwx.net \ (847) 963-0116 oOo---(_)---oOo--\------------------------------------------------------ \ Wholesale Internet Services - http://www.megapop.net

18 25

Telenex/Atlantic Research Interview 7200
by Jim Hickstein 27 Mar '02

27 Mar '02

Not operational; I apologize. I just picked up an ARC Interview 7200 analyzer, and it hath no floppies. Racking my brains (and having exhausted Google!) I decided that NANOG was the likeliest place to find someone who has (access to) such a beast, and who might make me copies of the software for a nominal bribe. (Or better yet, cite or send the images.) Sitting here with my new toy, and whimpering....

1 0

Route Collector
by Chris Pace 27 Mar '02

27 Mar '02

Is it common or a good idea to have a route collector in a datacenter/enterprise environment ? We have 1 router that just collects routes using bgp and ospf, then set all servers to use it as the default gateway. Is this practical or am I making more work for myself ? Chris Pace

3 4

RE: Senator Hollings is at it again
by smd＠clock.org 27 Mar '02

27 Mar '02

| Hollings is full of it. No, he is just very stupid and/or misled. > The Congress finds: > > (1) The lack of high quality digital content continues to hinder > consumer adoption of broadband Internet service and digital television > products. This is exactly backwards, and should not be used to justify this bill. It is the lack of broadband Internet service availability which constrains the development and dissemination of high-quality original digital content. Moreover, blessing only the likes of Hollywood production companies with the term "high-quality" is offensive. Countries which develop a real broadband market will notice that a "geocities distributed into households" market in original digital content develops, and that the law of large numbers suggests that some of this content will be high quality (consider the best of geocities in its prime) by anyone's standards except possibly Congress's. That highly revenue-minded organizations might not know how to take advantage of a market of millions of always-on/high-speed-connected urban households in the USA is sad, but it ignores the question: why does such a market not exist? Simple: the iLECs are strangling it off. Perhaps their interests and the Hollywoods' interests dovetail so much that we could see mergers between big content owners and last-mile owners. Then there'd be the fun choice between actively-filtered broadband ("watch all the high quality [as determined by Congress!] digital content you can pay for, and see none of that darned free stuff!") and no broadband at all, on a market-by-market basis. Cooooool! So cool, in fact, that I think that this bill is doomed because it does not go far enough to support exactly that sort of development. Sean.

5 4

EarthLink founder guilty of operating a Ponzi scheme
by blitz 27 Mar '02

27 Mar '02

LOS ANGELES The co-founder of EarthLink, one of the nation's largest Internet providers, agreed yesterday to plead guilty to operating a Ponzi scheme that involved $593 million and 800 investors, including celebrities. Reed Slatkin acknowledged in court documents that he was responsible for $254 million in losses and agreed to plead guilty to mail fraud, wire fraud, money laundering and obstruction of justice charges. Full story here: http://www.uniontrib.com/news/business/20020327-9999_1n27ponzi.html Like we didn't know?

1 0

Re: Route filters, IRRs, and route objects
by Przemyslaw Karwasiecki 27 Mar '02

27 Mar '02

Yes, This is true, and I am using cisco prefix list already, and "upto" notation on juniper boxes. The problem is that some providers (like LEVEL3) requires that all routes are registered in some IRR before they will consider them valid/legitimate.... So I have filters accepting from my customers whatever le 24, but once those routes are propagated over Internet and they reach eventually providers like Level3, they have their filters accepting only those routes, which are registered on some IRR in exact way.... Przemek On Wed, 2002-03-27 at 14:56, Rob wrote: > this can be easily achieved on ciscos (IOS 11.3.1 and up) by using prefix lists. note the following example: > > ip prefix-list 1 permit 10.0.0.0/18 le 24 > > the le 24 at the end indicates that this line of the prefix list will allow any prefix less than or equal to 24 within the 10.0.0.0/18 block. apply this inbound to your bgp neighbor and there is your filter. for this particular example, you could use any number from 19 to 32 to indicate how long of a prefix you will allow. > > i hope this answers your question. cheers! > > -R > > > Przemyslaw Karwasiecki [karwas(a)ifxcorp.com] wrote: > > > > Hello, > > > > I would like to ask you for an advice in regards to > > "proxy registering" of customer route objects in IRR. > > > > What is the best current practice in a situation, > > when your customers want to advertise to you several > > /18 or /19 but they also have a requirement to be able > > to advertise some deaggregated routes on top of aggregates. > > > > It is very common that they are unable to predict exactly > > which deaggregated routes they will need to advertise, > > as they use those to achieve some traffic engineering > > objectives which change over time. And "over time" does > > NOT occur once per 30 minutes or so, so they DON'T > > generate any major BGP fluctuations. > > > > Forgive my ignorance, but is my understanding of RPSL > > correct, that it should be possible to specify routes > > in a way which will allow cover aggregate plus whole > > set of possible more specific routes upto certain netmask > > length. Something like: 10.0.0.0/18^18-24 > > > > So why this is uncommon to use such notation to describe > > routing policy, and use it to generate filters? > > > > Why it is required by some providers to generate explicit, > > exact route objects, in order to allow routes through > > their filters? > > > > Is it really necessary to "explode" route-sets like > > those 10.0.0.0/m^m-n into 2^(n-m+1) separate route objects > > to meet requirements of some providers? > > > > I believe that this is very common problem, so if there > > are any places on the web with some "best practice" > > documents, please point me to them. > > > > Thank you, > > > > Przemek > >

2 1

Re: How to get better security people
by Roger Marquis 27 Mar '02

27 Mar '02

"E.B. Dreger" <eddy+public+spam(a)noc.everquick.net> wrote: > Service patches were never applied. When some suspicious > happenings left said server inoperable, they just installed > Win2000 and went on, not caring what had happened or why. > > No, I was not the employee. A friend of mine worked there before > getting fed up and quitting. We see this a lot too. It is, IMHO, why good security people who are not in finance, defense or other security-conscious sectors tend to be consultants. Consultant or not IS security gurus are no different than other in-demand technical specialists. You have to 1) pay them appropriately, 2) have a decent working environment (no windowless cubicles, junk food cafeterias, inflexible hours, unskilled management, etc), and 3) provide constant training opportunities (conferences, classes, good assignments). Don't expect them to have programming degrees or be interested in coding. Those would be security developers as opposed to security analysts. Finally, NEVER ask a Unix literate engineer to use an MS Windows PC... -- Roger Marquis Roble Systems Consulting http://www.roble.com/

1 0