- Test - lists.nanog.org

DDOS - How much is "too much"?
by Tuc at T-B-O-H 17 Dec '08

17 Dec '08

Hi, I have a client who prior to me settled into a non-carrier-neutral facility. They were approached this week for "DoS/DDoS protection" which they could buy in X Mb/s, 2xX Mb/s or 4xX Mb/s scrubbing solutions. Maybe I've been out of the running my larger Managed Server Hosting Company too long, but wasn't the "non-elegant" solutions something ISPs just "did"? Was it only DoS, and when it comes to DDoS they tell you its just too much to handle. And blocking how many netblocks does an ISP consider "too many" before it tells the client there is only so much it can do for them? Do people tell/give clients their own solutions? (Like Zebra boxes that'll inject BGP into their site) They wanted me to come up with 3 reasons FOR the service, 3 against, and what I felt was a fair market value for this. I just need to know if people still did that type of stuff for each other or if everything costs nowadays.... Thanks, Tuc/TBOH

2 1

NANOG 45: Register Now, Hotel Link Available
by Tom Daly 17 Dec '08

17 Dec '08

Folks, NANOG 45 in the Dominican Republic is fast approaching, so now is the time to go get registered for the conference. You can register for NANOG 45 at: https://nanog.merit.edu/registration/ I'm also pleased to report that our hotel has provided us with with a direct link for online reservations. You can make your reservations online at: http://cwp.marriott.com/sdqgw/nanog/ Be aware: the hotel is offering very nice rooms at a great rate (part of what should make your travel justification easier), so be sure to register soon. Also, consider booking travel soon. A number of airlines have substantially discounted flights at the moment, but one never knows when they might expire. Looking forward to seeing you all in SDQ, Tom Daly, for the NANOG Program Committee -- Tom Daly tom(a)dyndns.com Dynamic Network Services, Inc. http://dynamicnetworkservices.com/

2 1

postini contact?
by mike 17 Dec '08

17 Dec '08

I have a serious problem with postini applying some rules that look like the work of a rouge engineer in their ranks, and I need an internal contact to discuss the problem with. thanks.

8 8

e300 vs mx240 for border router ?
by Leslie 17 Dec '08

17 Dec '08

Hey nanog-izens So for routers that are touching our transit and (hopefully soon) future peering, we're looking at both the force10 e300's and juniper mx240's. The e300's are cheap but I have heard some rumors/talk of falling over when it has to deal with large numbers of prefixes and routes? The mx240's are nice but the cost difference is enormous. Does anyone have experience with e300's running into issues with large routing tables? Are there any tricks/tips that work around any issues (if they exist?) Thanks in advance Leslie

8 8

Ventzislav Tzvetkov ist außer Haus.
by Ventzislav.Tzvetkov＠telefonica.de 16 Dec '08

16 Dec '08

Ich werde ab 16.12.2008 nicht im Büro sein. Ich kehre zurück am 18.12.2008. Ich werde Ihre Nachricht nach meiner Rückkehr beantworten.

1 0

No route to verizon
by Sharlon R. Carty 15 Dec '08

15 Dec '08

Hello, This is my first post. Can anyone provide some info or Verizon why there is no connectivity to Verizon CA(Verizon Business UUNETCA8-A)? Can not reach the following net range: 66.48.66.160 - 66.48.66.175 --sharlon

7 7

Re: Net Mgmt Tools and supporting OS
by vitto malitani 15 Dec '08

15 Dec '08

Thanks to all who replied. Due to ease of deployment I will probably go with the Cent)S based server and tools and modify things as I need it afterwards. Best of luck, Vitto, On Tue, Dec 9, 2008 at 4:00 PM, Claudia de Luna <cldeluna(a)yahoo.com> wrote: > Vito, > > I"m currently consulting to the state of California corrections department > on their wan and this question continually comes up. > > My recommendation is to get started with CactiEZ as you SNMP management > tool. CactiEZ is a CentOS based Cacti server that essentially loads > everything you need to get up and running. If you already have an > authoratative and complete list of all your network infrastructure equipment > it is then a simple matter of adding the devices to the server. > Out of the box you get your syslog server (essential) with some basic > search capabilities, your monitoring for bandwidth utilization, errors, > latency (ping based) and router CPU. > > You can grow from there with notification (it's pretty basic but better > than nothing), availability reports, and even a weather map. > > As someone else already said, use the OS you are most comfortable with. > Running monitoring on a network is a full time job in and of itself so don't > complicate things! > > Tools like OpenNMS and Nagios are a little more complex. The CactiEZ CD is > pretty much turnkey and gives you most, if not all, the tools to get you up > and running. From there you can see what needs it does not meet and grow > from there. > > Claudia > > > This link lists the "plug ins" available out of the box but there are > others as Cacti has a very good plug in architecture. > http://cactiusers.org/wiki/Homepage > > Example WeatherMap > > > > ------------------------------ > *From:* vitto malitani <vmalitani(a)gmail.com> > *To:* nanog(a)nanog.org > *Sent:* Tuesday, December 9, 2008 9:17:40 AM > *Subject:* Net Mgmt Tools and supporting OS > > I am fairly new user of nanog mail list so I am not sure if the question > below is appropriate for this list. If not, please excuse it. > - I am building a new low-budget customer WAN/LAN network and need some > ideas for network management tools. I've seen couple of email threads > regarding all sort of "net goodies". However, since I haven't used them > all, I am not sure which OS would be the most appropriate for these aps? > Can anyone share their ideas in regards of apps and supporting platforms? > I would be most comfortable with free distribution of linux, but I am not > sure which distro supports most of the tools? Is the paid OS required for > all these tools, like RedHat Server or SuSe or Windows platforms? > > Thanks much, > > Vitto >

1 0

Re: Netblock reassigned from Chile to US ISP...
by Robert Tarrall 15 Dec '08

15 Dec '08

Martin List-Petersen wrote: -> Contact Google. Somebody from Google replied off-list. Sounds like Google maybe had this updated even before he looked at it. -> Again. Akamai is helpful. Contact them. Somebody from Akamai replied off-list and they're looking into it. -> 3) End-user unable to complete an online e-commerce transaction -> due to a fraud-prevention service thinking he was a Chilean user -> trying to buy something with a US-based credit card. -> -> There's no fast fix for this, but have you talked to MaxMind about -> chaning the Geo location ? They'll implent it fast and it's in their -> DB within a week, max 2, but it'll take 2 months at least, before it MaxMind was the first place I checked; they already had the correct info when I looked. IP2Location don't have the right info, but they think it's a Speakeasy.net IP in Washington DC which probably won't be a problem. No idea about Digital Element yet. Netblock is 67.214.48.0/20 - was reg'd a couple of weeks ago so folks who pull ARIN assignments regularly will have it. Those who care but don't check ARIN regularly may want to see if they think it's in Chile, and change it to Denver, Colorado if so. -> However, the ecommerce issue is a bit worse, because there's some -> of'em out there, like one of the biggest hosters in the states, that -> have 2 year old data. Yeah, it's those types that I'm hoping to locate as well... Google and Akamai were immediately noticed by the test users, and have also responded very quickly (thanks, guys), but ideally we'd like to be proactive and get as many of these updated *before* the real customers hit the network and start having problems. -Robert.-

17 24

Sbc contact
by chaim.rieger＠gmail.com 14 Dec '08

14 Dec '08

Please contact me offlist. Regarding socal connectivity. Thanx Sent via BlackBerry from T-Mobile

1 0

UDP DoS mitigation?
by Rick Ernst 14 Dec '08

14 Dec '08

We've had an increasing rate of DoS attacks that spew tens-of-thousands of small UDP packets to a destination on our network. We are getting roughly 2x our entire normal pps across all providers through one interface, or about 4x normal through the individual interface. The Cisco 7206VXR/NPE-G1 CPU melts (>95% load vs 15% average, 20% normal peak) when this hits. I'm using CEF and ip-route-cache flow on the outside interface. Unicast RPF is also enabled on the interface. Unicast RPF in conjunction with a BGP black-hole generator handles TCP attacks fairly well. Two questions: - Are there any knobs I should be turning in the Cisco config to help with mitigate this? - Are there any platforms that deal with high PPS/small packet more gracefully? We are looking at a network refresh and aren't locked into Cisco as a vendor (although our current IP network consists entirely of Cisco gear). Our current aggregate (all providers, in- plus out-bound) bandwidth is ~500Mbs, but projected growth is 1Gbs within the year. Thanks, Rick

6 7