June 2009 - Test - lists.nanog.org

Issues through ATT core/backbone
by Veerender Attri 03 Jun '09

03 Jun '09

We have a few circuits with ATT and a few VZ. Since friday we have seen serveral intermittent issues throught ATT to reach various customers and our various remote offices. If we swing the traffic through VZ interfaces using static routes we can reach those locations fine. We were doing traceroutes during the issue and we saw the traceroutes dying inside ATT network. I was wondering if any one else saw similar issues ? On friday we saw issue between ATT and GBLX peering point. We saw similar issue on tuesday. And another one today. We sent to ATT various traceroutes and opened a few tickets but didnt really get any kind of confirmation. The problem seems to remedy itself on its own after 10-30 minutes. Please chime in if any one else saw similar issues transiting through AT&T or global crossing.

2 2

Savvis quality?
by David Hubbard 03 Jun '09

03 Jun '09

Just wondering if anyone can tell me their opinion on Savvis bandwidth/company preferably from a web host perspective. Considering a connection. Thanks, David

6 7

Re: Fiber cut - response in seconds?
by Warren Bailey 02 Jun '09

02 Jun '09

I do 250 mbits on 21 transponders :) ----- Original Message ----- From: John van Oppen <john(a)vanoppen.com> To: Chris Adams <cmadams(a)hiwaay.net>; Deepak Jain <deepak(a)ai.net> Cc: nanog(a)nanog.org <nanog(a)nanog.org> Sent: Tue Jun 02 14:51:59 2009 Subject: RE: Fiber cut - response in seconds? Ok, while this is off-topic, let's just point people to Wikipedia: Other satellites (which are NOT in the same position at all times from the prospective of a spot on earth): http://en.wikipedia.org/wiki/Geosynchronous_orbit TV, and other fixed positioned (relative to the earth are geostationary): http://en.wikipedia.org/wiki/Geostationary_orbit perhaps further comments can go to the discussion pages on Wikipedia since I would wager a very small number of us push any serious number of bits via satellite. John van Oppen Spectrum Networks LLC Direct: 206.973.8302 Main: 206.973.8300 Website: http://spectrumnetworks.us -----Original Message----- From: Chris Adams [mailto:cmadams@hiwaay.net] Sent: Tuesday, June 02, 2009 3:36 PM To: Deepak Jain Cc: nanog(a)nanog.org Subject: Re: Fiber cut - response in seconds? Once upon a time, Deepak Jain <deepak(a)ai.net> said: > I promise you that that is not the case for all applications. > Geosynchronous satellites can be anywhere. For the applications you > are considering (communications mostly), equatorial orbit is the most > advantageous. Geosynchronous are only over a particular longitude. They move up and down in latitude, so it isn't over a given point except twice per day (or only once at the extremes). -- Chris Adams <cmadams(a)hiwaay.net> Systems and Network Administrator - HiWAAY Internet Services I don't speak for anybody but myself - that's enough trouble.

2 1

Re: Fiber cut - response in seconds?
by David Barak 02 Jun '09

02 Jun '09

--- On Tue, 6/2/09, Charles Wyble <charles(a)thewybles.com> wrote: > David Barak wrote: > > Encryption is insufficient - if you let someone have > physical access for a long enough period, they'll eventually > crack anything. > > Really? I don't think so. I imagine it would be much more > dependent on the amount of computing power the attacker has > access to. More encrypted blobs won't help. If that was the > case then the various encryption schemes in wide use today > would be cracked already. Bad guys can setup networks and > blast data through it and have complete access. I don't see > them cracking encryption. Paranoia 101 teaches us that any given encryption approach will eventually fall before a brute-force onslaught of sufficient power and duration[1]. I'm not trying to argue that the attacker in this case could necessarily detect a flaw in the algorithm; rather, they'll get an effectively infinite number of chances to bang against it with no consequences. Once it's cracked, the attacker will *still* have the physical access which is thus compromised, and then has free access to all of the transmissions. Physical security is a prerequisite to all of the other approaches to communication security. Those cases where physical security is presumed to be non-existant have to rely on a lot of out-of-band knowledge for any given method to be resistant to attack, and it's very hard to make use of a connection of that type for regular operations. Pretty much all security eventually boils down to people with firearms saying "don't do that." David Barak Need Geek Rock? Try The Franchise: http://www.listentothefranchise.com

7 8

Fiber cut - response in seconds?
by Charles Wyble 02 Jun '09

02 Jun '09

http://www.washingtonpost.com/wp-dyn/content/article/2009/05/30/AR200905300… Not sure if I fully believe the article. Responding to a fiber cut in seconds? I suppose it's possible if $TLA had people monitoring the construction from across the street, and they were in communication with the NOC.

18 31

Re: Fiber cut - response in seconds?
by David Barak 02 Jun '09

02 Jun '09

Encryption is insufficient - if you let someone have physical access for a long enough period, they'll eventually crack anything. Encryption makes the period of time longer, but let them try? As regards "roving," we are talking about Tyson's Corner here: that's pretty close (< 5km) to major offices of lots of folks who would care deeply about such matters. David Barak Need Geek Rock? Try The Franchise: http://www.listentothefranchise.com --- On Tue, 6/2/09, Charles Wyble <charles(a)thewybles.com> wrote: > From: Charles Wyble <charles(a)thewybles.com> > Subject: Re: Fiber cut - response in seconds? > To: "nanog(a)nanog.org" <nanog(a)nanog.org> > Date: Tuesday, June 2, 2009, 1:57 PM > Cheaper? > > To quote sneakers.... were the united states govt. we don't > do that sort > of thing. > > Martin Hannigan wrote: > > It would also be cheaper to add an additional layer of > security with > > encryption vs. roving teams of gun toting manhole > watchers. > > > > YMMV, > > > > Best! > > > > Marty > > > > > > > > On 6/2/09, Deepak Jain <deepak(a)ai.net> > wrote: > >>> No. And here's why: If you're a naughty > foreign intelligence team, and > >>> you know your stuff, you already know where > some of the cables you'd > >>> really like a tap on are buried. When you hear > of a construction > >>> project > >>> that might damage one, you set up your > innocuous white panel truck > >>> somewhere else, near a suitable manhole. When > the construction guy with > >>> a backhoe chops the cable (and you may well > slip him some money to do > >>> so), *then* you put your tap in, elsewhere, > with your actions covered > >>> by > >>> the downtime at the construction site. That's > why the guys in the SUVs > >>> are in such a hurry, because they want to > close the window of time in > >>> which someone can be tapping the cable > elsewhere. > >>> > >>> At least that's what I heard. I read it > somewhere on the internet. > >>> Definitely. Not at all a sneaky person. No > sir. > >> And if you were a naughty foreign intelligence > team installing a tap, or a > >> bend, or whatever in the fiber contemporaneously > with a known cut, you could > >> also reamplify and dispersion compensate for the > slight amount of affect > >> your work is having so that when its tested later, > the OTDR is blind to your > >> work. > >> > >> Ah, the fun of Paranoia, Inc. > >> > >> Deepak Jain > >> AiNET > >> > >> > > > > > >

3 2

Huawei cx300
by Jack Kohn 02 Jun '09

02 Jun '09

Guys, Anybody any experience with VPLS on Huawei cx300? Jack

2 1

White House net security paper
by jamie rishaw 02 Jun '09

02 Jun '09

The White House just put out a release on net security[1] - at first glance a mission/vision/values paper, the release page[2] also containing a short video[3]. At first glance, this looks promising - anyone else get a chance to read/review? Comments? -jamie [1] http://www.whitehouse.gov/asset.aspx?AssetId=1732 [2] http://www.whitehouse.gov/CyberReview/ (other links here as well) [3] http://www.whitehouse.gov/videos/2009/May/20090529_Cyber_Security.mp4 -- Jamie Rishaw // .com.arpa@j <- reverse it. ish. [Impressive C-level Title Here], arpa / arpa labs

11 19

RE: In a bit of bind...
by Ben Matthew 02 Jun '09

02 Jun '09

Thanks very much for the various responses to my question; both on and off-list. I'm very much liking the idea of only letting the outside world see bind and then AXFR'ing the data from an easier-to-manage internal database backed solution. Whether that be myDNS, Microsoft or whatever. Bit of initial config work and then, in theory, an easy job to administer. Actually feel a bit dumb for not considering that in the first place. Cheers again, Ben -----Original Message----- From: Peter Hicks [mailto:peter.hicks@poggs.co.uk] Sent: 01 June 2009 12:42 To: Ben Matthew Cc: nanog(a)nanog.org Subject: Re: In a bit of bind... Ben, Ben Matthew wrote: > I have six servers in total, two multi-homed servers for ordinary DNS and four servers running an Anycast network (2 x master and slave). > For DNS, you may find it easier to outsource hosting to another provider who has geographically diverse DNS services. This doesn't necessarily mean loss of control. It also separates your nameserver hosting from your servers - suppose your network were to be under attack, or a configuration error dropped you offline. If DNS were somewhere else, you could log in, change A records, point somewhere else. > Anyway I've recently been investigating other options for DNS as, like many companies currently, we've laid off a bunch of staff and the overhead for maintaining BIND is quite high if done, like us, unassisted and you are editing zone files in a text editor. > Revision control systems - CVS, Subversion - are your friend here. What about wrapping up your DNS change procedure through perl or shell scripts which automatically roll back if bind doesn't reload, or some critical hosts suddenly disappear from the file. Also, ask yourself what the cost of operating the service without changes is, and what the cost of each change is. How often are you making changes? How often do you need to make a change in an absolute emergency? If changes are being done frequently, a technical or semi-technical member of staff will get to know the procedure. If changes are being made rarely, can the changes wait for you to apply them if you don't feel comfortable with others doing it? > Ultimately for our simple zones (non-Anycast, basic web forwarders) I want to create a web-app to do this for me, probably in PHP. I could create something that... Herein lies a problem - you want to create a web front-end to a DNS server. You're going to have to do a lot of testing to make this play nicely, and you could introduce your own security holes or gotchas. What is the cost of creating something yourself? How about one of the following? * Outsource DNS hosting, use another provider's interface to manage * BIND9 slaves, Windows-based master (hidden) which already has a GUI and it isn't difficult to change zones * Stick to what you have and document it, wrapping the 'apply' process in some simple shell or perl Peter ________________________________________________ DISCLAIMER This e-mail message, including any attachments, is intended solely for the use of the addressee and may contain confidential information. If it is not intended for you, please inform the sender and delete the e-mail and any attachments immediately. Any review, retransmission, disclosure, copying or modification of it is strictly forbidden. Please be advised that the views and opinions expressed in this e-mail may not reflect the views and opinions of TIML Radio Limited or any of its parent and subsidiary companies. Whilst we take reasonable precautions to ensure that our emails are free from viruses, we cannot be responsible for any viruses transmitted with this e-mail and recommend that you subject any incoming e-mail to your own virus checking procedures. Use of this or any other e-mail facility signifies consent to any interception we might lawfully carry out to prevent abuse of these facilities. ________________________________________________ TIML Radio Limited (trading as Absolute Radio) Registered office: One Golden Square, London. W1F 9DJ Registered in England No 02674136 VAT No 927 2572 11

4 3

RE: In a bit of bind...
by gb10hkzo-nanog＠yahoo.co.uk 02 Jun '09

02 Jun '09

Hi, I have not been following this thread too closely, but I spotted the last poster talking about a database backend to DNS. There are some interesting thoughts on the matter in a Nominet Blog Post here : http://blog.nominet.org.uk/tech/2008/06/02/nameservers-and-very-large-zones/

1 0