- Test - lists.nanog.org

Intelligent Automation of network tasks
by Ejay Hire 07 Dec '04

07 Dec '04

In my opinion, every network with more than a dozen or so routers needs an automated method to distribute massive configuration changes. There is a lot of fear that something will break during updates, but with some intelligence, that risk can be minimized. Related to this, here is how I distribute Bogons, cognizant of the fact that the system has to be smart enough not to break anything in the event a telnet session breaks. So, here is what I send to my routers.. No ip prefix-list bogons ip prefix-list bogon seq 1 permit 0.0.0.0/0 Ip prefix-list bogon deny 0.0.0.0/7 le 32 Ip prefix-list bogon deny 2.0.0.0/8 le 32 <snip> Ip prefix-list bogon deny 197.0.0.0/8 le 32 Ip prefix-list bogon deny 223.0.0.0/8 le 32 ip prefix-list bogon permit 0.0.0.0/0 le 27 No ip prefix-list bogon seq 1 permit 0.0.0.0/0 Worst case scenario, I break my bogon filters... and that happens very very rarely. The same logic can be applied to access-list using named access lists. Hopefully that will help someone. -ejay

4 3

RE: Intelligent Automation of network tasks
by Hannigan, Martin 07 Dec '04

07 Dec '04

Call me sentimental, but I was using/making my previous staff use rtrmon in the absence of big OSS systems. I believe it's still up at ISC somewhere. I can't remember if it has a "glob all" function. I do remember it would probably be easy enough to integrate. -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan(a)verisign.com > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Tuesday, December 07, 2004 1:54 PM > To: Ejay Hire > Cc: nanog(a)merit.edu > Subject: Re: Intelligent Automation of network tasks > > > > On Tue, Dec 07, 2004 at 12:39:25PM -0600, Ejay Hire wrote: > > > > In my opinion, every network with more than a dozen or so > routers needs > > an automated method to distribute massive configuration > changes. There > > is a lot of fear that something will break during updates, > but with some > > intelligence, that risk can be minimized. > > juniper and cisco both support taking machine generated > configurations generated by a non-router device (eg: unix host). > > http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/product s_feature_guide09186a00801d1dc2.html it's not just in 12.3T, it's also in 12.2S.. on your juniper, try something like "config, load override" - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

Trojaned versions of Makelovenotspam doing the rounds ...
by suresh＠outblaze.com 07 Dec '04

07 Dec '04

What a surprise (or not!) http://www.theregister.co.uk/2004/12/07/fake_lycos_screensaver_trojan/ > Virus writers have begun distributing their wares in emails that pose as > Lycos's abandoned "Make love not spam" screensaver. > > The fake screensaver emails contain an attachment with a RAR SFX archive that > has embedded key logger Trojan inside, antivirus firm Sophos warns. Infected > emails come in emails with subject lines such as "Be the first to fight spam > with Lycos screen" and an attachment called "Lycos screensaver to fight > spam.zip". > > Upon successful installation, the key logging Trojan (Mdropper-IT) sends a > message to an Indonesian email address confirming its status. The screensaver > file, rather than displaying the Lycos screensaver, displays a blank screen. [snip]

1 0

Remote sites, aggregates and more-specific routes
by Sam Stickland 07 Dec '04

07 Dec '04

Hi, We currently announce our entire range as the largest possible aggregates. We are about to add the first site that's a sizable distance away. The link to the remote site is relatively expensive, so we don't want to have to backhaul traffic between the sites if we can help it. We seem to have the following options available: 1) Announce the greater aggregate at both ends, and risk having to haul traffic between the sites ourselves. 2) Deaggregate our ranges completely. I don't particulary want to do this, since the predicted 80/20 split in IP address usage across the sites will create a quite a few new routes in the ever growing table. 3) Only announce more-specifics at the remote site, and tag the more specific routes NO-EXPORT if we peer with the AS in both locations. Am I right in thinking that #3 seems is the best option? AFAICS it adds no new unnecessary routes to the global table (outside of our immediate peers and transit providers) and still keeps unneccessary traffic off of the intersite link. Are there any options I missed? Sam

1 0

RE: Unflattering comments about ISPs and DDOS
by J. Oquendo 07 Dec '04

07 Dec '04

> "reconfigure their mail programs to point at Comcast's > servers, and each phone call to the help desk costs $9." And they couldn't spend say: $1.00 per CD with a vb script or instructions on doing this $100.00 (far fetched price) to have an interactive step-by-step flash video created to show their customers $1000.00 (far fetched price) to set up some VXML based number with a "Press 1 to RTFM... Press 2 to RTFM again" Even at an uber high charge (800/866 toll) of say $4.00 per call, they could still implement the changes save tons of money, and tons of aspirin when their headaches go away. Maybe someone here can draft up a $10,000,000.00 pitch it to them become an instant millionaire and save Comcast some money at the same time. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

4 3

using sniffer on high-bandwidth pipes
by todd romero 07 Dec '04

07 Dec '04

does anyone have expirience using a sniffer on a hi-capacity network segment, that might know if there are limitations I need to worry about? example: customers doing EMC database replication across a mpls link, and when the capacity reaches aprox. 250 Mbp/s packets are arriving out of sequence etc. So we need to put sniffers on both sides to capture some data to see whats happeneing when the capacity reaches 250mbps. what kind of system requirements would be needed to be able to be able to capture that amount of data. For some reason, I dont think that the Dolch Pac 65 sniffers we have (running nt4 and sniffer pro2) would be able to handle that kind of data? If they cant, we can probbaly use a sun box. what kind of specs would the box need? tia, tr

8 7

Neutral Colo - Las Vegas, NV
by Charlie Khanna - NextWeb 07 Dec '04

07 Dec '04

Hi, Can anyone tell me if there are any carrier neutral data centers in Las Vegas, NV? Thanks. -Charlie

1 0

Unflattering comments about ISPs and DDOS
by Michael.Dillon＠radianz.com 07 Dec '04

07 Dec '04

This article in ZDNET UK entitled "WIth ISPs like this, who needs enemies?" http://comment.zdnet.co.uk/andrewdonoghue/0,39027004,39175983,00.htm contains some rather unflattering comments about ISPs who don't help customers deal with DDOS attacks. The head of security technology for a major ISP named in the article said: "Why should ISPs do something? It's very much as if people want something for nothing. This noise is superfluous and silly." The thinking is this. There are two operational problems here, one big and one small. The big one is when your customer is the target of DDoS. The small one is when your customers originate the DDoS. I think the writer is telling us to treat these as two sides of the same problem. If management buys into this view then it would make the business case for the operational effort needed to clean up botnets. And if enough people clean up the bots on their network, then a case can be made for depeering (or severely damping) networks that don't clean up their act. --Michael Dillon

6 5

LG close to MCI Japan anyone?
by Elmar K. Bins 07 Dec '04

07 Dec '04

Hi there, I'm currently searching for a looking glass close to AS703 in Japan. Unfortunately, JPIX doesn't offer one (would have been to easy anyway). Any pointers? Yours, Elmar. PS: Whoever maintains traceroute.org and is on the list: Very many of the listed RS and LGs are offline and some have been for quite a while.

3 2

RE: Bangladesh gets itself an IXP
by Majid Farid 07 Dec '04

07 Dec '04

Also http://www.pie.net.pk/ for Pakistan. -- Majid. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Suresh Ramasubramanian Sent: Monday, December 06, 2004 8:56 AM To: nanog(a)nanog.org Subject: Bangladesh gets itself an IXP http://www.bdix.net looks quite good to me. Open peering, with over 10 local ISPs peering there. What a change from the joke that is NIXI (www.nixi.org) in India .. srs (depressed)

2 1