- Test - lists.nanog.org

re: commonly blocked ports (but not on backbones)
by brett watson 14 Sep '05

14 Sep '05

> seems to me this is the wrong question... a default security > "posture" (network or system, isp or enterprise or any type of > entity) should be: "if it's not explicitly allowed, it's denied." apologies, i see the original poster was talking about a *backbone*... my mind was on campus/edge/customer networks. this policy, of course, does not apply to backbones (unless you want an avalanche of customer calls). -b

1 0

CAT5 surge/lightning strike protection recommendations?
by R.P. Aditya 14 Sep '05

14 Sep '05

I have a bunch of cat5 buried about 1 ft below the surface connecting multiple buildings on a campus (short runs) and lightning strikes nearby have caused surges along one or more of the cables and burnt out switch ports. I would like to protect the switch ports -- there seem to be lots of products on the market. Anyone have recommendations (tested/practical is best :-)? The APC Protectnet PNET1 and PRM24 seem quite nice and not too expensive -- if they work....pros? cons? Thanks, Adi

13 17

Re: commonly blocked ISP ports
by Fergie (Paul Ferguson) 14 Sep '05

14 Sep '05

A couple of decent barometers: http://www.dshield.org/topports.php and: http://www.mynetwatchman.com/default.asp - ferg -- Luke Parrish <lukep(a)centurytel.net> wrote: Not quite looking for tips to manage my network and ACL's or if should or should not be blocking, more looking for actual ports that other ISP's are blocking and why. For example: port 5 worm 2.5 port 67 virus 8.2 At 03:12 PM 9/14/2005, Valdis.Kletnieks(a)vt.edu wrote: >On Wed, 14 Sep 2005 14:42:56 CDT, Luke Parrish said: > > We have a list, some reactive and some proactive, however we need to > remove > > ports that are no longer a threat and add new ones as they are published. > >All ports that are open are threats, at least potentially. What you *should* >be doing is: > >a) When you block a new port due to a current exploit, log the fact. >b) Work with customers/users to make sure they're patched, and that new >machines >are patched before they go live. >c) When probing for the port stops (which it never does), or some sufficient >number of downstream boxes are patched and safe, remove the block. > >Either that, or block the world, and open ports on request. > >Remember - *you* are the only one on this list who really knows if a given >port is a threat anymore.... > >(And that's totally skipping all the noise about corporate firewalls >versus ISP >firewalls and different expectations regarding security/transparency...) Luke Parrish Centurytel Internet Operations 318-330-6661 -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: commonly blocked ISP ports
by Scott Weeks 14 Sep '05

14 Sep '05

----- Original Message Follows ----- From: Luke Parrish <lukep(a)centurytel.net> To: nanog(a)merit.edu Subject: commonly blocked ISP ports Date: Wed, 14 Sep 2005 14:42:56 -0500 > Everyone, > > Does anyone have a reference point for commonly blocked > ports? > > We have a list, some reactive and some proactive, however > we need to remove ports that are no longer a threat and > add new ones as they are published. See the NANOG archives. There is a LOT of discussion regarding this issue there. Please everyone, let's don't do this again. It has not been long enough since the last one and my "D" key is beginning to wear out after the last couple of days... scott

1 0

cogent and level3
by Joseph Nuara 14 Sep '05

14 Sep '05

Does anyone know what the story is with Cogent and L3? I noticed that my Cogent site (IN NY) is using a path to one of my providers (IN NJ) via asia as opposed to the local and preferred L3 peer. After several days I was finally told that L3 and Cogent are working through some peering negotiations and cogent is moving traffic off their L3 peer in anticipation of a depeering (I guess they are trying to avoid the whole France Telecom thing that happend last time). Does anyone have a better clue as to what is going on and where the negotiations stand?

2 1

Load Balancing between multiple BGP peer connections
by Joe Shen 14 Sep '05

14 Sep '05

Hi, How could load on multiple BGP peer links be balanced automatically? The situation we are facing: ---------------------------| | Service provider | | | --R1--------------------R2--- |\ | | \ E-BGP | | \ ----------------\ | | \| ----R3--------------------R4-| | Our Network | | (OSPF) | ----------------------------- The three links between our network and Service provider network are all 1Gbps. Now, we noticed that load on link R1-R3, R1-R4 is about 50% (in/out), but load on R2-R4 are about 90% ( in/out). How could we balance those load on the three links automatically? or must we tune the route mannually? Is there any technical guide on this? thanks in advance. Joe Send instant messages to your online friends http://asia.messenger.yahoo.com

3 3

Re: CAT5 surge/lightning strike protection recommendations?
by Frank Coluccio 14 Sep '05

14 Sep '05

re: ""what did your electricians say ..." Back to lurking in a moment, but I should note that fire and safety code issues are so shrouded in matters of locality and jurisdiction, at times, and bound up in industry and governmental standards that are so esotric in nature, that the typical electrical worker, and I dare say even most licensed electricians and IT consultants, are totally unaware of the specifics, or they are given to gross misconceptions and half-truths. This is so, not so much due to the complex nature of the matter at hand, but due to a lack of regular exposure to it. Nufsed. Frank A. Coluccio DTI Consulting Inc. 212-587-8150 Office 347-526-6788 Mobile On Wed Sep 14 10:58 , 'Hannigan, Martin' sent: I asked him "what did your electricians say" and the entire ground conversation went south. Good post. Thanks. -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan(a)verisign.com > -----Original Message----- > From: owner-nanog(a)merit.edu [owner-nanog(a)merit.edu','','','')">owner-nanog(a)merit.edu]On Behalf Of > Frank Coluccio > Sent: Wednesday, September 14, 2005 10:52 AM > To: nanog(a)merit.edu > Subject: Re: CAT5 surge/lightning strike protection recommendations? > > > > There's not much left to interpretation and preferences here, aside > > from the choice of medium to be used. I should also add that > some of the > > advice that has been posted in this thread, as well-meaning > and thoughtful as it > > has been, has been downright dangerous to follow. > > > > If one is going to run copper cable between buildings, or outdoors, in > > general, in lieu of the better alternatives of fiber or wireless, then > > there are local and national electrical, fire and safety > codes in effect > > that spell out what you must do, enforceable under the penalty of law. > > And while certain of those precautions have been spelled out > upstream in > > piecemeal fashion, none thus far has been entirely accurate > or complete. > > > > Yes, when running copper between buildings, lightning > arresters/circuit > > - i.e., protection - are a must, but they must be placed > within a couple > > of feet of the building point of entry, or POE. Think about > it. Does it > > make great sense to protect a cable from surges deep within > the interior > > of a building if the cable traverses vast distances on premises > > unprotected between the point of entry and the terminal point. > > Therefore, the stipulation of performing grounding, bonding and surge > > protections at the point where the cable enters the building (in > > potentially at addition points, elsewhere, when required). > > > > Also, if the copper cable is "armored" with a corrugated steal jacket, > > as many outside plant cables are, then the shielding (the armor) must > > also be "bonded" to earth ground at the POE, as well. So the issue > > becomes one not only of grounding, but bonding, as well. And while I'm > > on that subject, be aware that many FIBER OPTIC cables designed for > > inter-building/outside plant use are also armored and must be > treated in > > the same manner. > > > > BICSI (Building Industries Consulting Systems International) > > www.bicsi.org does a good job of rolling up all of the relevant > > standards, as do a number of other sources. For some good coverage of > > safety, grounding and bonding principles and techniques see the > > following Structured Cabling Supplement reference by Panduit > (taken from > > the Cisco CCNA Networking Academy Program) > > > > http://www.tecmiami.com/cisco/extra/CCNA1_CS_1_en.pdf > > > > Frank A. Coluccio > > DTI Consulting Inc. > > 212-587-8150 Office > > 347-526-6788 Mobile > > >

2 1

Re: CAT5 surge/lightning strike protection recommendations?
by Frank Coluccio 14 Sep '05

14 Sep '05

There's not much left to interpretation and preferences here, aside from the choice of medium to be used. I should also add that some of the advice that has been posted in this thread, as well-meaning and thoughtful as it has been, has been downright dangerous to follow. If one is going to run copper cable between buildings, or outdoors, in general, in lieu of the better alternatives of fiber or wireless, then there are local and national electrical, fire and safety codes in effect that spell out what you must do, enforceable under the penalty of law. And while certain of those precautions have been spelled out upstream in piecemeal fashion, none thus far has been entirely accurate or complete. Yes, when running copper between buildings, lightning arresters/circuit - i.e., protection - are a must, but they must be placed within a couple of feet of the building point of entry, or POE. Think about it. Does it make great sense to protect a cable from surges deep within the interior of a building if the cable traverses vast distances on premises unprotected between the point of entry and the terminal point. Therefore, the stipulation of performing grounding, bonding and surge protections at the point where the cable enters the building (in potentially at addition points, elsewhere, when required). Also, if the copper cable is "armored" with a corrugated steal jacket, as many outside plant cables are, then the shielding (the armor) must also be "bonded" to earth ground at the POE, as well. So the issue becomes one not only of grounding, but bonding, as well. And while I'm on that subject, be aware that many FIBER OPTIC cables designed for inter-building/outside plant use are also armored and must be treated in the same manner. BICSI (Building Industries Consulting Systems International) www.bicsi.org does a good job of rolling up all of the relevant standards, as do a number of other sources. For some good coverage of safety, grounding and bonding principles and techniques see the following Structured Cabling Supplement reference by Panduit (taken from the Cisco CCNA Networking Academy Program) http://www.tecmiami.com/cisco/extra/CCNA1_CS_1_en.pdf Frank A. Coluccio DTI Consulting Inc. 212-587-8150 Office 347-526-6788 Mobile

1 0

Re: LA power outage?
by Fergie (Paul Ferguson) 14 Sep '05

14 Sep '05

It's also interesting to note that, at least by some estimates, the brief power outage in L.A. yesterday took down more networks than Hurrucane Katrina: http://www.techweb.com/showArticle.jhtml?articleID=170702966 Of course, So. California is pretty "network-dense", but what does that say about the level of seriousness that network operators place on their "uptime"? - ferg -- Steve Sobol <sjsobol(a)JustThe.net> wrote: Valdis.Kletnieks(a)vt.edu wrote: > On Mon, 12 Sep 2005 21:21:59 -0000, "Reeves, Rob" said: > >>We've been told by our field tech in LA that One Wilshire had lost power >>for a bit, but it is now restored. I don't know the duration of the >>outage, but our equipment there is on DC and did not go down. > > > So - who in LA is going to be telling Santa they want a new data-center sized > diesel UPS genset for Christmas? ;) More like, "which manager is telling Santa they want a new, clue-imbued employee for Christmas?" I'm not too close to the story and I don't live in Los Angeles (I live and work 55-65 miles northeast of downtown), but it seems to me that the problem could have been avoided with a little more caution on the part of the person who cut the wires. -- Steve Sobol, Professional Geek 888-480-4638 PGP: 0xE3AE35ED Company website: http://JustThe.net/ Personal blog, resume, portfolio: http://SteveSobol.com/ E: sjsobol(a)JustThe.net Snail: 22674 Motnocab Road, Apple Valley, CA 92307 -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

6 5

Re: Computer systems blamed for feeble hurricane response?
by Mike Tancsa 14 Sep '05

14 Sep '05

At 05:10 PM 13/09/2005, kent crispin wrote: >Port 587? Not everyone implements that. You would make a large part of the internet unreachable via email vinyl# telnet mx2.mail.yahoo.com 587 Trying 67.28.114.36... telnet: connect to address 67.28.114.36: Connection refused Trying 4.79.181.13... ---Mike

2 2