- Test - lists.nanog.org

FW: time for a new list?
by Lawrence A. Deleski 03 Nov '98

03 Nov '98

---------- >From: Brett_Watson(a)enron.net >To: nanog(a)merit.edu >Subject: Re: time for a new list? >Date: Tue, Nov 3, 1998, 5:29 PM > >na... the only thing that will ever work on this list is marshall law. or >better yet, a dictator. > >-brett > > I nominate Brett Watson. :-) Larry Deleski Program Manager Cisco PSO ldeleski(a)cisco.com

1 0

Re: time for a new list?
by Brett_Watson＠enron.net 03 Nov '98

03 Nov '98

na... the only thing that will ever work on this list is marshall law. or better yet, a dictator. -brett Peter Polasek <pete(a)cobra.brass.com> on 11/03/98 07:27:48 AM To: Josh Gluck <josh(a)tricreations.com> cc: nanog(a)merit.edu, Peter Polasek <pete(a)cobra.brass.com> (bcc: Brett Watson/Enron Communications) Subject: Re: time for a new list? I think that all that's needed are some loose guidelines. The sun-managers list, for example, loosely requires that all issues be discussed off-line (i.e. through direct e-mail to the submitter) after an issue has been initially submitted to the list. The submitter is then required to issue a summary of the results after all responses have been received. The only management that is in place (that I know of) is that the group mail-server rejects replies to the list address (which eliminates 95% of off-line discussions from being broadcast to the list). There are some habitual offenders of the rules, but it is largely an effective arrangement. I'm sure there are very many people (myself included) who have an interest in the NANOG discussions but simply can not take the sheer volume of messages. Peter On Tue, 3 Nov 1998, Josh Gluck wrote: > I have been reading this list for a while now, and for the most part, > just sitting back reading posts that interest me. I appreciate the early > heads up on outages, new info on networking technology and the like. > However, I do believe that moderating or "policing" the list would be a good > idea. I hate downloading my mail sometimes, for all the nonsense posts that > have been being sent to NANOG lately. Some of the threads go on forever or > seem to attract many of the following replies: > > { > > From: whoever(a)nowhere.com > To: Nanog(a)merit.edu > Subject: One REALLY LONG THREAD ABOUT NOTHING > > <<< > <<< Some quoted non needed long email from the thread > <<< that everyone has already seen about 20 times > <<< > > Agreed > > :) > > ------------------------------------------------------------ > >A 20 line sig that no one really cares about anyway > ------------------------------------------------------------ > > } > > These kind of replies are not needed. When I see these in my inbox, I > will stop reading the list and just delete everything. Most of us that > receive the list, don't need 3 pages of quoted material from the previous > post. All of the subscribers recieve the threads, I personally dont need it > more than once. Just use the original subject line and throw in a Re: > > As for a subscription requirement, that may be a little difficult as the > "good" information that passes through this list, is interesting to a great > deal of people that may not fit into the subscription group. It wouldn't be > fair to have them be denied from the right to see what is going on, however > a posting credentials requirement might be a good idea, but then again who > would enforce this, and what would the requirements be? > > I like this list a great deal, and use some of the information that I > gather from reading posts. I am willing to add any additional thoughts or > what have you, in an attempt to get NANOG more stream lined. I don't want > people to think that I am standing on a soap box, preaching, especially > because I don't really post to the list, but I am just letting everyone know > I would like to help make the list "a better place" > > > Josh Gluck - josh(a)tricreations.com > Senior Unix System Administrator > Tri Star Web Technical Support > 888-757-4248 > > > *The views expressed are my own and > do not reflect at all on the part of my > employer. > >

1 0

Re: machine specs for Netflow collector & Analyzer
by Brett_Watson＠enron.net 03 Nov '98

03 Nov '98

(this is with my customer login, not the "public" pages) flow collector: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/nfc/nfc_2_0/index.h tm and flow analyer: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/nfa/index.htm you want version 2.0 and the docs under there should have hardware requirements and all the knobs you want for data reduction, etc (ok, maybe not *all* the knobs but it's a nice improvement over v1.0) wow, did i just post something on-topic, and non-drivelous? -brett Roy Hockett <royboy(a)umich.edu> on 11/02/98 10:11:12 PM Please respond to Roy Hockett <royboy(a)umich.edu> To: nanog(a)merit.edu cc: (bcc: Brett Watson/Enron Communications) Subject: machine specs for Netflow collector & Analyzer I know this is not in the spirit of this list, however, I am sure those who have addressed this issue are participants in this list. If you have web resources, or FAQs please point me in this direction. I have seen a fair amount of threads on related to this topic on this list, but none of them address the equipment that is being used for the collection and analyzing of netflow data. We are looking to collect about Gig of netflow data/hour. We are looking into how we can purge unneeded details, and keep just stats. That said we will atleast want to keeps a weeks worth of data, and backup old data to tape. We most likely will us Solaris as the platform of choice, but are open to others recommendations. What memory and disk storage setups are people using to collect and analyze data set of this size? Any recommendations are welcome. Please respond to me directly. Thanks, -Roy Hockett

1 0

BSDi TCP Headers
by Jonathan A. Zdziarski 03 Nov '98

03 Nov '98

After dealing with packeteer for about a week regarding our latest problems, we finally were able to find the root of the problem; several other customers as well as myself all share one common thread; we all are experiencing crawling slow transfers with BSDi (when using the packetshaper). I tried it from a solaris machine on the same network, and transfers immediately picked up. Packeteer did some sniffing, and it appears that BSDi "breaks" the HTTP protocol, and we suspect it's doing the same thing with FTP (as that's where I'm having my problems). It's most likely the way it writes TCP headers rather than the protocol itself (i.e. apache isn't the one at fault). I've got an open issue with packeteer about it, they're trying to come out with a hack for their code to work with BSDi machines, but in the meantime it would be a better idea to solve the problem at the root and find out if there's anything the BSDi folks can do to explore/patch this problem. Is anyone else having similar problems w/BSDi and TCP Transport? Thank you, Jonathan A. Zdziarski Sr. Systems Administrator Netrail, inc. 888.NET.RAIL x240

1 0

Re: Xedia vs Packeteer Comparsion
by Tim Salo 03 Nov '98

03 Nov '98

> Date: Sun, 1 Nov 1998 08:54:04 -0500 (EST) > From: "Jonathan A. Zdziarski" <jonz(a)netrail.net> > Subject: Re: Xedia vs Packeteer Comparsion > [...] > I was told that the xedia boxes only shape outgoing bandwidth, not > incoming. ... > [...] This may be only a matter of what you call "outgoing" bandwidth. Any IP device only has control over how outgoing bandwidth is allocated (where "outgoing" is from the perspective of the device its self, _not_ in the sense of data "outgoing" from a local ISP to a national service provider). An IP device can only control how outgoing bandwidth is allocated by managing its outbound queues, for example deciding which packet to transmit next and which packet to drop next. The device has no control (in the absence of some sort of QoS request or QoS support from the [e.g., ATM] network) over how incoming bandwidth is allocated; all the device can do is receive the next packet that is sent to it on the line. -tjs

1 0

Morons?
by John Fraizer 03 Nov '98

03 Nov '98

At 06:50 PM 11/1/98 -0500, you wrote: >Hey morons argueing over the ssh bug, rootshell just posted an email >advisory, they have written code on an ssh-1.2.26 exploit. They were >hacked via ssh, and they have stated so on their web page as well. > > Dave McKay > themonk(a)lower.org > Systems/Security Admin > > Hello Mr. McKay. Firstly, I do wonder where you get off addressing NANOG as morons. Do you suppose to be the only individual in the readership with a clue? Before you crotch-check yourself and belt out "hell yes," perhaps you should re-read the email from mr Knox. I realize that being a the hero to network admins everywhere must take up an enormous amount of your time so, I have included the paragraph to which I am referring: [ Date: Sun, 1 Nov 1998 12:45:13 -0800 (PST) From: Kit Knox <kit(a)connectnet.com> X-Sender: kit(a)kit.rootshell.com To: nanog(a)merit.edu Subject: [rootshell] Security Bulletin #25 <snip> They appear to have jumped the gun slightly and do not have working exploit code, but have found possible buffer overflows in the ssh 1.2.26 code. Rootshell has also received further reports of exploit code going around in various circles. SSH Communications Security Ltd. has evaluated this bulletin and now believes it is actually not a problem. <snip> ] "reports of exploit code" and actual WORKING exploits are nowhere near the same. Hell, some marketing people would like you to believe "reports" of windows boxes outperforming *nix boxes on identical hardware running the same tasks. So, please tell all of us supposed "morons," where is the mention of the "code on an ssh-1.2.26 exploit" that they have written? Could you do us the service of posting a URL or are you too busy saving us from our feeble selves? What I'm seeing on the webpage live and in technicolor is the same email from IBM-ERS that was posted to NANOG with rootshell comments added in [] to each paragraph. There is no mention of their having a working exploit and there is no mention of them being "hacked" via SSH. The site states: [ On Wed Oct 28th at 5:12AM PST the main Rootshell page was defaced by a group of crackers. Entry to the machine was made via SSH (secure shell) which is an encrypted interface to the machine at 04:57AM PST this morning. Rootshell was first informed of this incident at 6:00 AM PST and the site was immediately brought offline. The site was back up and operational by 8:00AM PST. ] If you contend that this is being "hacked via ssh" I contend that you are making a huge leap. For all we know, and what I personally suspect, another box on the net was compromised that had a valid key with empty passphrase to login to the rootshell box. ------- John Fraizer | __ _ The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

2 1

digex smurf amplifiers
by Dan Hollis 03 Nov '98

03 Nov '98

Ok who do I talk to at digex to get their smurf amplifiers closed. I have a ticket open with them since Oct 21. -Dan

4 3

Re: [rootshell] Security Bulletin #25
by Richard Steenbergen 03 Nov '98

03 Nov '98

>Well, seeing how 2.0 is actually a commercial product and supposedly >re-written, I can see why they'd want to sell it. If you want to run ssh >and don't want to pay for it, you're stuck with the 1.x version. Those >that can pay do, and those that don't whine for some reason. It's not >like you couldn't take the source to 1.2.26 and alter it now, is it? Have you ever stopped to look at the src to 2.0? Large portions of it is unfinished. Hell the only symetric ciphers they have are DES (do we even have to go here), RC4 (a stream cipher that has been implimented wrong in SSH before), and Mars (an AES candidate from IBM which has known attacks against it). -- Richard Steenbergen <humble(a)lightning.net> Data Innovations System Admin http://www.bitchx.com/~humble - humble@EFnet - PGP KeyID: 0x21581362 PGP Fingerprint: 7552 6AB2 B9C7 5A1B F1B6 8EA3 DFCF 793D 2158 1362 Remember - Boss spelled backwards is "double S.O.B"

4 3

more on ticket systems...
by Rich Sena 03 Nov '98

03 Nov '98

found this on the jitterbug page - it's a link to a page full of ticket and helpdesk systems for linux... http://linas.org/linux/pm.html like I said pv - I need to pay attention... -- I am nothing if not net-Q! - ras(a)poppa.clubrich.tiac.net

1 0

Outage Archives/Outage Studies
by William B. Norton 03 Nov '98

03 Nov '98

Hi all - Have any of you stumbled upon an Internet outage study? I'm looking for classifications of outages by cause (circuits, router SW, misconfigurations, physical facilities like power, accidental pulled cables, etc) If not, has anyone assembled anything like an aggregated outage-archive page? Thanks in advance - Bill ---------------------------------------------------------------- William B. Norton <wbn(a)equinix.com> 734.662.0748 (Work/Home) http://www-personal.umich.edu/~wbn/ 734.604.1133 (cell)

1 0