February 2004 - Test - lists.nanog.org

Question
by Tracey Webb 11 Feb '04

11 Feb '04

Does anyone on the list have any opinions on the adtran total access 1200 using Inverse Multiplexing over ATM. Tracey Webb Network Operations Cameron Communications, LLC 337-775-3097 Office 337-583-2097 337-493-4894 page tracey.webb(a)camtel.com FCC# PG-GB-022338 ************************************************************************ *** This email and any files transmitted with it from Cameron Communications are strictly confidential and intended solely for the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. ************************************************************************ ***

1 0

RE: SMTP authentication for broadband providers
by Mark Segal 11 Feb '04

11 Feb '04

> I'm looking for comments on whether this is generally seen as a positive change or a waste > of time (ie - will the next virus or worm gleam your SMTP username and password from > Outlook Express and use it to replicate/SPAM)? We are planning on moving the same way. Without a doubt, a new virus or worm will emerge that will steal the SMTP-AUTH from the config file (or more likely, ALL the new variants will steal the SMTP-AUTH info). But, with SMTP-AUTH you can limit the number of connections and outbound emails, which is the real reason we are doing it. Also since some of the new variants are smart enough to bundle in a SMTP server, or use the local service in XP, we have taken to blocking emails from clearly marked residential high speed subnets (reverse DNS) in other providers space. Maybe its time there is some proposed rfc like device for this? Regards, Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com <http://www.fcibroadband.com/> Futureway Communications Inc. is now FCI Broadband

1 0

Re: animations from "Making Sense of BGP" talk available
by Joe Loiacono 11 Feb '04

11 Feb '04

Cool tool! It's amazing to see BGP in action and what 'really' happens. A comment: could you define the number of prefixes a little more? E.g., is it the total imported and exported across the link, imported only, exported only, context dependent, etc. Thanks! Joe Loiacono Van Jacobson <van To: nanog(a)merit.edu @packetdesign.co cc: m> Subject: animations from "Making Sense of BGP" talk available Sent by: owner-nanog 02/11/2004 02:14 AM The animations from Tina Wong's "Making Sense of BGP" talk at NANOG-30 this morning are available at: http://www.packetdesign.com/technology/presentations/nanog-30/index.htm The animations are in SVG (a W3C graphics standard) and should be viewable in any web browser but you'll probably have to download an SVG plugin first (there's a link to Adobe's free plugin at the top of the web page). If you play with the stuff, we'd welcome coments, suggestions, whatever. Thanks. - Tina, Cengiz & Van

1 0

animations from "Making Sense of BGP" talk available
by Van Jacobson 11 Feb '04

11 Feb '04

The animations from Tina Wong's "Making Sense of BGP" talk at NANOG-30 this morning are available at: http://www.packetdesign.com/technology/presentations/nanog-30/index.htm The animations are in SVG (a W3C graphics standard) and should be viewable in any web browser but you'll probably have to download an SVG plugin first (there's a link to Adobe's free plugin at the top of the web page). If you play with the stuff, we'd welcome coments, suggestions, whatever. Thanks. - Tina, Cengiz & Van

1 0

[University at Buffalo] MAN/MEN Research
by Enrico Riedel 11 Feb '04

11 Feb '04

Dear All! My name is Enrico Riedel, and I'm a Graduate Student in Management Information Systems at the University at Buffalo. Currently, I'm working on my Master's Thesis, and researching the Metro Area Networks and Metro Ethernet Networks from a technical, economical, and emerging practices point of view. The particular information I'm looking for is: ---------------------------------------------- * Information about major technical architectures --> trends in this area * Service bundles * Pricing Mechanisms and Pricing Information * For ISPs - Options that are offered to them, that they can use to provide services to their customers Does anyone have information about the above topics? If you can help me, please send me an e-mail to eriedel(a)buffalo.edu. I'm very thankful for any information I can get! Sincerely, Enrico Riedel

1 0

Re: 7500 and DCEF
by Hank Nussbacher 11 Feb '04

11 Feb '04

On Wed, 07 Jan 2004, I posted: >> They recently refreshed the platform with RSP16, VIP8, and MX. It's still >> a viable platform for many medium size providers. > >As an exercise see if you can determine when this 7513: >http://noc.ilan.net.il/stats/ILAN-CPU/new-gp-cpu.html >swapped from an RSP8 to an RSP16 in the past 2 months. After posting this a month ago, I felt I also needed to post a follow-up on the matter. If one looks at the CPU graph now, you will see that I was able to get the RSP16 to drop from 54% to 43% via altering all out ACLs from named to numbered. This is due to a bugid: CSCec07566 (Packets for interface with named ACL are not dcef switched) which affects many 12.2S versions. Next I added "ip multicast-routing distributed" and "ip mroute-cache distributed" to all multicast enabled interfaces, A reload 6 days ago caused the CPU to drop from 43% to 22% - probably due to some unknown reason - whereby all the DCEF changes were not taking hold. Lastly, on all slow serial interfaces (2Mb/sec and under), I changed the queuing to "fair-queue" and that caused DCEF to kick in and bought another 10% reduction. I am now at around 10% CPU and happy. I'd like to thank Rodney Dunn of Cisco for suggesting many DCEF fixes and configuration optimizations. -Hank

1 0

IDS data.
by Jamie Reid 11 Feb '04

11 Feb '04

We have built an experimental system that aggregates IDS alerts by sorting them into subnets, then associating them with routes from the a view of the global BGP table, and in turn associates them with their ASN. From there, we can create lists of security events as they are related to the network contact information available from the radb, ripe, arin etc. That is, we can divvy-up our IDS events by ISP (or rather, NSP) on a reasonably accurate basis, and provide a complete history of events that originated from networks announced by them. (A side project is watching for events that originate from bogons or reportedly hijacked routes. Nothing yet, but we'll see. I mailed someone ad d-sheild about getting a report of this kind of activity from them, but no answer. I'm still interested, btw) Anyway, my question is, will this actually change how we report incidents? It raises a few questions, like how many raw events constitute an incident worth alerting a service provider to? Obviously we would check the events before sending it off, but while we might care about one of our /16's getting whisker'ed by 10 sites on your network, you may not, and there is little anyone can do to compel you to care unless a law has been broken. More to the point, should we consider using contact information in maintainer objects as security incident POCs? Another side project may be a standard XML report, which sites recieving reports can in turn aggregate and mine for what to respond to, but that's just a thought. So, now that we can link our security events directly to subnets and ASNs, how would you like this data served? Regards, -j -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324

2 1

Re: question on ptr rr
by Suresh Ramasubramanian 11 Feb '04

11 Feb '04

Randy Bush wrote: > as your percentiles look worse than those here, do you think > it is indian dns maintenance or politics, or linux list > users, or both? DNS maintenance, and cluelessness at several ISPs - quite a few ISPs don't even have PTR RR for their smarthosts. Luckily most of the larger ISPs around do have PTR for their smarthosts, but several of them seem to think it is not necessary for their dialup / dsl pool, or even for their colo clients.. rDNS is an "added extra" that you have to pay for) Good thing = there's a regional netops conference called SANOG (South Asian NOG, at http://www.sanog.org) that concentrates on the indian subcontient region and is also priced cheaply enough so that lots more people from the subcontinent can attend. Priced cheaply as in other netops conferences are dirt cheap in dollars, but USD 1 = INR 48, and the average monthly salary of a mid level ISP sysadmin is something like USD 500..600. srs

1 0

Looking for someone who is very experienced with IPForwarding in Extreme switches
by Drew Weaver 11 Feb '04

11 Feb '04

I figured I wouldn't bore the rest of you with this slight oddity I've come across in ExtremeWare that I am having an issue getting resolved, but if anyone knows a decent deal about how these switches really work, and doesn't mind giving me a hand, could you tag me off list? Thanks, -Drew

1 0

Re: question on ptr rr
by Suresh Ramasubramanian 11 Feb '04

11 Feb '04

Randy Bush wrote: > btw, i did give you a cursory answer to this. and i asked if you > would provide some data. As I told you in another email, a good 40% of my mail on my personal colo comes from sources without rDNS - mostly within India, from and to some fairly large linux lists. regards -suresh

2 1