- Test - lists.nanog.org

Exodus Contact
by Gyorfy, Shawn 04 Apr '02

04 Apr '02

Please can someone that deals with routing issues at Exodus.net contact me off the list, or if anyone knows of a good contact at Exodus.net please contact me off the list. Thanks in advance. Shawn.

1 0

Configure SNMP for non udp 161 port
by Holmes, Daniel 04 Apr '02

04 Apr '02

Does anyone know off hand how to configure a cisco router to respond to SNMP v1/v2 requests on a udp port other than 161 (default) Thanks - Dan

1 0

Qwest Transit
by Andy Dills 04 Apr '02

04 Apr '02

Ok, we have an opportunity to get Qwest bandwidth amazingly cheap. I can't disclose the details (NDA), but bottom line is it looks like the cheapest in the industry and because there is no loop involved, it could be one hell of a deal on a ds3. I'm not a fan of Qwest, traditionally. I've had some (somewhat famous) run-ins with their sales people, and I personally know plenty of companies who over several years have had tons of complaints with various aspects of their organization. However, I'm not interested in all of that at the moment. I need to evaulate, without all of my longheld bias, whether or not Qwest can provide quality DS3 transit. The traditional knock on Qwest is that they're an over-built under-peered network with poor support. But a lot of time has passed, so surely they would have addressed the peering issues by now? I can deal with poor support...the circuit is a simple cross connect, and our bgp filter changes are fairly uncommon. Can anybody speak positively or negatively about the quality of Qwest transit? We ordered a metered ds3 for a backup circuit, but with the pricing I'm seeing, I'm really tempted to localpref and prepend our announcements such that most of the traffic flows through Qwest. I plan on trying it out regardless, but I'd like to hear from the list first. Thanks, Andy xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Andy Dills 301-682-9972 Xecunet, LLC www.xecu.net xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Dialup * Webhosting * E-Commerce * High-Speed Access

5 4

RE: Qwest Transit
by Fred Heutte 04 Apr '02

04 Apr '02

Bear in mind that the financial situation at Qwest is bad. They are getting ready to take an estimated $20 to $30 billion writeoff on accounting restatements (mostly of "goodwill") and will probably be sanctioned by the SEC, as indicated in wire stories today. http://www.salon.com/tech/wire/2002/04/02/qwest/index.html Their Portland office is across the street from me, and my phone and DSL is dependent on them of course, so this is of direct concern in my case! I should mention that despite its deserved reputation for greedy management (whether as Pacific Northwest Bell, U S West or now Qwest), ops has generally been pretty good and the retail (consumer/ small business) DSL service, from my personal experience, is top notch. (Of course, they run it on FreeBSD so that should tell you something :) We certainly know from experience that a major financial upheaval can affect operations at least indirectly (loss of management attention, budget cuts, deferred maintenance, cutbacks in monitoring and response systems, etc.). On the other hand, it's not a good idea to overreact to news like this. So I would proceed with due caution concerning Qwest transit. As a wise person once said, don't put all your routes in one pipe. Fred

7 6

Re: How to get better security people
by blitz 04 Apr '02

04 Apr '02

>Problem is, some feces for brains boss is always going to come along and >tell you to do what you know is not in the best interest of security. And >when the problem rears its ugly head, YOU take the heat, not the idiot who >insisted you go against proper procedure. All I can advise, is document, document, document, then when it does come down, and they point the fickle finger of fate at you, you can always produce the documentation that 'da bozz' made ya do it... >Hmm. Incredibly biased opinion follows... > >A basic security mindset is a combination of paranoia, a talent for >contingency planning, and an understanding of business need. > >However, the paranoia must not be so extensive as to be crippling, >the contingency planning must not be so obsessive as to be paralysing, >and the understanding of business need should not interfere with the >periodic difficult and unpopular decisions that must be made to >protect the greater good.

8 10

RE: How to get better security people
by Zimmerman, David 03 Apr '02

03 Apr '02

In a former life as well as my current one, we had a primary Information Security officer, and myself acting as corporate firewall engineer. I found that my own role was best performed as a network security "conductor" of the "orchestra" of sysadmins who actually built and operated our Internet systems. You build a mailing list and forward interesting stuff from CERT/CIAC/Bugtraq/etc; you try to keep everyone informed, and guide them along the way with reasonably well-stated firewall guidelines ("I'll do this, I won't do that" with some give-and-take, and a little heartache over the purity of the architecture). And you get involved with the business as much as you can to spread the network security gospel. At some level it becomes less of a pure technical security issue, and more a social engineering challenge. Ultimately, it's all about risk management, and minimizing your risk by maximizing the knowledge flow and relationships that you build within the company. I recognized that generally I knew more about network security and IP/TCP/UDP than the people running the systems, and at some level you only get so much system security given the knowledge of the folks involved. So you back it up with as much of a secure network environment as you can negotiate v.s. the needs of the business, and make sure that the top Security dog is on the same page as you are. Ultimately you'll have an incident in spite of your best efforts -- no matter how totalitarian you are in your security policies -- and the most important thing is to educate everyone about the factors driving the security architecture. Maybe you make fundamental changes in response to the incident, or maybe you just try to educate everyone a little better, but hopefully in either case learn something along the way. dp -----Original Message----- From: Sean Donelan [mailto:sean@donelan.com] Sent: Tuesday, April 02, 2002 10:18 PM To: Christopher E. Brown Cc: NANOG Subject: Re: How to get better security people On Tue, 2 Apr 2002, Christopher E. Brown wrote: > I think it comes down to being able to deal creatively with a > lack of total control, and find ways to limit what you cannot > eliminate. Security specialists can't be everywhere, can't do everything, and can't stop every bad thing. The reality is the people who have the biggest impact on security don't have security in their job title. Instead of a neighborhood watch do we need a network watch? While we need a few people with "deep" security knowledge, we also need to spread a thin layer of security pixie dust throughout the entire organization. Is it really a lack of control. While some security specilists carry a big stick, on most projects security is just one of many specialities required to work together. If you are a security specialist, just getting invited to a project before its finished is a major accomplishment.

1 0

RE: Stealth p2p network in Kazaa and Morpheus?....
by Chris Boyd 03 Apr '02

03 Apr '02

<grouch> Maybe ISPs and carriers can file a class action suit against these guys for something. I wanted to run a network, not manage someone else's distributed server farm. </grouch> > -----Original Message----- > From: Craig Holland [SMTP:cholland@yahoo-inc.com] > Sent: Tuesday, April 02, 2002 6:35 PM > To: Nanog@Merit. Edu > Subject: Stealth p2p network in Kazaa and Morpheus?.... > > > This was news to me, so I'm passing it along. Sorry if it's spam. > Checked > the archives, and didn't see anything to this affect. > > <watch the wrap> > http://story.news.yahoo.com/news?tmpl=story&u=/cn/20020402/tc_cn/stealth_p > 2p > _network_hides_inside_kazaa

4 3

RE: Stealth p2p network in Kazaa and Morpheus?....
by Borchers, Mark 03 Apr '02

03 Apr '02

Anthony D Cennami wrote: > > You aren't maintaining anybodies distributed server farm. You're > maintaining the infrastructure that your clients pay you to use, and > they're allowing this application to function in the manner > described in > plain english within the license agreement. That's a slight stretch. However, your point about an AUP is well taken. Perhaps networks will now want to consider a prohibition along the lines of "Distribution of content by a third party via a customer's connection may be blocked at the sole discretion of the provider, or may be grounds for termination of service."

1 0

Economics of flooding
by Livio Ricciulli 03 Apr '02

03 Apr '02

Hi, we are doing research on the economics of flooding attacks and we have a few questions; help would be greatly appreciated. Is anyone aware of a process for claiming a deduction in charges when fees are associated with a flooding attack? In particular, attacks may push up the 95% usage or (more commonly) attacks may create prolonged loss of network availability; Both outcomes may result in a claim for deduction. Has anyone ever dealt with something like this? How is this handled today? What evidence or proof has to be provided to get the deductions (if any)? Thanks in advance, Livio.

4 3

Stealth p2p network in Kazaa and Morpheus?....
by Craig Holland 03 Apr '02

03 Apr '02

This was news to me, so I'm passing it along. Sorry if it's spam. Checked the archives, and didn't see anything to this affect. <watch the wrap> http://story.news.yahoo.com/news?tmpl=story&u=/cn/20020402/tc_cn/stealth_p2p _network_hides_inside_kazaa

1 0