May 2004 - Test - lists.nanog.org

RE: Barracuda Networks Spam Firewall
by Christopher Brown 17 May '04

17 May '04

We've had a 400 up for 3 months now, very nice box. It's doing pretty good with handling false positives, and the updates are very frequent. One of the nice things for us is the ability to do per domain / per user quarantines for clients that want that ability. It also has an 'Exchange Accelerator' to tie into LDAP on exchange servers. We've not had any serious through put issues so far, but only pushing 500K mails a day so far. Christopher Brown Concergent, LLC Wichita, Kansas -----Original Message----- From: Jared B. Reimer [mailto:jared@theriver.com] Sent: Monday, May 17, 2004 3:48 PM To: Claydon, Tom Cc: nanog(a)merit.edu Subject: Re: Barracuda Networks Spam Firewall We have done an eval of this same product (model 400). It is very cool in virtually every regard except one: performance. We were facing 1+ hour mail delays (!) through the device when pumping less than 1,000,000 messages per day through it. Given that they claim it can handle ten times that much, I am left wondering what happened. Very disappointing in that regard; the eval unit is being shipped back as a result. -- Jared At 11:35 AM 5/17/2004, Claydon, Tom wrote: >Doing evaluations on anti-spam, anti-virus solutions, and ran across >this: > >http://www.barracudanetworks.com/ > >Looks like a good box -- even won an Editor's Choice award from Network >Computing recently. > >Does anyone on list have any experience with these boxes? If so, how are >they with false positives, quarantine capabilities, etc? > >Thanks, >Tom Claydon >Dobson Telephone ## Jared B. Reimer <jared(a)theriver.com> ## CTO / The River Internet Access Co. ## +1 (877) 88-RIVER x170 || http://www.theriver.com/

1 0

Re: Barracuda Networks Spam Firewall
by Jared B. Reimer 17 May '04

17 May '04

We have done an eval of this same product (model 400). It is very cool in virtually every regard except one: performance. We were facing 1+ hour mail delays (!) through the device when pumping less than 1,000,000 messages per day through it. Given that they claim it can handle ten times that much, I am left wondering what happened. Very disappointing in that regard; the eval unit is being shipped back as a result. -- Jared At 11:35 AM 5/17/2004, Claydon, Tom wrote: >Doing evaluations on anti-spam, anti-virus solutions, and ran across >this: > >http://www.barracudanetworks.com/ > >Looks like a good box -- even won an Editor's Choice award from Network >Computing recently. > >Does anyone on list have any experience with these boxes? If so, how are >they with false positives, quarantine capabilities, etc? > >Thanks, >Tom Claydon >Dobson Telephone ## Jared B. Reimer <jared(a)theriver.com> ## CTO / The River Internet Access Co. ## +1 (877) 88-RIVER x170 || http://www.theriver.com/

1 0

RE: CiSCO IOS 12.* source code stolen
by Michel Py 17 May '04

17 May '04

Rough translation of: http://www.securitylab.ru/45221.html May, 15 2004 Leak of code CiSCO IOS source code? As it became known to SecurityLab, the source code of operating system CISCO IOS 12.3, 12.3t, which is used in the majority of Cisco network devices has been stolen on May 13, 2004. The total volume of the stolen information represents about 800MB in an archive file. According to the information available to us, the leak of fragments of the source code occurred because of a break-in into the corporate network of Cisco System. Representatives of Cisco System have not made any comments about the break-in so far. A person whose alias on *darknet@EFnet IRC is "franz" has given a small parts of the source code (about 2.5 Mb) as proof. Below are links to the first 100 first lines of source code of: ipv6_tcp.c: http://www.securitylab.ru/45222.html ipv6_discovery_test.c: http://www.securitylab.ru/45223.html

8 9

More on Anti-Spam/Anti-Virus Solutions
by Claydon, Tom 17 May '04

17 May '04

Thanks to everyone who has responded regarding the Barracuda Network Spam Firewall. They look like very low cost but very powerful boxes. We are in the process of choosing an anti-spam/anti-virus solution for our current email enviroment (Sendmail Pro on RH9 Enterprise). One of the vendors that caught our eye was Sophos, and their PureMessage product http://www.sophos.com/products/pm/. However, I have not read much regarding integration issues with PM into an existing Sendmail Pro enviroment. Anyone have any success/horror stories on this? Thanks, Tom Claydon

1 0

Re: Pay-As-You-Use High-Speed Internet?
by Jonathan M. Slivko 17 May '04

17 May '04

Also, you could also take the approach of wiring a whole building for Internet connectivity through that model, like Intellispace does. -- Jonathan Daniel Senie wrote: > At 05:22 PM 5/14/2004, you wrote: > >> Hello Fellow NANOG'ers, >> >> I was just thinking about this - tell me if it sounds reasonable? The >> company that I work for developed a piece of technology which, through >> rate-limit statements, allow customers to buy/sell bandwidth "on >> demand". Now, I was thinking: "Why can't we take this technology that >> we've tested successfully in a colo environment and adapt it a little >> bit for personal/buisness-class ISP's to allow them to bill for the >> bandwidth that a customer uses, and only that with the exception of a >> base monthly fee (to cover the DSL/T1 loop, e-mail services, support, >> etc.) of a few dollars. > > > The access line (T-1, etc.) loop charge is substantially larger than the > bandwidth charge. Get the phone companies to price the lines better, and > it might make sense. > > >> Personally, I would like to see a senario where everyone just pays for >> what they use - it would be a much better system for allowing people >> who don't neccessarily need to get on the Internet at high-speed, get >> on high-speed which will not only increase revenue for the ISP's, but >> also for the customer who can now use DSL/T1 access in a much more >> effective way. >> >> Questions? Comments? Suggestions? >> >> -- Jonathan >> >> -- >> Jonathan M. Slivko >> Network Operations Center >> Invisible Hand Networks, Inc. >> help(a)invisiblehand.net >> 1-866-MERKATO (USA) >> 1-812-355-5908 (Intl) >> <http://www.invisiblehand.net> -- Jonathan M. Slivko Network Operations Center Invisible Hand Networks, Inc. help(a)invisiblehand.net 1-866-MERKATO (USA) 1-812-355-5908 (Intl) <http://www.invisiblehand.net>

4 4

MSN blocking PMTUD
by Miguel Mata-Cardona 17 May '04

17 May '04

Hi, it seems that Microsoft Network is blocking the path MTU discovery (ICMP fragmentation required but df bit set). That is causing problems because some customers who happen to use GRE tunnels for their branch offices can't access MSMessenger of the Hotmail page. Is there somebody from MSN here? Is there a workaround for this problem without using other type of tunneling? If not, is there any other workaround? -- Miguel Mata-Cardona Intercom El Salvador mmata(a)intercom.com.sv voz: ++(503) 278-5068 fax: ++(503) 265-7024

2 1

Flash crowds and DOS on POTS
by Sean Donelan 17 May '04

17 May '04

All networks are vulnerable to Denial of Service attacks and flash crowds. Broadcasting & Cable investigates the problems with the telephone and SMS voting with the Fox television show American Idol. http://www.broadcastingcable.com/article/CA417981 The difference is when people get a "busy" signal on the phone network, they don't think phone network is collapsing.

7 6

Re: CiSCO IOS 12.* source code stolen
by Per Gregers Bilse 16 May '04

16 May '04

Some years ago I was arguing with my then department head (whom I have the greatest respect for, it should be said) at Cisco that IOS should be turned open source. Needless to say, the suggestion was met with "some" resistance, mildly speaking. I still think the idea has a lot going for it. IOS as such is not a major revenue source, considering equipment prices in general; Cisco could bundle IOS at no cost merely by cranking up the hardware prices by a small amount, and there are no big secrets in the source. Arguably, there are things that some people might find "interesting" to try to dig into, but in terms of making a network box, a lot of the mystery has turned into old hat over the years. Heck, I have a completely independent and in every possible way unencumbered BGP4 implementation under my belt (the core was done well before my stint at Cisco), and in terms of coding complexity I've had much worse on my plate. Going back in time, Cisco's main claim to fame has always been to be there when you needed them, and in the old days they always were. Tony Li, who has posted here, is probably the best known, but there were many others, and they were all equally respected, revered, and honoured, not just for their knowledge and insight, but because, unlike the case at other vendors, they were there at night, at weekends, and at all other unholy hours, when a sinking networker needed them to be there. For the past many years, however, that hasn't been the case, whether or not one is carrying a hugely expensive maintenance contract in one's pocket. In one word, Cisco has turned "corporate". They managed to stay alive for much longer than most other vendors, but eventually they too couldn't remain un-corporate any longer. But, completing the circle, turning IOS into Open Source may be a way to bring back the heady days when Cisco/IOS ruled the world, in a fashion. All it takes is to bring online a ton of dedicated developers, just like any other Open Source project, and we know they're out there. Quoting my favourite American saying, "This is an opportunity". And the ball is in Cisco's court. -- Per

1 0

APNIC new block of addresses
by John Tran 16 May '04

16 May '04

Dear colleagues APNIC received IPv4 address blocks 58/8 and 59/8 from IANA in April 2004 and will be making allocations from these ranges in the near future. This announcement is being made for the information of the Internet community so that network configurations such as routing filters may be updated as appropriate. For more information on the resources administered by APNIC, see: http://www.apnic.net/db/ranges.html For information on the minimum allocation sizes within address ranges administered by APNIC, see: http://www.apnic.net/db/min-alloc.html Kind regards Son ____________________________________________________________________ Resources Services Manager <Son(a)apnic.net> Asia Pacific Network Information Centre phone: +61 7 3858 3100 http://www.apnic.net fax: +61 7 3858 3199 Helpdesk phone: +61 7 3858 3188 email: helpdesk(a)apnic.net Please send Internet Resource Requests to <hostmaster(a)apnic.net> _____________________________________________________________________ _______________________________________________ Apnic-announce mailing list Apnic-announce(a)lists.apnic.net http://mailman.apnic.net/mailman/listinfo/apnic-announce _______________________________________________ apnic-talk mailing list apnic-talk(a)lists.apnic.net http://mailman.apnic.net/mailman/listinfo/apnic-talk

1 0

Antivirus firms discover Bots
by Sean Donelan 16 May '04

16 May '04

I'm glad that anti-virus firms are noticing the growth of Bots. Unfortunately, their guestimating ability is still woefully inadequate. Even frequent updates to anti-virus software won't help. Many bots disable automatic updates and block access to the antivirus sites. By the time anti-virus software detects somethings wrong, its already too late. The solution is to make certain your computer is not compromised, instead of relying on anti-virus to clean it up later. Antivirus firms warn of growing 'Bot' Networks http://www.informationweek.com/story/showArticle.jhtml?articleID=20300880

5 7