February 2010 - Test - lists.nanog.org

Research Project: Internet capacity during pandemic events
by haska＠ualberta.ca 03 Feb '10

03 Feb '10

Hello everyone, My name is Mike Haska, and I am a graduate student at the University of Alberta. I am conducting research into Internet capacity issues during pandemic events. In order to analyze certain aspects of this topic, I need to get in touch with representatives from the major Internet service providers in Canada - some of whom, I am hoping, are members of this distribution. Specifically, I am looking to get in touch with individuals who are familiar with the structure of their network and with any pandemic contingency plans that are in place within their organization. If you think you may be able to assist, or if you know of anyone who could, please contact me at (haska at ualberta.ca) and I will provide further information on all aspects of this study. To put your mind at ease - I'm not fishing around for sensitive information or your root passwords; I'm looking for an overview of your policies and your responses to hypothetical scenarios. Your confidentiality is assured and you are welcome to preview all the questions to be asked before you commit to participating in any way. I feel this topic has important implications to network operators in Canada, so any support you can offer to this research project is greatly appreciated. Best regards, -Mike

4 3

Re: Fiber Cut in CA?
by charles＠knownelement.com 02 Feb '10

02 Feb '10

That is one long protect path. Yikes. Sent via BlackBerry from T-Mobile

8 7

RE: Datacenter for DR in northwestern NJ/NY
by Ray Sanders 02 Feb '10

02 Feb '10

Datapipe has a facility in N.J... Not sure if they are 50mi from NYC Mobile email powered by the force... ---- Original Message ---- From: "Matt Sprague" <msprague(a)readytechs.com> Date: 2/2/10 2:19 pm To: "nanog(a)nanog.org" <nanog(a)nanog.org> Subj: Datacenter for DR in northwestern NJ/NY Hello NANOG! Does anyone know of some strong datacenters in northwestern NJ, or north of Westchester NY without getting too far away from NYC? I'm looking for a DR colo solution for a site that is in NYC; this needs to be at least 50m away from NYC, but I'm trying to keep it not too much further than that for convenience. I'm also trying to keep this to top level providers as there may be compliance requirements. Thanks in advance for any responses. -- Matt Sprague ReadyTechs, LLC msprague(a)readytechs.com<mailto:msprague@readytechs.com> 973-455-0606 x1204 (voice) http://www.readytechs.com/

3 2

Re: NREN Network Design
by Tarig Y. Adam 02 Feb '10

02 Feb '10

Hi Stephane thanks, your scheme is very expressive.And sorry for forgetting to send this message to my own list (afnog). regarding the subject the next hop of default route of our customers are ISP routers then SUIN routers. Is this a normal situation??? Normal0falsefalsefalseEN-USX-NONEAR-SAMicrosoftInternetExplorer4 /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin;} --------------------------------- Eng. Tarig Yassin Adam Sudanese Universities' Information Network (SUIN) T: +249925659149 ----- Original Message ----- From: Stephane Bortzmeyer <bortzmeyer(a)nic.fr> To: Tarig Yassin Adam <tarig(a)suin.edu.sd> Cc: Phil Regnauld <regnauld(a)nsrc.org> , <afnog(a)afnog.org> Date: Tuesday, February 2 2010 11:40 AM Subject: Re: NREN Network Design On Mon, Feb 01, 2010 at 10:04:07PM -0500, Tarig Yassin Adam <tarig(a)suin.edu.sd> wrote a message of 597 lines which said: > hi phil [And thanks for forwarding this discussion where it belongs. It is sad that a discussion on an african NREN was first carried to a North America list.] > We already applied to AfriNIC, they allocated to us /18 ipv4 we're > using two ISPs to connect to our customers and the same time we're > using these ISPs for the Internet. And you use BGP? You have your own AS? > The ISP using tunnel layer 3. I am sorry, I cannot parse this sentence. > For customer sites to reach our NOC they need next hop to the ISP > routers which we do not have a control. The way I understand it (you are really short on details), the universities are your customers and there is always an ISP between NREN and UNI: +---------+ | | +---------+ | NREN |---------| ISP 1 |------- UNI 1 +---------+ +---------+ | | \ +--------+ | \ | ISP 2 | +-----------+ \ +--------+-------| Internet | +--------+ | | +-----------+ | UNI 2 | | | | | +------+ +-------+ +--------+ |UNI 3 | | UNI 4 | +------+ +-------+ Is my schema OK? If no, please provide yours. If yes, I wonder, what service provides the NREN if no connectivity? If you just provide Internet servers (HTTP, XMPP, etc), there is no need to "tunnel" anything over the ISP.

1 0

[NANOG] NREN Network Design
by Tarig Yassin Adam 02 Feb '10

02 Feb '10

I'm try to redesign the Sudanese NREN (National Research & Education Network). we provide end to end service,to our customers. Our network is build over local ISPs. But the problem of the current design that each time we need to go back to the ISP to change our Infrastructure IP addresses, when the situation need this.How can solve this? I heard about something called Virtual Network Environment which give us the full control of ISP routers, is it the best solution? What about others NRENs.Thanks Normal0falsefalsefalseEN-USX-NONEAR-SAMicrosoftInternetExplorer4 /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin;} --------------------------------- Eng. Tarig Yassin Adam Sudanese Universities' Information Network (SUIN) T: +249925659149 E: tarig(a)sustech.edu

4 3

Re: Mitigating human error in the SP
by Chadwick Sorrell 02 Feb '10

02 Feb '10

On Tue, Feb 2, 2010 at 12:45 PM, James Downs <james.downs(a)egontech.com> wrote: > > On Feb 2, 2010, at 9:33 AM, Jared Mauch wrote: > > We have solved 98% of this with standard configurations and templates. > > To deviate from this requires management approval/exception approval after > an evaluation of the business risks. > > I would also point Chad to this book: http://bit.ly/cShEIo (Amazon Link to > Visual Ops). > It's very useful to have your management read it. You may or may not be > able to or want to use a full ITIL process, but understanding how these > policies and procedures can/should work, and using the ones that apply makes > sense. > Change control, tracking, and configuration management are going to be key > to avoiding mistakes, and being able to rapidly repair when one is made. > Unfortunately, most management that demands No Tolerance, Zero Error from > operations won't read the book. > Good luck.. I'd bet most of the people on this list have been there one time > or another. > Cheers, > -j Interesting book, maybe I'll bring that to the next meeting. Thanks for the heads up on that.

1 0

Threading the senderbase reputation needle
by Drew Weaver 02 Feb '10

02 Feb '10

Howdy, Has anyone come up with a reverse DNS 'pattern' that one can employ that will prevent Senderbase from assigning a poor reputation to an entire /24 because they saw an email they didn't like from a single IP address? We're an infrastructure provider, which means that we lease servers, etc to customers and everything we do uses static IPs. Our current 'default (before the customer changes it)' is a x.x.x.x.static.domain.com, apparently Senderbase cannot look up CIDR boundaries in the RIR database (even though we spend a lot of time making sure that we publish the CIDR information) so they just assume that each 'offender' owns the entire /24 and they also consider any 'email' from the static.domain.com domain to be the 'same offender' (which is completely silly). The other little annoyance about their system is that we assign CIDR blocks to users (almost always a /29) these CIDRs include IP addresses like the gateway address, the broadcast address, the network address, etc and the users may only use 2-3 of the IPs in the /29, but they expect us or the user to set a 'custom looking' reverse DNS on all of the IPs in the range. Originally, we were not putting any reverse DNS on our IPs until the customer requested it (or did it themselves via our system) but then we ran into problems with some RBLs that require reverse DNS on all IPs, and other RBLs that require matching forward and reverse DNS on all IPs. I've contacted Senderbase for advice on what specifically we need to do but they've been vague at best and I have even asked them for examples of companies who 'meet their specifications' but I wasn't given any. I'm considering doing something like customerXXXXX.static.domain.com but then I can see other problems with that also. Any advice? -Drew

4 5

Unix Sysadmin/Net Eng in the Toronto Area?
by Carlos Kamtha 02 Feb '10

02 Feb '10

Greetings, I am looking for an experienced Freebsd/linux/cisco/juniper person. If you live in Toronto or the GTA and are interested please drop me a line offlist. Cheers, Carlos.

1 0

Re: Mitigating human error in the SP
by gb10hkzo-nanog＠yahoo.co.uk 02 Feb '10

02 Feb '10

>>Otherwise, as Suresh notes, the only way to eliminate human error completely is >>to eliminate the presence of humans in the activity. and,hence by reference..... >> Automated config deployment / provisioning. That's the funniest thing I've read all day... ;-) A little pessimistic rant.... ;-) Who writes the scripts that you use, who writes the software that you use ? There will always be at least one human somewhere, and where there's a human writing software tools, there's scope for bugs and unexpected issues. Whether inadvertent or not, they will always be there. If the excrement is going to hit the proverbial fan, try as you might to stop it, it will happen. Nothing in the IT / ISP / Telco world is ever going to be perfect, far too complex with many dependencies. Yes you might play in your perfect little labs until the cows come home ..... but there always has been and always will be an element of risk when you start making changes in production. Face it, unless you follow the rigorous change control and development practices that they use for avionics or other high-risk environments, you are always going to be left with some element of risk. How much risk your company is prepared to take is something for the men in black (suits) to decide because it correlates directly with how much $$$ they are prepared to throw your way to help you mitigate the risk .....;-) That's my 2 <insert_currency> over ...... thanks for listening (or not !).... ;-)

3 2

Fwd: [Pauldotcom] Skiddy Interview
by andrew.wallace 02 Feb '10

02 Feb '10

---------- Forwarded message ---------- From: andrew.wallace <andrew.wallace(a)rocketmail.com> Date: Sat, Jan 30, 2010 at 9:31 PM Subject: Re: [Pauldotcom] Skiddy Interview To: Adrian Crenshaw <irongeek(a)irongeek.com> Cc: PaulDotCom Security Weekly Mailing List <pauldotcom(a)mail.pauldotcom.com> On Sat, Jan 30, 2010 at 3:10 PM, Adrian Crenshaw <irongeek(a)irongeek.com> wrote: > Kind of interesting Skiddy Interview: > > http://hackerpublicradio.org/eps/hpr0505.mp3 > > Guy seems pretty uneducated, but it gives you an idea of the mentality. No > offence meant to the HPR podcast, it has some good stuff. > Like your comments. > > Adrian > He mentions selling a Bank of America employee account starting around 7 minutes 40 seconds, which just suffered a Denial of Service attack to its website. http://isc.sans.org/diary.html?storyid=8119 Any connection? Of course probably not, but just thought i'd throw it out there anyway. Andrew

2 1