Network Management

Gartner Sanity Check...

Schratboy — Thu, 21 Aug 2008 12:35:09 -0400

Has anybody actually gone back and validated for accuracy any of Gartner's previous market predictions? Personally, I've never seen any. They continue to promote market research, selling this mixture of snake oil and technology allure for thousands and thousands of dollars. It's all upside for the prospective buyers while Gartner is never held to account for the validity of their projections.

Introducing "Securing the Line"

Matthew Nickasch — Thu, 21 Aug 2008 10:08:38 -0400

We're all familiar with the common security concerns with deploying an IP Telephony environment. Tomorrow, I'm launching a large 10-part series on improving VoIP and telecom security in an enterprise environment. Titled "Securing the Line," this new series will feature a daily article focusing on a specific aspect of VoIP and/or telecom security, posted each morning. In the afternoons, I'll discuss the VoIP/telecom/convergence market news or analysis of the day. In addition, if you have any views or ideas that you feel need to be included in a VoIP/telecom security discussion, please feel free to reply to this thread! Coming Up on "Considering Convergence": - Afternoon Newsbreak : Cisco's SMB IP-PBX Push

Read more

NBA and the security fairy

Schratboy — Wed, 20 Aug 2008 17:54:02 -0400

Really, does anyone think that a technology box secures anything? And this NBA stuff? Patterns, thresholds and alarms are so 'fire fighting old hat!' Perhaps it's helping keep the sanity at a Wild West University but practically speaking, I can't ever see this kind of investment being worthwhile in the commercial sector. Schools have the money to throw endless amounts of technology at problems. They really don't manage anything because it's too scattered and students and profs are too independent. Throwing technology at problems is the only answer.

Read more

Adam Powers CTO of Lancope: Top 5 uses of NetFlow

Brad Reese — Wed, 20 Aug 2008 15:05:48 -0400

Picking the mind of an extremely talented technologist is the objective of this new blog series. The following Q&A with Adam Powers of Lancope is the first of a multi-part series on the Top 5 Uses of NetFlow. For the first story, Adam Powers - CTO of Lancope, has answered the questions of yours truly below to discuss NetFlow Event Logging and how it compares to Syslog.

Section I: NetFlow Event Logging 1. What types of messages used in Syslog do you feel will move to NetFlow? High speed structured events such as firewall logs primarily. NetFlow Event Logging (NEL) is found in Cisco’s newest high speed firewall technologies such as the new ASR-1000 and the venerable ASA 5000 series. Let’s take a look at the ASR-1000 as an example. The ASR offers an integrated, zone-based IOS firewall capable of speeds in excess of 2Gbps. At these rates, firewall state table session setup and teardowns occur at incredibly high rates. Customers with even trivial logging requirements will find that traditional syslog incurs a significant load on the ASR-1000’s route processor. Cisco’s ASR (Aggregated Services Router) is designed to run advanced services at the network’s edge. It follows that customers would want to use the route processor’s available horsepower to accommodate those advanced services rather than spend its time manufacturing and sending syslog. When using NetFlow Event Logging in the ASR, firewall logging is pushed down into hardware freeing the Route Processor to perform higher order tasks. The creation of hardware-based NetFlow v9 is much less expensive than the creation of software-based syslog. Unfortunately NEL technology is relatively new and support for it is sparse at best. Customers wanting to reap the benefits of NEL will find that very few if any syslog aggregation and collection technologies simply do not support NEL. Working with Cisco engineers, Lancope has introduced a simple 1U appliance called the NEL Gateway to address this issue. The StealthWatch NEL Gateway leverages Lancope’s knowledge of high speed NetFlow processing to create a simple protocol gateway that converts the high speed NEL events into C3PL compliant syslog messages suitable for export to most any traditional syslog collector. Each 1U NEL Gateway appliance can process up to 40,000 firewall events per second, translating them into equivalent syslog messages and forwarding them to one or more syslog collectors using the original source IP of the sending ASR. The diagram below provides a overview of how the ASR and the NEL Gateway work together... Within the ASR-1000, the following firewall event types are exported over NEL and translated into syslog by the NEL Gateway: The screenshot below shows the status page for the NEL Gateway. Note the counts shown on a per record type basis. One last important note: Due to the efficiency of NetFlow v9, NEL is up to 18x more efficient in terms of bandwidth generated through logging. Given an Ethernet MTU of 1500 up to 18 NEL events are packed into a single NEL UDP datagram.

Section II: Flexible NetFlow 2. When does Lancope plan to have flexible NetFlow phase 2 implemented? Lancope has already begun to support additional key and non-key fields provided in v9. Our next major improvement to Flexible NetFlow support should arrive in the Q1 timeframe of 09. This release is being timed in conjunction with some very interesting Flexible NetFlow enhancements we’re not even allowed to discuss as of yet. The trouble with Flexible NetFlow has been that there were too few real benefits provided by FNF (Flexible NetFlow) over TNF (traditional NetFlow). That is changing very rapidly thanks to new key/non-key’s being added to FNF. 3. What types of cache messages (normal, immediate, permanent) do you plan to accept initially and when? The StealthWatch NetFlow collector has a minimum set of fields required to operate. As long as the Flexible NetFlow exporter sends at least the minimum set the cache mechanism and cache timers can be configured any way the customer desires. The minimum required fields for the StealthWatch flow collector include: FIRST_SWITCHED LAST_SWITCHED IN_BYTES IN_PKTS SRC_INT_ID DST_INT_ID PROTOCOL L4_SRC_PORT L4_DST_PORT SRC_ADDR_IPV4/IPv6 (IPv6 support added in 5.8 release) DST_ADDR_IPV4/IPv6 For those customers wanting to reduce the amount of bandwidth consumed by NetFlow to an absolute minimum, creating a flow template with these the set above will result in a very efficient NetFlow export. Immediate and permanent cache settings can be used with the current release of StealthWatch so long as they include the fields listed above. Automated cache configuration via SNMP PUTs are a bit further out. The jury is still out on how useful automation of cache creation will be in an real-world environment. 4. Will you be archiving these different caches where applicable and rolling up the data into 10, 30, 1 hour etc. intervals? Definitely. This is already in the product. The StealthWatch System provides a retention management system that allows the operator to specify how long they would like to keep various statistics derived through NetFlow analysis. StealthWatch tracks interface utilization statistics from 1 minute up to 1 day resolution. Statistics are "rolled up" over time in accordance with the retention policy configured within the system. The screenshot below gives you an idea of how this retention manager works... 5. Will you be triggering and sending the SNMP sets necessary to setup the different caches above? Lancope is researching the usefulness of automated cache creation but has held off on a firm date commitment for this kind of functionality. Instead we’re focusing our engineering efforts on the newer key/non-key fields provided by FNF. We’re interested in how we can use them and what additional fields we might persuade Cisco to add in the future. As FNF gets more real field use we’ll get a better understanding for how automated cache creation should work.

What questions would YOU like Adam Powers to answer? http://www.BradReese.Com Search 26,983 current Cisco Job openings worldwide.


	JDSU 4th Quarter 2008: Expect strong outperformance for its advanced optical technologies (AOT) segment
	CCIE water cooler gossip: CCIE agent musical chair game?
	CCIE water cooler gossip: CCIE agent rules of the road?
	Brocade 3rd Quarter 2008 results: Cisco long-term threat to Brocade's Fibre Channel switching franchise
	CCIE water cooler gossip: Is a rosy future in the forecast for sitting CCIEs?
	Brad Reese on Cisco Story Archives

Cisco Jobs Cisco Resumes 2008 Cisco Salary Rates Post Cisco CV/Resume FREE

Read more

Business Driven Virtual Data Center Strategy

Tony and Sheppard — Wed, 20 Aug 2008 14:22:40 -0400

Virtualization has many advocates and is the latest IT bandwagon rallying cry. The approaches to virtualization have taken two distinct paths. The supply side path is usually undertaken by IT operations in an attempt to mask hardware differences and minimize complexity; this approach does not go far enough. The other path involves a business demand driven approach. The demand driven approach needs to be taken to ensure that virtualization is executed in a strategic manner.

Read more

System Tools Hyena: tips and tricks

Ron Barrett — Wed, 20 Aug 2008 14:12:40 -0400

The first tool I wrote about for A Better Windows World was System Tools Hyena. Of all the tools I have come across thus far in my 11+ years in technology, this is one of my all-time favorites. As I explained when I first wrote about Hyena, this tool has everything you need to manage Windows servers and desktops. It even has native support for Exchange Server and Terminal Server account settings. The remote-control functions allow you to use clients like VNC for remote administration of servers and workstations.

Read more

Cisco still foggy about cloud services

Mitchell Ashley — Wed, 20 Aug 2008 10:56:46 -0400

NWW Cisco Subnet has a post about bloggers writing prolifically about Cisco and cloud services. Setting the Cisco WebEx acquisition aside for the moment, Cisco could and probably will offer some type of software-as-a-service or cloud software service themselves. I would expect the best SaaS opportunities to come in the VoIP market before it shows up anywhere else for Cisco. That said . . .

Read more

huh?

Wed, 20 Aug 2008 10:07:18 -0400

in the Related Content box are 3 links: Related Content Gartner: Indian outsourcers gaining global share Gartner: Top 30 offshore locations for 2008 Offshoring grows, automation key to cost cutting, Gartner am i missing something?

Its about uptime

Kerrie Meyler — Wed, 20 Aug 2008 09:56:25 -0400

A while back, I wrote a post about downtime and managing IT Operations (see http://www.networkworld.com/community/node/20187). As a follow-up to that, I just participated in a blog interview with StackSafe about IT Operations and how Operations Manager can help you in managing your downtime (and uptime!). Check it out at http://www.stacksafe.com/blog/kerrie-meyler-a-microsoft-mom-mvp-dishes-about-it-operations/08/19/2008/.

blue

Wed, 20 Aug 2008 04:04:54 -0400

my blue katalog you give open

A Better Windows World tools library update

Ron Barrett — Wed, 20 Aug 2008 00:03:22 -0400

As promised, here is an update to the tools library I posted in July. Enjoy the full list of everything we have featured on A Better Windows World. Tool Names: A-Z Altiris Software Virtualization Solution Amazon Kindle Angry IP Scanner Civil Netizen ClamWin Portable

Read more

Hmm

LiTTLe_OnE — Tue, 19 Aug 2008 18:35:57 -0400

interesting...

Toshiba Announces AT&T SIP Trunking Interoperability

Matthew Nickasch — Tue, 19 Aug 2008 11:17:48 -0400

With SIP trunking becoming more and more popular, IP-PBX vendors are looking to provide customers with options for lower-cost trunking functionality. Recently, Toshiba announced SIP interoperability with the AT&T IP Flexible Reach service. This recent advancement solidifies Toshiba's IP-PBX offerings, giving users the opportunity to take advantage of AT&T's nationwide coverage and stability of the IP Flexible Reach service. This adds to Toshiba's portfolio of SIP interoperability certifications, including IPTimize and CBeyond.

Read more

Gartner Group Gaffs and Web 2.0 Techno-Hype

WebDesignMiami — Tue, 19 Aug 2008 10:04:29 -0400

Gartner Group Gaffs and Web 2.0 Techno-Hype The renowned Gartner Group's latest Hype Cycle report places "Web 2.0" in a "Trough of Disillusionment": http://tinyurl.com/6ycvs8 But for a few good chuckles, I suggest you Google the following and browse the first 20-30 listings: failures Gartner Group warnings Gartner Group Gartner Group expects Gartner Group predicts As for "Web 2.0?, like so many tech articles posted since Tim O'Reilly (or was it Dale Dougherty?) first coined the term in 2004 (or was it 2005?), this one references "Web 2.0" as if it were something tangible--or at least a concept with clear, concise definition. It is not.

Read more

Podcast: Only You Can Save The Planet On August 27th

Mitchell Ashley — Tue, 19 Aug 2008 05:32:33 -0400

Power IT Down Day: it's a new initiative by HP, Intel and Citirx to help all of us reduce the power consumption of our workstations, computer, monitors and other electronic devices when we leave our desks at night. August 27th is the day planned to observe this "awareness holiday". Tom Simmons, area Vice President for Citrix Federal, joins me as a guest on the podcast to talk about this initiative.

On the 27th (it's not too far away), turn off all the power consuming devices when you leave your desk at night.

Read more

SolarWinds Orion deployments

Tue, 19 Aug 2008 03:54:27 -0400

We are responsible for some of the largest installations of Orion within the UK.Customer feedback is always positive when combined with our installation and consultancy services. SolarWinds is continuing to grow and with tight integration of modules and now a distributed architecture it will fast become the NM solution of choice. Prosperon Networks

Bah

Fri, 15 Aug 2008 20:40:22 -0400

Mandatory 3-week $18,500 program? Why? The money. If you can perform the tasks and pass the exams, what does the $18,500 price tag and 3-weeks get you? Just another way to line M$ pockets.

ShieldsUp!: A great free resource to ensure your surfing safely

Ron Barrett — Fri, 15 Aug 2008 17:26:49 -0400

In today’s market there are not many really good tools that do not cost you an arm and a leg to implement or that take forever to configure and learn to use since they are free. ShieldsUp! Is a tool you may or may not be aware of that takes no time to learn and configure and is absolutely free. Provided by Gibson Research Corporation , ShieldsUp! Offers several different tests: File Sharing, Common Ports, All Service Ports ( the first 1056 ports anyway), Messenger Spam, Browser Headings, Custom port probes or Specific Port information. ShieldsUp! Does not only do a stellar job at testing these security holes, they provide you with information on how to fix them.

Read more

"IT" Far From Problem-Free

Matthew Nickasch — Fri, 15 Aug 2008 14:32:22 -0400

If you've been following the general IT industry news for the last week or so, you've noticed some major stories that have hit the wire. From the VMWare ESX/ESXi bug that brought some virtualization infrastructures to a halt, to the multiple instance Google Apps / Gmail outages, it has been recently quite busy. On a lighter note, and since it is Friday afternoon, let's reflect on what these outages and problems mean to IT managers, corporate leaders, and the end users.

Read more

A damn cool open source tool called NEDI

ronaldxbartels — Thu, 14 Aug 2008 14:11:09 -0400

For many years now I have used an unknown open source tool called NEDI http://www.nedi.ch/ In my opinion it is the MAC king!