- Test - lists.nanog.org

Botnet Traffic
by James Smith 23 Feb '12

23 Feb '12

Hello, Can anyone on this list provide botnet network traffic for analysis, or Ip’s which have been infected. -- Sincerely; James Smith CEO, CEH, Security Analyst Email: james(a)smithwaysecurity.com Phone: 1877-760-1953 Website: www.SmithwaySecurity.com CONFIDENTIALITY NOTICE: This communication with its contents may contain confidential and/or legally privileged information. It is solely for the use of the intended recipient(s). Unauthorized interception, review, use or disclosure is prohibited and may violate applicable laws including the Electronic Communications Privacy Act. If you are not the intended recipient, please contact the sender and destroy all copies of the communication. - This communication is confidential to the parties it was intended to serve -

3 3

common time-management mistake: rack & stack
by Jeff Wheeler 23 Feb '12

23 Feb '12

Randy's P-Touch thread brings up an issue I think is worth some discussion. I have noticed that a lot of very well-paid, sometimes well-qualified, networking folks spend some of their time on "rack & stack" tasks, which I feel is a very unwise use of time and talent. Imagine if the CFO of a bank spent a big chunk of his time filling up ATMs. Flying a sharp router jockey around to far-flung POPs to install gear is just as foolish. Not only does the router jockey cost a lot more to employ than a CCNA, but if your senior-level talent is wasting time in airports and IBXes, that is time they can't be doing things CCNAs can't. I was once advising a client on a transit purchasing decision, and a fairly-large, now-defunct tier-2 ISP was being considered. We needed a few questions about their IPv6 plans answered before we were comfortable. The CTO of that org was the only guy who was able to answer these questions. After waiting four days for him to return our message, he reached out to us from an airplane phone, telling us that he had been busy racking new routers in several east-coast cities (his office was not east-coast) and that's why he hadn't got back to us yet. As you might imagine, the client quickly realized that they didn't want to deal with a vendor whose CTO spent his time doing rack & stack instead of engineering his network or engaging with customers. If he had simply said he was on vacation, we would never have known how poorly the senior people at that ISP managed their time. With apologies to Randy, let the CCNAs fight with label makers. -- Jeff S Wheeler <jsw(a)inconcepts.biz> Sr Network Operator / Innovative Network Concepts

20 24

Customer Notification System.
by James Wininger 23 Feb '12

23 Feb '12

We are a smaller ISP in Indiana. We are growing quite rapidly (yeah for us). We have a need for a customer notification system. We have simply out grown the ability to send emails to our customers manually. We need to have a better way of notifying our customers of maintenance etc. We would need to send notifications out to say about 400 customers. Ideally the system would send an attached PDF. It would be great if this system were SQL based etc. Does anyone know of a system that is out there that does this? We have looked at a few applications (windows based) but integration with billing etc seems to be a caveat. I have thought of possibly using a mailing list type approach, but that gets us back to (almost) where we are today. Any pointers would be greatly appreciated. -- Jim Wininger jwininger(a)ifncom.net

15 18

automatic bgp route refresh
by Joe Maimon 23 Feb '12

23 Feb '12

Hey All, I would greatly appreciate it if somebody would point me to cisco release notes for the change I see in 15.1 where BGP neighbor route-map configurations happen in real time, without needing any clearing, soft or otherwise. Seems like some have also noticed this behavior recently on some other trains. Much obliged. Best, Joe

1 0

Question regarding anycasting in CDN setup
by Anurag Bhatia 23 Feb '12

23 Feb '12

Hello everyone! I have a small question and was wondering if someone could help me with that. Question is - why companies like Google, Amazon are having partial anycasting in CDN setups? E.g if we pick a random hostname from url of Picasa picture - lh3.googleusercontent.com - this one is further a cname string and at the end you will find different A records when checked from different locations. E.g when checked from my local system (in India): ;; QUESTION SECTION: ;lh3.googleusercontent.com. IN A ;; ANSWER SECTION: lh3.googleusercontent.com. 86276 IN CNAME googlehosted.l.googleusercontent.com. googlehosted.l.googleusercontent.com. 176 IN A 209.85.175.132 Next, lookup from a server in Europe: ;; QUESTION SECTION: ;lh3.googleusercontent.com. IN A ;; ANSWER SECTION: lh3.googleusercontent.com. 86400 IN CNAME googlehosted.l.googleusercontent.com. googlehosted.l.googleusercontent.com. 300 IN A 209.85.148.132 thus different IPs in both cases. I understand that Google is doing anycasting on core DNS servers, and thus we always hit nearest DNS server and all DNS servers are sort of independent and carry different A records for CDN strings which point to local cache server IP addresses. And here's confirmation: anurag@laptop:~$ dig googleusercontent.com. ns +short ns2.google.com. ns3.google.com. ns4.google.com. ns1.google.com. Picking ns1.google.com. and asking IP for googlehosted.l.googleusercontent.com. from different locations: anurag@laptop:~$ dig @ns1.google.com googlehosted.l.googleusercontent.com. a +short 209.85.175.132 anurag@server7:~$ dig @ns1.google.com googlehosted.l.googleusercontent.com. a +short 209.85.148.132 As expected - same server (which appears same but is different) giving different values - thus I am actually hitting different servers in both cases. Now my question here is - why this setup and not simply using having a A record for googlehosted.l.googleusercontent.com. which comes from any anycasted IP address space? Why not anycasting at CDN itself rather then only at DNS layer? Can someone explain? Thanks! -- Anurag Bhatia anuragbhatia.com or simply - http://[2001:470:26:78f::5] if you are on IPv6 connected network! Twitter: @anurag_bhatia <https://twitter.com/#!/anurag_bhatia> Linkedin: http://linkedin.anuragbhatia.com

6 8

FCoE Deployment
by Jack Morgan 22 Feb '12

22 Feb '12

Does anyone know of any company or organization deploying FCoE[1] in a production environment? I'm curious how widely adopted this technology is. [1] http://en.wikipedia.org/wiki/Fibre_Channel_over_Ethernet http://fcoe.com/ Thanks, -- Jack Morgan

5 5

[BIZ] Colocate at New York
by Olivier CALVANO 22 Feb '12

22 Feb '12

Hi we want see a colocate at New York: * Equinix or telehouse * 1/4 or 1/2 rack (only private rack with 1/4 or 1/2 door) * 1 Kva Dual Feeds * 1 Cross Connect Fiber * no internet. If you know a good supplier ;=) Thanks Olivier

1 0

Cisco CAT6500 IOS Simulator
by Carlos Asensio 22 Feb '12

22 Feb '12

Hi there, Anyone know a way of simulate a Cisco CAT6500 IOS? We're trying to deploy a lab of our production environment. Thanks in advance, Carlos.

1 0

Re: DNS Attacks
by Joel M Snyder 22 Feb '12

22 Feb '12

> http://thehackernews.com/2012/02/fbi-will-shutdown-internet-on-march-8.html Quoting the FBI: 85.255.112.0 through 85.255.127.255 67.210.0.0 through 67.210.15.255 93.188.160.0 through 93.188.167.255 77.67.83.0 through 77.67.83.255 213.109.64.0 through 213.109.79.255 64.28.176.0 through 64.28.191.255 Solve said problem easily by destination NATing those IPs on 53/UDP/TCP to your own recursive servers, or dump them on Google at 8.8.8.8 if you're so inclined. Extra bonus result: NAT logs will show who needs a pleasant email from customer service. Or you could just let 'em[1] suffer, BoFH-style. jms [1] "'em" in this case is "your customer service reps" who will see a 'higher than normal call volume' should the FBI's warning mean anything. -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

11 16

Re: Customer Notification System.
by Tom Pipes 21 Feb '12

21 Feb '12

Not sure if you have a customer database/spreadsheet and what OS platform you use, but this product has served us well in the past: http://www.massmailsoftware.com/bulkmail/ Tom Pipes tom.pipes(a)t6mail.com On Tue, Feb 21, 2012 at 4:58 PM, James Wininger <jwininger(a)ifncom.net>wrote: > We are a smaller ISP in Indiana. We are growing quite rapidly (yeah for > us). We have a need for a customer notification system. We have simply > out grown the ability to send emails to our customers manually. We need > to have a better way of notifying our customers of maintenance etc. > > > > We would need to send notifications out to say about 400 customers. > Ideally the system would send an attached PDF. It would be great if this > system were SQL based etc. > > > > Does anyone know of a system that is out there that does this? We have > looked at a few applications (windows based) but integration with > billing etc seems to be a caveat. I have thought of possibly using a > mailing list type approach, but that gets us back to (almost) where we > are today. Any pointers would be greatly appreciated. > > > > -- > > Jim Wininger > > jwininger(a)ifncom.net > > > >

1 0