Re: Cross-country shipping of large network/computer gear?

2003-08-28 Thread N. Richard Solis

I've only shipped a few (moderately) heavy things on short notice in my 
career.  Almost all of those involved FedEx because it was simple and 
hassle-free.  If we're talking about shipping palettes of equipment then 
I agree with the  use of air cargo.  It wasn't entirely clear from the 
first post that a few palette's worth of equipment was what was being 
shipped.

BTW, counter-to-counter service isn't always handled as luggage.  In a 
few cases the package is hand-carried over to the cargo terminal where 
it's put on the next flight out.  Then it's held for you at the 
destination, NOT put out on the conveyor belt.

Most air cargo firms are set up to deal with companies that ship 
products as a part of their daily business.  They usually dont do a 
whole lot of business with individual shippers.  YMMV.  I've used air, 
rail, and truck.  IMHO, if you dont know a bill of lading from a hotel 
bill then an air cargo company isn't where you should start.

WRT FedEx: just because your stuff got damaged, don't assume that they 
break everything they touch.  There isn't a single business that I can 
think of that would tolerate a 40% loss rate on anything.  FedEx could 
NOT stay in business long with those kinds of numbers.  Nor could they 
keep an insurance carrier.


Robert E. Seastrom wrote:

 
  N. Richard Solis [EMAIL PROTECTED] writes:
 
   FedEx will be your best bet.  Trust me.
 
  FedEx Heavy = pay a surcharge for heavy boxes, get it moved by a 120
  pound delivery person with a handtruck rather than a pallet jack or
  other appropriate freight handling equipment... and dropped off the
  truck.  My experience is a 40% damage rate when shipping Cisco 7507
  and 7513 routers via FedEx Heavy.  Here are some pictures from back
  when I was at AboveNet: http://www.seastrom.com/fedex/
 
   You COULD do a counter to counter shipment via an airline cargo desk.
   That MIGHT be cheaper but you will still have to transport it from your
   spot to their pickup and back again on the other side.
 
  Counter-to-counter is the *last* way you would want to ship that sort
  of thing (handled as luggage on a flight, beat to hell by baggage
  handlers, and you get to retrieve it from baggage claim in an airport
  and schlep it all the way to your car).  Far better (if you have
  access to trucks on both ends) is to ship it air freight.  As you
  enter your favorite airport, follow the signs to Air Cargo, not the
  signs to the passenger terminal.  When you find a place with a lot of
  places for 18-wheelers to back up to loading docks, and relatively few
  places for cars to park, you've found the right place.  Matthew
  doesn't mention specific terminus points for the shipment, but based
  on whois information I'll make a wild guess that NYC is one end.  JFK
  appears to be the big United installation (vs LGA and EWR), per info
  on www.unitedcargo.com - I tend to prefer them because of their long
  hours for pickup and delivery at IAD, which makes life convenient for
  me.  :)
 
  If you need door-to-door service, there are numerous air freight
  forwarders who can handle palletized equipment and move it around the
  country/world in a timely fashion (and really, if you're talking about
  300+ pounds of rackmount equipment, that's how you want to move it
  anyway).
 
  Two companies that I've used and been quite happy with the results are
  Cavalier International and Eagle Global Logistics.  You may recognize
  Eagle's logo from stickers on previous shipments that you've gotten
  from major manufacturers who have stuff manufactured in the Far East.
  The Pros Know.
 
  http://www.eaglegl.com/
  http://www.cavalier-intl.com/
 
  ---Rob
 
 




Re: Plano, TX Legacy: Fiber Provider or Wireless Wireless question

2003-08-20 Thread N. Richard Solis

Wireless is a good option with a few caveats:

1. At the speeds you are talking about, you need line of sight. 
Usually, this means getting up high to account for curvature of the 
earth and clearing of what is called the fresnel zone for the particular 
frequency you are using.

2. You will need to use some of the higher frequency systems to get link 
speeds of a gig or more.  There are 23ghz unlicensed systems as well as 
60ghz unlicensed systems.  The 60ghz systems will get you higher speeds 
but the link distance will be on the order of hundereds of meters.

3. Link planning will be a critical exercise.  If you really NEED the 
high availability, you can get it by properly considering the distance 
you need to go, the speeds you will use, the frequencies you will 
transmit at, and the statistical expectations of weather and other 
factors that will affect the total path attenuation the system will 
encounter.  Systems that average availability of 99.99% are commonplace 
and 99.999% can be achieved by using shorter path distances.

Try the guys at www.ydi.com.  They will steer you right.

-Richard




[EMAIL PROTECTED] wrote:

 
  Looking for any advice or pointers for obtaining
  multiple Gig links (last mile) in the Plano, TX
  area.  The abundance of fiber options here seems
  to be decidedly underwhelming. Looking for suggestions
  including creative options such as wireless. I
  need to get from Plano to any closest better place for
  picking up multiple Gig Internet links.  Wondering
  too what other large companies in this area have done
  for large internet links...any advice appreciated.
 
  Also, I'm reading now that more ISP's are using
  wireless for last mile provisioning on the new
  unlicensed frequencies.  Was wondering if anyone
  had experience using Dragonwave or any similar
  wireless products in Texas. Do sandstorms and
  golf ball sized hail pose significant issues?
  Severe thunderstorms?  Would like to chat with
  anyone with significant wireless experience in
  the Dallas area. WOuldnt mind speaking with an
  unfluffed sales person eitehr. :-)
 
 
 
 




Re: Advice/Experience with small sized DDWM gear

2003-08-14 Thread N. Richard Solis

Fletcher,

My primary responsibility here is engineering exactly these kinds of 
systems.

The biggest difference between CWDM systems and DWDM systems is system 
reach.  Most CWDM systems are designed for short haul applications like 
yours (approx 20km and under.  Most DWDM systems are designed for much 
more expansive requirements (50-600km).  The primary reason for this is 
amplification and laser power.  CWDM systems use low power uncooled 
lasers that can drift in frequency making it hard for them to pack many 
channels into the limited transmission window provided by available 
fiber.  Amplifiers will raise the system cost.  DWDM systems use higher 
power lasers that are actively cooled to make them stable in frequency 
and consequently, you can fit more into the transmission window.  They 
get system reach by using optical amplifiers.

I've had great experience with several vendors but ultimately your 
choice depends on your particular situation and requirements.  CWDM will 
be much lower cost.  Look at the ONLINE 2500 series from Ciena or the 
CWDM options from Movaz Networks.  But don't stop there.  There are MANY 
other CWDM vendors that can help you.

Don't forget to check what kinds of channel bandwidths are supported. 
Some can provide actual BER information for each muxed channel.

If you have further questions, don't hesitate to contact me.


[EMAIL PROTECTED] wrote:

 
  On Fri, 20 Jun 2003 14:56:41 -0400  Deepak Jain wrote:
Nanogers,
   
We are looking for advice/experience from folks who has used small
  6-8
Wavelength DDWM.
   
Also what are the pros and cons of CDWM and DDWM?
   
Application;  5 Mile Dark Fiber between two carrier neutral hotels
  in SF.
   
All help is appreciated and results will be shared if requested.
   
  
   Arman,
  
 I think the biggest difference between small DWDM and CWDM is
  how much
   growth room you need.
  
 If you need 8 wavelengths (possibly 16 is still called CWDM
  but I doubt
it)
   you can stay on the CWDM side. The lasers and the gear is generally
  cheaper.
  
 With DWDM gear everything seems to be more expensive, but you
  get a lot
   more control as the electronics governing the chassis' tend to be
  much more
   advanced. On a short run like that, many advanced features like
  all-optical
   amplification and such are not necessary. I am not aware of any
  all-optical
   CWDM amplifiers yet. (for example).
  
 If you are planning more than just 1 DF run, you could buy the
  less
   expensive solution and just swap it out when you need something more
  and use
   the CWDM solution somewhere else.
  
 If you have decent/modern fiber, you should be able to
  comfortable sign
   al
   8 waves x 1G or 8 x 2.5G (full duplex). Some DWDM gear will let you
  double
   that on just 8 colors by going full duplex on each fiber (each thread).
  
 So its a question of how much BW you need and how much you
  want to pay
   for right now.
  
 (If I am wrong, someone please correct me).
  
   Hope this helps, let me know what you decide.
 
  I would be interested in recommendations for specific hardware.  We
  are looking at longer runs and the units must be NEBS compliant as the
  nodes are in telco COs.
 
  thanks,
  fletcher
 




Re: Power outage in North East

2003-08-14 Thread N. Richard Solis

I just got off the phone with an old boss of mine.  ;-)  It would appear 
that there is a large fire at a ConEd plant that has now caused a 
cascading power outage in the Northeast.  Some more plants may have 
tripped offline because of the load they absorbed from the loss of the 
other plant.

If I get more information, I'll post.

Damian Gerow wrote:

 
  Thus spake Joel Perez ([EMAIL PROTECTED]) [14/08/03 16:27]:
   Has anyone heard of a big Power outage in the North east?
   I just got a call from one of my tech's in the GBLX bldg in Newark, NJ
   at 1085 raymond and they are telling him that they lost power!
   But I also got a call from ATT in NY that they also lost Power!
 
  It looks like a rather large power outage -- we're in South Western
  Ontario,
  Canada, and power is out in Waterloo, Cambridge, Guelph, Hespler, and
  (I'm
  pretty sure) London as well.  Can't say about Toronto.
 
- Damian
 




Re: a list of hosts in a RPC BOTNET, mostly 209.x.x.x,

2003-08-10 Thread N. Richard Solis

Atlantech is local to me and sells a lot of DS1 internet access to Wireless ISPs.  
Maybe a war driver is having some fun...
 
 
Drew Weaver wrote:
 
 !-- /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; 
 margin-bottom:.0001pt; font-size:12.0pt; font-family:Times New Roman;} a:link, 
 span.MsoHyperlink {color:blue; text-decoration:underline;} a:visited, 
 span.MsoHyperlinkFollowed {color:purple; text-decoration:underline;} 
 span.EmailStyle17 {font-family:Arial; color:windowtext;} @page Section1 {size:8.5in 
 11.0in; margin:1.0in 1.25in 1.0in 1.25in;} div.Section1 {page:Section1;} --

 I've tried contacting abuse departments of several of these isps and none of them 
 seem to care, so I figured I would post the info here, and maybe someone will let 
 them know, the biggest offender is atlantech. These are all hosts that have been 
 compromised by the same person, they're being used to SYN flood 65.110.34.100

   

 If you want to see this glorious channel for your self its called #!LPOL! on 
 Undernet.

   

 Basically the way this works is your box gets attacked, then it sits on this irc 
 channel and waits for commands, in this case the command is !SYN 65.110.34 1000 6667 
  -s

   

 Anyways here is the list, and every 30 seconds or so 2 or 3 more jump into this 
 room.. the botnet is growing!

   

 #!LPOL! Jessica74 H [EMAIL PROTECTED] :3 Jessica743071

 #!LPOL! Claire272 H [EMAIL PROTECTED]

 #!LPOL! Sophia554 H [EMAIL PROTECTED] :3 Sophia554325

 #!LPOL! Chloe9013 H [EMAIL PROTECTED] :3 Chloe901312

 #!LPOL! Sydney542 H [EMAIL PROTECTED] :3 Sydney542199

 #!LPOL! Elsa12423 H [EMAIL PROTECTED] :3 Elsa124230

 #!LPOL! Minki7099 H [EMAIL PROTECTED] :3 Minki709990

 #!LPOL! Makayla57 H [EMAIL PROTECTED] :3 Makayla574543

 #!LPOL! Leslie525 H [EMAIL PROTECTED] :3 Leslie525606

 #!LPOL! Autumn319 H [EMAIL PROTECTED] :3 Autumn319583

 #!LPOL! Samantha3 H [EMAIL PROTECTED] :3 Samantha394828

 #!LPOL! Yamilla15 H [EMAIL PROTECTED] :3 Yamilla150205

 #!LPOL! Grace2018 H [EMAIL PROTECTED] :3 Grace201892

 #!LPOL! Lujan7794 H [EMAIL PROTECTED] :3 Lujan779454

 #!LPOL! Minki7888 H [EMAIL PROTECTED] :3 Minki788839

 #!LPOL! Briana185 H [EMAIL PROTECTED] :3 Briana185975

 #!LPOL! Angela274 H [EMAIL PROTECTED] :3 Angela274842

 #!LPOL! Anna79907 H [EMAIL PROTECTED] :3 Anna799072

 #!LPOL! Sung42146 H [EMAIL PROTECTED] :3 Sung421466

 #!LPOL! Estella68 H [EMAIL PROTECTED] :3 Estella680044

 #!LPOL! Jenna5293 H [EMAIL PROTECTED] :3 Jenna529394

 #!LPOL! Courtney6 H [EMAIL PROTECTED] :3 Courtney697581

 #!LPOL! Caroline5 H [EMAIL PROTECTED] :3 Caroline527031

 #!LPOL! Shannon50 H [EMAIL PROTECTED] :3 Shannon505552

 #!LPOL! Beyonce82 H [EMAIL PROTECTED] :3 Beyonce828929

 #!LPOL! Kelsey198 H [EMAIL PROTECTED] :3 Kelsey198278

 #!LPOL! Nicole203 H [EMAIL PROTECTED] :3 Nicole203361

 #!LPOL! Jasmine27 H [EMAIL PROTECTED] :3 Jasmine270357

 #!LPOL! Niki68912 H [EMAIL PROTECTED] :3 Niki689129

 #!LPOL! Bailey427 H [EMAIL PROTECTED] :3 Bailey427581

 #!LPOL! Emily9352 H [EMAIL PROTECTED] :3 Emily935216

 #!LPOL! Nicole893 H [EMAIL PROTECTED] :3 Nicole893482

 #!LPOL! Hannah294 H [EMAIL PROTECTED] :3 Hannah294622

 #!LPOL! Savannah7 H [EMAIL PROTECTED] :3 Savannah707812

 #!LPOL! Marissa29 H [EMAIL PROTECTED] :3 Marissa298910

 #!LPOL! Marissa89 H [EMAIL PROTECTED] :3 Marissa898535

 #!LPOL! Shakira76 H [EMAIL PROTECTED] :3 Shakira762665

 #!LPOL! Jenna8438 H [EMAIL PROTECTED] :3 Jenna843871

 #!LPOL! Ashley377 H [EMAIL PROTECTED] :3 Ashley377799

 #!LPOL! Andrea434 H [EMAIL PROTECTED] :3 Andrea434270

 #!LPOL! Jessica49 H [EMAIL PROTECTED] :3 Jessica494079

 #!LPOL! Caitlin83 H [EMAIL PROTECTED] :3 Caitlin835383

 #!LPOL! Denise777 H [EMAIL PROTECTED] :3 Denise777131

 #!LPOL! Nicole948 H [EMAIL PROTECTED] :3 Nicole948345

 #!LPOL! Haley0390 H [EMAIL PROTECTED] :3 Haley039010

 #!LPOL! Samantha1 H [EMAIL PROTECTED] :3 Samantha151353

 #!LPOL! Niki13026 H [EMAIL PROTECTED] :3 Niki130268

   

 I hope this isn't off topic.

   

 -Drew

   



RE: Humidity ranges?

2003-08-04 Thread N. Richard Solis

 IIRC, too low a humidity level makes static electricity a problem.  Too high makes 
the cold air condense on your equipment.  60-65% sounds about right.


 
Todd Mitchell - lists wrote:
 

 | and when I should
 | complain to the datacenter operators? (References I can point to would
 | be nice.)

 When your equipment starts to rust ;)

 I don't have any technical references, but I think that anything over
 65% is probably too much.  Most facilities I have equipment in do not
 exceed that mark.

 Todd

 --  






Re: Soviet era maps of Moscow (was Re: Backbone Infrastructure and Secrecy)

2003-07-09 Thread N. Richard Solis

 I can tell you that FREQUENTLY the maps dont match the reality of utility placement.  
Especially w.r.t. fiber paths.  VERY few cable maps that are availaible accurately 
reflect splice points or interconnects between mutiple cables entering a vault.  
Without access to the specific GPS points and the described arcs that are the 
foundation of a true GIS representation of installed plant, the maps are useless for 
anything more specific than knowing whether you are close enough to a fiber route even 
bother seeing if you can jump onto it.

At a power company that I worked at we had a huge GIS implementation going on.  Every 
pole, conduit, and cable was entered into the system along with all of the active 
elements like transformers and the like.  We had guys running around with GPS 
backpacks that received differential GPS coordinates and would walk the routes to 
enter the data with information about what they were standing next to.  With all of 
that effort, we would find that the map overlays that represented the streets and 
homes were so inaccurate that frequently a pole would appear as if it was right in the 
middle of the of a major roadway.  Thus began the process of cleaning up the city GIS 
implementation.  It was much better than the maps we had but it wasn't perfect.  
Sometimes the data doesn't get quite the sanity checking that it should.  Skill levels 
differ between mapmakers.

 
Sean Donelan wrote:
 

 On Tue, 8 Jul 2003, Pete Kruckenberg wrote:
  So, instead, we will all continue to blindly buy redundant
  infrastructure that uses the same fiber bundles, because we
  don't have the information to make a more intelligent
  choice. Just makes it easier for a terrorist to do his job.

 All the official soviet maps of Moscow were filled with errors
 because someone thought it would keep invaders from figuring out
 how to drive through the city.  Instead most tourists bought
 Moscow maps from the US Central Intelligence Agency, because they
 were more accurate than the soviet maps.

 The Automobile Association of America has long offered triptiks as
 a membership benefit.  Tell AAA the starting and ending points of
 your trip, and they will create a customized map booklet of the entire
 route. Think how useful a AAA membership would be to a terrorist.

 I haven't seen Sean Gorman's maps so I don't know if he has really
 put together something unique, or its similar to the same types of
 maps other people create as we've built our networks.  The
 interesting thing about many maps is how often they are incorrect,
 just like the soviet era maps of Moscow.  Just because a map show fiber
 runs between two points doesn't mean either the fiber or the circuits
 actually follow the line on the map.  Would you consider 50 mapping
 errors per trench mile good or bad?  At an Underground Damage Prevention
 conference one of the speakers was explaining how to reduce the error
 rate.

 The second phase of frustration about network design is once you've
 managed to get a map, finding out the real world doesn't match the map.

 BTW, I'm still looking for decent network mapping software :-)






Re: LH/ELH Recommendations?

2003-05-30 Thread N. Richard Solis

I'm afraid that there isn't a good commercially-available way to send any high speed 
optical signal over a single continuous fiber for 200 miles.  The physics simply 
prohibit it.

The source of the problem is a limit on the maximum launch power into the fiber before 
you start to see interesting material interaction effects of high laser power on glass 
fibers.  At last guess, that limit was about +17dBm into standard SMF-28.  Couple this 
with a typical receive sensitivity of -12dBm for 10gpbs signals and you've for about 
29dB of link margin to work with.  Assuming of course that there aren't any patches or 
other attenuators in the path, and at a typical attenuation of .25db/km, that gets you 
about 116km.  That's about 70 miles.  Of course, I might be wrong about the exact 
figures, but you get the idea.

Using an optical amplifier is the best bet but like all amplifiers it will introduce 
noise into the signal.  You'll need something to measure OSNR (Optical SNR) to make 
sure that your signal will even be readable at the far end.  Amps generate more noise 
at high gain levels.  You COULD go out and buy an optical  gain block to do this but 
it would be a kludge and COULD damage your optics on the far end.

In short, there aren't many solutions that are cheap that will let you do this without 
putting some equipment along the way to amplify, regenerate, or otherwise enhance the 
signal.

FWIW, most terrestrial fiber networks are designed around a 25db span loss, or roughly 
70-80 km.  If there was an easy, cheap way available today to reduce the number of 
expensive AMP/REGEN huts your typical long-haul provider would require, it would have 
been found by now.

Dont believe anyone who tells you they can send a signal 4000km without regeneration.  
They are talking about electrical regen, not optical amplification.


Deepak Jain wrote:



 Last time I asked the list for recommendations on how to solve a short reach
 fiber problem I got some amazing answers and suggestions -- for which, I am
 still appreciative of. I summarized for everyone who asked and will gladly
 do so if anyone else would like to know.

 I've got a new pickle I am trying to work through and have been wholly
 unexcited by the solutions various vendors are talking about (read: $=x^n).
 I am trying to signal over a dark fiber (SMF) loop of about 200 miles.
 (150mi on one leg and 50mi on the other). I would _like_ to find a 10GE
 solution (say a XENPAK module that will do 150miles), but GE would do if it
 supports some kind of xWDM.

 I am afraid I am going to have to go Lucent LamdaXtreme or Cisco ONS 15800,
 but am hoping that is just overkill. Heck, a source for used LH/ELH SONET
 OADMs would be fanastic if a router-based solution isn't obvious.

 I am certain many on this list have tackled this kind of problem in
 particularly ingenious ways. Your pointers are very much appreciated.

 Thanks in advance,

 DJ








Re: Cascading Failures Could Crash the Global Internet

2003-02-06 Thread N. Richard Solis

I don't know of too many electrical distribution networks that use DC
interconnection to limit AC failures from propogating.

The main cause of AC disruption is a power plant getting out of phase
with the rest of the power plants on the grid. When that happens, the
plant "trips" of goes off-line to protect the entire grid. You lose
some generating capacity but you dont fry everything on the network
either.

http://www.nerc.com/

There are some states that operate their own grids. Texas, for example.

-Richard


Sean Donelan wrote:
 
  
  
Sigh, there are differences between tightly coupled networks, such as 
the electric power grid and loosely couple networks like the Internet. 
But there are also some similarities, such as electric grids use DC 
interconnections to limit how far AC disturbances propagate; the 
Internet uses AS interconnections to limit IGP disturbances from 
propagating. 
  
  http://sci.newsfactor.com/perl/story/20686.html 
  
The actual article requires payment to read 
  http://ojps.aip.org/getabs/servlet/GetabsServlet?prog=normalid=PLEEE8660606510201idtype=cvipsgifs=Yes 
  
  
   



Re: Cascading Failures Could Crash the Global Internet

2003-02-06 Thread N. Richard Solis


Vadim Antonov wrote:
 
  
  
On Thu, 6 Feb 2003, N. Richard Solis wrote: 
  
 The main cause of AC disruption is a power plant getting out of
phase 
 with the rest of the power plants on the grid. 
  
This is typically a result of sudden load change (loss of transmission 
line, short, etc) changing the electromagnetic drag in generators, and, 
therefore, the speed of rotation of turbines. 
  
 When that happens, the plant "trips" of goes off-line to protect
the 
 entire grid. 
  
Some difference in phase is tolerable, the resulting cross-currents 
generate heat in the trasmission lines and transformers. 
  
It is not sufficient to disconnect a generator from the grid. Since
water 
gates or steam supply can not be closed off fast, the unloaded turbine 
would accelerate to the point of very violent self-destruction. So the 
generators are connected to the resistive load to dump the energy
there. 
Those resistors are huge, and go red-hot in seconds. If a gate or
valve 
gets stuck, they melt down, with the resulting explosion of the
turbine. 
  
 You lose some generating capacity but you dont fry everything on
the 
 network either. 
  
Well... not that simple. A plant going off-line causes sudden load 
redistribution in the network, potentially causing overload and phase 
shifting in other plants, etc. A cascading failure, in other words. 
  
Yeah yeah yeah. I know that everything isn't simple. I actually
worked at a power plant so none of this is new to me. Can cascading
failures occur? Yes. Witness the Great Blackout in NYC. My point was
that there are places where the electrical network is designed to "blow
the bolts" to TRY and protect everything. Does it work? Most of the
time, yes. All of the time? NO.

It is a complicated problem but you'd be suprised at how fast things
can happen when you HAVE to keep the system running. There is a
tremendous amount of skill concentrated in that field and they do a
good job of keeping everything running well. How many turbine
overspeed events do you get notified about? Those guys can do a rapid
shutdown of a plant VERY quickly. Turning it back on though is a whole
different matter. We needed to have one station operating so that we
could actually get the big one going. Then we'd take the small one
offline and bring it back up quickly to handle specific load peaks.

The loss of a single transmission line isn't going to cause a whole
station to trip. If you're losing a bunch though, you've probably got
lots of other problems to worry about.


--vadim 
  
  
   



RE: your mail

2002-08-21 Thread N. Richard Solis


Who did you think held the cellphone and the pager? :-)

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
David Lesher
Sent: Wednesday, August 21, 2002 12:32 AM
To: nanog list
Subject: Re: your mail



Unnamed Administration sources reported that N. Richard Solis said:


 If you haven't worked in an environment where you had to turn in your
 cellphone and pager at the front desk, show a badge to a camera around
every
 corner, and get your office keys from a vending machine you dont know what
 real security looks like.

You missed the places w/ real security. That's where the very
polite Marine Security Guard with the 870 shotgun asks to see
your badge again...



--
A host is a host from coast to [EMAIL PROTECTED]
 no one will talk to a host that's close[v].(301) 56-LINUX
Unless the host (that isn't close).pob 1433
is busy, hung or dead20915-1433




RE: Shared facilities (was Re: your mail)

2002-08-21 Thread N. Richard Solis


Sean,

For a lot of people, these locations are a place to store an entire web
presence.  That might include order information or private email or credit
card records for an entire day's transactions.  My feeling is that the
general purpose of security at these locations is to make sure that no one
is tampering with any equipment in any way, to include unauthorized removal.

That was the point of my previous email.  The connections to those machines
and the data stored on them is what is of value in those locations, not the
physical security of the people.

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
Sean Donelan
Sent: Wednesday, August 21, 2002 2:03 AM
To: [EMAIL PROTECTED]
Subject: Shared facilities (was Re: your mail)



On Wed, 21 Aug 2002, David Lesher wrote:
 Unnamed Administration sources reported that N. Richard Solis said:
  If you haven't worked in an environment where you had to turn in your
  cellphone and pager at the front desk, show a badge to a camera around
every
  corner, and get your office keys from a vending machine you dont know
what
  real security looks like.
 You missed the places w/ real security. That's where the very
 polite Marine Security Guard with the 870 shotgun asks to see
 your badge again...

Sigh, and in places with real security you rarely find enemies/competitors
sitting in the same room.  Exchange points are like the United Nations,
not high security military bases.  AMS-IX, Equinix, Linx/Telehouse, PAIX,
etc provide a neutral facility for competitors to exchange network traffic.
The facility operators provide a reasonable level of security, and try to
keep the diplomats from punching each other.  Its in all (most?) the
competitors' self-interest to follow the rules.

Let's not lose sight of the purpose of colocation/exchange points.
If we start requiring you to be a US citizen and have top secret
clearance in order to enter a colocation facility, we've probably
decreased the usefulness of the exchange points.





RE: your mail

2002-08-20 Thread N. Richard Solis


I think that getting caught is a good indication that they take the security
of the facility seriously.  Some places will ban you forever if you violate
their policies.  The mantrap thing is there for a reason.  People are always
free to build out their own spaces however they wish.  If you don't like
their policies, don't colo there.  Build your own.  I like their approach of
controlling access very tightly.  Overkill is definitely better than
underkill.  My experience is that a lot of security measures that appear
ridiculous or redundant actually act as a defense-in-depth strategy.  Their
practice of requiring a guard to leave the control booth to allow someone in
instead of using a buzzer may seem stupid but serves an important but not
entirely well-publicized purpose.


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
Paul Vixie
Sent: Tuesday, August 20, 2002 2:54 PM
To: [EMAIL PROTECTED]
Subject: Re: your mail



[EMAIL PROTECTED] (Nathan Stratton) writes:

 Uh, yes. Equinix is a rip off in general. I got kicked out of Chicago
 using the side door. I was sick of the stupid man trap crap and noticed
 they had a door that was propped open in the back that leads outside. It
 was much easier to back the truck up there and go in and out. The whole
 thing is a joke, they spent a lot of cash to look good, but there is very
 little substance.

nevertheless PAIX hasn't made it to chicago yet, and equinix is quite
a bit more neutral than a normal abovenet/exodus/att/qwest/ibm/uunet
hosting center would be, and that makes them the only game in that town.

i recommend that you work hard at helping them fix whatever it is they're
doing wrong.  think of your work in that regard as a public service.
--
Paul Vixie




RE: your mail

2002-08-20 Thread N. Richard Solis


Leaving or forcing doors to be propped open generally triggers an alarm that
prompts a visit from someone in security.  It is entirely possible that
someone who worked at the facility informed the security staff of what they
were doing because they needed to leave the door open to fetch a package or
something that was going to be moved through that door.  It's also entirely
possible that someone working there was violating the security policy
entirely.  That happens as well.  I would need many more fingers and toes to
count the number of sleeping guards I've caught at colo sites.

The point is: people do dumb things that compromise security for everyone in
order to make their own lives easier.  A good security plan anticipates
these lapses and puts measures in place to deal with them.

If you haven't worked in an environment where you had to turn in your
cellphone and pager at the front desk, show a badge to a camera around every
corner, and get your office keys from a vending machine you dont know what
real security looks like.

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
Majdi S. Abbas
Sent: Tuesday, August 20, 2002 3:13 PM
To: N. Richard Solis
Cc: [EMAIL PROTECTED]
Subject: Re: your mail



On Tue, Aug 20, 2002 at 03:08:22PM -0400, N. Richard Solis wrote:
 I think that getting caught is a good indication that they take the
security
 of the facility seriously.

Which is clearly exhibited by them leaving a side door propped
open, or not checking or securing this door earlier

--msa




RE: your mail

2002-08-20 Thread N. Richard Solis


Then the appropriate person to talk to is the account manager.  Catching a
problem yourself doesn't do anyone any good if the management of the
facility (or the company) isn't involved.  My experience is that a LOT of
companies want to hear from customers when things go amiss.  They can't
always rely on their own employees to let them know when the are falling
down on the job.  I've gotten corrective action form people just by
threatening to bring in a higher management layer.  People would rather fix
a problem themselves than allow their management to fix it for them.

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
Nathan Stratton
Sent: Tuesday, August 20, 2002 5:07 PM
To: N. Richard Solis
Cc: Majdi S. Abbas; [EMAIL PROTECTED]
Subject: RE: your mail



On Tue, 20 Aug 2002, N. Richard Solis wrote:

 Leaving or forcing doors to be propped open generally triggers an alarm
that
 prompts a visit from someone in security.  It is entirely possible that
 someone who worked at the facility informed the security staff of what
they
 were doing because they needed to leave the door open to fetch a package
or
 something that was going to be moved through that door.  It's also
entirely
 possible that someone working there was violating the security policy
 entirely.  That happens as well.  I would need many more fingers and toes
to
 count the number of sleeping guards I've caught at colo sites.

Correct, I am sorry I think that is my point. There are a lot of things
that they SHOULD have been doing, but they were not. I am saying they
spent lots of money on a security image and not on security. They never
found me using the door and that is a problem, when I let them know about
their issues they rather shut me up then deal with them.

 The point is: people do dumb things that compromise security for everyone
in
 order to make their own lives easier.  A good security plan anticipates
 these lapses and puts measures in place to deal with them.

 If you haven't worked in an environment where you had to turn in your
 cellphone and pager at the front desk, show a badge to a camera around
every
 corner, and get your office keys from a vending machine you dont know what
 real security looks like.

I know what real security looks like, I also know what real security is. I
am saying that I am willing to pay for real security, but I am not willing
to page for the image of real security and go through the hassle of the
image of real security when there is no real security. I don't know about
all of their sights, but at least two have the security image when you
walk in, but the rest of the building and other entrances have less then
my house.



Nathan Stratton
nathan at robotics.net
http://www.robotics.net