- Test - lists.nanog.org

Assymetric Routing / Statefull Inspection Firewall
by Mike Turner 17 Mar '04

17 Mar '04

Hello Everyone, I am currently looking for a statefull inspection firewall that support asymmetric routing - is there such a product? I cannot imagine that I am the only person with redundant Internet connectivity, that would like to put firewalls near the edge of our network. Any thoughts / Suggestions would be greatly appreciated! Thanks, Mike

5 4

who offers cheap (personal) 1U colo?
by Paul Vixie 17 Mar '04

17 Mar '04

every time i tell somebody that they shouldn't bother trying to send e-mail from their dsl or cablemodem ip address due to the unlikelihood of a well staffed and well trained and empowered abuse desk defending the reputation of that address space, i also say "buy a 1U and put it someplace with a real abuse desk, and use your dsl or cablemodem to tunnel to that place." and then a few questions come in -- "where can i put a 1U for the $50/month you claim is possible?" so as a public service i've decided to gather some answers to that question and put them on the web someplace so i can refer folks to it when i'm asked. if you know of a place that offers 1U/month for $50/month with some kind of bandwidth limitations (moderate peak, low average), and a strong abuse desk (including repossessing the 1U server upon proof of abuse or neglect), please send me e-mail with a url and some details. i'll summarize it all online and report the aggregation URL back to this mailing list.

34 73

Managing Network Monitoring Equipment (RFC)
by Andrew D Kirch 17 Mar '04

17 Mar '04

As I was trolling through SlashDot's Star Trek's Design Influence On Palm, New Tech (please don't shoot me), I came upon a series of posts (cited below) that almost got to the point of a problem I'm having: My network monitoring is hard to use, network monitoring has no standard, nor prepackaged equipment capable of doing it with minimal installation time or turnaround because of this network monitoring and lan analysis varies GREATLY between sites, and between companies. This results in increased training costs, and increased acclimation time for new administrators. Also untrained NOC staff (the poor sap most companies have doing third shift and overnight NOC work) will not be able to use or understand display output from these systems. The solution to this problem is complex, but a feature set becomes apparent: Theory: (from posts on slashdot) That brings up an interesting thought. Perhaps if interfaces were designed to be intelligible on TV, they'd be more usable in reality, too. Think about it. People watching the show may not know anything about computers, but they still had to understand the occasional piece of information that was important to the plot. (One good example would be when Dr. Crusher was caught in her son's experimental warp bubble. She didn't know where she really was until she saw (and the viewer) saw a picture of the "nature of the universe" and recognized it as something she (and the viewer) saw on one of Wesley's screens in Engineering. That kind of driving force behind usability would probably be beneficial to general use of computers. >From the Star Trek Technical Manual - Page 34 We incorporated the concept of software-definable, task specific panel layout into our controls because Mike (Okuda) thought it a logical way of simplifying designs that would otherwise have been nightmarishly complex. The basic idea is that the panels automatically reconfigure themselves to suit the specific task at hand. Practice: (these are from posts on slashdot) Here in Australia, our new combat "Collins" class subs had a user interfce designed by committee. It took 13 button presses to designate a target and launch a torpedo. The generals, when assessing this new sub, complained that the UI in a Playstation game to at most three clicks to designate a target and launch; why can't a multi-billion dollar sub work like that. The contractor then employed some game UI designers to rewrite the combat system. Many years ago, in 1972, I modelled a UI after the displays in "2001". This was a 24x80 text display on a TV showing the status of a mainframe computer. The upper half of the screen showed constantly updated status information. Ever few seconds, the lower half of the screen switched to a new screen, alternating between a memory map, a job list, status messages, and requested operator input. High priority messages would immediately preempt the lower half of the screen. This was a big hit. People would stand outside the glass computer room wall to watch. It was self-explanatory enough that people could follow it effectively. from one of my admins: "You know, network monitoring should look something like the Astrometrics Lab on Voyager" My thoughts on the matter as follows: 1. The system should never suffer from a lack of display area, or attempt to compact data into a small display area, it should be easy to understand, and easy to monitor even from a distance. This means that the solution will need to be multiple monitors, preferably with touch-screen support, and a logically structured device based (be it a server, a vlan, a managed switch, or a router) navigation method. The control surface and the display surface should not be discrete, they should in fact be the same device. 2. There is already a wealth of GOOD, and free lan analysis software out there (MRTG, nettraf, Etherape, Ethereal, tcpdump, syslog, Nettop, Statnet, phpSysInfo, argus, etc.) What this means is that we don't need to reinvent the wheel, merely put it on the car in such a manner that it gets the user from point A to point B without any real concious thought, without diluting the tool in question. 3. This system should be capable of being distributed throughout the topography and capable of tunneling data with minimal impact on firewalls, or the current network configuration. It should also in whole take a minimal amount of time to configure and configuration of such a system should not require a reconfiguration of the whole network. Also configuration should be kept separate from normal use, and it should be "ready-to-use" out of the box. My questions are these, is there any use for such a product? What do you use in LAN and network monitoring? Where are the largest UI hiccups? What do you want but don't see in your current solution? When you leave is your staff able to interpret data from your equipment effectively? Could the whole process be sped up? I would also like to take a seperate moment to apologize to Mister Hallacy, it appears we are both being played with, and he has been greatly helpful in this matter. Thank you for your time and consideration, and your patience with my ill-concieved and offtopic posts over the last few days. -- Andrew D Kirch | Abusive Hosts Blocking List | www.ahbl.org Security Admin | Summit Open Source Development Group | www.sosdg.org Key At http://www.2mbit.com/~trelane/trelane.key Key fingerprint = B4C2 8083 648B 37A2 4CCE 61D3 16D6 995D 026F 20CF

1 0

GigE High-Availability + Link Aggregation
by Jason McCormick 17 Mar '04

17 Mar '04

Hello all, I'm trying to price and buy a network setup for a high-availability GigE situation that requires link aggregation. In a simplistic example, my need is to have, Host A with 2 GigE NICs (copper) that are link aggregated with 802.3ad but each "side" is run to a different switch with a host Host B on the other side configured in the same manner. For example: +----------------+ /--| GigE Switch 1 |--\ | +----------------+ | / \ NIC1-/ \-NIC1 HOST A -= =- Host B NIC2-\ /-NIC2 \ / | +----------------+ | \--| GigE Switch 2 |--/ +----------------+ In this example, Host A would have an IP of 10.0.0.1 that would be aggregated on both NIC1 and NIC2 to provide 2Gbps through put and Host B would have 10.0.0.2 with link aggregation. The theory to this being that I can kill two birds with one stone and provide 2Gbps throughput while having the high-availability. If Switch1 dies, throughput drops to 1Gbps but the endpoints are still available and vise-versa. If I'm understanding 802.3ad properly, the aggregates have to be on the same switch or at least in the same "stack" and can't be passed along on-wire in the same way that other tagged protocols can (such as VLAN tags). Maybe I'm wrong on this? As usual, cost is a MAJOR constraint (when isn't it?!?) and I'm looking for the cheapest possible solution. Can anyone recommend a product/products that would accomplish this for me? I'm trying to keep the price < $6000 if possible. If you feel this is off-topic, please feel free to reply to me personally. Thanks a lot in advance! -- Jason McCormick jason(a)devrandom.org GPG Key ID: 96D6CF63

1 1

Re: Packet Kiddies Invade NANOG
by Michael.Dillon＠radianz.com 17 Mar '04

17 Mar '04

People should be worried about stuff like this. Banetele is a facilities-based network operator in Norway and these guys are directly attacking their BGP sessions to put them off the air. Assuming that they are not sourcing the attacks in Banetele's AS, then you, the peer of Banetele are delivering the packet stream that kills the BGP session. How long before peering agreements require ACLs in border routers so that only BGP peering routers can source traffic destined to your BGP speaking routers? (08:48:02) <#sigdie!OseK_> i just collapsed banetele's BGP announcement (08:48:43) <#sigdie!p> i dunno banetele looks dead (08:48:48) <#sigdie!p> or maybe im just lagging (08:49:00) <#sigdie!OseK_> ... BitchX: Sent server ping to [irc.banetele.no] (08:49:00) <#sigdie!OseK_> ... Server pong from irc.banetele.no 0.8224 seconds (08:49:12) <#sigdie!p> bash-2.05a$ telnetirc.banetele.no 6667 (08:49:13) <#sigdie!p> Trying 213.239.111.2... (08:49:16) <#sigdie!OseK_> thats cuz I collapsed their BGP announcement by nailing their router head on(08:49:26) <#sigdie!OseK_> but they have a secondary route to efnet (08:49:30) <#sigdie!_mre|42o> BGP announcement? (08:49:31) <#sigdie!OseK_> thru their multihomed connection (08:49:32) <#sigdie!OseK_> yeah (08:49:37) <#sigdie!OseK_> they have a collapsable route (08:49:44) <#sigdie!OseK_> using the border gateway protocl (08:49:54) <#sigdie!OseK_> hey have to announce to a pool (08:49:58) <#sigdie!OseK_> in order to establish their route (08:50:07) <#sigdie!OseK_> but if thye get hit enough their router drops the announcements (08:50:10) <#sigdie!OseK_> and they lose their routes (08:50:14) <#sigdie!OseK_> its wierd (08:50:21) <#sigdie!OseK_> i dont quite understand how it works myself

7 6

RE: Firewall opinions wanted please
by Burton, Chris 17 Mar '04

17 Mar '04

Depends on many aspects; performance, management, and logging features. I personally recommend Checkpoint FW-1 Express for a smaller site if you want easy configuration and a great logging interface; though the pricing may not be what you are looking for. Cisco PIX is also great but the management and logging aspects in my opinion are not up to par with Checkpoint on the lower price end (i.e. Without investment in other management tools). It goes back to what you and anyone supporting the platform will be comfortable with. Chris Burton Network Engineer Walt Disney Internet Group: Network Services The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact Walt Disney Internet Group at 206-664-4000. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Nicole Sent: Tuesday, March 16, 2004 2:27 PM To: nanog(a)nanog.org Subject: Firewall opinions wanted please Hi I am looking for a good but reasonably priced firewall for a 40 or so server site. Some people swear by Pix, others swear at it a lot. Also I have heard good things about Netscreen. Or any others you would recommend for protecting servers on a busy network. Don't really need anything with VPN just the standard http, ftp, ssh, https, type traffic up to 100mb throughput. From what I have heard a proxy firewall would be best? Thanks in advance!! Nicole -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ " Daemons" will now be known as "spiritual guides" -Politically Correct UNIX Page

1 0

verisignmail.com RBL Contact
by Mark Foster 16 Mar '04

16 Mar '04

If anyone on here is from the powers-that-be behind the verisignmail.com RBL - or infact anyone from Verisign Security - could they please contact me offlist regarding an ongoing (2 month!) issue regarding mail delivery. Thanks, and sorry for the noise (again!). Mark.

1 0

RE: Cisco website www.cisco.com 403 forbidden?
by Robert A. Hayden 16 Mar '04

16 Mar '04

Still 404s on me now when I try to log into CCO or follow any of my bookmarks to case query, pricelist, or TAC Case generation. Todays excuse of the day is: <flip> <flip> <flip> SUNSPOTS! On Mon, 15 Mar 2004, Todd Mitchell - lists wrote: > > | Behalf Of Jay Hennigan > | Sent: March 15, 2004 3:19 PM > | > | Is it just me that they don't like? > > All fixed now, but load times are hella slow: > > phoenix:~# curl -I cisco.com > HTTP/1.1 200 OK > Date: Mon, 15 Mar 2004 20:40:53 GMT > Server: Apache/1.0 (Unix) > Set-Cookie: CP_GUTC=209.123.169.252.240801079383253714; path=/; expires=Fri, > 09-Mar-29 20:40:53 GMT; domain=.cisco.com > Connection: close > Content-Type: text/html > > Todd > > -- >

3 2

2001:590::/32 announced by both AS4436 (nLayer) and AS4474 (Global Village, no contact in whois, but seems to be nLayer...)
by Jeroen Massar 16 Mar '04

16 Mar '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [cc: to hostmaster(a)arin.net, maybe now it will get their attention instead of going into /dev/null] Hi, Here is some operational content, instead of Packet Kiddies trying to rape each other verbally ;) According to Toshikazu Saito (Powerdcom): > I know both ASs, 4436 and 4474 are yours, so > nlayer should resolve this problem or respond to this. But: OrgName: Global Village Communication, Inc. OrgID: GVC-8 Address: 1144 East Arques Avenue City: Sunnyvale StateProv: CA PostalCode: 94086 Country: US ASNumber: 4474 ASName: GVIL1 ASHandle: AS4474 Comment: The information for this ASN has been reported to Comment: be invalid. ARIN has attempted to obtain updated data, but has Comment: been unsuccessful. To provide current contact information, Comment: please e-mail hostmaster(a)arin.net. RegDate: 1995-03-08 Updated: 2003-07-31 The reason for the above was that we are currently seeing 2001:590::/32 announced by both AS4436 (nLayer) and AS4474 (Global Village Communication) but apparently this is the same company and apparently they are using the bogus ASN. Bogus as it has no valid contact information See telnet://grh.sixxs.net or http://www.sixxs.net/tools/grh/lg/?find=2001:590::/32 for the odd routes and who it goes over. As nLayer seems to be able to only send ticket responses but there seems to be no real user alive maybe it is time to start letting their peers ask them what to do with this and if they can't contact them to just start depeering? Unresponsive "NOC"'s is a real nightmare. Greets, Jeroen -----BEGIN PGP SIGNATURE----- Version: Unfix PGP for Outlook Comment: Jeroen Massar / http://unfix.org/~jeroen/ iQBGBAERAgAQCRApqihSMz58IwUCQFb4WAAAoTsAniiZQnM0LhXbVJD7keZCNu6f CM2OAKCPs2tdOfwt49m8/xLnugqyGRMnGA== =ePKi -----END PGP SIGNATURE-----

7 11

Re: Stateful Ethernet Bridging and it's effect on overall Internet topology.
by Gregory Taylor 16 Mar '04

16 Mar '04

I agree, however there are some implementations of this type of bridging that 'routing' would not be a good substitute for. Say mangling traffic going outbound for compression purposes (A La Redline (Yes I know redline does proxying and not bridging)). I guess my best question would be, is there a solution to the problem. Maybe a possible way of bridging the traffic without polluting the world with unnecessary broadcasts of MAC addresses and over-head ethernet frames. (Is there a way to strip that garbage from the outbound traffic generated by the bridge). Greg ---------- Original Message ---------------------------------- From: "Wayne E. Bouchard" <web(a)typo.org> Date: Tue, 16 Mar 2004 12:49:38 -0700 >This goes back to traditional bridging issues. > >The problems include: > >loops and ineffective or broken STP implementations > >arp and broadcast storms > >mac address collisions > >which version of bridging to use and their associated advantages and >disatvantages. > >I can't see that adding the capacity to do traffic shaping or >filtering changes any of these issues. It just adds to the complexity. >It still holds that, generally speaking, if you can route instead of >bridging, it's a better option. > >On Tue, Mar 16, 2004 at 01:36:48PM -0600, Gregory Taylor wrote: >> >> I have a question and would like all of your opinions on this matter, as I research heavily into stateful ethernet bridging, packet mangling and their advantages and disadvantages to local and wide area network topologies. >> >> Deployed in large volumes, what negative effects, if any, would ethernet and fiber bridges have on the Internet as a whole. >> >> Lets say I was to build a bridge designed to intercept and manipulate traffic coming in from an outside network into my 'colo site' to do traffic shaping, packet filtering, and ethernet frames manipulation. And I deployed 100s of these into the facility as a means to control overall traffic. Would these transparent bridges be detrimental in any way to the rest of the internet. I understand that since they are re-transmitting data that the possibility of their MAC addresses popping up every time a machine behind it pops up could be an issue when doing network monitoring. But I'd just like to know what everyone thinks about such products. >> >> (Excuse me if my statements seem a little incoherent, I just woke up) >> >> Greg > >--- >Wayne Bouchard >web(a)typo.org >Network Dude >http://www.typo.org/~web/ >

1 0