August 2005 - Test - lists.nanog.org

Problems at Microsoft?
by Drew Weaver 03 Aug '05

03 Aug '05

Hi there, we've had a few complaints about connectivity issues to Microsoft, is anyone else seeing a problem? Usually I get between 2-3MBps when I download from them, at the moment I get 8k/sec downloading http://download.microsoft.com/download/b/6/2/b624b535-644a-41e1-9727-812 dcd6bad87/E3SP1ENG.EXE (service pack 1 for exchange 03) from Both my network, and a monitoring server we have in chicago. Anyone else seen this? -Drew

5 4

FCC expected to officially propose DSL deregulation on Thursday
by Fergie (Paul Ferguson) 03 Aug '05

03 Aug '05

"United States Federal Communications Commission Chairman Kevin Martin is expected to officially propose the deregulation of DSL services from telecommunications carriers on Thursday." http://www.redherring.com/article.aspx?a=13022 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

OMB details milestones to move to IPv6
by Fergie (Paul Ferguson) 03 Aug '05

03 Aug '05

Apparently, the OMB has release a memo outlining it's IPv6 migration plans. From an article in GCN.com: [snip] Agencies may have until June 30, 2008, to transition to Internet Protocol Version 6, but the planning starts now. The Office of Management and Budget has released a memo [.pdf] that gives agencies until Nov. 15 to assign an official to coordinate the move to the new protocol and complete an inventory of existing routers, switches and hardware firewalls. [snip] http://www.gcn.com/vol1_no1/daily-updates/36579-1.html The OMB memo: http://www.whitehouse.gov/omb/memoranda/fy2005/m05-22.pdf - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: OT: Cisco.com password reset.
by Hannigan, Martin 03 Aug '05

03 Aug '05

> Now imagine if instead of 2655 users it was 1-1.5million, Sure, 1.5MM. That's a lot. Don't get owned in the first place. Todays CSCO market cap is 124.0B. This is not our problem. -M<

1 0

VOIP provider
by Shane Owens 03 Aug '05

03 Aug '05

Not really an operational question, but an engineering question non-the-less. This may also not be the most suitable forum, but there is a large brain trust here that can probably answer my questions. We are looking at a business plan to launch a large VOIP carrier globally. My questions are: 1: Does it make sense to scatter nodes around the globe to limit latency on intraregional calls? If so how many? We were thinking about 7 placed at strategic points around the globe. 2: Is a softswitch architecture preferred to a proxy server/Media Gateway (Vonage) only type architecture? 3: What protocols should be used for firmware upgrades to ATA devices? We are thinking HTTPS or SFTP, or HTTP if those aren't available on selected devices. I am trying to stay away from TFTP for security reasons. 4: Anyone have any vendor recommendations? We currently use Metaswitch for our Softswitch, but I'm not sure it would be the best choice for a large scale deployment although I am going to research it. 5: Should I work with large wholesalers (L3, GX, etc) or try to penetrate markets in some other way? 6: Are there any wholesalers (DID Origination) outside of the US that anyone knows of? Sorry to have so many questions. Many of these I already have ideas on the answers however I acknowledge there are far smarter people than myself in the world. So I figure it's a good idea to ask and get opinions from others before I make a final decision. Shane Shaneowens<at>dna-communications.com

6 5

RE: OT: Cisco.com password reset.
by Church, Chuck 03 Aug '05

03 Aug '05

I eventually got an email stating it couldn't associate my email address with an active CCO ID. I'm guessing their system is getting backed up because it's affecting lots of people. Next step: "Please email cco-team(a)cisco.com to have your correct email address associated with your User ID. To ensure you receive prompt attention, please provide all of the following details: 1 Maintenance contract or Account number you used in your registration 2 The user ID your believe you have 3 Full name 4 Company name " Chuck Church Lead Design Engineer CCIE #8776, MCNE, MCSE Netco Government Services - Design & Implementation 1210 N. Parker Rd. Greenville, SC 29609 Home office: 864-335-9473 Cell: 703-819-3495 cchurch(a)netcogov.com PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4371A48D -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mike Tancsa Sent: Wednesday, August 03, 2005 9:52 AM To: Dan Armstrong Cc: nanog(a)merit.edu Subject: Re: OT: Cisco.com password reset. Same here. I didnt get a notice that it was reset, but I cannot login ---Mike At 09:30 AM 03/08/2005, Dan Armstrong wrote: >My PW to CCO did not work this morning either. I am on hold with the TAC >right now.... > > > >Joe Blanchard wrote: > >>FYI >>I got an email that my CCO account's password was reset >>last night. Not sure how widespread this issue was, but >>I called my account contact and verified that this is >>a valid email, and that my password needed to be reset. >> >>Just a heads up. >> >>-Joe Blanchard >> >> >>

4 3

Re: Your router/switch may be less secure than you think
by Robert Bonomi 03 Aug '05

03 Aug '05

> From owner-nanog(a)merit.edu Wed Aug 3 09:07:20 2005 > To: Michael.Dillon(a)btradianz.com > Cc: nanog(a)merit.edu > Subject: Re: Your router/switch may be less secure than you think > From: "Robert E.Seastrom" <rs(a)seastrom.com> > Date: Wed, 03 Aug 2005 09:58:53 -0400 > > > > Michael.Dillon(a)btradianz.com writes: > > > We should all be looking to the security auditing work done by > > the OpenBSD team for an example of how systems can be > > cleaned up, fixed, and locked down if there is a will to do so. > > Beer, unsupported assertions, and lack of rigorous audit methodology > can be blended together to make one's code more secure? That would seem to depend on the quality of the code _before_ the blending, no? As well as getting the proportions in the blend "just right". *grin* Seriously, _any_ approach "can" result in better/more secure code. It all depends on exactly _what_ is done. Some approaches for identifying and/or eliminating "problems" are more efficient and/or more effective than are alternative means. This does -not- mean that those are the "only" ways to get things done. Now, the _liklihood_ that any given approach "willresult in better/more secure code -- *that* is an entirely different question. :)

1 0

IOS new architechture will be more vulnerable?
by Joe Maimon 03 Aug '05

03 Aug '05

quotes from wired interview with Mike Lynn " WN: So this new version of the operating system that they're coming out with, that's in beta testing. Lynn: It's actually a better architecture ... but it will be less secure.... That's why I felt it was important to make the point now rather than sweep it under the rug. I think it's something that we can fix.... " " But at the same time, now that I think they already are, I will say it's not as bad as you probably think it is. Not yet ... because the version that makes this an unstoppable critical problem is not out yet. " What exactly does this mean?

4 3

RE: "Cisco gate" - Payload Versus Vector
by Randy Bush 03 Aug '05

03 Aug '05

very helpful analysis. some questions: even without stiffling the heap check via crashing_already (i.e. a 'fix' is developed for that weakness), is the 30-60 second window sufficient to do serious operational damage. i.e. what could an attacker do with a code injection with a mean life as short as 15-30 seconds? that seems a bit short for a direct routing injection of much worth. but how about a damping attack (flap the victim's route enough to cause everyone to damp them), or would mrai stiffle that? could it be used to cascade to a neighbor? i suppose that diverting the just the right 15-30 seconds of traffic could be profitable. secondly, is there reason not to believe that the attack vectors might be at layer two, mpls, as well as layer three, ip? i.e. the "internet-free core" gambit does not reduce exposure to this one? > The "bad guys" are discussing the issues and we should think long > and hard before we muzzle the "good guys". http://rip.psg.com/~randy/draft-ymbk-obscurity-00.txt is a bit old, but seems relevant. randy

4 3

SPF Loses Mindshare?
by Fergie (Paul Ferguson) 03 Aug '05

03 Aug '05

I don't want to seed a flaming napalm-laden e-mail exchange on the list with this, but I fugured the folks running networks who haven't seen this, probably should. There's an article by John Levine "SUBJ: line is the title) over on CircleID that might be intersting some folks in the e-mail authentication jihad: http://www.circleid.com/article/1157_0_1_0_C/ For your perusal. - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1