September 2010 - Test - lists.nanog.org

RE: NOC Automation / Best Practices
by Martin Hotze 08 Sep '10

08 Sep '10

> -----Original Message----- > Date: Wed, 08 Sep 2010 08:54:20 -0700 > From: Charles N Wyble <charles(a)knownelement.com> > Subject: NOC Automation / Best Practices > To: nanog(a)nanog.org > > NOGGERS, > > (...) > The way I see it, an ounce of prevention is worth a pound of cure. > Along > those lines, I'm putting in some mitigation techniques are as follows > (hopefully this will reduce the number of incidents and therefore calls > to the abuse desk). I would appreciate any feedback folks can give me. > > A) Force any outbound mail through my SMTP server with AV/spam > filtering. > B) Force HTTP traffic through a SQUID proxy with SNORT/ClamAV running > (several other WISPs are doing this with fairly substantial bandwidth > savings. However I realize that many sites aren't cache friendly. > Anyone > know of a good way to check for that? Look at HTTP headers?). Do the > bandwidth savings/security checking outweigh the increased support > calls > due to "broken" web sites? > C) Force DNS to go through my server. I hope to reduce DNS hijacking > attacks this way. > > Thanks! For either A, B or C you won't get my business, let alone a combination of all 3. *wah!* There is too much FORCE here. :-) #m

5 4

yahoo crawlers hammering us
by Ken Chase 08 Sep '10

08 Sep '10

So i guess im new at internets as my colleagues told me because I havent gone around to 30-40 systems I control (minus customer self-managed gear) and installed a restrictive robots.txt everywhere to make the web less useful to everyone. Does that really mean that a big outfit like yahoo should be expected to download stuff at high speed off my customers servers? For varying values of 'high speed', ~500K/s (4Mbps+) for a 3 gig file is kinda... a bit harsh. Especially for an exe a user left exposed in a webdir, thats possibly (C) software and shouldnt have been there (now removed by customer, some kinda OS boot cd/toolset thingy). This makes it look like Yahoo is actually trafficking in pirated software, but that's kinda too funny to expect to be true, unless some yahoo tech decided to use that IP/server @yahoo for his nefarious activity, but there are better sites than my customer's box to get his 'juarez'. At any rate: >From Address To Address Proto Bytes CPS ============================================================================================================================================================================================== 67.196.xx.xx..80 67.195.112.151..44507 tcp 14872000 523000 $ host 67.195.112.151 8.8.8.8 151.112.195.67.in-addr.arpa domain name pointer b3091122.crawl.yahoo.net. CIDR: 67.195.0.0/16 NetName: A-YAHOO-US8 so that's yahoo, or really well spoofed. Is this expected/my own fault or what? A number of years ago, there were 1000s of videos on a customer site (training for elderly care, extremely exciting stuff for someone into -1-day movies to post on torrent sites). Customer called me to say his bw was gone, and I checked and found 12 yahoo crawlers hitting the site at 300K/s each (~30Mbps +) downloading all the videos. This was all the more injurious as it was only 2004 and bandwidth was more than $1/mbps back then. I did the really crass thing and nullrouted the whole /20 or whatever they were on per ARIN. It was the new-at-the-time video.yahoo.com search engine coming to index the whole site. I suppose they cant be too slow about it, or they'll never index a whole webfull of videos this century, but still, 12x 300K/s in 2004? (At the time Rasmus though it was kinda funny. I do too, now.) /kc -- Ken Chase - ken(a)heavycomputing.ca - +1 416 897 6284 - Toronto CANADA Heavy Computing - Clued bandwidth, colocation and managed linux VPS @151 Front St. W.

7 9

NOC Automation / Best Practices
by Charles N Wyble 08 Sep '10

08 Sep '10

NOGGERS, The recent thread on ISP port blocking practice mentioned a way to identify infected machines through a highly automated manner. This got me thinking about other ways to automate aspects of network/system operations when it comes to tier-1 end user support (is it plugged in/is your wireless working etc) and tier-2/3 NOC support (abuse desk/incident response/routing issues etc) . I'm putting in a very high degree of monitoring/healing in place to reduce the amount of end user support calls that come in, and only bother a human when it's a real issue. I'm in the process of launching a small regional wireless ISP / ad delivery network in Los Angeles CA. I have a small staff (I'm the only full time engineer, I have a couple NOC techs and 1 help desk tech who will provide escalation for any serious issues). My initial thoughts/questions on the matter: 1) Are people integrating their PBX with their OSS/CRM systems? So when a call comes in the tech has all the relevant information? (perhaps even things like traceroute/port scan/AV/security health status based on their phone number or customer number?). This way if I take a user offline because they are spewing spam/virii the tech can refer them to our IT support partner organization to clean up their PC. :) 2) What sort of automated alerting/reporting/circuit turn down/RADIUS lock out is done in regards to alerting customers or even taking them offline when they have a security issue? 3) What are folks doing in terms of frontline offloading? Do you have your PBX set to play a different recording when you have an outage so the NOC techs phones don't go crazy and leave them free to deal with the issue? 4) Your comments here. :) The way I see it, an ounce of prevention is worth a pound of cure. Along those lines, I'm putting in some mitigation techniques are as follows (hopefully this will reduce the number of incidents and therefore calls to the abuse desk). I would appreciate any feedback folks can give me. A) Force any outbound mail through my SMTP server with AV/spam filtering. B) Force HTTP traffic through a SQUID proxy with SNORT/ClamAV running (several other WISPs are doing this with fairly substantial bandwidth savings. However I realize that many sites aren't cache friendly. Anyone know of a good way to check for that? Look at HTTP headers?). Do the bandwidth savings/security checking outweigh the increased support calls due to "broken" web sites? C) Force DNS to go through my server. I hope to reduce DNS hijacking attacks this way. Thanks!

2 1

RE: NANOG Digest, Vol 32, Issue 25
by Martin Hotze 08 Sep '10

08 Sep '10

> -----Original Message----- > Message: 3 > Date: Wed, 8 Sep 2010 10:24:38 +0000 > From: Nathan Eisenberg <nathan(a)atlasnetworks.us> > Subject: RE: yahoo crawlers hammering us > To: "nanog(a)nanog.org" <nanog(a)nanog.org> > Message-ID: > <8C26A4FDAE599041A13EB499117D3C28164AC3A7@ex-mb- > 1.corp.atlasnetworks.us> > > Customers don't want to deliver their content to search engines? That > seems silly. I have a private website; I don't want the site to be listed or content found via a search engine. I want to be able to give the URL out to friends etc. but I don't want all of the world hotlink or whatever - sure, I can password protect the site, but for now I have a ton of rewrite conditions in place. #m

1 0

CFP: COMSNETS 2011 (Deadline in five days!)
by Ramana Kompella 08 Sep '10

08 Sep '10

*** APOLOGIES IF YOUR RECEIVED MULTIPLE COPIES OF THE CFP *** COMSNETS 2011 The THIRD International Conference on COMunication Systems and NETworks January 4-8, 2011, Bangalore, India http://www.comsnets.org (In Co-operation with ACM SIGMOBILE) (Technically Co-Sponsored by IEEE COMSOC) The Third International Conference on COMmunication Systems and NETworkS (COMSNETS) will be held in Bangalore, India, from 4 January 2011 to 8 January 2011. COMSNETS is a premier international conference dedicated to addressing advances in Networking and Communications Systems, and Telecommunications services. The goal of the conference is to create a world-class gathering of researchers from academia and industry, practitioners, business leaders, intellectual property experts, and venture capitalists, providing a forum for discussing cutting edge research, and directions for new innovative business and technology. The conference will include a highly selective technical program consisting of parallel tracks of submitted papers, a small set of invited papers on important and timely topics from well-known leaders in the field, and poster sessions of work in progress. Focused workshops and panel discussions will be held on emerging topics to allow for a lively exchange of ideas. International business and government leaders will be invited to share their perspectives, thus complementing the technical program. Papers describing original research work and practical experiences/experimental results are solicited on topics including, but not limited to: Topics of Interest ------------------ Internet Architecture and Protocols Network-based Applications Video Distribution (IPTV, Mobile Video, Video on Demand) Network Operations and Management Broadband and Cellular Networks (3G/4G, WiMAX/LTE) Mesh, Sensor and PAN Networks Communication Software (Cognitive Radios, DSA, SDR) Wireless Operating Systems and Mobile Platforms Peer-to-peer Networking Cognitive Radio and White Space Networking Optical Networks Network Security & Cyber Security Technologies Cloud and Utility computing Storage Area Networks Next Generation Web Architectures Vehicular Networking Energy-Efficient Networking Network Science and Emergent Behavior in Socio-Technical Networks Social Networking Analysis, Middleware and Applications Networking Technologies for Smart Energy Grids Disruption/Delay Tolerant Networking Conference Highlights --------------------- Conference Inaugural Speaker: Prof. Pravin Varaiya, U. C. Berkeley, USA Banquet speaker: Dr. Rajeev Rastogi, Yahoo Research, India Keynote Speakers: Prof. Don Towsley, U. Mass Amherst, USA Dr. Pravin Bhagwat, AirTight Networks, India Dr. Jean Bolot, Sprint, USA Workshops WISARD (4, 5 Jan) NetHealth (4 Jan) IAMCOM (5 Jan) Mobile India 2011 (7 Jan) Technical Paper and Poster Sessions Ph.D Forum Panel Discussions Demos & Exhibits Important Deadlines ------------------- Paper submission: September 13, 2010 at 11:59 pm EDT (Sept 14, 9:29 am IST) Notification of Acceptance: November 8, 2010 Camera-Ready Submission: December 8, 2010 Detailed conference information and paper submission guidelines will soon be available on the conference web site. Please see http://www.comsnets.org for detailed information from time to time. The conference email address is: comsnets2011(a)gmail.com General Co-Chairs ----------------- David B. Johnson, Rice University, USA Anurag Kumar, IISc Bangalore, India Technical Program Co-Chairs --------------------------- Jon Crowcroft, U. of Cambridge, UK D. Manjunath, IIT Bombay, India Archan Misra, Telcordia Tech., USA Steering Committee Co-Chairs ---------------------------- Uday Desai, IIT Hyderabad, India Giridhar Mandyam, Qualcomm, USA Sanjoy Paul, Infosys, India Rajeev Shorey, NIIT University, India G. Venkatesh, SASKEN, India Panel Co-Chairs --------------- Aditya Akella, U. of Wisconsin, USA Venkat Padmanabhan, MSR, India Ph.D Forum Chair ---------------- Bhaskaran Raman, IIT Bombay, India Publications Chair ------------------ Varsha Apte, IIT Bombay, India Demos and Exhibits Co-Chairs ---------------------------- Aaditeshwar Seth, IIT Delhi, India Ajay Bakre, Netapps, India Sponsorship Chair ----------------- Sudipta Maitra, Delhi, india Workshop Chairs --------------- Sharad Jaiswal, Alcatel-Lucent, India Ravindran Kaliappa, CUNY, USA Neelesh Mehta, IISc Bangalore, India Mobile India 2011 Co-Chairs --------------------------- Gulzar Azad, Google, India Gene Landy, Ruperto-Israel & Weiner, USA Rajaraghavan Setlur, SASKEN, India Sridhar Varadharajan, SASKEN, India Publicity Co-Chair ------------------ Augustin Chaintreau, TTL, France Kameswari Chebrolu, IIT Bombay, India Song Chong, KAIST, Korea Ramana Kompella, Purdue Univ, USA Nishanth Sastry, U. of Cambridge, UK Web Co-Chairs ------------- Santhana Krishnan, IIT Bombay, India Vinay Veerappa, SASKEN, India International Advisory Committee -------------------------------- K. K. Ramakrishnan, AT&T, USA Victor Bahl, Microsoft Research, USA Sunghyun Choi, Seoul National U., Korea Sajal Das, U. Texas at Arlington, USA B. N. Jain, IIT Delhi, India Anurag Kumar, IISc, Bangalore, India L. M. Patnaik, IISc, Bangalore, India Krithi Ramamritham, IIT Bombay, India Parmesh Ramanathan, U. Wisconsin, USA Krishan Sabnani, Alcatel-Lucent, USA Kang Shin, U. Michigan, USA Nitin Vaidya, U. Illinois, USA University Partners: -------------------- IIT Bombay, IIT Delhi, IISc Bangalore, IIT Hyderabad, NIIT University, IIIT Bangalore Patrons: -------- Mobile Monday Bangalore, Sasken, IBM Research, Alcatel Lucent

1 0

Fwd: [swinog] IP address are now personal data
by Thomas Mangin 08 Sep '10

08 Sep '10

FYI Begin forwarded message: > From: Pascal Gloor <pascal.gloor(a)spale.com> > Date: 8 September 2010 11:25:18 GMT+01:00 > To: "swinog(a)swinog.ch" <swinog(a)swinog.ch> > Subject: [swinog] IP address are now personal data > > Dear community, > > something important for us happened today that may have some impact on our daily business. > > Our Federal Court just decided that IP addresses are personal data and the federal law about data protection must also be followed also for IP addresses. Collecting IP adresses for private (corporate) investigation is not legal. Companies like Logistep have to stop their activities immédiately! > > As ISP be carefull not to publish traffic information containing IP addresses. > > see you, > Pascal > > _______________________________________________ > swinog mailing list > swinog(a)lists.swinog.ch > http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

3 3

Re: Looking Glass
by James Bensley 08 Sep '10

08 Sep '10

Hmm, Google says you could use http://www.zebra.org/ to set your box up as a route, and then you can just view the routes from there? Or look here; http://www.bgp4.as/tools -- Regards, James. http://www.jamesbensley.co.cc/ There are 10 kinds of people in the world; Those who understand Vigesimal, and J others...?

6 7

Re: ISP port blocking practice
by Robert Bonomi 08 Sep '10

08 Sep '10

> From nanog-bounces+bonomi=mail.r-bonomi.com(a)nanog.org Tue Sep 7 15:15:13 2010 > Date: Mon, 6 Sep 2010 19:55:06 -0500 > From: Brett Frankenberger <rbf+nanog(a)panix.com> > To: deleskie(a)gmail.com > Subject: Re: ISP port blocking practice > Cc: NANOG list <nanog(a)nanog.org> > > On Mon, Sep 06, 2010 at 10:38:15PM +0000, deleskie(a)gmail.com wrote: > > > > Having worked in past @ 3 large ISPs with residential customer pools > > I can tell you we saw a very direct drop in spam issues when we > > blocked port 25. > > No one is disputing that. Or, at least, I'm not disputing that. I'm > questioning whether or not the *Internet* has experienced any decrease > in aggregate spam as a result of ISPs blocking port 25. Did the spam > you blocked disappear, or did it all get sent some other way? _I_ can't say about 'some other way', but, on average, between 1/4 and 1/3 of the all the incoming spam at my personal server is 'direct to MX', that would have been been, at least 'slowed a little bit' by "classical, dumb" port 25 blocking. Now, a *smart* port 25 enforcer -- where traffic outbound to port 25 was selectively NATted into a 'data sink' -- something that replies "200" to everything up to the DATA command, and _always_ gives a 5xy response to that (with text like "you must send outgoing mail though our server'), WOULD kill the traffic dead. Or, at least, force the spamware writers to start paying attention to SMTP response codes, *IF* they wanted to count deliveries. All available evidence says that -most- spammers/spamware/ botnets pay no attention to such -- as established by the effectiveness of GreetPause, and greylisting. It is worth noting that this kind of 'smart' port 25 blocking would also automatically identify 'infected' machines, and by consulting the records of who is corrently on that IP address, tell _which_customer_ is has the infected machine, *AND* notify the customer of their problem. all without any need for any (expensive) human involvement. Aside, if spamware _had_ to 'obey the rules' of SMTP transactions, regarding reading reply codes, that alone would probalbly reduce by 50%, if not more, the aggregate sending _capacity_ of the world's spam sources. Whether that would make much of a difference, I don''t know -- depnds on how far existing 'capacity' exeeeds existing usage/demand.133-136 140 142-145 147

1 0

Looking Glass
by Peter Rudasingwa 07 Sep '10

07 Sep '10

I have a linux (ubuntu) box and I would like to install a BGP looking glass. Are there any out there for free and how can one go about it? Is linux the best OS to use? Thanks, Peter R.

5 4

Inline Traffic Management / Tracking - Usage Based Billing
by Paul Stewart 07 Sep '10

07 Sep '10

Hi there... We are examining several options currently for appliances/devices that sit inline (most likely) and can perform all/some of these services: -Track customer usage and generate monthly reports based on username (PPPOE) or cable MAC (DHCP) - and doesn't require any changes to our Radius infrastructure. In other words, it has the smarts to gather the username/IP combination along with the Radius Start/Stop to do accurate reporting. -Throttling of certain services/applications at certain times of day (looking for fairly extensive options here including ability to take total link capacity into account - reasonably dynamic) -24X7X365 support and hardware coverage (no next business day shipping - 4 hour response onsite kind of stuff) -Clustering/HA options -Centralized management/reporting This is NOT an open invitation for sales people to contact me - I'm asking here for operational feedback with likes/dislikes. I can appreciate if most folks prefer to reply offline. We have trialled the Arbor solution to date but that is the only comparison we have so far. Thanks, Paul Stewart

1 0