- Test - lists.nanog.org

RE: Cisco introduced 'warm' reload...
by Michel Py 15 Sep '03

15 Sep '03

Rodney, > Rodney Dunn wrote: > Thanks for pointing that out. I'll have it removed > from the CLI for any platforms where it's not supported. Actually, there's nothing to remove. The > cisco7507#reload ? > LINE Reason for reload Is perfectly legitimate. > The currently supported platforms are: > 3660 and 3745 in 12.3(2)T > 7200 in 12.2(18)S > I'll also check on future platform implementations and > let you know. While at first the feature seems platform > independent it turns out there are some platform > dependencies. If I may, it would be a hell of a good idea to make it work on platforms such as the 7500 where one would think it is un-necessary. On paper, having a feature set with rpr/rpr+ would render this command un-necessary on a 7500 with dual RSPs. In practice, there are so many compatibility issues with rpr/rpr+ and other features that some 7500s that have dual RSPs run a non-rpr image and the second RSP is sitting in the router as a spare. Michel.

2 2

Re: Sabotage not backhoes: More cable cuts
by George William Herbert 14 Sep '03

14 Sep '03

>Someone climbed a 15-foot tower in Southern Arizona cutting a fiber optic >cable used by Broadwing and Tucson Electric Power. This was within five >feet of the 138,000-volt power line. The site was also guarded by barbed >wire. > >This is not your typical backhoe. > >Rural areas have long dealt with the occasional shotgun damaged cable or >microwave horn; or the farmer burying the dead cow in the back pasture. >But I don't recall two reported acts of sabotage in less than 30 days >before. > >http://www.fox11az.com/news/local/stories/KMSB_local_fiberoptic_091203.9d8b… Is there *anyone* systematically looking at the impact of physical security on network links and datacenters? A lot of people make noise about it, but I haven't seen any changes even since 9/11 which would make penetration exercises any less likely to succeed (and, presumably, actual hostile activity were there to be such). -george william herbert gherbert(a)retro.com

1 0

DS1 Question
by Dennis Dayman 14 Sep '03

14 Sep '03

I am thinking of using ElPaso (elpaso.com) global telecommunications for D1 access across the SBC territory in Texas. Any one have an opinion of them. Does anyone have a list of question I should be asking potential providers of my DS1 lines? -Dennis "Sometimes I don't understand the software, and sometimes I don't understand the hardware, but I can *see* the blinking lights!"

1 0

MIT still has over 900 network drops disabled
by Sean Donelan 14 Sep '03

14 Sep '03

Eight weeks after Microsoft's first announcement concerning RPC vulnerabilities, MIT still has over 900 network drops disabled due to infected machines on the campus. http://www-tech.mit.edu/V123/N39/39SoBig2.39n.html MIT is known for having very bright people. Imagine the difficulty people without an MIT education are having trying to fix their Microsoft computers. MIT is taking the conservative approach. MIT Network Security requires users to reformat their hard drive and re-install their operating system (and I assume install all the patches) before re-enabling the network connection. Could you find your original operating system disks? Did your computer even come with a disc copy of the original operating system? I had some computers which asked the user to "backup" the original operating system on 50-90 floppy disks because the vendor only shipped the OS "pre-installed." Very few people spent the time (or the discs). And you are still face with the problem the patches aren't available yet on physical media (CD, Floppy, etc). So you need to find a friend with a fixed computer to make copies of the patches for you.

1 0

92 Byte ICMP Blocking Problem
by Richard J.Sears 14 Sep '03

14 Sep '03

We started blocking 92 Byte ICMP packets on our ingress points on our core backbone routers. This was a recommendation from Cisco to help mitigate the effects of the Nachi worm. Since then, we have been hammered with customer complaints concerning the inability to talk to mail servers and ssh to their servers, as well as other weird network issues, all centering around the time we started blocking 92 Byte ICMP packets. Has anyone else seen this, and if so, is the only resolution to stop the blockage of 92 Byte ICMP Packets..? Thanks Richard

8 10

Rumor: Microsoft preparing a new patch/service pack CD
by Sean Donelan 13 Sep '03

13 Sep '03

BetaNews is reporting that Microsoft will release a new Service Pack on September 24 including the various security patches. Because Service Packs are also available as CD distributions (for a shipping charge), this may help customers without high-speed Internet connections obtain all the patches (over 30 Megabytes) needed for their system. Unfortunately, many brand-new PC's include old versions of the Windows Operating system and are immediately infected when connected to the Internet before they can download all the patches. This would be a welcome change from Microsoft's previous public statments that the Windows Update Service is the only way for retail consumers to obtain the patches. http://www.betanews.com/article.php3?sid=1063425644

1 0

RE: Cisco introduced 'warm' reload...
by Michel Py 13 Sep '03

13 Sep '03

> Pascal Gloor wrote: > Cisco inroduced 'warm' reload > http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_ > feature_guide09186a00801a755a.html > 12.3(2)T This feature was introduced. > 12.2(18)S This feature was integrated into Cisco IOS Release 12.2(18)S. > Did anyone test this yet? It's not available on all platforms, at least not on my test one. When doing "reload warm" it does a cold one and takes "warm" as the reason for reload. Michel. cisco7507#sh ver Cisco Internetwork Operating System Software IOS (tm) RSP Software (RSP-JK9O3SV-M), Version 12.3(2)T, RELEASE SOFTWARE (fc1) Synched to technology version 12.3(1.9) cisco7507#warm? % Unrecognized command cisco7507#warm-reload Translating "warm-reload"...domain server (192.168.222.4) % Unknown command or computer name, or unable to find computer address cisco7507#reload ? LINE Reason for reload at Reload at a specific time/date cancel Cancel pending reload in Reload after a time interval <cr>

2 1

Re: More on the DDoS Attack
by Eric Gauthier 13 Sep '03

13 Sep '03

Hello, Ok - I know I said I'd have something for the list on Monday. Unforunately, work kept getting in the way :( Yesterday, I sent our this URL to the people who replied to me privately. It is a general overview (with a few details) of how various schools have been dealing with the recent RPC vulnerabilities and the associated Blaster/Welchia worms. http://www.roxanne.org/~eric/blaster.html Take a look and let me know what you think. Any question or comments - editorial or otherwise - would be greatly appreciated. Eric :)

2 1

Cisco introduced 'warm' reload...
by Pascal Gloor 13 Sep '03

13 Sep '03

Cisco inroduced 'warm' reload http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guid e09186a00801a755a.html 12.3(2)T This feature was introduced. 12.2(18)S This feature was integrated into Cisco IOS Release 12.2(18)S. Did anyone test this yet? Pascal

2 1

Re: 92 Byte ICMP Blocking Problem
by Mark Vevers 13 Sep '03

13 Sep '03

Steve Carter said: > > I believe it to be true that all policy route traffic is processor switched rather than CEF on the 75xx platform. If so, the 75xx might not be handling all it's being asked to and dropping stuff in a > non-deterministic way. > In my experience you can do the 92 byte blocking on 75's with dCEF provided you are *very* careful about exactly what policy based routes you set up ... Try the following: On the interfaces make sure you have: ip route-cache policy Then apply your PBR the inbound interface: ip policy route-map block92 which looks like: route-map block92 permit 10 match ip address 121 match length 92 92 set interface Null0 route-map block92 permit 20 With access-list 121 looking like access-list 121 permit icmp any any echo The route-map is exteremly critial because some can be done in dCEF and some can't - and you must have the extra permit as well (sorry if I'm teaching grandma to suck eggs) but this seems to work for us.(12.2.15T5) Be sure to check the vip cpu .... and show cef drop and show cef not-cef-switched for the linecard involved ... BTW we also found that in an earlier release of IOS we needed to reboot the router to get this to work properly. Regards Mark -- Mark Vevers. mark(a)ifl.net / mark(a)vevers.net Principal Internet Engineer, Internet for Learning, Research Machines Plc. (AS5503)

1 0