- Test - lists.nanog.org

MPLS Book Recommendation
by Charlie Khanna - NextWeb 07 Oct '04

07 Oct '04

Hi, Can anyone recommend a good book on MPLS? I'm looking for something that will illustrate network design/implementation (including possible Cisco configs) with MPLS. Thanks! -Charlie

2 1

survey of maintenance time
by Zhen Wu 07 Oct '04

07 Oct '04

Dear administrators: I am a PhD student from Univ of Oregon. We are studying the characteristics of Internet routing instability. I have a very simple survey for the administrators. Do you mostly do the system maintenances during the weekend in order NOT to interfere network usage during weekdays? Here I mean maintenances like change routes, replace devices, change configurations... The more response, the better :) Your cooperations are greatly appreciated! Zhen Wu

1 0

CWDM Test Gear
by Deepak Jain 07 Oct '04

07 Oct '04

(If there is enough interest I will summarize to the list, or privately amongst the interested). Can anyone recommend a few relatively simple-to-use pieces of test equipment one could use to test say: a) the presense of a lambda [or multiple ones] in the CWDM range on a piece of metro fiber, b) the color of each lambda, c) other cool things. If the signal is there, the SFP can give us most of this info. The idea is that for set up, testing, repair of a working system I'm looking for a couple of out-of-band items that are relatively trivial. I don't want to deploy an OTDR test kit at every POP if I can avoid it. suggestions are appreciated! Thanks, Deepak Jain AiNET

1 0

RE: short Botnet list and Cashing in on DoS
by Hannigan, Martin 07 Oct '04

07 Oct '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > J. Oquendo > Sent: Thursday, October 07, 2004 1:11 AM > To: nanog(a)merit.edu > Subject: short Botnet list and Cashing in on DoS > > > > > > I've been slowly compiling a list of known botnets should > anyone care to filter, or check them in your netblocks if > someone in your > range is passing off garbage, etc. Information has been > passed from others > admins having to deal with these pest. Care to pass on a host > that you're > seeing I'll post it for others to see as well. Perhaps when I have > spare time, I may or may not throw up something where admins > can check, > add, hosts they're seeing. Don't know if I want my connection getting > toasted for doing so, but it could be something informative, a-la > spamhaus. Bothaus anyone? > > http://www.infiltrated.net/sdbot-irc-servers.txt > The problem with that is the list rapidly updates and must be maintained with some level of frequency and there's a level of trust involved in it as well. Going after the bots is lesser effort. The controllers are a priority. -M< -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan(a)verisign.com

5 4

spanned traffic routing
by Patrick Arguello 07 Oct '04

07 Oct '04

How can one take spanned packets from a mirroing port and use a L3 switch to "classify" and route it to different servers. Would it be the same if the packets were coming from passive taps? Worry I have is if the L3 switch ports would drop the spanned packets because the ports usually cannot be set to promiscuous mode. (Hopefully the L3 device that can do what I want ought not to be expensive.) Pls correspond directly with me Thanks! - Patrick A. --------------------------------- Do you Yahoo!? vote.yahoo.com - Register online to vote today!

1 0

Cracker U.
by frank＠dticonsulting.com 07 Oct '04

07 Oct '04

Try this, instead, if you are getting 404s: http://makeashorterlink.com/?B24816979 --------------- On Thu Oct 7 8:55 , Blaxthos <blaxthos(a)bash.org> sent: >http://www.technologyreview.com/articles/04/10/ap_2100504.asp\?trk=nl > >i get a 404 for that url > >8:55am CDT > >/blax On Thu Oct 7 8:11 , Randy Bush <randy(a)psg.com> sent: > >> "North Korea Has Some 600 Computer Hackers, South Korea Says" > >and in some years, they may catch up to the us > >randy >

1 0

Re: short Botnet list and Cashing in on DoS
by frank＠dticonsulting.com 07 Oct '04

07 Oct '04

Since we're posting articles this morning: "North Korea Has Some 600 Computer Hackers, South Korea Says" >From MIT's Tech Review Newsletter: "They don't need physical nukes to create problems ... They (the North Koreans) could just exploit our network vulnerabilities. It's completely doable." http://www.technologyreview.com/articles/04/10/ap_2100504.asp\?trk=nl frank(a)fttx.org On Thu Oct 7 0:10 , 'J. Oquendo' <sil(a)politrix.org> sent: > > > >I've been slowly compiling a list of known botnets should >anyone care to filter, or check them in your netblocks if someone in your >range is passing off garbage, etc. Information has been passed from others >admins having to deal with these pest. Care to pass on a host that you're >seeing I'll post it for others to see as well. Perhaps when I have >spare time, I may or may not throw up something where admins can check, >add, hosts they're seeing. Don't know if I want my connection getting >toasted for doing so, but it could be something informative, a-la >spamhaus. Bothaus anyone? > >http://www.infiltrated.net/sdbot-irc-servers.txt > > >------------- >Virus writers seek cash from chaos >By John Leyden >The Register >http://www.theregister.co.uk/2004/10/06/vxers_cash_in/ > >Last month Trend Micro, the anti-virus firm, recorded a six-fold increase >in malware compared to September 2003. It detected 1,485 new items of >malware last month, compared to 250 new types of malicious code in the >same period last year. > >... > >Trend also records the emergence of the first JPEG virus in September, and >notes that the most damaging variant of the Sasser worm - Sasser-B - is >still prevalent four months after its first appearance in the wild. >------------- > > >=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ >J. Oquendo >GPG Key ID 0x51F9D78D >Fingerprint 2A48 BA18 1851 4C99 > >CA22 0619 DB63 F2F7 51F9 D78D >http://pgp.mit.edu:11371/pks/lookup\?op=get&search=0x51F9D78D > >sil @ politrix . org http://www.politrix.org >sil @ infiltrated . net http://www.infiltrated.net > >"How can we account for our present situation unless we >believe that men high in this government are concerting >to deliver us to disaster?" Joseph McCarthy "America's >Retreat from Victory"

3 2

Routes Selection
by Abhishek Verma 07 Oct '04

07 Oct '04

Hi, Given two routes similar in preference (BGP steps) where each is received from a different ISP (or technically speaking an AS). How do I as a network operator decide which one to install in the forwarding table? Here goes the list of options that i have: (a) I can install both the routes in my FIB and split the traffic. Packet reordering would not be a problem as most of the modern routers hash packets based on the fields carried in the IP header. Thus similar packets would flow in same direction. OAM can be a minor issue. But its not something that is impossible to sort out. People have been anyway doing it for IGPs. (b) I could select one route based on *some* policy. I would love to get an insight on what kind of policies people use to route traffic. Now, I use just one route. The other comes live into action when the primary or my first one goes down. I get redundancy but I lose bandwidth. To save bandwidth I could write policies/routemaps/etc to send some traffic over one link and the remaining over the other. But then this is static and does not guarantee an equal or a just split of traffic. Any help/comments on this would be highly appreciated. Regards, Abhishek V. -- Class of 2004 Institute of Technology, BHU Varanasi, India

1 0

Leucadia Selloff
by Fergie (Paul Ferguson) 05 Oct '04

05 Oct '04

Leucadia National sold all of its MCI stock. The conglomerate filed an 8-K with the SEC stating that it sold its 5% stake in the carrier. According to the document the sale brought in a pre-tax profit of about $20 million for Leucadia. The investment company says the sale "should not be interpreted to mean that (Leucadia) is no longer interested in acquiring control of MCI, but no assurance can be given that (it) will acquire control of MCI." Leucadia in July filed for permission with the SEC to buy 50% of MCI's shares. http://www.nwfusion.com/edge/news/2004/0928mci.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

Re: NANOG 32 PGP key signing
by Jonathan McDowell 05 Oct '04

05 Oct '04

In article <20041004194249.1ac15275(a)216-80-33-36.drb-bsr1.chi-drb.il.cable.rcn.com> (earth.lists.nanog) you wrote: > Those of you attending NANOG 32 are encouraged to submit your public PGP > key to take part in the regular key signing event. ... > As usual, the group PGP signing event will occur following the nsp-sec > BoF on Monday night. Full details for the NANOG 32 PGP signing event > can be found here: > <http://www.nanog.org/pgp.html> There doesn't seem to be a lot of emphasis on identity verification according to this page. It only says "You might want to bring photo id with you". Personally, and all the keysignings I've been involved with and people I've spoken to about them, you should *always* verify government issue photo id when agreeing to sign someone's key. Len Sassaman's Efficient Group Key Signing Method is worth a read too. It's at: http://sion.quickie.net/keysigning.txt J. -- "Just because I'll spend 4 hours | .''`. Debian GNU/Linux Developer automating a task that takes 4 | : :' : Happy to accept PGP signed minutes by hand doesn't mean I'm | `. `' or encrypted mail - RSA + not lazy." -- Mike Sphar, asr | `- DSA keys on the keyservers.

2 1