- Test - lists.nanog.org

4 GB interface s HSRP with two Class C address block
by Joe Shen 13 May '04

13 May '04

Hi, We want to set up a resilent internet connection between backbone and outing going network by using 4 GB ethernet. It's demanded that the four GB ethernet connection are grouped into two GB channels ( two work horse + two backup), HSRP + STP are requirement to enable system reliablity. It's also expected to use 8 IP addresses for network i nterconnection between backbone and outgoing network. We plan to provide such service by using GB interfaces on two catalyst 6509. But, to my understanding if the two GB channels are configured with 2*4 interconnection IP addresses, STP is not required between our switches and customer's switches. And, the two GB channel could participate two HSRP groups, and acts as primary and standby sequently. GB Catalyst6509-A =================== Catalyst6509-B <- outgoing （layer2+layer3) || || || GB Channel || GB Channel || 2GB || Catalyst 2948G =================== Catalyst2948G <-Core ( maybe only layer2 ) network with two class C address To the topology above, I think the 8 interconnection IP addresses are not required. But, if the two GB channels are configured into one VLAN, the number of of host in one collision domain will be 2*256, this will surely derive to broadcast storm. I don't know how to set up IP routing in Layer 3 of 6509-A and 6509-B either. How could it done? Each word will be highly appreciated. Regards Joe Shen ---- Msg sent via Spymac Mail - http://www.spymac.com

1 0

Draft agenda for San Francisco
by Susan Harris 13 May '04

13 May '04

This may change - please keep an eye on www.nanog.org for updates, and see you next week! ---------------------------------------------------------------------- DRAFT AGENDA: NANOG 31 May 23-25, San Francisco Sunday Tutorials --------------- 1:30 - 3:00 p.m. BGP Techniques for Service Providers Level: Introductory/Intermediate Philip Smith, Cisco 1:30 - 3:00 p.m. Using IPsec to Encrypt Your Wireless Traffic at NANOG Level: Introductory, Hands-on Duane Wessels, Measurement Factory 3:00 - 3:30 p.m BREAK 3:30 - 5:00 p.m. BGP Techniques for Service Providers (cont'd.) 3:30 - 5:00 p.m. IS-IS Up to Date Level: Intermediate/Advanced Shankar Vemulapalli, Cisco Sunday Evening Reception ------------------------ 6:00 p.m. at a cool SF location :) Hosted by Switch and Data Monday, May 24 -------------- 9:00 a.m. Welcome, Introductions Susan Harris, Merit Duane Wessels, Measurement Factory Steve Feldman, CNET 9:15 a.m. BGP Wedgies: Bad Routing Policy Interactions that Cannot Be Debugged Tim Griffin, Intel, author Randy Bush, IIJ, presenter 9:45 a.m. IP Over Anything Blaine Christian, MCI 10:15 a.m. Implications of Securing Backbone Router Infrastructure Ryan McDowell, Sprint 10:35 a.m. BREAK 11:00 a.m. Benefits of Negotiated Interdomain Traffic Engineering Ratul Mahajan, David Wetherall, and Thomas Anderson, University of Washington 11:20 p.m. Verifying Wide-Area Routing Configuration Nick Feamster, MIT 12:00 p.m. LUNCH (on your own) 1:30 p.m. Case Studies in Intra-Domain Routing Instability Zhang Shu, Nat'l. Institute of Information and Communications Technology, Japan 2:00 p.m. Implementing Global Network Mobility using BGP Benjamin Abarbanel, Boeing 2:30 p.m. BGP Standards--What's Next? Sue Hares, NextHop 3:00 p.m. BREAK 3:30 p.m. Happy Packets - Initial Results Randy Bush, IIJ 4:00 p.m. Research Forum -------------- Predicting Public Internet Growth With Classical Economic Theory, or, The Wealth of Networks Tom Vest, eyeconomics.com In-Progress Research Designing Support for Troubleshooting Complex Network Problems Livio Ricciulli, Metanetworks Monday Evening BOFs & Key Signing --------------------------------- 7:30 - 9:00 p.m. ISP Security and NSP-SEC BOF V Danny McPherson, Arbor Merike Kaeo, moderators 9:00 - 10:30 p.m. What Does NANOG Want the IETF to Do? Harald Alvestrand, Cisco Alex Zinin, Alcatel, moderators 9:00 p.m. PGP Key Signing Party Joe Abley, ISC, host Tuesday, February 10 -------------------- 9:00 a.m. Appropriate Layer 2 Interconnection Between IXPs Keith Mitchell, XchangePoint 9:30 a.m. Evolution of the U.S. Peering Ecosystem Bill Norton, Equinix 10:15 a.m. BREAK 10:45 a.m. IPv6 IPv4 Threat Comparison Darrin Miller and Sean Convery, Cisco 11:15 a.m. Panel: Network Augmentation--Experiences in Adding IPv6 Services/Support to Existing IPv4 Networks Bill Manning, moderator Rob Rockell, Sprint Brent Sweeny, Internet2 NOC Ed Lewis, ARIN 12:00 p.m. LUNCH (on your own) 1:30 p.m. Coherent Naming Schemes: A Case Study Matthew F. Ringel, Tufts University 2:00 p.m. Tulip: A Tool for Locating Performance Problems Along Internet Paths Ratul Mahajan, Neil Spring, David Wetherall, and Thomas Anderson, University of Washington 2:20 p.m. Near Real-Time Publication of Allocated Netblocks Leo Bicknell, AboveNet Cathy Wittbrodt 2:40 p.m. Preparing RIR Allocation Data for Network Security Analysis Tasks Brian Trammell, CERT 3:00 p.m. Integrated Security for SNMP-Based Management Wes Hardaker, Sparta 3:15 p.m. Adjourn

1 0

RE: BGP Exploit
by Mark Johnson 13 May '04

13 May '04

Hi, > > What if sessions were attacked without MD5 in place. We > would just see > > session resets. As these happen anyway frequently at > peering points is > > there > > any straightforward way to determine if the vulnerability > caused the > > reset? > > If you're referring to session resets because of a peer or user > action then something akin to "Last reset due to FOO" can likely > be gleaned from "show bgp neighbor" output, especially since BGP > performs "graceful shutdown" via notification messages under normal > conditions I think what I'm trying to ask is: 1. Does anyone know if the exploit is actually being used? and 2. I assume there is no way to identify an exploit reset from the usual resets caused by routers hanging, ports failing, DDoS's, etc. However, I thought I'd ask... Kind regards, Mark

2 1

RE: Worms versus Bots
by Michel Py 13 May '04

13 May '04

> William wrote: > but in our ISP office I setup new win2000 servers and first > thing I do is download all the patches. I've yet to see the > server get infected in the 20-30 minutes it takes to finish it It can happen in 5 or 10 minutes (I've seen it) but only if all of the following conditions are met simultaneously: a) administrator's password blank (or something _really_ easy to guess) b) public IP (no NAT) c) no firewall In other words: if one is stupid, one gets worm'ed or bot'ed. > (Note: I also disable IIS just in case until > everything is patched..). Not a bad idea, but sometimes you don't have the choice of doing it (with scripted installs or things like SBS). Besides, IIS is not the main source of trouble on a machine that sits on the Internet unprotected. I consider disabling IIS a second or third line of defense, to be used after you implemented the steps not to get screwed in the first place (which you described). > Similarly when settting up computers for several of my > relatives (all have dsl) I've yet to see any infection > before all updates are installed. Me too. > Additional to that many users have dsl router or similar > device and many such beasts will provide NATed ip block > and act like a firewall not allowing outside servers to > actually connect to your home computer. Indeed. I have a $10 one that I use for installations (even when I install from a "trusted" environment), because the danger does not come only from the Internet, it can also come from your own LAN. By putting the machine being installed alone on its own segment behind a NAT box, you also shield yourself from crud that could be on the trusted network. > On this point it would be really interested to see what > percentage of users actually have these routers and if > decreasing speed of infections by new virus (is there > real numbers to show it decreased?) have anything to > do with this rather then people being more carefull and > using antivirus. Difficult to measure, and here's why: recent worms are polymorphic and propagate/replicate using many different mechanisms. How do you make the difference between a) a worm that arrived trough email and then contaminated x machines on your LAN and b) a worm that arrived through a vulnerability of IIS and then contaminated x machines on your LAN? The trouble here is that if you had all the time in the world _and_ if you did not have x users screaming, you could look at logs and such and finally figure out which of the egg or the chicken was first. In a real world, you clean the mess and when you are done you have to catch up with all the stuff you did not do while cleaning, and you never know. Michel.

17 24

RADB dup lookup?
by Hank Nussbacher 13 May '04

13 May '04

Merit people, Either this link should be taken down or fixed to work: http://www.ra.net/cgi-bin/ra/radb-duplicates.pl Regards, Hank

1 0

RE: Worms versus Bots
by Michel Py 13 May '04

13 May '04

> Jonathan M. Slivko > Uh... they have. It's called a Snapgear card :) Same as the 3com card, this is not for the consumer market. First, the consumer is generally afraid of opening the PC. Second, it costs many times more than a Linksys or other el-cheapo external box. Michel.

1 0

RE: Worms versus Bots
by Michel Py 13 May '04

13 May '04

> Chris Woodfield wrote: > I stand corrected, they're out there. I'm advised that > 3com has a on-NIC firewall product as well. > However, at $299 and $329 respectively, I don't anticipate > wide adoption in the consumer market... No danger, as it is not worth jack as a standalone product; requires a centralized server to tell it what to do. Not for the consumer market in the first place. Even for the corporate market, $300 + the server + managing the whole enchilada == to much $$$ per port. Michel.

1 0

nsp-sec BoF agenda
by Merike Kaeo 12 May '04

12 May '04

Hello all. Danny and I will be moderating (facilitating) the upcoming nsp-security BoF at NANOG. Below is the agenda..... >================================================== >NSP Security BOF >Monday Evening, May 24, 2004 >Chairs: Merike Kaeo & Danny McPherson > >AGENDA: > >Barry Dykes/Viawest: DOS/Security Incident Handling (~10 minutes) >Roland Dobbins/Cisco IT: DOS/Security Incident Handling (~10 minutes) >Michael Bailey & Evan Cooke/UoM: IMS (~15 minutes) >Blaine Christian/MCI:TTL Filterings (~15 minutes) >Dave Ward/Cisco: BGP over IPSEC (~15 minutes) >Wendy Garvin/Cisco PSIRT: TCP Vulnerability (~15 minutes) >Chairs/Open Discussion: TCP Vulnerability Q & A (~15 minutes) >Patrick Gilmore/Open Discussion: Responding to Vulnerability Rumors (~15 >minutes) >Open Floor for Discussions - merike and danny - merike

1 0

RE: BGP Exploit
by Mark Johnson 12 May '04

12 May '04

Hi, > What would a Cisco log if the IP's for the BGP sessions were > attacked & MD5 > was in place ? What if sessions were attacked without MD5 in place. We would just see session resets. As these happen anyway frequently at peering points is there any straightforward way to determine if the vulnerability caused the reset? Kind regards, Mark

2 1

Spamcop
by Vicky Rode 12 May '04

12 May '04

Hi there, Just wondering why was my e-mail thread (Hierarchical Credit-based Queuing (HCQ): QoS) dated 5/9/2004 9:36 PM reported as a spam? Just trying to understand so that I don't repeat it. Below is a cut and paste of the reported incident. Please advice. regards, /vicky ---- cut here ------ Return-Path: <988145978(a)bounces.spamcop.net> Received: from vamx01.mgw.rr.com ([24.28.193.148]) by acme-reston.va.rr.com (Post.Office MTA v3.5.3 release 223 ID# 0-59787U250000L250000S0V35) with SMTP id com for <abuse(a)rr.com>; Mon, 10 May 2004 10:42:14 -0400 Received: from vmx2.spamcop.net (vmx2.spamcop.net [206.14.107.117]) by vamx01.mgw.rr.com (8.12.10/8.12.8) with ESMTP id i4AEkwhn017175 for <abuse(a)rr.com>; Mon, 10 May 2004 10:47:01 -0400 (EDT) Received: from sc-app3.verio.ironport.com (HELO spamcop.net) (192.168.11.203) by vmx2.spamcop.net with SMTP; 10 May 2004 07:47:00 -0700 Received: from [68.13.211.63] by spamcop.net with HTTP; Mon, 10 May 2004 14:47:01 GMT From: 988145978(a)reports.spamcop.net To: abuse(a)rr.com Subject: [SpamCop (24.30.181.126) id:988145978]Hierarchical Credit-based Queuing (HCQ): QoS Precedence: list Message-ID: <rid_988145978(a)msgid.spamcop.net> Date: Sun, 9 May 2004 21:36:30 -0700 (PDT) X-SpamCop-sourceip: 24.30.181.126 X-Mailer: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705) via http://www.spamcop.net/ v1.3.4 X-Virus-Scanned: Symantec AntiVirus Scan Engine [ SpamCop V1.3.4 ] This message is brief for your comfort. Please use links below for details. Email from 24.30.181.126 / Sun, 9 May 2004 21:36:30 -0700 (PDT) http://www.spamcop.net/w3m?i=z988145978zab5cec781dcfa15ae459c11bd03b7bef z [ Offending message ] Return-path: <owner-x> Envelope-to: x Delivery-date: Mon, 10 May 2004 00:39:15 -0400 Received: from [198.108.1.26] (helo=trapdoor.merit.edu) by wilma.widomaker.com with esmtp (Exim 3.36 #1) id 1BN2ZP-000Jo6-00 for x; Mon, 10 May 2004 00:39:15 -0400 Received: by trapdoor.merit.edu (Postfix) id B68EC91206; Mon, 10 May 2004 00:36:37 -0400 (EDT) Delivered-To: x Received: by trapdoor.merit.edu (Postfix, from userid 56) id 8645591243; Mon, 10 May 2004 00:36:37 -0400 (EDT) Delivered-To: x Received: from segue.merit.edu (segue.merit.edu [198.108.1.41]) by trapdoor.merit.edu (Postfix) with ESMTP id 50AFD91206 for <x>; Mon, 10 May 2004 00:36:34 -0400 (EDT) Received: by segue.merit.edu (Postfix) id 3B3955914F; Mon, 10 May 2004 00:36:34 -0400 (EDT) Delivered-To: x Received: from ms-smtp-02-eri0.socal.rr.com (ms-smtp-02-qfe0.socal.rr.com [66.75.162.134]) by segue.merit.edu (Postfix) with ESMTP id EAB7358E5D for <x>; Mon, 10 May 2004 00:36:33 -0400 (EDT) Received: from [192.168.2.2] (cpe-24-30-181-126.socal.rr.com [24.30.181.126]) by ms-smtp-02-eri0.socal.rr.com (8.12.10/8.12.7) with ESMTP id i4A4aUce025659 for <x>; Sun, 9 May 2004 21:36:30 -0700 (PDT) Message-ID: <409F________0602(a)socal.rr.com> Date: Sun, 09 May 2004 21:36:41 -0700 From: Vicky Rode <vickyr(a)socal.rr.com> Reply-To: vickyr(a)socal.rr.com User-Agent: Mozilla Thunderbird 0.6 (Windows/20040502) X-Accept-Language: en-us, en MIME-Version: 1.0 To: x Subject: Hierarchical Credit-based Queuing (HCQ): QoS X-Enigmail-Version: 0.83.6.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: Symantec AntiVirus Scan Engine Sender: owner-x Precedence: bulk Errors-To: owner-nanog-outgoing(a)merit.edu X-Loop: nanog Hi there, Just wondering if anyone out there has either implemented or looked into this queuing method for quality of service implementation. This solution is offered (hardware solution) and patented by foursticks.com. According to foursticks, "HCQ achieves the efficiency and flexibility of first generation queuing systems, without the disadvantages." It compares HCQ (interesting reading) w/ Class-Based Queuing (CBQ), Random Early Discard (RED) and Weighted Random Early Discard (WRED),Weighted Fair Queuing (WFQ),Priority Queuing (PQ) & Low Latency Queuing (LLQ). Also can anyone recommend a qos forum which I can ping as well. Any insight will be appreciated. regards, /vicky

9 10