- Test - lists.nanog.org

RE: Distributed sniffer products
by Braun, Mike 03 Sep '03

03 Sep '03

We've been playing with Wildpackets http://www.wildpackets.com/. They sniff LAN to Gig and some WAN as well. The Distributed model is still vaporware, but is said to be out soon. The expert analysis is comparable if not better than NAI. Mike Braun -----Original Message----- From: Brennan_Murphy(a)NAI.com [mailto:Brennan_Murphy@NAI.com] Sent: Wednesday, September 03, 2003 1:02 PM To: owen(a)delong.com; JAustad(a)temgweb.com; nanog(a)merit.edu Subject: RE: Distributed sniffer products The cost benefit analysis on Ethereal/etc vs Sniffer on anything but the smallest of networks is usually very easy to make. The fundamental issue is what questions do you have and should you have about your network and what tool answers those questions efficiently and reliably. Good protocol analyzers sell because they save time in answering important questions. Sniffer recently released a SMB Sniffer called Netasyst...worth a look if cost has been an issue in the past. So ends this biased response. :-) -----Original Message----- From: Owen DeLong [mailto:owen@delong.com] Sent: Wednesday, September 03, 2003 2:50 PM To: Austad, Jay; 'nanog(a)merit.edu' Subject: Re: Distributed sniffer products Etherial and other libpcap tools work reasonably well, can be easily deployed using commodity hardware, and would cost you a lot less than NetAssoc. Owen --On Wednesday, September 3, 2003 1:07 PM -0500 "Austad, Jay" <JAustad(a)temgweb.com> wrote: > > Anyone have any experience with these? I'm looking for something > similar to Network Associates Sniffer product. > > Are there any open source projects that are decent? What are others > using? > > ---------------- > Jay Austad > Senior Network Analyst > Travelers Express / MoneyGram > e: jaustad(a)temgweb.com p: 952.591.3779

1 0

RE: Distributed sniffer products
by Brennan_Murphy＠NAI.com 03 Sep '03

03 Sep '03

The cost benefit analysis on Ethereal/etc vs Sniffer on anything but the smallest of networks is usually very easy to make. The fundamental issue is what questions do you have and should you have about your network and what tool answers those questions efficiently and reliably. Good protocol analyzers sell because they save time in answering important questions. Sniffer recently released a SMB Sniffer called Netasyst...worth a look if cost has been an issue in the past. So ends this biased response. :-) -----Original Message----- From: Owen DeLong [mailto:owen@delong.com] Sent: Wednesday, September 03, 2003 2:50 PM To: Austad, Jay; 'nanog(a)merit.edu' Subject: Re: Distributed sniffer products Etherial and other libpcap tools work reasonably well, can be easily deployed using commodity hardware, and would cost you a lot less than NetAssoc. Owen --On Wednesday, September 3, 2003 1:07 PM -0500 "Austad, Jay" <JAustad(a)temgweb.com> wrote: > > Anyone have any experience with these? I'm looking for something > similar to Network Associates Sniffer product. > > Are there any open source projects that are decent? What are others > using? > > ---------------- > Jay Austad > Senior Network Analyst > Travelers Express / MoneyGram > e: jaustad(a)temgweb.com p: 952.591.3779

1 0

Cisco Service Provider code - Any good?
by Jason Frisvold 03 Sep '03

03 Sep '03

All, It was requested that I post this email to the Nanog list as the person in question does not have posting ability... :) Hello All, We're currently looking into migrating our Cisco 72xx and 75xx routers to Service Provider IOS and I was wondering if anyone has had any good luck with a certain version? We've seen that 12.0(25)S1 seems to be an ok version but I have also heard some gripes about it. The PAs that we run in most of the units are the following: ATM-OC3-MM ATM-OC12-MM FastE GigE The IOS would also have to support RFC-1483 connections (Preferrably RBE), BGP, IS-IS and any other basic services of the such. Thanks in advance… -- --------------------------- Jason H. Frisvold Backbone Engineering Supervisor Penteledata Engineering friz(a)corp.ptd.net RedHat Engineer - RHCE # 807302349405893 Cisco Certified - CCNA # CSCO10151622 MySQL Core Certified - ID# 205982910 --------------------------- "Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world." -- Albert Einstein [1879-1955]

2 2

Automatic shutdown of infected network connections
by Sean Donelan 03 Sep '03

03 Sep '03

Some universities such as Vanderbilt University are automatically shutting down network ports when they detected signature worm traffic. Almost 25% of the students' computers were detected as infected when they connected to the university network. http://www.vanderbilthustler.com/vnews/display.v/ART/2003/08/29/3f4eb4b3537… How many ISPs disconnect infected computers from the network? Do you leave them connected because they are paying customers, and how else could they download the patch from microsoft?

9 12

Re: Automatic shutdown of infected network connections
by Omachonu Ogali 03 Sep '03

03 Sep '03

On Wed, Sep 03, 2003 at 10:55:47AM -0400, bscott(a)ntisys.com wrote: > On Wed, 3 Sep 2003, at 10:41am, nanog(a)missnglnk.com wrote: > > And if you just bought a new system, it should have the big update (SP2) > > installed on the machine already ... > > Service Pack 2 for Windows XP has not been released yet. Weird, when I go to Add/Remove programs, I see "(SP2)" next to the hotfixes I applied, from that I assumed SP2 was out or something. > As of 1 Sep 2003, there are 21 post-SP1 security-related hotfixes posted > for Windows XP. The total download size is quite large, if you are on a 56 > kilobit modem. Most of my updates were done on this same modem, and if I recall correctly, most of them varied in size from 300KB to 2MB. Then again, I haven't done a fresh XP install ever since I installed it on this laptop so I don't know how big the initial lump is right now. > > ... unless you're dealing with an incompetent PC > > manufacturer/reseller/whatever that likes to cut corners ... > > Like, say, most of them? Eek. :( Hate to rehash the responsibility debate...but shouldn't the manufacturers/whatever slap the latest service packs on their products that they're selling? If GM puts out a recall on their vehicles for a GE lamp. Yeah, I'm sure GE takes the blame and a hit to their stock, but the dealers go to GM (the aggregator) for the replacement and fix the vehicles they have on the lot before another one gets sold, right? Subtract one level of hierarchy (the dealer, or you could leave it in, since most system builders are rolling out their own stores...Apple, Dell, Gateway, etc.) and you have the common relationship of Microsoft-OEM-End User. Shouldn't the OEM be responsible for any product coming off their shelf that's been "recalled" up until the point of the "recall"?

3 2

NANOG 29 (Chicago) Meeting Information
by Carol Wadsworth 03 Sep '03

03 Sep '03

Registration is now open for NANOG 29, October 19-21, in Chicago. The meeting will be hosted by Server Central. Call for Presentations (submit by September 8): http://www.nanog.org/mtg-0310/call29.html Additional meeting information: http://www.nanog.org Of special note, vendor sponsors can now display equipment during the continental breakfasts and afternoon breaks. Vendor sponsor information: http://www.nanog.org/vendor.html See you there!

1 0

RE: bgp as-path info
by Ejay Hire 03 Sep '03

03 Sep '03

IIRC, They will advertise your specifics if you attach a community of 7018:20 to the route as you send it to them. Otherwise they aggregate all of the routes in the 12/8. -Ejay -----Original Message----- From: Austad, Jay [mailto:JAustad@temgweb.com] Sent: Tuesday, September 02, 2003 1:19 PM To: 'Jack Bates'; Austad, Jay Cc: nanog(a)merit.edu Subject: RE: bgp as-path info Actually, it looks like this is what they are doing. I've already put a call in with them. > -----Original Message----- > From: Jack Bates [mailto:jbates@brightok.net] > Sent: Tuesday, September 02, 2003 1:17 PM > To: Austad, Jay > Cc: nanog(a)merit.edu > Subject: Re: bgp as-path info > > > If you look closely, they are probably not just stripping > your AS. They > are probably aggregating your network. One provider that I am > aware of > that does this is AT&T. Since your advertisements out the > other network > will be more specific, traffic will only come through them. If the > networks are the same size, then traffic will most likely > come through > your first provider due to AS path counts. > > Usually, you have to request that your more specific routes > be allowed > out due to multi-homing. In the case of AT&T, they have a > community that > you must send with the route to have it sent beyond their > local network. > It's really just a matter of default preference on the part of your > provider. Some default to advertise more specific while > others default > to advertising their aggregates. The latter is used most > commonly when a > provider does a lot of BGP peering that is not multi-homed. > It's not a > bad policy when it comes to looking at the BGP tables. > > -Jack > > Austad, Jay wrote: > > > I just brought up a BGP session with one of my providers, > they are stripping > > our AS as it leaves their network, so it looks like the > route is originating > > from their network. I have another provider that I will be > bringing up BGP > > with later this week. Once I bring up the other provider, I will be > > advertising several networks out both of them. > > > > Is this as-path stripping going to cause issues? Does it > matter either way? > > > > -jay > > >

1 0

RE: bgp as-path info
by Truman, Michelle, RTSLS 03 Sep '03

03 Sep '03

Jay, Customer care should be able to help you. If you have any trouble let me know. I can tell you the community you need to use to get your more specific route out. Michelle Michelle Truman CCIE # 8098 Principal Technical Consultant AT&T Solutions Center mailto:mtruman@att.com Work: 651-998-0949 -----Original Message----- From: Austad, Jay [mailto:JAustad@temgweb.com] Sent: Tuesday, September 02, 2003 1:19 PM To: 'Jack Bates'; Austad, Jay Cc: nanog(a)merit.edu Subject: RE: bgp as-path info Actually, it looks like this is what they are doing. I've already put a call in with them. > -----Original Message----- > From: Jack Bates [mailto:jbates@brightok.net] > Sent: Tuesday, September 02, 2003 1:17 PM > To: Austad, Jay > Cc: nanog(a)merit.edu > Subject: Re: bgp as-path info > > > If you look closely, they are probably not just stripping > your AS. They > are probably aggregating your network. One provider that I am > aware of > that does this is AT&T. Since your advertisements out the > other network > will be more specific, traffic will only come through them. If the > networks are the same size, then traffic will most likely > come through > your first provider due to AS path counts. > > Usually, you have to request that your more specific routes > be allowed > out due to multi-homing. In the case of AT&T, they have a > community that > you must send with the route to have it sent beyond their > local network. > It's really just a matter of default preference on the part of your > provider. Some default to advertise more specific while > others default > to advertising their aggregates. The latter is used most > commonly when a > provider does a lot of BGP peering that is not multi-homed. > It's not a > bad policy when it comes to looking at the BGP tables. > > -Jack > > Austad, Jay wrote: > > > I just brought up a BGP session with one of my providers, > they are stripping > > our AS as it leaves their network, so it looks like the > route is originating > > from their network. I have another provider that I will be > bringing up BGP > > with later this week. Once I bring up the other provider, I will be > > advertising several networks out both of them. > > > > Is this as-path stripping going to cause issues? Does it > matter either way? > > > > -jay > > >

1 0

Re: Automatic shutdown of infected network connections
by Nathan E Norman 03 Sep '03

03 Sep '03

On Wed, Sep 03, 2003 at 10:49:24AM -0400, George Capehart wrote: > On Wednesday 03 September 2003 08:20 am, Nathan E Norman wrote: > > On Wed, Sep 03, 2003 at 07:39:17AM -0500, Matthew S. Hallacy wrote: > > <snip> > > > > Besides, have you ever tried updating an XP system at 56k? It could > > > literally take days. > > > > You may have a point there. > > More to the point, why would one subscribe to a cable service to get > only 56k when they could get better rates from another cable provider > or DSL? Defeats the purpose of subscribing to a broadband service. > Your customers who want high speed service would most likely change > providers . . . > > My $0.02. I *like* my 250k connection . . . ;-) Perhaps you missed the part where Jonathan said this is a config for customers whose machine has been infected by the virus du jour. The conscientious customer gets something quite a bit better than 56k :-) -- Nathan Norman - Incanus Networking mailto:nnorman@incanus.net A booming voice says, "Wrong, cretin!", and you notice that you have turned into a pile of dust.

1 0

Re: Sprint NOC? Are you awake now?
by neal rauhauser 03 Sep '03

03 Sep '03

I didn't know their NOC number, puck.nether.net is down, normal phone channels lead to voicemail jail. Sorry to disturb your morning but its much easier to complete by 0600 than to have five counties worth of users dialing a phone right next to where you're working. Simon Lockhart wrote: > > On Fri Aug 29, 2003 at 04:10:27AM -0500, neal rauhauser wrote: > > I've just upgraded a Cisco 7206 for a customer with a DS3 and we're > > now ready to take full routes. No one is answering at support, email has > > gone unanswered for thirty minutes - if someone at the Sprint NOC is > > awake please call Neal or Mike at 402-426-6136 - we'd really like to get > > this done before customers start waking up ... > > Since when was nanog a way to get in touch with NOCs? > > Simon > -- > Simon Lockhart | Tel: +44 (0)1628 407720 (x37720) | Si fractum > Technology Manager | Fax: +44 (0)1628 407701 (x37701) | non sit, noli > BBC Internet Operations | Email: Simon.Lockhart(a)bbc.co.uk | id reficere > BBC Technology, Maiden House, Vanwall Road, Maidenhead. SL6 4UB. UK -- mailto:neal@lists.rauhauser.net phone:402-301-9555 "After all that I've been through, you're the only one who matters, you never left me in the dark here on my own" - Widespread Panic

11 20