July 2004 - Test - lists.nanog.org

Quick question.
by Vish Yelsangikar 29 Jul '04

29 Jul '04

Sorry for the spam. I am trying to find this info, but can't find it anywhere. So posting my question to a wide and experienced audience. What are the chances of dual Sup 6500 chassis going down completely for whatever reason in general or hardware failure in particular. Anyone has MTBF for 6500 with dual everything (power supply, sup)? You may reply to me off list. Thanks. Vish.

1 0

RE: Loss of Telnet Capability to 6509
by Peering 28 Jul '04

28 Jul '04

I had this once with a 7500 and a friend at Cisco told me this procedure. I'm not sure if it would help you though. I had an idle session in "show users" output. To clear the idle session, I typed "show tcp brief". My friend said the stuck one should be in "ESTAB" state, but the one I cleared said "LASTACK", so you can always go by the foreign address. It's better to kick people off temporarily than to have to reboot the router just to clear a stuck VTY session. To clear the session, type "clear tcp tcb xxxxxxxx", using the hexadecimal TCB address at the beginning of the line from show tcp brief. Then check show users output to see if the session has disappeared. Diane Turley Network Engineer Xspedius Communications Co. 636-625-7178 -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Richard J. Sears Sent: Wednesday, July 28, 2004 2:35 PM To: Jason Frisvold Cc: Nanog Subject: Re: Loss of Telnet Capability to 6509 Hi Jason, the only ACL's on the vty's are the same across my entire farm of routers and switches. And when I telnet to a box with an ACL, I get a refused connection...this one is saying that it is timing out. On Wed, 28 Jul 2004 15:33:45 -0400 "Jason Frisvold" <friz(a)corp.ptd.net> wrote: > > Do you have ACL's restricting access to the vty's? I've seen > instances where telnet ports get locked up because of port scanning > and/or attacks... > > -- > Jason Frisvold > Penteledata > > > > -----Original Message----- > > From: Richard J. Sears [mailto:rsears@adnc.com] > > Sent: Wednesday, July 28, 2004 2:54 PM > > To: Nanog > > Subject: Loss of Telnet Capability to 6509 > > > > > > > > We posted this to cisco-nsp but someone suggested posting it here as > > well... > > > > > > > > We have a 6509 running a SUP720 in IOS only mode (no cat os). > > > > At around 4am this morning, we lost our ability to telnet to > > the router. > > Running a tcpdump shows that the router never responds to the telnet > > request. > > > > All functions and interfaces on the router seem fine (bgp, > > etherchannel, > > ibgp, vtp, hsrp) and I can console into the sup with no > > problems at all, > > we just cannot telnet into it. The CPU is at around 6%. > > > > I have checked all access lists on the router, none were > > added/removed or modified on line vty that would cause this problem. > > All logging appears normal. > > > > We are running Version 12.2(17a)SX3. > > > > Anyone have a similar problem or know how to check or restart > > the telnet > > process on the router without a reload...? > > > > > > ****************************************** > > Richard J. Sears > > Vice President > > American Digital Network > > ---------------------------------------------------- > > rsears(a)adnc.com > > http://www.adnc.com > > ---------------------------------------------------- > > 858.576.4272 - Phone > > 858.427.2401 - Fax > > INOC-DBA - 6130 > > ---------------------------------------------------- > > > > I fly because it releases my mind > > from the tyranny of petty things . . > > > > > > "Work like you don't need the money, love like you've > > never been hurt and dance like you do when nobody's watching." > > > > ****************************************** Richard J. Sears Vice President American Digital Network ---------------------------------------------------- rsears(a)adnc.com http://www.adnc.com ---------------------------------------------------- 858.576.4272 - Phone 858.427.2401 - Fax INOC-DBA - 6130 ---------------------------------------------------- I fly because it releases my mind from the tyranny of petty things . . "Work like you don't need the money, love like you've never been hurt and dance like you do when nobody's watching."

1 0

RE: Loss of Telnet Capability to 6509
by Jason Frisvold 28 Jul '04

28 Jul '04

Do you have ACL's restricting access to the vty's? I've seen instances where telnet ports get locked up because of port scanning and/or attacks... -- Jason Frisvold Penteledata > -----Original Message----- > From: Richard J. Sears [mailto:rsears@adnc.com] > Sent: Wednesday, July 28, 2004 2:54 PM > To: Nanog > Subject: Loss of Telnet Capability to 6509 > > > > We posted this to cisco-nsp but someone suggested posting it here as > well... > > > > We have a 6509 running a SUP720 in IOS only mode (no cat os). > > At around 4am this morning, we lost our ability to telnet to > the router. > Running a tcpdump shows that the router never responds to the telnet > request. > > All functions and interfaces on the router seem fine (bgp, > etherchannel, > ibgp, vtp, hsrp) and I can console into the sup with no > problems at all, > we just cannot telnet into it. The CPU is at around 6%. > > I have checked all access lists on the router, none were added/removed > or modified on line vty that would cause this problem. All logging > appears normal. > > We are running Version 12.2(17a)SX3. > > Anyone have a similar problem or know how to check or restart > the telnet > process on the router without a reload...? > > > ****************************************** > Richard J. Sears > Vice President > American Digital Network > ---------------------------------------------------- > rsears(a)adnc.com > http://www.adnc.com > ---------------------------------------------------- > 858.576.4272 - Phone > 858.427.2401 - Fax > INOC-DBA - 6130 > ---------------------------------------------------- > > I fly because it releases my mind > from the tyranny of petty things . . > > > "Work like you don't need the money, love like you've > never been hurt and dance like you do when nobody's > watching." > >

3 2

RE: Loss of Telnet Capability to 6509
by Burton, Chris 28 Jul '04

28 Jul '04

It is possible that all of the VTY session have been used up (line vty 0 4); if this is the case then a clearing (clear line vty x) of the sessions should resolve the issue. Chris C. Burton Network Engineer Walt Disney Internet Group: Network Services Smith Tower: 206.664.4131 Westin: 206.664.4833 Mobile: 425.591.4805 The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact Walt Disney Internet Group at 206-664-4000. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Richard J. Sears Sent: Wednesday, July 28, 2004 11:54 AM To: Nanog Subject: Loss of Telnet Capability to 6509 We posted this to cisco-nsp but someone suggested posting it here as well... We have a 6509 running a SUP720 in IOS only mode (no cat os). At around 4am this morning, we lost our ability to telnet to the router. Running a tcpdump shows that the router never responds to the telnet request. All functions and interfaces on the router seem fine (bgp, etherchannel, ibgp, vtp, hsrp) and I can console into the sup with no problems at all, we just cannot telnet into it. The CPU is at around 6%. I have checked all access lists on the router, none were added/removed or modified on line vty that would cause this problem. All logging appears normal. We are running Version 12.2(17a)SX3. Anyone have a similar problem or know how to check or restart the telnet process on the router without a reload...? ****************************************** Richard J. Sears Vice President American Digital Network ---------------------------------------------------- rsears(a)adnc.com http://www.adnc.com ---------------------------------------------------- 858.576.4272 - Phone 858.427.2401 - Fax INOC-DBA - 6130 ---------------------------------------------------- I fly because it releases my mind from the tyranny of petty things . . "Work like you don't need the money, love like you've never been hurt and dance like you do when nobody's watching."

1 0

Loss of Telnet Capability to 6509
by Richard J. Sears 28 Jul '04

28 Jul '04

We posted this to cisco-nsp but someone suggested posting it here as well... We have a 6509 running a SUP720 in IOS only mode (no cat os). At around 4am this morning, we lost our ability to telnet to the router. Running a tcpdump shows that the router never responds to the telnet request. All functions and interfaces on the router seem fine (bgp, etherchannel, ibgp, vtp, hsrp) and I can console into the sup with no problems at all, we just cannot telnet into it. The CPU is at around 6%. I have checked all access lists on the router, none were added/removed or modified on line vty that would cause this problem. All logging appears normal. We are running Version 12.2(17a)SX3. Anyone have a similar problem or know how to check or restart the telnet process on the router without a reload...? ****************************************** Richard J. Sears Vice President American Digital Network ---------------------------------------------------- rsears(a)adnc.com http://www.adnc.com ---------------------------------------------------- 858.576.4272 - Phone 858.427.2401 - Fax INOC-DBA - 6130 ---------------------------------------------------- I fly because it releases my mind from the tyranny of petty things . . "Work like you don't need the money, love like you've never been hurt and dance like you do when nobody's watching."

2 2

Barracuda Networks Spam Firewall
by Claydon, Tom 28 Jul '04

28 Jul '04

Doing evaluations on anti-spam, anti-virus solutions, and ran across this: http://www.barracudanetworks.com/ Looks like a good box -- even won an Editor's Choice award from Network Computing recently. Does anyone on list have any experience with these boxes? If so, how are they with false positives, quarantine capabilities, etc? Thanks, Tom Claydon Dobson Telephone

27 46

SPF deployment by Oct. 1 ?
by John Bittenbender 28 Jul '04

28 Jul '04

http://www.infoworld.com/article/04/07/22/HNmicrosoftid_1.html As a side note, I notice that the article mentions a submission to the IETF but I haven't seen any RFC's related, if there is one out there can someone please point it out for me? I didn't see anything obvious here: http://www.ietf.org/html.charters/dnsop-charter.html or here: http://darkwing.uoregon.edu/~llynch/dnsop/ Looking in the wrong place? John Bittenbender P.S. If I missed a mail about this somewhere along the path please disregard or edjamacate me off-list.

15 15

RE: COnfiguration Suggestion - Etherchannel
by Michel Py 27 Jul '04

27 Jul '04

> Richard J. Sears wrote: > I am running a 6509 with Dual SUP720's in IOS mode only >(no cat software). It was pointed out that there are really > two different ways to configure the switch - I guess my > question is which is the best (lowest overhead, etc)? The two you posted are equivalent; the second one simply uses the default VLAN, amount of overhead is the same. Now, there is a third method (trunking) that allows your etherchannel to carry multiple VLANs at the same time (you would use encap dot1q). If you connect two large switches for the same organization, you likely want the trunk to carry all your VLANs. In your case, I believe one VLAN to connect the customer is enough, so your config is fine IMHO. Michel.

1 0

Re: SPF deployment by Oct. 1 ?
by Douglas Otis 27 Jul '04

27 Jul '04

On Tue, 2004-07-27 at 13:38, James Couzens wrote: > On Sat, 2004-07-24 at 18:49, John Bittenbender wrote: > > http://www.infoworld.com/article/04/07/22/HNmicrosoftid_1.html > > > > As a side note, I notice that the article mentions a submission to the > > IETF but I haven't seen any RFC's related, if there is one out there > > can someone please point it out for me? > > > > I didn't see anything obvious here: > > > > http://www.ietf.org/html.charters/dnsop-charter.html > > > > or here: > > > > http://darkwing.uoregon.edu/~llynch/dnsop/ > > > > Looking in the wrong place? > > The "MARID" version of SPF is a bastardization of the original SPF being > called SenderID in that they are trying to cram as much crap into it as > they can. Although it appears that the idea of storing "SenderID" > records in XML as DNS records has been averted I'm extremely sceptical > that anything will come of that group in the near future. > > As for people parsing SPF records and dropping email as a result of a > FAIL response, there are some groups out there doing this. Verizon > tried for a few days I believe and then quickly reverted when they > realized the error in doing so. I think its much to soon to be doing > this especially in view of the forwarding problem with SPF. > > The MARID list is pretty useless for anyone seeking information, and > actually its pretty useless even if you are trying to subject the > proposed protocol to any idea you might have as many on the list have > disregarded valid issues several times. Perhaps this is to retain > focus, or perhaps its because they think they know better, this is my > opinion in view of what I have witnessed thus far. You will find a > better reception on the SPF-DISCUSS list as is hosted by spf.pobox.com. > You can find links to it on the spf.pobox.com site by clicking on the > "Forums" link (poorly worded I know, the old site was much better). Sender-ID employs existing SPF records intended to qualify the RFC 2821 MAIL FROM, but then fully ignores the RFC 2821 MAIL FROM. Sender-ID introduces "Purported Responsible Address" (PRA) from the RFC 2822 headers, where differing types trump more recent headers. The author of SPF and owner of spf.pobox.com dropped the MAIL FROM strategy of ASRG to adopt this proprietary scheme of Microsoft. PRA will not abate the bounce traffic. PRA is not able to end Phishing as touted either. A message can be fully validated by including a header such as Resent-From: random.random.Starbucks.to where the From seen by the user could be anyone. There is no means to accredit the administration of the domain accountable for the introduction of the spam either. With the typical scale otherwise needed, many publish their records open-ended to allow mail sent from differing points of access. If a common relay point were published in a closed-ended fashion, then those sharing this server would know they could forge mail for that domain as fully validated. The number of DNS lookups to obtain the "record set" could include hundreds of queries. There is a timeout of 20 seconds for obtaining perhaps dozens of references contained within a single "SPF" record, such as PTR, MX, A, AAAA. If a timeout occurs, the message receives a 450 temp error and is to be repeated at some point. A new series of DNS queries is immediately started for the next message. Without exceeding Sender-ID time limits, the process can continue for more than 3 minutes per message. It also threatens network stability with high levels of UDP traffic together with premature termination and overlay of these queries. With IPS's transparent interception of SMTP traffic, mail may go missing if this is not known before hand. Defining an "open" record set could swamp DNS with spammer abuse. Forget about mail forwarding working. But, by all means, publish, publish, publish. Caveat Emptor. Publisher beware. MARID http://www.ietf.org/html.charters/marid-charter.html (note, the marid-protocol links are in error). Sender-ID drafts: http://www.ietf.org/internet-drafts/draft-ietf-marid-submitter-02.txt http://www.ietf.org/internet-drafts/draft-ietf-marid-core-02.txt http://www.ietf.org/internet-drafts/draft-ietf-marid-protocol-00.txt http://www.ietf.org/internet-drafts/draft-ietf-marid-rationale-00.txt CSV drafts: http://www.ietf.org/internet-drafts/draft-ietf-marid-csv-intro-01.txt http://www.ietf.org/internet-drafts/draft-ietf-marid-csv-csa-01.txt http://www.ietf.org/internet-drafts/draft-ietf-marid-csv-dna-01.txt There is an alternative solution that can do something to protect the networks and not break mail. The Client SMTP Validation (CSV) drafts provides a solution to ensure the SMTP client can be both authenticated and authorized to send mail. If used in conjunction with SPF, it could effectively thwart spam and Trojan systems. PRA however, keeps the door open. : ( There is a possible alternative to SPF that uses a DomainKey approach to sign the RFC2821 MAIL FROM using the local part called Bounce Address Tag Validation (work in progress). http://www.brandenburg.com/specifications/draft-crocker-marid-batv-00-06dc.… There is also work ongoing to provide an effective means to identify the sender (work in progress). http://www.ietf.org/internet-drafts/draft-fenton-identified-mail-00.txt -Doug

1 0

Re: ad.doubleclick.net missing from DNS?
by Robert Bonomi 27 Jul '04

27 Jul '04

>From owner-nanog(a)merit.edu Tue Jul 27 11:37:36 2004 Date: Tue, 27 Jul 2004 12:34:04 -0400 (EDT) From: Sean Donelan <sean(a)donelan.com> To: nanog(a)merit.edu Subject: ad.doubleclick.net missing from DNS? The A record for ad.doubleclick.net is missing from DNS. This is causing apparent web page slowdowns when viewing web sites containing ads linked to ad.doubleclick.net Aw, shucks. <weeping type="tears" sub-type="crocodile"> Couldn't happen to a more deserving company.

1 0