OT: Stupid vendor tricks.

2005-07-05 Thread Bill Nash
Co-workers from past lives will recognize this as a subject near and dear to my little black heart: CISCO-SLB-MIB::slbServerFarmBindId.4."10.0.0.10" = Gauge32: 0 CISCO-SLB-MIB::slbServerFarmBindId.4."10.0.0.11" = Gauge32: 0 CISCO-SLB-MIB::slbServerFarmBindId.4."10.0.0.12" = Gauge32: 0 CISCO-SL

RE: London incidents

2005-07-11 Thread Bill Nash
Would the folks posting news related events please footnote source URLS, especially if arguing over factual details? Thanks. - billn On Mon, 11 Jul 2005, Sean Donelan wrote: On Mon, 11 Jul 2005, Hannigan, Martin wrote: All this while I was trying unsuccessfully to use my mobile to ring

Re: zotob - blocking tcp/445

2005-08-18 Thread Bill Nash
On Thu, 18 Aug 2005, Roger Marquis wrote: My question is not what can we do about bots, we already filter these worst case networks, but what can we do to make it worthwhile for bot-providers like NETNET to police their own networks without involving lawyers? Establish and document a history

Re: zotob - blocking tcp/445 (fwd)

2005-08-18 Thread Bill Nash
Resent to address formatting misbehaviour: Source proto dstPort count 62.149.195.129 6 42 13018 203.69.204.250 6 445 12889 213.123.129.237 1 204812693 70.17.255.436 443 12685 217.132.56.139 6 489911056 209.181.111.12 6

Re: [OT] Re: Banned on NANOG

2004-12-03 Thread Bill Nash
On Fri, 3 Dec 2004, Lou Katz wrote: I was puzzled by this, since I basically lurk on the list, and have made very few postings. I replied to Susan privately that, among other things, I had no record nor recollection of any previous warnings, and asked politely for information regarding these, sinc

RE: [OT] Re: Banned on NANOG

2004-12-03 Thread Bill Nash
On Fri, 3 Dec 2004, Hannigan, Martin wrote: This is my first post directly to the NANOG list. Ever. I'm not sure why you chose this thread as your sunshine, but welcome. In brief, I've never been largely concerned with where I jump into the pool, or if my speedo matches the popular cut. Apologies

Re: [OT] Re: Banned on NANOG

2004-12-04 Thread Bill Nash
On Sat, 4 Dec 2004, Paul Vixie wrote: first of all, who somebody is or how longstanding or how clueful are all subjective measures at best, and actually quite irrelevant. meritocracy, which this and all similar street-level forums must be based on, depends on the quality of what you're saying toda

Re: [OT] Re: Banned on NANOG

2004-12-04 Thread Bill Nash
On Sat, 4 Dec 2004, Stephen Sprunk wrote: I think Paul's idea is a good start: each message needs to have more signal than noise, but we can all tolerate (or even enjoy) a small percentage of noise so long as it's spread thin. I'd much rather the moderator(s) focus their efforts tracking/blocki

Re: Banned on NANOG

2004-12-04 Thread Bill Nash
On Sat, 4 Dec 2004, J.D. Falk wrote: On 12/04/04, Patrick W Gilmore <[EMAIL PROTECTED]> wrote: I also think that makes it nearly impossible to run a good, informative list. Certainly FAR more difficult than just leaving the list completely unmoderated. I do not believe anyone here would argue tho

Re: Banned on NANOG

2004-12-06 Thread Bill Nash
On Mon, 6 Dec 2004, Hannigan, Martin wrote: You expect? Bill, nothing personal, but your S:N is 0:6 at this point. Not one single op post ever. No meeting attendance. Not one answered technical question. How about earning a few stripes before making demands of NANOG? Srh may be in need of a config

Enterprise syslog management and alert generation.

2004-12-07 Thread Bill Nash
Some people call this 'Netcool' or products of a similiar stripe. I'm ramping up a project to rebuild some previous work done on this front with an open source distribution in mind (those of you on the syslog-ng list have seen mention of it), so I'm fishing for requirements I may not have alre

Re: Enterprise syslog management and alert generation.

2004-12-07 Thread Bill Nash
On Tue, 7 Dec 2004, Alexei Roudnev wrote: In such products, only 20% value is in engine; 80% are in rules, because I can not wrire rules myself - I have not event until it happen, and I can not filetr out noice until it happen. We use a few syslog analyzers (using syslog-ng as a transport), some wi

RE: Anycast 101

2004-12-20 Thread Bill Nash
On Mon, 20 Dec 2004, Hannigan, Martin wrote: there are some million-bot drone armies out there. with enough attackers I know I haven't seen any 1MM+ zombie armies out there and I'm looking for them. Why spend all that time getting 1MM bots when you only need 100K? Dormant reinforcements. Multiple

RE: Anycast 101

2004-12-20 Thread Bill Nash
On Mon, 20 Dec 2004, Hannigan, Martin wrote: Look at how the discussions surrounding SPAM have evolved. It went from "damn abusers", to "damn software", to "where's the money coming from?". The BotNet problem has already evolved to "where's the money". Botnets are a new phenomenon. [ Gadi!?] Botnet

Re: Sunday evening meeting

2005-01-03 Thread Bill Nash
On Mon, 3 Jan 2005, Susan Harris wrote: Also, what are the expected outcomes of this meeting? We can't predict outcomes until we hear from you folks - that's the goal of the meeting, to hear any and all concerns about moderation of the NANOG list, selection of talks for the meetings, and whatever e

Proposed list charter/AUP change?

2005-01-04 Thread Bill Nash
On Mon, 3 Jan 2005, Steve Sobol wrote: Susan keeps on claiming spam is offtopic for Nanog, yet the AUP/Charter/FAQ don't mention spam other than telling us not to ask "I'm being spammed, how can I make it stop?" If it's flat-out offtopic, no matter what, or if the majority of list members don't

Re: Proposed list charter/AUP change?

2005-01-04 Thread Bill Nash
On Tue, 4 Jan 2005, Stephen J. Wilcox wrote: Hi Bill, to be fair, there are specific forum for discussion of spam tackling measures and people have been pointed in that direction on numerous occasions, however in its generic sense it might still be on topic for nanog. I note the original post t

RE: Proposed list charter/AUP change?

2005-01-04 Thread Bill Nash
On Tue, 4 Jan 2005, Hannigan, Martin wrote: The changes that people are discussing have little to do with "what is" and "what isn't" on topic for the NANOG mailing list. On/off topic is very relevant, since it determines moderator involvement. Many people feel moderation is broken, and topical can

Re: Proposed list charter/AUP change?

2005-01-05 Thread Bill Nash
On Wed, 5 Jan 2005, Janet Sullivan wrote: Bill Nash wrote: On/off topic is very relevant, since it determines moderator involvement. Many people feel moderation is broken, and topical candidates are an element of it. Seeing post after post from people who feel they've been unfairly sanct

Re: Graphing Peering

2005-01-19 Thread Bill Nash
If you're already using MRTG, hopefully you're at least passingly familiar with perl and SNMP. If so, you can do some hackery to identify your BGP peer interfaces automatically and then use it to reference existing interface graphs. Take a peek in the BGP4 mib, specifically at the BgpPeerEntry

Re: Graphing Peering

2005-01-19 Thread Bill Nash
The link on that page for Juniper's Destination Class Usage (DCU) is broken. Try this one instead: http://www.juniper.net/techpubs/software/junos/junos70/swconfig70-interfaces /html/interfaces-family-config25.html - Dan On 1/19/05 5:56 PM, "Bill Nash" <[EMAIL PROTECTED]> wrote:

Re: IRC Bot list (cross posting)

2005-02-08 Thread Bill Nash
You don't mass an army if you're not about to use it. This situation can (very quickly) have operational relevance. Bringing it to light to a wider forum than special interest groups is a good idea. You'd certainly care more if it was pointed at you. - billn On Tue, 8 Feb 2005, william(at)elan.

RE: IRC Bot list (cross posting)

2005-02-08 Thread Bill Nash
On Wed, 9 Feb 2005, Hannigan, Martin wrote: Bill, haven't we been here before? :) There's TWO places that are doing this botnet stuff and the NANOG AUP discourages cross posting. I for one certainly don't want yet another list full of botnet stuff. And I'm not subscribed to either. Yet, I've no les

RE: IRC Bot list (cross posting)

2005-02-09 Thread Bill Nash
On Wed, 9 Feb 2005, Hannigan, Martin wrote: out botnet lists to NANOG, fine by me. I never said I can stop them. I just said I didn't want them as a subscriber. I understand that you don't know where these existing lists are. Look hard. If you suddenly care about bots enough in the last 24 hours to

Re: IRC Bot list (cross posting)

2005-02-09 Thread Bill Nash
[ Edited and resent, the first appears to have vanished in transit ] I concede the point that operational tracking of botnets doesn't belong here, and I offer apologies to Martin, and the list in general, for not counting to ten before replying to his email. However, simply suppressing discussio

RADB anon ftp server stoned or deprecated?

2005-02-14 Thread Bill Nash
$ ftp ftp.radb.net Connected to ftp.radb.net (198.108.1.48). 421 Service not available, remote server has closed connection $ ftp ftp.merit.edu Connected to ftp.merit.edu (198.108.1.48). 421 Service not available, remote server has closed connection - billn

Re: RADB anon ftp server stoned or deprecated?

2005-02-14 Thread Bill Nash
omain server: Name: ns1.ipowerweb.net Addresses: 64.70.61.130 smarthost1# host ds194-37.ipowerweb.com ns2.ipowerweb.net Using domain server: Name: ns2.ipowerweb.net Addresses: 66.235.217.200 smarthost1# At 10:05 PM 14/02/2005, Bill Nash wrote: $ ftp ftp.radb.net Connected to ftp.radb.net (198.108.1.48)

RE: NANOG Changes

2005-02-21 Thread Bill Nash
On Sun, 20 Feb 2005, Hannigan, Martin wrote: [ snip ] As I was browsing the archive, I noticed my post and his and another one from William Leizon that quoted mine have been removed from it. From what I understand, the archive feature wasn't turned on until just before the first post that was actu

Re: High volume WHOIS queries

2005-03-01 Thread Bill Nash
On Tue, 1 Mar 2005, Paul G wrote: point - they're trying to restrict the practicality of attempting to harvest the data and an open to the public whois server with no access restrictions would defeat that. I don't know that this is the case, I suspect it's resource management. If the database is g

Re: US slaps fine on company blocking VoIP

2005-03-04 Thread Bill Nash
On Fri, 4 Mar 2005, Nathan Allen Stratton wrote: I don't speak for BroadVoice, but this seams to be to be stupid. Why should the government get involved in ISPs blocking ports? If customers don't like it, go to a new provider, what country is this?? Frankly, I don't see the point, any provider that

Re: US slaps fine on company blocking VoIP

2005-03-04 Thread Bill Nash
On Fri, 4 Mar 2005, Nathan Allen Stratton wrote: The fact is, the company was preventing it's users from using technology offered by said company's competitors. No, they are just preventing companies that are using port X, most providers have figured out how to make VoIP work on any port. It's a p

Re: US slaps fine on company blocking VoIP

2005-03-06 Thread Bill Nash
On Fri, 4 Mar 2005, Robert Blayzor wrote: Bill Nash wrote: At the root of it, it's deliberate anti-competitive behavior, and that's what the fine is for. I'm generally fine to have the government stay out of the internet as much as possible, but this move was the correct one, as i

Re: US slaps fine on company blocking VoIP

2005-03-07 Thread Bill Nash
On Mon, 7 Mar 2005, Adi Linden wrote: If VOIP doesn't run on your network because you've oversold your capacity, no amount of QoS is going to put the quality back into your service. People will find better ISPs. If you deliberately set QoS to favor your services over a competitor, whom your custome

Re: VoIP Port Blocking Draws Congressional Interest

2005-03-08 Thread Bill Nash
On Tue, 8 Mar 2005, Fergie (Paul Ferguson) wrote: http://www.eweek.com/article2/0,1759,1773832,00.asp - ferg 'He also urged Congress to pass legislation to ensure the "complete neutrality" of wire-line and wireless telephone companies to enable VOIP customers to freely access any telephone netwo

Re: Vonage service suffers outage

2005-03-10 Thread Bill Nash
On Thu, 10 Mar 2005, Christian Kuhtz wrote: I think the final nail in this coffin is the Vonage banner ad/masthead which describes them as "the broadband phone company." But it's broadband! Shsh. It's an information service. It's IP. These are not the packets you're looking for. ;) What all

Re: IRC bots...

2005-03-12 Thread Bill Nash
On Sat, 12 Mar 2005, Fergie (Paul Ferguson) wrote: Somewhat related to operational issues... It was interesting to read the "daily handler" log at the ISC which related their experiences with detecting (and disabling/disinfecting) a machine/network infected with several IRCbot drone computers. As s

RE: IRC bots...

2005-03-12 Thread Bill Nash
On Sat, 12 Mar 2005, Hannigan, Martin wrote: [ SNIP ] Who's got time for all that? Chase the controller, shut down the user until they buy some AV software. We've gone beyond "I didn't know" for endusers in most regions. Enterprise IT staff running from whip-cracking security staff, that's who has

Re: IRC bots...

2005-03-13 Thread Bill Nash
On Sat, 12 Mar 2005, John Kristoff wrote: Tallying then just the TCP 6667 traffic, perhaps eliminating very short lived or small flows, should be a good indicator of IRC traffic usage, but tagging those as potential sources for problems may be Yes and no, in my experience. Depending on the drone, s

Re: Traceroute with ASN

2005-03-15 Thread Bill Nash
On Tue, 15 Mar 2005, Bruce Pinsky wrote: Ziggy David Lubowa wrote: | On Tue, 15 Mar 2005 17:51:32 +0800 (CST), Joe Shen wrote | |>Yes. Can I do this on a Linux box without having to |>install Zebra BGP on it? | Doesnt look like you have to, below is the link to the tarball | | http://oppleman.com

Re: IRC bots...

2005-03-21 Thread Bill Nash
On Mon, 21 Mar 2005, Alan Sparks wrote: On Sun, 2005-03-20 at 14:25, Florian Weimer wrote: * Martin Hannigan: Who's got time for all that? Chase the controller, shut down the user until they buy some AV software. That should read "AV software from at least three vendors, with direct Am I the only o

RE: outage/maintenance window opinion

2005-03-28 Thread Bill Nash
Also, the possibility of equipment failure should *always* be factored into backout/recovery plans. You can have all the faith in your hardware that you want, but Murphy has enable/root. If it's something has simple as having redundant capacity to shift the load to, or as drastic as having a s

OT: Chasing spam.

2005-03-29 Thread Bill Nash
I'm chasing after some spam that appears to have been built from a nanog post culling, and am looking for anyone else who may have recieved some mail a few weeks back, relevent info looks like: Date: Tue, 8 Mar 2005 12:01:59 -0800 From: Steve Gladstone <[EMAIL PROTECTED]> Subject: Register for

Re: OT: Chasing spam.

2005-03-29 Thread Bill Nash
Thanks for the speedy responses, gang. All my suspicions are confirmed, and I'm putting an edge on my cudgel. =) - billn On Tue, 29 Mar 2005, Bill Nash wrote: I'm chasing after some spam that appears to have been built from a nanog post culling, and am looking for anyone else wh

Re: Vonage Hits ISP Resistance

2005-03-30 Thread Bill Nash
On Thu, 31 Mar 2005, Jamie Norwood wrote: On Wed, 30 Mar 2005 21:36:19 -0600, Chris Adams <[EMAIL PROTECTED]> wrote: Once upon a time, Eric A. Hall <[EMAIL PROTECTED]> said: Do you also block NNTP so that customers have to use your servers? Change that to SMTP and you'll get a bunch of "yes" answer

Re: Vonage Hits ISP Resistance

2005-03-31 Thread Bill Nash
On Thu, 31 Mar 2005, Fergie (Paul Ferguson) wrote: Who said it was QoS? Blocking is QoS. ;) - billn

Re: Vonage Hits ISP Resistance

2005-03-31 Thread Bill Nash
On Thu, 31 Mar 2005, Suresh Ramasubramanian wrote: Korea Telecom recently decided to scrap its flat rate high speed [1] broadband offering and move to a traffic based charging plan - must be because most korean broadband gets used for online gaming, which is as high bandwidth use an app as you can

Re: Vonage Hits ISP Resistance

2005-03-31 Thread Bill Nash
On Thu, 31 Mar 2005, Steve Sobol wrote: Bill Nash <[EMAIL PROTECTED]> wrote: I have no idea what my cable company pays for their bandwidth, but I am certain it's more than the $40 per month I pay for my 3Mbps down/256 Mbps up... and I am able to actually *get* 3Mbps on many occas

Re: Vonage Hits ISP Resistance

2005-03-31 Thread Bill Nash
On Thu, 31 Mar 2005, Steve Sobol wrote: Bill Nash <[EMAIL PROTECTED]> wrote: regular basis, I imagine regulation will happen, especially if ISPs keep trying to inhibit consumer choices. There's a fine line between "inhibiting consumer choices" and "ensuring that you

Re: Vonage Hits ISP Resistance

2005-04-01 Thread Bill Nash
On Fri, 1 Apr 2005, Stephen Sprunk wrote: I understand the woes of mixing 911 and VoIP myself, although I'm not a Vonage user. The VoIP phone on my desk connects 911 calls to the Vancouver, BC, PSAP (since it's off a PBX at work), but I also know the direct-dial number for the local Dallas, TX, PS

Re: potpourri (Re: Clearwire May Block VoIP Competitors )

2005-04-01 Thread Bill Nash
On Fri, 1 Apr 2005, Adi Linden wrote: If VoIP companies are regulated into providing 911 service, minimum availability standards, etc is one thing. Forcing anyone that might be transporting VoIP into becoming a Telco is quite another... At this point, I think it's simply an argument over the interp

Re: Cisco to merge with Nabisco

2005-04-01 Thread Bill Nash
On Fri, 1 Apr 2005, Robert Boyle wrote: Brilliant move Cisco! This should give Cisco a keen and unprecedented insight into the inner workings of the cracker culture which will enable better network security. 'Network devices are rated by total packet volume, not chassis weight. Packets may sett

RE: Cisco to merge with Nabisco

2005-04-01 Thread Bill Nash
On Fri, 1 Apr 2005, Church, Chuck wrote: Incorrectly chosen switching path can now result in lost packets AND indigestion. Is this mitigated by activating Nabisco Express Forwarding?

Re: Yes, I realize it's April Fools Day, but... (was: Cisco to merge with Nabisco)

2005-04-01 Thread Bill Nash
On Fri, 1 Apr 2005, Bill Woodcock wrote: ...the "reformed" NANOG list moderation committee seems to suffer foolishness somewhat more gladly than the old regime. Could we have a little more backbone in the moderation, please? I don't want to be reading about crackers until this time next year. "In

Re: Network-Automation discussion mailing list created

2005-04-07 Thread Bill Nash
On Thu, 7 Apr 2005, Brent Chapman wrote: I've created a Network-Automation mailing list for discussions of issues related to automating network configuration and management, including (but not limited to) methods, mechanisms, techniques, philosophies, policies, and products. In the spirit of ma

Re: Network-Automation discussion mailing list created

2005-04-07 Thread Bill Nash
On Thu, 7 Apr 2005, Brent Chapman wrote: At 3:15 PM -0700 4/7/05, Bill Nash wrote: I've created a Network-Automation mailing list for discussions of issues related to automating network configuration and management, including (but not limited to) methods, mechanisms, techniques, philoso

Re: SORBS Identity theft alert

2005-04-10 Thread Bill Nash
On Mon, 11 Apr 2005, Dean Anderson wrote: See http://www.iadl.org/sorbs/sorbs-story.html And with some clever correlation, googling, and patience, I could do the same for the majority of people posting to this list on a regular basis. In short, what's your point? If you have substantial evidence

Re: SORBS Identity theft alert

2005-04-11 Thread Bill Nash
On Sun, 10 Apr 2005, Randy Bush wrote: SORBS lists Dean. I suspect this makes him angry. who's dean? the problem with feeding trolls is that they puke it up on the carpet. Negative reinforcement is better than procmail. The problem with trolls is that they keep coming back if you don't beat them

Re: Maybe OT: MPLS QOS SLA Monitoring

2005-04-11 Thread Bill Nash
On Mon, 11 Apr 2005 [EMAIL PROTECTED] wrote: I'm currently looking at what the possibilities are for monitoring network activity and SLAs against Cisco QOS mechanisms within VRFs. The most desirable method seems to be using NetFlow collectors, though it seems as though the benchmark for this is Net

Re: AUP for NANOG?

2005-04-14 Thread Bill Nash
On Thu, 14 Apr 2005, Scott Grayban wrote: > > I am new to this field and I joined here to learn more. > I certainly have heard my share of bashing from linux forums. > > The more bashing I hear here the less I want to ask a question here. > I'm not stupid but I am worried that one question might

RE: Getting a BGP table in to a lab

2005-04-20 Thread Bill Nash
Zebra is a great option here, I use it to eat a routing table from production routers, peer a perl Net::BGP daemon with it, and then do SQL injections from there to instruct my netflow engine on baseline subnetting for external networks, as well as provide AS clue for non-AS aware netflow expo

Re: Vonage Hits ISP Resistance

2005-03-30 Thread Bill Nash
On Wed, 30 Mar 2005, Eric A. Hall wrote: | to bear the additional cost of my customers choosing to use a | competitor's VOIP service over my own, says Greg Boehnlein, who | operates Cleveland, Ohio-based ISP N2Net. | | Without control of the last mile, we're screwed, Boehnlein says, | which is

Re: On the-record - another "off-topic" post

2005-05-03 Thread Bill Nash
On Tue, 3 May 2005, Dean Anderson wrote: Basically, when the discussion degenerates to "dean is a troll", on a forum like this, it means they've run out of ideas, but don't want to concede anything, and are looking to divert attention to something else. And of course, one can't make someone (on a f

Catalyst Flow Export wierdness.

2005-06-08 Thread Bill Nash
Configured to export v5 flows, cat6509 running IOS is sourcing 95% v7, and 5% v5. Anyone seen this kind of behaviour? - billn

Netflow voodoo.

2005-06-08 Thread Bill Nash
Thanks for the emails, y'all very quickly confirmed my theories and I'm starting an argument with the network guys about it. Thanks again! - billn

Re: Catalyst Flow Export wierdness.

2005-06-08 Thread Bill Nash
t make the difference, the clued respondants still saw the break for what it was. Thanks again. - billn On Wed, 8 Jun 2005, Andrew - Supernews wrote: "Bill" == Bill Nash <[EMAIL PROTECTED]> writes: Bill> Configured to export v5 flows, cat6509 running IOS is sourcing Bill&

Re: live chat with other nanog'ers

2005-12-31 Thread Bill Nash
On Fri, 30 Dec 2005, Christian Kuhtz wrote: This must be the holiday lull... Is this thread a glue pot yet? The surest sign that a thread has run its full course and is now descending into true wankerhood.. is when I post to it. Happy New Year, kids. - billn

Re: Reporting botnets?

2006-01-11 Thread Bill Nash
There are companies/products that specialize in mitigating C&C traffic in a fairly elegant manner. One specific one that we've had good experiences with is Mainnerv's Darknet product. They deploy a box on the network, interfacing with your enterprise via a BGP peer, which issues a handful o

Re: Cisco, haven't we learned anything? (technician reset)

2006-01-12 Thread Bill Nash
Just as an offshoot discussion, what's the state-of-the-art for AAA services? We use an modified tacacs server for multi-factor authentication, and are moving towards a model that supports single-use/rapid expiration passwords, with strict control over when and how local/emergency authentica

Re: GoDaddy.com shuts down entire data center?

2006-01-17 Thread Bill Nash
On Tue, 17 Jan 2006, Matt Ghali wrote: On Tue, 17 Jan 2006, Robert E.Seastrom wrote: The first and second paragraphs are sane. The last paragraph gives Go Daddy the right to capriciously and arbitrarily delete your domain for any reason they wish ("Morally objectionable activities will i

Re: Interesting netflow entry

2006-02-06 Thread Bill Nash
On Mon, 6 Feb 2006, Wil Schultz wrote: Here is another pattern, sourced off of one the destinations: [snip] You may find it far simpler to just ask the person who owns the sources that those packets are. While this may not be politically feasible (insert network and privacy policies her

Re: Interesting netflow entry

2006-02-07 Thread Bill Nash
On Mon, 6 Feb 2006, Wil Schultz wrote: Incidentally (because I ask everyone this), what's your flow volume (flows per second)? Cannot get ahold of the machine until tomorrow. I did a 'wc' on 4 devices for 5 minutes and it comes out to just under 3600, about 11-12 per second... Erm, that

Re: Interesting netflow entry

2006-02-07 Thread Bill Nash
On Tue, 7 Feb 2006, Christopher L. Morrow wrote: Are you sure you're getting everything? he did previously state he was only using about 120mbps... and it'd depend upon his/your sample rates as well... Missed that part. Even so, 120mbps of actual usage, I would expect to see a higher volu

RE: Fed Bill Would Restrict Web Server Logs

2006-02-14 Thread Bill Nash
On Tue, 14 Feb 2006, David Hubbard wrote: From: Andy Davidson Speaking with my e-commerce vendor hat on, server logs (apache, mail, application audit logs) and other information about visitors (especially those who have conducted a purchase transaction with us, or signed up to our newslett

Re: Fed Bill Would Restrict Web Server Logs

2006-02-14 Thread Bill Nash
On Tue, 14 Feb 2006, Hyunseog Ryu wrote: I guess the question is how to read "legitimate" word. ^.^ I guess the bill was written in mind of privacy concern. But also there is some requirement for security/law-enforcement viewpoint. I received the request from some law-enforcement about actual

Re: Quarantine your infected users spreading malware

2006-02-20 Thread Bill Nash
On Tue, 21 Feb 2006, Gadi Evron wrote: Many ISP's who do care about issues such as worms, infected users "spreading the love", etc. simply do not have the man-power to handle all their infected users' population. The ISPs will be a part of the solution. However, ISPs fall into two major c

Re: Quarantine your infected users spreading malware

2006-02-20 Thread Bill Nash
g that this has operational merit when it comes to mitigating both risk and effects is pretty astounding, even by nanog standards. Thanks. - billn On Mon, 20 Feb 2006, Bill Nash wrote: On Tue, 21 Feb 2006, Gadi Evron wrote: Many ISP's who do care about issues such as worms, infected users "

RE: Quarantine your infected users spreading malware

2006-02-20 Thread Bill Nash
ISPs hold the relevent data to contact the users. This needs a feedback loop, in that ISPs need to know which traffic leaving their networks is misbehaviour somewhere else. Between firewall logs, IDS logs, netflow headers, apache logs, whatever. It's all there. It just needs to be used. - b

Re: Quarantine your infected users spreading malware

2006-02-21 Thread Bill Nash
On Tue, 21 Feb 2006, [EMAIL PROTECTED] wrote: Why not just bypass them and go direct to the unwashed masses of end users? Offer them a free windows infection blocker program that imposes the quarantine itself locally on the user's machine. This program Offering them free software won't work

Re: Quarantine your infected users spreading malware

2006-02-21 Thread Bill Nash
On Tue, 21 Feb 2006, [EMAIL PROTECTED] wrote: If you're talking about a compulsory software solution, why not, as an ISP, go back to authenticated activity? Distribute PPPOE clients mated with common anti-spyware/anti-viral tools. Pull down and update signatures *every time* the user logs in,

Re: Quarantine your infected users spreading malware

2006-02-21 Thread Bill Nash
On Tue, 21 Feb 2006, Jason Frisvold wrote: On 2/21/06, Bill Nash <[EMAIL PROTECTED]> wrote: If you're talking about a compulsory software solution, why not, as an ISP, go back to authenticated activity? Distribute PPPOE clients mated with common anti-spyware/anti-viral tools. Pu

Re: 95th percentile - the sociology study.

2006-02-27 Thread Bill Nash
On Mon, 27 Feb 2006, Jo Rhett wrote: All but three of the people who tried to teach me how to calculate 95th percentile were polite and clueful when I reminded them that I wanted the math, not a tutorial. A couple of misunderstanding actually wandered off into statistical analysis ramblings w

Re: Quarantine your infected users spreading malware

2006-02-28 Thread Bill Nash
The simplest method is to issue a different gateway to a registry of known offenders, forcing their into a restrictive environment that blocks all ports, and uses network translation tricks to redirect all web traffic to a portal. For cable modems and bridged DSL, you can do this with DHCP,

Re: Quarantine your infected users spreading malware

2006-03-01 Thread Bill Nash
On Wed, 1 Mar 2006, David Nolan wrote: Yeah, but it's not near as fun as dynamic acls updated via a script monitoring flow logs in real-time. It's definitely easier to implement, though. Interesting... Thats actually basically what we were doing before, but phased out in favor of the URPF &

Re: UDP Badness [Was: Re: How to measure network quality&performance for voip&gameservers (udp packetloss, delay, jitter,...)]

2006-03-10 Thread Bill Nash
On Fri, 10 Mar 2006, Richard A Steenbergen wrote: On Fri, Mar 10, 2006 at 11:52:40AM +, tony sarendal wrote: Does traceroute really do that ? Even for ICMP. Think about it. Hint: the return packets your traceroute produces, do they have the same return path for every hop ? Think Inter

Re: Backbone Monitoring Tools

2006-03-28 Thread Bill Nash
If you can't say something useful.. Assuming you're looking for basic latency and availability monitoring, with alerts: http://www.smokeping.org - billn On Tue, 28 Mar 2006, Jon Lyons wrote: mrtg.. Ashe Canvar <[EMAIL PROTECTED]> wrote: Hi All, I want a simple backbone monitor for my 5

Re: Backbone Monitoring Tools

2006-03-29 Thread Bill Nash
Wouldn't you be better served just walking the netToMedia tables for your devices? Parsing configs sucks. Even caching the contents of a simple snmpwalk would save you some pain. Shovel 'em into a db and call it a day. - billn On Wed, 29 Mar 2006, Ashe Canvar wrote: Well, True. But the i

Re: Determine difference between 2 BGP feeds

2006-04-18 Thread Bill Nash
Were I faced with this reporting equirement on an on-going basis, I'd suggest establishing a read-only BGP peer with both devices and comparing directly. I've got a perl BGP peering daemon that feeds and maintains a mirror of the BGP routing table into SQL, applying updates and withdrawals

Re: Determine difference between 2 BGP feeds

2006-04-18 Thread Bill Nash
On Tue, 18 Apr 2006, David Andersen wrote: Much of what Bill described below is already present using Nick Feamster's bgptools release: http://nms.lcs.mit.edu/software/bgp/bgptools/ Start with zebra / quagga / etc., which do a great job of dumping tables and updates. Then use bgptools to

Re: Geo location to IP mapping

2006-05-15 Thread Bill Nash
It works for spammers. - billn On Mon, 15 May 2006, Brian Wallingford wrote: I'm not quite comfortable with the idea of building a market audience based on data with at best dubious accuracy. On Mon, 15 May 2006, Martin Hannigan wrote: :At 12:49 PM 5/15/2006, Brian Wallingford wrote: : :>

Re: Geo location to IP mapping

2006-05-15 Thread Bill Nash
Google's available geolocation resources are much more direct: They can get the information directly from the user. Google mail users setting location information, google home page users setting weatherbug details, common location searches in google maps, or local business directory searches

Re: Interesting new spam technique - getting a lot more popular.

2006-06-14 Thread Bill Nash
And let me tell you.. inheriting a network like that, knowing a better way to do it, will make you want to put a gun in your mouth. Two /19's worth of address space in VLAN1 (not just in one vlan, but in vlan *1*. Cisco nerds are slapping foreheads or spitting Coke right now.) Trying to mig

Re: OT: Vendors Using NANOG for a Sales Channel

2007-10-26 Thread Bill Nash
On Fri, 26 Oct 2007, Scott Weeks wrote: > I would suggest that no one should buy from vendors who get email > addresses from NANOG or other technical mailing lists. It will only > encourage them to do it more and ruin the value of the mailing list in > question. > > You obviously haven't had

Re: [admin] Errors to NANOG list subscribers take II

2007-11-09 Thread Bill Nash
On Fri, 9 Nov 2007, Jay R. Ashworth wrote: > On Fri, Nov 09, 2007 at 11:11:28AM -0500, Martin Hannigan wrote: > > On Nov 9, 2007 11:00 AM, Bill Nash <[EMAIL PROTECTED]> wrote: > > > Given the serious impact this is having on operations, does this have a > > > m

Re: [admin] Errors to NANOG list subscribers take II

2007-11-09 Thread Bill Nash
Given the serious impact this is having on operations, does this have a master ticket number or escalation id of some type? Has the vendor been involved yet? When can we expect to see a post mortem/RFO? - billn On Fri, 9 Nov 2007, Martin Hannigan wrote: > > Dear Colleagues: > > As you know

Re: [admin] Using the NANOG list as a paging mechanism

2008-01-04 Thread Bill Nash
On Fri, 4 Jan 2008, Patrick Clochesy wrote: I think the "page" is going to the list because the sender does not know the contact for the site, and the list provides a good way to find someone to handle the request... the intended recipient of the page being a north american network operator

RE: Area Social Activity

2008-02-14 Thread Bill Nash
Given that the last reported water temperature in Monterey was 52.9F, I think there will be more drinkers than divers. - billn On Thu, 14 Feb 2008, Rod Beck wrote: I am suggesting a Certified Drinkers Event in the hotel bar Sunday evening. -Original Message- From: [EMAIL PROTECTED

Re: load balancing and fault tolerance without load balancer

2008-03-14 Thread Bill Nash
NANOG really isn't the forum for this kind of conversation. That said, look into devices like Alteons, or open source solutions like Balance-NG. Even Apache can be used for this with something like mod_proxy. Good luck. - billn On Sat, 15 Mar 2008, Joe Shen wrote: hi, we plan to set

Re: do you know how to dump packet to see vlan info

2008-03-19 Thread Bill Nash
You can use the 8021q module in linux, and the vlan tools to run an interface as a dot1q trunk. I'm not sure off-hand about the other distributions, but under Debian you just need the 'vlan' package. modprobe 8021q ifconfig eth1 up vconfig add eth1 ifconfig eth1. netmask Configure your s

OT: vendor spam

2008-03-31 Thread Bill Nash
Anyone seen spam from Uplogix.com? As it came to this email address, which I don't give to vendors for exactly this reason, I'm suspecting it's been harvested from this list or maybe c-nsp, the only other list I'm active on, for sporadic amounts of active. Has anyone else seen this? I'd lik

Re: Anyone from Verio here?

2008-04-16 Thread Bill Nash
Just going off your email address/domain, it occurs to me that your problem may in fact be far to leet for the likes of nanog to handle. Have you tried an efnet oper? They have far superior leetness, and quite likely a little more time on their hands. One of them may also own that botnet, so

  1   2   >