And Verio too? (was Re: Level3 problems)

2005-10-21 Thread Pete Kruckenberg
Authoritative sources report that Verio coincidentally had major problems last night also: http://www.boingboing.net/2005/10/21/two_tierone_isps_are.html http://slashdot.org/article.pl?sid=05/10/21/0958232 (is this the end for Level3? heh) Odd. The last time there was major instability due

Methodology for BGP policy development

2004-09-15 Thread Pete Kruckenberg
I'm looking for some good material on the methodology (best practices) of moderately-complex BGP policy development. I've found no shortage of the tools (prefix lists, community list filters, route maps, etc) for *implementation* of BGP policy. Including plenty of router configuration

RE: optics pricing (Re: Weird GigE Media Converter Behavior)

2004-08-30 Thread Pete Kruckenberg
On Sun, 29 Aug 2004, Michel Py wrote: 1. Support: sometimes you will need vendor support, and this is especially true of new products. Putting Kingston DRAM in a 2600 is one thing; a limited test on a few routers will quickly show if it works or not, and the odds of an IOS upgrade that

Teaching/developing troubleshooting skills

2004-06-24 Thread Pete Kruckenberg
I'm working on trying to teach others in my group (usually less-experienced, but not always) how to improve their large-network troubleshooting skills (the techniques of isolating a problem, etc). It's been so long since I learned network troubleshooting techniques I can't remember how I learned

Re: TCP/BGP vulnerability - easier than you think

2004-04-21 Thread Pete Kruckenberg
Interesting that Cisco uses random port selection with SNMP (http://www.cisco.com/warp/public/707/cisco-sa-20040420-snmp.shtml, see the Detail selection) but not with TCP. Too bad that TCP ports aren't randomized even with the fixed IOS versions. Would seem that as long as you're implementing

Re: Sobigf + BGP

2003-08-28 Thread Pete Kruckenberg
On Wed, 27 Aug 2003 [EMAIL PROTECTED] wrote: We have seen that many people *posting* do not have the best of intentions; I can assure you that there are lurkers on Nanog (surprise, surprise) who are not nearly as naive and well-intentioned as J. O. would hope. In fact, I know that there

RE: East Coast outage?

2003-08-15 Thread Pete Kruckenberg
On Fri, 15 Aug 2003, Randy Bush wrote: i guess it would be amusing to read a power engineers' mailing list discussing how the internet should have been designed. Well, if the Internet ever has a major outage, they'll be entitled to share their opinions. Until then...

RE: Cisco vulnerability and dangerous filtering techniques

2003-07-23 Thread Pete Kruckenberg
On Wed, 23 Jul 2003, McBurnett, Jim wrote: Quick solution to this bug, as well as any future bug(s) replace all routers with PCs running Zebra. That is good until Zebra get's a bug and then someone will say go to XYZ... Macintosh running Zebra. Macs are as powerful as

Re: Backbone Infrastructure and Secrecy

2003-07-08 Thread Pete Kruckenberg
On Tue, 8 Jul 2003, Adam Kujawski wrote: Who, besides Sean, has maps like this? The state PUC? If so, is that information available to the public? Do you have to go thorugh a background check and/or sign an NDA? Or is it only the providers themselves that have the maps for this stuff? It

Thank you

2003-06-04 Thread Pete Kruckenberg
Thank you to everyone who attended NANOG 28 in Salt Lake City. We enjoyed hosting the conference and hope you enjoyed your time in Salt Lake. See you in October. Pete.

DNS records for routers

2003-03-01 Thread Pete Kruckenberg
Any passionate opinions about DNS record conventions for routers? Or recommendations? I'm not particularly concerned about device naming conventions (we have that down), I'm more interested in what makes sense for public-viewable DNS names (so I can put those beautiful fully-compliant names

Re: Network monitoring/IDS rant - What's hot what's not?

2003-02-26 Thread Pete Kruckenberg
On Wed, 26 Feb 2003, Christopher L. Morrow wrote: CA-Unicenter/OVW/Tivoli are not IDS systems... (traditionally) but they can normally monitor the heck out of 'decent' sized networks (less than 500 components was my last experience with OVW atleast, tivoli and CA we never got working

Re: Network monitoring/IDS rant - What's hot what's not?

2003-02-26 Thread Pete Kruckenberg
On Tue, 25 Feb 2003, Christopher J. Wolff wrote: I'm rapidly coming to the conclusion that any software Computer Associates publishes is designed for the criminally insane. http://www.sltrib.com/2003/feb/02232003/business/31810.asp

ENUM/E.164 books

2003-02-22 Thread Pete Kruckenberg
Anyone have recommendations on good books (or similar resources) on ENUM/E.164 for education, planning, design, implementation and/or operation? Pete.

Experience w/ QoS/app performance monitors

2003-02-19 Thread Pete Kruckenberg
Would anyone who is running QoS/SLA/application performance monitors (ie BRIX Networks) be willing to share (on the list or privately) what their experience has been with those products and how they are used/useful in actual experience to engineer and operate networks. Pete.

Selfish Routing

2003-02-14 Thread Pete Kruckenberg
http://www.scienceblog.com/community/article1018.html --- The Internet is 'fault-tolerant,' so there are always many routes a message can take. A packet of data traveling from New York to San Francisco might go by way of Chicago or Dallas, or might even hop from New York to Columbus to Miami

Regional Exchange Peering Forum

2003-02-10 Thread Pete Kruckenberg
As a follow-up to the IX Operator Panel today, a Web site and mailing list have been set up to focus and expand the interests of regional exchange points. The REP Forum is intended for anyone who is interested in discussion and development of regional exchanges. This includes operators,

IP QoS case-studies

2003-02-03 Thread Pete Kruckenberg
I've found there's no shortage of advice and theory about the viability of IP QoS (DiffServ) in a large wide-area (converged) network. I have not had much luck with finding documentation about experiences implementing and operating such a beast. Presumably that's yet another (silent)

Re: Scaled Back Cybersecuruty

2003-01-14 Thread Pete Kruckenberg
On 14 Jan 2003, Vijay Gill wrote: Avi Freedman [EMAIL PROTECTED] writes: Perhaps the Feds (and maybe states) could use their purchasing power to effect change. Short of that, or regulation, the I don't see how the serious issues we have with the 'net will get resolved. People do. I've

Re: Trends in network operator security

2003-01-09 Thread Pete Kruckenberg
On Thu, 9 Jan 2003, Sean Donelan wrote: On Wed, 8 Jan 2003 [EMAIL PROTECTED] wrote: Arent these more the attack trends of tier-3 providers and not network operators. Maybe. I don't see too many tier-1 network operators attacking other tier-1 network operators. The trend I continue to

Re: Scaled Back Cybersecuruty

2003-01-08 Thread Pete Kruckenberg
On Tue, 7 Jan 2003 [EMAIL PROTECTED] wrote: This may be of interst: AP: Bush Expected to Sign Scaled Back Internet Security Plan One of the criticisms of the change relative to this group is that the previous stronger wording for the network operator industry was watered down. Instead of

DWDM interconnects

2003-01-06 Thread Pete Kruckenberg
How common are DWDM interconnects between networks (carriers)? Is DWDM considered a reliable/scalable/operable carrier interconnection technology? Is multi-vendor DWDM (whether internal to the network or for carrier interconnection) practical or sensible, especially for carrier/network

Re: AOL Cogent

2002-12-28 Thread Pete Kruckenberg
On Sat, 28 Dec 2002, Richard A Steenbergen wrote: Consider this example: If I buy 100Mbit of transit from AboveNet in IAD, odds are you're gonna peer off 75% of my traffic locally, without it ever having touched expensive longhaul circuits. If I buy 100Mbit of paid peering, odds are you're

Re: PAIX

2002-11-14 Thread Pete Kruckenberg
Wired covered several of these topics in their August issue. http://www.wired.com/wired/archive/10.08/korea.html The article points out several subtle, yet fundamental, changes that happen socially and psychologically once the broadband network is available everywhere, to virtually everyone,

Good quotes on importance of good network addressing

2002-10-03 Thread Pete Kruckenberg
I'm doing a presentation and white paper to convince a bunch of people that network addressing is one of (if not the most) important aspect of network design and management. The goal is to convince them that we need a plan, which will probably require them to do some renumbering. I'm

Security/operations roles/interactions

2002-09-25 Thread Pete Kruckenberg
I have the opportunity to redefine some roles of our Network Security group and Operations group. More specifically, Operations want to be more involved in day-to-day security activities like incident management and security monitoring. The goal is to make both groups more effective and

Re: looking glass

2002-07-18 Thread Pete Kruckenberg
We have heavily modified a version of the MRLG ( ftp://ftp.enterzone.net/looking-glass/ ) to provide controlled router access to a specific (mostly internal) audience. We have found that allowing people who normally have no router access, to have read-only access to some normally enable-only

Sprint multicast route list

2002-07-11 Thread Pete Kruckenberg
I'm doing some analysis of who I might be able to reach via multicast through Sprint. Sadly, route-views multicast peering with Sprint is not working at the moment. I'd appreciate if someone could email me the output from show ip mbgp neighbor sprint peer received-routes or show ip mbgp from

Re: Sprint multicast route list

2002-07-11 Thread Pete Kruckenberg
Thanks, I got it. And route-views will be fixed, too. On Thu, 11 Jul 2002, Pete Kruckenberg wrote: Date: Thu, 11 Jul 2002 12:53:37 -0600 (MDT) From: Pete Kruckenberg [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Sprint multicast route list I'm doing some analysis of who I might

Re: Arbor Networks DoS defense product

2002-05-14 Thread Pete Kruckenberg
On Wed, 15 May 2002, Sean Donelan wrote: Telus has gone first, and announced it is using Arbor's products across its backbone network. http://www.eweek.com/article/0,3658,s=720a=26867,00.asp People have been trying the products for a while. Does Arbor Networks really have an answer to

Effective ways to deal with DDoS attacks?

2002-05-01 Thread Pete Kruckenberg
There's been plenty of discussion about DDoS attacks, and my IDS system is darn good at identifying them. But what are effective methods for large service-provider networks (ie ones where a firewall at the front would not be possible) to deal with DDoS attacks? Current method of updating ACLs

Re: Effective ways to deal with DDoS attacks?

2002-05-01 Thread Pete Kruckenberg
On Wed, 1 May 2002 [EMAIL PROTECTED] wrote: and then again, there has been much discussion on simple DoS attacks, where the term DDoS is erroneously used... I am very much not trying to imply that this is the case here, but it's important that the two be thoroughly distinguished from

Re: Effective ways to deal with DDoS attacks?

2002-05-01 Thread Pete Kruckenberg
On Thu, 2 May 2002, Richard A Steenbergen wrote: SYN packet comes in, one of these machines responses with a RST to the source, which is actually the target of the You have an interesting situation. I think rate limiting outbound RSTs would be the least offensive thing you could do, off

The Myth of Five 9's Reliability (fwd)

2002-04-24 Thread Pete Kruckenberg
From the Canarie news mailing list. I don't think I've ever experienced five 9's on any telco service, I have always assumed I must be the one customer experiencing down-time, and the aggregate was somehow five 9's. How is network reliability calculated to end up with five 9's? Pete.