April 2005 - Test - lists.nanog.org

Network-Automation discussion mailing list created
by Brent Chapman 07 Apr '05

07 Apr '05

I've created a Network-Automation mailing list for discussions of issues related to automating network configuration and management, including (but not limited to) methods, mechanisms, techniques, philosophies, policies, and products. Since 1990 or so, much of the research in the system administration field has focused on automation. It's now well accepted that a well-run operation doesn't manage 10,000 servers individually, but rather uses tools like cfengine to manage definitions of those servers and then create instances of those servers as needed. In the networking world, though, most of us seem to be still manually configuring (and reconfiguring) every device. That's starting to change, though, and I've created the Network-Automation mailing list as a forum to help advance that change. See the list's web page for more information, to view archives, or to subscribe: http://www.greatcircle.com/network-automation I look forward to some interesting discussions there, and I hope you'll join us! -Brent -- Brent Chapman <brent(a)greatcircle.com> -- Great Circle Associates, Inc. Specializing in network infrastructure for Silicon Valley since 1989 For info about us and our services, please see http://www.greatcircle.com/ Network Automation blog: http://www.greatcircle.com/blog/network_automation

2 4

US still leads global spam list according to BBC article
by Nicole 07 Apr '05

07 Apr '05

* US still leads global spam list * More than a third of all spam e-mails originate in the US, according to a survey by security firm Sophos. Full story: http://news.bbc.co.uk/1/hi/technology/4420161.stm US still leads global spam list Spam: Made in the USA? More than a third of all spam e-mails originate in the US, according to a survey by security firm Sophos. Computers in the US were responsible for more than 35% of global spam, while South Korea was responsible for almost a quarter of all spam e-mails. According to Sophos more than 50% of all spam is sent from "zombie" PCs, computers that have been take over by hackers or virus writers. The survey comes as spam is reported to be on the wane. The survey was compiled using the firm's "global network of spam traps". "Although the USA is responsible for producing more than a third of all of the world's spam, its percentage contribution has decreased," said Graham Cluley, senior technology consultant for Sophos. Deborah Platt Majoras, the US's top consumer protection official, said on Thursday that data from internet service providers (ISPs) suggested the deluge of unwanted emails selling sex, drugs and get-rich quick schemes may be waning. On a visit to Brussels, the head of the US Federal Trade Commission (FTC), said: "Spam has been a huge problem around the world, not just in these two continents. "Recently the ISPs seem to think that less spam is actually reaching consumers' mailboxes. That's the first good news I've heard on spam, if it's true, since I started." Percentage 'fallen' "The percentage of spam sent from American computers has fallen 12% since the start of the year compared to other countries," said Mr Cluley. He said the drop was a result of ISPs enforcing anti-spam policies and a growing awareness of the need to protect all computers from being hacked by spammers. "Businesses and computer users must protect themselves from becoming a zombie by having up-to-date anti-virus software, firewalls and Microsoft security patches," he added. PCs in China sent almost 10% of spam, said the survey, while countries including France, Spain and the UK were each responsible for between one and three percent of spam e-mails. Nicole -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ Opportunity is missed by most people because it is dressed in overalls and looks like work. - Thomas Edison If you want to go backwards, you put it in 'R,' and if you want to go forward, you put it in 'D' -- Sen. Tom Harkin (D-IA)

1 0

DNS cache poisoning update
by Fergie (Paul Ferguson) 07 Apr '05

07 Apr '05

SANS Internet Storm Center: "The InfoCon is currently set at yellow in response to the DNS cache poisoning issues that we have been reporting on for the last several days. We originally went to yellow because we were uncertain of the mechanisms that allowed seemingly "secure" systems to be vulnerable to this issue. Now that we have a better handle on the mechanisms, WE WANT TO GET THE ATTENTION OF ISPs AND ANY OTHERS WHO RUN DNS SERVERS THAT MAY ACT AS FORWARDS FOR DOWNSTREAM Microsoft DNS SYSTEMS. If you are running BIND, please consider updating to Version 9. Read on for more information..." http://isc.sans.org/diary.php - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

2 1

Re: DNS cache poisoning update
by Fergie (Paul Ferguson) 07 Apr '05

07 Apr '05

So call me old-fashioned (oh, wait a minute -- you just did)... :-) - ferg -- Randy Bush <randy(a)psg.com> wrote: posting news clippings to large mailing lists is just sooooo yesterday. try http://www.blogger.com/start randy

2 1

Cingular
by Tom Sands 07 Apr '05

07 Apr '05

Can someone from Cingular please contact me off-list Thank you, -- ------------------------------------------------------ Tom Sands Chief Network Engineer Rackspace Managed Hosting (210)447-4065 ------------------------------------------------------

1 0

RE: botted hosts
by Ejay Hire 07 Apr '05

07 Apr '05

I will build this if there is interest and it doesn't exist elsewhere. Is there a need for a centralized repository of this information? (I know about dshield, but without a way to aggregate the data it's not altogether useful.) -ejay > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Petri Helenius > Sent: Monday, April 04, 2005 1:45 PM > To: Peter Corlett > Cc: nanog(a)nanog.org > Subject: Re: botted hosts > > > Peter Corlett wrote: > > >A side-effect of the greylisting and other mail checks is that I've > >got a lovely list of compromised hosts. Is there any way I can > >usefully share these with the community? > > > > > Set up a website where one can input a route and can see > hosts covered > with it? > > Pete > > > > > > > >

1 0

Re: The power of default configurations
by Paul Vixie 07 Apr '05

07 Apr '05

> IMO, RFC1918 went off the track when both ISP's and registries started > asking their customers if they have "seriously considered using 1918 space > instead of applying for addresses". This caused many kinds of renumbering > nightmares, overlapping addresses, near death of ipv6, etc. just checking... does that mean you favour the one-prefix-per-asn implicit allocation model, or the ipv6 version of 1918 which intentionally doesn't overlap in order to serve inter-enterprise links, or what exactly?

2 1

RE: BGP Anywhere - Global Redundancy
by Howard, W. Lee 07 Apr '05

07 Apr '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Steve Gibbard > Sent: Wednesday, April 06, 2005 8:48 PM > To: Vandy Hamidi > Cc: nanog(a)merit.edu > Subject: Re: BGP Anywhere - Global Redundancy > > On Wed, 6 Apr 2005, Vandy Hamidi wrote: > > > Below is how I believe it should be done. > >> From PDC: > > -Advertise CIDR block to all peers w/good metric (0 hop count) > >> From BDC: > > -Advertise same CIDR block to all peers w/poor metric (+20 hop > > count) > > To clarify, you want no traffic coming into the backup site when the > primary site is up, right? > > Assuming a random set of peers and upstreams, this won't > actually do what > I think you're trying to do. Since local-preference > overrides MEDs and AS > path lengths, and since you don't have control over what goes > on in other > networks, you'll likely get some traffic coming into your > backup site even > when you don't intend it to. > > You could *maybe* get around this by having the same transit provider > (probably just one in this case, which is scary for other > reasons) in both locations. If you're paying somebody money, you have a much > better chance of getting them to follow your desired routing policy. > Still, it's really not good to be making a routing announcement somewhere where > you don't want to receive traffic. If you have the same ISPs at both data centers, this will work. All outsiders will route to one of your ISPs, who will send traffic to the best localpref. Until one of them loses their connection to your primary site; then it will route traffic to the backup site, even though, to you, the primary is online with the other ISPs. Convergence time across the Internet in case of complete failure could be 15 minutes, +/-5. Lee > -Steve >

1 0

Netlantis --- is it ever coming back?
by John van Oppen 07 Apr '05

07 Apr '05

Does anyone know if netlantis.org is coming back? That was a very useful site but it has been down for a long time (with a note saying that it will be back soon) now. I would love to have access to that BGP info again, it was very helpful... I am still contributing a route feed, and that session is up. Thanks, John van Oppen AS23265 / PocketiNet Communications

3 2

BGP Anywhere - Global Redundancy
by Vandy Hamidi 07 Apr '05

07 Apr '05

All, We're an ASP and are considering adding a secondary Backup Datacenter (BDC) in the US to protect our web presence. My goal is to ensure automatic failover of my Primary DC's (IP) traffic to the BDC in the event of a catastrophic failure of the PDC. I'm considering geographic load balancing and BGP Anywhere as the two options. I'm clear on how the Geo LB works, but have some doubts about BGPAW as I've never implemented it before and documentation online is pretty weak to non-existent. Below is how I believe it should be done. >From PDC: -Advertise CIDR block to all peers w/good metric (0 hop count) >From BDC: -Advertise same CIDR block to all peers w/poor metric (+20 hop count) During normal operation, all ASes will route production traffic to PDC. In the event of catastrophic failure at PDC; PDC advertisements will cease, BDC route will become the only one on the net and traffic will route to the BDC. Questions: 1) Will this work? 2) Other suggestions or alternatives? 3) Any chance that traffic could flow to BDC for any reason? 4) Any internet etiquette I could be ignoring? 5) What would you estimate the failover time would be? 6) Assuming the routers at PDC and BDC pull down full routing table, how will the receipt of the PDC CIDR advertisement be treated? BGP rules say it will be dropped as a routing loop. What alternatives would I have if I want to be able to route that CIDR block traffic from the BDC to the PDC. Confed? Cisco conditional advertisements? Thanks all. This is the only place I can think of that would have the expertise to comment. -=Vandy=-

3 2