- mice-discuss - lists.micemn.net

Re: Graphs, Stats and List Archive (was: Re: Is Today The Test)

by Richard Laager

Here are my answers to the questions David posed: On Thu, 2013-12-05 at 20:27 -0600, David Farmer wrote: > 1. Should the list archive be public? Yes. > 3. What graphs and statistics should be collected? The traffic graphs, plus I think error graphs should be added. > 4. Who should have access to what graphs and statistics? Whoever is delegated by the Board to administer Cacti has full access to Cacti. Whoever is delegated by the Board to administer the switches has read access to all graphs. Graphs are public, unless that network has asked to opt-out. If a network has opted-out, the graph is hidden from the public ("guest") user account. The aggregate graph (the one from the home page) is public, but should not separate traffic by colors or otherwise. That graph shall not show a "Current" or "Last" value. No other aggregates shall be public without further discussion. (A graph of a port facing a remote switch is not an "aggregate" graph for this purpose; it's a "network" graph.) > 5. What is the proper security for the graphs and statistics? Reasonable passwords for the non-public Cacti accounts. A randomly-generated password for SNMP between Cacti and the switches, ideally changed whenever someone is removed from the switch or Cacti delegations. -- Richard ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Hannigan, Martin

On Dec 10, 2013, at 10:06 PM, Jay Hanke <jayhanke(a)MANKATONETWORKS.NET<mailto:jayhanke@MANKATONETWORKS.NET>> wrote: On Dec 10, 2013 8:34 PM, "Hannigan, Martin" <marty(a)akamai.com<mailto:marty@akamai.com>> wrote: > > On Dec 10, 2013, at 9:25 PM, Richard Laager <rlaager(a)WIKTEL.COM<mailto:rlaager@WIKTEL.COM>> wrote: > > > On Tue, 2013-12-10 at 21:21 -0500, Reid Fishler wrote: > >> Please take a look at http://www.netnod.se/ix/statistics, to see how > >> they do it. This is what we are planning to model off of. > > > > They are graphing the anonymous ports. So MICE would have exactly the > > problems I noted. So this doesn't solve anything. > > > > I agree, it would be sort of a joke actually as it would be completely obvious when we went down and back up. > > This will also prevent other large sources of traffic from joining the exchange. We're happy to work to see if we can help with whatever the objective is and to come up with a solution if its possible, but we would like our ports opted out ASAP. MICE is required by contract to provide mrtg graphing to Akamai. MICE is also managed by the members of the exchange. If the managers of the ix can't access the graphs we can't provide them if requested. Marty, could you be specific in your request and make a suggestion? Jay, Right on with the agreement. It does say that we may ask for MRTG graph data related to ports statistics. It also says we expect confidentiality. Our port data is confidential. The MICE Board signed this agreement with us. If we take our port down to the wider audience like we have gracefully requested, we're happy to discuss what the objective is and how we may be helpful. I'll be honest, I doubt that the outcome is "sure, display our data to anyone with a login", but it is likely to be reasonable and inline with North American IXP norms. NETNOD is in Norway and Mice is in North America. NETNOD is also orders of magnitude larger than MICE. That's not the solution. Best, -M< ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Jay Hanke

On Dec 10, 2013 8:34 PM, "Hannigan, Martin" <marty(a)akamai.com> wrote: > > On Dec 10, 2013, at 9:25 PM, Richard Laager <rlaager(a)WIKTEL.COM> wrote: > > > On Tue, 2013-12-10 at 21:21 -0500, Reid Fishler wrote: > >> Please take a look at http://www.netnod.se/ix/statistics, to see how > >> they do it. This is what we are planning to model off of. > > > > They are graphing the anonymous ports. So MICE would have exactly the > > problems I noted. So this doesn't solve anything. > > > > I agree, it would be sort of a joke actually as it would be completely obvious when we went down and back up. > > This will also prevent other large sources of traffic from joining the exchange. We're happy to work to see if we can help with whatever the objective is and to come up with a solution if its possible, but we would like our ports opted out ASAP. MICE is required by contract to provide mrtg graphing to Akamai. MICE is also managed by the members of the exchange. If the managers of the ix can't access the graphs we can't provide them if requested. Marty, could you be specific in your request and make a suggestion? Jay ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Hannigan, Martin

On Dec 10, 2013, at 9:25 PM, Richard Laager <rlaager(a)WIKTEL.COM> wrote: > On Tue, 2013-12-10 at 21:21 -0500, Reid Fishler wrote: >> Please take a look at http://www.netnod.se/ix/statistics, to see how >> they do it. This is what we are planning to model off of. > > They are graphing the anonymous ports. So MICE would have exactly the > problems I noted. So this doesn't solve anything. I agree, it would be sort of a joke actually as it would be completely obvious when we went down and back up. This will also prevent other large sources of traffic from joining the exchange. We're happy to work to see if we can help with whatever the objective is and to come up with a solution if its possible, but we would like our ports opted out ASAP. Best, -M< ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Richard Laager

On Tue, 2013-12-10 at 21:21 -0500, Reid Fishler wrote: > Please take a look at http://www.netnod.se/ix/statistics, to see how > they do it. This is what we are planning to model off of. They are graphing the anonymous ports. So MICE would have exactly the problems I noted. So this doesn't solve anything. -- Richard ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Reid Fishler

Please take a look at http://www.netnod.se/ix/statistics, to see how they do it. This is what we are planning to model off of. Reid On Tue, Dec 10, 2013 at 9:16 PM, Richard Laager <rlaager(a)wiktel.com> wrote: > On Tue, 2013-12-10 at 21:05 -0500, Reid Fishler wrote: > > > Because the ports are currently labeled, we will allow allow members, > > upon request, to move to another port at the time that they remove the > > identity from their port. > > You're saying that Akamai can move to another port and we won't put a > name on that port's graph? Wouldn't it be really obvious that the > unlabeled graph that's just started sending/receiving traffic is the one > network (Akamai) that just disappeared from the set of labeled graphs? > > Plus, until there's another network that opts out, it's still obvious > which port is Akamai. And if that network isn't of a similar size, even > then it still be obvious. > > I don't see any reason to move (or unlabel) anything. If you want to > grant these requests, just stop showing Akamai's port's graph to the > guest user in Cacti and remove it from the weathermap. > > Access to the Cacti admin interface should be along the same lines as > access to manage the actual MICE switches: it's privileged and comes > with discretion requirements. Not every member has access to the > switches' management interface(s) nor Cacti admin today. I have neither, > for example. > > -- > Richard > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > -- Reid Fishler Director Hurricane Electric +1-510-580-4178 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Re: Port Anonymity

by Richard Laager

On Tue, 2013-12-10 at 21:05 -0500, Reid Fishler wrote: > Because the ports are currently labeled, we will allow allow members, > upon request, to move to another port at the time that they remove the > identity from their port. You're saying that Akamai can move to another port and we won't put a name on that port's graph? Wouldn't it be really obvious that the unlabeled graph that's just started sending/receiving traffic is the one network (Akamai) that just disappeared from the set of labeled graphs? Plus, until there's another network that opts out, it's still obvious which port is Akamai. And if that network isn't of a similar size, even then it still be obvious. I don't see any reason to move (or unlabel) anything. If you want to grant these requests, just stop showing Akamai's port's graph to the guest user in Cacti and remove it from the weathermap. Access to the Cacti admin interface should be along the same lines as access to manage the actual MICE switches: it's privileged and comes with discretion requirements. Not every member has access to the switches' management interface(s) nor Cacti admin today. I have neither, for example. -- Richard ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Port Anonymity

by Reid Fishler

Hello MICE Persons- The SC has discussed recent requests for protection of port statistics, and we have decided to adapt the method that Netnod in Sweden tackles this issue. At any time, any IX member may choose to make their port anonymous in the graphs and logs. Because the ports are currently labeled, we will allow allow members, upon request, to move to another port at the time that they remove the identity from their port. This will allow any network that does not wish its statistics to be public to be satisfied, while allowing the members to see have access to statistics, in this, a cooperative exchange without dedicated staff. Any members who wish to have their port anonymized, please contact me and I will make sure that it is done. Also, a reminder: port statistics of other members are NOT for sharing outside of your own company without permission from the other involved networks. If anyone has any questions, please feel free to post. Reid -- Reid Fishler Director Hurricane Electric +1-510-580-4178 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 11, 2013

Q1 2014 MICE UG Meeting

by Shaun Carlson

Good Afternoon All! MICE UG 10 has been scheduled, as follows: Date: Thursday, January 30th Time: 4:00 pm (1600 Hours) Location: 511 Building Please send your agenda items when you have a chance! Thanks! s *Shaun Carlson*Network Engineering Manager | Arvig ph: (218) 346-8673 | em: shaun.carlson(a)arvig.com ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 10, 2013

Re: Graphs, Stats and List Archive (was: Re: Is Today The Test)

by Reid Fishler

Martin- I will have a call with you to discuss this. Lets take it offline. Reid On Tue, Dec 10, 2013 at 9:18 AM, Hannigan, Martin <marty(a)akamai.com> wrote: > Board, > > I haven't heard anything back on this. Can someone let me know where we > intend to go with this? > > Best, > > -M< > > > > On Dec 6, 2013, at 1:15 AM, "Hannigan, Martin" <marty(a)akamai.com> wrote: > > > > > David, > > > > In no discussion was there a statement about this. > > > > We would simply ask to opt out. > > > > Best, > > > > Marty > > > > > > > >> On Dec 5, 2013, at 19:28, "David Farmer" <farmer(a)UMN.EDU> wrote: > >> > >>> On 12/5/13, 18:47 , Hannigan, Martin wrote: > >>> > >>> On Dec 5, 2013, at 12:52 PM, Anthony Anderberg > >>> <anthonyanderberg(a)NU-TELECOM.NET > >>> <mailto:anthonyanderberg@NU-TELECOM.NET>> wrote: > >>> > >>>> Just so we're all clear: > >>>> The public graph is the aggregate graph that gets exported and linked > >>>> from our home page. It's a stacked graph where everyone's piece is > >>>> the same green color, partially for simplicity but mostly to obscure > >>>> the details. > >>>> The graph Frank posted is a similar stacked graph, but I've broken the > >>>> traffic out a little (also its ingress vs egress as a way of checking > >>>> accuracy.) This graph and the more detailed weathermap are password > >>>> protected, although admittedly the password is not particularly > robust. > >>>> As Steve mentioned over the course of a couple UG meetings we'd > >>>> decided that members should be able to see the exchange's traffic > >>>> patterns, as they say sunlight can cure a great many things. > >>> > >>> We weren't present at the UG's and I don't recall a list discussion. I > >>> don't recall being asked. It's non-standard for an IXP to do this. It > >>> should be opt in. I'd certainly like to opt out please. > >>> > >>>> To the original question, it looks like a number of us are up this > >>>> week – I was thinking it might be holiday shopping. > >>>> If anyone is on from Enventis they might want to consider upgrading > >>>> their port, looks like it's almost at capacity in the evening hours. > >>> > >>> > >>> If these are supposed to be behind lock and key, we failed. > >>> > >>> > http://lists.iphouse.net/cgi-bin/wa?A2=ind1312&L=MICE-DISCUSS&F=&S=&P=1337 > >>> I'm not logged into anything and that's in the clear. > >> > >> Marty, > >> > >> There have been several discussions with the subject of stats, cacti > >> graphs, etc on the list, since you subscribed in late 2011. So, it > >> shouldn't be a complete surprise. But, I'll agree there wasn't a direct > >> discussion of what graphs and statistics should be kept discussed on the > >> list. > >> > >> And, yes, it may have been bad form for Frank to post a graph on the > >> mailing list since it has a public archive. But, there is a basic > >> password on the graphs themselves. > >> > >> So, that brings up a few things it wouldn't hurt to discuss; > >> > >> 1. Should the list archive be public? > >> > >> 2. If not, what security should the list archive have? > >> > >> 3. What graphs and statistics should be collected? > >> > >> 4. Who should have access to what graphs and statistics? > >> > >> 5. What is the proper security for the graphs and statistics? > >> > >> 6. What is the proper etiquette regarding these graphs and statistics? > >> > >> Thanks. > >> > >> -- > >> ================================================ > >> David Farmer Email: farmer(a)umn.edu > >> Office of Information Technology > >> University of Minnesota > >> 2218 University Ave SE Phone: 1-612-626-0815 > >> Minneapolis, MN 55414-3029 Cell: 1-612-812-9952 > >> ================================================ > >> > >> ######################################################################## > >> > >> To unsubscribe from the MICE-DISCUSS list, click the following link: > >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > > > ######################################################################## > > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > ######################################################################## > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 > > -- Reid Fishler Director Hurricane Electric +1-510-580-4178 ######################################################################## To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

Dec. 10, 2013