June 2004 - Test - lists.nanog.org

Aggregating 16,000 gigE ports in one campus?
by Eric Kuhnke 10 Jun '04

10 Jun '04

http://science.slashdot.org/science/04/06/02/0038223.shtml?tid=126 Reading the posts by slashdot readers (and CWU alumni) it seems as if they are upgrading to gigabit using the existing 62/125 and singlemode installed in the late 1980s. Some people say it's rate-limited to 10Mbps... But if it isn't, how do you aggregate 16,000 gigabit ports in one campus? Tons of Cisco 6509/6513s with MT-RJ cards? I'd like to see the commission cheque for the sales rep that sold them the gear. :-)

1 0

Re: Even you can be hacked
by dunger-nanog1087＠mailblocks.com 10 Jun '04

10 Jun '04

I completely agree that the customers in these cases should be held responsible for the services they purchased from their ISPs. Let's all try to keep in mind that the two customers mentioned in the article as being on the receiving end of large bills were businesses, not consumers. In the course of running his "small high-tech company," Mr. Liber could have hired a part-time IT guy to watch over his systems and keep them patched and healthy. Doing so could have cost him less than the $85,000 his ISP billed him for. He also could have procured liability insurance for his business. Perhaps he also could have bought a firewall, or a better one. Any of these options would have cost Mr. Liber's business some money. He appears to have chosen instead to accept higher business risk in exchange for a higher potential profit margin. And, when the bills arrived, he could have chosen to pay them. Instead, he chose to file for bankruptcy. Each step of the way, he had options, and he made his choices as he saw fit. Was this truly negligence, or a calculated business risk? -DaveU

1 0

Re: NLB Recommendations
by John Neiberger 10 Jun '04

10 Jun '04

> I'm looking for recommendations for network load balancers. These, at > this time, will primarily be used to attach to a cluster of webservers > although I would like a solution which can be repurposed to other > applications later. I am looking at F5's Big IP, Cisco's SLB, and > Foundry's ServerIron at this time. We have Cisco 11503s and F5 Big IPs in our network. I bought the Big IPs because I was getting rather fed up with the Cisco stuff. Each has their quirks but I think I prefer the F5, especially for box-to-box redundancy. That's really rough with the Cisco gear unless you want to fork out a lot of cash for their ridiculously expensive ethernet modules so you can get a direct box-to-box connection. If you have load-balanced servers behind an F5 that also must be available for direct connection, then the F5 is a huge pain, while that is extremely simple with the Cisco gear. Other than that, I think I the F5 is a better product and easier to manage once you get used to how it works. If you've previously used the Cisco gear, you have to unlearn a few concepts and terms in order to make sense of the F5 world. Regards, John --

16 17

RE: Even you can be hacked
by McBurnett, Jim 10 Jun '04

10 Jun '04

Laurence F. Sheldon, Jr. wrote: >Even if the water company is sending me 85% TriChlorEthane? >Right. Got it. The victim is always responsible. >There you have it folks. Ok. Being resposible as network manager, if I think something is strange and I nor my staff can fix it. I call for help. Either Vendor support, a good consultant, or community help. In many cases the Victim always has some portion of responsibilty. If I leave a Windows 2000 server SP 0 no security fixes on my network, get it hacked and have a lawsuit cause XYZ company caught a hacker attack from it.... who is the Victim? who is responsible? This may be exactly what that guy did.... I think Sean sent out the California law reference last year that said the VICTIM of a security breach must report it to their customers... I think we have alot of operational issues that we must look at here.. What do we do? Many AUP's I have seen would have shut down that customer, if someone complained..... Does this mean if we go to a for profit bandwidth charge system that we let people destroy others with the worms they have for money we would get chargeing for the worm attack? Jim

1 0

Urgent help needed with SORBS
by Michael Tokarev 10 Jun '04

10 Jun '04

This may be somewhat off-topic here, but still.. Today at about 00:00 UTC, one of SORBS official nameservers somehow got a corrupt datafile, and started spreading incorrect information. The problem had gone at next reload or next data transfer (which was after about 20 minutes), but some caches got corrupt data. We need to identify the "bad" nameserver, but so far was unable to do so. If you're running BIND8 caches (note bind8, bind9 won't not help), and are expiriencing problems resolving dnsbl.sorbs.net zone, please, perform a nameserver dump (by sending SIGINT to the named process) and find the origin of NS records for dnsbl.sorbs.net. Problematic data is like this: dnsbl.sorbs.NET. 119671 NS \@. 119671 NS safe. 119671 NS socks. 119671 NS ip4set. 119671 NS relays. 119671 NS proxies. 119671 NS sDATASET. (as of why this happened, -- that's another topic, I have only one guess - two processes writing into the same file at the same time, which may, in theory, have this effect, -- but in order to be able to check this, we need to determine which nameserver performed badly). Thank you. /mjt P.S. Reply-To set to prevent filling NANOG with somewhat offtopic posts...

1 0

Re: TCP-ACK vulnerability (was RE: SSH on the router)
by Christopher L. Morrow 10 Jun '04

10 Jun '04

On Thu, 10 Jun 2004, joshua sahala wrote: > On (10/06/04 15:26), Christopher L. Morrow wrote: > > > > dns is your friend here :( People love to name things such that they are > > easy to remember. cat5500.floor2.build3.you.com > > > > only if the dns/security/network/whatever admins are stupid enough to s/stupid/careless/ || s/stupid/unknowing/ || s/stupid/<pick your favorite reason why users do dumb things>/ > let that zone be queried on their public facing dns servers. bind > allows for the filtering of queries, so your noc/engineering/etc address > blocks can query that zone (if it requires that there is an external dns > server for that zone). granted this is only obscuring things a bit, it right, and as Sean pointed out to ... Alexei earlier: "Worms do this for you" (maybe he said port scanners/banner-grabbers) point being obscurity isn't really buying you anything :( > isn't really all that different that having a (semi-)seperate management > network. > if you don't have it set up like this, or don't know how, then buy > dns/bind (or an equivalent book) and/or hire someone who does. Sure, you know this, I know this, Sean knows this and apparently Alexei knows this (other present company of list included probably as well) but Joe SOHO Networker doesn't necessarily know this, nor does his corporate 'security/secretary' person know this :( (or even have the power to change it most times). So, yes, if you think ahead, plan for the worst and make security part of your initial design you are ok. What percentage does this? I'd bet less than the AV/Upgrade percentages :( -Chris

1 0

NLB Recommendations
by James Baldwin 10 Jun '04

10 Jun '04

I'm looking for recommendations for network load balancers. These, at this time, will primarily be used to attach to a cluster of webservers although I would like a solution which can be repurposed to other applications later. I am looking at F5's Big IP, Cisco's SLB, and Foundry's ServerIron at this time.

4 3

RE: IT security people sleep well
by Jason Frisvold 10 Jun '04

10 Jun '04

> -----Original Message----- > From: Edward B. Dreger [mailto:eddy+public+spam@noc.everquick.net] > > Correct. One must shell out more money for a bigger feature set > to obtain SSH. I don't recall specifics off the top of my head, > and don't have a javascript-cable machine handy to use Feature > Navigator[*], but certain { feature sets | trains } only support > SSHv1. I don't see why they can't roll it into every ios that runs on a router capable of ssh. Ssh and sshd on my linux system barely break 500k compiled... And there's a TON of functionality in there that isn't required on a router. It would seem that you could get ssh put into these code trains in under 500k ... Personally, I like having a little wiggle room in the flash ... Putting an image on there that occupies the entire flash is a bad thing... > [*] Quick gripe: Did anyone at Cisco ever consider that people > might like to use Feature Navigator without javascript? > What's next? Mandatory Flash Player? I concur.. Mandatory Javascript sucks... Esp when Mozilla and Firefox have problems viewing the pages... Cisco's site became decidedly un-useful when they switched it over to this new design... > Eddy Jason Frisvold Penteledata

7 9

Re: Charter blocking Port 25
by Mark Andrews 10 Jun '04

10 Jun '04

In article <20040610020644.GI6816(a)arctic.org> you write: > >On 06/09/04, Arman <arman(a)unitedlayer.com> wrote: > >> Does anybody else know of other cable/DSL providers that simply block >> outbound port 25? > > Many of 'em do. If your contract says you can run servers on > your connection, then you should call and complain. > > On the other hand, if Charter prohibits running servers on your > connection...well, you get what you pay for. What does whether you can run a server have to do with *initiating* SMTP traffic. As for the original question. Optus blocks but if you call customer support they will remove the block with a warning "if you spam we will block it" which is reasonable based on the published AUP. Yes they also added the block w/o informing anyone. I would be calling Charter and asking for the block to be removed. > Either way, this is one of those issues where everyone has an > opinion and they've all been stated before. > >-- >J.D. Falk "be crazy dumbsaint of the mind" ><jdfalk(a)cybernothing.org> -- Jack Kerouac -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews(a)isc.org

2 1

[Fwd: [IP] Japan facing bandwidth shortage due to take-up in broadband]
by Suresh Ramasubramanian 09 Jun '04

09 Jun '04

I wonder how much of this is bandwidth that could be saved by clamping down on worm traffic / assorted junk from zombies and open proxies etc, before investing in new bandwidth on a national scale - and in upgrading routers and other kit for that purpose. And I do believe that a lot of the bandwidth for broadband (true broadband that is, not what the average US ISP would call "dsl" or "cable") there is online gaming traffic... bandwidth requirements for that would be increasing steadily if I don't miss my guess. -------- Original Message -------- Subject: [IP] Japan facing bandwidth shortage due to take-up in broadband Date: Wed, 9 Jun 2004 19:07:04 -0400 From: David Farber <dave(a)farber.net> Reply-To: dave(a)farber.net To: Ip <ip(a)v2.listbox.com> Begin forwarded message: [Thanks to Adam Peake for this pointer. Some excerpts - BSA] http://neasia.nikkeibp.com/wcs/leaf?CID=onair/asabt/fw/292043 Prediction of Communications Crisis Prompts Japan's Telecom Ministry to Take Action February 23, 2004 (TOKYO) -- Japan's Ministry of Public Management, Home Affairs, Posts and Telecommunications (MPHPT) is taking the initiative to establish a study group in order to circumvent a potential communications crisis that could occur in Japan due to a sharp increase in data communications traffic. Predicting that the spread of broadband communications may cause capacity shortages in existing communications infrastructures as soon as five years from now, and strong possibilities of triggering interruptions, the MPHPT plans to launch countermeasures aimed at reinforcing the communications infrastructure. The study group expects to release a midterm report this summer. According to the report, data communications traffic across the country has been expanded nearly 1,000 times as large as that observed in the last 10 years. If it continues to increase at this pace, the domestic data communications traffic should reach as much as 1,024 times the current volume in the next 10 years. With the current facilities as they are, a simple calculation shows that actual communications traffic will exceed the backbone's maximum capacity as soon as five years from now. That is not the only problem. Capacity limits of devices -- routers and switches that constitute communications networks -- are coming within sight. In order to handle huge communications traffic without any delay, large-capacity routers of more than 10Tbps are required. To deal with growing data communications traffic, it is imperative to reinvest in the communications infrastructure, such as an expansion of relay-network capacities by adding new optical fibers and communications equipment. ------------------------------------- You are subscribed as suresh(a)hserus.net To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/

5 5