December 2013 - mice-discuss - lists.micemn.net

Re: Port Anonymity

by Hannigan, Martin

Jay, Theres a lot of conflicting stuff here. Think I liked most of Richards responses to David. Let's talk live and see if we can sort this out. Work? Best, Marty On Dec 10, 2013, at 22:49, "Jay Hanke" <jayhanke(a)MANKATONETWORKS.NET<mailto:jayhanke@MANKATONETWORKS.NET>> wrote: > Right on with the agreement. It does say that we may ask for MRTG graph data related to ports statistics. It also says we expect confidentiality. Our port data is confidential. The MICE Board signed this agreement with us. If we take our port down to the wider audience like we have gracefully requested, we're happy to discuss what the objective is and how we may be helpful. I'll be honest, I doubt that the outcome is "sure, display our data to anyone with a login", but it is likely to be reasonable and inline with North American IXP norms. NETNOD is in Norway and Mice is in North America. NETNOD is also orders of magnitude larger than MICE. That's not the solution. > Can you narrow down the scope better? Keep in mind we have no formally defined admins, so if you say admin you'll need to lay that out as well. Jay ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Hannigan, Martin

First, let's get back into compliance and we can work together. Best, Marty On Dec 10, 2013, at 22:49, "Jay Hanke" <jayhanke(a)MANKATONETWORKS.NET<mailto:jayhanke@MANKATONETWORKS.NET>> wrote: > Right on with the agreement. It does say that we may ask for MRTG graph data related to ports statistics. It also says we expect confidentiality. Our port data is confidential. The MICE Board signed this agreement with us. If we take our port down to the wider audience like we have gracefully requested, we're happy to discuss what the objective is and how we may be helpful. I'll be honest, I doubt that the outcome is "sure, display our data to anyone with a login", but it is likely to be reasonable and inline with North American IXP norms. NETNOD is in Norway and Mice is in North America. NETNOD is also orders of magnitude larger than MICE. That's not the solution. > Can you narrow down the scope better? Keep in mind we have no formally defined admins, so if you say admin you'll need to lay that out as well. Jay ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Jay Hanke

> Right on with the agreement. It does say that we may ask for MRTG graph data related to ports statistics. It also says we expect confidentiality. Our port data is confidential. The MICE Board signed this agreement with us. If we take our port down to the wider audience like we have gracefully requested, we're happy to discuss what the objective is and how we may be helpful. I'll be honest, I doubt that the outcome is "sure, display our data to anyone with a login", but it is likely to be reasonable and inline with North American IXP norms. NETNOD is in Norway and Mice is in North America. NETNOD is also orders of magnitude larger than MICE. That's not the solution. > Can you narrow down the scope better? Keep in mind we have no formally defined admins, so if you say admin you'll need to lay that out as well. Jay ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Graphs, Stats and List Archive (was: Re: Is Today The Test)

by Richard Laager

Here are my answers to the questions David posed: On Thu, 2013-12-05 at 20:27 -0600, David Farmer wrote: > 1. Should the list archive be public? Yes. > 3. What graphs and statistics should be collected? The traffic graphs, plus I think error graphs should be added. > 4. Who should have access to what graphs and statistics? Whoever is delegated by the Board to administer Cacti has full access to Cacti. Whoever is delegated by the Board to administer the switches has read access to all graphs. Graphs are public, unless that network has asked to opt-out. If a network has opted-out, the graph is hidden from the public ("guest") user account. The aggregate graph (the one from the home page) is public, but should not separate traffic by colors or otherwise. That graph shall not show a "Current" or "Last" value. No other aggregates shall be public without further discussion. (A graph of a port facing a remote switch is not an "aggregate" graph for this purpose; it's a "network" graph.) > 5. What is the proper security for the graphs and statistics? Reasonable passwords for the non-public Cacti accounts. A randomly-generated password for SNMP between Cacti and the switches, ideally changed whenever someone is removed from the switch or Cacti delegations. -- Richard ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Hannigan, Martin

On Dec 10, 2013, at 10:06 PM, Jay Hanke <jayhanke(a)MANKATONETWORKS.NET<mailto:jayhanke@MANKATONETWORKS.NET>> wrote: On Dec 10, 2013 8:34 PM, "Hannigan, Martin" <marty(a)akamai.com<mailto:marty@akamai.com>> wrote: > > On Dec 10, 2013, at 9:25 PM, Richard Laager <rlaager(a)WIKTEL.COM<mailto:rlaager@WIKTEL.COM>> wrote: > > > On Tue, 2013-12-10 at 21:21 -0500, Reid Fishler wrote: > >> Please take a look at http://www.netnod.se/ix/statistics, to see how > >> they do it. This is what we are planning to model off of. > > > > They are graphing the anonymous ports. So MICE would have exactly the > > problems I noted. So this doesn't solve anything. > > > > I agree, it would be sort of a joke actually as it would be completely obvious when we went down and back up. > > This will also prevent other large sources of traffic from joining the exchange. We're happy to work to see if we can help with whatever the objective is and to come up with a solution if its possible, but we would like our ports opted out ASAP. MICE is required by contract to provide mrtg graphing to Akamai. MICE is also managed by the members of the exchange. If the managers of the ix can't access the graphs we can't provide them if requested. Marty, could you be specific in your request and make a suggestion? Jay, Right on with the agreement. It does say that we may ask for MRTG graph data related to ports statistics. It also says we expect confidentiality. Our port data is confidential. The MICE Board signed this agreement with us. If we take our port down to the wider audience like we have gracefully requested, we're happy to discuss what the objective is and how we may be helpful. I'll be honest, I doubt that the outcome is "sure, display our data to anyone with a login", but it is likely to be reasonable and inline with North American IXP norms. NETNOD is in Norway and Mice is in North America. NETNOD is also orders of magnitude larger than MICE. That's not the solution. Best, -M< ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Jay Hanke

On Dec 10, 2013 8:34 PM, "Hannigan, Martin" <marty(a)akamai.com> wrote: > > On Dec 10, 2013, at 9:25 PM, Richard Laager <rlaager(a)WIKTEL.COM> wrote: > > > On Tue, 2013-12-10 at 21:21 -0500, Reid Fishler wrote: > >> Please take a look at http://www.netnod.se/ix/statistics, to see how > >> they do it. This is what we are planning to model off of. > > > > They are graphing the anonymous ports. So MICE would have exactly the > > problems I noted. So this doesn't solve anything. > > > > I agree, it would be sort of a joke actually as it would be completely obvious when we went down and back up. > > This will also prevent other large sources of traffic from joining the exchange. We're happy to work to see if we can help with whatever the objective is and to come up with a solution if its possible, but we would like our ports opted out ASAP. MICE is required by contract to provide mrtg graphing to Akamai. MICE is also managed by the members of the exchange. If the managers of the ix can't access the graphs we can't provide them if requested. Marty, could you be specific in your request and make a suggestion? Jay ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Hannigan, Martin

On Dec 10, 2013, at 9:25 PM, Richard Laager <rlaager(a)WIKTEL.COM> wrote: > On Tue, 2013-12-10 at 21:21 -0500, Reid Fishler wrote: >> Please take a look at http://www.netnod.se/ix/statistics, to see how >> they do it. This is what we are planning to model off of. > > They are graphing the anonymous ports. So MICE would have exactly the > problems I noted. So this doesn't solve anything. I agree, it would be sort of a joke actually as it would be completely obvious when we went down and back up. This will also prevent other large sources of traffic from joining the exchange. We're happy to work to see if we can help with whatever the objective is and to come up with a solution if its possible, but we would like our ports opted out ASAP. Best, -M< ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Richard Laager

On Tue, 2013-12-10 at 21:21 -0500, Reid Fishler wrote: > Please take a look at http://www.netnod.se/ix/statistics, to see how > they do it. This is what we are planning to model off of. They are graphing the anonymous ports. So MICE would have exactly the problems I noted. So this doesn't solve anything. -- Richard ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Reid Fishler

Please take a look at http://www.netnod.se/ix/statistics, to see how they do it. This is what we are planning to model off of. Reid On Tue, Dec 10, 2013 at 9:16 PM, Richard Laager <rlaager(a)wiktel.com> wrote: > On Tue, 2013-12-10 at 21:05 -0500, Reid Fishler wrote: > > > Because the ports are currently labeled, we will allow allow members, > > upon request, to move to another port at the time that they remove the > > identity from their port. > > You're saying that Akamai can move to another port and we won't put a > name on that port's graph? Wouldn't it be really obvious that the > unlabeled graph that's just started sending/receiving traffic is the one > network (Akamai) that just disappeared from the set of labeled graphs? > > Plus, until there's another network that opts out, it's still obvious > which port is Akamai. And if that network isn't of a similar size, even > then it still be obvious. > > I don't see any reason to move (or unlabel) anything. If you want to > grant these requests, just stop showing Akamai's port's graph to the > guest user in Cacti and remove it from the weathermap. > > Access to the Cacti admin interface should be along the same lines as > access to manage the actual MICE switches: it's privileged and comes > with discretion requirements. Not every member has access to the > switches' management interface(s) nor Cacti admin today. I have neither, > for example. > > -- > Richard > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > -- Reid Fishler Director Hurricane Electric +1-510-580-4178 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Richard Laager

On Tue, 2013-12-10 at 21:05 -0500, Reid Fishler wrote: > Because the ports are currently labeled, we will allow allow members, > upon request, to move to another port at the time that they remove the > identity from their port. You're saying that Akamai can move to another port and we won't put a name on that port's graph? Wouldn't it be really obvious that the unlabeled graph that's just started sending/receiving traffic is the one network (Akamai) that just disappeared from the set of labeled graphs? Plus, until there's another network that opts out, it's still obvious which port is Akamai. And if that network isn't of a similar size, even then it still be obvious. I don't see any reason to move (or unlabel) anything. If you want to grant these requests, just stop showing Akamai's port's graph to the guest user in Cacti and remove it from the weathermap. Access to the Cacti admin interface should be along the same lines as access to manage the actual MICE switches: it's privileged and comes with discretion requirements. Not every member has access to the switches' management interface(s) nor Cacti admin today. I have neither, for example. -- Richard ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013