Re: New worm?

2005-04-21 Thread Christopher L. Morrow
On Fri, 22 Apr 2005, Chris Boyd wrote: > > > On Apr 22, 2005, at 12:13 AM, Christopher L. Morrow wrote: > > do you atleast have info about the packet > > types/destinations/anything-useful ? > > > > Netflow is showing a lot of 1500 byte packets, but many different > destinations. It looks simil

Re: New worm?

2005-04-21 Thread Chris Boyd
On Apr 22, 2005, at 12:13 AM, Christopher L. Morrow wrote: do you atleast have info about the packet types/destinations/anything-useful ? Netflow is showing a lot of 1500 byte packets, but many different destinations. It looks similar to gnutella traffic. Maybe just a lot files to share and ou

Re: New worm?

2005-04-21 Thread Christopher L. Morrow
On Thu, 21 Apr 2005, Chris Boyd wrote: > > > On Apr 21, 2005, at 11:24 PM, Charles Cala wrote: > > i've seen file sharing/p2p/spam bots set up like that. > > > > removed a few, the hard way. > > > > (un mounted the drives, set them up on another box, and cleaned them) > > > > what does the virus

Re: New worm?

2005-04-21 Thread Chris Boyd
On Apr 21, 2005, at 11:24 PM, Charles Cala wrote: i've seen file sharing/p2p/spam bots set up like that. removed a few, the hard way. (un mounted the drives, set them up on another box, and cleaned them) what does the virus scan turn up? Don't know yet, as the support staff gone for the day at thi

Re: New worm?

2005-04-21 Thread Jon Lewis
On Thu, 21 Apr 2005, Chris Boyd wrote: > Several machines on a resnet that I consult for have started spewing > traffic--50Mbits/sec all the way up to line rate. We're working on > discoing the affected machines and getting traffic characteristics. Why new worm? What makes you think they're no

New worm?

2005-04-21 Thread Chris Boyd
Several machines on a resnet that I consult for have started spewing traffic--50Mbits/sec all the way up to line rate. We're working on discoing the affected machines and getting traffic characteristics. Anyone else seeing similar? --Chris

Re: Getting a BGP table in to a lab

2005-04-21 Thread Nathan Ward
Nathan Ward wrote: >I'm trying to come up with a way to get a full BGP routing table in to >my lab. >I'm not really fussed about keeping it up to date, so a snapshot is fine. >At the moment, I'm thinking about spending a few hours hacking together >a BGP daemon in perl to peer with and record a t

Re: Load balance over multiple bgp feeds

2005-04-21 Thread Will Yardley
On Thu, Apr 21, 2005 at 05:06:27PM -0700, Will Yardley wrote: > On Thu, Apr 21, 2005 at 06:47:36PM -0500, Mike Hyde wrote: [ Sorry for the self-followup. ] > > I was wondering what everyone does to load balance over multiple > > bgp feeds. We currently have 5 bgp feeds with 2 providers. Do you

Re: Load balance over multiple bgp feeds

2005-04-21 Thread Will Yardley
On Thu, Apr 21, 2005 at 06:47:36PM -0500, Mike Hyde wrote: > I was wondering what everyone does to load balance over multiple bgp > feeds. We currently have 5 bgp feeds with 2 providers. Do you just > randomly pick networks, or use something like netflow to try and > pick the best path. A lot of

Load balance over multiple bgp feeds

2005-04-21 Thread Mike Hyde
I was wondering what everyone does to load balance over multiple bgp feeds. We currently have 5 bgp feeds with 2 providers. Do you just randomly pick networks, or use something like netflow to try and pick the best path. Mike

RE: Getting a BGP table in to a lab

2005-04-21 Thread Reeves, Rob
Andre summed it up nicely for me here. I suppose quagga's stability is somewhat relative to the actual environment it's being used in. In our case, it was a live environment with nearly 20 full routing tables in constant flux (the usual table churn from various providers). We moved on to someth

Re: Getting a BGP table in to a lab

2005-04-21 Thread Nathan Ward
Nathan Ward wrote: >I'm trying to come up with a way to get a full BGP routing table in to >my lab. >I'm not really fussed about keeping it up to date, so a snapshot is fine. >At the moment, I'm thinking about spending a few hours hacking together >a BGP daemon in perl to peer with and record a t

Re: Getting a BGP table in to a lab

2005-04-21 Thread Daniel Roesen
On Thu, Apr 21, 2005 at 11:36:03PM +0200, Andre Oppermann wrote: > The only missing thing there [in OpenBGPD] is full filtering > capabilities which are under development currently. Oh, and other very basic things like IPv4-multicast, IPv6-unicast and IPv6-multicast AFI/SAFI support. Regards, D

Re: Getting a BGP table in to a lab

2005-04-21 Thread Andre Oppermann
Arnold Nipper wrote: On 21.04.2005 17:17 Reeves, Rob wrote Quagga is great for smaller implementations, but it doesn't scale very well. It eats up a lot of CPU, so once you hit a certain number of BGP peers, it may start intermittently flapping BGP sessions, or even just crash the bgpd process ent

AW: Getting a BGP table in to a lab

2005-04-21 Thread John van Oppen
I agree... I have around 75 peers on a box that actually does the routing running quagga, and there appears to be no problem. My only issues have been with version upgrades having bugs in them, but those problems are due to my inadequate testing. I also utilize supervise scripts (daemontoo

Re: Getting a BGP table in to a lab

2005-04-21 Thread Arnold Nipper
On 21.04.2005 17:17 Reeves, Rob wrote Quagga is great for smaller implementations, but it doesn't scale very well. It eats up a lot of CPU, so once you hit a certain number of BGP peers, it may start intermittently flapping BGP sessions, or even just crash the bgpd process entirely. For what numb

Re: Getting a BGP table in to a lab

2005-04-21 Thread Steven M. Bellovin
In message <[EMAIL PROTECTED]>, Nathan Ward writes: > >I'm trying to come up with a way to get a full BGP routing table in to >my lab. >I'm not really fussed about keeping it up to date, so a snapshot is fine. >At the moment, I'm thinking about spending a few hours hacking together >a BGP daemon i

Re: Getting a BGP table in to a lab

2005-04-21 Thread Okan Demirmen
> > -Original Message- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > > Behalf Of Nathan Ward > > Sent: Wednesday, April 20, 2005 8:35 PM > > To: nanog@merit.edu > > Subject: Getting a BGP table in to a lab > > > > > > I'm trying to come up with a way to get a full BGP routin

RE: Getting a BGP table in to a lab

2005-04-21 Thread Reeves, Rob
Quagga is great for smaller implementations, but it doesn't scale very well. It eats up a lot of CPU, so once you hit a certain number of BGP peers, it may start intermittently flapping BGP sessions, or even just crash the bgpd process entirely. Although, I don't recall whether or not the newer

RE: Getting a BGP table in to a lab

2005-04-21 Thread Frotzler, Florian
Hi, Zebra is outdated, the successor is called quagga (at least on debian) and is capable of providing most of the vendor C BGP features, though MD5 autentication is still experimental I think. We used to push a handful of BGP full feeds on our quagga router and it didn't stumble a bit. OSPF also