March 2010 - Test - lists.nanog.org

anti-ddos test solutions ?
by jul 18 Mar '10

18 Mar '10

Hello nanogers, Following the multiple thread on ddos attack, I was asking myself how someone could test chosen solutions. In most cases, you can't load your Internet access in the same way attackers will (does someone have a botners with ten thousands computers or more :) ?) But a solution to test basic attack (synflood, slowloris, socktress, ...) with 10 to hundred computers would be interesting, so not a tool but more a service. Found only Parabon [1] on Google Does someone know something similar ? Thanks Best regards, Jul Note: Please, don't forget this kind of public tests have some serious legal impact and you need to have an agreement with your ISP/operators to do it in most countries. Note2: Google has a lot of answers. Most of them are about tool and methodology, so not sure for a live test. I'm not looking for a lab solution but real one with business acceptation (and a wise choice on the hours of the test so front-end can be switch to "maintenance mode") [1] New grid service simulates DDoS attacks, May 2009 http://www.computerworlduk.com/technology/security-products/business-contin…

10 11

Re: Latency quesstion
by Gregory Hicks 18 Mar '10

18 Mar '10

> X-VR-Score: -70.00 > Date: Thu, 18 Mar 2010 11:48:31 -0500 > From: Larry Sheldon <LarrySheldon(a)cox.net> > To: nanog(a)nanog.org > Subject: Re: Latency quesstion > > On 3/18/2010 10:07, Larry Sheldon wrote: > > On 3/18/2010 09:56, Dennis Dayman wrote: > >> have a friend who has 21 floors of a building in DFW, multiple [...] > > It would be interesting to know where this message has been for an hour > and a half. It looks like it was stuck on machine eastrmpop110.cox.net for a while: Received: from eastrmpop110.cox.net ([68.230.240.52]) by s0.nanog.org with esmtp (Exim 4.68 (FreeBSD)) (envelope-from <larrysheldon(a)cox.net>) id 1NsIq7-00072X-DV for nanog(a)nanog.org; Thu, 18 Mar 2010 16:44:56 +0000 Received: from eastrmimpo01.cox.net ([68.1.16.119]) by eastrmmtao107.cox.net (InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP id <20100318150713.FCRZ18765.eastrmmtao107.cox.net(a)eastrmimpo01.cox.net> for <nanog(a)nanog.org>; Thu, 18 Mar 2010 11:07:13 -0400 It didn't waste any time getting from you to eastrmimpop01.cox.net but took about 45 minutes to get off of eastrmpop110.cox.net. That backlog has most probably been cleared up by now. Regards, Gregory Hicks --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer | Direct: 408.569.7928 People sleep peaceably in their beds at night only because rough men stand ready to do violence on their behalf -- George Orwell The price of freedom is eternal vigilance. -- Thomas Jefferson "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

cisco as pptp client
by Ingo Flaschberger 18 Mar '10

18 Mar '10

Hi, I'm searching a working (if possible) configuration for a cisco 1841 as pptp-client. 1841 should do an pptp dialin to another cisco via ethernet-port. Kind regards, Ingo Flaschberger

1 0

Latency quesstion
by Dennis Dayman 18 Mar '10

18 Mar '10

have a friend who has 21 floors of a building in DFW, multiple switches, etc and they started to have latency issues this weekend where half if not all packet are being dropped to folder shares, printers, etc. Suggestions on how they can troubleshoot that? call in a company to help identify it? -Dennis

11 19

Re: Latency quesstion
by Brielle Bruns 18 Mar '10

18 Mar '10

Dennis, In large installations, I've always found it helpful when diagnosing LAN issues to isolate floors and departments first - using routers or with devices that can do transparent bridging. That way, you can walk through each dept/floor testing for the issues, and hopefully find only one location its still affecting. Its entirely likely that there's either a loop of some sort or a switch has gone off the deep end. If you'd like, let him know if he wants to drop me a mail, I can walk through details about the situation and hopefully help him narrow it down. ------Original Message------ From: Dennis Dayman To: nanog(a)nanog.org Subject: Latency quesstion Sent: Mar 18, 2010 7:56 AM have a friend who has 21 floors of a building in DFW, multiple switches, etc and they started to have latency issues this weekend where half if not all packet are being dropped to folder shares, printers, etc. Suggestions on how they can troubleshoot that? call in a company to help identify it? -Dennis -- Brielle Bruns http://www.sosdg.org / http://www.ahbl.org

3 2

RE: Best VPN Appliance
by Joel M Snyder 18 Mar '10

18 Mar '10

> > Thank-you all for reply and sugessting the VPN Box.?? > I'm in the process of evaluating different boxes and they are;?? > > SA4500 SSL VPN Appliance? > http://www.juniper.net/us/en/products-services/security/sa-series/sa4500/?? > > Barracuda SSL VPN? > http://www.barracudanetworks.com/ns/products/sslvpn_overview.php > > F5 ??FirePass SSL VPN > ?http://www.f5.com/products/firepass/ > > The problem i'm facing so far is MAC OS X compatibility. The demo box i had for Juniper was not able to run Network Connect on MAC OS 10.5.8. The Juniper SSL VPN works great with Mac 10.6 (and prior versions going back about 5 years). I'm not sure what issue you might be seeing, but Network Connect is very solid in that environment. Secure Meeting also works fine on the Mac. The place where you will have compatibility issues is the end-point security checking, but this is common to all OS X. If you're not doing EPS checking, you don't care. If you are, you already know that Macs have a different set of software & vocabulary than Windows platforms. >>From your experience from F5, Juniper and Barracuda, which one will be best in terms of; > > 1) Support > 2) Resiliency > 3) Security > 4) Scalability > 5) Manageability The Barracuda box is very new and I haven't looked at it, but certainly the Juniper and F5 boxes are top contenders; you should also be looking at SonicWALL (which used to be Aventail). Your laundry list above is fairly vague, since you don't list YOUR requirements. However, I did a very extensive test of SSL VPN devices a few years ago which is still VERY applicable to the products that were in it. This is considered a fairly mature market, and the F5 box of today is not very different from the one of three years ago. You might consider figuring out what you want to do with the box, and then measuring the contenders against that, rather than asking "which is the most scalable," since in the NANOG context that could mean anything from "two-node active/active cluster" to "geographic clustering in 40 data centers." (Nick will at this point chime in with his now-famous "string analogy") Try reading this: http://www.networkworld.com/reviews/2005/121905-ssl-test-intro.html?rl It's dated 2005, so you can assume that annoying bugs are fixed, but product feature sets are very similar. There's also some more recent SSL VPN testing I've done in Network World, such as the Netgear box (not designed for the enterprise) and just last week the Microsoft one. Note that Network World writes for enterprises, and NANOG is a service provider mailing list, so depending on why you're asking for this, my results may or may not be applicable. For example, features like delegated and partitioned management, which are SP-critical but often ignored in the enterprise, weren't really part of my evaluation. jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

1 0

Hotmail/MSN email admin
by Daniel Staal 18 Mar '10

18 Mar '10

If there are any Hotmail/MSN email admins on this list, could you please contact me offlist at Daniel.T.Staal(a)uscg.dhs.gov Thanks. Daniel T. Staal --------------------------------------------------------------- This email copyright the author. Unless otherwise noted, you are expressly allowed to retransmit, quote, or otherwise use the contents for non-commercial purposes. This copyright will expire 5 years after the author's death, or in 30 years, whichever is longer, unless such a period is in excess of local copyright law. ---------------------------------------------------------------

1 0

Re: Best VPN Appliance
by Stefan Fouant 18 Mar '10

18 Mar '10

Toivo, The SA Series absolutely supports IPsec if you are using Network Connect. It defaults to using IPsec and if that is not supported then it will fall back to SSL. Of course, NC is not as secure as W-SAM, J-SAM, or Core Access in terms of role and resource granularity control but the support for IPsec is absolutely there. HTHs. Stefan Fouant ------Original Message------ From: Voll, Toivo To: Chris Campbell To: Dawood Iqbal Cc: nanog(a)nanog.org Subject: RE: Best VPN Appliance Sent: Mar 8, 2010 11:56 AM We're generally happy with our Juniper SA6500s, but they, and a lot of the other SSL VPN vendor appliances will not support IPSec. Cisco's ASA does, but it's less feature-rich in the SSL VPN arena. The Juniper was the most mature and flexible of all the offerings we looked at, but also the most expensive, and it's not perfect either. Having migrated from Cisco's 3000 series appliances, the current SSL VPNs are a totally different mindset and about two orders of magnitude more complicated. Have a very good understanding of exactly what problem you're trying to solve with the product and what kind of policies and requirements you have to meet, or it's going to be a mess. I can answer more specific questions on our experiences and testing off-list. -- Toivo Voll University of South Florida Information Technology Communications -----Original Message----- From: Chris Campbell [mailto:Chris.Campbell@nebulassolutions.com] Sent: Friday, March 05, 2010 11:36 AM To: Dawood Iqbal Cc: nanog(a)nanog.org Subject: Re: Best VPN Appliance The Juniper SA is by far and away the market leader and in my opinion the best end user experience. On 5 Mar 2010, at 15:57, Dawood Iqbal wrote: > Hello All, > > > > Is it possible to get your ideas on what VPN appliances are good to have in > enterprise network? > > > > Requirements are; > > SSL > > IPSec > > Client and Web VPN support (Win/MAC/iPhone/Android) > > If webvpn is used, then when any user connects via webvpn, we should be able > to re-direct him to any and ONLY specific application i.e SAP. > > If 2 boxes are installed then they should replicate data seamlessly. > > > > > > Regards, > > dI > Sent from my Verizon Wireless BlackBerry

16 16

Announcing: Ruby API for xtractr
by kowsik 18 Mar '10

18 Mar '10

What started off as a way to unit test the RESTful API for xtractr has now turned into a Ruby gem that we are releasing as open source. First xtractr, then nuggets and now a gem. We are happy to announce a Ruby gem for xtractr which takes all the goodness of Ruby and interacts RESTfully with xtractr for oh-so-fun network forensics and troubleshooting all from within IRB, the interactive Ruby shell. Blog: http://bit.ly/baW3zZ Code: http://code.google.com/p/pcapr/ Thanks, K. --- http://www.pcapr.net/ http://www.mudynamics.com http://labs.mudynamics.com http://twitter.com/pcapr

1 0

RE: CSIRT - Backbone Security : Runtime Monitoring and DynamicReconfiguration for Intrusion Detection Systems
by Guillaume FORTAINE 18 Mar '10

18 Mar '10

Do you have any concern against fat dudes ? Best Regards, Guillaume FORTAINE ---------------------------------------- > From: Charles.Church(a)harris.com > To: charles(a)knownelement.com; gfortaine(a)live.com; nanog(a)nanog.org > Date: Wed, 17 Mar 2010 20:42:49 -0400 > Subject: Re: CSIRT - Backbone Security : Runtime Monitoring and DynamicReconfiguration for Intrusion Detection Systems > > isn't Obeseus the greek god of fat dudes? > > ----- Original Message ----- > From: charles(a)knownelement.com > To: Guillaume FORTAINE ; nanog(a)nanog.org > Sent: Wed Mar 17 20:18:40 2010 > Subject: Re: CSIRT - Backbone Security : Runtime Monitoring and DynamicReconfiguration for Intrusion Detection Systems > > Mods, > > Can we get the spam off the list? Its getting old. > > > ------Original Message------ > From: Guillaume FORTAINE > To: nanog(a)nanog.org > Subject: CSIRT - Backbone Security : Runtime Monitoring and DynamicReconfiguration for Intrusion Detection Systems > Sent: Mar 17, 2010 5:14 PM > > Misses, Misters, > > Let me introduce myself : Guillaume FORTAINE, Engineer in Computer > Science. Me and my partners, INVEA-TECH (please see the attached file > invea.pdf) [0] and Cognitive Security (please see the attached file > cs.pdf) [1], are currently working on High-Speed Network Security > Solutions. > > By the way, we would greatly appreciate to invite you to a further > reading of the publication entitled "Obeseus – a lightweight DDOS > detector for big attacks" (please see the attached file obeseus2.pdf) > > The point mentioned: "Would be self-learning with black lists" in this > publication is of particular interest . We think that this last one is > pretty much the core of a system that does big attack detection on > backbones and is driving the new tools in this area according to our > readings. The abilities to be assisted on the learning phase, to > detect and block zero-day attacks. > > That's why we would greatly appreciate to invite you to a further > reading about our methodology (please see the attached files > paper4.pdf, Camnep.pdf and CognitiveSecurity.pdf). > > For a demo : > > http://demo.cognitivesecurity.cz/ > > We look forward to your answer, > > Best Regards, > > Guillaume FORTAINE > Tel : +33(0)631092519 > Mail : gfortaine(a)gfortaine.biz > Google Wave : gfortaine(a)googlewave.com > > [0] http://www.invea-tech.com/ > [1] http://www.cognitivesecurity.cz/ > >> >> >> > > > > > Sent via BlackBerry from T-Mobile _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 1