- mice-discuss - lists.micemn.net

Re: Port Anonymity

by Hannigan, Martin

On Dec 10, 2013, at 10:49 PM, Jay Hanke <jayhanke(a)MANKATONETWORKS.NET<mailto:jayhanke@MANKATONETWORKS.NET>> wrote: > Right on with the agreement. It does say that we may ask for MRTG graph data related to ports statistics. It also says we expect confidentiality. Our port data is confidential. The MICE Board signed this agreement with us. If we take our port down to the wider audience like we have gracefully requested, we're happy to discuss what the objective is and how we may be helpful. I'll be honest, I doubt that the outcome is "sure, display our data to anyone with a login", but it is likely to be reasonable and inline with North American IXP norms. NETNOD is in Norway and Mice is in North America. NETNOD is also orders of magnitude larger than MICE. That's not the solution. > Can you narrow down the scope better? Keep in mind we have no formally defined admins, so if you say admin you'll need to lay that out as well. Sure. And thanks for the call this morning, I appreciated it. When we define admins they should be folks with enable on the gear who have it to fix problems. There should also be a basic expectation of privacy of that data. Admins emailing. me and saying "Hey! Where's your port upgrade!" is fine, but emailing the entire list with that is probably not ok. That should apply across the organization. This would be a fairly standard interpretation of how things are done at IXP's in North America and depending upon the final language I would be pleased to support. As far as my data being "public" I'm going to disagree with the board that any member with a login != public so I'm still asking that they remove my graph until we have a better solution. I'm a former MRTG user and maker of pages to monitor things with SNMP, I'm well aware of how to make this work and I'm happy to volunteer to help manage the cacti instance if it would be helpful. There are multiple good reasons for this approach. Unfortunately, the UG meeting conflicts with my Super Bowl vacation or I would come to do a presentation for you on this. Perhaps next one. I hope this helps to clarify and move us along. And as soon as we get this resolved I'll start working to add my second 10G. :-) Best, -M< ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Anthony Anderberg

Anytime today (11th) or Friday (13th) are fine for me if anyone wanted to have a call. I'd agree that Dave did a good job of summarizing the issues and Richard's responses are a reasonable evolution in our shared MICE journey. I'd thought about a combination of ASN/member specific passwords and leaving the graphs open to members but I'm not sure that would meet Martin's needs, especially in the nirvana of the future when his competition might also be MICE members. Obviously under a "hidden graph" scenario members couldn't troubleshoot traffic bottlenecks across MICE themselves and people would need to continue to have reasonable expectations about volunteer administrator's abilities to respond. Part of the support for the current policy came from member's experiences of being frustrated by their provider's opaqueness in situations like the last iOS upgrade, but I think everyone understands that some of Akamai's needs are a little different. One loose end: Doug - can you remove that posting (or perhaps just the graph image) from the mailing list archive? The "anonymous port" idea isn't a bad one either, but it doesn't seem as clean to me in terms of maintenance simplicity and perhaps in terms of anonymity given the current port count and comparative traffic volumes. Having said that I'll certainly work to implement whatever the group's new direction is, appreciate everyone's thoughts and support. Cheers, anthony Anthony Anderberg Sr. Systems Analyst [NUtel_email_logo_1] 320-234-5239 anthonyanderberg(a)nu-telecom.net<mailto:anthonyanderberg@nu-telecom.net> www.nutelecom.net From: MICE Discuss [mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET] On Behalf Of Shaun Carlson Sent: Wednesday, December 11, 2013 6:13 AM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Port Anonymity Should we set up a call for later today? s On Tuesday, December 10, 2013, Hannigan, Martin wrote: Jay, Theres a lot of conflicting stuff here. Think I liked most of Richards responses to David. Let's talk live and see if we can sort this out. Work? Best, Marty On Dec 10, 2013, at 22:49, "Jay Hanke" <jayhanke(a)MANKATONETWORKS.NET<javascript:_e(%7b%7d,%20'cvml',%20'jayhanke(a)MANKATONETWORKS.NET');>> wrote: > Right on with the agreement. It does say that we may ask for MRTG graph data related to ports statistics. It also says we expect confidentiality. Our port data is confidential. The MICE Board signed this agreement with us. If we take our port down to the wider audience like we have gracefully requested, we're happy to discuss what the objective is and how we may be helpful. I'll be honest, I doubt that the outcome is "sure, display our data to anyone with a login", but it is likely to be reasonable and inline with North American IXP norms. NETNOD is in Norway and Mice is in North America. NETNOD is also orders of magnitude larger than MICE. That's not the solution. > Can you narrow down the scope better? Keep in mind we have no formally defined admins, so if you say admin you'll need to lay that out as well. Jay ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 -- Shaun Carlson Network Engineering Manager | Arvig ph: (218) 346-8673 | em: shaun.carlson(a)arvig.com<mailto:shaun.carlson@arvig.com> ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Shaun Carlson

Should we set up a call for later today? s On Tuesday, December 10, 2013, Hannigan, Martin wrote: > Jay, > > Theres a lot of conflicting stuff here. Think I liked most of Richards > responses to David. > > Let's talk live and see if we can sort this out. Work? > > Best, > > Marty > > > On Dec 10, 2013, at 22:49, "Jay Hanke" <jayhanke(a)MANKATONETWORKS.NET<javascript:_e({}, 'cvml', 'jayhanke(a)MANKATONETWORKS.NET');>> > wrote: > > > Right on with the agreement. It does say that we may ask for MRTG graph > data related to ports statistics. It also says we expect confidentiality. > Our port data is confidential. The MICE Board signed this agreement with > us. If we take our port down to the wider audience like we have gracefully > requested, we're happy to discuss what the objective is and how we may be > helpful. I'll be honest, I doubt that the outcome is "sure, display our > data to anyone with a login", but it is likely to be reasonable and inline > with North American IXP norms. NETNOD is in Norway and Mice is in North > America. NETNOD is also orders of magnitude larger than MICE. That's not > the solution. > > > > Can you narrow down the scope better? Keep in mind we have no formally > defined admins, so if you say admin you'll need to lay that out as well. > > Jay > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > > ------------------------------ > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > -- *Shaun Carlson*Network Engineering Manager | Arvig ph: (218) 346-8673 | em: shaun.carlson(a)arvig.com ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Hannigan, Martin

Jay, Theres a lot of conflicting stuff here. Think I liked most of Richards responses to David. Let's talk live and see if we can sort this out. Work? Best, Marty On Dec 10, 2013, at 22:49, "Jay Hanke" <jayhanke(a)MANKATONETWORKS.NET<mailto:jayhanke@MANKATONETWORKS.NET>> wrote: > Right on with the agreement. It does say that we may ask for MRTG graph data related to ports statistics. It also says we expect confidentiality. Our port data is confidential. The MICE Board signed this agreement with us. If we take our port down to the wider audience like we have gracefully requested, we're happy to discuss what the objective is and how we may be helpful. I'll be honest, I doubt that the outcome is "sure, display our data to anyone with a login", but it is likely to be reasonable and inline with North American IXP norms. NETNOD is in Norway and Mice is in North America. NETNOD is also orders of magnitude larger than MICE. That's not the solution. > Can you narrow down the scope better? Keep in mind we have no formally defined admins, so if you say admin you'll need to lay that out as well. Jay ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Hannigan, Martin

First, let's get back into compliance and we can work together. Best, Marty On Dec 10, 2013, at 22:49, "Jay Hanke" <jayhanke(a)MANKATONETWORKS.NET<mailto:jayhanke@MANKATONETWORKS.NET>> wrote: > Right on with the agreement. It does say that we may ask for MRTG graph data related to ports statistics. It also says we expect confidentiality. Our port data is confidential. The MICE Board signed this agreement with us. If we take our port down to the wider audience like we have gracefully requested, we're happy to discuss what the objective is and how we may be helpful. I'll be honest, I doubt that the outcome is "sure, display our data to anyone with a login", but it is likely to be reasonable and inline with North American IXP norms. NETNOD is in Norway and Mice is in North America. NETNOD is also orders of magnitude larger than MICE. That's not the solution. > Can you narrow down the scope better? Keep in mind we have no formally defined admins, so if you say admin you'll need to lay that out as well. Jay ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Jay Hanke

> Right on with the agreement. It does say that we may ask for MRTG graph data related to ports statistics. It also says we expect confidentiality. Our port data is confidential. The MICE Board signed this agreement with us. If we take our port down to the wider audience like we have gracefully requested, we're happy to discuss what the objective is and how we may be helpful. I'll be honest, I doubt that the outcome is "sure, display our data to anyone with a login", but it is likely to be reasonable and inline with North American IXP norms. NETNOD is in Norway and Mice is in North America. NETNOD is also orders of magnitude larger than MICE. That's not the solution. > Can you narrow down the scope better? Keep in mind we have no formally defined admins, so if you say admin you'll need to lay that out as well. Jay ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Graphs, Stats and List Archive (was: Re: Is Today The Test)

by Richard Laager

Here are my answers to the questions David posed: On Thu, 2013-12-05 at 20:27 -0600, David Farmer wrote: > 1. Should the list archive be public? Yes. > 3. What graphs and statistics should be collected? The traffic graphs, plus I think error graphs should be added. > 4. Who should have access to what graphs and statistics? Whoever is delegated by the Board to administer Cacti has full access to Cacti. Whoever is delegated by the Board to administer the switches has read access to all graphs. Graphs are public, unless that network has asked to opt-out. If a network has opted-out, the graph is hidden from the public ("guest") user account. The aggregate graph (the one from the home page) is public, but should not separate traffic by colors or otherwise. That graph shall not show a "Current" or "Last" value. No other aggregates shall be public without further discussion. (A graph of a port facing a remote switch is not an "aggregate" graph for this purpose; it's a "network" graph.) > 5. What is the proper security for the graphs and statistics? Reasonable passwords for the non-public Cacti accounts. A randomly-generated password for SNMP between Cacti and the switches, ideally changed whenever someone is removed from the switch or Cacti delegations. -- Richard ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Hannigan, Martin

On Dec 10, 2013, at 10:06 PM, Jay Hanke <jayhanke(a)MANKATONETWORKS.NET<mailto:jayhanke@MANKATONETWORKS.NET>> wrote: On Dec 10, 2013 8:34 PM, "Hannigan, Martin" <marty(a)akamai.com<mailto:marty@akamai.com>> wrote: > > On Dec 10, 2013, at 9:25 PM, Richard Laager <rlaager(a)WIKTEL.COM<mailto:rlaager@WIKTEL.COM>> wrote: > > > On Tue, 2013-12-10 at 21:21 -0500, Reid Fishler wrote: > >> Please take a look at http://www.netnod.se/ix/statistics, to see how > >> they do it. This is what we are planning to model off of. > > > > They are graphing the anonymous ports. So MICE would have exactly the > > problems I noted. So this doesn't solve anything. > > > > I agree, it would be sort of a joke actually as it would be completely obvious when we went down and back up. > > This will also prevent other large sources of traffic from joining the exchange. We're happy to work to see if we can help with whatever the objective is and to come up with a solution if its possible, but we would like our ports opted out ASAP. MICE is required by contract to provide mrtg graphing to Akamai. MICE is also managed by the members of the exchange. If the managers of the ix can't access the graphs we can't provide them if requested. Marty, could you be specific in your request and make a suggestion? Jay, Right on with the agreement. It does say that we may ask for MRTG graph data related to ports statistics. It also says we expect confidentiality. Our port data is confidential. The MICE Board signed this agreement with us. If we take our port down to the wider audience like we have gracefully requested, we're happy to discuss what the objective is and how we may be helpful. I'll be honest, I doubt that the outcome is "sure, display our data to anyone with a login", but it is likely to be reasonable and inline with North American IXP norms. NETNOD is in Norway and Mice is in North America. NETNOD is also orders of magnitude larger than MICE. That's not the solution. Best, -M< ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Jay Hanke

On Dec 10, 2013 8:34 PM, "Hannigan, Martin" <marty(a)akamai.com> wrote: > > On Dec 10, 2013, at 9:25 PM, Richard Laager <rlaager(a)WIKTEL.COM> wrote: > > > On Tue, 2013-12-10 at 21:21 -0500, Reid Fishler wrote: > >> Please take a look at http://www.netnod.se/ix/statistics, to see how > >> they do it. This is what we are planning to model off of. > > > > They are graphing the anonymous ports. So MICE would have exactly the > > problems I noted. So this doesn't solve anything. > > > > I agree, it would be sort of a joke actually as it would be completely obvious when we went down and back up. > > This will also prevent other large sources of traffic from joining the exchange. We're happy to work to see if we can help with whatever the objective is and to come up with a solution if its possible, but we would like our ports opted out ASAP. MICE is required by contract to provide mrtg graphing to Akamai. MICE is also managed by the members of the exchange. If the managers of the ix can't access the graphs we can't provide them if requested. Marty, could you be specific in your request and make a suggestion? Jay ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Hannigan, Martin

On Dec 10, 2013, at 9:25 PM, Richard Laager <rlaager(a)WIKTEL.COM> wrote: > On Tue, 2013-12-10 at 21:21 -0500, Reid Fishler wrote: >> Please take a look at http://www.netnod.se/ix/statistics, to see how >> they do it. This is what we are planning to model off of. > > They are graphing the anonymous ports. So MICE would have exactly the > problems I noted. So this doesn't solve anything. I agree, it would be sort of a joke actually as it would be completely obvious when we went down and back up. This will also prevent other large sources of traffic from joining the exchange. We're happy to work to see if we can help with whatever the objective is and to come up with a solution if its possible, but we would like our ports opted out ASAP. Best, -M< ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013