Re: [c-nsp] BGP Config

2009-05-19 Thread Charles Wyble
Ivan Pepelnjak wrote: I absolutely agree with Charles ... although not on the provider will give you the necessary details part. I've seen some service providers that were somewhat inadequate in that respect (trying to be diplomatic :). Yes. That's quite true unfortunately. :( You might

[c-nsp] IP Tunneling Question

2009-05-19 Thread Charles Wyble
All, I'm looking to setup a VPN with a couple colocation providers who are friends of mine, and have some under utilized address space. They are supporting some security research I am doing (a darknet/honeynet). [1] I am exploring different options to utilize that IP space on my lab

Re: [c-nsp] Inventory tool

2009-05-13 Thread Charles Wyble
Check out http://inventory.alterpoint.com/ Darryl Dunkin wrote: RANCID includes various hardware output with serial numbers and revisions, along with full configurations: http://www.shrubbery.net/rancid Netdot does some of this as well: http://netdot.uoregon.edu -Original Message-

Re: [c-nsp] BGP and OSPF - redesign

2009-05-11 Thread Charles Wyble
Pete Templin wrote: ch...@lavin-llc.com wrote: [snip] 1: Add in any necessary configurations so that OSPF is carrying AT LEAST what it'll have at the end of the project. 2: Update BGP so that it's carrying everything that it should be carrying. 3: Trim BGP so that it's carrying

Re: [c-nsp] Lightweight Radius Server for small installation and Windows

2009-05-06 Thread Charles Wyble
I agree. I set this up with windows 2008 recently. My Linksys wireless router and my cisco 1841 authenticate to AD. I haven't hooked it up to a VPN yet but that's possible. As for one time passwords, http://www.wikidsystems.com/community-version and http://directory.apache.org/ I don't

Re: [c-nsp] The mechanics of SSO

2009-05-06 Thread Charles Wyble
Ouch. nasty race condition from the looks of it. Those little corner cases that are oh so very sharp. Ross Vandegrift wrote: Hey guys, Today, due to what appears to be a major problem in SXF13, we experienced two sequential crashes, taking out both SUPs in a 6500 within the time it

Re: [c-nsp] Nexus 5000?

2009-05-06 Thread Charles Wyble
- no 10/100; copper Ether is 1G only Why? Can't the silicon do 10/100/1000? I mean that is what most kit is sold as right? I mean granted many folks have 1gbps ports on their kit but it almost seems like they go out of there way to avoid the 10/100 compatibility.

Re: [c-nsp] Cisco MPLS interoperability with Mikrotik (or Linux) MPLS

2009-04-29 Thread Charles Wyble
Last time I looked into this (mid last year) the Linux bits weren't very mature. Not sure how Mikrotik or Vyatta have changed it. Hopefully they have made things better. Rubens Kuhl wrote: Have anynone done any testing interoperating Cisco MPLS (Cat 6k or 7600 families) with Mikrotik (which

Re: [c-nsp] DHCP server suited for option 82

2009-04-27 Thread Charles Wyble
http://www.cisco.com/en/US/docs/ios/12_2t/12_2t2/feature/guide/ftrbeo82.html Pavel Skovajsa wrote: Hello all, I am trying to setup linux dhcpd ISC server to act according to certain circuit-id values in the Option 82, and I find the whole configuration very poorly documented, and quite

Re: [c-nsp] DHCP server suited for option 82

2009-04-27 Thread Charles Wyble
Also http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gdhcpopt.html which I think is what you want. Pavel Skovajsa wrote: Hello all, I am trying to setup linux dhcpd ISC server to act according to certain circuit-id values in the Option 82, and I find the whole configuration

Re: [c-nsp] DHCP server suited for option 82

2009-04-27 Thread Charles Wyble
http://www.thtech.net/article/10 for ISC example Pavel Skovajsa wrote: Hello all, I am trying to setup linux dhcpd ISC server to act according to certain circuit-id values in the Option 82, and I find the whole configuration very poorly documented, and quite complex. This is quite surprising

Re: [c-nsp] Problems with DHCP static bindings

2009-04-24 Thread Charles Wyble
I recall having this problem with Xerox printers. I believe I ended up having to set the address via the control panel on the device. This was with ISC DHCPD server. It's something weird with Xerox kit, not the server side. james edwards wrote: We are using DHCP off the router, assigning

Re: [c-nsp] QoS Lab Recommendations

2009-04-20 Thread Charles Wyble
Well perhaps start with the GNS3 labs to get an idea of various topologies? Andy Saykao wrote: Hi All, I'm looking for some QoS hands on labs to try out - does any body have any recommendations or reference material I can use? I've got all the hardware to pretty much set up any lab I want.

Re: [c-nsp] Monitoring External Web Server

2009-04-03 Thread Charles Wyble
I would strongly recommend keynote over gomez. It's what a lot of folks use. Gomez has some interesting features, but I found them harder to work with. Pingdom is also a popular choice. Or you could just use nagios or other monitoring tools do you have any sort of network

Re: [c-nsp] Unknown Multicast Traffic cause High CPU

2009-04-01 Thread Charles Wyble
What does a network packet dump tell you? ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/

Re: [c-nsp] Free/low-cost traffic generator?

2009-03-26 Thread Charles Wyble
Conflicker is free and comes with unpatched windows systems. :) On a more serious note, what sort of traffic/apps are you testing? Voice? Web? Inca wrote: Does anyone know of a free (open source or otherwise) or low cost traffic generator that we can use to stress test multiple gigabit links

Re: [c-nsp] QoS on Tunnel Interfaces w/ DSL

2009-03-25 Thread Charles Wyble
DSL on both ends? Cisco on both ends? What gear/ios version? I'm curious to this as well. I have an 1841 ISR I'm using as my production home router, and want to deploy an IPSEC endpoint at another location, and optimize as much as possible. Jeff Cartier wrote: Greetings All, I was

Re: [c-nsp] Traffic analysis via Netflow/BGP export?

2009-03-23 Thread Charles Wyble
Mateusz Blaszczyk wrote: Jeff, I would like to have a tool that allows me to historically view traffic trends going to destination AS's so I can adjust some route-maps to better balance traffic egressing my network. Any suggestions would be appreciated. That one seems easy and

Re: [c-nsp] Changing SSH Port on IOS

2009-03-21 Thread Charles Wyble
Um. why don't you setup some ACL to limit access? It's generally ill advised to run dameons with shell access directly connected to the internet. :) I use OpenVPN for all my access, and only run SSH on the private interface. I realize this isn't always possible, but is a good solution.

Re: [c-nsp] Freeware management software

2009-03-21 Thread Charles Wyble
Yep Opsview is nice. Also check out http://www.ossec.net/ and http://www.ntop.org/news.html Roy wrote: Opsview??? http://www.opsview.org Arne Larsen / Region Nordjylland wrote: Hi Folks. Can someone give me a hint, I’m looking for freeware management software like NMIS. Software that can

Re: [c-nsp] centralized mac filtering

2009-03-18 Thread Charles Wyble
Hegedus Gabor wrote: Hegedus Gabor wrote: Hi all, Is any solution to filtering wifi mac addresses from one database, if i have more devices and one wireless domain with one ssid? thank you! br Gabor I think this would be something that RADIUS is good for. You need to look at your

Re: [c-nsp] Opinions of DDoS appliances, other techniques, most notably Cisco Guard

2009-03-15 Thread Charles Wyble
Searching for netflow ids ( http://www.google.com/search?q=netflow+idsie=utf-8oe=utf-8aq=trls=org.mozilla:en-US:officialclient=firefox-a) returns some very interesting results. ___ cisco-nsp mailing list cisco-nsp@puck.nether.net

Re: [c-nsp] Opinions of DDoS appliances, other techniques, most notably Cisco Guard

2009-03-15 Thread Charles Wyble
Roland Dobbins wrote: On Mar 15, 2009, at 11:54 PM, Drew Weaver wrote: Also, without a dedicated DDoS system deployed, what is the most reliable/fastest way to determine the destination(s) of the attacks (SNMP, NetFlow, etc)? With or without a dedicated DDoS mitigation system,

[c-nsp] Resetting an RSM password/config

2009-03-06 Thread Charles Wyble
All, I recently purchased some cisco gear for my lab. One of the things I am doing is configuring a Catalyst 5505 with a Route Switch Module (RSM). Any idea how to reset the config to factory defaults? I bought it second hand and need to clear the configs as I don't know the password. I