- Test - lists.nanog.org

Quarantaine network for infected hosts?
by Adi Linden 01 Dec '03

01 Dec '03

Reading about the various ways universities deal with ill behaved client PCs, is there documentation on how to quarantaine devices on a network? Adi

3 2

Anyone from Cogent that can look at "show log" and not get confused?
by Alex Yuriev 01 Dec '03

01 Dec '03

Hello, If there is possibly maybe a person from Cogent that does not get severely confused and say "Oh, it is just the way the routers work" or "Oh it just takes a long time for routes to be sent to you" after being shown synch errors, garbage in AS_PATH that cogent is sending, I would greatly appreciate hearing from you since your lead tech thinks that it is normal for a GSR to take 30 minutes to receive entire 576 routes. Thanks, Alex

1 0

Need contact information for ATDN
by J. Oquendo 01 Dec '03

01 Dec '03

//Second posting// Good evening all, anyone have a good contact for AOL (ATDN) engineers? Having a problem with users on a /17 getting mail there, checked for blackholes on my end, would like to know if my routes are being null0'd. TIA J. Oquendo =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How do you know where I'm at when you haven't been where I've been understand where I'm coming from" -- Cypress Hills

1 0

Re: [Re: Have worm? University upgrades network]
by joshua sahala 01 Dec '03

01 Dec '03

Sean Donelan <sean(a)donelan.com> wrote: > > Do people find "self-certification" by end-users actually fixes > anything? depends on how badly they want to get back on that interweb-thing...and how clueful they are (or can be made to be). if the penalties for not being clean are steep enough (no interweb privileges for a semester), then i think they will do it right. > Or do users keep on clicking on the "Yes, I'm Clean" button? > > In the meantime, you still have to carry the traffic from the infected > computer if only on your quarantine "network." Usually the quarantine > LAN is some type of virtual network, so the underlying bandwidth is > still consumed by the traffic. Its amazing what happens to a > registration server when an infected computer tries to register tens of > thousands of times a minute. Redirecting the user traffic to a > quarantine server, results in that server getting whalloped. > i would hope that you are filtering and rate-limiting upstream traffic, and that you have built the server with sufficient horsepower and self-preservation hooks that it would survive. ftp or http don't require too much upstream, and you probably don't need to allow much else from the users computers /joshua "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

3 3

Re: Have worm? University upgrades network
by warner＠cats.ucsc.edu 01 Dec '03

01 Dec '03

Sean Donelan said > On the other hand, California State-Long Beach is planning to upgrade > its network to deal with the worms. > > > http://www.csulb.edu/~d49er/archives/2003/fall/news/volLIVno49-dorm.shtml While Sean's interpretation draws reasonable inference from the cited article, the particular upgrade we've been told about will use some L2 intercept boxes to scan user computers at the time they attempt to connect to the LB net. They seem to be referring to the installation of the authentication/scanning boxes as part of the network upgrade. The hope/plan is that web redirection for software fixits through an appropriate campus download page will preceed releasing full internet services to the users. I don't think that CSULB is going to add capacity to deal with the icmp scans. Rather they are hopeful that they can use this as a clean up strategy. What we (UC Santa Cruz) share with LB is the vendor that will be adding scanning to their net-auth box: Perfigo. We have heard of the LB plans indirectly through the vendor, but in the context of the article, it all fits. -jim warner, UC Santa Cruz ---

2 1

IRU Contracts?
by Deepak Jain 01 Dec '03

01 Dec '03

I am assuming this is on-topic, though the responses may not be. If there is interest, I will be glad to summarize the answers for the list. I have been testing a few aspects of the market for DF, and I am assuming that for those that are capable of paying for it (DF) to guys who can provide contracts that are enforceable beyond 90 days after signing, a lot more complexity can be cooked into agreements today (2003) than before (1999) -- moreover, a lot more is known about what can go wrong with IRUs now than when they were first being bought. However, I am not seeing a lot of the agreements themselves changing... So I was wondering... For my purposes, I am considering hundreds and thousands of thread-miles, but I am sure even for small intracity spans, some of these things matter. What terms do particular companies or does the community in general think need to be included above and beyond the standard IRU language most vendors are providing? Does anyone insist on fiber performance (beyond dB loss) for the entire life of the contract (if so, what other measures), maintenance/repair SLAs, mass-fusion performance on splices? Does anyone require lambda testing outside of 1550nm? Does anyone accept the payment terms proposed or do they take what they can get depending on the provider? I am guessing only about 3 people are going to want to hear the results of this, so private email responses may be best. Thanks in advance, DJ

2 1

Equant contact?
by Howard C. Berkowitz 30 Nov '03

30 Nov '03

Might I impose on someone who knows the corporate organization of Equant to contact me offline? TIA, Howard

1 0

Cogentco BGP admin around ?
by Jan Czmok 30 Nov '03

30 Nov '03

Hi! Anybody from Cogentco BGP department around ? i need a urgent BGP reconfiguration. I have a ticket# but no response since 15 hours. Please respond privately --jan -- Jan Czmok, Network Engineering & Support, Global Access Telecomm, Inc. Ph.: +49 69 299896-35 - fax: +49 69 299896-40 - sip:13129*522@inoc-dba.pch.net

1 0

Re: Santa Fe city government computers knocked out by worm
by Sean Donelan 29 Nov '03

29 Nov '03

On Sun, 16 Nov 2003, Jamie Reid wrote: > There was a comment (maybe even mine) in a previous thread > about accepting a base level of potentially compromised hosts > on a network, as the costs of rooting out every last one becomes > unwieldly. Networks are large enough that security must be > viewed as an economy of controls and risks instead of as a binary > state of secure or compromised. If your policy is not to root out every last one, then you need to beef up your network so a single compromised host doesn't bring down the whole network. The Internet is evidence that a network can continue to operate even with a very large number of compromised machines on a daily basis. On the other hand, if a single user downloading a music file on your network can take your entire network off the air for several days, you may have a problem. I've often tried to explain that ISPs generally view worms as a "capacity planning" issue. Worms change the "eco-system" of the Internet and ISPs have to adapt. But ISPs generally can't "fix" the end-users or their computers. System admins were able to completely eradicate the Morris worm. But most modern worms like Nimda, Code Red I/II, Slammer stick around. Sometimes a new worm like Nachi supplants an older worm like Blaster. Even if the ISP tries to be the great network firewall, we have mobile computers with mobile code. Laptops are too common, connecting to multiple networks.

5 12

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]
by Daniel Senie 29 Nov '03

29 Nov '03

At 06:24 PM 11/28/2003, Sean Donelan wrote: >On Sat, 29 Nov 2003, Petri Helenius wrote: > > If you are an access provider, specially in the consumer space, you can > > do many things to help the "Greater Internet" by keeping your own back > > yard in good shape. In the transit business, you are expected to > > deliver the bits regardless of the content so there the only viable > > option is to drop packets where the source or destination addresses > > don´t make sense. > >What is the difference between a transit provider and an access provider, >specially in the consumer space? Why is a transit provider expected to >deliver the bits, but the access provider isn't? Since the bulk of >Internet access is actually provided by wholesale providers (e.g. >AOL/Earthlink buy wholesale modem access from UUNET/Level3), who is >the access provider and who is the transit provider? And how do you handle the situation where a provider is both? UUNet, for example, sells LOTS of T-1 lines to non-ISP businesses, and sells retail dialup services to consumers. Sure they also sell wholesale bandwidth and wholesale dialup services to ISPs, but it's not their whole business. The problem isn't "someone else's problem" for anyone.

2 1