- Test - lists.nanog.org

spam decrease since friday
by Sebastian Ganschow 19 Jan '09

19 Jan '09

Hi nanog, we're seeing that we're getting about 2/3 fewer spam since friday. Even blacklist hits are declining. Does anyone has an explanation? Regards Sebastian

3 2

Cisco ASA / Comcast SMTP problem workaround
by lorell＠hathcock.org 19 Jan '09

19 Jan '09

I have the problem when working out of my house that Comcast will lock down outbound SMTP on the regular ports. This may be due to the kids' computer getting infected with a virus from time to time. That is its own problem and I want to deal with it on its own. The problem I want to discuss is a workaround to Comcast blocking outbound SMTP. I have noticed at my house when I have problems with regular SMTP traffic on port 25 to my own colo servers, that my Yahoo! premium email goes through fine without problem. I have a premium Yahoo! account and use SMTP on port 465 and POP3 on 995 with SSL configured on both. The thought occurred to me that I could solve my immediate problem as well as let me send/receive email at hotels and wifi hotspots that all block regular SMTP traffic on port 25. And roll out an encrypted new service to my hosted customers. I run my own small hosting company at a colo for a handful of customer domains and several that I own. I have a Cisco ASA 5505 (security plus license) and a pair of mail servers needed for in- and out-bound SMTP. The servers are on private IP addresses behind the ASA which has static statements for the servers inside. Also, I have additional IPs available if needed for this solution. Here is my question: How do I configure my ASA (and Outlook) to: 1. Encrypt traffic between Outlook and the ASA on non-traditional SMTP and POP3 ports without using a VPN? (Using SSL just as Yahoo! does it.) 2. Leave my servers' configuration alone so that they continue to send/receive email in exactly the same way they are doing now? Summarized: How do I duplicate Yahoo! premium email service using PAT on my Cisco ASA without changing any settings on my server? Qualifiers: 1. I don't want to change the email server configurations because it is run by a control panel software and if I take it out of spec, the next update could wipe out my custom config. 2. I don't want to use a VPN client on my laptop because it takes up VPN licenses on the ASA and because a successful solution would be a boon to my customers. I believe the ASA would have to do these things: 1. Accept SSL connections on the outside interface. 2. Accept the inbound SMTP request on an arbitrary, but non-dynamic port and translate it to port 25 and send it on to the server. 3. Accept the response from the server and translate it back into the arbitrary port (from #2 above) on the remote client. 4. Do the same thing as above except for POP3. This configuration would allow customers to also configure their SMTP/POP3 clients to allow them access to email without configuring a VPN client for each one. Stated simply, I want to duplicate what Yahoo! premium email is doing between their servers and their customers like me. Any thoughts? Lorell Hathcock

2 3

Circuit numbering scheme - best practice?
by Jay Hennigan 18 Jan '09

18 Jan '09

We've grown to the point that "The MCI T-1 in Ontario" or "Bob's ethernet to port 6/23 on switch 7" aren't scaling. Also in working with carriers we are frequently asked to provide our internal circuit number. I've seen a lot of the the LEC scheme NN-XXXX-NNNNNN where XXXX has some significance with regard to the speed and type of circuit. The leading NN seems to be a mystery and the trailing NNNNNN is a serial number. I've also seen DS1-NNNNNNN as a straight speed-serial number type of thing and horrendously long circuit numbers including CLLI codes such as 101/T3/SNLOCAGTH07/SNLOCA01K15 . Any suggestions from those who have been down this road as to a schema that makes sense and is scalable? Are there documented best practices? -- Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

6 5

WISP Lists - Networking in Honduras
by Israel Lopez 18 Jan '09

18 Jan '09

Hello NANOG & LACNOG, Can point me towards an active WISP mailing list? I have a few questions about conducting site surveys for wireless infrastructure in Honduras. I'm mostly concerned about; the use of 802.11A/B/G & 900MHz equipment, RF interference, radio placement and Local Regulations,. I can take my answers off list. Thank You Kindly, Israel Lopez (EWB-OC Olancho Aid Technical Lead <http://ewb-oc.org/olancho/>)

1 0

"Smart" hands around Dulles airport / northern VA.
by Warren Kumari 17 Jan '09

17 Jan '09

Hi all, This is a mail that I have been meaning to send ever since I moved back to the NoVA area, but have only gotten around to now... Many years ago I used to provide emergency, smart hands type assistance to those in need, but had to give this up when I moved out of the area. Anyway, I'm back and am willing to start doing this again.... This is primarily for those cases where you would normally have to fly someone out to have them replace a line-card or two, hook up a few cables, maybe swap a disk in an array, etc. This is not for those cases where you simple need someone to push the reset button, nor for rebuilding your entire cage from scratch... Anyway, if you have gear here and think that you might need to take me up on this, drop me a mail and I'll give you my direct contact info... If you like this idea, and are willing to also provide this sort of thing to the community (either in this, or in another area), please let me know -- I'll look into setting up a website / mailing list / something... Important disclaimers and limitations: 1: I do not want (nor may I accept) any compensation for this, other than good-will and a hope that you might help out someone else in need (AKA, I miss the days when this industry was more co-operative). 2: $day_job comes first. 3: If you are a competitor of $day_job you are probably out of luck. 4: If you wants me to plug in a new device, its your responsibility to make sure that you have sufficient power. 5: If you are a shady spammer, don't bother... FAQ: Q: What! Are you crazy? I'd never let a stranger into my cage! A: Huh, neither would I, but some people are less paranoid than us and / or know and trust me. Q: Why are you doing this again? What's in it for you? A: Back in the day, this industry used to be much more friendly and people would often go out of their way to help others. I fully understand why this has changed over time, but, well, it sucks.. I'd like to try and bring back some of the community feeling. Q: How did you end up so handsome!? A: First off, thank you. It was mainly luck.... Q: I am a small company looking to build a network for my 200 sales people (or something similar). Can I hire you as a consultant? A: Sorry, no. I have a day job that keeps me busy and entertained. I am not a consultant, nor do I have any wish to be one (and can think of few things worse). Oh, and I'm assuming that you meant that you own and / or work at a small company and not that you *are* a small company, because that would be weird. W -- Never criticize a man till you've walked a mile in his shoes. Then if he didn't like what you've said, he's a mile away and barefoot.

6 6

Jay Shao is out of the office.
by Jay Shao 17 Jan '09

17 Jan '09

I will be out of the office starting 01/17/2009 and will not return until 02/09/2009. I will respond to your message when I return. Please contact with NETTCP(a)DTCC.COM for any production issues ----------------------------------------- ________________________________________________________ DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

1 0

What might have been a lightning talk on anycast had I gotten to a meeting
by Howard C. Berkowitz 17 Jan '09

17 Jan '09

Economies and underemployment being what they are, I won't be getting to the in-person meeting, but it occurred to me that a brief tutorial on some of the operational applications of anycast might be a lightning tutorial. I wrote such a short article at http://en.citizendium.org/wiki/Anycasting. Citizendium, as some of you may know, is a open-content wiki that operates on a real-names model with hopefully helpful expert review. I'm starting to take some of my past NANOG presentations and turn them into articles or sets of related articles, obviously updating them. Since NANOG doesn't have a publication mechanism for its presentations, or even summaries of long mailing list threads written for someone who had not been following them, it might be useful as a means of education. I'd welcome anyone who would like to participate; it's still an early project. Given, for example, the various trade press pieces on BGP security and vulnerability expert, I may try, unless someone already has a tutorial they might like to be adapted, they'd like to write, or co-write, to do something at a little more detailed level than Network World, but lighter than an RFC. I have assorted BGP articles there, still at an introductory level, and was starting something on routing policy.

1 0

Level 3 Philly "Major outage"?
by up＠3.am 17 Jan '09

17 Jan '09

I have a cabinet at Broadwing's (now Level 3) Norristown data center, for over 2 years now. It has always seemed something of a backwater in terms of Broadwing's network, and even more so with Level 3. An outage started yesterday morning, reportedly caused by a broadcast storm on their Philly Big Iron switch that connects to Norristown (this happened before last August). In a couple of hours, they had it fixed, only for it to go into up-and-down mode a couple of hours later, for the rest of the day. I escalated the ticket at around 6:20pm, but saw no lasting improvment. This morning, I started getting customer calls that it was down again. I called Level 3 once more, after seeing the same "Analysis in Progress" message on their portal from the previous evening. The rep described that a "major outage" was happening in Philly, even though there's nothing on their "Network Outages" list about it. I would think that if this was a "Major Outage" in Philadelphia for Level 3, there would be some NANOG chatter on it, which I don't see. It's back up for now, but does anybody have any knowledge of this? As an aside, would it be ok for me to solicit colocation services in the Philadelphia area on this list? A change has to be made at some point. Thanks, James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

1 0

BGPSEC & soBGP
by Naveen Nathan 17 Jan '09

17 Jan '09

I came across this article on /.: http://www.networkworld.com/news/2009/011509-bgp.html?page=1 I'm not too familiar with security of routing protocols, but it became immediately evident as I read this article that much of the work has been accomplished with soBGP. I'm wondering why there is a new initiative for another technology to secure BGP. -- Naveen Nathan

2 1

Re: Circuit numbering scheme - best practice?
by Scott Weeks 17 Jan '09

17 Jan '09

----- jay(a)west.net wrote: ------ <snip> thing and horrendously long circuit numbers including CLLI codes such as 101/T3/SNLOCAGTH07/SNLOCA01K15. ------------------------------- That is what's used by the transport section (I'm in the IP section) in the company where I work. Even though the description is long, I use the entire CID from the carrier along with something that makes sense to me and the NOC folk that'll be troubleshooting before I get to it. Long in information many times means more work done by the first level folks. Here's a couple of examples: "LAG 29 LINK 1 for CKT ID: 101/GE1/HNLLHIMN37W/HNLLHIMN53W" "101/GE1/HNLLHIMN37W/HNLLHIMN44W to Cisco 3750 7th floor data center" "OC-12 POS line to AT&T: CIDs-> HT: 82.ODGS.xxxxxx.HAWT AT&T: IVEC.xxxxxx..ATI" Long? Yes. Helpful to the first level NOC folks? Yes. scott

1 0