August 2004 - Test - lists.nanog.org

RE: Legal intercept - 3550
by Burton, Chris 11 Aug '04

11 Aug '04

You could setup a Linux/Solaris (or other) device (It would need to be GigE capable) and span all of the data to that port and then use either iptables/ipchains to log the data and drop what don't need or use ethereal/tcpdump to capture the data using filters to weed out the information you do not need. Also as mentioned in a previous reply you could use the VLAN ACL features depending on your IOS version. There are several ways to achieve what you are looking to do; it just depends on your level of comfort with configuring the methods mentioned and of course cost. Chris Burton Network Engineer Walt Disney Internet Group: Network Services The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact Walt Disney Internet Group at 206-664-4000. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Stefan Baltus Sent: Wednesday, August 11, 2004 12:05 PM To: nanog(a)merit.edu Subject: Re: Legal intercept - 3550 Thanks for all the replies. The best solution was by Boyan Krosnov who suggested the following: Configure the GE port where the traffic comes in from the fiber tap in a separate new vlan A, access mode. Configure fastethernet X to be in access mode for vlan A. Configure a static mac entry for vlan A pointing the destination mac address of the router where the traffic heads to to fastethernet X. Connect your sniffer on Fastethernet X. -- at this stage all traffic going to that router will be dumped to the sniffer. Not precisely what you want. -- now comes the trick Configure a VLAN access-map http://www.cisco.com/en/US/products/hw/switches/ps646/products_command_r eference_chapter09186a008021145c.html ip access-list ext acl1 permit ip host x.x.x.x any permit ip any host x.x.x.x vlan access-map alabala match ip address acl1 action forward vlan filter alabala vlan-list A This works for my case. Boyan: thanks a lot. Stefan On Wed, Aug 11, 2004 at 04:37:24PM +0200, Stefan Baltus wrote: > > Hi, > > We have a situation where we need to intercept certain IP traffic that > is somewhere within a link of 300Mbit/s of traffic (GigabitEthernet). > The setup that we built is as follows: > > router > ^ > | GE > | > fiber tap -------> cisco catalyst 3550 > | > | GE > v > switch > > > The catalyst 3350 is receiving the traffic from router to switch and > vice versa. Now, we'd like to filter all but certain IP's on the 3350 > and switch this traffic to a FE port on that same 3550. Currently > we've put the FE interface in SPAN mode, but that fills up the FE port > completely (obviously). Is there any way to accomplish this? > > Regards, > > Stefan > > -- > Stefan Baltus <stefan.baltus(a)xbn.nl> XB Networks B.V. > Manager Engineering Televisieweg 2 > telefoon: +31 36 5462400 1322 AC Almere > fax: +31 36 5462424 The Netherlands -- Stefan Baltus <stefan.baltus(a)xbn.nl> XB Networks B.V. Manager Engineering Televisieweg 2 telefoon: +31 36 5462400 1322 AC Almere fax: +31 36 5462424 The Netherlands

1 0

Datacenter
by Daniel Corbe 11 Aug '04

11 Aug '04

Hello, My company is looking to build a new Datacenter in the Ft. Lauderdale area of florida. This is my first such experience building one from scratch. Does anyone have or know of an available design guide? What kind of options are available for backup power? (IE low or midrange Diesel generators, Backup Battery Arrays, etc) Can someone recommend a good electrician that has experience with Datacenters? What about enviornmental controls? (IE A/C Systems, Fire Supression systems designed for datacenters, Humidity control, access control (key card/pad systems), etc) Anyone out there do raised flooring cheaply? :)

1 0

verizon postmaster contact?
by Brian Russo 11 Aug '04

11 Aug '04

Can someone with verizon mail/postmaster group get in touch with me. thanks, - bri -- Recursivity. Call back if it happens again.

1 0

Testing procedures for new network implementation?
by Wayne Chow 11 Aug '04

11 Aug '04

Hi All We are in the process of planning for the upgrade of a 3Com network. The new infrastructure will be comprised of 3Com 4950s with XRN and a dozen stacks of 4400s. What are the best practices of testing the new implementation? Any advices or suggestions would be greatly appreciated. The only software that we have is the 3Com Network Director. Thank you in advance. Wayne Chow Network Administrator Faculty of Dentistry, University of Toronto

4 4

Legal intercept - 3550
by Stefan Baltus 11 Aug '04

11 Aug '04

Hi, We have a situation where we need to intercept certain IP traffic that is somewhere within a link of 300Mbit/s of traffic (GigabitEthernet). The setup that we built is as follows: router ^ | GE | fiber tap -------> cisco catalyst 3550 | | GE v switch The catalyst 3350 is receiving the traffic from router to switch and vice versa. Now, we'd like to filter all but certain IP's on the 3350 and switch this traffic to a FE port on that same 3550. Currently we've put the FE interface in SPAN mode, but that fills up the FE port completely (obviously). Is there any way to accomplish this? Regards, Stefan -- Stefan Baltus <stefan.baltus(a)xbn.nl> XB Networks B.V. Manager Engineering Televisieweg 2 telefoon: +31 36 5462400 1322 AC Almere fax: +31 36 5462424 The Netherlands

5 5

Verizon Data (T1) Rep?
by Jonathan M. Slivko 11 Aug '04

11 Aug '04

Hello, Can a Verizon Data (T1) Rep. please call/contact me off list ASAP? Thanks! -- Jonathan -- Jonathan M. Slivko Invisible Hand Networks, Inc. 670 Broadway, Suite 302 New York, NY 10012 Phone: (212) 226-1422 x601 Fax: (212) 202-7640 jslivko(a)invisiblehand.net

1 0

Are AOL's MXs mass rejecting anyone else's emails?
by Andrew Paprocki 11 Aug '04

11 Aug '04

We're currently getting this from AOL MX servers: 64.12.138.57 failed after I sent the message. Remote host said: 554-: (RLY:FA) http://postmaster.info.aol.com/errors/554rlyfa.html 554 TRANSACTION FAILED Yet, after viewing their alleged reason for rejecting the mail, we can find nothing wrong with our mail headers. Wondering if this is a bug on AOL's side or if anyone else has encountered/fixed this issue to stop the bouncing mail? -Andrew

1 0

Floorspace / Power Possibilities - location independant
by Micah McNelly 11 Aug '04

11 Aug '04

Guys/Gals, I'm currently digging for cheap floorspace / power / network with no specific geographical region in mind. If you know of any well managed facilities with very low per square foot cost and cheap power (no hamsters please) please respond to me offlist. Should be carrier neutral but have bandwidth available. Thanks, /m

1 0

Re: That MIT paper
by Joe Shen 11 Aug '04

11 Aug '04

Hi, >The paper doesn't pass any judgement on types of lookups, but obviously >not all DNS lookups are equal from the end user perspective. In our observation, looking for IP address consists 70% of our cache server load, MX consists of 14% and PTR only occupies 5%. And, on the other hand, the coarse analysis of our network traffic shows, Web traffic occupies only 8% while stream meadia occupies the most part of traffic. So, the authors the conclusion may be correct as viewing film online does not rely on DNS so much as browsing web pages. But, to my understanding a too short TTL will do harm to cache server performance esp. the amount of RR cached is so large that BIND have to wait for swapping I/O and re-fetching those timeout RR again. >"In our follow-up measurement study, [we found] that DNSBL related > DNS lookups at CSAIL in February 2004 account for 14% of all DNS > lookups. In comparison, DNSBL related traffic accounted for merely > 0.4% of all DNS lookups at CSAIL in December 2000." Is these work published or available publicly? Any work done with performance tuning with cache server? > 1. almost nobody has time to invest in reading this kind of paper. > 2. almost everybody is willing to form a strong opinion regardless of that. > 3. people from #2 use the paper they didn't read in #1 to justify an opinion. people rely on their experience, but science tries to find on basis of analysis. Usually, we met problems which is caused by people replace scientific conclusion with their experience. Joe ---- Introducing Spymac MailPro: http://www.spymac.com/mailpro/

2 1

BellSouth: please stop advertising 209.152.54.0/23
by Jon Snyder 10 Aug '04

10 Aug '04

BellSouth is advertising 209.152.54.0/23, which is part of 209.152.32.0/19 owned by someone else who isn't a BellSouth customer. If anyone from BellSouth is listening, can you please make this stop? Or if you have a working contact at BellSouth please let me know. The number for their NOC listed at http://puck.nether.net/netops/ is not working and emails and phone calls to all of the contacts listed in their ARIN entries have gone unanswered. Here's some relevant routeviews data: route-views.oregon-ix.net>sh ip bgp 209.152.54.0 BGP routing table entry for 209.152.54.0/23, version 30041418 Paths: (14 available, best #7, table Default-IP-Routing-Table) Not advertised to any peer 3292 6939 6389 6198 195.249.0.135 from 195.249.0.135 (195.249.0.135) Origin IGP, localpref 100, valid, external Community: 3292:1107 3292:1905 7500 2516 7911 6389 6198 202.249.2.86 from 202.249.2.86 (202.12.27.99) Origin IGP, localpref 100, valid, external 3277 13062 25462 6320 8001 6389 6198 194.85.4.55 from 194.85.4.55 (194.85.4.55) Origin IGP, localpref 100, valid, external Community: 3277:13062 3277:65301 3277:65307 6461 6389 6198 209.249.254.19 from 209.249.254.19 (209.249.254.19) Origin IGP, metric 3203, localpref 100, valid, external Community: 6461:5997 16150 13237 174 6389 6198 217.75.96.60 from 217.75.96.60 (217.75.96.60) Origin IGP, metric 0, localpref 100, valid, external Community: 13237:44088 13237:46881 16150:65320 16150:65324 12956 6389 6198 213.140.32.146 from 213.140.32.146 (213.140.32.146) Origin IGP, localpref 100, valid, external Community: 12956:20024 12956:28310 12956:28311 8001 6389 6198 209.123.12.51 from 209.123.12.51 (209.123.12.51) Origin IGP, localpref 100, valid, external, best Community: 6389:20103 6389:30132 6389:46198 8001:2000 8001:2006 3333 6320 8001 6389 6198 193.0.0.56 from 193.0.0.56 (193.0.0.56) Origin IGP, localpref 100, valid, external 7660 2516 7911 6389 6198 203.181.248.233 from 203.181.248.233 (203.181.248.13) Origin IGP, localpref 100, valid, external 6939 6389 6198 216.218.252.152 from 216.218.252.152 (216.218.252.152) Origin IGP, localpref 100, valid, external 7911 6389 6198 64.200.151.12 from 64.200.151.12 (64.200.151.12) Origin IGP, localpref 100, valid, external Community: 6389:20103 6389:30132 6389:46198 7911:999 7911:7206 11608 3491 6389 6198 207.246.129.14 from 207.246.129.14 (207.246.129.14) Origin IGP, localpref 100, valid, external Community: 11608:1006 11608:5504 7911 6389 6198 64.200.95.239 from 64.200.95.239 (64.200.95.239) Origin IGP, localpref 100, valid, external Community: 6389:20103 6389:30132 6389:46198 7911:999 7911:7206 6939 6389 6198 216.218.252.145 from 216.218.252.145 (216.218.252.145) Origin IGP, localpref 100, valid, external Thanks, ---------- Jon Snyder

4 3