March 2004 - Test - lists.nanog.org

Re: Incoming Fax
by randy＠psg.com 22 Mar '04

22 Mar '04

1 0

Re: Personal Co-location Registry
by Brandon Butterworth 22 Mar '04

22 Mar '04

> IMHO the right way to do this is to build the power cycling > capability into the individual 1U boxen. Again, we > should be talking to the embedded systems folks to > give them a standard set of requirements that everyone > can support. See Sun Netra LOM. Done. > This may be worth having a workshop > discussion at a NANOG meeting to define requirements. Won't that lead to an over complicated kitchen sink (see Sun RSC)? This should be simple it's supposed to be more reliable than the system it's managing. > I envisage a standard control module with two external > serial ports. One serial, rj45 is fine The major complication is that 1U boxes are really built for Windows where this is useful but only does part of the job. As it doesn't remote the Windows desktop they don't bother including it. Likewise we're still stuck with Windows centric BIOS rather than an OPENBOOT alike. Both need doing to make 1U X86 worthwhile. Is the linux market isn't big enough to be worth designing for properly? brandon

1 0

Re: Personal Co-location Registry
by Michael.Dillon＠radianz.com 22 Mar '04

22 Mar '04

>Personally, I have a major dislike for daisy-chained control buses like this. >All it needs is one box at the start of the bus to go bad and you've lost >control all the other boxes on the bus. The same thing can happen with Ethernet or any communications protocol that uses a shared wire/medium. However, given the fact that RS-232 is an extremely well understood and simple technology, I don't think there is much risk in using an RS-232 daisy-chained control bus. Of course the embedded systems folks might be able to make a case for I2C or HP1B or something else that is used in industrial and laboratory control applications. --Michael Dillon

1 0

Remote control servers was:(Re: Personal Co-location Registry)
by Michael.Dillon＠radianz.com 22 Mar '04

22 Mar '04

>Weasel, like the sun implementation, allows remote reboot of wedged >machines. This is key, particularly when running on an Intel platform ><cough>. If there are any PC serial console implementations that >allow one to do this, I'd like to hear about it, since I'm not aware >of such. Buying a serial console server *plus* a power cycler fills >my heart with hatred. Given the fact that the guts of a server leave enough room in a 1U case for an additional computer, it's only a matter of time before someone puts together 1U Intel-based systems that include a serial console server and power cycler running on the separate control computer. And given that we now have devices like the Gumstix on the market http://www.gumstix.com/ it's only a matter of time before this capability gets built into even smaller boxen. We really do need to have a chat with some of the folks doing embedded systems work because if they knew that there was a need for these types of server control systems, it wouldn't take them very long to produce usable products. All the pieces needed are available off the shelf today. The only problem remaining is the integration and this is something that embedded systems people do very well. --Michael Dillon

1 0

standard transit arrangements
by Sven Huster 22 Mar '04

22 Mar '04

Hello I just wanted to find out what the "standard" arrangements are when one buys transit traffic. I've been left in charge of this now, without haven't been doing this before :-( So what normally you buy x amount of bandwidth over a physical line e.g. 45Mb/s over FastEthernet or so. They then charge you for excessive usage based on 95th percentile. Is there anything else I need to keep an eye on? Thanks Sven

1 1

Compromised Hosts?
by Deepak Jain 22 Mar '04

22 Mar '04

Nanogers - Would any broadband providers that received automated, detailed (time/date stamp, IP information) with hosts that are being used to attack (say as part of a DDOS attack) actually do anything about it? Would the letter have to include information like "x.x.x.x/32 has been blackholed until further notice or contact with you" to be effective? If even 5% of these were acted upon, it might make a difference. The question is... would even 1% be? Thanks for your opinions, DJ

5 4

Re: Hi
by milton＠isomedia.com 21 Mar '04

21 Mar '04

1 0

TWTC Backbone
by Don Lundquist 21 Mar '04

21 Mar '04

Is anyone experiencing difficulties with the TWTC backbone? I have been experiencing some strange performance issues where icmp and trace routes seem to work fine but http and other protocols seem to get squashed...? Regards, Don don.lundquist(a)peak-10.com 704.264.1010

2 1

FW: Where is this info coming from?
by Eric Krichbaum 21 Mar '04

21 Mar '04

When I use a looking glass tool like GASP or lg.level3.net etc. on our 66.118.64.0/19 space, it's shows up as MOUNTAINNET which we haven't used for years. ARIN's whois info shows it correctly. Where should I go to correct this, please? Eric Krichbaum

1 0

Re: UDP port 4000 traffic: likely a new worm
by Rodney Joffe 20 Mar '04

20 Mar '04

Unfortunately the vulnerability has proven to not be restricted to port 4000. Keep monitoring SANS :-( -----Original Message----- From: Josh Richards <jrichard(a)digitalwest.net> Date: Sat, 20 Mar 2004 13:50:30 To:nanog@merit.edu Subject: Re: UDP port 4000 traffic: likely a new worm The good news is that "witty" appears to not be a very witty propagator. Our flow data shows attempts to connect to 4000/udp on hosts in our network having a downward trend over the last few hours: Time Unique Source IPs 08:00 350 09:00 332 10:00 297 11:00 298 12:00 265 (all times PST) -jr * Josh Richards <jrichard(a)digitalwest.net> [20040320 11:10]: > > Confirmed. We had our first customer (colo) hit yesterday evening at > 20:43 PST. Additionally, they experienced the hard drive corruption (which > was added to the ISC diary entry within the last several hours). Traffic > was 4000/udp. Initial 90 Mbit/s peak which leveled out at a constant > 60 Mbit/s before we took them off-line. > > -jr > > * Johannes B. Ullrich <jullrich(a)sans.org> [20040320 00:44]: > > Looks like there may be a worm going around hitting systems that run > > BlackIce. Common characteristics of the packets: Source port 4000 (but > > random target port) and the string > > "insert witty message here". > > > > details will be posted here: > > http://isc.sans.org/diary.html > > as I get them together. -- Josh Richards | Colocation Web Hosting Bandwidth Digital West Networks | +1 805 781-9378 / www.digitalwest.net San Luis Obispo, CA | AS14589 & AS29962 jrichard(a)digitalwest.net | DWNI - Making Internet Business Better

1 0