Literatur hint needed

2010-06-16 Thread Matthias Flittner
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi Folks, I'm searching an fundamental book about how to (inter)connect two networks. It should be about how to connect your business network in a secure and reliable way to the internet. The book should contain some theoretical basics and common

Re: Literatur hint needed

2010-06-16 Thread Jens Link
Matthias Flittner matthias.flitt...@de-cix.net writes: Hi Folks, I'm searching an fundamental book about how to (inter)connect two networks. It should be about how to connect your business network in a secure and reliable way to the internet. The book should contain some theoretical basics

Re: Literatur hint needed

2010-06-16 Thread Matthias Flittner
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hey Jens, thanks for your fast answer. The Illustrated Network: How TCP/IP Works in a Modern Network (ISBN-13: 978-0123745415) should cover this topic. Yes this book covers a lot but I need one which should help me to build an secure transfer point

Re: Literatur hint needed

2010-06-16 Thread Valdis . Kletnieks
On Wed, 16 Jun 2010 10:21:54 +0200, Matthias Flittner said: I'm searching an fundamental book about how to (inter)connect two networks. It should be about how to connect your business network in a secure and reliable way to the internet. The book should contain some theoretical basics and

(OT) recipe for Live streaming from NANOG49

2010-06-16 Thread Anton Kapela
On Jun 15, 2010, at 9:27 AM, T.J. Kniveton wrote: I'm using a 24 iMac in full screen so the resolution is pretty decent. But I hadn't thought about the side benefit of watching what people are doing on their laptops, good entertainment value I suppose. Glad it looks decent for folks out

PCAP Sanitization Tool

2010-06-16 Thread Bein, Matthew
Hello, Anyone know of a good tool for sanitizing PCAP files? I would like to keep as much of the payload as possible but remove src and dst ip information.

Re: PCAP Sanitization Tool

2010-06-16 Thread Michael Collins
FLAIM: flaim.ncsa.illinois.edu On Jun 16, 2010, at 12:58 PM, Bein, Matthew wrote: Hello, Anyone know of a good tool for sanitizing PCAP files? I would like to keep as much of the payload as possible but remove src and dst ip information. Mike Collins mcoll...@aleae.com

Re: (OT) recipe for Live streaming from NANOG49

2010-06-16 Thread Eric Brunner-Williams
Does anyone have the video bits from the Haitian panel? I'd like to run it within our loop at the ICANN meeting next week in Brussels. Tia! Eric

2010.06.16 NANOG49 day 3 notes

2010-06-16 Thread Matthew Petach
Alas, another great NANOG has come to an end; it went by so quickly this time. Notes from today, including the inimitable duo of Todd Underwood and Odd Tunderwood, are now up at http://kestrel3.netflight.com/2010.06.16-NANOG49-day3.txt As always, I'm sure I got a bunch of things wrong,

Future of WiMax

2010-06-16 Thread Seth Mattinen
A while back I remember reading a comment here that WiMax is not a future proof technology and that several manufacturers have dropped it or something to that effect. I think it was in the starting a WiMax ISP thread. This has stuck in my head, and I was curious if there was any truth to this.

Re: Future of WiMax

2010-06-16 Thread Gregory Hicks
Date: Wed, 16 Jun 2010 12:35:16 -0700 From: Seth Mattinen se...@rollernet.us WiMax sounds promising, but I certainly don't hear a lot about it other than Sprint/Clear. Is it just that everyone that's doing wireless is sticking with relatively inexpensive 802.11 a/b/g/n products, or is

Re: Future of WiMax

2010-06-16 Thread Rubens Kuhl
The future of WiMAX seems a lot less promising now that FD-LTE is the clear winner for wide-scale mobile deployment, and TD-LTE, 802.11n and proprietary technologies will compete for non-paired spectrum and/or niche markets. But one can build a network with WiMAX and make money out of it; global

Anybody from Shaw Cable

2010-06-16 Thread Antoine Reversat
We are having a strange routing issue. If anybody from Shaw cable could contact me offlist I'd be very thankfull.

RE: Future of WiMax

2010-06-16 Thread Murphy, Jay, DOH
Dude, LTE and WiMax a more siblings, than distinct rivalries. The technologies will grow together over time, versus, one taking the ascendancy, and the other, descent. WiMAX is here today, and long term evolution, well, let's see how the futures play out. ~Jay Murphy IP Network Specialist NM

Re: PCAP Sanitization Tool

2010-06-16 Thread kowsik
Log sanitation is a whole lot easier than packets. AFAIK, santizing pcaps is an intractable problem because of various kinds of encodings that exist within packets. Examples: - FTP IPv4 addresses are comma separated - DNS does label encoding of domain names (especially with pointers) - Forwarded

Re: Future of WiMax

2010-06-16 Thread Curtis Maurand
they've already claimed they'll probably switch to LTE. They said it was just a software change to do that. Of course the standard for actually placing a phone call on it (LTE) has yet to finalized. On 6/16/2010 3:40 PM, Gregory Hicks wrote: Date: Wed, 16 Jun 2010 12:35:16 -0700 From:

Sending ARP request to unicast MAC instead of broadcast MAC address?

2010-06-16 Thread Chris Woodfield
OK, this sounds Really Wacky (or, Really Hacky if you're into puns) but there's a reason for it, I swear... Will typical OSS UNIX kernels (Linux, BSD, MacOS X, etc) reply to a crafted ARP request that, instead of having FF:FF:FF:FF:FF:FF as its destination MAC address, is instead sent to the

Re: PCAP Sanitization Tool

2010-06-16 Thread Sebastian Castro
Bein, Matthew wrote: Hello, Anyone know of a good tool for sanitizing PCAP files? I would like to keep as much of the payload as possible but remove src and dst ip information. Would address anonymization work? Instead of removing src/dst ip, you can zero them. I've used CoralReef

Re: Sending ARP request to unicast MAC instead of broadcast MAC address?

2010-06-16 Thread James Hess
On Wed, Jun 16, 2010 at 5:57 PM, Chris Woodfield rek...@semihuman.com wrote: OK, this sounds Really Wacky (or, Really Hacky if you're into puns) but there's a reason for it, I swear... Will typical OSS UNIX kernels (Linux, BSD, MacOS X, etc) reply to a crafted ARP request that, instead of

Todd Underwood was a little late

2010-06-16 Thread Jon Lewis
I just took a closer look at something odd I'd noticed several days ago. One of our DNS servers was sending crazy amounts of ARP requests for IPs in the /24 its main IP is in. What I've found is we're getting hit with DNS requests that look like they're from typical internet traffic for

Re: PCAP Sanitization Tool

2010-06-16 Thread Steven Bellovin
On Jun 16, 2010, at 9:58 48AM, Bein, Matthew wrote: Hello, Anyone know of a good tool for sanitizing PCAP files? I would like to keep as much of the payload as possible but remove src and dst ip information. What's your threat model? In general, proper anonymization of packet

Re: PCAP Sanitization Tool

2010-06-16 Thread travis abrams
TCPReplay may be helpful to you. http://tcpreplay.synfin.net/ == Travis www.theipsguy.com == On Wed, Jun 16, 2010 at 12:58 PM, Bein, Matthew mb...@iso-ne.com wrote: Hello, Anyone know of a good tool for sanitizing PCAP files? I would like to keep

Re: Todd Underwood was a little late

2010-06-16 Thread Mark Andrews
In message pine.lnx.4.61.1006162044210.5...@soloth.lewis.org, Jon Lewis write s: I just took a closer look at something odd I'd noticed several days ago. One of our DNS servers was sending crazy amounts of ARP requests for IPs in the /24 its main IP is in. What I've found is we're getting

Re: Sending ARP request to unicast MAC instead of broadcast MAC address?

2010-06-16 Thread Ingo Flaschberger
Dear Chris, OK, this sounds Really Wacky (or, Really Hacky if you're into puns) but there's a reason for it, I swear... Will typical OSS UNIX kernels (Linux, BSD, MacOS X, etc) reply to a crafted ARP request that, instead of having FF:FF:FF:FF:FF:FF as its destination MAC address, is

Re: Todd Underwood was a little late

2010-06-16 Thread Nicholas Suan
We've been seeing the same thing since 2010-06-10: 22:13:19.687981 IP 72.236.167.197.41789 72.236.167.138.domain: 38783+ A? jkl.cnr.cn. (28) 22:13:19.773076 IP 72.236.167.124.33327 72.236.167.138.domain: 38783+ A? i10.aliimg.com. (32) 22:13:19.855750 IP 72.236.167.169.33381

Re: Todd Underwood was a little late

2010-06-16 Thread Jon Lewis
On Thu, 17 Jun 2010, Mark Andrews wrote: Why was this traffic hitting your DNS server in the first place? It should have been rejected by the ingress filters preventing spoofing of the local network. When I ran a smaller simpler network, I did have input filters on our transit providers

Re: Todd Underwood was a little late

2010-06-16 Thread Mark Andrews
In message pine.lnx.4.61.1006162237180.5...@soloth.lewis.org, Jon Lewis write s: On Thu, 17 Jun 2010, Mark Andrews wrote: Why was this traffic hitting your DNS server in the first place? It should have been rejected by the ingress filters preventing spoofing of the local network.

Re: Todd Underwood was a little late

2010-06-16 Thread Roy
On 6/16/2010 7:43 PM, Jon Lewis wrote: On Thu, 17 Jun 2010, Mark Andrews wrote: Why was this traffic hitting your DNS server in the first place? It should have been rejected by the ingress filters preventing spoofing of the local network. When I ran a smaller simpler network, I did have

Re: Todd Underwood was a little late

2010-06-16 Thread Garrett Skjelstad
RFC 2827 anyone? On Wed, Jun 16, 2010 at 9:38 PM, Roy r.engehau...@gmail.com wrote: On 6/16/2010 7:43 PM, Jon Lewis wrote: On Thu, 17 Jun 2010, Mark Andrews wrote: Why was this traffic hitting your DNS server in the first place? It should have been rejected by the ingress filters