February 2003 - Test - lists.nanog.org

(no subject)
by Lynn Bashaw 05 Feb '03

05 Feb '03

Does anyone on the list know of any ISPs that bill based on average utilization, rather than some variation of 95th percentile? Thanks Lynn Bashaw Director, Network Engineering Yipes Enterprise Services 2000 S. Colorado Blvd. Denver, CO 80222

8 7

issues with sprint in chicago?
by Eric Whitehill 05 Feb '03

05 Feb '03

Is there anyone else out there that seems to be reporting issues with sprint in chicago? In the last hour, i've had 1/2 dozen customers seeming to be calling with issues across some stuff in chicago. Trying to see if this is a sprint problem or a my problem. Thanks! -Eric

1 0

RE: your mail
by Bill Woodcock 05 Feb '03

05 Feb '03

On Wed, 5 Feb 2003, Koepp, Karsten wrote: > Volume usually totals in+out, whereas average does max(in,out) > divided by time intervals. Well, not to be nit-picky, but that wouldn't strictly be averaging, then. To get back to the question at hand, another scheme that I'm seeing more prevalent lately is dual-bin, where local traffic is flat-rate, and international traffic is measured-rate (i.e. billed per-bit). That's relatively easy to do in a simple satcom-up sort of network, since you just bill by netflow accounting on the satcom interface. There's been a really good discussion of these sorts of billing methods going on on the NordNOG list over the past two weeks, and we'll be having a panel discussion on billing methods at the NordNOG meeting next week. -Bill

1 0

Network Operations "Metrics"
by Pete Kruckenberg 05 Feb '03

05 Feb '03

CEO's are judged by their company's profitability, long-term growth, efficiency, etc. Students are judged based on quizes, reports, mid-terms and finals. The economy is tracked by tracking individual sectors, quarter-to-quarter and year-over-year performance, unemployment, interest rates, etc. What metrics are used to measure networks and network operators? What "micro" measurements (the equivalent of tracking travel expenses or cost-of-sales to ensure overall profitability) are used to ensure good macro-level (up-time, network reliability, application performance, happy customers)? What systems/processes do you use to track all of this information, and associate it to overall business success? Thanks. Pete.

7 6

What could have been done differently?
by Sean Donelan 04 Feb '03

04 Feb '03

On Tue, 28 Jan 2003, The New York Times wrote: > A spokesman for Microsoft, Rick Miller, confirmed that a > number of the company's machines had gone unpatched, and > that Microsoft Network services, like many others on the > Internet, experienced a significant slowdown. "We, like the > rest of the industry, struggle to get 100 percent > compliance with our patch management," he said. Many different companies were hit hard by the Slammer worm, some with better than average reputations for security awareness. They bought finest firewalls, they had two-factor biometric locks on their data centers, they installed anti-virus software, they paid for SAS70 audits by the premier auditors, they hired the best managed security consulting firms. Yet, they still were hit. Its not as simple as don't use microsoft, because worms have hit other popular platforms too. Are there practical answers that actually work in the real world with real users and real business needs?

20 29

Re: EuroNOG
by woody＠pch.net 04 Feb '03

04 Feb '03

Oh! Sorry, we didn't know Jim FLEMING was behind it. I'm sure we're all glad to be thus reassured of its bona fides. ----Original Message---- From: Nicolas DEFFAYET <nicolas.deffayet+woody%ndsoftware.net(a)paixhost.pch.net> Subject: Re: EuroNOG On Tue, 2003-02-04 at 11:09, Stephane Bortzmeyer wrote: As requested by Pascal Gloor on EuroNOG mailing-list, i reply to Stephane's message. Flames & co > /dev/null > On Mon, Feb 03, 2003 at 04:52:57PM -0800, > bmanning(a)vacation.karoshi.com <bmanning(a)vacation.karoshi.com> wrote > a message of 45 lines which said: > > > how/why is this proposed group distinct from the European Operator Forum? > > Bill, Nicolas Deffayet just wanted a NOG for himself. Let him play. > > For those who are not members of the 6bone or who do not know France, > let's remind them that: > > * NDsoftware does not exist (it is not in the French directory of > companies) NDSoftware exist. > * Mike Cheney does not exist (NDsoftware lists several english names > because it is "more serious" but all of them are actually fake) Mike CHENEY exist. Mike is (with 2 other people) the EuroNOG founder. > * Euronog is just a spinoff of NDsoftware, no operator ever > participated in it. EuroNOG is neutral. NDSoftware is just a sponsor for domain, website and hosting. There is many operators on euronog(a)ml.euronog.org and there are active: 1: First message 2 Feb 2003 Nicolas DEFFAYET 2: EuroNOG (European Network Operators Group) 3 Feb 2003 Mike CHENEY 3: lets start!!! 3 Feb 2003 Pascal Gloor 4: Re: lets start!!! 3 Feb 2003 Pascal Gloor 5: Re: lets start!!! 3 Feb 2003 Nicolas DEFFAYET 6: Welcome & Workgroup Proposal 4 Feb 2003 Jan Czmok 7: Re: Welcome & Workgroup Proposal 4 Feb 2003 Nicolas DEFFAYET 8: Re: lets start!!! 4 Feb 2003 Blindauer Emmanuel 9: TODO proposal 4 Feb 2003 Nicolas DEFFAYET 10: Re: TODO proposal 4 Feb 2003 Henk Uijterwaal (RIPE-NCC) 11: Re: TODO proposal 4 Feb 2003 Mike CHENEY 12: "...explain how Euronog will differ..." ? 4 Feb 2003 Jim Fleming 13: DDoS tracking WG 4 Feb 2003 Daniel Concepcion 14: Re: DDoS tracking WG 4 Feb 2003 Jim Fleming 15: Re: DDoS tracking WG 4 Feb 2003 Michael Hallgren 16: Re: DDoS tracking WG 4 Feb 2003 Daniel Concepcion 17: Re: TODO proposal 4 Feb 2003 Mike CHENEY 18: Re: DDoS tracking WG 5 Feb 2003 Mike CHENEY 19: explanations needed 5 Feb 2003 Pascal Gloor 20: Re: DDoS tracking WG 5 Feb 2003 Jan Czmok 21: Re: explanations needed 5 Feb 2003 Jim Fleming 22: Re: DDoS tracking WG 5 Feb 2003 Jan Czmok 23: Re: DDoS tracking WG 5 Feb 2003 Daniel Concepcion 24: NOC contact list...database development... 5 Feb 2003 Jim Fleming If you want subscribe to the mailing-list: euronog-subscribe(a)ml.euronog.org. -- Nicolas DEFFAYET, NDSoftware NDSoftware NOC: http://noc.ndsoftwarenet.com/ FNIX6: http://www.fnix6.net/ EuroNOG: http://www.euronog.org/

2 1

Re: Remote email access
by John R Levine 04 Feb '03

04 Feb '03

> Blocking "direct-from-dialup" spam is best done on the receiving end, > blocking *unauthenticated* SMTP connections made directly from dial-up > IPs. If there were a definitive list of dialup and DHCP IP ranges, I might agree. But after some years of compiling the MAPS DUL, Pan Am's PDL, the osirusoft list, and who knows how many others, there isn't, so I don't see how that's a practical approach. Blocking outbound SMTP also prevents relay exploits of unsecured servers that will never be secured, and there'll never be a definitive list of them, either. > IMHO, to block ALL outbound port 25 traffic > on the sending end is throwing the baby out with the bathwater. It certainly is, but for most ISPs, there's a very small baby in a huge tub of spam. Remember that this whole question only occurs for dialup or DHCP users who are not using their ISP's mail service. While that probably includes just about everyone you and I know, overall, it's a teensy minority of ISP customers. Regards, John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner "A book is a sneeze." - E.B. White, on the writing of Charlotte's Web

2 2

Tracing where it started
by Phil Rosenthal 04 Feb '03

04 Feb '03

Hello, It might be interesting if some people were to post when they received their first attack packet, and where it came from, if they happened to be logging. Here is the first packet we logged: Jan 25 00:29:37 EST 216.66.11.120 --Phil ISPrime

21 32

Re: Remote email access
by Dave Crocker 04 Feb '03

04 Feb '03

JC, Monday, February 3, 2003, 9:43:01 PM, you wrote: JD> Dave Crocker wrote: >> Recently I had protracted discussions with a number of Ops folks about >> this issue and have chosen to drop that debate. I do not agree with >> blocking port 25, either, but am far more concerned about having a ... JD> Why does a single solution need to be "broadly supported"? interoperability. when there are choices for solving the same problem, a service can make one choice -- or, in this case, each of at least two different services can make different choices -- and a software vendor can make yet another another. then there is no interoperability. that is exactly the problem that I have repeatedly experienced. JD> IMHO, all JD> that is needed is for each individual to find a solution that works for JD> them, given their preferred email client, email host, and provider options. hmmm. sounds like I have not described the problem clearly enough. So here is the short form: My email service provider permits me to post new email from anywhere on the net, as long as I go through proper authentication. (The details of how this is done do not matter; the method is reasonable and sufficient.) The provider happens to support this posting via port 25. When I am traveling, my access often is through a provider that kindly block outbound port 25, so I cannot post email. Each provider has behaved as you suggest, and the result is that I cannot post email. JD> My present solution is to ssh into a server where I have an account, Once again: I have no doubt that individuals are able to solve their individual problems, individually, especially when they are technically savvy. That approach does not make for a viable, large-scale (as in mass-market) industry. d/ -- Dave <mailto:dcrocker@brandenburg.com> Brandenburg InternetWorking <http://www.brandenburg.com> t +1.408.246.8253; f +1.408.850.1850

7 14

ATT Dallas Latency? Master Ticket
by Brennan_Murphy＠NAI.com 04 Feb '03

04 Feb '03

Anyone know of a master ticket for latency on ATT's Dallas network? Looks like they have some routing problems this morning. We see traceroutes hit 2sec latency at various hops in their Dallas network. Anyone else see this? Wouldnt normally post a note like this but having trouble getting clear communication from carrier. TIA. 4 | | 12.123.16.30 | gbr1-a30s8.dlstx.ip.att.net | Dallas, TX, USA | | 0 | x | 12.123.16.0 | | 5 | | 12.122.12.57 | tbr1-p013801.dlstx.ip.att.net | Dallas, TX, USA | | 1917 | ----x----- | 12.122.12.0 | | 6 | | 12.122.12.74 | ggr1-p340.dlstx.ip.att.net | Dallas, TX, USA | | 0 | x | 12.122.12.0 | | 7 | | 208.172.129.129 | acr2-so-2-1-0.Dallas.cw.net | Dallas, TX, USA | | 0 | x | 208.172.129.0 | | 8 | | 208.172.130.104 | agr4-loopback.Dallas.cw.net | Dallas, TX, USA | | 0 | x | 208.172.130.0 | | 9 | | 208.172.139.29 | dcr1-so-1-3-0.Dallas.cw.net | Dallas, TX, USA | | 0 | x | 208.172.139.0 |

1 0