- Test - lists.nanog.org

Peering best practices advice needed.
by Rolo Tomassi 09 Dec '04

09 Dec '04

Hi all, Please forgive the simplistic nature of the query.. Basically my company is multi-homed with 2 different providers in the UK, and advertising a /18. Now some colleaguges in another part of the world want to break that /18 into two /19's and advertise one /19 and we advertise the other. This is fine, however we are NOT running IBGP in the core, therefore the UK customers in the /19 will not be able to reach the other /19 as there would be a loop detected through EBGP. Now someone mentioned that we could use AS-LOOP-IN feature which will overcome this problem and allow us to route to each other via EBGP. I really think this is a bad idea but until we get an internal link - I dont see a way forward. So... anyone doing this currently in their network or have any "best practices" way round this. I want our company to be good Netizens but still be able to pass traffic between the 2 /19's. Any help would be greatly appreciated. Rolo ! _________________________________________________________________ Stay in touch with absent friends - get MSN Messenger http://www.msn.co.uk/messenger

7 7

ASN and Peering Problem
by Adi Linden 09 Dec '04

09 Dec '04

We currently have two /19 that we advertise on a single ASN. A client would like to obtain /23 or /22 from us. This is not a problem, except that their primary internet provider is someone else, other than us. I think that they would need to have their own ASN to advertise their portion of our ip space to their peers. My question is, should we provide the ASN or should they apply for an ASN? What is the minimum block considered routable, is it reasaonable to advertise a /23 on its own ASN? Are there any other solutions I haven't thought of? Thanks, Adi

4 3

ddos?
by Dan Hollis 09 Dec '04

09 Dec '04

Anyone aware of ddos affecting savvis, level3, or qwest at the moment? -Dan

3 2

Re: Peering best practices advice needed.
by Richard Irving 08 Dec '04

08 Dec '04

acennami(a)neupath.com wrote: > That is what he is doing, however if he is advertising the two /19's, >from two disconnected sites with the same ASN, > they will not be able to reach each other as BGP will >interpret this as a path loop. Yup. I would presume, as they aren't connected, nor running iBGP, they would be running different ASN's. Anything else hurts. > On Wed, Dec 08, 2004 at 12:56:13PM -0500, Richard Irving wrote: > >>Rolo Tomassi wrote: >> >>>Hi all, >>> >>>Please forgive the simplistic nature of the query.. >>> >>>Basically my company is multi-homed with 2 different providers in the >>>UK, and advertising a /18. Now some colleaguges in another part of the >>>world want to break that /18 into two /19's and advertise one /19 and we >>>advertise the other. This is fine, however we are NOT running IBGP in >>>the core, therefore the UK customers in the /19 will not be able to >>>reach the other /19 as there would be a loop detected through EBGP. >> >> Pardon my simplistic solution, try dropping the /18, and -only- >>advertise the corresponding /19 from each region. >> >> >>>Now someone mentioned that we could use AS-LOOP-IN feature which will >>>overcome this problem and allow us to route to each other via EBGP. I >>>really think this is a bad idea but until we get an internal link - I >>>dont see a way forward. So... anyone doing this currently in their >>>network or have any "best practices" way round this. I want our company >>>to be good Netizens but still be able to pass traffic between the 2 /19's. >> >> See above. K.I.S.S. (No offense intended ;) >> >> >>>Any help would be greatly appreciated. >>> >>>Rolo ! >>> >>>_________________________________________________________________ >>>Stay in touch with absent friends - get MSN Messenger >>>http://www.msn.co.uk/messenger

1 0

wi.rr.com
by Jeffrey Sharpe 08 Dec '04

08 Dec '04

Could someone from Roadrunner contact me off-list please? ------------------------------------------------ Jeffrey Sharpe CyberLynk Helpdesk and Support 414.858.9335 or 800.942.8022 jsharpe(a)cyberlynk.net ------------------------------------------------

1 0

Trojan poses as Lycos Europe screensaver
by Fergie (Paul Ferguson) 08 Dec '04

08 Dec '04

This article made coffee come out of my nose. :-) - ferg http://news.com.com/Trojan+poses+as+Lycos+Europe+screen+saver/2100-7349_3-5… -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

Enterprise syslog management and alert generation.
by Bill Nash 08 Dec '04

08 Dec '04

Some people call this 'Netcool' or products of a similiar stripe. I'm ramping up a project to rebuild some previous work done on this front with an open source distribution in mind (those of you on the syslog-ng list have seen mention of it), so I'm fishing for requirements I may not have already covered. I currently have: Perl regexp engine for applied rules. Tokenization and extraction of data from inbound syslog data. Assigning (single|multiple) customized event handlers to rule matches Ability to run multiple analyzers concurrently Optional linear rule application versus weighted optimization SQL storage of rules for centralized management and redistribution. Fully customized alert generation. My current production implementation has handled over 20 gigs a day, at peak, on a single analyzer (dual amd 2800+), using syslog-ng as a transport mechanism (forked socket transport with local disk logging for backup). Every network is different, as are particular requirements. Who's got wish lists? I personally wouldn't mind an on-list discussion about this, as it applies to standard operations toolsets, but if that's not kosher, feel free to contact me off-list. - billn

2 2

RE: Enterprise syslog management and alert generation.
by Chad Skidmore 08 Dec '04

08 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Bill Nash [mailto:billn@billn.net] > Posted At: Tuesday, December 07, 2004 11:07 PM > Posted To: NANOG > Conversation: Enterprise syslog management and alert generation. > Subject: Re: Enterprise syslog management and alert generation. > > The X over time is a new one, it's been mentioned a couple > times today, and I can certainly account for it. I've added > it to my rapidly growing list. > > - billn > > As a current Netcool user that is one of several things that we've really come to like with their product. As Alexi says flexability in rules is HUGE, and is one of the reasons we've been very pleased with Netcool Omnibus. If there was an open source alternative I think it would be very attractive. I would agree that the rules engine is key. Oddly enough every operator is a little different and a solid (and easy to use) rules engine can make all the difference in the world. If you can be as good as Netcool then that is pretty impressive. Regards, Chad - ---------------------------- Chad E Skidmore One Eighty Networks, Inc. - AS12111 http://www.go180.net 509-688-8180 -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQbabgU2RUJ5udBnvEQJ9EgCfWpWU4L8cevOJLAy41dtYp0+q3uwAniE8 nqR+/s921KzHs/OkXNMdLUDn =efKB -----END PGP SIGNATURE-----

1 0

RE: Enterprise syslog management and alert generation.
by Paul Jasa 08 Dec '04

08 Dec '04

This is a topic near and dear to my heart. I've been using SEC for a while now, been very happy with it. If you like Perl and its regular expressions, SEC will do the trick. It has a very complex log correlation capabilities, and multiple action methods, strongly recommend it especially if used with syslog-ng http://sourceforge.net/projects/simple-evcorr BTW, the README and instructions on how to set it up and all the options is extremely well-written and thorough, you'll like it. pj ====================================== Paul ====================================== -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Alexei Roudnev Sent: Wednesday, December 08, 2004 12:52 AM To: Bill Nash; nanog(a)merit.edu Subject: Re: Enterprise syslog management and alert generation. In such products, only 20% value is in engine; 80% are in rules, because I can not wrire rules myself - I have not event until it happen, and I can not filetr out noice until it happen. We use a few syslog analyzers (using syslog-ng as a transport), some with simple logcheck, other with database for rules and hosts; and every time problem is the same - writing rules is 90% of the problem. But... do you have rules, such as fort example _send alert if any system began to generate 10 times logs / hour more vs. average? Or saying _single PCI ERROR on Solaris - ignore, 10 in a straight line - send warning... ----- Original Message ----- From: "Bill Nash" <billn(a)billn.net> To: <nanog(a)merit.edu> Sent: Tuesday, December 07, 2004 12:48 PM Subject: Enterprise syslog management and alert generation. > > > Some people call this 'Netcool' or products of a similiar stripe. I'm > ramping up a project to rebuild some previous work done on this front with > an open source distribution in mind (those of you on the syslog-ng list > have seen mention of it), so I'm fishing for requirements I may not have > already covered. > > I currently have: > Perl regexp engine for applied rules. > Tokenization and extraction of data from inbound syslog data. > Assigning (single|multiple) customized event handlers to rule matches > Ability to run multiple analyzers concurrently > Optional linear rule application versus weighted optimization > SQL storage of rules for centralized management and redistribution. > Fully customized alert generation. > > My current production implementation has handled over 20 gigs a day, at > peak, on a single analyzer (dual amd 2800+), using syslog-ng as a > transport mechanism (forked socket transport with local disk logging for > backup). > > Every network is different, as are particular requirements. Who's got wish > lists? I personally wouldn't mind an on-list discussion about this, as it > applies to standard operations toolsets, but if that's not kosher, feel > free to contact me off-list. > > - billn The information contained in this e-mail and any attached documents may be privileged, confidential and protected from disclosure. If you are not the intended recipient you may not read, copy, distribute or use this information. If you have received this communication in error, please notify the sender immediately by replying to this message and then delete it from your system.

1 0

Setting up DS-3 and 2 4xT1
by Joshua Brady 07 Dec '04

07 Dec '04

My apologies if some may find this a little off-topic. However, here is my issue. I need a router, which can take 2 4xT1's and a DS-3, while handing a Gbit for internal use. Now to complicate the entire situation, this needs to go into a 3 bedroom apartment, so I need to keep the power bills down if I can :) What would everyone recommend? Off-List replies are fine, I will summarize at the end. Thanks, Joshua Brady

6 5