Re: Testing procedures for new network implementation?

Hi Rick You seem slightly confused: All the URLs you sent are for 10/100 ethernet switches/hubs (I inserted the relevant title below each url ) -- Rafi ## On 2004-08-11 10:39 -0400 Ricardo Rick Gonzalez typed: RG RG Wayne, RG RG My organization has recently switched from a

Re: Default Internet Service

How the H*** did Hitler and Nazis relate to the subject ??? Susan -- Rafi ## On 2004-06-13 16:08 +0100 Per Gregers Bilse typed: PGB PGB PGB Anybody care to mention Hitler and Nazis? Yes? Please? Pretty please? PGB PGB -- Per PGB PGB

Re: IT security people sleep well

## On 2004-06-07 10:29 -0400 Daniel Corbe typed: DC DC DC You have to have an IOS image with the 3DES feature set to run ssh Not quite: single DES will do fine (if you use an SSH client that supports it) -- Rafi DC DC Edward B. Dreger wrote: DC DC DS Date: Thu, 03 Jun 2004

Re: [Fwd: [IP] New flaw takes Wi-Fi off the air]

## On 2004-05-13 21:43 -0400 [EMAIL PROTECTED] typed: Any bets on what will be rediscovered next? Some CERT will realize that if a DDoS uses RFC1918 source addresses, it will be hard to track down the misbehaving sources? ;) No - then someone would have to re-invent backscatter

RE: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 orother vendor ?

## On 2004-04-26 10:31 +0100 Stephen J. Wilcox typed: SJW On Sun, 25 Apr 2004, Alexander Hagen wrote: SJW SJW I was surprised by the similarities between the 7507 and 7513. Why EOL SJW the one device that has a pleasing form factor ? There are MANY SJW providers who would be quite happy

RE: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 orother vendor ?

## On 2004-04-25 06:06 -0700 Alexander Hagen typed: AH AH It is a great box. But I need BGP. I notice Cisco does not support 7505 AH with Software Advisor but does 7507 whats the deal with that ? That would probably be that the 7505 is EOL(End Of Life)

RE: Cisco Router best for full BGP on a sub 5K bidget 7500 7200 orother vendor ?

: (650) 728-3086 AH AH Cell: (650) 740-0650 (Does not work at our office in Montara) AH AH Home: (Emgcy or weekends) 650-728-5820 AH AH fax: (650) 240-1750 AH AH http://www.etheric.net AH AH AH AH -Original Message- AH From: Rafi Sadowsky [mailto:[EMAIL PROTECTED] AH Sent: Sunday

Re: Overflow circuit

## On 2004-03-27 19:30 -0800 Alexei Roudnev typed: AR AR It means, that satellite (with it's 1 second delay and unavoidable echo) Geosynchronous satellite IP link RTT can be just over 500 mill-sec (real life experience) IMHO thats a rather significant difference -- Rafi

Re: who offers cheap (personal) 1U colo?

## On 2004-03-14 11:58 - Simon Lockhart typed: SL SL If someone can point me to Virtual Solaris Machine, then I'd willingly offer SL that as a service (the colo I help run as a hobby is Sun only). AFAIK that will be in Solaris 10 - See N1 Grid Containers on

Re: BL of Compromised Hosts?

## On 2004-02-22 19:20 +0100 Daniel Concepcion typed: DC DC DC Hi Deepak, DC DC Check DC http://www.cymru.com/BGP/bogon-rs.html DC They are doing a good job in this issue. Not quite - That is a list of BOGON networks (such as non-allocated, private(RFC1918), ... ) You're probably

Re: Nachi/Welchia Aftermath

## On 2004-01-20 20:02 -0800 Tom (UnitedLayer) typed: T( T( On Tue, 20 Jan 2004, Rubens Kuhl Jr. wrote: T( Not all L3-switches are flow-based; prefix-based ones should do just fine. T( Can people add/correct this initial list ? T( T( Flow-based: Foundry with IronCore modules, Cisco

Re: router design (was Re: /24s run amuck)

## On 2004-01-13 14:35 -0500 Richard A Steenbergen typed: RAS RAS RAS As far as pricing for these things goes, let us take an example here... RAS The Juniper routing engine is actually a 6U blade server on it's side: RAS RAS

Re: Cachibility analysis software ?

HN HN Go to http://www.ircache.net/ and click on the cachability checker HN link in the left navigation menu. HN HN Or: http://www.mnot.net/cacheability/ HN HN -Hank HN Or: http://www.web-caching.com/cacheability.html -- Rafi

Re: VeriSign Capitulates

## On 2003-10-03 15:56 -0400 Sean Donelan typed: SD SD SD Without so much as a hearing, ICANN today formally asked us to shut down SD the Site Finder service, said VeriSign spokesman Tom Galvin. We will SD accede to their request while we explore all of our options. SD SD Uhm, was that

Re: change to the COM and NET TLD

Hi Neil Maybe I'm being naive(or silly ;-) but wouldn't complaining to FTC.gov be more effective ? -- Thanks, Rafi ## On 2003-09-16 08:40 +0100 Neil J. McRae typed: NJM NJM Dear Incredibly Bright Chaps over at Verisign, NJM NJM I accidentally typed www.msnnn.net and NJM was

Off-topic followups [Was: Re: East Coast outage?]

Hi Guys I must say I'm enjoying all of these fascinating off topic followups but isn't about time to move this discussion to [EMAIL PROTECTED] ? -- Thanks, Rafi -- Rafi Sadowsky [EMAIL PROTECTED] Network Operations Center | VoiceMail

RE: WANTED: ISPs with DDoS defense solutions

## On 2003-07-31 09:27 -0400 McBurnett, Jim typed: MJ MJ I tend to agree here. MJ I have noticed so many attacks etc coming from MJ APNIC as of recent that on our corp network we have an ACL MJ to block a number of APNIC blocks. MJ If there was a dynamic method to add null0 routes to MJ

Re: Major E-mail Delivery for FTC DNCR Launch

## On 2003-06-25 21:25 -0400 Leo Bicknell typed: LB LB LB * Put in the e-mail a clear, short, easy to read over the phone LB link (http://www.yoursite.com/spam.html) Oops: this is an existing URL titled FREE Credit Card Gateway :-( LB that describes what LB action on the web site

Re: internet.com

## On 2003-03-31 18:14 -1000 Michael Painter typed: MP MP Time to get *nix loaded on this new laptop I suppose...what's your favorite traceroute prog.? MP MP --Michael MP MP May I suggest using tcptraceroute ? -- Rafi

Re: NANOG Splinter List (Was: State Super-DMCA Too True)

Hi guys, Whats wrong with the nanog-offtopic list ? -- Rafi ## On 2003-03-30 14:07 -0500 Jared Mauch typed: JM JM JM Hello, JM JM Someone write up a list charter for a new list and let me know. JM JM I can host such a list. JM JM - Jared JM JM On Sun, Mar

Re: Using Policy Routing to stop DoS attacks

## On 2003-03-25 09:06 -0500 Christian Liendo typed: [snip] CL CL Depending on the router and the code, if I implement an access-list then CL the CPU utilization shoots through the roof. CL What I would like to try and do is use source routing to route that traffic CL to null. I figured it

OT: Re: WANAL (Re: What could have been done differently?)

## On 2003-01-28 17:49 - Paul Vixie typed: PV PV In any case, all of these makers (including Microsoft) seem to make a very PV good faith effort to get patches out when vulnerabilities are uncovered. I PV wish we could have put time bombs in older BINDs to force folks to upgrade, PV but

Re: Level3 routing issues?

## On 2003-01-25 20:04 - Stephen J. Wilcox typed: SJW SJW SJW Heres my advice to the uninitiated. Run linux, run firewalls, disable what you SJW dont need and listen to folks who have real world experience. SJW SJW Steve SJW Please don't start a flame war about this but are you

Re: MBONE

## On 2002-12-28 01:39 +0100 Daniel Roesen typed: DR DR DR Why don't you ask on your own continent? Is there any particular DR attractive idea behind sending traffic unnecessarily over the Atlantic DR which I miss? DR Seems your network(cluenet.de) finds sending traffic that way attractive

[OT]Re: MBONE

Hi Nicolas It seems you have an IPv6 tunnel to SWITCH - AFAIK they should be getting an MBONE feed via GEANT Why not ask them(since you seem to already have a working arrangement)? Alternatively try Renater (the French NRN) who is also downstream from GEANT -- Rafi ## On

Re: Operational Issues with 69.0.0.0/8...

## On 2002-12-09 20:19 -0600 Rob Thomas typed: RT RT Hi, Eddy. RT RT ] Give Rob Thomas official authority, a paycheck, and the necessary RT ] bandwidth. ;-) RT RT Hehe! I'll second that! :) No one would support it, though, once they RT saw my lousy code. :) Hi Rob 1) I'd take your

Re: Spanning tree melt down ?

## On 2002-11-30 15:41 +0100 Jim Segrave typed: JS JS I find the reactions on this mailing list disturbing, to say the JS least. The rush to judgement about what happened appears to be based JS on speculation and assumptions about how this large facility was run, JS managed and staffed. JS

Re: Spanning tree melt down ?

## On 2002-11-29 15:05 -0600 Daniel Golding typed: DG DG DG Yes, I read his bio. I'm sure he's quite the techie amongst his fellow DG physicans, and I think thats a great thing. However, its more than just a DG bad idea to put someone who isn't completely proficient in a job like this DG -

Re: What? : Delivery Status Notification (Failure) (fwd)

me too :-( -- Rafi ## On 2002-11-16 15:07 +0100 Andre Chapuis typed: AC AC Yes I do too... AC Andr AC AC - Original Message - AC From: Stephen J. Wilcox [EMAIL PROTECTED] AC To: [EMAIL PROTECTED] AC Sent: Saturday, November 16, 2002 1:28 PM AC Subject: What? : Delivery

Re: PAIX

## On 2002-11-14 14:44 -0800 Vadim Antonov typed: VA VA VA On Thu, 14 Nov 2002, David Diaz wrote: VA VA 2) There is a lack of a killer app requiring peering every 100 sq Km. VA VA Peering every 100 sq km is absolutely infeasible. Just think of the VA number of alternative paths routing

Re: Need help with ~100Mbps layer2 or 3 to Alexandria/Egypt

## On 2002-11-07 16:30 -0800 Arman typed: A A Hello, A A We have been tasked with finding ~100 megs of IP transit in A Alexandria/Egypt. A Options; A 1. Lease E3 circuit between Italy or any location within the oceanic fiber A route or direct IP connectivity in Alexandria. Planning

Re: High Processor Rates on Routers.

## On 2002-11-06 15:54 - Chris Roberts typed: CR CR CR BGP can cause a lot of processor utilisation when updates are received, CR although this is not normally at accurate 30 second intervals, so I CR wouldn't suspect this particularly. CR I've seen this happen with OSPF routes

Re: UUNET Routing issues

## On 2002-10-04 23:50 +0200 Iljitsch van Beijnum typed: IvB IvB Obviously some packet loss and jitter are normal. But how much is IvB normal? Even at a few tenths of a percent packet loss hurts TCP IvB performance. The only way to keep jitter really low without dropping large IvB numbers of

Re: How do you stop outgoing spam?

## On 2002-09-10 10:02 +0300 Petri Helenius typed: PH PH If somebody is ignorant enough to implement IP over HTTP, why should PH they be accommodated? There are numerous reasons why there are other PH port numbers to TCP than 80 and other protocol numbers to IP than 6. Why do you think

Re: How do you stop outgoing spam?

## On 2002-09-10 09:45 -0400 [EMAIL PROTECTED] typed: Hi Eliot Maybe I'm missing something obvious but do how you get rate-limiting per TCP *flow* with Cisco IOS ? It is more trouble than its worth. IMHO there are other problems beside SPAM that can use per flow

Re: How do you stop outgoing spam?

## On 2002-09-09 17:53 -0400 Marshall Eubanks typed: ME ME ME When I go to Internet cafe's (I like Global Gossip), I connect my Ti-book ME to the local ethernet if at all possible (that's why I like Global Gossip) and ME use high bit rates (i.e., file transfers) in both direction. ME ME If I

Re: How do you stop outgoing spam?

## On 2002-09-09 17:15 -0700 Eliot Lear typed: EL EL Paul Vixie wrote: EL per-destination host AND port egress rate shaping. if someone tries to send EL more than 1Kbit/sec to all port 80's, or more than 1Kbit/sec to any single EL IP address, then you can safely RED their overage. this

Re: Traffic Threshold monitoring?

## On 2002-08-25 23:54 -0700 Rob Mitzel typed: RM RM Hi everyone, RM RM Quick question. We're currently using MRTG to monitor traffic on a RM number of cisco switches connected to various customers. Now, this is RM all great and everything, except there's no real way to monitor if a RM

Re: Eat this RIAA (or, the war has begun?) - Why not all ISPs?

## On 2002-08-22 08:04 +0100 Avleen Vig typed: AV AV Start here: AV avleen@apple:avleen : host -t MX riaa.org AV riaa.org mail is handled (pri=50) by mail3.riaa.com AV riaa.org mail is handled (pri=10) by list.sparklist.com AV riaa.org mail is handled (pri=10) by mail.riaa.com AV riaa.org mail

Re: Eat this RIAA (or, the war has begun?) - Why not all ISPs?

OOPS - my typo sorry! (standing in the corner with egg on my face ;-) ## On 2002-08-22 11:10 +0300 Rafi Sadowsky typed: RS RS RS ## On 2002-08-22 08:04 +0100 Avleen Vig typed: RS RS AV RS AV Start here: RS AV avleen@apple:avleen : host -t MX riaa.org RS AV riaa.org mail is handled (pri=50

Re: Identifying DoS sources quickly (was: Bogon list or Dshield.orgtype list)

## On 2002-07-31 10:09 +0200 Jesper Skriver typed: JS On Wed, Jul 31, 2002 at 12:22:30AM -0700, Randy Bush wrote: JS JS AFAIK 12.0S only has the service provider feature set JS JS i fear that the joke is on us. at least one other train seems to JS have been merged into the ex-isp train.

Re: Identifying DoS sources quickly (was: Bogon list or Dshield.orgtype list)

## On 2002-07-30 08:23 -0700 Randy Bush typed: RB RB Not a complete solution but a start: RB IP Source Tracker: RB http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120 RB limit/120s/120s21/ipst.htm RB Available as of 12.0(22)S for 7500 and 12000 series Cisco

Re: fractional gigabit ethernet links?

Sush, Are you thinking of rate-limiting or traffic shaping ? I'd expect rate-limiting of bursty traffic to lose some packets irrespective of the L3 hardware/CPU capacity -- Rafi ## On 2002-07-15 23:57 -0400 Sush Bhattarai typed: SB SB Might want to query your provider as to where

Re: The Cidr Report - web site inaccessible ?

Is it just me ? -- Thanks Rafi [rafi@noc ~]$ date Sun Jul 14 21:30:54 IDT 2002 [rafi@noc ~]$ lynx -dump http://www.employees.org/~tbates/cidr-report.html; Forbidden You don't have permission to access /~tbates/cidr-report.html on this

Re: Allocated IP blocks

Rob Thomas maintains a a nice list: http://www.cymru.com/Documents/bogon-list.html -- Rafi ## On 2002-07-01 10:12 -0700 Mike Batchelor typed: MB MB Is there a list anywhere of allocated IP blocks? MB MB I need to update my IDS sensor's table of valid blocks. It's alarming on MB

Re: KPNQWEST cease operation?

## On 2002-06-14 04:08 +0100 Chrisy Luke typed: CL CL ?$BLpEDIt?(B wrote (on Jun 14): CL I heard that NOC of KPQWEST in Frankfurt would cease operation at 1400 CL hour (local time) today. CL CL Is there any additional information about this? CL CL http://live.ebone.com/ is probably about

limiting # of prefixes from a BGP peer (Was: Re: genuity - any good?)

-- Rafi Sadowsky [EMAIL PROTECTED] Network/System/Security VoiceMail: +972-3-646-0592 FAX: +972-3-649-8629 Mangler ( :-) | FIRST-REP for ILAN-CERT([EMAIL PROTECTED]) Open University of Israel | (PGP key - ) http://telem.openu.ac.il/~rafi