October 2009 - Test - lists.nanog.org

Simple Change Management Tracking
by Paul Stewart 26 Oct '09

26 Oct '09

Hi folks... I'm just looking for some feedback ... we are looking for a *really* simple Change Management ticket system. All we want is a system that does the following: Technician opens ticket requesting a network level or server level change outlining the brief details, severity level and date for work to be performed. Senior technical staff/management review and approve/deny Technician completes change and records information in ticket to have it closed off. Ideal would be some kind of email notification option as well. On the surface, this seems really simple but every option (open source and commercial) wants to tie this into a MUCH larger package solution which we don't need. This is to manage approximately 6 people in a specific group of the company. Any input would be appreciated... Paul ---------------------------------------------------------------------------- "The information transmitted is intended only for the person or entity to which it is addressed and contains confidential and/or privileged material. If you received this in error, please contact the sender immediately and then destroy this transmission, including all attachments, without copying, distributing or disclosing same. Thank you."

8 13

Re: What should ISPs ASPs MSPs xSPs do?
by deleskie＠gmail.com 26 Oct '09

26 Oct '09

I always make the assumption that I'm on my own and now one will help. If they do GREAT if not, sucks to be but I'm prepared. In a perfect world we all help others, but if the people paying any givens person paycheck have other issues tasked to higher priority levels then I can blame or fault them for not helping me. -jim ------Original Message------ From: Sean Donelan To: nanog(a)nanog.org Subject: What should ISPs ASPs MSPs xSPs do? Sent: Oct 25, 2009 7:13 PM Other than the usual damned if they do, damned if they don't; is there any rough consensus about some practical things ISPs, ASPs, MSPs, xSPs (and customers/users) should do or should not do? Or is it just rough consensus what other people should do, but you'll get upset if that rough consensus stopped you from doing something? Stop stuff you don't like immediately, anytime of the day or night; but give you years to fix your stuff even if it is hurting other people's stuff. Sent from my BlackBerry device on the Rogers Wireless Network

1 0

RE: ISP port blocking practice/Free Speech
by Richard.E.Brown＠dartware.com 26 Oct '09

26 Oct '09

> > Free speech doesn't include the freedom to shout fire in a crowded theatre. > > It most certainly does! There is absolutely nothing to prevent one from > shouting "FIRE" in a crowded theatre. Actually, it doesn't. When I was on-staff at the computer center at Dartmouth, our provost also happened to be a first-amendment scholar, and he gave us an impromptu speech about the first amendment at a staff meeting :-) The US Supreme Court recognizes a couple exceptions to the broad permission to speak freely: - Shouting fire in a crowded theater is explicitly prohibited because of the obvious danger and risk of injury. - "Fighting words", that by their very utterance inflict injury or tend to incite an immediate breach of the peace". [Wikipedia] The example he gave was this: someone standing on a soapbox in Hanover NH, saying that we should storm the gates in Washington and burn the place down is just exercising their free speech rights - there's no credible *imminent* threat. However, standing there and saying that we should burn down the Town Hall could clearly be believed to be a real threat, and the government would be justified in stepping in. Rich Brown richard.e.brown(a)dartware.com Dartware, LLC http://www.dartware.com 66-7 Benning Street Telephone: 603-643-9600 West Lebanon, NH 03784-3407 Fax: 603-643-2289

5 4

Nanog Mentioned in TED Video: Jonathan Zittrain
by Israel Lopez-LISTS 26 Oct '09

26 Oct '09

Remember when youtube went down? Mr. Zittrain briefly mentions nanog during his TED talk in July 2009. http://www.ted.com/talks/jonathan_zittrain_the_web_is_a_random_act_of_kindn… Enjoy.

3 4

What should ISPs ASPs MSPs xSPs do?
by Sean Donelan 25 Oct '09

25 Oct '09

Other than the usual damned if they do, damned if they don't; is there any rough consensus about some practical things ISPs, ASPs, MSPs, xSPs (and customers/users) should do or should not do? Or is it just rough consensus what other people should do, but you'll get upset if that rough consensus stopped you from doing something? Stop stuff you don't like immediately, anytime of the day or night; but give you years to fix your stuff even if it is hurting other people's stuff.

2 1

application recommendation
by nsosoc -G- 25 Oct '09

25 Oct '09

Hey guys, I have a need for your candid opinion. I am searching for an enterprise sized application (commercial or otherwise) that can accomplish diversified network access from the inside. This is roughly the situation: A diversified very large (multinational) enterprise, consisting of a multitude of local networks. Each of the local networks provide direct hard-wired local and Internet access with our equipment to our employees. Our company has many third-party users. We would want to provide to the latter (after a secure admission session) Internet access with their own equipment through our (the same hard-wired) connection (and subsequently with our firewall services and using our corporate endpoint security), but no access to the internal/local networks. Which application would accomplish this? Appreciating your recommendations. Best, Jack Jack Ryan Network Architecture National Railway System nsosoc(a)gmail.com

1 0

Advice about Qwest, Cogent, and Equinix facilities
by Jeffrey Negro 24 Oct '09

24 Oct '09

My company is planning on implementing a new strategy for our web application deployment. My goal is to choose a datacenter/collocation provider who has facilities in the NY and Chicago regions, so that I can have a Primary and DR site connect by at least a 100M line. So far I have identified Qwest, Cogent and Equinix as possible providers. As I have only dealt with Equinix in the past, I would welcome any advice or experiences other nanog members may have with regards to these providers, as well as any suggestions about other providers that may fit the bill. Thank you in advance for your input. Jeffrey Negro, Network Engineer Billtrust - Improving Your Billing, Improving Your Business www.billtrust.com <http://www.billtrust.com/> 609.235.1010 x137 jnegro(a)billtrust.com <mailto:jeichmann@billtrust.com>

3 2

Re: ISP port blocking practice
by a.harrowell＠gmail.com 24 Oct '09

24 Oct '09

-original message- Subject: Re: ISP port blocking practice From: Owen DeLong <owen(a)delong.com> Date: 24/10/2009 4:00 am Yes. Owen On Oct 23, 2009, at 2:19 PM, Lee Riemer wrote: > Isn't blocking any port against the idea of Net Neutrality? > Only if you take a legalistic view of it. Too much of the NN debate is about the futile search for an infallible legal argument with no corner cases. This is silly. Take an empirical, practical view instead. Obviously there is no objection to blocking spam going out; after all, the spam comes from machines that are no longer under the control of their owners, so the only free speech that is affected is that of the spammer, and hasn't that already been litigated? Free speech doesn't include the freedom to shout fire in a crowded theatre. Neither does it include the freedom to carry out a DDOS on the fire brigade control room. You aren't allowed to levy a toll on the roads and except your mates - roads are neutral. But that doesn't invalidate the speed limit or the obligation to drive on the left. > Justin Shore wrote: >> Owen DeLong wrote: >>> Blocking ports that the end user has not asked for is bad. >> >> I was going to ask for a clarification to make sure I read your >> statement correctly but then again it's short enough I really don't >> see any room to misinterpret it. Do you seriously think that a >> typical residential user has the required level of knowledge to >> call their SP and ask for them to block tcp/25, tcp & udp/1433 and >> 1434, and a whole list of common open proxy ports? While they're >> at it they might ask the SP to block the C&C ports for Bobax and >> Kraken. I'm sure all residential users know that they use ports >> 447 and 13789. If so then send me some of your users. You must be >> serving users around the MIT campus. >> >>> Doing it and refusing to unblock is worse. >> >> How you you propose we pull a customer's dynamically-assigned IP >> out of a DHCP pool so we can treat it differently? Not all SPs use >> customer-facing AUTH. I can think of none that do for CATV though >> I'm sure someone will now point an oddball SP that I've never heard >> of before. >> >>> Some ISPs have the even worse practice of blocking 587 and a few >>> even >>> go to the horrible length to block 465. >> >> I would call that a very bad practice. I haven't personally seen a >> mis-configured MTA listening on the MSP port so I don't think they >> can make he claim that the MSP port is a common security risk. I >> would call tcp/587 a very safe port to have traverse my network. I >> think those ISPs are either demonstrating willful ignorance or >> marketing malice. >> >>> A few hotel gateways I have encountered are dumb enough to think >>> they can block TCP/53 >>> which is always fun. >> >> The hotel I stayed in 2 weeks ago that housed a GK class I took had >> just such a proxy. It screwed up DNS but even worse it completely >> hosed anything trying to tunnel over HTTP. OCS was dead in the >> water. My RPC-over-HTTP Outlook client couldn't work either. >> Fortunately they didn't mess with IPSec VPN or SSH. Either way it >> didn't matter much since the network was unusable (12 visible APs >> from room, all on overlapping 802.11b/g channels). The average >> throughput was .02Mbps. >> >>> Lovely for you, but, not particularly helpful to your customers >>> who may actually want to use some of those services. >> >> I take a hard line on this. I will not let the technical ignorance >> of the average residential user harm my other customers. There is >> absolutely no excuse for using Netbios or MS-SQL over the Internet >> outside of an encrypted tunnel. Any user smart enough to use a >> proxy is smart enough to pick a non-default port. Any residential >> user running a proxy server locally is in violation of our AUP >> anyway and will get warned and then terminated. My filtering helps >> 99.99% of my userbase. The .001% that find this basic security >> filter intolerable can speak with their wallets. They can find >> themselves another provider if they want to use those ports or pay >> for a business circuit where we filter very little on the >> assumption they as a business have the technical competence to >> handle basic security on their own. (The actual percentage of >> users that have raised concerns in the past 3 years is .0008%. I >> spoke with each of them and none decided to leave our service.) >> >> We've been down the road of no customer-facing ingress ACLs. We've >> fought the battles of getting large swaths of IPs blacklisted >> because of a few users' technical incompetence. We've had large >> portions of our network null-routed in large SPs. Then we got our >> act together and stopped acting like those ISPs who we all love to >> bitch about, that do not manage their customer traffic, and are >> poor netizens of this shared resource we call the Internet. Our >> problems have all but gone away. Our residential and business users >> no longer call in on a daily basis to report blacklisting >> problems. We no longer have reachability issues with networks that >> got fed up with the abuse coming from our compromised users and >> null-routed us. I stand by our results as proof that what we're >> doing is right. Our customers seem to agree and that's what matters. >> >> Justin >> >> >>

2 1

Re: Interesting Point of view - Russian police and RIPE accused of aiding RBN
by Paul Bosworth 24 Oct '09

24 Oct '09

I think the larger point is that ripe turned a blind eye to an internationally recognized criminal network. On Oct 24, 2009 2:01 AM, "Suresh Ramasubramanian" <ops.lists(a)gmail.com> wrote: http://www.eweekeurope.co.uk/news/russian-police-and-internet-registry-accu… Some quotes from the article - Internet registry RIPE NCC turned a blind eye to cybercrime, and Russian police corruption helped the perpetrators get away with it, according to the UK Serious Organised Crime Agency [...] "RIPE was being paid by RBN for that service, for its IP allocation," he said. "Essentially what you have - and I make no apologies for saying this is - if you were going to interpret this very harshly RIPE as the IP allocation body was receiving criminal funds and therefore RIPE was involved in money laundering offences," said Auld. [...] "All we could get there was a disruption, we weren't able to get a prosecution in Russia," admitted Auld. "Our biggest concern is where did RBN go? Our information suggests that RBN is back in business but now pursuing a slightly different business model which is bad news." [...] "Where you have got LIRs (Local Internet Registries) set up to run a criminal business- that is criminal actvity being taken by the regional internet registries themselves. "So what we are trying to do is work with them to make internet governance a somewhat less permissive environment for criminals and make it more about protecting consumers and individuals," added Auld. RBN looked legitimate, says RIPE NCC In response to the comments that it could be accused of being involved in criminal activity, Paul Rendek, head of external relations and communications at RIPE NCC said that the organisation has very strict guidelines for dealing with LIRs. "The RBN was accepted as an LIR based on our checklists," he said." Our checklists include the provision of proof that a prospective LIR has the necessary legal documentation, which proves that a business is bona fide." etc

3 2

Slashdotted - Peering Disputes Migrate To IPv6
by Scott Howard 24 Oct '09

24 Oct '09

http://tech.slashdot.org/story/09/10/23/1715235/Peering-Disputes-Migrate-To… I wouldn't bother with the comments unless you really need to know how the analogy between IP peering and two gay guys ends up... (hey, it's Slashdot, what did you expect?) Scott

2 1