February 2015 - Test - lists.nanog.org

Intrusion Detection recommendations
by Andy Ringsmuth 19 Feb '15

19 Feb '15

NANOG'ers, I've been tasked by our company president to learn about, investigate and recommend an intrusion detection system for our company. We're a smaller outfit, less than 100 employees, entirely Apple-based. Macs, iPhones, some Mac Mini servers, etc., and a fiber connection to the world. We are protected by a FreeBSD firewall setup, and we stay current on updates/patches from Apple and FreeBSD, but that's as far as my expertise goes. Initially, what do people recommend for: 1. Crash course in intrusion detection as a whole 2. Suggestions or recommendations for intrusion detection hardware or software 3. Other things I'm likely overlooking Thank you all in advance for your wisdom. ---- Andy Ringsmuth andy(a)newslink.com News Link – Manager Technology & Facilities 2201 Winthrop Rd., Lincoln, NE 68502-4158 (402) 475-6397 (402) 304-0083 cellular

17 27

Re: Intrusion Detection recommendations
by Randy Bush 19 Feb '15

19 Feb '15

> I've been tasked by our company president to learn about, investigate and > recommend an intrusion detection system for our company. > > We're a smaller outfit, less than 100 employees, entirely Apple-based. > Macs, iPhones, some Mac Mini servers, etc., and a fiber connection to the > world. We are protected by a FreeBSD firewall setup, and we stay current > on updates/patches from Apple and FreeBSD, but that's as far as my > expertise goes. > > Initially, what do people recommend for: > > 1. Crash course in intrusion detection as a whole > 2. Suggestions or recommendations for intrusion detection hardware or > software > 3. Other things I'm likely overlooking if you were comfortable enough with freebsd to use it as a firewall, you can run your traffic through, or mirror it to, a freebsd box running https://www.bro.org/ or https://www.snort.org/ two quite reasonable and powerful open source systems randy

6 6

Access switch for small business recommendation
by Manuel Marín 19 Feb '15

19 Feb '15

Dear nanog community I'm looking for a cost effective access switch for FTTB active fiber deployments. We are currently using Accedian demarcation devices but it's probably an overkill for customers that only require a basic internet service. The basic requirements we are looking for are: * Vlan support in order to deploy multiple services * 1 or 2 SFP ports * 4 10/100/1000 * Dying gasp (in order to identify if the equipment is down because power issue) * Rate limit per port * SNMP support to check SFP DDM values * Rack mountable I would appreciate if you can share what you use for these type of requirements. Thank you and have a great day Regards

1 0

OT - Small DNS "appliances" for remote offices.
by Ray Van Dolson 18 Feb '15

18 Feb '15

Hopefully not too far off topic for this list. Am looking for options to deploy DNS caching resolvers at remote locations where there may only be minimal infrastructure (FW and Cisco equipment) and limited options for installing a noisier, more power hugnry servers or appliances from a vendor. Stuff like Infoblox is too expensive. We're BIND-based and leaning to stick that way, but open to other options if they present themselves. Am considering the Soekris net6501-50. I can dump a Linux image on there with our DNS config, indudstrial grade design, and OK performance. If the thing fails, clients will hopefully not notice due to anycast which will just hit another DNS server somewhere else on the network albeit with additional latency. We ship out a replacement device rather than mucking with trying to repair. There's also stuff like this[1] which probably gives me more horsepower on my CPU, but maybe not as reliable. Maybe I'm overengineering this. What do others do at smaller remote sites? Also considering putting resolvers only at "hub" locations in our MPLS network based on some latency-based radius. Ray [1] http://www.newegg.com/Mini-Booksize-Barebone-PCs/SubCategory/ID-309

23 24

[NANOG-announce] Don't Forget: ARIN+NANOG On The Road - Orlando
by Valerie Wittkop 18 Feb '15

18 Feb '15

The next On The Road event is just a few short days away… We invite you to join us at: ARIN+NANOG On The Road - Orlando Tuesday, 24 February 2015 9:00 AM – 5:00 PM; Reception: 5:00 PM – 6:30 PM Eastern Time Register at: https://www.nanog.org/meetings/road5/registration <https://www.nanog.org/meetings/road5/registration> ARIN + NANOG On The Road is hosted by the American Registry for Internet Numbers (ARIN <https://www.arin.net/>) and the North American Network Operators’ Group (NANOG <https://www.nanog.org/>). If you are, or will be, in the Orlando area, we invite you to attend this meeting <https://www.nanog.org/meetings/road5/home>. The agenda <https://nanog.org/meetings/road5/agenda> features an “Open Internet Debate” keynote address; sessions will include an ARIN Overview along with policies under discussion, DNSSEC & RPKI, presentations on IPv6, Traceroute, updates on local IX activities, and an introduction to BGP. This free event, held <https://nanog.org/meetings/road5/hotel> at the Holiday Inn Resort Orlando-Lake Buena Vista, will also feature interactive discussions and networking opportunities. Lunch will be provided and there will be two drawings for $100 Amazon gift cards. Please register <https://nanog.org/meetings/road5/registration> today! Make ARIN+NANOG On The Road your first step toward learning how you can take the wheel and steer the future of the Internet. Please share this invitation with anyone you feel may benefit from attending this meeting. Learn more about On The Road events here <https://www.nanog.org/meetings/road/home>. Feel free to contact us at nanog-support(a)nanog.org <mailto:nanog-support@nanog.org> if you have any questions. Regards, Valerie Valerie Wittkop NANOG Program Director 48377 Fremont Boulevard, Suite 117 Fremont, CA 94538 Tel: +1 510 492 4030 _______________________________________________ NANOG-announce mailing list NANOG-announce(a)mailman.nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Usage Graphing per Subnet
by Methsri Wickramarathna 18 Feb '15

18 Feb '15

Hi All, I have a requirement to plot a usage graph per subnet. As an example. I have a 192.168.1.0/24 subnet divided among 32 customers where each one will get a /29 [ 192.168.1.0/29 => Customer A ; 192.168.1.8/29 => Customer B etc... ] ... Is there any tool to graph the usage of entire /24 subnet ??? -- -- ~~( ŊëŌ )~~

7 10

Job: Head of Network Operations - NEXTDC - Sydney Australia - 457 Available
by Skeeve Stevens 17 Feb '15

17 Feb '15

Hi all, On Seek.com.au - http://www.seek.com.au/job/28150202?pos=1&type=standout I know a bit about this role, so feel free to chat to me offline if you are wondering if you are suitable.... or just apply directly :) I'm helping them find the right person... hardest thing is knowing who is out there and looking for a role like this. I will be in Japan at the Apricot/APNIC conference in a couple of weeks if you're there and you are interested in the role and would like to catch-up and chat about it. ...Skeeve *Skeeve Stevens - Founder & Chief Network Architect* eintellego Networks Pty Ltd Email: skeeve(a)eintellegonetworks.com ; Web: eintellegonetworks.com Phone: 1300 239 038 ; Cell +61 (0)414 753 383 ; Skype: skeeve Facebook: eintellegonetworks <http://facebook.com/eintellegonetworks> ; Twitter: eintellego <https://twitter.com/eintellego> LinkedIn: /in/skeeve <http://linkedin.com/in/skeeve> ; Expert360: Profile <https://expert360.com/profile/d54a9> The Experts Who The Experts Call Juniper - Cisco - Cumulus Linux - Cloud - Consulting - IPv4 Brokering

2 2

Re: Usage Graphing per Subnet
by Larry Sheldon 17 Feb '15

17 Feb '15

On 2/17/2015 05:35, Methsri Wickramarathna wrote: > I have a requirement to plot a usage graph per subnet. As an example. > > I have a 192.168.1.0/24 subnet divided among 32 customers where each one > will get a /29 [ 192.168.1.0/29 => Customer A ; 192.168.1.8/29 => Customer > B etc... ] ... > > Is there any tool to graph the usage of entire /24 subnet ??? If MRTG can't do it, it can't be did. http://en.wikipedia.org/wiki/Multi_Router_Traffic_Grapher http://oss.oetiker.ch/mrtg/ -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

1 0

Comcast Business IPv6 issues
by David Sotnick 17 Feb '15

17 Feb '15

Hi NANOG, I am a Comcast business Internet subscriber and have been struggling with having my assigned IPv6 /64 block changing every time Comcast pushes out a firmware update to my (Motorola BitSurfer) CM. It seems rather silly that my IPv4 address has not changed in the six months I've been a Comcast business customer, yet my IPv6 address changes every few weeks, always after a reset command is sent from the head-end to my CM (or after power outage). My *home* Comcast IPv6 address has not changed in over a year, and the same applies for my IPv4 address, so something is different about the way Comcast is treating their IPv6 business customers. This is getting quite frustrating as I run my security cameras over IPv6 and when the addresses change out from under me, things obviously break. Any insights here from the wise hivemind of Nanog or from Comcast network folks? Any chance static IPv6 will be available to business customers? While I am on the subject — ip6.arpa reverse DNS delegation would also be a nice thing to have if and when static IPv6 addressing is made available. :) Thanks! David Sotnick -- DDV Studios

2 1

Low BW between Mountain View and OR -- why?
by Glen Kent 17 Feb '15

17 Feb '15

Hi, I have a server in Mountain View and i am doing a speedtest with a server in Oregon. I see that the upload/download BW that i am getting is low -- around 10.0Mbps and 5.0Mbps. gkent@ubuntu:~/ics$ speedtest-cli --server 4082 Retrieving speedtest.net configuration... Retrieving speedtest.net server list... Testing from Comcast Cable (50.250.251.210)... Hosted by Eastern Oregon Net, Inc. (La Grande, OR) [913.33 km]: 120.959 ms Testing download speed........................................ Download: 5.08 Mbits/s Testing upload speed.................................................. Upload: 10.89 Mbits/s When i check my connectivity with a server in NYC, its much better, though the server is much further away. gkent@ubuntu:~/ics$ speedtest-cli --server 2947 Retrieving speedtest.net configuration... Retrieving speedtest.net server list... Testing from Comcast Cable (50.250.251.210)... Hosted by Atlantic Metro (New York City, NY) [4129.02 km]: 307.568 ms Testing download speed........................................ Download: 38.52 Mbits/s Testing upload speed.................................................. Upload: 10.62 Mbits/s I am trying to understand why this is so? I would wager that NYC being further away would give me a worse throughput than OR, but the speedtest tells me otherwise. The 2nd and more puzzling observation is that while OR is giving a download of around 5.08Mbps, it will improve and become much better later in the day. There are times when i see it going up as high as 48Mbps. Sometimes while a transfer is in progress i see that my download suddenly goes down from 48Mbps to 2Mbps. Can somebody here tell me why such a drastic fluctuation is seen? Thanks, Glen

4 3