- Test - lists.nanog.org

Re: 3 strikes - Interior Department ordered offline again
by Fred Heutte 16 Mar '04

16 Mar '04

This is quite something. From Judge Lamberth's order, additional insight into the behavior of a contractor we know well: It is unfortunate, therefore, that Interior proposes that [e]ach bureau or office for which reconnection is intended will take steps to verify its representation that the IT system is secure from Internet access by unauthorized users. Interior Proposal at 7. In support, Interior plans to submit documentation to the Court that will incorporate the data necessary to support a riskbased decision on Internet reconnection. The assessment may include, as appropriate: (1) network mapping and enumeration; (2) SANS/FBI Top 20 Vulnerability List Comparison; (3) vulnerability assessment; and (4) penetration testing. Id. at 7. Interior further offers that the above assessment will be performed by Interior or its contractor. Id. at 7 n.9. Interiors current contractor is Science Applications International Corporation (SAIC). Id. at 8 n.11. As this Court already noted: SAIC is a contractor that is paid by the Interior Department and as such it cannot be considered to be a testing agency that operates independently of the Interior Department. 274 F.Supp.2d at 133. Furthermore, the Court observes that SAICs long history as an Interior contractor in this area and the simple fact that Interiors IT security remains poor makes this Court reticent to rely on their judgment. Allowing Interior or SAIC to provide the verification of representations made by its bureaus on the adequacy of their IT security does not offer this Court any party without a conflict of interest or a track record of incompetency and is an insufficient method of verifying IT security. The Courts desire is simple and specific. The Court wants Interior to propose and the Court to approve 1) an entity with no prior relationship to Interior, 2) that possesses the requisite expertise in IT security, 3) whose only work for Interior will be performing the tasks set forth for it in the preliminary injunction issued this date, and 4) who will report all its findings to the Court. The Court does not mandate that such an entity work for the Court, in fact they can be paid and supervised directly by Interior. In this regard the Court is now making and continues to make every effort to allow the department to manage its own affairs without Court intervention. But the Court must absolutely have an entity not tainted by the history of falsehoods and deceptions that has plagued this litigation, nor otherwise dependent upon Interior for its revenues and livelihood, to provide honest appraisals of the security of individual Indian trust data ... Interior truly brought this on themselves. Accordingly, the Office of Inspector General, the Minerals Management Service, the Bureau of Land Management, the Bureau of Reclamation, the Office of the Special Trustee, Fish and Wildlife, the Bureau of Indian Affairs, the Office of Surface Mining, and the National Business Center must disconnect all of their respective computer systems from the Internet. This includes every single IT system within that bureau whether or not that IT system houses or provides access to individual Indian trust data. In contrast, the National Park Service, the Office of Policy Management and Budget, and the United States Geological Survey do not have to disconnect any currently connected system from the Internet. Lastly, no system essential for the protection against fires or other threats to life or property should be disconnected from the Internet.

1 0

Re: Platinum accounts for the Internet (was Re: who offers cheap (personal) 1U colo?)
by Scott Weeks 16 Mar '04

16 Mar '04

On Mon, 15 Mar 2004, Randy Bush wrote: : > No true in many cases. All I have to prove is it's not the network and : > then I hand it off to the windows/*nix/<whatever> sysadmins. To prove : > it's not the network, I don't need to know the end systems in any sort of : > detail. : : to pass the buck, one needs to know nothing. what makes a great noc : engineer is taking ownership of the user's problem. In smaller networks, sure. However, it's not about passing the buck in large networks. It's about responsibilities. There, if you take ownership of the sysadmin's part of the ticket (where there're a lot of sysadmins for every OS), you'll likely get =them= chopped off and hung on the wall as an example to others. I would be pissed if one of the sysadmin folks tried to troubleshoot the backbone network instead of handing it off to me after clearing their part of the problem... All I need to do is clear my part and pass it to them with all helpful data points included in the ticket. Any more than that and I'm stomping on other folks' toes. scott

2 1

3 strikes - Interior Department ordered offline again
by Sean Donelan 16 Mar '04

16 Mar '04

The US Department of Interior was ordered to disconnect most, but not all, Internet connections. They don't have to disconnect their modems, private networks, or other agency networks. This is the third time the court has ordered the Interior Department to disconnect some or all of their systems. The court's order is interesting reading http://www.indiantrust.com/_pdfs/20040315DisconnectITSystems.pdf Although the judge is clearly frustrated with Interior's behaivor to date, there are practical limits on what a professional can say. An architect can only swear she designed a building to meet applicable codes, not that the building will never fall down.

1 0

PRISP (ISP Provisiong) Project (was - Ipal project)
by william(at)elan.net 15 Mar '04

15 Mar '04

Due to previous ipal name collision discovered last week the project has been renamed PRISP, big thanks to GertJan Hagenaars for this name. Again if people would like to participate, this project will develop opensource software (or framework and database schema for such software) to help ISPs in tracking setup of new network services and connections. This would include allocation of ip addresses and database of such allocations, database of circuits and network devices, administration and colloboration on actual provisioning process for new connections (both for physical circuits and logical connections such as for colo customer), etc. At some distant future project homepage will be located at www.prisp.org currently there is a sourceforge project info at: http://sourceforge.net/projects/prisp/ If you're interested in helping, please join the mail list: http://lists.sourceforge.net/mailman/listinfo/prisp-discuss Or send email to prisp-discuss-subscribe(a)lists.sourceforge.net with usual "subscribe" in subject and body For reference for those who may join mail list after this message, below is the first email that is starting real project discussions (there have been some smaller discussions last week on different mail lists but we're starting it all again to keep track of this in archives): -------------------------------------------------------------------------- Date: Mon, 15 Mar 2004 13:40:26 -080D (PST) From: "william(at)elan.net" <wi0liam(a)elan.net> To: prisp-discuss(a)lists.sourceforge.net Subject: Open discussion - service provisioning components We'll open the discussion with what people would like to see in the service provisioning database software. Try to think of what network engineers are doing when setting up new customer and which settings might be general enough to be part of some database as well as which of those settings can be automated in some way. Might also be good if in your reply, you order these settings by how they come up in the actual provisioning process. -- William Leibzon Elan Networks william(a)elan.net

1 0

Cisco's Website down?
by joej＠Rocknyou.com 15 Mar '04

15 Mar '04

Anyone else seeing an error getting to www.cisco.com? <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>403 Forbidden</TITLE> </HEAD><BODY> <H1>Forbidden</H1> You don't have permission to access / on this server.<P> <P>Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request. <HR> <ADDRESS>Apache/1.0 Server at www.cisco.com Port 80</ADDRESS> </BODY></HTML> Cheers -Joe

6 6

Curiosity
by Laurence F. Sheldon, Jr. 15 Mar '04

15 Mar '04

People keep asking me "why don't you take that off list?" I have a suggestion: say instead "STFU"--it is easier to type. And that is the net effect, because every attempt to take an item off-list results in something like the following. I can not really figure out what the problem is. -------- Original Message -------- Subject: Mail System Error - Returned Mail Date: Mon, 15 Mar 2004 15:26:16 -0500 From: Mail Administrator <Postmaster(a)cox.net> Reply-To: Mail Administrator <Postmaster(a)cox.net> To: LarrySheldon(a)cox.net This Message was undeliverable due to the following reason: Your message was not delivered because the return address was refused. The return address was '<LarrySheldon(a)cox.net>' Please reply to Postmaster(a)cox.net if you feel this message to be in error. -- Requiescas in pace o email

2 1

www.sunfreeware.com down too?
by Jon R. Kibler 15 Mar '04

15 Mar '04

Have noticed several sites down today. Can't seem to get to www.sunfreeware.com as well as Cisco. -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

2 1

RE: Cisco website www.cisco.com 403 forbidden?
by Amar Andersson 15 Mar '04

15 Mar '04

Works fine for me. -- amar

3 2

RE: Cisco website www.cisco.com 403 forbidden?
by Claydon, Tom 15 Mar '04

15 Mar '04

Al Qaeda packets? -----Original Message----- From: Laurence F. Sheldon, Jr. [mailto:LarrySheldon@cox.net] Sent: Monday, March 15, 2004 2:25 PM To: nanog(a)merit.edu Subject: Re: Cisco website www.cisco.com 403 forbidden? Jay Hennigan wrote: > Is it just me that they don't like? I've seen one or two other reports. Seems like a good opportunity for a round of Wild Speculation. -- Requiescas in pace o email

1 0

Cisco 6513 Bug (was Re: hey had eric sent you
by joej＠Rocknyou.com 15 Mar '04

15 Mar '04

Scott, Yep, we had to send in the line cards to get them upgraded, didn't have any information on upgrading the s/w on the Line cards and TAC wanted me to RMA them back. So. Boy this one was a real pain because it only seemed protocol specific at the time. Here's the referenced Bug for those interested. CSCeb67650 Bug Details Headline WS-X6548-GE-TX & WS-X6148-GE-TX may drop frames on egress Product cat6000 Model x6548 Component hw-1000tx Duplicate of Severity 2 Severity help Status Resolved Status help First Found-in Version 8.1 All affected versions First Fixed-in Version 8.1(1.8), 8.1(1.9), 8.2(0.18)DEL, 7.6(2.3), 12.1(19.4)E, 12.2(17a)SX Version help Release Notes Packets destined out the WS-X6548-GE-TX or the WS-X6148-GE-TX that are less than 64 bytes will be dropped. This can occur when a device forwards a packet that is 60 bytes and the 4 byte dot1q tag is to added to create a valid 64 byte packet. When the tag is removed the packet is 60 bytes. If the destination is out a port on the WS-X6548-GE-TX or the WS-X6148-GE-TX it will be dropped by the linecard. Additionally, if packets are received on an interface that does not have a minimum MTU of 64 bytes (e.g. ATM,POS) and are destined out the WS-X6548-GE-TX or the WS-X6148-GE-TX it will be dropped by the linecard. No current workaround other than moving the recieving device to a different model linecard. Cheers! -Joe ---------- From: owner-nanog@merit.edu[SMTP:owner-nanog@merit.edu] on behalf of Scott McGrath[SMTP:mcgrath@fas.harvard.edu] Sent: Monday, March 15, 2004 11:07 AM To: joe Cc: Riley, Marty; nanog(a)merit.edu Subject: Re: hey had eric sent you Bit hard by same bug. What version of code are you running on the 6513 8.1(2) fixes the bug on the 6x48 line cards. What happens is that packets of 64 bytes or less are silently dropped. Replacing linecards will not help unless there is another bug of which I am not aware. With a little digging I can dredge up the relevant DDTS. Scott C. McGrath On Sat, 13 Mar 2004, joe wrote:

1 0