- Test - lists.nanog.org

Re: [Fwd: FOUND VIRUS IN MAIL from <owner-nanog@merit.edu>]
by Larry Rosenman 18 Jun '02

18 Jun '02

On Mon, 2002-06-17 at 23:34, Patrick Thomas wrote: > > > I didn't see the mail, just my virus scanner going off. I figured > > SOMEONE might actually care. > > Which virus scanner are you using for your MUA ? I didn't know there were > any good ones for pine or elm...or do you have it working directly with > your MTA ? If so, which MTA is it tied into ? amavisd-milter, tied into sendmail 8.12.3 on a FreeBSD host, using McAffee's UVSCAN. Works great. I have a client that has a website, and they've been getting 10-50 klez.h@MM virii a day blocked by the same setup. > -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 972-414-9812 E-Mail: ler(a)lerctr.org US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749

1 0

How to make setup backup route for windows server
by william＠elan.net 18 Jun '02

18 Jun '02

Hi everyone, I need advice on how to best impliment backup routing for windows server. More particularly I have situation where a new server will be placed behind firewall but the server also has 2nd ethernet port which will be connected directly to the router (for that port firewall rules are being entered directly on cisco router). Firewall connection should be the one used for actual traffic unless firewall is down and in that case direct route to the server should be used. The actual ips stay the same (they are on loopback interface on the windows server) so what is necessary is for cisco router to know if firewall is up and if so route that block of ips throuh the firewall and if not, then route it directly to the server through ethernet interface. Now, the firewall itself is actually linux server with its own set of firewall, logging, routing rules, that server is currently not running any routing software. The router is cisco 7500 and its setup with BGP for internet and EIGRP for intranet routing to other routers on our net. I'm thinking the best way to do this maybe to run gated on the linux firewall server and run OSPF on both linux firewall and router. The other problem that still may ned to be solved is default route on windows server (currently I'm thinkin of justing pointing it to interface connected to the router as there would not be any outgoin firewall rules). In addition I will in two weeks need to impliment the same scenario with solaris server being behind firewall with backup connection to router, so it'd good to find universal soltutions. Any suggestions? How are others doing in similar situations? --- William Leibzon Elan Communications Inc.

2 1

RE: XO
by Mansey, Jon 17 Jun '02

17 Jun '02

They already did http://www.isp-planet.com/cplanet/news/03march2002/28adelphia.html Jm > -----Original Message----- > From: blitz [mailto:blitz@macronet.net] > Sent: Monday, June 17, 2002 4:11 PM > To: nanog(a)trapdoor.merit.edu > Subject: XO > > > > Did I hear right on the nightly news, XO went bankrupt today? > > Presently, we're taking bets on when Adelphia goes chapter 11... >

1 0

RE: remember the "diameter of the internet"?
by Mansey, Jon 17 Jun '02

17 Jun '02

I think this is pretty simple. Its just that the closest city to you where ATT and XO peer is Chicago. If they peered in Dallas, it would a whole lot better. I get this all the time, not as bad as this, going to sites across town (LA) when a trace regularly goes via San Jose and back. I guess the Internet isnt as inter-networked as it could be, and less and less so seemingly. The old idea of mutual peering being good for the net etc seems firmly dead nowadays. jm > -----Original Message----- > From: brett watson [mailto:brett@the-watsons.org] > Sent: Monday, June 17, 2002 2:38 PM > To: nanog(a)merit.edu > Subject: remember the "diameter of the internet"? > > > > i sit behind cox-cable service at home, and in troubleshooting why my > connectivity is *so* horrible, i find the following traceroute. does > anyone do any sane routing anymore? does diameter matter (we > used to talk > about it a long, long while ago). i guess i'm just old and > crusty but this > seems to violate so many natural laws. > > i find in more random testing that i seem to be a minimum of > 15 hops from > anything, and it's not just the # of hops, it's the *paths* i travel. > bouncing between two cities several times, on several > different provider > networks, from one border to the other. > > wow. > > -b > > traceroute www.caida.org > > > 1 10.113.128.1 30 unavailable > 2 68.2.6.25 10 ip68-2-6-25.ph.ph.cox.net > 3 68.2.0.26 40 ip68-2-0-26.ph.ph.cox.net > 4 68.2.0.18 50 ip68-2-0-18.ph.ph.cox.net > 5 68.2.0.10 20 ip68-2-0-10.ph.ph.cox.net > 6 68.2.0.70 10 ip68-2-0-70.ph.ph.cox.net > 7 68.2.14.13 10 chnddsrc02-gew0303.rd.ph.cox.net > 8 68.1.0.168 20 chndbbrc02-pos0101.rd.ph.cox.net > 9 68.1.0.146 30 dllsbbrc01-pos0102.rd.dl.cox.net > 10 12.119.145.125 40 unavailable > 11 12.123.17.54 30 gbr6-p30.dlstx.ip.att.net > 12 12.122.5.86 51 gbr4-p90.dlstx.ip.att.net > 13 12.122.2.114 80 gbr2-p30.kszmo.ip.att.net > 14 12.122.1.93 50 gbr1-p60.kszmo.ip.att.net > 15 12.122.2.42 70 gbr4-p40.sl9mo.ip.att.net > 16 12.122.2.205 60 gbr3-p40.cgcil.ip.att.net > 17 12.123.5.145 60 ggr1-p360.cgcil.ip.att.net > 18 207.88.50.253 90 unavailable > 19 64.220.0.189 80 ge5-3-1.RAR1.Chicago-IL.us.xo.net > 20 65.106.1.86 70 p0-0-0-0.RAR2.Chicago-IL.us.xo.net > 21 65.106.0.34 60 p1-0-0.RAR1.Dallas-TX.us.xo.net > 22 65.106.0.14 120 p6-0-0.RAR2.LA-CA.us.xo.net > 23 64.220.0.99 80 ge1-0.dist1.lax-ca.us.xo.net > 24 206.111.14.238 211 a2-0d2.dist1.sdg-ca.us.xo.net > 25 209.31.222.150 80 unavailable > 26 198.17.46.56 140 pinot.sdsc.edu > 27 192.172.226.123 91 cider.caida.org >

3 2

Re: spare fibers
by Kelly J. Cooper 17 Jun '02

17 Jun '02

If you're referring to the National Security Council (NSC) or the President's Critical Infrastructure Protection Board (PCIPB) and the ISP-related working groups they put together (which Avi reported on at NANOG) when you say "they" then you should know that they are looking at those sorts of things and they're working on building a simulator/test-bed. It just wasn't part of the charters for the WGs. They're looking at a lot of different issues because they understand there aren't any silver bullets. Hence the working groups... hence the long set of questions that someone else pointed to... hence some of the other projects they're working on... they want feedback. They want to understand as many aspects of the various problems as possible. BUT there are also a LOT of different sets of "they" out there, so try to be specific. Regards, Kelly J. On Jun 16, 7:42pm, Daniel Golding wrote: > Subject: RE: Re: spare fibers * *Hmm. How many points of disruption, backhoes, chainsaws, hooligans, etc, *would be needed to do this in the US and Canada? 20? 30? Sean Donelan on *a specially outfitted Segway? (just picture it...) * *I suspect that might be a better source of inquiry for our friends in *the federal government, then, say, SBGP. * *Might be useful for the Powers That Be to actually do a simulation of *this, and see how far they can get. * *- Daniel Golding * *> -----Original Message----- *> From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On *> Behalf Of Frank Coluccio *> Sent: Sunday, June 16, 2002 6:43 PM *> To: blitz(a)macronet.net *> Cc: nanog(a)trapdoor.merit.edu *> Subject: Re: Re: spare fibers *> *> *> *> Almost without exception, "ring topology" implies a *> single-carrier doing physical *> layer provisioning and support. In the case where multiple *> points are under *> attack in a concerted effort to knock out service (including *> the failover *> capabilities), it's either an "inside job" or, at the least, *> one where *> intelligence relating to individual SONET backbones and rings *> has been obtained *> from various sources for the purpose of thwarting such _self-healing_ *> capabilities that are usually afforded by SONET/SDH. *> *> In the not too distant past (during the pre-sonet and early *> SONET days when N+1 *> automatic protection switching was used instead of *> counter-rotating recovery *> schemes) we saw this occur, albeit infrequently, during *> periods of labor unrest *> and other tense forms of situations relating to competition *> (where folks feared *> for their jobs) along the NY-NJ corridor and in certain parts *> of California, to *> name just two that I recall off the top of my head. Until *> recently (post 9-11), *> however, it was hardly a matter of overwhelming concern. *> Today it is becoming *> more so a matter of heightened concern. Meshing through the *> use of diverse *> providers' facilities may prove to be the ultimate means of *> protection, with the *> proviso being that those providers are not all sharing the *> same physical routes. *> fwiw. *> *> FAC *> *> > *> > *> > Hi Daniel and all, *> > Yes, multiple fiber in multiple conduits, traveling *> multiple paths is *> > the *> > best way to insure something's going to have connectivity. *> > Ring topology is what I've seen mostly for best protection, *> if something *> > goes down, restoration takes milliseconds and is automatic. *> Worst case, is *> > some contractor digs up the place where your fiber enters *> your building and *> > severs everything....not much you can do about that kind of outage. *> > *> > *> > At 20:41 6/16/02 +0200, you wrote: *> > *> > *> > >Hi blitz, *> > > *> > >I think that you talk about multiple outage in the *> Telefonica Network *> > >in Spain cause by sabotage. (48 fibers in 4 points at the same *> > >time) *> > > *> > >I see ok the interest of the ministry, is necessary to assure that *> > >outages don't affect to the national infraestruture. *> > > *> > >In our case we build our network over diverse companys *> with diverse *> > >path in their fiber network. I see ok, that all companys *> that operate *> > >basic services do it and they will have backup and emergency plans. *> > > *> > >Regards, *> > >Daniel *> > >Intelideas *> > > *> > > *> > >On Sun, 16 Jun 2002, blitz wrote: *> > > *> > > > *> > > > The Spanish ministry of science and technology has asked *> > > > telecommunications companies to activate a backup *> plan in the *> > > > case of such emergencies in future. *> > > > *> > > > Spare fibers in the same duct ;-? *> > > > *> > > > Doesn't sound like it would be much protection from "backhoe *> > > > fade"...heh *> > > > * >-- End of excerpt from Daniel Golding

2 1

Re: spare fibers
by Martin Hannigan 17 Jun '02

17 Jun '02

At 07:44 AM 6/17/2002 +0300, Rafi Sadowsky wrote: >## On 2002-06-16 15:04 -0400 blitz typed: > >b> >b> >b> Hi Daniel and all, >b> Yes, multiple fiber in multiple conduits, traveling multiple paths is the >b> best way to insure something's going to have connectivity. >b> Ring topology is what I've seen mostly for best protection, if something >b> goes down, restoration takes milliseconds and is automatic. > > >> Worst case, is >b> some contractor digs up the place where your fiber enters your building and >b> severs everything....not much you can do about that kind of outage. > >Why not? - > > IMHO If you already get diverse carriers splitting them between say >the front and the back of the building shouldn't be that hard Many non colo buildings, old, or otherwise, don't have two 0 manholes, don't have the riser infrastructure, etc. etc. If you aren't already a carrier, you could end up spending a whole of money on conduit leases, facilities leases, and commitments to carriers that have to dig out from a diverse manhole, fees to the landlord for boring the foundation and building the entrance facilities..etc. Landlords today are very smartly getting involved in owning the core infrastructure <splice boxes, cross connects, conduit> and leasing it back to business, net, and carrier companies. Regards, -- Martin Hannigan hannigan(a)fugawi.net

1 0

Re: spare fibers
by blitz 17 Jun '02

17 Jun '02

Hi Daniel and all, Yes, multiple fiber in multiple conduits, traveling multiple paths is the best way to insure something's going to have connectivity. Ring topology is what I've seen mostly for best protection, if something goes down, restoration takes milliseconds and is automatic. Worst case, is some contractor digs up the place where your fiber enters your building and severs everything....not much you can do about that kind of outage. At 20:41 6/16/02 +0200, you wrote: >Hi blitz, > >I think that you talk about multiple outage in the Telefonica >Network in Spain cause by sabotage. (48 fibers in 4 points at the same >time) > >I see ok the interest of the ministry, is necessary to assure that outages >don't affect to the national infraestruture. > >In our case we build our network over diverse companys with diverse path >in their fiber network. I see ok, that all companys that operate basic >services do it and they will have backup and emergency plans. > >Regards, >Daniel >Intelideas > > >On Sun, 16 Jun 2002, blitz wrote: > > > > > The Spanish ministry of science and technology has asked > > telecommunications companies to activate a backup plan in the > > case of such emergencies in future. > > > > Spare fibers in the same duct ;-? > > > > Doesn't sound like it would be much protection from "backhoe fade"...heh > >

3 2

Re: Re: spare fibers
by Frank Coluccio 17 Jun '02

17 Jun '02

Almost without exception, "ring topology" implies a single-carrier doing physical layer provisioning and support. In the case where multiple points are under attack in a concerted effort to knock out service (including the failover capabilities), it's either an "inside job" or, at the least, one where intelligence relating to individual SONET backbones and rings has been obtained from various sources for the purpose of thwarting such _self-healing_ capabilities that are usually afforded by SONET/SDH. In the not too distant past (during the pre-sonet and early SONET days when N+1 automatic protection switching was used instead of counter-rotating recovery schemes) we saw this occur, albeit infrequently, during periods of labor unrest and other tense forms of situations relating to competition (where folks feared for their jobs) along the NY-NJ corridor and in certain parts of California, to name just two that I recall off the top of my head. Until recently (post 9-11), however, it was hardly a matter of overwhelming concern. Today it is becoming more so a matter of heightened concern. Meshing through the use of diverse providers' facilities may prove to be the ultimate means of protection, with the proviso being that those providers are not all sharing the same physical routes. fwiw. FAC > > > Hi Daniel and all, > Yes, multiple fiber in multiple conduits, traveling multiple paths is the > best way to insure something's going to have connectivity. > Ring topology is what I've seen mostly for best protection, if something > goes down, restoration takes milliseconds and is automatic. Worst case, is > some contractor digs up the place where your fiber enters your building and > severs everything....not much you can do about that kind of outage. > > > At 20:41 6/16/02 +0200, you wrote: > > > >Hi blitz, > > > >I think that you talk about multiple outage in the Telefonica > >Network in Spain cause by sabotage. (48 fibers in 4 points at the same > >time) > > > >I see ok the interest of the ministry, is necessary to assure that outages > >don't affect to the national infraestruture. > > > >In our case we build our network over diverse companys with diverse path > >in their fiber network. I see ok, that all companys that operate basic > >services do it and they will have backup and emergency plans. > > > >Regards, > >Daniel > >Intelideas > > > > > >On Sun, 16 Jun 2002, blitz wrote: > > > > > > > > The Spanish ministry of science and technology has asked > > > telecommunications companies to activate a backup plan in the > > > case of such emergencies in future. > > > > > > Spare fibers in the same duct ;-? > > > > > > Doesn't sound like it would be much protection from "backhoe fade"...heh > > > > >

3 2

spare fibers
by blitz 16 Jun '02

16 Jun '02

The Spanish ministry of science and technology has asked telecommunications companies to activate a backup plan in the case of such emergencies in future. Spare fibers in the same duct ;-? Doesn't sound like it would be much protection from "backhoe fade"...heh

2 2

Of interest to the community ..
by Robert Mathews 15 Jun '02

15 Jun '02

F Y I ... presently floating ... If you have seen it before, please excuse. ==> "Microsoft Warns of New Security Flaws" Reuters - 06/13/02 Microsoft disclosed a trio of critical software vulnerabilities on Wednesday. The company has issued a patch for a hole that can cause system shutdowns or enable hackers to run malicious code on a computer; the flaw affects users of Windows XP, Windows Routing and Remote Access Server, Windows NT 4.0, NT 4.0 Terminal server edition, and Windows 2000. The other security flaws include an Internet Explorer vulnerability that could allow intruders to commandeer computers via an old Internet protocol, and a hole in Microsoft's instant messaging and chat programs that would permit hackers to run their code on victim machines. The Wednesday announcement brings the total number of security bulletins Microsoft has released this year to 30, demonstrating the company has made little actual progress toward its target of more secure software since making it a primary goal about six months ago. Nevertheless, David Gardner of Microsoft's Security Response Center claims that the initiative has had positive effects--for one thing, engineers are detecting these flaws before they are identified and revealed by outside researchers. "Coding Flaw Might Assist Hackers" By Riva Richmond The Wall Street Journal - 06/13/02 P. B4 Computer-security specialists are exploring whether the Internet infrastructure could become a ripe target for hackers because of findings that faulty deployments of the Abstract Syntax Notation One (ASN.1) computer language makes Simple Network Management Protocol (SNMP) vulnerable to intrusions. At the core of the problem are certain versions of programming code used to read ASN.1, which fail when attempting to deal with very long or distorted messages, giving rise to system crashes or memory overflow that hackers could exploit. If such errors have widely proliferated, other protocols may be open to attacks that could shut down routers and switches, severely hampering online access. Such protocols are used by the telecom sector, and are also incorporated into nuclear-control systems, power-control systems, printer-job management, package tracking, secure communications, and online multimedia applications. Sourcefire founder Martin Roesch and other experts say that the problem is being investigated by tech firms, private researchers, and government agencies. The National Infrastructure Protection Board's Debbie Weierman notes that her agency has been collaborating with experts from the NSA, the Federal Computer Incident Response Center, CERT, private groups, and others since March to see how widespread the ASN.1 flaw is. Microsoft, Lucent, and Oracle are among the private-sector companies that have investigated or are investigating how their products may be affected by the ASN.1 problem. Meanwhile, TruSecure's Paul Robertson believes high-level hackers have devised malicious programs that exploit the flaw.

5 4