Re: using sniffer on high-bandwidth pipes

2004-12-07 Thread Alexei Roudnev
We are using FreeBSD 4.x on 1Gbit Ethernet (for snifferring). Never had a problems (but I should not garantee 100% snifferring on 400,000pps). In reality, correct, pps is important, bandwidth is not important. If traffic is VoIP, it's a problem; if it is 90% WEB, it's an easy task. -

RE: Unflattering comments about ISPs and DDOS

2004-12-07 Thread Michael . Dillon
Even at an uber high charge (800/866 toll) of say $4.00 per call, they could still implement the changes save tons of money, and tons of aspirin when their headaches go away. Maybe someone here can draft up a $10,000,000.00 pitch it to them become an instant millionaire and save Comcast

Remote sites, aggregates and more-specific routes

2004-12-07 Thread Sam Stickland
Hi, We currently announce our entire range as the largest possible aggregates. We are about to add the first site that's a sizable distance away. The link to the remote site is relatively expensive, so we don't want to have to backhaul traffic between the sites if we can help it. We seem to

Trojaned versions of Makelovenotspam doing the rounds ...

2004-12-07 Thread Suresh Ramasubramanian
What a surprise (or not!) http://www.theregister.co.uk/2004/12/07/fake_lycos_screensaver_trojan/ Virus writers have begun distributing their wares in emails that pose as Lycos's abandoned Make love not spam screensaver. The fake screensaver emails contain an attachment with a RAR SFX

Intelligent Automation of network tasks

2004-12-07 Thread Ejay Hire
In my opinion, every network with more than a dozen or so routers needs an automated method to distribute massive configuration changes. There is a lot of fear that something will break during updates, but with some intelligence, that risk can be minimized. Related to this, here is how I

Re: Intelligent Automation of network tasks

2004-12-07 Thread Jared Mauch
On Tue, Dec 07, 2004 at 12:39:25PM -0600, Ejay Hire wrote: In my opinion, every network with more than a dozen or so routers needs an automated method to distribute massive configuration changes. There is a lot of fear that something will break during updates, but with some intelligence,

RE: Intelligent Automation of network tasks

2004-12-07 Thread Hannigan, Martin
Call me sentimental, but I was using/making my previous staff use rtrmon in the absence of big OSS systems. I believe it's still up at ISC somewhere. I can't remember if it has a glob all function. I do remember it would probably be easy enough to integrate. -- Martin Hannigan

Re: Intelligent Automation of network tasks

2004-12-07 Thread Alexei Roudnev
On Cisco it is (generation of config update) veryu complicated (in general case) task. But we always automated every day config changes (acccess lists, as path lists, route maps, interfaces except some special cases, and so on). perl + 'expect+ 'conf net' was key elements. - Original

Enterprise syslog management and alert generation.

2004-12-07 Thread Bill Nash
Some people call this 'Netcool' or products of a similiar stripe. I'm ramping up a project to rebuild some previous work done on this front with an open source distribution in mind (those of you on the syslog-ng list have seen mention of it), so I'm fishing for requirements I may not have

Re: Enterprise syslog management and alert generation.

2004-12-07 Thread Alexei Roudnev
In such products, only 20% value is in engine; 80% are in rules, because I can not wrire rules myself - I have not event until it happen, and I can not filetr out noice until it happen. We use a few syslog analyzers (using syslog-ng as a transport), some with simple logcheck, other with database

Re: Enterprise syslog management and alert generation.

2004-12-07 Thread Bill Nash
On Tue, 7 Dec 2004, Alexei Roudnev wrote: In such products, only 20% value is in engine; 80% are in rules, because I can not wrire rules myself - I have not event until it happen, and I can not filetr out noice until it happen. We use a few syslog analyzers (using syslog-ng as a transport), some

RE: Enterprise syslog management and alert generation.

2004-12-07 Thread Paul Jasa
This is a topic near and dear to my heart. I've been using SEC for a while now, been very happy with it. If you like Perl and its regular expressions, SEC will do the trick. It has a very complex log correlation capabilities, and multiple action methods, strongly recommend it especially