March 2004 - Test - lists.nanog.org

New route-views collector up at the LINX
by David Meyer 17 Mar '04

17 Mar '04

Folks, We are now up and running at the LINX (London Internet Exchange) and would like to invite folks at the LINX to peer with route-views. You can get to the open CLI via 'telnet route-views.linx.routeviews.org' (of course, nothing much there yet). Please contact us at help(a)routeviews.org if you would like to contribute your view. In addition, I've included our standard boilerplate below. Thanks, The Route-Views Team ----- AS : 6447 University of Oregon: route-views : 128.223.60.103 (multi-hop IPv4) route-views2 : 128.223.60.102 (multi-hop IPv4) route-views3 : 128.223.60.108 (multi-hop IPv4) : 2001:468:d01:3c::80df:3c6c (multi-hop IPv6) route-views6 : 128.223.60.194 (v6 peering only) : 2001:468:d01:3c::80df:3c6d (multi-hop IPv6) route-views.wide: 202.249.2.166 (WIDE peering only) route-views.paix: 198.32.176.5 (PAIX peering only) route-views.linx: 195.66.225.222 (LINX peering only) route-views.linx: 195.66.227.222 (LINX peering only) - Route-views does not announce _any_ prefixes. - We would like to receive a full default-free table from all sessions with all peers. - In order for our multihop-ebgp sessions to survive transient network failures, we would like to increase the BGP hold-timer to 10 minutes (600 seconds). A value of zero does not work for several cases. If possible, peers should set their hold-timer to the max value which allows Route-Views to change without your intervention. cisco: neighbor 128.223.60.x timers 21845 65535 juniper: set protocols bgp group routeviews hold-time 65535 - Please send your communities. If possible, please describe the communities you advertise. - Please provide your NOC's email and telephone number(s). - Route information from these sessions is made publicly available in two forms: manufacturer-style "show ip bgp" and MRT format. -- Short questionnaire. These data will only be shared with researchers. - What type of router(s) are we peering with? - We have a (closed) mail list which we use to announce outages to our peers. If you would like your noc added to this list, please let us know. Thanks!

1 0

Re: who offers cheap (personal) 1U colo?
by Janet Sullivan 17 Mar '04

17 Mar '04

Mike Damm wrote: > That being said, I've had the idea for a couple years now of getting enough > geeky folks together to rent a rack on both coasts and populate it with a > few different operating systems and bits of gear for just the reasons > outlined in this thread. > > So if you decide to put something together, I'm up for it. I got an email from Eric Brunner-Williams who hangs out on freebsd-isp and nanog that really sparked my interest. Go to http://wampumpeag.net/vixie-personal-1U-colo.html At the bottom of the page it reads: "We've started the paperwork with the NCBA to form a real honest-to-goodness member-owned cooperative for bloggers, and a real honest-to-goodness member-owned cooperative for personal 1U colo is just a second set of paper. This is about as vague as a price sheet can get, but this was where we were headed before Paul popped the question on NANOG, and in April we'll be accepting member 1U units."

1 0

House Panel Slams Federal IT Security
by John Obi 17 Mar '04

17 Mar '04

Hi, Federal agencies aren't doing enough to secure their network systems, even as documented cyber-attacks against the U.S. government continue to dramatically rise, U.S. Rep. Adam Putnam (R-FL) said Thursday. For more info check http://www.internetnews.com/infra/article.php/3327081 Thanks, -J __________________________________ Do you Yahoo!? Yahoo! Mail - More reliable, more storage, less spam http://mail.yahoo.com

1 0

Re: Firewall opinions wanted please
by Michael.Dillon＠radianz.com 17 Mar '04

17 Mar '04

>> _Everyone_ (network connected) should have a firewall. > Why? Every network-connected device should have a security layer. Firewalls provide a nice modular security layer and they are cheap compared to the devices/networks that they protect. > When did the end2end nature of the Internet suddenly > sprout these mutant bits of extra complexity that reduce > the overall security of the 'net? The security issue has always been there. You can either build security into the network or into the endpoints. Given that the Internet model is to keep complexity out of the network and in the endpoints, the next question is for site administrators to ask themselves, do I manage *MY* network, like the Internet, or do I manage it like an endpoint? If the answer is to treat it as an endpoint, then it is quite appropriate to install a firewall as a gateway between the network and the Internet. Consider that many endpoints in today's world now encapsulate networks within a single physical device. Routers, switches, cellphones, cars and any embedded device using I2C. Just as the distinction between a router and a switch has been blurred by the advance of technology, so too has the distinction between an endpoint and a network. --Michael Dillon

1 0

[Fwd: Re: who offers cheap (personal) 1U colo?]
by Janet Sullivan 17 Mar '04

17 Mar '04

Stephen J. Wilcox wrote: > if the market for this is nanog and you're just looking for smtp/shell surely we > can manage this between ourselves without charge (ask your nanog buddy for a > shell as a favour).. I know I can and will do this Well, I do have motives beyond outbound smtp. I actually looked at some of the mail only services, but I really want someplace that will do IMAP and authenticated SMTP. I want to be able to configure how I filter spam, which I don't want to do at the MUA level because I'll need to access mail various ways from various locations. Besides mail, I want to be able to create and control firewall rules on the box. I also want to be able to setup Apache exactly like I want it, etc. And sometimes its nice to have shell access on a machine in a different location for troubleshooting purposes. However, I do like the idea of setting up a community of like minded individuals who would be willing to do secondary MX and/or DNS for each other, and perhaps provide basic shell accounts... On the other hand, I'm a little leary of giving someone I don't know access to one of my boxes. I'm curious how a virtual colocation or dedicated server co-op could work, with values statements on how servers must be run (secure, no SPAM), etc. Would there be member fees? Would members have to democratically vote to let new members in after some kind of vetting process? Would anyone even be interested in such an idea? It would also be interesting to see what kind of monitoring tools could be developed with a diverse set of servers in different parts of the world... could we set up a co-op version of keynote monitoring, where we helped monitor each other?

1 0

Firewall opinions wanted please
by Nicole 17 Mar '04

17 Mar '04

Hi I am looking for a good but reasonably priced firewall for a 40 or so server site. Some people swear by Pix, others swear at it a lot. Also I have heard good things about Netscreen. Or any others you would recommend for protecting servers on a busy network. Don't really need anything with VPN just the standard http, ftp, ssh, https, type traffic up to 100mb throughput. From what I have heard a proxy firewall would be best? Thanks in advance!! Nicole -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ " Daemons" will now be known as "spiritual guides" -Politically Correct UNIX Page

8 8

ANNOUNCEMENT: RIPE NCC's Second Remote Route Collector in North America Deployed at the NYIIX (RRC11)
by Matthew Williams 17 Mar '04

17 Mar '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear All, The RIPE NCC is pleased to announce that the Routing Information Service's (RIS) second Remote Route Collector in North America, RRC11, is now ready to peer with members at the New York International Internet Exchange (NYIIX). The collector is our first outside of the RIPE region to accept IPv6 peering sessions. The RIS is also present at MAE-West in San Jose and we are currently looking for more peers there too. Please see the following URLs for peering details: - - http://www.ripe.net/ris/rrc11.html - - http://www.ripe.net/ris/rrc08.html Your BGP feeds are warmly welcome :) +++ Other RIS Developments: - ----------------------- * New web interface for RISwhois - RIPE NCC IPv4/IPv6 address to origin mapping The service looks up IPv4 or IPv6 addresses in the RIB dumps most recently collected by the RIS, and reports the prefixes and origin AS numbers which match the specified IP, as well as the RRCs that observed the prefixes. URL: http://www.ris.ripe.net/cgi-bin/riswhois.cgi * RIS 'MOAS' Report List of prefixes being advertised by Multiple Origin Autonomous Systems. URL: http://www.ris.ripe.net/moas/moas.html * Documentation on how to set up the RISng database and the associated tools An in-depth overview of the RIS database structure written by two students at the Technical University of Munich. URL: http://www.ripe.net/ris/analysis.html * Libbgpdump 1.4 is now available on the RIS web site Libbgpdump is a C library for reading Zebra/Quagga dump files with IPv4 and IPv6 support. The software package also includes 'bgpdump', a drop-in replacement for route_btoa with IPv6 support and better handling of corrupt data. URL: http://www.ris.ripe.net/source/ +++ For more info about the RIS: http://www.ripe.net/ris. Feel free to drop us a line at ris(a)ripe.net. Best regards, The RIS Team --- > Matthew Williams (MW243-RIPE) > Customer Liaison Engineer > RIPE NCC - http://www.ripe.net/np/ -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBQFg4NMHkFbJe+GdoEQJCNACePKtzxSUuGEH41Aa8ECLgqkBFekMAoKop mq+MIgrl4q9rQ2NBhdcD5XZP =ygY7 -----END PGP SIGNATURE-----

1 0

Assymetric Routing / Statefull Inspection Firewall
by Mike Turner 17 Mar '04

17 Mar '04

Hello Everyone, I am currently looking for a statefull inspection firewall that support asymmetric routing - is there such a product? I cannot imagine that I am the only person with redundant Internet connectivity, that would like to put firewalls near the edge of our network. Any thoughts / Suggestions would be greatly appreciated! Thanks, Mike

5 4

who offers cheap (personal) 1U colo?
by Paul Vixie 17 Mar '04

17 Mar '04

every time i tell somebody that they shouldn't bother trying to send e-mail from their dsl or cablemodem ip address due to the unlikelihood of a well staffed and well trained and empowered abuse desk defending the reputation of that address space, i also say "buy a 1U and put it someplace with a real abuse desk, and use your dsl or cablemodem to tunnel to that place." and then a few questions come in -- "where can i put a 1U for the $50/month you claim is possible?" so as a public service i've decided to gather some answers to that question and put them on the web someplace so i can refer folks to it when i'm asked. if you know of a place that offers 1U/month for $50/month with some kind of bandwidth limitations (moderate peak, low average), and a strong abuse desk (including repossessing the 1U server upon proof of abuse or neglect), please send me e-mail with a url and some details. i'll summarize it all online and report the aggregation URL back to this mailing list.

34 73

Managing Network Monitoring Equipment (RFC)
by Andrew D Kirch 16 Mar '04

16 Mar '04

As I was trolling through SlashDot's Star Trek's Design Influence On Palm, New Tech (please don't shoot me), I came upon a series of posts (cited below) that almost got to the point of a problem I'm having: My network monitoring is hard to use, network monitoring has no standard, nor prepackaged equipment capable of doing it with minimal installation time or turnaround because of this network monitoring and lan analysis varies GREATLY between sites, and between companies. This results in increased training costs, and increased acclimation time for new administrators. Also untrained NOC staff (the poor sap most companies have doing third shift and overnight NOC work) will not be able to use or understand display output from these systems. The solution to this problem is complex, but a feature set becomes apparent: Theory: (from posts on slashdot) That brings up an interesting thought. Perhaps if interfaces were designed to be intelligible on TV, they'd be more usable in reality, too. Think about it. People watching the show may not know anything about computers, but they still had to understand the occasional piece of information that was important to the plot. (One good example would be when Dr. Crusher was caught in her son's experimental warp bubble. She didn't know where she really was until she saw (and the viewer) saw a picture of the "nature of the universe" and recognized it as something she (and the viewer) saw on one of Wesley's screens in Engineering. That kind of driving force behind usability would probably be beneficial to general use of computers. >From the Star Trek Technical Manual - Page 34 We incorporated the concept of software-definable, task specific panel layout into our controls because Mike (Okuda) thought it a logical way of simplifying designs that would otherwise have been nightmarishly complex. The basic idea is that the panels automatically reconfigure themselves to suit the specific task at hand. Practice: (these are from posts on slashdot) Here in Australia, our new combat "Collins" class subs had a user interfce designed by committee. It took 13 button presses to designate a target and launch a torpedo. The generals, when assessing this new sub, complained that the UI in a Playstation game to at most three clicks to designate a target and launch; why can't a multi-billion dollar sub work like that. The contractor then employed some game UI designers to rewrite the combat system. Many years ago, in 1972, I modelled a UI after the displays in "2001". This was a 24x80 text display on a TV showing the status of a mainframe computer. The upper half of the screen showed constantly updated status information. Ever few seconds, the lower half of the screen switched to a new screen, alternating between a memory map, a job list, status messages, and requested operator input. High priority messages would immediately preempt the lower half of the screen. This was a big hit. People would stand outside the glass computer room wall to watch. It was self-explanatory enough that people could follow it effectively. from one of my admins: "You know, network monitoring should look something like the Astrometrics Lab on Voyager" My thoughts on the matter as follows: 1. The system should never suffer from a lack of display area, or attempt to compact data into a small display area, it should be easy to understand, and easy to monitor even from a distance. This means that the solution will need to be multiple monitors, preferably with touch-screen support, and a logically structured device based (be it a server, a vlan, a managed switch, or a router) navigation method. The control surface and the display surface should not be discrete, they should in fact be the same device. 2. There is already a wealth of GOOD, and free lan analysis software out there (MRTG, nettraf, Etherape, Ethereal, tcpdump, syslog, Nettop, Statnet, phpSysInfo, argus, etc.) What this means is that we don't need to reinvent the wheel, merely put it on the car in such a manner that it gets the user from point A to point B without any real concious thought, without diluting the tool in question. 3. This system should be capable of being distributed throughout the topography and capable of tunneling data with minimal impact on firewalls, or the current network configuration. It should also in whole take a minimal amount of time to configure and configuration of such a system should not require a reconfiguration of the whole network. Also configuration should be kept separate from normal use, and it should be "ready-to-use" out of the box. My questions are these, is there any use for such a product? What do you use in LAN and network monitoring? Where are the largest UI hiccups? What do you want but don't see in your current solution? When you leave is your staff able to interpret data from your equipment effectively? Could the whole process be sped up? I would also like to take a seperate moment to apologize to Mister Hallacy, it appears we are both being played with, and he has been greatly helpful in this matter. Thank you for your time and consideration, and your patience with my ill-concieved and offtopic posts over the last few days. -- Andrew D Kirch | Abusive Hosts Blocking List | www.ahbl.org Security Admin | Summit Open Source Development Group | www.sosdg.org Key At http://www.2mbit.com/~trelane/trelane.key Key fingerprint = B4C2 8083 648B 37A2 4CCE 61D3 16D6 995D 026F 20CF

1 0