RE: 10GE access switch router

2004-09-29 Thread Temkin, David

Bill,


With the right amount of prep work and understanding of how the
stacking works, you can control everything you complained about.

I complained about the same stuff until I read the document that
explains how to:

1) Renumber a switch in the cluster (and all of it's interfaces with it)

2) Hot swap a new switch into the cluster
3) - and this one's sweet - upgrade the s/w on the entire cluster in one
shot, even if they're different models
4) Control which switch is the master so that adding a new switch to the
stack doesn't chance screwing up your configs. 
5) Permanently remove all stacking config from the switch

The actual backplane has lived up performance wise in the testing I've
done, but I haven't come anywhere near testing it to 32gbps.


Just the same as thousands of people have wiped out every VLAN on their
network by putting in a switch with a higher VTP revision number with no
VLANs defined, it takes a learning curve to work well with these
suckers.

Granted - the software has been somewhat buggy - but those aren't the
merits I'm debating.

http://www.cisco.com/en/US/customer/products/hw/switches/ps5023/products
_configuration_guide_chapter09186a00801a6558.html



 -Original Message-
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
 Behalf Of Bill Woodcock
 Sent: Wednesday, September 29, 2004 11:33 AM
 To: Deepak Jain
 Cc: Frederic NGUYEN; [EMAIL PROTECTED]
 Subject: Re: 10GE access switch router
 
 
   On Tue, 28 Sep 2004, Deepak Jain wrote:
  Just a note, if you want redundant 10GE uplinks you 
 need to get two of
  these and stack them. The stacking interface does not 
 reduce the amount
  of switching bandwidth to the front ports IIRC.
 
 ...and the stacking interface is actually pretty lousy, from 
 our testing.
 We were anticipating really liking it, but we haven't touched 
 it again, since our lab work.  Obviously it precludes 
 hot-swappability, but beyond that, using it wipes any 
 preexisting configuration on all but the first box (and out 
 of two, I don't know how to predict which it will decide is 
 first, in advance), and it leaves the port-numbering screwed 
 up on any boxes that have used it, in perpetuity.
 
 -Bill
 
 
 


IMPORTANT: The information contained in this email and/or its attachments is 
confidential. If you are not the intended recipient, please notify the sender 
immediately by reply and immediately delete this message and all its attachments.  Any 
review, use, reproduction, disclosure or dissemination of this message or any 
attachment by an unintended recipient is strictly prohibited.  Neither this message 
nor any attachment is intended as or should be construed as an offer, solicitation or 
recommendation to buy or sell any security or other financial instrument.  Neither the 
sender, his or her employer nor any of their respective affiliates makes any 
warranties as to the completeness or accuracy of any of the information contained 
herein or that this message or any of its attachments is free of viruses.


Website contact for www.cisco.com

2004-09-23 Thread Temkin, David

Can someone responsible for either security or operations of
www.cisco.com please contact me?  We are seeing an issue where you may
be blocking one of our source IP addresses from accessing the website.

Thanks,
-Dave

David Temkin
S-I-G



IMPORTANT: The information contained in this email and/or its attachments is 
confidential. If you are not the intended recipient, please notify the sender 
immediately by reply and immediately delete this message and all its attachments.  Any 
review, use, reproduction, disclosure or dissemination of this message or any 
attachment by an unintended recipient is strictly prohibited.  Neither this message 
nor any attachment is intended as or should be construed as an offer, solicitation or 
recommendation to buy or sell any security or other financial instrument.  Neither the 
sender, his or her employer nor any of their respective affiliates makes any 
warranties as to the completeness or accuracy of any of the information contained 
herein or that this message or any of its attachments is free of viruses.


RE: NYSE

2004-09-22 Thread Temkin, David

And let's not forget that if you use that 3rd party provider, especially
to connect to SIAC, you pay a premium to have someone to blame other
than the actual data provider.  

 

 -Original Message-
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
 Behalf Of [EMAIL PROTECTED]
 Sent: Wednesday, September 22, 2004 5:36 AM
 To: nanog
 Subject: Re: NYSE
 
 
  I would prefer not to use a third party provider because of the IP 
  backbone. My experience has been witht eh third party providers is 
  that there is not enough responsiveness (packet loss issues) to 
  burstable traffic at market open and close.
  Unfortunately when the third party networks were designed 
 there was no 
  forethought into the need for market data traffic or multicast.
 
 Hmmm... well I happen to work in Engineering at Radianz.
 
 I can assure that our network was designed for multicast so 
 that there are two resilient low latency paths for multicast 
 traffic throughout our network in spite of the tendency of IP 
 to have a single best path. And our basic design rules for 
 network capacity worldwide are to allow for the bursts that 
 happen at U.S. Market Open.
 
 The advice to go to a 3rd party provider who specializes in 
 the financial services industry is a good one because we and 
 our competitors tend to understand the special needs of 
 companies in that industry. If you want to discuss this 
 further with one of our technical sales support people, then 
 send me an email and I'll put you in touch.
 
 --Michael Dillon
 
 


IMPORTANT: The information contained in this email and/or its attachments is 
confidential. If you are not the intended recipient, please notify the sender 
immediately by reply and immediately delete this message and all its attachments.  Any 
review, use, reproduction, disclosure or dissemination of this message or any 
attachment by an unintended recipient is strictly prohibited.  Neither this message 
nor any attachment is intended as or should be construed as an offer, solicitation or 
recommendation to buy or sell any security or other financial instrument.  Neither the 
sender, his or her employer nor any of their respective affiliates makes any 
warranties as to the completeness or accuracy of any of the information contained 
herein or that this message or any of its attachments is free of viruses.


RE: NYSE

2004-09-21 Thread Temkin, David

You can no longer order direct lines to SIAC unless you have an
extremely compelling reason.  Nowadays you must order a line to SFTI
which is their Disaster-Recovery-centric service.  You are correct about
the connection method, but he will need to be specific and understand
that he wants to connect to SFTI and not just SIAC directly anymore.

See: https://sfti.siac.com/sfti/index.jsp  for more details.



 -Original Message-
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
 Behalf Of Alen Capalik
 Sent: Monday, September 20, 2004 10:20 PM
 To: Philip Lavine
 Cc: nanog
 Subject: Re: NYSE
 
 
 
 On Mon, Sep 20, 2004 at 10:36:16AM -0700, Philip Lavine wrote:
  
  If I where to connect to SIAC thru a SONNET ring who's 
 would it be? Is 
  it private or public?
 
 They use any provider (Verizon, MCI, ATT and ConEd Comm.), 
 however ConED Comm. is their primary backbone provider.  So, 
 here's how you go about it.  You order a line (DS-1, DS-3, 
 100Mb/s, Gig, whatever) from any of the providers you use (if 
 I were you I would use either Verizon or ConEd Comm, I can 
 give you the number for ConEd Comm. head sales person).  You 
 contact SIAC, and you start the paperwork to get your network 
 connected into their backbone SONET.  Once you get permit 
 numbers, you have the provider drop a line into one of 5 data 
 centers around NY area, and SIAC gives you a port on one of 
 their Juniper Routers.  They also give you a VLAN setup 
 requirements so you can configure your border switch/router.  
 The line is owned by you.  SIAC only gives you a port on 
 their routers.  NOTE: NEVER ORDER ONE LINE.
 ORDER TWO OR MORE LINES TO DIFFERENT SIAC DATA CENTERS.  The 
 cost for one port (one line) is as follows:
 
 MRC (Monthly Reaccuring Cost):
   $4,400.00 
 NRC (Non-Reaccuring Cost i.e. one time fee):  $8,800 
 
 Any line you drop at SIAC will cost you that amount, and 
 that's on top of the line costs from the provider.  That's 
 it.  Hope this helps.  Like I said it's a very long and 
 tedious process getting the line up and running with SIAC.  
 They are practically a government institution, and they don't 
 move too fast for anybody.
 
  
  --- R. Benjamin Kessler [EMAIL PROTECTED] wrote:
  
   I've setup a highly-redundant connection for one of my clients 
   (equipment in two different access-centers in two 
 different cities).
   
   What are you looking to do?
   
   - Ben
   
   ~~
   R. Benjamin Kessler
   Sr. Network Consultant
   CCIE #8762, CISSP, CCSE
   Midwest Network Services Group
   Email: [EMAIL PROTECTED]
   http://www.midwestnsg.com
   Phone: 260-625-3273
   
   -Original Message-
   From: [EMAIL PROTECTED]
   [mailto:[EMAIL PROTECTED] On Behalf Of Philip Lavine
   Sent: Friday, September 17, 2004 2:38 PM
   To: [EMAIL PROTECTED]
   Subject: NYSE
   
   
   Does anyone have experience in setting up a direct 
 connection with 
   NYSE, specifically SIAC or SFTI?
   
   
 
   __
   Do you Yahoo!?
   Read only the mail you want - Yahoo! Mail SpamGuard.
   http://promotions.yahoo.com/new_mail
   
   
   
   
  
  
  
  
  __
  Do you Yahoo!?
  New and Improved Yahoo! Mail - Send 10MB messages!
  http://promotions.yahoo.com/new_mail
 
 --
 Alen Capalik
 CTO
 Wiretap Networks Inc.
 
 Tel:  (310)497-3512
 Email:[EMAIL PROTECTED]
 Website:  http://www.wiretapnetworks.com
 
 /*
  *  Anything that is considered impossibility,
  *  will in fact occur with absolute certainty.
  */
 


IMPORTANT: The information contained in this email and/or its attachments is 
confidential. If you are not the intended recipient, please notify the sender 
immediately by reply and immediately delete this message and all its attachments.  Any 
review, use, reproduction, disclosure or dissemination of this message or any 
attachment by an unintended recipient is strictly prohibited.  Neither this message 
nor any attachment is intended as or should be construed as an offer, solicitation or 
recommendation to buy or sell any security or other financial instrument.  Neither the 
sender, his or her employer nor any of their respective affiliates makes any 
warranties as to the completeness or accuracy of any of the information contained 
herein or that this message or any of its attachments is free of viruses.


RE: RE: NYSE

2004-09-21 Thread Temkin, David

It's my understanding that 
A) The providers of the actual ring did install Separate fiber for
SFTI but I have no idea whether or not they're in new rights of way -
I'm willing to bet not

B) Reducing the points of entry into the ring reduces complexity and
makes it much easier to recover the ring in the event of a disaster.
Understanding that SIAC has thousands and thouands of customers
connecting at the DS-3+ level to get data that's generated from one
place means that you need to keep the distribution uniform.  Basically,
it boils down to them being able to say Our ring is up, if your
connectivity to our ring is down it's your problem in order to maintain
fairness between Trading firm A that has 10 people and Trading firm B
that has 10,000 people.  

When they were maintaining separate interfaces for each customer they
could potentially run into issues where they'd get certain larger firms
back able to trade sooner than smaller ones and then you create unfair
market disadvantages. 

 -Original Message-
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
 Sent: Tuesday, September 21, 2004 10:40 AM
 To: Temkin, David
 Cc: Alen Capalik; Philip Lavine; nanog
 Subject: Re: RE: NYSE
 
 
 There are a few things about the SFTI set up that are a bit 
 baffling to me.  From their website:
 
 SFTI carries IP traffic over a topology of redundant, 
 self-healing fiber-optic rings, completely independent of all 
 other telco circuits and conduits. SFTI's design is 
 straightforward, consolidating traffic into fewer pipes, 
 which minimizes complexity and reduces the number of 
 potential points of failure. 
 
 What does completely independent of all other telco circuits 
 and conduits mean?  Did they get their very own new right 
 of ways dug out.  A certain government report listed their 
 physical fiber provider, and they certainly are not new right 
 of ways.  Further, I'm a bit baffled how reducing the number 
 of pipes reduces the number of potential points of failure.  
 Usually fewer pipes means less diversity.  A ring is nice 
 till someone hits it in two places.  I also wonder how many 
 of these rings are collapsed in a single conduit.  I hope 
 someone over there is asking tough questions and are 
 following up on getting a second physical fiber provider.  
 I'd recommend not advertising who it this time either.
 
 - Original Message -
 From: Temkin, David [EMAIL PROTECTED]
 Date: Tuesday, September 21, 2004 9:45 am
 Subject: RE: NYSE
 
  
  You can no longer order direct lines to SIAC unless you have an 
  extremely compelling reason.  Nowadays you must order a 
 line to SFTI
  which is their Disaster-Recovery-centric service.  You are correct 
  aboutthe connection method, but he will need to be specific and 
  understandthat he wants to connect to SFTI and not just SIAC
  directly anymore.
  
  See: https://sfti.siac.com/sfti/index.jsp  for more details.
  
  
  
   -Original Message-
   From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED] On Behalf 
   Of Alen Capalik
   Sent: Monday, September 20, 2004 10:20 PM
   To: Philip Lavine
   Cc: nanog
   Subject: Re: NYSE
   
   
   
   On Mon, Sep 20, 2004 at 10:36:16AM -0700, Philip Lavine wrote:

If I where to connect to SIAC thru a SONNET ring who's
   would it be? Is
it private or public?
   
   They use any provider (Verizon, MCI, ATT and ConEd 
 Comm.), however 
   ConED Comm. is their primary backbone provider.  So, 
 here's how you 
   go about it.  You order a line (DS-1, DS-3, 100Mb/s, Gig, 
 whatever) 
   from any of the providers you use (if I were you I would 
 use either 
   Verizon or ConEd Comm, I can give you the number for ConEd Comm. 
   head sales person).  You contact SIAC, and you start the 
 paperwork 
   to get your network connected into their backbone SONET.  
 Once you 
   get permit numbers, you have the provider drop a line 
 into one of 5 
   data centers around NY area, and SIAC gives you a port on one of 
   their Juniper Routers.  They also give you a VLAN setup 
 requirements 
   so you can configure your border switch/router.
   The line is owned by you.  SIAC only gives you a port on their 
   routers.  NOTE: NEVER ORDER ONE LINE.
   ORDER TWO OR MORE LINES TO DIFFERENT SIAC DATA CENTERS.  The cost 
   for one port (one line) is as follows:
   
   MRC (Monthly Reaccuring Cost):
 $4,400.00 
   NRC (Non-Reaccuring Cost i.e. one time fee):  $8,800 
   
   Any line you drop at SIAC will cost you that amount, and 
 that's on 
   top of the line costs from the provider.  That's it.  Hope this 
   helps.  Like I said it's a very long and tedious process 
 getting the 
   line up and running with SIAC.
   They are practically a government institution, and they 
 don't move 
   too fast for anybody.
   

--- R. Benjamin Kessler [EMAIL PROTECTED] wrote:

 I've setup a highly-redundant connection for one of my
  clients
 (equipment in two

RE: RE: RE: NYSE

2004-09-21 Thread Temkin, David

You are correct.  The rings are geographically diverse and separated
(ie, they have separate rings for each metro and then tie the rings
together in multiple places).  No idea about the right-of-ways, but my
understanding is that it wasn't necessarily meant to be a be-all-end-all
for those sorts of outages.

You are correct, however, it is one of the most reliable infrastructures
we connect to. 

 -Original Message-
 From: R. Benjamin Kessler [mailto:[EMAIL PROTECTED] 
 Sent: Tuesday, September 21, 2004 12:39 PM
 To: [EMAIL PROTECTED]; 'Temkin, David'
 Cc: 'Alen Capalik'; 'Philip Lavine'; 'nanog'
 Subject: RE: RE: RE: NYSE
 
 My understanding is that the way the SFTI network is built 
 the loss of an entire ring between Site A and Site B wouldn't 
 cause an outage because Site B would also have a ring between 
 it and Site C and Site A would be connected to Site n.
 
 I can't speak to how the fibers were procured and whether or 
 not they're in their own rights-of-way (as another poster 
 suggested; I'd guess that they're using previously dark fiber 
 in existing bundles).
 
 Based-on the drawings I've seen (unfortunately, they don't 
 appear to be on SFTI's web site so they must be considered 
 proprietary) the multiple rings are separated in some places 
 by several hundred miles to prevent the single back hoe incident.
 
 Aside from the $$ and the joy of dealing with SIAC (they tend 
 to be a bit inflexible at times), the infrastructure has been 
 quite stable in the 18 months that my client has been using it.
 
 -Original Message-
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
 Behalf Of [EMAIL PROTECTED]
 Sent: Tuesday, September 21, 2004 10:31 AM
 To: Temkin, David
 Cc: Alen Capalik; Philip Lavine; nanog
 Subject: Re: RE: RE: NYSE
 
 
 
 So, that would be a another conduit sitting in the same right 
 of way, and this is supposed to make it completely 
 independent.  Last time I checked a backhoe treated all 
 conduits the same.  Not trying to shoot the messanger jsut 
 trying to make a point.
 
 Points of entry is different than the number of pipes.  The 
 biggest single problem in the security of these networks is 
 physical diversity, at least in my biased point of view.  
 There are six different sets of right of ways in Manhattan 
 and forty something fiber providers, but no one seems to fess 
 up when they are not offering redundancy but just another 
 pipe in the same conduit.  Do the math and you see the 
 problem.  It is not just a SFTI problem but a generic 
 problem.  Just worrisome that it appears that SFTI does not 
 see it as a problem, or worse view at as a problem they have 
 solved by laying new pipe in the same conduits.
 
 The problem rears it head in several examples where 
 effeciency and cost savings trumps true diversity.  
 
 - Original Message -
 From: Temkin, David [EMAIL PROTECTED]
 Date: Tuesday, September 21, 2004 11:11 am
 Subject: RE: RE: NYSE
 
  It's my understanding that
  A) The providers of the actual ring did install Separate 
 fiber for 
  SFTI but I have no idea whether or not they're in new 
 rights of way - 
  I'm willing to bet not
  
  B) Reducing the points of entry into the ring reduces 
 complexity and 
  makes it much easier to recover the ring in the event of a disaster.
  Understanding that SIAC has thousands and thouands of customers 
  connecting at the DS-3+ level to get data that's generated from one 
  place means that you need to keep the distribution uniform.
  Basically,it boils down to them being able to say Our ring 
 is up, if 
  your connectivity to our ring is down it's your problem in 
 order to 
  maintainfairness between Trading firm A that has 10 people 
 and Trading 
  firm B that has 10,000 people.
  
  When they were maintaining separate interfaces for each 
 customer they 
  could potentially run into issues where they'd get certain larger 
  firmsback able to trade sooner than smaller ones and then 
 you create 
  unfair market disadvantages.
  
   -Original Message-
   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
   Sent: Tuesday, September 21, 2004 10:40 AM
   To: Temkin, David
   Cc: Alen Capalik; Philip Lavine; nanog
   Subject: Re: RE: NYSE
   
   
   There are a few things about the SFTI set up that are a 
 bit baffling 
   to me.  From their website:
   
   SFTI carries IP traffic over a topology of redundant, 
 self-healing 
   fiber-optic rings, completely independent of all other telco 
   circuits and conduits. SFTI's design is straightforward, 
   consolidating traffic into fewer pipes, which minimizes 
 complexity 
   and reduces the number of potential points of failure.
   
   What does completely independent of all other telco circuits and 
   conduits mean?  Did they get their very own new right 
 of ways dug 
   out.  A certain government report listed their physical fiber 
   provider, and they certainly are not new right of ways.  Further, 
   I'm a bit baffled how

RE: DS3 questions.

2003-12-11 Thread Temkin, David
Title: Message



With a 
box like the Adtran Atlas you'd be able to give them the PRI's and hand the rest 
off as a DS-3 or HSSI.

-Dave

  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Drew 
  WeaverSent: Thursday, December 11, 2003 11:59 AMTo: 
  '[EMAIL PROTECTED]'Subject: DS3 questions.
  
   
  We have a scenario where we have a DS3 at a Customer location that they want 
  to use for both Data/PRI(voice) They need 8 Voice PRIs and they want to use 
  the remainder of the DS3 for data. If we channelize this DS3, my question is, 
  is it possible to use the unused portion of the DS3 as a fractional DS3, or 
  would we have to terminate the rest as single T1s?
  
  Thanks,
  -Drew
  IMPORTANT: The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.


RE: No encapsulation command on IOS 12.2(12a) ??

2003-10-24 Thread Temkin, David

Kind of OT for NANOG, you should go to cisco-nsp for these kinds of
questions.

However, to answer your question anyway you need an IP plus version of IOS
to get 802.1q/ISL subifs on a 36xx router.  That's only plain IP (c3620-i
vs. c3620-is)

-Original Message-
From: Roman Volf [mailto:[EMAIL PROTECTED] 
Sent: Friday, October 24, 2003 5:49 AM
To: [EMAIL PROTECTED]
Subject: No encapsulation command on IOS 12.2(12a) ??



Show Version:

Cisco Internetwork Operating System Software
IOS (tm) 3600 Software (C3620-I-M), Version 12.2(12a), RELEASE SOFTWARE
(fc1)

flash image:
System image file is flash:c3620-i-mz.122-12a.bin


I'm trying to configure a FastEthernet sub interface for 802.1q VLANs, but
theres no encapsulation command. I've googled it up for about 2 hours and
have come up with nothing... the following command sequence is documented
dozens of times:

As shown on:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120
t/120t1/8021q.htm#wp3944
interface fastethernet slot/port.subinterface-number encapsulation dot1q
vlanid


Any help would be appreciated.


RE: Extreme BlackDiamond

2003-10-14 Thread Temkin, David

... And seeing as that all most switches are is a glorified multiple port
bridge, feel free to go to your 7500 and make it a switch by placing
bridge-group 1 on every port, and if you want to get really crazy and make
it a L3 switch, go all out and put in a bridge 1 route ip. :-)



-Original Message-
From: Michel Py [mailto:[EMAIL PROTECTED] 
Sent: Monday, October 13, 2003 7:02 PM
To: Richard A Steenbergen; Mikael Abrahamsson
Cc: [EMAIL PROTECTED]
Subject: RE: Extreme BlackDiamond



 Richard A Steenbergen wrote:
 So a 7500 with a fast cache is a L3 switch? :)

Of course. It does wire-speed switching with one and
Possibly more CX-EIP6 if you enable dCEF :-)

Michel.


Adjusting TCP windows on production systems?

2003-09-30 Thread Temkin, David
Title: Adjusting TCP windows on production systems?





Is there anyone in a production environment who, as part of their system build process, adjusts the TCP receive window/MSS/etc. on production systems?

I'm dealing with a few latency issues and the MSS settings improve them, but I'm hesitant to suggest it unless there's something I can point to.

-Dave





Address for making BGP changes w/ Qwest?

2003-09-04 Thread Temkin, David
Title: Address for making BGP changes w/ Qwest?





[EMAIL PROTECTED] doesn't work anymore. Is there anyone from Qwest on the list or can someone point me to where I'm supposed to be making these changes now? (Call tech support?!)

Thanks,



Dave





RE: dry pair

2003-08-29 Thread Temkin, David

Order it as an alarm circuit... At least that's how VZ recognizes it in
NY.

-Dave

-Original Message-
From: Austad, Jay [mailto:[EMAIL PROTECTED] 
Sent: Friday, August 29, 2003 12:08 PM
To: [EMAIL PROTECTED]
Subject: dry pair



Does anyone know to go about getting Qwest or a CLEC to patch through a dry
pair between two buildings connected to the same CO?

When I called to order one, no one knew what I was talking about.

-jay


RE: GLBX ICMP rate limiting (was RE: Tier-1 without their own backbone?)

2003-08-28 Thread Temkin, David

Not that Yipes is necessarily a transit provider by any means, but they have
done the same thing within the cores of their network.  I was
troubleshooting an issue yesterday that was pointing to them for 15-20%
packet loss, and I called them and they stated that they started rate
limiting ICMP last weekend, but that it was only on a temporary basis.

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
Sent: Thursday, August 28, 2003 8:24 AM
To: [EMAIL PROTECTED]
Subject: GLBX ICMP rate limiting (was RE: Tier-1 without their own
backbone?)



On Wed, 27 Aug 2003, [EMAIL PROTECTED] wrote:

 We have a similarly sized connection to MFN/AboveNet, which I won't 
 recommend at this time due to some very questionable null routing 
 they're doing (propogating routes to destinations, then bitbucketing 
 traffic sent to them) which is causing complaints from some of our 
 customers and forcing us to make routing adjustments as the customers 
 notice MFN/AboveNet has broken our connectivity to these destinations.

We've noticed that one of our upstreams (Global Crossing) has introduced 
ICMP rate limiting 4/5 days ago.  This means that any traceroutes/pings 
through them look awful (up to 60% apparent packet loss).  After 
contacting their NOC, they said that the directive to install the ICMP 
rate limiting was from the Homeland Security folks and that they would not 
remove them or change the rate at which they limit in the foreseeable 
future.

What are other transit providers doing about this or is it just GLBX?

Cheers,

Rich


RE: Cross-country shipping of large network/computer gear?

2003-08-27 Thread Temkin, David

FWIW we've had FedEx destroy hundreds of thousands of dollars of gear in
transit (all shipped with full insurance and properly packed).  They're
extremely slow to pay their insurance claims on large amounts, as well.

This has happened to us at least 5 times so far - cross-country,
cross-state, and international.

Choose carefully.



-Original Message-
From: N. Richard Solis [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, August 27, 2003 2:27 PM
To: Matthew Zito
Cc: [EMAIL PROTECTED]
Subject: Re: Cross-country shipping of large network/computer gear?



FedEx will be your best bet.  Trust me.

You COULD do a counter to counter shipment via an airline cargo desk. 
That MIGHT be cheaper but you will still have to transport it from your 
spot to their pickup and back again on the other side.

Rail is not an option because it is across country. Ground/Highway is not an
option because it is across country.

Your only choice is by air.

Use FedEx.  Life is short.

-Richard


Matthew Zito wrote:

 
 
  Hello,
 
  I was wondering if anyone could provide any advice or suggestions on  
shipping heavy/bulky equipment (~300 pounds, about a half-rack worth of  
gear) on short notice cross-country?  We're obviously looking to minimize  
cost, but realistically it can't be in transit for more than two   days.
Are   there any companies or methods people would recommend?  Thanks in
advance   for the help. Thanks again,   Matt --   Matthew
Zito   GridApp Systems   Email: [EMAIL PROTECTED]   Cell: 646-220-3551  
Phone: 212-358-8211 x 359   http://www.gridapp.com



RE: Port blocking last resort in fight against virus

2003-08-14 Thread Temkin, David

True, but at that time you didn't have illegitimate traffic on port 80,
either.  Future engineering could be worked around this issue.

-Original Message-
From: Matthew Kaufman [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, August 13, 2003 12:09 PM
To: 'McBurnett, Jim'; [EMAIL PROTECTED]
Subject: RE: Port blocking last resort in fight against virus




 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
 Behalf Of McBurnett, Jim
...  I really can not image 
 legitimate traffic on 135..

My problem with this approach is that, in 1985, you could have said I
really cannot imagine legitimate traffic on port 80.

(On the other hand, you could probably say that today and be mostly right)

Matthew Kaufman
[EMAIL PROTECTED]


RE: a new labor intensive layer 1 solution (humor?)

2003-07-28 Thread Temkin, David

Which, ironically coincided with the time WorldCom bought UUNet.

duck

-Original Message-
From: Christopher L. Morrow [mailto:[EMAIL PROTECTED] 
Sent: Monday, July 28, 2003 1:05 PM
To: Robert E. Seastrom
Cc: Eric Kuhnke; [EMAIL PROTECTED]
Subject: Re: a new labor intensive layer 1 solution (humor?)




On Mon, 28 Jul 2003, Robert E. Seastrom wrote:


 Christopher L. Morrow [EMAIL PROTECTED] writes:

  I believe thats an FN-FAL rifle, not a M-16... I wonder if telcom's 
  could employ these folks to watch over their fiber lines to keep the 
  backhoes away?

 It's a SIG SG550, not an FAL or an M16.

well there ya go! :) I just knew it wasn't a m16 and was guessing toward the
FAL due to language and stock appearances... been a few years since I spent
time looking at guns.


RE: Fiber cut in PA?

2003-06-26 Thread Temkin, David

According to Yipes it was just two customers affected - a landscaping truck
caught fire and took out a spur at Route 30  Route 100...



-Original Message-
From: Nick Nelson [mailto:[EMAIL PROTECTED] 
Sent: Thursday, June 26, 2003 1:14 PM
To: [EMAIL PROTECTED]
Subject: Fiber cut in PA?



Has anyone heard any details on the fiber cut in PA affecting ATT, 
and possibly from what I understand Yipes and webreseller.net? 

From my understanding it's an auto accident, but beyond that I 
haven't been able to find any details..

Anyone?


cheers,
nick
--
Nick Nelson//   USA: 1-877-Lunarpages
[EMAIL PROTECTED]//UK: 0800 0729150
Lunarpages.com   // INTL: 1-714-521-8150


IMPORTANT:The information contained in this email and/or its attachments is
confidential. If you are not the intended recipient, please notify the
sender immediately by reply and immediately delete this message and all its
attachments.  Any review, use, reproduction, disclosure or dissemination of
this message or any attachment by an unintended recipient is strictly
prohibited.  Neither this message nor any attachment is intended as or
should be construed as an offer, solicitation or recommendation to buy or
sell any security or other financial instrument.  Neither the sender, his or
her employer nor any of their respective affiliates makes any warranties as
to the completeness or accuracy of any of the information contained herein
or that this message or any of its attachments is free of viruses.




Latency generator?

2003-06-25 Thread Temkin, David
Title: Latency generator?





Does anyone know of any free, cheap, or potentially rentable latency generators? Ideally I'd like something that just sits between two ethernet devices to induce layer 2/3 latency in traffic, but am open to any options...



David Temkin
S-I-G
401 City Avenue
Bala Cynwyd, PA 19004
http://www.sig.com




IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.





RE: Minimum prefix length?

2003-06-12 Thread Temkin, David

Back on topic...

For those who mentioned Verio I found
http://info.us.bb.verio.net/routing.html#PeerFilter which I forgot exists.
Looks like they've changed it to a /22 for everything in Class A and B
space.


IMPORTANT:The information contained in this email and/or its attachments is
confidential. If you are not the intended recipient, please notify the
sender immediately by reply and immediately delete this message and all its
attachments.  Any review, use, reproduction, disclosure or dissemination of
this message or any attachment by an unintended recipient is strictly
prohibited.  Neither this message nor any attachment is intended as or
should be construed as an offer, solicitation or recommendation to buy or
sell any security or other financial instrument.  Neither the sender, his or
her employer nor any of their respective affiliates makes any warranties as
to the completeness or accuracy of any of the information contained herein
or that this message or any of its attachments is free of viruses.




Minimum prefix length?

2003-06-11 Thread Temkin, David
Title: Minimum prefix length?





A few years ago I had an issue with a few of the larger carriers rejecting my routes (from a natural Class B space) because their prefix length was too short (at one point I simply had the /16 divided into two /17's and this still got rejected in some places). I can't remember which carriers exactly, but it may have been some larger transit providers like AboveNet/etc.

Anyone know what the current attitude is by carriers about this? Nowadays with ever-growing memory and CPU it doesn't seem like it's as much of an issue. In an environment where we're all trying to conserve address space watching natural boundries doesn't seem all that smart.




IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.





FW: Minimum prefix length?

2003-06-11 Thread Temkin, David

Randy - please stop sending these to me - you send me one every time I post
to NANOG.  If you don't like the signature that's appended to my emails (not
by my choice), and the litigious society we live in,  go ahead and block all
email from me.

Replies directly to you to stop sending me these emails have gone
unanswered, which is why I am mentioning this here.



-Original Message-
From: Randy Bush [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, June 11, 2003 4:34 PM
To: Temkin, David
Subject: Re: Minimum prefix length?


you have sent a message to me which seems to contain a legal warning on who
can read it, or how it may be distributed, or whether it may be archived,
etc.

i do not accept such email, and have therefore deleted it.  do not expect
further response.

randy


IMPORTANT:The information contained in this email and/or its attachments is
confidential. If you are not the intended recipient, please notify the
sender immediately by reply and immediately delete this message and all its
attachments.  Any review, use, reproduction, disclosure or dissemination of
this message or any attachment by an unintended recipient is strictly
prohibited.  Neither this message nor any attachment is intended as or
should be construed as an offer, solicitation or recommendation to buy or
sell any security or other financial instrument.  Neither the sender, his or
her employer nor any of their respective affiliates makes any warranties as
to the completeness or accuracy of any of the information contained herein
or that this message or any of its attachments is free of viruses.




RE: FW: Minimum prefix length?

2003-06-11 Thread Temkin, David

I'm glad to hear there is actually some precedent.  

As I mentioned to someone privately, I could go ahead and use a @yahoo.com
or some other webmail service, but I prefer doing anything work related via
email such as this officially rather than covertly.  I may go ahead and
switch at some point, though.

Ironic, though, that you're 100% correct- that signature is going to be
archived publically, which goes against what it claims.



-Original Message-
From: Stephen J. Wilcox [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, June 11, 2003 4:51 PM
To: Temkin, David
Cc: [EMAIL PROTECTED]
Subject: Re: FW: Minimum prefix length?


Whilst we're sidetracking...

I took some counsel on this not so long ago to see whether these were just 
novelty signatures or if they were real legal stuff. Turns out they could 
actually be used legally, interesting I thought.

Howevers its curious that signatures such as this claiming to be
confidential 
are posted to a list which is very much public and archived in several
public 
websites.. not sure how right it is to autoappend them to all your mails as
well 
as the private ones!

Steve

On Wed, 11 Jun 2003, Temkin, David wrote:

 
 Randy - please stop sending these to me - you send me one every time I 
 post to NANOG.  If you don't like the signature that's appended to my 
 emails (not by my choice), and the litigious society we live in,  go 
 ahead and block all email from me.
 
 Replies directly to you to stop sending me these emails have gone 
 unanswered, which is why I am mentioning this here.
 
 
 
 -Original Message-
 From: Randy Bush [mailto:[EMAIL PROTECTED]
 Sent: Wednesday, June 11, 2003 4:34 PM
 To: Temkin, David
 Subject: Re: Minimum prefix length?
 
 
 you have sent a message to me which seems to contain a legal warning 
 on who can read it, or how it may be distributed, or whether it may be 
 archived, etc.
 
 i do not accept such email, and have therefore deleted it.  do not 
 expect further response.
 
 randy
 
 
 IMPORTANT:The information contained in this email and/or its 
 attachments is confidential. If you are not the intended recipient, 
 please notify the sender immediately by reply and immediately delete 
 this message and all its attachments.  Any review, use, reproduction, 
 disclosure or dissemination of this message or any attachment by an 
 unintended recipient is strictly prohibited.  Neither this message nor 
 any attachment is intended as or should be construed as an offer, 
 solicitation or recommendation to buy or sell any security or other 
 financial instrument.  Neither the sender, his or her employer nor any 
 of their respective affiliates makes any warranties as to the 
 completeness or accuracy of any of the information contained herein or 
 that this message or any of its attachments is free of viruses.
 
 
 



IMPORTANT:The information contained in this email and/or its attachments is
confidential. If you are not the intended recipient, please notify the
sender immediately by reply and immediately delete this message and all its
attachments.  Any review, use, reproduction, disclosure or dissemination of
this message or any attachment by an unintended recipient is strictly
prohibited.  Neither this message nor any attachment is intended as or
should be construed as an offer, solicitation or recommendation to buy or
sell any security or other financial instrument.  Neither the sender, his or
her employer nor any of their respective affiliates makes any warranties as
to the completeness or accuracy of any of the information contained herein
or that this message or any of its attachments is free of viruses.




RE: ntop and/or sflow

2003-06-06 Thread Temkin, David

I find ntop crashes quite often under heavy traffic loads, moreso if you're
using it realtime versus as a sflow/netflow collector, but even then it
still crashes.

Also, clicking too quickly on certain pages in ntop will crash the whole
thing :-)

-Original Message-
From: Timothy Brown [mailto:[EMAIL PROTECTED] 
Sent: Friday, June 06, 2003 3:45 PM
To: [EMAIL PROTECTED]
Subject: ntop and/or sflow



Is anyone doing work with ntop as an sFlow collector, or with sFlowtool to 
translate sFlow data into NetFlow data for use with other toolsets?

Can anyone speak to the usage of ntop in a production network?

Thanks,
Tim


IMPORTANT:The information contained in this email and/or its attachments is
confidential. If you are not the intended recipient, please notify the
sender immediately by reply and immediately delete this message and all its
attachments.  Any review, use, reproduction, disclosure or dissemination of
this message or any attachment by an unintended recipient is strictly
prohibited.  Neither this message nor any attachment is intended as or
should be construed as an offer, solicitation or recommendation to buy or
sell any security or other financial instrument.  Neither the sender, his or
her employer nor any of their respective affiliates makes any warranties as
to the completeness or accuracy of any of the information contained herein
or that this message or any of its attachments is free of viruses.




RE: They all suck! Re: UPS failure modes (was: fire at NAC)

2003-05-30 Thread Temkin, David

Liebert makes one, actually.   The model # escapes me, but we considered
using it for equipment that's single powered.  (We have uber power
redundancy..)

-Original Message-
From: E.B. Dreger [mailto:[EMAIL PROTECTED] 
Sent: Thursday, May 29, 2003 7:38 PM
To: [EMAIL PROTECTED]
Subject: Re: They all suck! Re: UPS failure modes (was: fire at NAC)



SD Date: Thu, 29 May 2003 16:53:43 -0400 (EDT)
SD From: Sean Donelan


SD Yep, tieing together redundant systems with parelleling gears 
SD turns two independent systems into one co-dependent system.  In a 
SD failure situation, you want to compartmentalize the failure.  
SD Loosing half your systems may be better than loosing all your 
SD systems.

Too bad a substantial amount of equipment doesn't allow for redundant
plugins.  The ability to plug { servers | routers | whatever } into two
totally separate power feeds is nice.

Anyone for building a rackmount transfer switch for two inputs? Assuming it
didn't fail (!) -- would the economies of scale work for or against it
compared to big transfer switches?  Between dealing with _much_ smaller
current levels and the opportunity for mass production, what are the chances
of something like this working?


Eddy
--
Brotsman  Dreger, Inc. - EverQuick Internet Division Bandwidth, consulting,
e-commerce, hosting, and network building
Phone: +1 (785) 865-5885 Lawrence and [inter]national
Phone: +1 (316) 794-8922 Wichita

~
Date: Mon, 21 May 2001 11:23:58 + (GMT)
From: A Trap [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: Please ignore this portion of my mail signature.

These last few lines are a trap for address-harvesting spambots. Do NOT send
mail to [EMAIL PROTECTED], or you are likely to be blocked.


IMPORTANT:The information contained in this email and/or its attachments is
confidential. If you are not the intended recipient, please notify the
sender immediately by reply and immediately delete this message and all its
attachments.  Any review, use, reproduction, disclosure or dissemination of
this message or any attachment by an unintended recipient is strictly
prohibited.  Neither this message nor any attachment is intended as or
should be construed as an offer, solicitation or recommendation to buy or
sell any security or other financial instrument.  Neither the sender, his or
her employer nor any of their respective affiliates makes any warranties as
to the completeness or accuracy of any of the information contained herein
or that this message or any of its attachments is free of viruses.




RE: They all suck! Re: UPS failure modes (was: fire at NAC)

2003-05-30 Thread Temkin, David

Here you go:

http://www.liebert.com/dynamic/displayproduct.asp?ID=1042cycles=60Hz

-Original Message-
From: Temkin, David 
Sent: Thursday, May 29, 2003 7:49 PM
To: 'E.B. Dreger'; [EMAIL PROTECTED]
Subject: RE: They all suck! Re: UPS failure modes (was: fire at NAC)


Liebert makes one, actually.   The model # escapes me, but we considered
using it for equipment that's single powered.  (We have uber power
redundancy..)

-Original Message-
From: E.B. Dreger [mailto:[EMAIL PROTECTED] 
Sent: Thursday, May 29, 2003 7:38 PM
To: [EMAIL PROTECTED]
Subject: Re: They all suck! Re: UPS failure modes (was: fire at NAC)



SD Date: Thu, 29 May 2003 16:53:43 -0400 (EDT)
SD From: Sean Donelan


SD Yep, tieing together redundant systems with parelleling gears
SD turns two independent systems into one co-dependent system.  In a 
SD failure situation, you want to compartmentalize the failure.  
SD Loosing half your systems may be better than loosing all your 
SD systems.

Too bad a substantial amount of equipment doesn't allow for redundant
plugins.  The ability to plug { servers | routers | whatever } into two
totally separate power feeds is nice.

Anyone for building a rackmount transfer switch for two inputs? Assuming it
didn't fail (!) -- would the economies of scale work for or against it
compared to big transfer switches?  Between dealing with _much_ smaller
current levels and the opportunity for mass production, what are the chances
of something like this working?


Eddy
--
Brotsman  Dreger, Inc. - EverQuick Internet Division Bandwidth, consulting,
e-commerce, hosting, and network building
Phone: +1 (785) 865-5885 Lawrence and [inter]national
Phone: +1 (316) 794-8922 Wichita

~
Date: Mon, 21 May 2001 11:23:58 + (GMT)
From: A Trap [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: Please ignore this portion of my mail signature.

These last few lines are a trap for address-harvesting spambots. Do NOT send
mail to [EMAIL PROTECTED], or you are likely to be blocked.


IMPORTANT:The information contained in this email and/or its attachments is
confidential. If you are not the intended recipient, please notify the
sender immediately by reply and immediately delete this message and all its
attachments.  Any review, use, reproduction, disclosure or dissemination of
this message or any attachment by an unintended recipient is strictly
prohibited.  Neither this message nor any attachment is intended as or
should be construed as an offer, solicitation or recommendation to buy or
sell any security or other financial instrument.  Neither the sender, his or
her employer nor any of their respective affiliates makes any warranties as
to the completeness or accuracy of any of the information contained herein
or that this message or any of its attachments is free of viruses.




RE: fire at NAC

2003-05-29 Thread Temkin, David

If by Fire at nac.net, you mean their Firewall promotion, here you go:

http://www.nac.net/specials.asp#84

*duck*

(I see no reference to a fire on anything off their system status/other
pages)

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, May 28, 2003 12:31 PM
To: [EMAIL PROTECTED]
Subject: fire at NAC



Fire at nac.net

http://www.nac.net

Alex


IMPORTANT:The information contained in this email and/or its attachments is
confidential. If you are not the intended recipient, please notify the
sender immediately by reply and immediately delete this message and all its
attachments.  Any review, use, reproduction, disclosure or dissemination of
this message or any attachment by an unintended recipient is strictly
prohibited.  Neither this message nor any attachment is intended as or
should be construed as an offer, solicitation or recommendation to buy or
sell any security or other financial instrument.  Neither the sender, his or
her employer nor any of their respective affiliates makes any warranties as
to the completeness or accuracy of any of the information contained herein
or that this message or any of its attachments is free of viruses.




RE: level3 contact

2003-03-05 Thread Temkin, David
Title: Message



I sure 
hope this isn't the future of Genuity



  
  -Original Message-From: Steve Rude 
  [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 05, 2003 1:46 
  PMTo: [EMAIL PROTECTED]Subject: OT: level3 
  contact
  
  Can someone clueful at level3 please contact me about bgp. We are a 
  customer, and phone calls and email have failed to get us a 
  contact.
  
  Sorry for the OT 
  post.
  
  Thanks.
  
  Steve 
  Rude
  IP 
  Network Engineer
  Skyriver 
  Communications, Inc.
  [EMAIL PROTECTED]
  858-812-9326 | 
  office
  858-945-1557 | 
  mobile
  



IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments.  Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited.  Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument.  Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.




Comcast contacts?

2003-02-26 Thread Temkin, David
Title: Comcast contacts?





Does anyone have any contacts at Comcast that I might speak to RE: an issue that multiple users from my network are having with their comcast.net email via the web.

Basically, starting last week, numerous users have reported that they get 'session timed out' messages as soon as they open their mailbox via the comcast.net webpage. I have no other issues with any other services.

Thanks,


-Dave



IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.





Not to beat a dead hose, but about the Bank of America ATM Article

2003-02-21 Thread Temkin, David
Title: Message



... some very 
interesting reading to follow up on the discussions that were had last month 
regarding ATM machine security and PIN storage. Turns out CitiBank has a 
serious flaw in their system that they'd rather everyone not know about. 
As well, as was noted, the PIN numbers are no longer stored on the 
cards.

See the article @ 
cryptome:

http://cryptome.org/pacc.htm

-Dave

David 
Temkin
S-I-G
401 City Avenue
Bala Cynwyd, PA 19004
http://www.sig.com




IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments.  Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited.  Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument.  Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.




RE: OT: Banc of America Article

2003-01-30 Thread Temkin, David

FYI this is completely incorrect.

I have changed my PIN with both my PayPal debit card as well as my First
Union/Wachovia card numerous times without a single contact with a physical
bank.

See: http://www.wachovia.com/helpcenter/page/0,,2372_2705,00.html

To store the PIN on a card, whether hashed or not, would be foolish.   Do
people really think that the ATM's of 15 years ago had the CPU power to
calculate the hash of a PIN number on the fly?  I know people who are
carrying around 10+ year old cards and they still work fine.

-Dave

 -Original Message-
 From: Krzysztof Adamski [mailto:[EMAIL PROTECTED]] 
 Sent: Thursday, January 30, 2003 3:39 PM
 To: [EMAIL PROTECTED]
 Subject: Re: OT: Banc of America Article
 
 
 
 Since nobody has given the correct information about the PIN 
 on the card I will give a very brief description.
 
 There are two types of PIN, natural and customer selected.
 The natural PIN is computed from the number on the card. The 
 computation involves one way crypto keys. I don't remember 
 the algorithm. For this the PIN that is stored on the card is .
 
 Now, when a customer selects a PIN, an offset is computed 
 between the natural PIN and selected PIN. This offset is 
 stored on the card.
 
 Based on this you can see that re-encoding is needed when you 
 change the PIN number, most ATM will do that re-encoding. So 
 unless things have changed in the last 4 years since I worked 
 with this, you can not change your PIN over the phone without 
 physical contact by the bank with the card.
 
 Personally I carry a card without any logo as my ATM card, at 
 one point I had access to reader/encoder for mag strip cards 
 and I programmed a blank card with the info from my real ATM 
 card. No encryption involved.
 
 K
 
 On Wed, 29 Jan 2003, David Charlap wrote:
 
  
  Al Rowland wrote:
   
   The PIN is on your card ...
  
  Not for any card I've ever owned.  I've changed my PIN several times
  over the years, and the bank has never re-encoded my card 
 or sent me a 
  new card as a result of doing so.
  
  Maybe some banks do store the PIN on the card, but I'm certain that 
  it's
  in the server for ever bank I've used.
  
   I use a not-my-bank ATM in the lobby at work and it 
 doesn't initiate 
   the call (you can hear the modem dial) until you're 
 beyond the PIN 
   screen and are actually requesting a transaction.
  
  I'm not surprised.  But the PIN is verified as a part of the 
  transaction.
  
  I've occasionally mistyped my PIN.  The ATM takes the 
 mistake and goes
  straight to the menu.  It's only after requesting a 
 transaction that it 
  comes back with the invalid PIN message.
  
  -- David
  
 


IMPORTANT:The information contained in this email and/or its attachments is
confidential. If you are not the intended recipient, please notify the
sender immediately by reply and immediately delete this message and all its
attachments.  Any review, use, reproduction, disclosure or dissemination of
this message or any attachment by an unintended recipient is strictly
prohibited.  Neither this message nor any attachment is intended as or
should be construed as an offer, solicitation or recommendation to buy or
sell any security or other financial instrument.  Neither the sender, his or
her employer nor any of their respective affiliates makes any warranties as
to the completeness or accuracy of any of the information contained herein
or that this message or any of its attachments is free of viruses.





RE: Banc of America Article

2003-01-26 Thread Temkin, David

I think you're leaving out a very viable possibility in your summary...

What if BoA took a proactive approach and shut down their SQL environment
(even though none of us known conclusively if they're a SQL or Oracle shop)
to verify that it was in fact clean and not compromised.  When you're
talking about access to billions of dollars, it's not worth taking a chance.
They might have actually followed proper security protocol and verified
their systems were clean before re-activating them.

Just a thought.

-Dave

 -Original Message-
 From: Alex Rubenstein [SMTP:[EMAIL PROTECTED]]
 Sent: Sunday, January 26, 2003 10:59 AM
 To:   Ray Burkholder
 Cc:   [EMAIL PROTECTED]
 Subject:  RE: Banc of America Article
 
 
 
 Let me summarize, then ask a question:
 
 a) BoA uses the public internet for ATM transactions. The public internet
 was so dead, that every one of thier ATM machines was dead for many hours,
 even many hours longer than the public internet was dead.
 
 b) BoA uses it's own network for it's on ATM transactions. Somewhere on
 the a public to private connection, a firewall wasn't doing it's job, or
 there wasn't a firewall. Things were broken for a while, until they were
 able to fix all thier SQL servers.
 
 I guess my point is, if it were a), not every ATM would be dead all the
 time, and things would have been fixed in only a little while. Not many
 internet 'backbones' (at least ones BoA would have used for this
 application) were down as long as BoA's ATM's were.
 
 On the other hand, I think it's more likely that BoA had unprotected SQL
 servers, and they got it. It took a long while for BoA IT people to make
 it out of bed saturday morning to fix the problem.
 
 I still clearly say that I don't know what happened, and I did make
 assumptions (as I said in the original mail) -- but I'd still place my
 money on b).
 
 
 
 On Sun, 26 Jan 2003, Ray Burkholder wrote:
 
  Actually, I think too many assumptions were made.
 
  Let's simplify.
 
  We know UUNet traffic capabilities were reduced significantly.  Uunet
  has many big customers.  Other big carriers had similar affects on their
  networks, probably particularly at peering points.
 
  We know many companies use public or private VPN services from major
  carriers such as these, and that both VPN types may use public internet
  carriers.
 
  I think therefore that the only true conclusion we could say is that if
  BoA's traffic was not prioritized, it therefore suffered collateral
  damage primarily due to traffic not being able to get through between
  ATM's and the central processing center.
 
 
 
 -- Alex Rubenstein, AR97, K2AHR, [EMAIL PROTECTED], latency, Al Reuben --
 --Net Access Corporation, 800-NET-ME-36, http://www.nac.net   --
 
 
 
IMPORTANT:The information contained in this email and/or its attachments is
confidential. If you are not the intended recipient, please notify the
sender immediately by reply and immediately delete this message and all its
attachments.  Any review, use, reproduction, disclosure or dissemination of
this message or any attachment by an unintended recipient is strictly
prohibited.  Neither this message nor any attachment is intended as or
should be construed as an offer, solicitation or recommendation to buy or
sell any security or other financial instrument.  Neither the sender, his or
her employer nor any of their respective affiliates makes any warranties as
to the completeness or accuracy of any of the information contained herein
or that this message or any of its attachments is free of viruses.





Problems with UU-Level3 last night?

2002-11-05 Thread Temkin, David

Last night I saw an issue with connectivity between a domestic site in
Pennsylvania off of Level3's network connecting to a site on UUNet in
Australia - latency was almost triple of what it normally is...

Level3's response was of course We don't see anything - even with
traceroutes showing otherwise.  Did anyone else experience anything or hear
anything about it?

Latency is normally in the ~240ms range.

1 Loopback0.GW1.SYD2.Alter.Net (210.80.0.54) 4 msec 4 msec 4 msec
2 321.at-3-0-0.XR1.SYD2.Alter.Net (210.80.3.89) 8 msec 8 msec 4 msec
3 so-3-0-0.TR2.SYD2.Alter.Net (210.80.48.145) 4 msec
so-3-0-0.TR1.SYD2.Alter.Net (210.80.48.133) 4 msec 4 msec
4 0.so-5-0-0.IR1.SAC2.Alter.Net (210.80.49.150) 164 msec
0.so-1-0-2.IR2.SAC2.Alter.Net (210.80.50.142) 164 msec
0.so-5-0-0.IR1.SAC2.Alter.Net (210.80.49.150) 164 msec
5 POS2-0.IR2.SAC1.ALTER.NET (137.39.31.206) 156 msec 156 msec
POS2-0.IR1.SAC1.ALTER.NET (137.39.31.190) 164 msec
6 0.so-0-0-0.TL1.SAC1.ALTER.NET (152.63.0.114) 184 msec 180 msec
0.so-4-1-0.TL2.SAC1.ALTER.NET (152.63.0.118) 156 msec
7 0.so-7-0-0.XL1.SAC1.ALTER.NET (152.63.53.249) 172 msec
0.so-7-0-0.XL2.SAC1.ALTER.NET (152.63.54.9) 168 msec 164 msec
8 POS6-0.BR5.SAC1.ALTER.NET (152.63.52.225) 168 msec
POS7-0.BR5.SAC1.ALTER.NET (152.63.52.229) 156 msec 156 msec
9 atm3-0.core2.SanFrancisco1.Level3.net (166.90.50.133) 496 msec 496 msec
492 msec
10 so-4-1-0.mp2.SanFrancisco1.Level3.net (209.247.10.237) 492 msec 500 msec
492 msec
11 so-0-1-0.mp1.Philadelphia1.Level3.net (64.159.0.141) 572 msec 572 msec
564 msec
12 gig10-2.hsa1.Philadelphia1.level3.net (209.247.9.26) 560 msec 560 msec
564 msec
13 unknown.Level3.net (63.209.178.162) 560 msec 556 msec 556 msec

  3 ge-6-1-0.mp2.Philadelphia1.level3.net (64.159.3.29) [AS 3356] 4 msec 4
msec 4 msec
  4 unknown.Level3.net (209.247.8.66) [AS 3356] 8 msec 4 msec 8 msec
  5 unknown.Level3.net (64.159.17.166) [AS 3356] 8 msec 4 msec 8 msec
  6 102.ATM2-0.BR3.NYC8.ALTER.NET (209.244.160.162) [AS 3356] 8 msec 8 msec
8 msec
  7 0.so-6-1-0.XL2.NYC8.ALTER.NET (152.63.19.50) [AS 3356] 4 msec 8 msec 8
msec
  8 0.so-1-0-0.TL2.NYC8.ALTER.NET (152.63.0.169) [AS 3356] 8 msec
0.so-2-0-0.TL2.NYC8.ALTER.NET (152.63.0.185) [AS 3356] 8 msec 8 msec
  9 0.so-2-0-0.TL2.SAC1.ALTER.NET (152.63.8.2) [AS 3356] 464 msec 460 msec
456 msec
 10 0.POS6-0.IR2.SAC1.ALTER.NET (152.63.0.117) [AS 3356] 464 msec
0.POS6-0.IR2.SAC1.ALTER.NET (152.63.0.149) [AS 3356] 80 msec
0.POS6-0.IR2.SAC1.ALTER.NET (152.63.0.117) [AS 3356] 468 msec
 11 so-7-1-0.IR2.SAC2.ALTER.NET (137.39.31.209) [AS 3356] 468 msec 472 msec
468 msec
 12 so-3-0-0.TR2.SYD2.Alter.Net (210.80.48.145) [AS 3356] 628 msec
0.so-1-0-0.TR2.SYD2.Alter.Net (210.80.50.141) [AS 3356] 624 msec
so-3-0-0.TR2.SYD2.Alter.Net (210.80.48.145) [AS 3356] 644 msec
 13 so-6-2-0.XR1.SYD2.Alter.Net (210.80.48.146) [AS 3356] 628 msec 624 msec
624 msec
 14 311.ATM5-0-0.GW1.SYD2.Alter.Net (210.80.3.90) [AS 3356] 620 msec 616
msec 608 msec



David Temkin
Susquehanna International Group, LLP


IMPORTANT:The information contained in this email and/or its attachments is
confidential. If you are not the intended recipient, please notify the
sender immediately by reply and immediately delete this message and all its
attachments.  Any review, use, reproduction, disclosure or dissemination of
this message or any attachment by an unintended recipient is strictly
prohibited.  Neither this message nor any attachment is intended as or
should be construed as an offer, solicitation or recommendation to buy or
sell any security or other financial instrument.  Neither the sender, his or
her employer nor any of their respective affiliates makes any warranties as
to the completeness or accuracy of any of the information contained herein
or that this message or any of its attachments is free of viruses.