December 2009 - Test - lists.nanog.org

More ASN collissions
by Jared Mauch 04 Jan '10

04 Jan '10

As always, good research by renesys. http://www.renesys.com/blog/2009/12/bonjour-yall-asn-split-persona.shtml - Jared

6 7

InterNAP FCP (again?)
by Michael J McCafferty 04 Jan '10

04 Jan '10

All, I know this has been discussed to some degree before and I have searched the archives. However is it seems in my previous posts to this list about anything, the truly useful replies are the private replies ones that don't make it to this list. We are considering the InterNAP Flow Control Platform. Currently we have 3 transit providers but are adding one or two more and will also be adding a connection to the Any2 exchange at One Wilshire. The price is manageable, the reporting seems quite useful, but I haven't seen it actually in action on my network. If it works as claimed for managing commit levels, performance, etc. then I expect we'd be very happy. The problem is that InterNAP does not want to do any acceptance testing... all sales are final... and in my research on the web, I see a few companies that have implemented the FCP and have either removed it or switched to Avaya CNA (yes, I know it's going away). Since InterNAP has pulled way from any kind of happiness guarantee, I'd very much like to hear from actual users of the FCP, happy and unhappy, to help me feel better about signing the PO. Does it do what it says it does for performance and managing commit levels? Do you feel it was worth the integration and money? Are you happy with it? What size and shape is the network you used it on? Do you have any additional thoughts to share regarding the FCP? Thanks! Mike -- ************************************************************ Michael J. McCafferty Principal M5 Hosting http://www.m5hosting.com You can have your own custom Dedicated Server up and running today ! RedHat Enterprise, CentOS, Ubuntu, Debian, OpenBSD, FreeBSD, and more ************************************************************

3 2

Article on spammers and their infrastructure
by Phil Regnauld 03 Jan '10

03 Jan '10

http://threatpost.com/en_us/blogs/attackers-buying-own-data-centers-botnets… It this something new ? The article seems to mix various issues together. And this would seem highly inefficient to me compared to traditional botnets (renting your own rack for a botnet doesn't really make sense :) Comments ?

21 38

RBN and it's spin-offs
by Bruce Williams 02 Jan '10

02 Jan '10

Interesting article about RBN, it's spin-offs and the global network infrastructure used for cybercrime. Has a passing mention of Atrivo's place in the global picture. http://www.newsweek.com/id/228674 Reportedly started by someone operating under the name "Flyman," RBN is known as the mother of cybercrime among online investigators. François Paget, senior expert for the McAfee company, says that RBN began as an Internet provider and offered "impenetrable" hosting for $600 a month. This meant a guarantee that it would not give out information about its clients, no matter what business they were in. Aleksandr Gostev, director of Kaspersky Labs, a global research and threat analysis center, believes that RBN's servers are located in Panama. "Confidential data about clients can be obtained only by a court decision," a Newsweek source familiar with the situation says. "But what court do you apply to if criminal ties are discovered? A Panamanian court?" -- Bruce Williams “Discovering...discovering...we will never cease discovering... and the end of all our discovering will be to return to the place where we began and to know it for the first time.” -T.S. Eliot

9 15

Restrictions on Ethernet L2 circuits?
by Endresen Even 01 Jan '10

01 Jan '10

Hello, Anyone with opinions on what restrictions a service provider should and should not impose on Ethernet L2 circuits provided to business customers wanting to connect several offices? The service provider's MPLS core network doesn't mind what traffic flows through the EoMPLS tunnel, but the L2 access network do mind and can be vulnerable to several layer 2 issues. Broadcast storm control and BPDU filter will protect the access network to a certain degree, but there are still potential layer 2 problems that can affect the switches, for example MAC address spoofing/flooding. Not to mention potentially difficult troubleshooting if a business customer connects two large LANs through the ISP's Ethernet layer 2 circuit, and then experience some occult layer 2 problem. Should business customers expect to be able to connect several LANs through an Ethernet L2 ciruit and build a layer 2 network spanning several locations? Or should the service provider implement port security and limit the number of MAC addresses on the access ports, forcing the customer to connect a router in both ends and segment their network? Also, do you see a demand for multi-point layer 2 networks (requiring VPLS), or are point-to-point layer 2 circuits sufficient to meet market demand? The most important argument for customers that choose Ethernet L2 over MPLS IP-VPN is that they want full control over their routing, they don't want the involvement from the service provider. Some customers also argue that a flat layer 2 network spanning several locations is a simpler and better design for them, and they don't want the "hassle" with routers and network segmentation. But IMO the customer (and the service provider) is far better off by segmenting their network in the vast majority of cases. What do you think? Regards, Even ___________________________________________________ This message and any attachment is intended for the person(s) named above only. It may contain information that is confidential or legally privileged. If you have received this communication in error, please erase all copies of the message and its attachments and notify us immediately. Thank You. This footnote confirms that the email and attachment(s) has been swept by our anti-virus solution for the presence of known computer viruses.

7 11

question regarding multi-homing
by Simon Chen 31 Dec '09

31 Dec '09

Hi all, Happy new year... I have a question regarding multi-homing, mostly from stub network's operational point of view. My big question is: what kind of failures do you usually see from your providers? Link down? Link up, but withdraw some routes? Link up, no route change, but blackholing partial or all traffic? Anything else? Let's say that I have two local routers (Ra and Rb) connecting to two providers, A and B. If router Ra sees provider A with problems of the first two cases (link down, link up but withdraw routes), the Rb can easily step up. My question is, if I am using provider A as the default, but provider A has the third problem (link up, no route change, but blackholing traffic), how can I detect it and switch provider automatically? To state this problem in detail: I use a static default route on Ra to forward traffic to provider A, or receive 0/0 from provider A via BGP. For some reason, provider A can no longer reach a /24. My network cannot be notified (unless, I receive a full internet routing table). In this case, all I know is that my traffic to /24 is blackholed through provider A. In this case, is there an automatic way for my stub network to switch over to provider B? Do I have to do the detection and switch over manually? I don't think VRRP can help here, right? Thanks. -Simon

6 6

Out of the office
by Andrew.Claybaugh＠securian.com 31 Dec '09

31 Dec '09

I will be out of the office starting 12/30/2009 and will not return until 01/04/2010. If you need immediate assistance please call TechSupport at 651-665-5000.

1 0

ip-precedence for management traffic
by Luca Tosolini 31 Dec '09

31 Dec '09

Experts, what is the general opinion of using ipp 7 'network control' for management traffic like: telnet ssh snmp ..... The idea is that ipp 0 1 2 3 4 5 are used for user traffic ipp = 6 is used by default by routing protocols like BGP, OSPF, LDP ... this leaves out only ipp 7 for management traffic, on the premise that routing and management should not share the same queue and resources..... Thanks, Luca.

24 38

Consumer-grade dual-homed connectivity options?
by Paul Bennett 30 Dec '09

30 Dec '09

Not sure whether this is an appropriate place to post this, but I thought I'd give it a shot, since you're all knowledgeable folks with regard to networking things... At home, I currently run two DSL lines. Right now, we just have two separate LANs, one connected to each line, with my wife's devices attached to one, and my devices attached to the other. For a while now, I've been thinking about setting up a load-balancing routing solution to give both of us access to both lines. I have the opportunity to acquire a refurbed Cisco Catalyst 2960 at a ridiculously low price. I also have access to a (nominally) spare quad-core 64-bit PC with 8GB of RAM. I say "nominally" because I'm thinking about setting it up as a media center / gaming rig connected to the TV in the den. That's largely beside the point, but it bears pointing out that keeping the PC available for my other needs would be a good thing. So. Is it going to be a more-effective solution to drop a few bucks on the 2960 and go through the hassle of learning how to set it up (and then setting it up), or would I be better off putting a secured Linux distro (e.g. gentoo-hardened, or something) on the semi-spare PC and running the load-balancing via iproute2 and friends? Either way, I'm looking at a learning curve, and a good amount of time fannying around getting the damn thing working -- there's a good chance I'd spend almost as much cash on the PC-based solution getting good-quality network cards, and maybe fast HDD tech (though it seems like RAM and cores would be more important than disk IO). What are your opinions? -- Paul

12 15

just...wow.
by Jerry Pasker 30 Dec '09

30 Dec '09

I got this email inquiring about data center space, from the most honest scumbag, *EVER* today. Operational relevance? Well, if everyone would turn these people down, we'd have a lot less problems to deal with. Sadly, requests like these happen far too often, but never have I had someone come right out and explain what they were doing up front like this without having to dig in to it. Scumbag email: ------------ Hello, I need servers to host botnet controller. Botnet controller is software that sends tasks to bots. Bots are hosts which send spam emails to millions of addresses. It's not direct spam but abuses on botnet contoller are received from time to time. What is your policy in case of receiving abuses and what is your policy in case of receiving a lot of abuses? What is policy about spam (not direct from your ips as I mentioned above)? Is it possible to host botnet controller in your datacenter during long-term time? Thank you. -------------- The part that leaves me feeling good is that they do get abuse complaints from time to time. There's hope.

4 5