September 2003 - Test - lists.nanog.org

Internetwork smarTest
by Dean Bogdanovic 15 Sep '03

15 Sep '03

Hi I am looking if somebody has some experience with Internetwork smarTest. Any feedback (preferably off list) would be greatly appreciated. Dean

1 0

RE: Cisco IOS Failure due to Virus
by Mark Segal 15 Sep '03

15 Sep '03

Got love nanog.. A nice man from cisco called me, it looked like a lot of packets on my router were being process switched (sh ip cache - displayed A LOT of entries). Anyway, it turns our some of my atm sub-ints inherited a "no ip route-cache cef" from a parent int and well you can see what happens when the packet volume increase. Richard I would check that.. So now to life the rate-limit and see what happens.. Regards, Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Mark Segal [mailto:MSegal@Corporate.FCIBroadband.com] Sent: September 15, 2003 1:50 PM To: 'Richard J.Sears'; 'Robert Blayzor' Cc: 'Nanog'; Mihai Iancu Subject: RE: Cisco IOS Failure due to Virus We are seeing the same problem on all of the 6400-nrp aggregation boxes we have in the network. Here is the IOS bug ID - CSCec12495.. Actually by rate limiting icmp on our network the problems have stopped/slowed down a lot. Sorry for the delay.. Was out of the country for a while.. Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Richard J.Sears [mailto:rsears@adnc.com] Sent: September 11, 2003 12:26 AM To: Robert Blayzor Cc: Nanog Subject: Re: Cisco IOS Failure due to Virus Hi Robert, Thanks for the info. We are running dCEF...routers show about 4% CPU load and the following memory: BR02#sh mem Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 613AE340 247798976 106515996 141282980 140653360 134546752 Fast 6138E340 131080 37240 93840 93840 93788 Also, we are not blocking 92 byte ICMP due to the traceroute problems on customers networks... Thanks On Wed, 10 Sep 2003 23:17:01 -0400 Robert Blayzor <rblayzor(a)inoc.net> wrote: > > On 9/10/03 10:58 PM, "Richard J.Sears" <rsears(a)adnc.com> wrote: > > > %SYS-2-MALLOCFAIL: Memory allocation of 704 bytes failed from > > 0x60329F00, alignment 0 > > Pool: Processor Free: 92744 Cause: Memory fragmentation Alternate > > Pool: None Free: 0 Cause: No Alternate pool -Process= "Pool > > Manager", ipl= 0, pid= 6 -Traceback= 6038049C 60382200 60329F08 > > 6038DEDC > > > > %TCP-6-NOBUFF: TTY0, no buffer available > > -Process= "BGP Router", ipl= 0, pid= 132 > > > > %% Low on memory; try again later > > Did you enable CEF? > Are you dropping 92 byte ICMP packets where needed? > > -- > Robert Blayzor, BOFH > INOC, LLC > rblayzor(a)inoc.net > PGP: http://www.inoc.net/~dev/ > Key fingerprint = A445 7D1E 3D4F A4EF 6875 21BB 1BAA 10FE 5748 CFE9 > > "I don't need parents. All I need is a recording that says, 'Go play > outside!" - Calvin and Hobbes > ****************************************** Richard J. Sears Vice President American Digital Network ---------------------------------------------------- rsears(a)adnc.com http://www.adnc.com ---------------------------------------------------- 858.576.4272 - Phone 858.427.2401 - Fax ---------------------------------------------------- I fly because it releases my mind from the tyranny of petty things . . "Work like you don't need the money, love like you've never been hurt and dance like you do when nobody's watching."

1 0

list thoughts on "unsupported" hardware?
by Ray Wong 15 Sep '03

15 Sep '03

I realize this isn't arguing about Windows patch mechanisms, but recently realized I've never answered this issue to my own satisfaction... How long do we keep upgrading and using network hardware once it's fallen off the support lists? The Cisco 7500 finally went off back in Feb of this year, as I recall. 3rd party upgrades, and used parts, are still readily available. (Actually, does anyone have suggestions on vendors for said upgrades and parts? I've noticed a lot more discounting than in the past, but usually from vendors I have no experience with). A client I've recently taken on happens to be relying on a 7500 for their border. In reality, their current use could fit on a 2621/2650, though they have been much larger in the past (there's a small pile of DS3 cards sitting on the shelf). They're still relying on a single provider for connectivity, etc. So, does anyone have any thoughts on how long we should be letting our poorer customers/employers live with products that are officially off the support lists? Clearly there will be (i.e. IOS) image support for quite some time. Is keeping (tested) spares around sufficient to justify actually spending some money to fit the newer/larger images? Newer/still current hardware seems much more a no-brainer, but advocating spending a thousand bucks to avoid spending 5x that on a more current fire-sale item is a little less clear, to me. -- Ray Wong rayw(a)rayw.net

1 0

RE: 92 Byte ICMP Blocking Problem
by Mark Segal 15 Sep '03

15 Sep '03

When I checked last week 1 in 4 packets was an ICMP message, so we rate limited ICMP ECHO and ICMP ECHO-REPLY messages.. And it only bugged PING'ers and windows traceroute users.. All those low memory alarms are now no longer plaguing our NMS. Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: John Souvestre [mailto:johns@sstar.com] Sent: September 13, 2003 11:53 PM To: jlewis(a)lewis.org Cc: nanog(a)nanog.org Subject: RE: 92 Byte ICMP Blocking Problem Hi. I've been running with the service policy version and haven't seen any problem either. I did notice that it seems to block DOS traceroutes, however. John John Souvestre - Southern Star - (504) 888-3348 - www.sstar.com -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of jlewis(a)lewis.org Sent: Saturday, September 13, 2003 10:18 PM To: William Devine, II Cc: Nanog Subject: Re: 92 Byte ICMP Blocking Problem Importance: High That's really weird. I've been running with route-map nachiworm permit 10 match ip address nachilist match length 92 92 set interface Null0 ip access-list extended nachilist permit icmp any any echo permit icmp any any echo-reply ip policy route-map nachiworm on transit interfaces and the virtual-templates of all our access servers that can do it properly (just blocking echo/echo-reply on the older ones that can't do the policy) and haven't heard about any customer complaints other than "I can't ping" in the places where we've blocked all echo/echo-reply. The routers doing this (7200/7500)'s are all running 12.2(1-3)S. Access servers are running mostly 12.1M or 12.2XB code.

1 0

RE: Cisco IOS Failure due to Virus
by Mark Segal 15 Sep '03

15 Sep '03

We are seeing the same problem on all of the 6400-nrp aggregation boxes we have in the network. Here is the IOS bug ID - CSCec12495.. Actually by rate limiting icmp on our network the problems have stopped/slowed down a lot. Sorry for the delay.. Was out of the country for a while.. Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Richard J.Sears [mailto:rsears@adnc.com] Sent: September 11, 2003 12:26 AM To: Robert Blayzor Cc: Nanog Subject: Re: Cisco IOS Failure due to Virus Hi Robert, Thanks for the info. We are running dCEF...routers show about 4% CPU load and the following memory: BR02#sh mem Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 613AE340 247798976 106515996 141282980 140653360 134546752 Fast 6138E340 131080 37240 93840 93840 93788 Also, we are not blocking 92 byte ICMP due to the traceroute problems on customers networks... Thanks On Wed, 10 Sep 2003 23:17:01 -0400 Robert Blayzor <rblayzor(a)inoc.net> wrote: > > On 9/10/03 10:58 PM, "Richard J.Sears" <rsears(a)adnc.com> wrote: > > > %SYS-2-MALLOCFAIL: Memory allocation of 704 bytes failed from > > 0x60329F00, alignment 0 > > Pool: Processor Free: 92744 Cause: Memory fragmentation Alternate > > Pool: None Free: 0 Cause: No Alternate pool -Process= "Pool > > Manager", ipl= 0, pid= 6 -Traceback= 6038049C 60382200 60329F08 > > 6038DEDC > > > > %TCP-6-NOBUFF: TTY0, no buffer available > > -Process= "BGP Router", ipl= 0, pid= 132 > > > > %% Low on memory; try again later > > Did you enable CEF? > Are you dropping 92 byte ICMP packets where needed? > > -- > Robert Blayzor, BOFH > INOC, LLC > rblayzor(a)inoc.net > PGP: http://www.inoc.net/~dev/ > Key fingerprint = A445 7D1E 3D4F A4EF 6875 21BB 1BAA 10FE 5748 CFE9 > > "I don't need parents. All I need is a recording that says, 'Go play > outside!" - Calvin and Hobbes > ****************************************** Richard J. Sears Vice President American Digital Network ---------------------------------------------------- rsears(a)adnc.com http://www.adnc.com ---------------------------------------------------- 858.576.4272 - Phone 858.427.2401 - Fax ---------------------------------------------------- I fly because it releases my mind from the tyranny of petty things . . "Work like you don't need the money, love like you've never been hurt and dance like you do when nobody's watching."

1 0

Microsoft announces new ways to bypass security controls
by Sean Donelan 15 Sep '03

15 Sep '03

For those not keeping up with Microsoft, because so many people have started blocking Netbios, RPC, SMB, etc; Microsoft announced yet another way to bypass security. On August 1, Microsoft introduced Exchange 2003. With Outlook 2003 this introduces an new implementation fo Exchange's MAPI protocol over HTTP allowing clients to natively connect to Exchange servers without using a virtual private network (VPN). Steve Conn, Microsoft's Product manager was quoted as "Since we have got a good implementation, we're going to keep supporting it." Microsoft will evangelise the new protocol, and developers of other mail clients and servers will be encouraged to implement it. http://www.microsoft.com/office/ork/xp/beta/three/ch8/OutC07.htm "Outlook 2003 now offers a better alternative to VPN connections -- RPC over HTTP. With this feature, users can have security-enhanced access to their Exchange Server accounts from the Internet when they are working outside your organization's firewall. Users do not need any special connections or hardware, such as smart cards and security tokens, and they can still get to their Exchange accounts even if the Exchange server and client computer behind the firewall are on different networks." By the way, Microsoft's RPC-Over-HTTP uses one of the ports in another Microsoft security advisory concerning RPC vulnerabilities. Extending the list of dangerous ports to include 593, RPC-over-HTTP. A suggested work around, use a virtual private network (VPN). Of course, Microsoft isn't the only one with mail protocol security weaknesses. POP3 is probably responsible for more cleartext passwords being transmitted over the Internet than any other network protocol.

4 3

Weekly lamer report
by Rob Thomas 15 Sep '03

15 Sep '03

Hi, NANOGers. While noshing on your morning bagel don't forget to check for lame DNS delegations. There are 21771 entries in the lamer report for the week ending 14 SEP 2003. These entries are often indicators of greater problems with name server configurations. <http://www.cymru.com/DNS/lame.html> This report does not include last week's filename typo. :) Thanks! Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

RE: Cisco introduced 'warm' reload...
by Michel Py 14 Sep '03

14 Sep '03

Rodney, > Rodney Dunn wrote: > Thanks for pointing that out. I'll have it removed > from the CLI for any platforms where it's not supported. Actually, there's nothing to remove. The > cisco7507#reload ? > LINE Reason for reload Is perfectly legitimate. > The currently supported platforms are: > 3660 and 3745 in 12.3(2)T > 7200 in 12.2(18)S > I'll also check on future platform implementations and > let you know. While at first the feature seems platform > independent it turns out there are some platform > dependencies. If I may, it would be a hell of a good idea to make it work on platforms such as the 7500 where one would think it is un-necessary. On paper, having a feature set with rpr/rpr+ would render this command un-necessary on a 7500 with dual RSPs. In practice, there are so many compatibility issues with rpr/rpr+ and other features that some 7500s that have dual RSPs run a non-rpr image and the second RSP is sitting in the router as a spare. Michel.

2 2

Re: Sabotage not backhoes: More cable cuts
by George William Herbert 14 Sep '03

14 Sep '03

>Someone climbed a 15-foot tower in Southern Arizona cutting a fiber optic >cable used by Broadwing and Tucson Electric Power. This was within five >feet of the 138,000-volt power line. The site was also guarded by barbed >wire. > >This is not your typical backhoe. > >Rural areas have long dealt with the occasional shotgun damaged cable or >microwave horn; or the farmer burying the dead cow in the back pasture. >But I don't recall two reported acts of sabotage in less than 30 days >before. > >http://www.fox11az.com/news/local/stories/KMSB_local_fiberoptic_091203.9d8b… Is there *anyone* systematically looking at the impact of physical security on network links and datacenters? A lot of people make noise about it, but I haven't seen any changes even since 9/11 which would make penetration exercises any less likely to succeed (and, presumably, actual hostile activity were there to be such). -george william herbert gherbert(a)retro.com

1 0

DS1 Question
by Dennis Dayman 14 Sep '03

14 Sep '03

I am thinking of using ElPaso (elpaso.com) global telecommunications for D1 access across the SBC territory in Texas. Any one have an opinion of them. Does anyone have a list of question I should be asking potential providers of my DS1 lines? -Dennis "Sometimes I don't understand the software, and sometimes I don't understand the hardware, but I can *see* the blinking lights!"

1 0