November 2003 - Test - lists.nanog.org

Excellent spin for a complete network outage
by Sean Donelan 14 Nov '03

14 Nov '03

The Naval Air Warfare Center Aircraft Division, in conjunction with NAVAIR and Navy/Marine Corps Intranet/Information Strike Force, will conduct a complete outage of computer networks from Nov. 22 at 11 p.m. to Nov. 23 at 7:30 a.m. During the outage, customers will not be able to access e-mail, Internet services or online corporate applications. All activities are encouraged to consider the impact of this outage and adjust operations accordingly.

1 0

RE: The Cidr Report
by McBurnett, Jim 14 Nov '03

14 Nov '03

> > On Fri, 14 Nov 2003, Suresh Ramasubramanian wrote: > > > Stephen J. Wilcox writes on 11/14/2003 7:16 AM: > > > > > So anyway, was discussing the cidr report at the last > nanog.. I was pointing out > > > that deaggregation is discouraged by the naming and > shaming and then someone > > > else pointed out that this list has scarcely altered in months. > > > > > > So, what can we do as the operator community if this > report isnt having the > > > desired effect? > > > > Stop accepting /24 type routes? Please no... That will drop me off the map.. > > Yeah maybe but what about where the RIRs have assigned > independent /24 space.. > or ISPs have subdelegated the IPs to a multihomed customer, > was more thinking > about where a bunch of routes originating from a single ASN > can be aggregated > rather than routing bloat in general. There are numerous such > examples of people > with eg a /19 announcing 32x /24 etc > > Steve I don't have the stats handy at the moment, but we decided to Multi-home I researched several issues with /24 blocks. One thing that seemed to stick out was that some providers were using /20 and /21 as "multi-home" blocks. They were reserving that block just for /24 multi-homing.. and I also remember that of the /24 being annouced independently, a majority of them were not multihomed....... just how bad is the auto-summarization at the upstream for the route propagation via BGP in the large routers anyway? Jim

2 1

Net Security Gets Root-Level Boost
by Hank Nussbacher 14 Nov '03

14 Nov '03

http://www.technewsworld.com/perl/story/32116.html -Hank

2 1

looking for pull traffic
by matthew zeier 14 Nov '03

14 Nov '03

Higher powers have decided our 95/5 traffic slit needs to move closer to 60/40 (transit pricing). I'm looking for legitimate ways to generate a significant amount of pull traffic, including partnerships with Southern California ISPs. Thanks. -- matthew zeier - "Curiosity is a willing, a proud, an eager confession of ignorance." - Leonard Rubenstein

7 7

Re: FW: Cost of Worm Attack Protection
by kgraham＠rogers.com 14 Nov '03

14 Nov '03

It would be great not to spend any money and let the worms run their course. But when you have to deal with downed production at the cost of give or take possibly 500K per attack it unfortunately cannot be done without one loosing their job. The last worm that spread throughout enterprises mentioned having to reinstall the entire server. If that server is a critical production server what would you do? Would spending 100K prevent the attack, very likely not. Would spending 100K help track the offending machine(s) and enable someone to remove them from the network until they are serviced, possibly? Would this help keep production rolling, possibly? The installation management and response time needed to implement an IDS solution does have to be investigated to see if the ROI comes in line with the cost. The ROI would need to include any saved downtime. If someone has this information please pass it along. A nicer solution would be an operating system that does not need a critical patch every other week, due to it's exploitable nature. Yes I am dreaming :) Kim > > From: "Braun, Mike" <MBraun(a)firstam.com> > Date: 2003/11/13 Thu PM 03:02:59 EST > To: "'nanog(a)merit.edu'" <nanog(a)merit.edu> > Subject: FW: Cost of Worm Attack Protection > > > The old saying of "you get what you pay for" seems to be well directed when > it comes to this topic. If you're willing to allocate $100K more than you > currently spend to mitigating the effects from Worms and Viruses, I'm sure > you will have some increased success. If you allocate 1 mill more, your > success will increase substantially. The true cost really boils down to > what you are trying to protect, such as how many servers, users, network > segments, and other critical devices you are willing to encompass in your > protection plan. Also, you may be able to mitigate the cost by using the > functionality built into devices you may already own. A good protection > schema needs to address the use and benefits from the following: Firewalls, > VPN tunnels and policies, HIDs, NIDs, Antivirus software, and a good network > security policy that grows with your network. You may already have most of > this in place and need only a little extra funding allocated to give you the > protection level you feel comfortable with. > > If you're looking for pricing on each component, they will vary widely > depending on the brand and model you go with. You should shop around for > components that suit your budget. An example of this price variance can be > found by looking at a Net Forensics project priced at $500k compared to a > similar solution going will Network Intelligence at $40K. The Network > Intelligence solution may not have all the functionality offered by Net > Forensics, but it may be enough for your needs. > > Best of luck in fighting this ever growing problem, > > Mike Braun > > -----Original Message----- > From: sgorman1(a)gmu.edu [mailto:sgorman1@gmu.edu] > Sent: Thursday, November 13, 2003 7:59 AM > To: Joel Jaeggli > Cc: nanog(a)merit.edu > Subject: Re: Cost of Worm Attack Protection > > > > Good point - then what is the cost of attempting to mitigate or handle > attacks vs. doing nothing? > > ----- Original Message ----- > From: Joel Jaeggli <joelja(a)darkwing.uoregon.edu> > Date: Thursday, November 13, 2003 10:14 am > Subject: Re: Cost of Worm Attack Protection > > > I haven't seen any network or customer site that has protected > > itself from > > worms... only mitigated them. > > > > joelja > > > > On Thu, 13 Nov 2003 sgorman1(a)gmu.edu wrote: > > > > > > > > > > > I was hoping to get some estimates from folks on the costs of > > defending> networks from various worm attacks. It is a pretty > > wide open question, > > > but if anyone has some rough estimates of what it costs per edge, > > > manpower vs. equipment costs, or any combination thereof it > > would be of > > > great assistance. We are doing some simulations of attack and > > defense> strategies and looking for some good metrics to plug into > > a cost benefit > > > model. We'd be happy to share the results if anyone is > > interested as > > > well. > > > > > > Thanks in advance, > > > > > > sean > > > > > > > -- > > ------------------------------------------------------------------- > > ------- > > Joel Jaeggli Unix Consulting > > joelja(a)darkwing.uoregon.edu > > GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB > > B67F 56B2 > > > > > > > > > "MMS <firstam.com>" made the following > annotations on 11/13/2003 12:03:21 PM > ------------------------------------------------------------------------------ > "THIS E-MAIL MESSAGE AND ANY FILES TRANSMITTED HEREWITH, ARE INTENDED SOLELY FOR THE USE OF THE INDIVIDUAL(S) ADDRESSED AND MAY CONTAIN CONFIDENTIAL, PROPRIETARY OR PRIVILEGED INFORMATION. IF YOU ARE NOT THE ADDRESSEE INDICATED IN THIS MESSAGE (OR RESPONSIBLE FOR DELIVERY OF THIS MESSAGE TO SUCH PERSON) YOU MAY NOT REVIEW, USE, DISCLOSE OR DISTRIBUTE THIS MESSAGE OR ANY FILES TRANSMITTED HEREWITH. IF YOU RECEIVE THIS MESSAGE IN ERROR, PLEASE CONTACT THE SENDER BY REPLY E-MAIL AND DELETE THIS MESSAGE AND ALL COPIES OF IT FROM YOUR SYSTEM." > ============================================================================== > >

2 1

Re: This may be stupid but
by Fisher, Shawn 14 Nov '03

14 Nov '03

I created a test of my own that I typically give to candidates. This has proved very helpful in determining if the prospective hire has strengths in the areas I need. Everytime I have skipped using the "test" I get burned. That being said I am still looking for attitude and work ethic as being a major component of the decision. Uh..I just realized I started this thread, I better be sit back and be quiet. -------------------------- Sent from my BlackBerry Wireless Handheld

2 1

Voice Compression
by Robert White 13 Nov '03

13 Nov '03

I am looking for an economical solution to compress 1248 voice DS-0s to 240 DS0s. My application is to extend the voice and data for a call center that needs roughly 63 T-1 equivalents of bandwidth down 21 physical T-1 ciscuits.

6 6

re: This may be stupid but
by Don Mills 13 Nov '03

13 Nov '03

I just had to respond to this thread and throw my 2 cents in. I can certainly see the frustration of hiring managers (having done so myself) that receive a load of resumes full of "certified" individuals who don't know squat. That is what a tech interview is for, though isn't it? Unfortunately to get to that interview you need a bit of flash to get your foot in the door. The world is as full of people claiming to be a linux guru as it is of MCSE's. I think some certs at least show that you are capable of learning, and some of the higher level ones show that you are capable of understanding/using concepts as well. Now I freely admit to being a cert collector/whore - I just do it for fun nowadays but I am willing to back every bit of it up in a tech interview - in fact I normally ask to tech interview with the heads of the unix, security, AND networking groups to prove I know what I claim to know (and I'm pretty sure I could pass as a high-level Microsoft guy if I desired). But it would be a tragic mistake on anyone's behalf to pre-assume that all those letters means I don't know what I am talking about. That's stereotyping, isn't it? -- Don Mills SCSA SCNA CCNP CCDP CISSP CQS-VPN CQS-PIX Chief Network Security/WAN Architect VA Dept. of Social Services don.mills(a)dss.virginia.gov

2 3

Re: looking for pull traffic
by Paul Vixie 13 Nov '03

13 Nov '03

> Ahh, but are you saying that current blow-based transit pricing is stable? ah. no. current transit pricing is way way lower than a non-bankrupt provider can afford to do it for on an ROI that the public markets would find worthy of their praise. eventually, all kinds of flies are going to hit all kinds of windshields. but there's so much bankrupt asset in the field right now that nobody still knows how much anything really costs them to produce. so it's apparently stable for now. > Maybe I am exceptionally naive, but are DDOSes *REALLY* that consistent > between providers to affect month-over-month or quarterly ratios? yes. because if you're a small provider then you only need a small flow to balance yourself. and the 95th percentile cuts both ways.

2 1

NANOG30 Call for Presentations
by Susan Harris 13 Nov '03

13 Nov '03

* * * * * * * * * * * * * * * * * CALL FOR PRESENTATIONS NANOG 30 ****************************************** CELEBRATING OUR 30th MEETING and 10th YEAR ****************************************** General Session Tutorials Case Studies Research Forum February 8-10, 2004 * * * * * * * * * * * * * * * * * The North American Network Operators' Group (NANOG) will hold its 30th meeting February 8-10, 2004, in Miami, Florida. The meeting will be hosted by Terremark and held at the Radisson Miami Hotel. This is the second time Terremark has hosted NANOG - NANOG24 was also held in Miami, in February 2002. Registration for NANOG30 opens December 15. NANOG conferences provide a forum for the coordination and dissemination of technical information related to backbone/enterprise networking technologies and operational practices. Meetings are held three times each year, and include two days of short presentations, plus afternoon/evening tutorial sessions. The meetings are informal, with an emphasis on relevance to current backbone engineering practices. NANOG conferences draw over 450 participants, mainly consisting of engineering staff from national service providers, and members of the research and education community. For more information about NANOG meetings, schedules, and logistics, see: http://www.nanog.org ------------------------------------------------------------------------------ CALL FOR PRESENTATIONS NANOG invites presentations on backbone/enterprise engineering, coordination, and research topics. Presentations should highlight issues relating to technology already deployed or soon to be deployed in core Internet backbones and exchange points. Vendors are encouraged to work with operators to present deployment experiences with the vendor's products. Researchers are invited to present short (10-minute) summaries of their work for operator feedback. Topics include routing, network performance, statistical measurement and analysis, and protocol development and implementation. Studies presented may be works in progress. Researchers from academia, government, and industry are encouraged to present. The community is invited to present talks on: -- Security attacks/mitigation, tools, and analysis -- Operator experience/how-to's on building packet-switched networks (e.g., IP or MPLS) that can carry TDM, Layer 2 (e.g., Frame Relay and ATM), IP services, and emerging services such as VPLS -- Experience with active DoS retaliation methods, e.g., reverse port scanning -- Operator case studies on: - Implementation experience with 10/100Gig E - VOIP architectures and deployment - Integration with optical control planes (GMPLS, ASON, etc.), voice (enterprise, Class 4 and Class 5), and video - Provisioning and automation - Enterprise network security, management, and route control - Network troubleshooting and problems solved -- Experience with active DoS retaliation methods, e.g., reverse port scanning. -- Implementation and use of measurement technologies in vendor devices Other potential topics include: -- Backbone traffic engineering -- Impact of BGP dynamics on backbone traffic patterns -- Route processor architecture -- Large-scale wireless deployment -- Building large-scale measurement infrastructure -- Inter-domain multicast deployment NANOG also welcomes suggestions/recommendations for tutorials, panels, and other presentation topics. ------------------------------------------------------------------------------ HOW TO PRESENT Submit a detailed abstract or outline describing the presentation in email to nanog-support(a)nanog.org. The deadline for proposals is December 22, 2003. While the majority of speaking slots will be filled by December 22, a limited number of slots will be available after that date for topics that are exceptionally timely and important. Submissions will be reviewed by the NANOG Program Committee, and presenters will be notified of acceptance by January 12. Final drafts of presentation slides are due by January 28, and final versions February 4. ---------------------------------------------------------------------------

1 0