- Test - lists.nanog.org

ISS X-Force Security Advisories on Checkpoint Firewall-1 and VPN-1
by Ingevaldson, Dan (ISS Atlanta) 05 Feb '04

05 Feb '04

Nanog- ISS X-Force release two X-Force Security Advisories this evening detailing high-risk issues in Checkpoint Firewall-1 and VPN-1. Please refer to the following URLs for more information: http://xforce.iss.net/xforce/alerts/id/162 http://xforce.iss.net/xforce/alerts/id/163 ------------------ Daniel Ingevaldson Director, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net

15 19

RE: Strange public traceroutes return private RFC1918 addresses
by Michael.Dillon＠radianz.com 05 Feb '04

05 Feb '04

>And why 4470 for POS? Did everyone borrow a vendor's FDDI-like default >or is there a technical reason? PPP seems able to use 64k packets (as >can the frame-based version of GFP, incidentally, POS's likely >replacement). According to this URL http://www.columbia.edu/acis/networks/advanced/jumbo/jumbo.html which you have seen before, the number of CRC bits in the protocol header limits the number of bytes you can practically use for the MTU. I expect that we won't go beyond 9000 byte MTUs for a long time. The 4470 for POS probably comes from Token Ring originally. In the original 4 Mbps token ring a device was allowed to hold the token for 9.1 ms which was enough time to transmit 4550 octets. This timing was probably adopted by FDDI which borrowed a lot from the token ring design. No doubt, the designers of POS were also influenced by token ring and just chose the same size. --Michael Dillon

6 5

Re: MTUs - Was: Strange public traceroutes return private RFC1918addresses
by sthaug＠nethelp.no 05 Feb '04

05 Feb '04

> Why is the MTU on Ethernet 1500 bytes? I have looked through various > docs (eg IEEE Std 802.x) and can find where maxUntaggedFrameSize is > listed as 1518 octets, but there is no mention of why this was chosen. > I know where the minimum frame size comes from (CSMA/CD and propagation > times, etc), but the maximum frame size number sounds fairly arbitrary. I believe Rich Seifert once said (on comp.dcom.lans.ethernet) that the cost of the necessary buffer memory for the first Ethernet cards was a relevant factor. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

Peering BOF VII - Peering Personals is Full
by William B. Norton 05 Feb '04

05 Feb '04

Hi all - At this point the Peering Personals part of the Peering BOF is full - please do not send any more RSVPs. Since there was confusion over this point the last time, there is no need to RSVP to *attend* the Peering BOF, only to participate in the Peering Personals during the second half of the BOF. That is the part where Peering Coordinators introduce themselves with a screen behind them indicating where they peer, their AS#, e-mail address, etc. This is the part of the BOF where we can not (for time reasons) fit anymore speakers. I could use a couple people though to help manage the logistics (and security ;-)) for the opening "Great Debate" on "Restrictive Peering Policies; Makes Business Sense vs. Counter-productive" however. Send me an e-mail if you can help. Also, if you think there are some key questions that need to be answered by the debaters, or further comments or suggestions regarding the BOF, I'd love to hear them as well. See you all in Miami - Bill

1 0

Contact needed for CERFnet?
by J. Oquendo 05 Feb '04

05 Feb '04

Sorry to pester on this. I've been working with a couple of clients who had connectivity issues. All more or less had the same problem, the dreaded viruses/worms/etc* issues. I was forwarded a call from tech support for a 'favored' customer and was told to get them up no matter what. Making a long story short, their machine had their dialup settings changed somehow to call a number (cust is contacting telco to see what number was dialed) and connect to the following address 12.129.205.220 ~> whois -h whois.arin.net 12.129.205.220 AT&T WorldNet Services ATT (NET-12-0-0-0-1) 12.0.0.0 - 12.255.255.255 CERFnet ATTENS-LAX1-1 (NET-12-129-192-0-1) 12.129.192.0 - 12.129.255.255 Nothing but a webpage that states "Place Holder" is located there. Normally I wouldn't even care, but I recall someone else mentioning this address earlier in the day. So I called and confirmed there have been a few hijacked connections going to this machine. Anyone know how a contact for this range? Also has anyone heard of anything similar? Thanks and apologies if inappropriate =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "Men have been taught that it is a virtue to agree with others. But the creator is the man who disagrees. Men have been taught that it is a virtue to swim with the current. But the creator is the man who goes against the current. Men have been taught that it is a virtue to stand together. But the creator is the man who stands alone." -- Ayn Rand

1 0

RE: Data Center Building Considerations
by Burton, Chris 04 Feb '04

04 Feb '04

I would suggest speaking with someone who has been part of a large scale datacenter design and implementation. Depending on what state/country you are in there are various electrical, HVAC, fire suppression, and other codes that you have satisfy along with any other company policies on this such as security, generator capacity (if available), carrier availability. Some buildings are great for data centers, other are not; but if this is a new building it may be pre-designed to house at least small scale data centers. Chris Burton Network Engineer Walt Disney Internet Group: Network Services The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact Walt Disney Internet Group at 206-664-4000. -----Original Message----- From: Aaron Thomas [mailto:athomas@deltacable.com] Sent: Wednesday, February 04, 2004 2:28 PM To: nanog(a)merit.edu Subject: Data Center Building Considerations Hello, We are doing some preliminary research into relocating our facilities into a new building. This building has not been built and we would like to have some input into at least one of the floors being suitable for a Data Center installation. What I was wondering is if there are any serious design consideration with respect to floor loading, access for things like HVAC/Power, and general convenience issues such as cable management, access security and the like. If anyone has recently gone through any kind of building design or similar work for this type of installation, perhaps you would be able to share your experience or information on the subject. Either a reply to the list or off list would be great. Cheers, Aaron

1 0

Re: Data Center Building Considerations
by J. Oquendo 04 Feb '04

04 Feb '04

You can try checking out the following documents. http://www.ieee802.org/3/10GBT/public/nov03/diminico_1_1103.pdf http://www.webtechniques.com/archives/1999/08/newton/ If you need info on Tempest shielding etc, http://www.politrix.org/foia/tempest =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "Men have been taught that it is a virtue to agree with others. But the creator is the man who disagrees. Men have been taught that it is a virtue to swim with the current. But the creator is the man who goes against the current. Men have been taught that it is a virtue to stand together. But the creator is the man who stands alone." -- Ayn Rand

1 0

Re: Strange public traceroutes return private RFC1918 addresses
by Michael.Dillon＠radianz.com 04 Feb '04

04 Feb '04

>Which (as discussed previously) breaks things like Path MTU Discovery, >traceroute, If RFC1918 addresses are used only on interfaces with jumbo MTUs on the order of 9000 bytes then it doesn't break PMTUD in a 1500 byte Ethernet world. And it doesn't break traceroute. We just lose the DNS hint about the router location. A more important question is what will happen as we move out of the 1500 byte Ethernet world into the jumbo gigE world. It's only a matter of time before end users will be running gigE networks and want to use jumbo MTUs on their Internet links. Could we all agree on a hierarchy of jumbo MTU sizes that with the largest sizes in the core and the smallest sizes at the edge? The increment in sizes should allow for a layer or two of encapsulation and peering routers should use the largest size MTU. Thoughts? --Michael Dillon

12 23

Data Center Building Considerations
by Aaron Thomas 04 Feb '04

04 Feb '04

Hello, We are doing some preliminary research into relocating our facilities into a new building. This building has not been built and we would like to have some input into at least one of the floors being suitable for a Data Center installation. What I was wondering is if there are any serious design consideration with respect to floor loading, access for things like HVAC/Power, and general convenience issues such as cable management, access security and the like. If anyone has recently gone through any kind of building design or similar work for this type of installation, perhaps you would be able to share your experience or information on the subject. Either a reply to the list or off list would be great. Cheers, Aaron

2 1

Sup2/MSFC2 Working netflow config for hybrid
by Malayter, Christopher 04 Feb '04

04 Feb '04

Hello All, I am looking for a valid working configuration example to do NDEv1 off a 6509 SUP2/MSFC2 running in hybrid mode. Any assistance offline would be great. -Chris

1 0