- Test - lists.nanog.org

Fiber cut - response in seconds?
by Charles Wyble 02 Jun '09

02 Jun '09

http://www.washingtonpost.com/wp-dyn/content/article/2009/05/30/AR200905300… Not sure if I fully believe the article. Responding to a fiber cut in seconds? I suppose it's possible if $TLA had people monitoring the construction from across the street, and they were in communication with the NOC.

18 31

Re: Fiber cut - response in seconds?
by David Barak 02 Jun '09

02 Jun '09

Encryption is insufficient - if you let someone have physical access for a long enough period, they'll eventually crack anything. Encryption makes the period of time longer, but let them try? As regards "roving," we are talking about Tyson's Corner here: that's pretty close (< 5km) to major offices of lots of folks who would care deeply about such matters. David Barak Need Geek Rock? Try The Franchise: http://www.listentothefranchise.com --- On Tue, 6/2/09, Charles Wyble <charles(a)thewybles.com> wrote: > From: Charles Wyble <charles(a)thewybles.com> > Subject: Re: Fiber cut - response in seconds? > To: "nanog(a)nanog.org" <nanog(a)nanog.org> > Date: Tuesday, June 2, 2009, 1:57 PM > Cheaper? > > To quote sneakers.... were the united states govt. we don't > do that sort > of thing. > > Martin Hannigan wrote: > > It would also be cheaper to add an additional layer of > security with > > encryption vs. roving teams of gun toting manhole > watchers. > > > > YMMV, > > > > Best! > > > > Marty > > > > > > > > On 6/2/09, Deepak Jain <deepak(a)ai.net> > wrote: > >>> No. And here's why: If you're a naughty > foreign intelligence team, and > >>> you know your stuff, you already know where > some of the cables you'd > >>> really like a tap on are buried. When you hear > of a construction > >>> project > >>> that might damage one, you set up your > innocuous white panel truck > >>> somewhere else, near a suitable manhole. When > the construction guy with > >>> a backhoe chops the cable (and you may well > slip him some money to do > >>> so), *then* you put your tap in, elsewhere, > with your actions covered > >>> by > >>> the downtime at the construction site. That's > why the guys in the SUVs > >>> are in such a hurry, because they want to > close the window of time in > >>> which someone can be tapping the cable > elsewhere. > >>> > >>> At least that's what I heard. I read it > somewhere on the internet. > >>> Definitely. Not at all a sneaky person. No > sir. > >> And if you were a naughty foreign intelligence > team installing a tap, or a > >> bend, or whatever in the fiber contemporaneously > with a known cut, you could > >> also reamplify and dispersion compensate for the > slight amount of affect > >> your work is having so that when its tested later, > the OTDR is blind to your > >> work. > >> > >> Ah, the fun of Paranoia, Inc. > >> > >> Deepak Jain > >> AiNET > >> > >> > > > > > >

3 2

Huawei cx300
by Jack Kohn 02 Jun '09

02 Jun '09

Guys, Anybody any experience with VPLS on Huawei cx300? Jack

2 1

White House net security paper
by jamie rishaw 02 Jun '09

02 Jun '09

The White House just put out a release on net security[1] - at first glance a mission/vision/values paper, the release page[2] also containing a short video[3]. At first glance, this looks promising - anyone else get a chance to read/review? Comments? -jamie [1] http://www.whitehouse.gov/asset.aspx?AssetId=1732 [2] http://www.whitehouse.gov/CyberReview/ (other links here as well) [3] http://www.whitehouse.gov/videos/2009/May/20090529_Cyber_Security.mp4 -- Jamie Rishaw // .com.arpa@j <- reverse it. ish. [Impressive C-level Title Here], arpa / arpa labs

11 19

RE: In a bit of bind...
by Ben Matthew 02 Jun '09

02 Jun '09

Thanks very much for the various responses to my question; both on and off-list. I'm very much liking the idea of only letting the outside world see bind and then AXFR'ing the data from an easier-to-manage internal database backed solution. Whether that be myDNS, Microsoft or whatever. Bit of initial config work and then, in theory, an easy job to administer. Actually feel a bit dumb for not considering that in the first place. Cheers again, Ben -----Original Message----- From: Peter Hicks [mailto:peter.hicks@poggs.co.uk] Sent: 01 June 2009 12:42 To: Ben Matthew Cc: nanog(a)nanog.org Subject: Re: In a bit of bind... Ben, Ben Matthew wrote: > I have six servers in total, two multi-homed servers for ordinary DNS and four servers running an Anycast network (2 x master and slave). > For DNS, you may find it easier to outsource hosting to another provider who has geographically diverse DNS services. This doesn't necessarily mean loss of control. It also separates your nameserver hosting from your servers - suppose your network were to be under attack, or a configuration error dropped you offline. If DNS were somewhere else, you could log in, change A records, point somewhere else. > Anyway I've recently been investigating other options for DNS as, like many companies currently, we've laid off a bunch of staff and the overhead for maintaining BIND is quite high if done, like us, unassisted and you are editing zone files in a text editor. > Revision control systems - CVS, Subversion - are your friend here. What about wrapping up your DNS change procedure through perl or shell scripts which automatically roll back if bind doesn't reload, or some critical hosts suddenly disappear from the file. Also, ask yourself what the cost of operating the service without changes is, and what the cost of each change is. How often are you making changes? How often do you need to make a change in an absolute emergency? If changes are being done frequently, a technical or semi-technical member of staff will get to know the procedure. If changes are being made rarely, can the changes wait for you to apply them if you don't feel comfortable with others doing it? > Ultimately for our simple zones (non-Anycast, basic web forwarders) I want to create a web-app to do this for me, probably in PHP. I could create something that... Herein lies a problem - you want to create a web front-end to a DNS server. You're going to have to do a lot of testing to make this play nicely, and you could introduce your own security holes or gotchas. What is the cost of creating something yourself? How about one of the following? * Outsource DNS hosting, use another provider's interface to manage * BIND9 slaves, Windows-based master (hidden) which already has a GUI and it isn't difficult to change zones * Stick to what you have and document it, wrapping the 'apply' process in some simple shell or perl Peter ________________________________________________ DISCLAIMER This e-mail message, including any attachments, is intended solely for the use of the addressee and may contain confidential information. If it is not intended for you, please inform the sender and delete the e-mail and any attachments immediately. Any review, retransmission, disclosure, copying or modification of it is strictly forbidden. Please be advised that the views and opinions expressed in this e-mail may not reflect the views and opinions of TIML Radio Limited or any of its parent and subsidiary companies. Whilst we take reasonable precautions to ensure that our emails are free from viruses, we cannot be responsible for any viruses transmitted with this e-mail and recommend that you subject any incoming e-mail to your own virus checking procedures. Use of this or any other e-mail facility signifies consent to any interception we might lawfully carry out to prevent abuse of these facilities. ________________________________________________ TIML Radio Limited (trading as Absolute Radio) Registered office: One Golden Square, London. W1F 9DJ Registered in England No 02674136 VAT No 927 2572 11

4 3

RE: In a bit of bind...
by gb10hkzo-nanog＠yahoo.co.uk 02 Jun '09

02 Jun '09

Hi, I have not been following this thread too closely, but I spotted the last poster talking about a database backend to DNS. There are some interesting thoughts on the matter in a Nominet Blog Post here : http://blog.nominet.org.uk/tech/2008/06/02/nameservers-and-very-large-zones/

1 0

AOL Postmaster
by Aaron Wendel 02 Jun '09

02 Jun '09

Is anyone from AOL lurking on the list that could contact me of-list? I'm having some issues with mail being rejected because AOL believes our IPs are dynamic. Aaron

4 3

How to measure network equipment usage effectiveness?
by Lee, Steven (NSG Malaysia) 02 Jun '09

02 Jun '09

Hi all, may I know how you guys measure the network equipment usage effectiveness? In what situation you will buy new network equipment instead of using the existing equipment? Any clue to share? Should we only upgrade/replace the equipment once the max PPS is reached? Is there any tools other there can measure this? Regards, Steven Lee

2 1

Re: Fiber cut - response in seconds?
by Robert Bonomi 02 Jun '09

02 Jun '09

> From nanog-bounces+bonomi=mail.r-bonomi.com(a)nanog.org Mon Jun 1 18:30:48 2009 > Date: Mon, 01 Jun 2009 15:40:31 -0700 > From: Charles Wyble <charles(a)thewybles.com> > To: "nanog(a)nanog.org" <nanog(a)nanog.org> > Subject: Fiber cut - response in seconds? > > http://www.washingtonpost.com/wp-dyn/content/article/2009/05/30/AR200905300… > > Not sure if I fully believe the article. Responding to a fiber cut in > seconds? I *don't* believe it, _as_written_. If one takes 'in seconds' to mean single-digit quantities, they had to be: in the vehicle, with the engine running transmission in gear, starting from within a few hundred feet, with no interfering traffic AND no opposing traffic light. Now, change the 'facts' of the scenario "slightly", and it becomes a bunch more believable. Allow 'double-digit' numbers of seconds, from the time the crew _noticed_ the cut, and it gets a bit less fantastic. Postulate some form of 'damage' to the cable -- maybe a kink, that stretched, but did not sever the cable, or more likely, a pressure rupture in an enclosing safety guard, -- such as a 'near miss' by a back-hoe might cause a few scoops before the cable was completely severed, plus allow for a little time between actual cable severance, and the cut cable becomes _visible_; now you're looking at 5-10 minutes from 'first warning' of a problem at the NOC (with TDR type gear giving approximate location) and the 'rapid response' team on site. They'd have to be on an alert status comparable to the old SAC first alert bomber crews, and probably based within 3-5 miles, but things are now within the realm of beleivability. Not saying I _do_ believe it, but we're into the range of "might, maybe, possibly, happen that way", without having to postulate a TARDUS. <grin> I would have expected such a crew to be eqipped with, and need to _use_, 'lights and sirens', and *big* air horns, in dealing with traffic on the roadway -- *AND* I would have expected that 'minor detal' to have been noted by the work crew. As for the last part -- about the billing issue -- assuming that the construction contractor had called JULIE (The undergournd utilities marking service) and gotten the sign-off from all the carriers, they _were_ 'home free'. The carrier who 'failed to mark' their cable gets to pay the cost of replacement.

1 0

Re: Fiber cut - response in seconds?
by Warren Bailey 02 Jun '09

02 Jun '09

Its all a sham. The construction was done by the cubans.. They're good at fiber taps ----- Original Message ----- From: Charles Wyble <charles(a)thewybles.com> To: nanog(a)nanog.org <nanog(a)nanog.org> Sent: Mon Jun 01 16:17:08 2009 Subject: Re: Fiber cut - response in seconds? I do feel this might be the last post from Mr Pooser. :) Your on to them it seems. ;) A very interesting idea. I imagine it wouldn't be hard for foreign actors to get access to the data feed of construction, observe for signs of a cut and then splice in a tap. Though wouldn't that tap be found via the real response team? Dave Pooser wrote: >> Right. So why the "near instant" response time. If it's a diverse path, >> one would imagine that they could respond in a few hours or a day and >> not have any impact. > > Just a guess, but: A cut cable is one thing. A cut cable in which people > wearing different suits and driving a different brand of SUV might splice in > a fiber tap is something altogether different.

1 0