- Test - lists.nanog.org

[University at Buffalo] MAN/MEN Research
by Enrico Riedel 11 Feb '04

11 Feb '04

Dear All! My name is Enrico Riedel, and I'm a Graduate Student in Management Information Systems at the University at Buffalo. Currently, I'm working on my Master's Thesis, and researching the Metro Area Networks and Metro Ethernet Networks from a technical, economical, and emerging practices point of view. The particular information I'm looking for is: ---------------------------------------------- * Information about major technical architectures --> trends in this area * Service bundles * Pricing Mechanisms and Pricing Information * For ISPs - Options that are offered to them, that they can use to provide services to their customers Does anyone have information about the above topics? If you can help me, please send me an e-mail to eriedel(a)buffalo.edu. I'm very thankful for any information I can get! Sincerely, Enrico Riedel

1 0

Re: 7500 and DCEF
by Hank Nussbacher 11 Feb '04

11 Feb '04

On Wed, 07 Jan 2004, I posted: >> They recently refreshed the platform with RSP16, VIP8, and MX. It's still >> a viable platform for many medium size providers. > >As an exercise see if you can determine when this 7513: >http://noc.ilan.net.il/stats/ILAN-CPU/new-gp-cpu.html >swapped from an RSP8 to an RSP16 in the past 2 months. After posting this a month ago, I felt I also needed to post a follow-up on the matter. If one looks at the CPU graph now, you will see that I was able to get the RSP16 to drop from 54% to 43% via altering all out ACLs from named to numbered. This is due to a bugid: CSCec07566 (Packets for interface with named ACL are not dcef switched) which affects many 12.2S versions. Next I added "ip multicast-routing distributed" and "ip mroute-cache distributed" to all multicast enabled interfaces, A reload 6 days ago caused the CPU to drop from 43% to 22% - probably due to some unknown reason - whereby all the DCEF changes were not taking hold. Lastly, on all slow serial interfaces (2Mb/sec and under), I changed the queuing to "fair-queue" and that caused DCEF to kick in and bought another 10% reduction. I am now at around 10% CPU and happy. I'd like to thank Rodney Dunn of Cisco for suggesting many DCEF fixes and configuration optimizations. -Hank

1 0

IDS data.
by Jamie Reid 11 Feb '04

11 Feb '04

We have built an experimental system that aggregates IDS alerts by sorting them into subnets, then associating them with routes from the a view of the global BGP table, and in turn associates them with their ASN. From there, we can create lists of security events as they are related to the network contact information available from the radb, ripe, arin etc. That is, we can divvy-up our IDS events by ISP (or rather, NSP) on a reasonably accurate basis, and provide a complete history of events that originated from networks announced by them. (A side project is watching for events that originate from bogons or reportedly hijacked routes. Nothing yet, but we'll see. I mailed someone ad d-sheild about getting a report of this kind of activity from them, but no answer. I'm still interested, btw) Anyway, my question is, will this actually change how we report incidents? It raises a few questions, like how many raw events constitute an incident worth alerting a service provider to? Obviously we would check the events before sending it off, but while we might care about one of our /16's getting whisker'ed by 10 sites on your network, you may not, and there is little anyone can do to compel you to care unless a law has been broken. More to the point, should we consider using contact information in maintainer objects as security incident POCs? Another side project may be a standard XML report, which sites recieving reports can in turn aggregate and mine for what to respond to, but that's just a thought. So, now that we can link our security events directly to subnets and ASNs, how would you like this data served? Regards, -j -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324

2 1

Re: question on ptr rr
by Suresh Ramasubramanian 11 Feb '04

11 Feb '04

Randy Bush wrote: > as your percentiles look worse than those here, do you think > it is indian dns maintenance or politics, or linux list > users, or both? DNS maintenance, and cluelessness at several ISPs - quite a few ISPs don't even have PTR RR for their smarthosts. Luckily most of the larger ISPs around do have PTR for their smarthosts, but several of them seem to think it is not necessary for their dialup / dsl pool, or even for their colo clients.. rDNS is an "added extra" that you have to pay for) Good thing = there's a regional netops conference called SANOG (South Asian NOG, at http://www.sanog.org) that concentrates on the indian subcontient region and is also priced cheaply enough so that lots more people from the subcontinent can attend. Priced cheaply as in other netops conferences are dirt cheap in dollars, but USD 1 = INR 48, and the average monthly salary of a mid level ISP sysadmin is something like USD 500..600. srs

1 0

Looking for someone who is very experienced with IPForwarding in Extreme switches
by Drew Weaver 11 Feb '04

11 Feb '04

I figured I wouldn't bore the rest of you with this slight oddity I've come across in ExtremeWare that I am having an issue getting resolved, but if anyone knows a decent deal about how these switches really work, and doesn't mind giving me a hand, could you tag me off list? Thanks, -Drew

1 0

Re: question on ptr rr
by Suresh Ramasubramanian 11 Feb '04

11 Feb '04

Randy Bush wrote: > btw, i did give you a cursory answer to this. and i asked if you > would provide some data. As I told you in another email, a good 40% of my mail on my personal colo comes from sources without rDNS - mostly within India, from and to some fairly large linux lists. regards -suresh

2 1

Root Servers Request
by Donovan Hill 10 Feb '04

10 Feb '04

This is a formal request to ICANN that they hand over the root server to a not-for-profit organization. I nominate ISC for this task. -- Donovan Hill Electronics Engineering Technologist, CCNA www.lazyeyez.net, www.gwsn.com

8 13

Re: question on ptr rr
by Suresh Ramasubramanian 10 Feb '04

10 Feb '04

Randy Bush wrote: > btw, i did give you a cursory answer to this. and i asked if you > would provide some data. After all the filters that I use were applied - 682 unique IP addresses, with no rDNS sent at least 6124 legitimate (assumed legitimate as not caught by my filters) emails in the period from Feb 2 to Feb 10. This box hosts mail for two large linux lists. And hosts my email, and email for my parents and a few friends. I and my friends are subscribed to various local linux and other mailing lists - several of which have no rDNS. srs

1 0

Re: question on ptr rr
by Suresh Ramasubramanian 10 Feb '04

10 Feb '04

Randy Bush wrote: > > this is what i call shooting in the dark. what are > OBJECTIVE METRICS? for example, can operators measure and > publish alpha and beta error rates on a selection of sites > of different flavors so we can decide when they are low > enough for our flavor of site to enable rdns filters? > The only usable metric you have, Randy, is the amount of collateral damage you would face on your network if you turned on rDNS. Trust me, the error rates on sites would vary widely, especially because you cannot assume a standard / uniform population of people sending mail to these sites. People who mail IETF lists, and people in asia, sending mail to a local list server in the rDNS-less desert that is some parts of APNIC land, might have completely different perceptions on the issue. Now, from your logs, just how much legitimate mail do you get that comes from an IP without PTR RR, and how much is that expressed as a percentage of legitimate incoming mail to your lists? How much is that as a percentage of spam inbound to your list [to be fair, let's make it "spam that would not have been stopped by your other filters]? srs

2 2

Re: [IP] VeriSign prepares to relaunch "Site Finder" -- calls
by Michael.Dillon＠radianz.com 10 Feb '04

10 Feb '04

> So, how do you explain that NIC France accepts the use of linux.fr > to someone who pretends to be the author & proprietary of > the name "linux" and who IS NOT Linus Torvalds? This reminds me of the times when people on the list accused other list members of being closet spammers. At the end of the day, this kind of public accusation is a waste of our time because we don't really have the tools to determine which side is telling the truth. In this case, I am fluent in French, and I spent 15 minutes or so, browsing http://www.linux.fr. It appears to be a legitimate *public* portal for people who are promoting the use of Linux in the enterprise. Nothing on that site claims authorship of Linux and I even stumbled across one forum message that made it clear that Linux is based on the GNU toolset. What is clear is that both http://www.linux.fr and you http://www.fr.scguild.com are trying to offer directories of IT consultants among other things. Could it be that you would rather divert the common resource (a domain name) for your own profit rather than let someone else do the same? Hopefully you and AFNIC http://www.nic.fr can take this silly dispute offline where it belongs.

1 0