- Test - lists.nanog.org

PowerDNS PDNS 1.99.6 first public release
by bert hubert 28 Mar '02

28 Mar '02

Of mild interest to readers of this list may be the first public release of what is to become PDNS 2.0 PDNS is an advanced high performance authoritative nameserver with a host of backends. Besides plain Bind configuration files, PDNS reads information from MySQL, Oracle, PostgreSQL and many other databases. Backends can easily be written in any language, a sample perl backend is provided. PDNS powers http://express.powerdns.com, a Web-based DNS maintenance site and the toplevel domain .TK. The not-for-profit release can be found on http://www.powerdns.com/pdns , documentation is on http://downloads.powerdns.com/documentation/html/ or included in the distribution. This is not yet a mature release, so your comments are appreciated. We will not spam this list further and instead invite you to join our 'pdns-users' mailinglist: http://mailman.powerdns.com/mailman/listinfo/pdns-users Thanks for your attention. Regards, bert hubert -- http://www.PowerDNS.com Versatile DNS Software & Services http://www.tk the dot in .tk http://lartc.org Linux Advanced Routing & Traffic Control HOWTO

1 0

Exodus/C&W Depeering
by Chris Parker 28 Mar '02

28 Mar '02

Well, another round of the depeering battles. We received notice this morning that Exodus is depeering at all US public exchanges on Friday ( gotta love that notice by the way ). They are also not accepting any requests for private peering ( despite meeting the requirements still listed on the peering page ): http://bengi.exodus.net/external/peering.html They will happily continue to sell transit at said exchanges though, and all C&W peering contacts forward to sales ( ain't that cute! ). Should be interesting to see how this impacts the ability to reach sites hosted at Exodus. -Chris -- \\\|||/// \ StarNet Inc. \ Chris Parker \ ~ ~ / \ WX *is* Wireless! \ Director, Engineering | @ @ | \ http://www.starnetwx.net \ (847) 963-0116 oOo---(_)---oOo--\------------------------------------------------------ \ Wholesale Internet Services - http://www.megapop.net

18 25

Telenex/Atlantic Research Interview 7200
by Jim Hickstein 28 Mar '02

28 Mar '02

Not operational; I apologize. I just picked up an ARC Interview 7200 analyzer, and it hath no floppies. Racking my brains (and having exhausted Google!) I decided that NANOG was the likeliest place to find someone who has (access to) such a beast, and who might make me copies of the software for a nominal bribe. (Or better yet, cite or send the images.) Sitting here with my new toy, and whimpering....

1 0

Route Collector
by Chris Pace 28 Mar '02

28 Mar '02

Is it common or a good idea to have a route collector in a datacenter/enterprise environment ? We have 1 router that just collects routes using bgp and ospf, then set all servers to use it as the default gateway. Is this practical or am I making more work for myself ? Chris Pace

3 4

RE: Senator Hollings is at it again
by smd＠clock.org 27 Mar '02

27 Mar '02

| Hollings is full of it. No, he is just very stupid and/or misled. > The Congress finds: > > (1) The lack of high quality digital content continues to hinder > consumer adoption of broadband Internet service and digital television > products. This is exactly backwards, and should not be used to justify this bill. It is the lack of broadband Internet service availability which constrains the development and dissemination of high-quality original digital content. Moreover, blessing only the likes of Hollywood production companies with the term "high-quality" is offensive. Countries which develop a real broadband market will notice that a "geocities distributed into households" market in original digital content develops, and that the law of large numbers suggests that some of this content will be high quality (consider the best of geocities in its prime) by anyone's standards except possibly Congress's. That highly revenue-minded organizations might not know how to take advantage of a market of millions of always-on/high-speed-connected urban households in the USA is sad, but it ignores the question: why does such a market not exist? Simple: the iLECs are strangling it off. Perhaps their interests and the Hollywoods' interests dovetail so much that we could see mergers between big content owners and last-mile owners. Then there'd be the fun choice between actively-filtered broadband ("watch all the high quality [as determined by Congress!] digital content you can pay for, and see none of that darned free stuff!") and no broadband at all, on a market-by-market basis. Cooooool! So cool, in fact, that I think that this bill is doomed because it does not go far enough to support exactly that sort of development. Sean.

5 4

EarthLink founder guilty of operating a Ponzi scheme
by blitz 27 Mar '02

27 Mar '02

LOS ANGELES The co-founder of EarthLink, one of the nation's largest Internet providers, agreed yesterday to plead guilty to operating a Ponzi scheme that involved $593 million and 800 investors, including celebrities. Reed Slatkin acknowledged in court documents that he was responsible for $254 million in losses and agreed to plead guilty to mail fraud, wire fraud, money laundering and obstruction of justice charges. Full story here: http://www.uniontrib.com/news/business/20020327-9999_1n27ponzi.html Like we didn't know?

1 0

Re: Route filters, IRRs, and route objects
by Przemyslaw Karwasiecki 27 Mar '02

27 Mar '02

Yes, This is true, and I am using cisco prefix list already, and "upto" notation on juniper boxes. The problem is that some providers (like LEVEL3) requires that all routes are registered in some IRR before they will consider them valid/legitimate.... So I have filters accepting from my customers whatever le 24, but once those routes are propagated over Internet and they reach eventually providers like Level3, they have their filters accepting only those routes, which are registered on some IRR in exact way.... Przemek On Wed, 2002-03-27 at 14:56, Rob wrote: > this can be easily achieved on ciscos (IOS 11.3.1 and up) by using prefix lists. note the following example: > > ip prefix-list 1 permit 10.0.0.0/18 le 24 > > the le 24 at the end indicates that this line of the prefix list will allow any prefix less than or equal to 24 within the 10.0.0.0/18 block. apply this inbound to your bgp neighbor and there is your filter. for this particular example, you could use any number from 19 to 32 to indicate how long of a prefix you will allow. > > i hope this answers your question. cheers! > > -R > > > Przemyslaw Karwasiecki [karwas(a)ifxcorp.com] wrote: > > > > Hello, > > > > I would like to ask you for an advice in regards to > > "proxy registering" of customer route objects in IRR. > > > > What is the best current practice in a situation, > > when your customers want to advertise to you several > > /18 or /19 but they also have a requirement to be able > > to advertise some deaggregated routes on top of aggregates. > > > > It is very common that they are unable to predict exactly > > which deaggregated routes they will need to advertise, > > as they use those to achieve some traffic engineering > > objectives which change over time. And "over time" does > > NOT occur once per 30 minutes or so, so they DON'T > > generate any major BGP fluctuations. > > > > Forgive my ignorance, but is my understanding of RPSL > > correct, that it should be possible to specify routes > > in a way which will allow cover aggregate plus whole > > set of possible more specific routes upto certain netmask > > length. Something like: 10.0.0.0/18^18-24 > > > > So why this is uncommon to use such notation to describe > > routing policy, and use it to generate filters? > > > > Why it is required by some providers to generate explicit, > > exact route objects, in order to allow routes through > > their filters? > > > > Is it really necessary to "explode" route-sets like > > those 10.0.0.0/m^m-n into 2^(n-m+1) separate route objects > > to meet requirements of some providers? > > > > I believe that this is very common problem, so if there > > are any places on the web with some "best practice" > > documents, please point me to them. > > > > Thank you, > > > > Przemek > >

2 1

Re: How to get better security people
by Roger Marquis 27 Mar '02

27 Mar '02

"E.B. Dreger" <eddy+public+spam(a)noc.everquick.net> wrote: > Service patches were never applied. When some suspicious > happenings left said server inoperable, they just installed > Win2000 and went on, not caring what had happened or why. > > No, I was not the employee. A friend of mine worked there before > getting fed up and quitting. We see this a lot too. It is, IMHO, why good security people who are not in finance, defense or other security-conscious sectors tend to be consultants. Consultant or not IS security gurus are no different than other in-demand technical specialists. You have to 1) pay them appropriately, 2) have a decent working environment (no windowless cubicles, junk food cafeterias, inflexible hours, unskilled management, etc), and 3) provide constant training opportunities (conferences, classes, good assignments). Don't expect them to have programming degrees or be interested in coding. Those would be security developers as opposed to security analysts. Finally, NEVER ask a Unix literate engineer to use an MS Windows PC... -- Roger Marquis Roble Systems Consulting http://www.roble.com/

1 0

FW: How to get better security people
by Jim Popovitch 27 Mar '02

27 Mar '02

Somehow eTrade's following response didn't make it to the list. I think it's important enough to resubmit it given the erroneous info posted earlier. -Jim P. -----Original Message----- From: David Rickling [mailto:drickling@etrade.com] Sent: Tuesday, March 26, 2002 6:02 PM To: 'LeBlanc, Jason'; 'Jim Popovitch'; 'Sean Donelan'; nanog(a)merit.edu Subject: RE: How to get better security people E*TRADE Financial has it's full complement of System and Network Security people still employed. The Director and Sr. Manager of the group have been with the Company for nearly five years and the average length of time within the group is 2 + years. E*TRADE Financial is dedicated to protecting it's customer assets and holds security is a core value for all associates. David Rickling Lead Network Engineer Network Architecture & Integrations E*Trade Financial This e-mail is the property of E*TRADE Group, Inc. It is intended only for the person or entity to which it is addressed and may contain information that is privileged, confidential, or otherwise protected from disclosure. Distribution or copying of this e-mail or the information contained herein by anyone other than the intended recipient is prohibited. If you have received this e-mail in error, please immediately notify the sender by e-mail at drickling(a)etrade.com <mailto:drickling@etrade.com> and telephone at (650)-331-5269. Please delete and destroy any copies of this e-mail. E*TRADE Group, Inc. 4500 Bohannon Drive Menlo, California 94025 -----Original Message----- From: LeBlanc, Jason [mailto:Jml@ebay.com] Sent: Tuesday, March 26, 2002 11:25 AM To: 'Jim Popovitch'; LeBlanc, Jason; 'Sean Donelan'; nanog(a)merit.edu Subject: RE: How to get better security people What eBay does as a business is of little consequence to me, as a network engineer, though it seems they make pretty good decisions based on things I've seen in three years here. That "fact" came from someone who worked for them in Atlanta, was merely an idle comment meant to share a bit of information. The tone of your reply is a bit off. > -----Original Message----- > From: Jim Popovitch [mailto:jimpop@rocketship.com] > Sent: Tuesday, March 26, 2002 11:06 AM > To: LeBlanc, Jason; 'Sean Donelan'; nanog(a)merit.edu > Subject: RE: How to get better security people > > > > -----Original Message----- > > From: LeBlanc, Jason <Jml(a)ebay.com> > > > > On that note, Etrade layed off their entire net sec team a few > > months back. I don't trade there no more. ;) > > Let me guess, eBay is moving into securities trading next.... > Your "facts" about eTrade are wrong, very wrong. > > -Jim P. >

2 1

Re: Exodus/C&W Depeering
by smd＠clock.org 27 Mar '02

27 Mar '02

| This isn't something I really care to make a big argument of, but my point | was that for many ISPs, the path will go from: | | SELF - EXODUS | | to: | | SELF - OTHER BACKBONE - C&W | | for a net increase in average path length. Are we talking AS_Path attributes here? If so, all this means is that now we don't announce OTHER BACKBONE routes to C&W/EXODUS, which we probably weren't doing anyway. Or are we talking forwarding paths, which are _different_ (and not necessarily stable even in the presence of perfect AS_Path stability)? If so, have we added any bottlenecks or sources of packet corruption? If none have been added, a change in the number of links and routers traversed is meaningless. (Note that it is possible that the number of links and routers DECREASES). Sean.

4 4