September 2005 - Test - lists.nanog.org

Re: commonly blocked ISP ports
by Fergie (Paul Ferguson) 14 Sep '05

14 Sep '05

A couple of decent barometers: http://www.dshield.org/topports.php and: http://www.mynetwatchman.com/default.asp - ferg -- Luke Parrish <lukep(a)centurytel.net> wrote: Not quite looking for tips to manage my network and ACL's or if should or should not be blocking, more looking for actual ports that other ISP's are blocking and why. For example: port 5 worm 2.5 port 67 virus 8.2 At 03:12 PM 9/14/2005, Valdis.Kletnieks(a)vt.edu wrote: >On Wed, 14 Sep 2005 14:42:56 CDT, Luke Parrish said: > > We have a list, some reactive and some proactive, however we need to > remove > > ports that are no longer a threat and add new ones as they are published. > >All ports that are open are threats, at least potentially. What you *should* >be doing is: > >a) When you block a new port due to a current exploit, log the fact. >b) Work with customers/users to make sure they're patched, and that new >machines >are patched before they go live. >c) When probing for the port stops (which it never does), or some sufficient >number of downstream boxes are patched and safe, remove the block. > >Either that, or block the world, and open ports on request. > >Remember - *you* are the only one on this list who really knows if a given >port is a threat anymore.... > >(And that's totally skipping all the noise about corporate firewalls >versus ISP >firewalls and different expectations regarding security/transparency...) Luke Parrish Centurytel Internet Operations 318-330-6661 -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: commonly blocked ISP ports
by Scott Weeks 14 Sep '05

14 Sep '05

----- Original Message Follows ----- From: Luke Parrish <lukep(a)centurytel.net> To: nanog(a)merit.edu Subject: commonly blocked ISP ports Date: Wed, 14 Sep 2005 14:42:56 -0500 > Everyone, > > Does anyone have a reference point for commonly blocked > ports? > > We have a list, some reactive and some proactive, however > we need to remove ports that are no longer a threat and > add new ones as they are published. See the NANOG archives. There is a LOT of discussion regarding this issue there. Please everyone, let's don't do this again. It has not been long enough since the last one and my "D" key is beginning to wear out after the last couple of days... scott

1 0

cogent and level3
by Joseph Nuara 14 Sep '05

14 Sep '05

Does anyone know what the story is with Cogent and L3? I noticed that my Cogent site (IN NY) is using a path to one of my providers (IN NJ) via asia as opposed to the local and preferred L3 peer. After several days I was finally told that L3 and Cogent are working through some peering negotiations and cogent is moving traffic off their L3 peer in anticipation of a depeering (I guess they are trying to avoid the whole France Telecom thing that happend last time). Does anyone have a better clue as to what is going on and where the negotiations stand?

2 1

Load Balancing between multiple BGP peer connections
by Joe Shen 14 Sep '05

14 Sep '05

Hi, How could load on multiple BGP peer links be balanced automatically? The situation we are facing: ---------------------------| | Service provider | | | --R1--------------------R2--- |\ | | \ E-BGP | | \ ----------------\ | | \| ----R3--------------------R4-| | Our Network | | (OSPF) | ----------------------------- The three links between our network and Service provider network are all 1Gbps. Now, we noticed that load on link R1-R3, R1-R4 is about 50% (in/out), but load on R2-R4 are about 90% ( in/out). How could we balance those load on the three links automatically? or must we tune the route mannually? Is there any technical guide on this? thanks in advance. Joe Send instant messages to your online friends http://asia.messenger.yahoo.com

3 3

Re: CAT5 surge/lightning strike protection recommendations?
by Frank Coluccio 14 Sep '05

14 Sep '05

re: ""what did your electricians say ..." Back to lurking in a moment, but I should note that fire and safety code issues are so shrouded in matters of locality and jurisdiction, at times, and bound up in industry and governmental standards that are so esotric in nature, that the typical electrical worker, and I dare say even most licensed electricians and IT consultants, are totally unaware of the specifics, or they are given to gross misconceptions and half-truths. This is so, not so much due to the complex nature of the matter at hand, but due to a lack of regular exposure to it. Nufsed. Frank A. Coluccio DTI Consulting Inc. 212-587-8150 Office 347-526-6788 Mobile On Wed Sep 14 10:58 , 'Hannigan, Martin' sent: I asked him "what did your electricians say" and the entire ground conversation went south. Good post. Thanks. -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan(a)verisign.com > -----Original Message----- > From: owner-nanog(a)merit.edu [owner-nanog(a)merit.edu','','','')">owner-nanog(a)merit.edu]On Behalf Of > Frank Coluccio > Sent: Wednesday, September 14, 2005 10:52 AM > To: nanog(a)merit.edu > Subject: Re: CAT5 surge/lightning strike protection recommendations? > > > > There's not much left to interpretation and preferences here, aside > > from the choice of medium to be used. I should also add that > some of the > > advice that has been posted in this thread, as well-meaning > and thoughtful as it > > has been, has been downright dangerous to follow. > > > > If one is going to run copper cable between buildings, or outdoors, in > > general, in lieu of the better alternatives of fiber or wireless, then > > there are local and national electrical, fire and safety > codes in effect > > that spell out what you must do, enforceable under the penalty of law. > > And while certain of those precautions have been spelled out > upstream in > > piecemeal fashion, none thus far has been entirely accurate > or complete. > > > > Yes, when running copper between buildings, lightning > arresters/circuit > > - i.e., protection - are a must, but they must be placed > within a couple > > of feet of the building point of entry, or POE. Think about > it. Does it > > make great sense to protect a cable from surges deep within > the interior > > of a building if the cable traverses vast distances on premises > > unprotected between the point of entry and the terminal point. > > Therefore, the stipulation of performing grounding, bonding and surge > > protections at the point where the cable enters the building (in > > potentially at addition points, elsewhere, when required). > > > > Also, if the copper cable is "armored" with a corrugated steal jacket, > > as many outside plant cables are, then the shielding (the armor) must > > also be "bonded" to earth ground at the POE, as well. So the issue > > becomes one not only of grounding, but bonding, as well. And while I'm > > on that subject, be aware that many FIBER OPTIC cables designed for > > inter-building/outside plant use are also armored and must be > treated in > > the same manner. > > > > BICSI (Building Industries Consulting Systems International) > > www.bicsi.org does a good job of rolling up all of the relevant > > standards, as do a number of other sources. For some good coverage of > > safety, grounding and bonding principles and techniques see the > > following Structured Cabling Supplement reference by Panduit > (taken from > > the Cisco CCNA Networking Academy Program) > > > > http://www.tecmiami.com/cisco/extra/CCNA1_CS_1_en.pdf > > > > Frank A. Coluccio > > DTI Consulting Inc. > > 212-587-8150 Office > > 347-526-6788 Mobile > > >

2 1

Re: CAT5 surge/lightning strike protection recommendations?
by Frank Coluccio 14 Sep '05

14 Sep '05

There's not much left to interpretation and preferences here, aside from the choice of medium to be used. I should also add that some of the advice that has been posted in this thread, as well-meaning and thoughtful as it has been, has been downright dangerous to follow. If one is going to run copper cable between buildings, or outdoors, in general, in lieu of the better alternatives of fiber or wireless, then there are local and national electrical, fire and safety codes in effect that spell out what you must do, enforceable under the penalty of law. And while certain of those precautions have been spelled out upstream in piecemeal fashion, none thus far has been entirely accurate or complete. Yes, when running copper between buildings, lightning arresters/circuit - i.e., protection - are a must, but they must be placed within a couple of feet of the building point of entry, or POE. Think about it. Does it make great sense to protect a cable from surges deep within the interior of a building if the cable traverses vast distances on premises unprotected between the point of entry and the terminal point. Therefore, the stipulation of performing grounding, bonding and surge protections at the point where the cable enters the building (in potentially at addition points, elsewhere, when required). Also, if the copper cable is "armored" with a corrugated steal jacket, as many outside plant cables are, then the shielding (the armor) must also be "bonded" to earth ground at the POE, as well. So the issue becomes one not only of grounding, but bonding, as well. And while I'm on that subject, be aware that many FIBER OPTIC cables designed for inter-building/outside plant use are also armored and must be treated in the same manner. BICSI (Building Industries Consulting Systems International) www.bicsi.org does a good job of rolling up all of the relevant standards, as do a number of other sources. For some good coverage of safety, grounding and bonding principles and techniques see the following Structured Cabling Supplement reference by Panduit (taken from the Cisco CCNA Networking Academy Program) http://www.tecmiami.com/cisco/extra/CCNA1_CS_1_en.pdf Frank A. Coluccio DTI Consulting Inc. 212-587-8150 Office 347-526-6788 Mobile

1 0

Re: LA power outage?
by Fergie (Paul Ferguson) 14 Sep '05

14 Sep '05

It's also interesting to note that, at least by some estimates, the brief power outage in L.A. yesterday took down more networks than Hurrucane Katrina: http://www.techweb.com/showArticle.jhtml?articleID=170702966 Of course, So. California is pretty "network-dense", but what does that say about the level of seriousness that network operators place on their "uptime"? - ferg -- Steve Sobol <sjsobol(a)JustThe.net> wrote: Valdis.Kletnieks(a)vt.edu wrote: > On Mon, 12 Sep 2005 21:21:59 -0000, "Reeves, Rob" said: > >>We've been told by our field tech in LA that One Wilshire had lost power >>for a bit, but it is now restored. I don't know the duration of the >>outage, but our equipment there is on DC and did not go down. > > > So - who in LA is going to be telling Santa they want a new data-center sized > diesel UPS genset for Christmas? ;) More like, "which manager is telling Santa they want a new, clue-imbued employee for Christmas?" I'm not too close to the story and I don't live in Los Angeles (I live and work 55-65 miles northeast of downtown), but it seems to me that the problem could have been avoided with a little more caution on the part of the person who cut the wires. -- Steve Sobol, Professional Geek 888-480-4638 PGP: 0xE3AE35ED Company website: http://JustThe.net/ Personal blog, resume, portfolio: http://SteveSobol.com/ E: sjsobol(a)JustThe.net Snail: 22674 Motnocab Road, Apple Valley, CA 92307 -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

6 5

Re: Computer systems blamed for feeble hurricane response?
by Mike Tancsa 14 Sep '05

14 Sep '05

At 05:10 PM 13/09/2005, kent crispin wrote: >Port 587? Not everyone implements that. You would make a large part of the internet unreachable via email vinyl# telnet mx2.mail.yahoo.com 587 Trying 67.28.114.36... telnet: connect to address 67.28.114.36: Connection refused Trying 4.79.181.13... ---Mike

2 2

Computer systems blamed for feeble hurricane response?
by Fergie (Paul Ferguson) 14 Sep '05

14 Sep '05

This is the first I've heard of this... Via The Inquirer: [snip] REPORTERS at the Wall Street Journal said they have seen documents which show that a swift response by the US federal government to Hurricane Katrina was hampered because FEMA computer servers crashed. Michael Brown, FEMA's head, resigned yesterday after being recalled by the Department of Homeland Security to Washington DC. Attempts by agencies to spur the Federal Emergency Management Agency into urgent action were met with bouncing emails, the Journal said. It quoted a Department of Health official as saying every email it had sent to FEMA staff bounced. "They need a better internet provider during disasters," the Journal quoted her or him as saying. A number of US agencies made desperate calls to the Department of Homeland Security and to Congresswomen and men, the article claimed. [Subscription required.] The newspaper did not say which computer systems FEMA uses. [snip] http://www.theinquirer.net/?article=26125 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

14 19

Re: Multi-6 [WAS: OT - Vint Cerf joins Google]
by Iljitsch van Beijnum 14 Sep '05

14 Sep '05

On 12-sep-2005, at 4:55, Matthew Petach wrote: > > And no, multiple IP addresses is not good enough. > What requirements do you have that are fundamentally incompatible > with using multiple addresses? > How would a default-free content provider with 1000+ peering sessions > be handled? Would they be treated as an ISP, even though they have no > downstreams, and get PI space? There are a few corner cases that fall through the cracks in today's policies. A content network like you describe would be one, a transit ISP with customers that all have their own addresses would be another: where would they get the IPv6 addresses to number their routers? However, the number of such networks is so incredibly small that whatever happens to them is completely insignificant with regard to scalability. Still, we need a decent policy for these cases, and JUST these cases but not random people who'd also like a /32. > Or would you expect them to get prefixes from every peer they have, > and configure several hundred IP addresses on each server? Getting address space from a peer doesn't make much sense. But 99.999% of all content networks have 1 or more ISPs that they can get address space from and then announce to any peers. > I'll be blunt. As long as that question is up in the air, none of > the major content providers are going to do anything serious in the > IPv6 arena. Well, I have no evidence of them doing anything with IPv6 anyway, so I don't know if this makes a difference. The whole point of IPv6 is that we have a technology that will allow our networks to grow for decades to come. Importing IPv4 mistakes defeats the purpose. > ACLs are already enough of a hassle with one > IP address per host. Ok, let's see... which is more important to keep the internet running, a routing table that fits in our routers, or acl monkeys that get to go home at 5?

12 18