- Test - lists.nanog.org

Re: Mitigating human error in the SP
by Chadwick Sorrell 02 Feb '10

02 Feb '10

On Tue, Feb 2, 2010 at 12:45 PM, James Downs <james.downs(a)egontech.com> wrote: > > On Feb 2, 2010, at 9:33 AM, Jared Mauch wrote: > > We have solved 98% of this with standard configurations and templates. > > To deviate from this requires management approval/exception approval after > an evaluation of the business risks. > > I would also point Chad to this book: http://bit.ly/cShEIo (Amazon Link to > Visual Ops). > It's very useful to have your management read it. You may or may not be > able to or want to use a full ITIL process, but understanding how these > policies and procedures can/should work, and using the ones that apply makes > sense. > Change control, tracking, and configuration management are going to be key > to avoiding mistakes, and being able to rapidly repair when one is made. > Unfortunately, most management that demands No Tolerance, Zero Error from > operations won't read the book. > Good luck.. I'd bet most of the people on this list have been there one time > or another. > Cheers, > -j Interesting book, maybe I'll bring that to the next meeting. Thanks for the heads up on that.

1 0

Threading the senderbase reputation needle
by Drew Weaver 02 Feb '10

02 Feb '10

Howdy, Has anyone come up with a reverse DNS 'pattern' that one can employ that will prevent Senderbase from assigning a poor reputation to an entire /24 because they saw an email they didn't like from a single IP address? We're an infrastructure provider, which means that we lease servers, etc to customers and everything we do uses static IPs. Our current 'default (before the customer changes it)' is a x.x.x.x.static.domain.com, apparently Senderbase cannot look up CIDR boundaries in the RIR database (even though we spend a lot of time making sure that we publish the CIDR information) so they just assume that each 'offender' owns the entire /24 and they also consider any 'email' from the static.domain.com domain to be the 'same offender' (which is completely silly). The other little annoyance about their system is that we assign CIDR blocks to users (almost always a /29) these CIDRs include IP addresses like the gateway address, the broadcast address, the network address, etc and the users may only use 2-3 of the IPs in the /29, but they expect us or the user to set a 'custom looking' reverse DNS on all of the IPs in the range. Originally, we were not putting any reverse DNS on our IPs until the customer requested it (or did it themselves via our system) but then we ran into problems with some RBLs that require reverse DNS on all IPs, and other RBLs that require matching forward and reverse DNS on all IPs. I've contacted Senderbase for advice on what specifically we need to do but they've been vague at best and I have even asked them for examples of companies who 'meet their specifications' but I wasn't given any. I'm considering doing something like customerXXXXX.static.domain.com but then I can see other problems with that also. Any advice? -Drew

4 5

Unix Sysadmin/Net Eng in the Toronto Area?
by Carlos Kamtha 02 Feb '10

02 Feb '10

Greetings, I am looking for an experienced Freebsd/linux/cisco/juniper person. If you live in Toronto or the GTA and are interested please drop me a line offlist. Cheers, Carlos.

1 0

Re: Mitigating human error in the SP
by gb10hkzo-nanog＠yahoo.co.uk 02 Feb '10

02 Feb '10

>>Otherwise, as Suresh notes, the only way to eliminate human error completely is >>to eliminate the presence of humans in the activity. and,hence by reference..... >> Automated config deployment / provisioning. That's the funniest thing I've read all day... ;-) A little pessimistic rant.... ;-) Who writes the scripts that you use, who writes the software that you use ? There will always be at least one human somewhere, and where there's a human writing software tools, there's scope for bugs and unexpected issues. Whether inadvertent or not, they will always be there. If the excrement is going to hit the proverbial fan, try as you might to stop it, it will happen. Nothing in the IT / ISP / Telco world is ever going to be perfect, far too complex with many dependencies. Yes you might play in your perfect little labs until the cows come home ..... but there always has been and always will be an element of risk when you start making changes in production. Face it, unless you follow the rigorous change control and development practices that they use for avionics or other high-risk environments, you are always going to be left with some element of risk. How much risk your company is prepared to take is something for the men in black (suits) to decide because it correlates directly with how much $$$ they are prepared to throw your way to help you mitigate the risk .....;-) That's my 2 <insert_currency> over ...... thanks for listening (or not !).... ;-)

3 2

Fwd: [Pauldotcom] Skiddy Interview
by andrew.wallace 02 Feb '10

02 Feb '10

---------- Forwarded message ---------- From: andrew.wallace <andrew.wallace(a)rocketmail.com> Date: Sat, Jan 30, 2010 at 9:31 PM Subject: Re: [Pauldotcom] Skiddy Interview To: Adrian Crenshaw <irongeek(a)irongeek.com> Cc: PaulDotCom Security Weekly Mailing List <pauldotcom(a)mail.pauldotcom.com> On Sat, Jan 30, 2010 at 3:10 PM, Adrian Crenshaw <irongeek(a)irongeek.com> wrote: > Kind of interesting Skiddy Interview: > > http://hackerpublicradio.org/eps/hpr0505.mp3 > > Guy seems pretty uneducated, but it gives you an idea of the mentality. No > offence meant to the HPR podcast, it has some good stuff. > Like your comments. > > Adrian > He mentions selling a Bank of America employee account starting around 7 minutes 40 seconds, which just suffered a Denial of Service attack to its website. http://isc.sans.org/diary.html?storyid=8119 Any connection? Of course probably not, but just thought i'd throw it out there anyway. Andrew

2 1

MARTINI: why it matters to Voice over IP service providers -- and why we want YOU to attend the Virtual Interim on February 9, 2010
by Bernard Aboba 02 Feb '10

02 Feb '10

The IETF MARTINI WG has been chartered to standardize an important aspect of SIP trunking: multiple AOR registration. This is not one of those "we'll deliver a standard when we're good and ready" working groups. This WG is aiming to deliver a single standard solution that can displace the myriad of adhoc "implicit registration" approaches that exist today. The goal is to change SIP trunking forever, or die trying. Not 5 years from now, not 2 years from now, but NOW. MARTINI will hold its third virtual Interim (yup, three 2.5+ hour interims in a period of less than 6 weeks) on February 9, 2010. If you are a Voice over IP service provider, and you care about the future of SIP trunking, then you need to attend MARTINI Virtual Interim III, or lose your whining rights, forever. The strawman agenda and the conference parameter details are available here: http://www.ietf.org/mail-archive/web/martini/current/msg00462.html Presentations and minutes from the previous virtual interims are available here: http://www.drizzle.com/~aboba/MARTINI/ The IETF MARTINI WG: not another half-baked standards working group that nobody cares about. Bernard Aboba Co-Chair, IETF MARTINI WG http://www.ietf.org/dyn/wg/charter/martini-charter.html

1 0

Fiber Cut in CA?
by Micheal Patterson 02 Feb '10

02 Feb '10

Anyone have any info on a current issue with a feed apparently being cut between AZ and CA that's causing problems for Cox customers by chance? -- Micheal Patterson

3 2

Cymru Bogon Route Help
by Chris Gotstein 02 Feb '10

02 Feb '10

I'm in the process of trying to setup bgp peering with Cymru to receive the bogon route list. I've got everything setup using the examples they have listed, but can't get the filtering to actually work on the incoming bgp. Using a Cisco 7200 router. Any off-list help would be appreciated. Thanks. -- ---- ---- ---- ---- Chris Gotstein, Sr Network Engineer, UP Logon/Computer Connection UP http://uplogon.com | +1 906 774 4847 | chris(a)uplogon.com

2 1

Need clued XO abuse contact
by Mike 01 Feb '10

01 Feb '10

I've been getting repeated junk emails from an XO customer and reports to abuse(a)xo.net are going unanswered and the problem is unresolved. Is there anyone who has a better contact who can take action on this issue? Offlist replies welcome. Thanks.

1 0

Re: Cymru Bogon Route Help
by Stefan Fouant 01 Feb '10

01 Feb '10

Can you give us a little more details around how you're trying to convert the BGP routes received into an ACL? While we're on the topic, I'd really love for the Team Cymru folks to turn their bogon list into a Flowspec feed <hint hint> ;) Sorry for the top post, I'm on my BB. Stefan Fouant ------Original Message------ From: Chris Gotstein To: nanog(a)nanog.org Subject: Cymru Bogon Route Help Sent: Feb 1, 2010 1:55 PM I'm in the process of trying to setup bgp peering with Cymru to receive the bogon route list. I've got everything setup using the examples they have listed, but can't get the filtering to actually work on the incoming bgp. Using a Cisco 7200 router. Any off-list help would be appreciated. Thanks. -- ---- ---- ---- ---- Chris Gotstein, Sr Network Engineer, UP Logon/Computer Connection UP http://uplogon.com | +1 906 774 4847 | chris(a)uplogon.com Sent from my Verizon Wireless BlackBerry

2 1