> Randy,
>
> >What do folk do about persistent SNMP probers? I.e. j random clueless sites
> >which keep querying one's backbone router(s). E.g. this morning I get the
> >NOC shift change report with the folk hammering on our routers as if we were
> >stupid enough to use 'public' as the community string.
>
> The problem isn't so much stupid people as stupid default settings on some
> network tools. A lot of software exists for the "enterprise" network
> market. Apparently, the designers of this software don't realize that most
> enterprise IP networks touch the larger, fully connected Internet. The
> default settings on half a dozen products I've personally used default to
> trying to discover the entire Internet on startup.
>
> I learned this the hard way a few years back. Every night before going
> home, I'd re-boot a network monitoring station, which would crash during the
> night. The station was crashing somewhere in the middle of the discovery of
> net 18. After the third or fourth attempt at discovering net 18, I got a
> phone call from MIT, and realized why my network monitoring station was
> crashing. (whoops)
>
> Things got really interesting when I called up the manufacturer. I asked
> them to please help me stop this software discovery process. Took me half
> an hour of explaining to convince them that discovering the entire Internet
> wasn't in the best interest of their customers. Took a new version to
> really stop this "feature".
>
> >So every day some poor NOC person has to search these folk down with the
> >great tools we have, send email, get told they're nazi idiots, ...
> >
> >So what do folk do about this?
>
> Educate, then assassinate.
>
>
> Seriously, I think some education is needed for the proliferating
> manufacturers of lower end IP management tools. All of a sudden, there are
> a lot of IP monitoring products out there. Most all of our customers are
> running some sort of tool to check the status of their LAN workstations,
> etc. We've been having to educate almost every new customer lately.
>
> Maybe denying some TCP socket at the border router level would stop a lot of
> this?
>
> Regards,
>
> Bill
I wouldn't really blame this on the NMS vendors as much as the lack of
standardized topology information in standard MIBs. The NMS products
use the brute-force method for a reason... there's little else available
(there's nothing available in many products; MIB-II is (unfortunately)
often the only thing you can really count on across products. Its sort
of like a discussion here a few months ago about how useless traceroute
can be (though I really would not like to open up that discussion here
again).
I do agree that you can throttle it so it doesn't run amok, and users
shouldn't need to run it often (unless their own network's topology is
changing a lot).
Daniel
~~~~~~
