November 2005 - Test - lists.nanog.org

Re: New improved Linux-foo(l) Worm noise
by Gregory Hicks 08 Nov '05

08 Nov '05

> Date: Wed, 9 Nov 2005 01:15:06 +0000 > From: n3td3v <xploitable(a)gmail.com> > To: nanog(a)merit.edu > Subject: Re: New improved Linux-foo(l) Worm noise > > > Hehehe, where has Fergie been lately? I kind of miss his online media > article updates. Moved to another list. Everyone 'dumped' on the updates... > On 11/8/05, Randy Bush <randy(a)psg.com> wrote: > > > > are you really an alias for fergie? > > > > > --------------------------------------------------------------------- I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

Re: Networking Pearl Harbor in the Making
by Roy S. Rapoport 08 Nov '05

08 Nov '05

On Mon, Nov 07, 2005 at 05:03:32PM +0000, Christopher L. Morrow wrote: > How do the operators/engineers explain to 'management', or whomever asks, > the 'training issues' that always crop up when more than one vendor are > proposed? Has anyone had good luck with this arguement? (my answer is sort > of along the lines of: "Its just a router, no matter the vendor and they > all have command-line help" but that's not always recieved well :) ) > > Just curious as I'm sure there are folks stuck in an all vendor X shop who > look over the electronic fence and see vendor Y with 'so much better' or > 'so much faster' or 'so much more blinkly lighty'... and try to have their > management agree to purchasing new devices :) It really depends on your management. Good management will either understand your arguments and support them or be non-technical enough that they'll let you make the technical decision because that's what they're paying you a lot of money to do. Back in 1999, I was the director of IT Engineering for Macromedia. We were putting up a new colo location at Exodus (the story of our relationship with them is worthy of another rant), and had purchased something on the order of $500K of Cisco equipment to provision it -- two Cisco 7513s and two Cisco 6009s. Forgive me, but I can't reliably tell you why we chose those specific models (six years ago!) -- but we needed to be able to sustaing gigabit bandwidth and our Cisco VAR, in combination with the Cisco district sales droids, said "get this!" The provisioning took a while, during which time the equipment gathered a bit of dust. Getting close to the installation date, our technical staff (including me) took Exodus' technical staff to lunch during which they said "Cisco ?! Ha! They're a piece of crap. You should look at Foundry." We talked about it in more details, and left lunch persuaded we should look at Foundry. The next 2-3 weeks were interesting. Amusingly, our salesrep at a Cisco VAR had left earlier to go join Foundry, so we already knew someone there. We had him come in and discuss their product line, got some references from him and talked to them (they were glowing), and priced out the competing platform. We then told Cisco that we were goig to go with Foundry. Amusingly, A) They did not deny their equipment could actually not sustain gigabit speeds; B) An Exoduds SVP called my CIO to let him know that the engineer I spoke with had 'over-communicated', that Exodus and Cisco had a strong partnership, and that in no way would they actually recommend going with someone else. Yeah, OK. We spent about 25%-40%, I believe, of the Cisco price on the two BigIron 8Ks we got. We had to deal with some minor training issues, obviously, and there were some things we were counting on being able to do that they weren't able to do at the time -- I still remember the meeting where the Foundry sales rep came in and said "I talked to my CEO about this feature you need; we can't do it right now, but it's scheduled to be put in in about 8 weeks. Meanwhile, we've gotten an OK to loan you this other equipment that will let you do what you need." In the end, though, the transition was remarkably smooth on a technical basis. Up until this time we were a Cisco-only shop for any purchased equipment (I'm making this subtle distinction because we still had to manage a bunch of shared-media 10-baseT hubs in some of our older locations. Don't get me started). Making the decision to go with Foundry required me to go to my boss and have a grand total of one informal meeting with him that largely consisted of "hey, I'm thinking of going with Foundry for the new colo. If they work, I might start considering them for Corp use also. They're cheaper, faster, and promise better service, and so far I see them delivering on this." Of course, I also promised that we'd be able to return the Cisco 7513s (we repurposed the 6009s) -- and that's when Cisco started pissing us off with an insane "no, wait, you've got to return it to the VAR ... But the VAR needs our approval!" game. It was about 6 weeks of conference calls with Cisco and our VAR and some meetings; apparently, the big issue was that we had unpacked the routers and, much like Best Buy, Cisco required us to return the equipment with all the original packaging. I suggested that maybe, since we were looking at about $150K of equipment, we could actually pay for replacement packaging, but no deal. Note that at the time we were OK with just a credit -- we knew we were going to spend more money on Cisco (at the time) anyway. Long story short, one day my Foundry salesrep and his SE were visiting and noticed I was pissed off. I told them about this issue I was having with Cisco, and on the spot he offered to do a trade-in -- he'd give me my full spent cost on the Ciscos for the 7513s as credit toward any Foundry equipment. The day after, I rented a van and took the two 7513s to Foundry's facilities, and dropped them off at shipping and receiving, where I got some curious looks. That evening, when we called the Cisco district manager and told him "don't worry about it -- we gave them to Foundry for a credit," both my boss and I enjoyed the resulting shock and dismay. So sometimes, moving away from being a one-vendor shop can be relatively painless. Other than Cisco trying desperately to hold on to their exclusivity in this case, we didn't really have too many problems. The key was mutual trust within my organization, and the ability of each layer in it -- my network engineers, me, my boss, my CIO -- to trust the other layers and let them do their job*. -roy * No IT story is complete without an unhappy ending. A management shakeup resulted in the replacement of the CIO, who ended up replacing management with his own people. My replacement was a Cisco guy and they ended up ripping out perfectly functioning Foundry equipment to put Cisco back in there. Of course by then it wasn't my problem anymore, but I got to hear the grumblings from my guys over beers.

1 0

new improved name service?
by Randy Bush 08 Nov '05

08 Nov '05

and, it seems, you need a new improved nameservice as well A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed: sil(a)politrix.org It appears that the DNS operator for politrix.org has installed an invalid MX record with an IP address instead of a domain name on the right hand side. randy

1 0

Re: BGP terminology question
by James Aldridge 08 Nov '05

08 Nov '05

NetSecGuy wrote: > I understand AS3333 is RIS itself, is this some kind of misconfig on their > end? It seems to be announcing it's entire table every 5 minutes. This > started late Friday and ended a few hours ago. FYI, AS3333 is the RIPE NCC's production AS; the RIS project uses AS12654. There seems to be a difference between the behaviours of Cisco and Juniper routers when encountering the RIS's default keepalive value of 0. Cisco routers (and Zebra/Quagga boxes) seem to operate quite happily without keepalive processing while Junipers seem to tear down and restart the session after the holdtime expires -- result: 170,000 or so additional updates every holdtime-and-a-bit seconds. [Aside: shouldn't the session be refused at startup if a mutually agreeable keepalive value can't be negotiated rather than being allowed to flap like this?] This problem seems to occur when any RIS peer migrates from Cisco to Juniper. The only difference this time is that both ASes are operated by (different groups within) the RIPE NCC. James

2 1

IPv6 in a current defaultless SFP ISP
by John Dupuy 08 Nov '05

08 Nov '05

I am currently tasked with upgrading our network to a dual-stack IPv4/IPv6 architecture. At the beginning of this project, I assumed the difficult part would be with the router upgrades, programming, etc. So far, that has been the easy part. Does anyone know of _any_ defaultless SFP providers (a.k.a. Tier 1) that support dual-stack IPv4/IPv6 BGP sessions? We currently have three transit connections for IPv4 (all to Tier 1 providers). "upgrading" those to IPv4/IPv6 doesn't appear possible as those three providers tell me they can't do IPv6 yet. Given our growth rate, it is quite possible we will need another transit DS3 in less than a year. If I can find a transit provider with IPv6 in St. Louis/Kansas City, that may decide our next choice. To avoid vendor wars on the list, please send vendor recommendations directly to me. John

1 0

Networking Pearl Harbor in the Making
by J. Oquendo 08 Nov '05

08 Nov '05

< CRAPAGANDA > Which operating system, embedded in more than 80% of enterprise IT environments, represents one of the fastest-growing hacker targets and potentially the most-devastating information-security vulnerability? Hint: It ain't Windows. Cisco Systems' Internetwork Operating System now sits at the center of the information security vortex. Because IOS controls the routers that underpin most business networks as well as the Internet, anyone exploiting its flaws stands to wreak havoc on those networks and maybe even reach into the computer systems and databases connected to them. IOS is a highly sophisticated piece of software, but--as with Microsoft's Windows--that's a double-edged proposition. Software complexity can be a hacker's best friend. http://www.informationweek.com/story/showArticle.jhtml?articleID=173402976&… EOC =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://mo.fscker.com :: Obscurity through Insecurity "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

11 11

MEDIA: Grokster shuts down
by william(at)elan.net 07 Nov '05

07 Nov '05

http://www.latimes.com/business/la-110705grokster_lat,0,4450717.story? coll=la-home-headlines Grokster Ltd. today shut down its online file sharing service to settle an entertainment industry lawsuit aimed at stopping illegal downloads of copyrighted music, movies and other programming. The settlement was announced by the Recording Industry Association of America and comes four months after the Supreme Court ruled that online file-sharing services such as Grokster can be held liable for copyright violations by their users. On its website, Grokster, which was the defendant in a lawsuit, notified visitors of the Supreme Court decision and plans to offer a legal service soon. ...The RIAA said the settlement, which prohibits Grokster from operating or distributing its file-sharing software, will be submitted to court today for approval. "This settlement brings to a close an incredibly significant chapter in the story of digital music," said RIAA Chairman Mitch Bainwol in a statement. ...The battle over file sharing began in 1999, when the original Napster network made it simple for people to copy songs for free from each other's computers. ...After Napster's demise, millions of users flocked to a new generation of file-sharing programs distributed by Grokster, StreamCast and numerous other companies. ...To the major music companies and Hollywood studios, this was doubly offensive -- not only were the companies helping people copy songs and movies for free, they also were milking advertisers for access to a huge audience of infringers. With Metro-Goldwyn-Mayer Studios as the lead plaintiff, the major record labels, movie studios and music publishers sued StreamCast and Grokster for copyright infringement in October 2001.

1 0

RE: Networking Pearl Harbor in the Making
by Robert Bonomi 07 Nov '05

07 Nov '05

> Subject: RE: Networking Pearl Harbor in the Making > Date: Mon, 7 Nov 2005 11:11:52 -0500 > From: "Hannigan, Martin" <hannigan(a)verisign.com> > > > > On Monday 07 Nov 2005 3:42 pm, Hannigan, Martin wrote: > > > > > > It's an argument for vendor diversity. > > > > No it is an argument for code base diversity (or better > > software engineering). > > > > Vendor diversity doesn't necessarily give you this, and you > > can get this with > > one vendor. > > How so? Haven't we recently seen an across the board bug in > multiple version of $vendor code? Excerpt from "Logic 101 -- Introductory Logical Reasoning": "Can" does not mean the same thing as "will". And, thus, the fact that one vendor has an across-the-board bug does _not_ mean that the same situation exists at =all= vendors.. The bug in multiple versions ov $vendor's code was directly attributable to those 'multiple versions' all being derived (at different points in time, and/or for different deployment niches) from the same primary 'code base'. Note: "code base", *singular*. The problem existed in the core code, so, naturally, it was present in all the varients of that *single* core. > > > > > Vendor diversity might be a good idea, but for other reasons. > > Sure. There are more reasons than one to do it. I was specifically > pointing out that code diversity is a good one - and not forgetting > associated cost and economic impacts as mentioned in a later followup. Vendor diversity does *not* _guarantee_ diversity in code-base. You have to *explicitly* spec/check/test for code-base diversity, to ensure that you have code-base diversity. It is _possible_ to get code-base diversity with multiple purchases from a single manufacturer/vendor. It is _possible_ to have a single common code-base among purchases from disparate manufacturers/vendors. The "probability" of getting things with different code-bases -- *without* *actually*checking*for*it* -- is higher if you purchase from multiple manufacturers/vendors, rather than from a single one. "Higher probability" != "guaranteed" Hence the need to explicitly check, if said diversity is a requirement.

1 0

RE: Using BGP to force inbound and outbound routing through particular routes
by Hannigan, Martin 07 Nov '05

07 Nov '05

What's the netblock and ASN you already have? > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Edward W. Ray > Sent: Wednesday, November 02, 2005 2:50 PM > To: nanog(a)merit.edu > Subject: Using BGP to force inbound and outbound routing through > particular routes > > > > spam was a lousy name... > > -----Original Message----- > From: spam [mailto:spamjail@mmicman.com] > Sent: Wednesday, November 02, 2005 11:44 AM > To: 'nanog(a)merit.edu' > Subject: FW: Using BGP to force inbound and outbound routing through > particular routes > > I recently made a request to get a cable modem connection at > my home. I > went for one of those $29.95 for three month specials in case > I run afoul of > some rules prohibiting what I am going to do. I already have > a multi-T1 > connection with a Class C block and BGP running on my Cisco > 3640 router, and > was looking to become multi-homed. The cable connection is > via bridge/DHCP > cable modem, and was going to hook it up to the Cisco 3640. > I have already > done the research and know from what block of IP addresses I will be > assigned, and the BGP route tables/peers. > > I would like to use BGP to force inbound and outbound routing > only through > particular peers, Sprint (AS 1239) and UUNET (AS 701). I > have been reading > "Practical BGP" by Whate, McPherson and Sangli and this appears to be > possible. However, do my adjacent routers need to support > BGP in order for > this to work? Could I use other routing protocols to > accomplish this, or > would this require knowledge of all possible downstream > router IP addresses? > > Edward W. Ray > > >

25 46

It's Not the Frequencies, Stupid
by Sean Donelan 07 Nov '05

07 Nov '05

http://www.tvtechnology.com/features/Masked-Engineer/f_mario_orazio-10.19.0… Katrina communications problems were caused by downed towers, power loss, broken connections, drained batteries, missing generators, and equipment underwater. Pick one or more. They were not caused by a lack of access to frequencies used for analog TV.

1 0