Subject: RE: [Ieprep] FW: The Spread of the Sapphire/Slammer SQL Worm

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Mon, 3 Feb 2003 02:24:27 -0600

> What really happened was the system collecting statistics about  
> the backbone used MS/SQL to store the data was infected, or the 
> measurement beacon was in a data center with another
> MS/SQL infected system which congested the local network 
> affecting all measurements of the backbone.

  Most of them have their collector systems in a separate 
management network[1]. Since, slammer had a major effect on local 
networks, it should be an important factor to be considered. I am 
not sure, but if  this issue has some co-relation with the debate 
on use of TCP Vs UDP between collectors and exporters in a passive 
monitoring system, a detailed discussion in psamp/ipfix wg is 
necessary.

> Government-run networks seemed to have as many infected systems as
> everyone else.  Allowing authorized government users to "exempt"
> themselves from network management controls would have probably been
> unwise in this case.

Can this statement be documented in any one of the drafts( requirements
or frame work)? I don't find any details on *how* exemption from management 
control is done for *IEPS* traffic in any of the ITU standards.

> Did .MIL exempt some infected machines from management controls  
> allowing them to transmit the infection with high priority packets?

[1] psamp/ipfix email archives
_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: Ken Carlberg <[email-masked]>
Date: Mon, 03 Feb 2003 11:54:53 +0000

> or frame work)? I don't find any details on *how* exemption from 
> management control is done for *IEPS* traffic in any of the ITU 
> standards.

one can consider IEPS as a recent extension of HPC/NS-EP -- the former
taking an international perspective of NS/Ep, which is national in
scope.  an example of info on the latter and network management controls
can be found at the latter.

http://www.interconnection.bellsouth.com/products/vertical/gets.html

going beyond what is stated in the above URL, my understanding is that
the implementation of these exemptions have limitations.  these are not
exemptions that have no boundaries and starve out other traffic.  once
this additional threshold is reached within that PSTN segment, GETS
users have the same chance and resources as anyone else.

also, the point is taken about the concern raised in allowing exemptions
to take place.  The Framework doesn't specifically cite the Network
Management Controls of telecom carriers since this refers specifically
to trunk groups.  However, the Framework document does have a section on
Traffic Engineering and a discussion about limiting the allocation of
resources for HPC -- and that its a good thing to have thresholds.  We
can probably add a paragraph or two to the section to bring up the
specific subject of Network Management Controls (and cite what they are
and what they pertain to) in the next version of the draft.

side note, even though nothing is particularly stated in the Framework
draft, we're currently bundling the subject of IP network management
within the area of traffic engineering.  if folks feel we should have a
separate section on network management with specific points to be made
about SNMP (beyond the fact that it will probably exist :-), please
bring up these points and let me know. side, side note, i'll be on
travel for a few days, so i'll be a while in responding to any points.

regards,

-ken