Recently, I had it put to me that LANs (and firewalls) should be 100%
reliable (barring major equipment failure) -- that networks & security
should be about as reliable as the electrical mains (i.e., something
that can taken for granted nearly all the time, and repairs should take
only a few minutes.)

I was informed that "millions of businesses every day" have that
kind of LAN reliability.

Is that level of reliability the norm in real SMBs, with 500-ish
hosts, multiple subnets, and a mandatory deny-by-default firewall
policy?

Which is the truer picture in a growing organization with fluid network
access requirements: that the network & security person has barely
anything to do because they set up the equipment "right" the
first time? Or that keeping up with the network & security
changes and failures and planning is more than a full-time job
that can involve many a late night (or marathon repair session)?

How much truth is there, in real organizations, to those old
cartoons of a skeleton with cobwebs in front of a computer terminal,
with the caption "The network's down again." ?


It seems to me that more than once I've been in a major bank and been
told "The network's down", and no-one, staff or customer, seemed
surprised. I also seem to recall hearing a number of casual
conversations along the lines of "Oh yeah, the network
went down again at work today"... and I don't recall
hearing anyone reply "Our network never goes down"... not
for anything short of a Service Provider.


Lastly: has anyone observed a network "freak out", with a series
of normally reliable devices getting confused and staying confused
all through hours of standard problem isolation procedures, with no
discernable reason for the multiple failures -- and for the devices
to eventually settle down, and start working properly with
configurations that didn't work before?

Recently, I had it put to me that LANs (and firewalls) should be 100%
reliable (barring major equipment failure) -- that networks & security
should be about as reliable as the electrical mains (i.e., something
that can taken for granted nearly all the time, and repairs should take
only a few minutes.)

I was informed that "millions of businesses every day" have that
kind of LAN reliability.

Is that level of reliability the norm in real SMBs, with 500-ish
hosts, multiple subnets, and a mandatory deny-by-default firewall
policy?

Which is the truer picture in a growing organization with fluid network
access requirements: that the network & security person has barely
anything to do because they set up the equipment "right" the
first time? Or that keeping up with the network & security
changes and failures and planning is more than a full-time job
that can involve many a late night (or marathon repair session)?

How much truth is there, in real organizations, to those old
cartoons of a skeleton with cobwebs in front of a computer terminal,
with the caption "The network's down again." ?

It seems to me that more than once I've been in a major bank and been
told "The network's down", and no-one, staff or customer, seemed
surprised. I also seem to recall hearing a number of casual
conversations along the lines of "Oh yeah, the network
went down again at work today"... and I don't recall
hearing anyone reply "Our network never goes down"... not
for anything short of a Service Provider.

Lastly: has anyone observed a network "freak out", with a series
of normally reliable devices getting confused and staying confused
all through hours of standard problem isolation procedures, with no
discernable reason for the multiple failures -- and for the devices
to eventually settle down, and start working properly with
configurations that didn't work before?

Walter Roberson wrote:

Recently, I had it put to me that LANs (and firewalls) should be 100%
reliable (barring major equipment failure) -- that networks & security
should be about as reliable as the electrical mains (i.e., something
that can taken for granted nearly all the time, and repairs should take
only a few minutes.)

I was informed that "millions of businesses every day" have that
kind of LAN reliability.

Is that level of reliability the norm in real SMBs, with 500-ish
hosts, multiple subnets, and a mandatory deny-by-default firewall
policy?

Which is the truer picture in a growing organization with fluid network
access requirements: that the network & security person has barely
anything to do because they set up the equipment "right" the
first time? Or that keeping up with the network & security
changes and failures and planning is more than a full-time job
that can involve many a late night (or marathon repair session)?

How much truth is there, in real organizations, to those old
cartoons of a skeleton with cobwebs in front of a computer terminal,
with the caption "The network's down again." ?


It seems to me that more than once I've been in a major bank and been
told "The network's down", and no-one, staff or customer, seemed
surprised. I also seem to recall hearing a number of casual
conversations along the lines of "Oh yeah, the network
went down again at work today"... and I don't recall
hearing anyone reply "Our network never goes down"... not
for anything short of a Service Provider.


Lastly: has anyone observed a network "freak out", with a series
of normally reliable devices getting confused and staying confused
all through hours of standard problem isolation procedures, with no
discernable reason for the multiple failures -- and for the devices
to eventually settle down, and start working properly with
configurations that didn't work before?

Don't confuse the reliability of the _network_ with the reliability of the
_system_.

When someone says "the network went down" they usually mean that the
_system_ went down, which may be a failure at Layer 4 or below but is much
more likely to be a server or application problem.

--
--John
to email, dial "usenet" and validate
(was jclarke at eye bee em dot net)

Recently, I had it put to me that LANs (and firewalls) should be
100% reliable (barring major equipment failure) -- that networks
& security should be about as reliable as the electrical mains
(i.e., something that can taken for granted nearly all the time,
and repairs should take only a few minutes.)

I was informed that "millions of businesses every day"
have that kind of LAN reliability.

Is that level of reliability the norm in real SMBs,
with 500-ish hosts, multiple subnets, and a mandatory
deny-by-default firewall policy?

a late night (or marathon repair session)?

and I don't recall hearing anyone reply "Our network never
goes down"... not for anything short of a Service Provider.

Walter Roberson <roberson@ibd.nrc-cnrc.gc.ca> wrote:
Recently, I had it put to me that LANs (and firewalls) should be
100% reliable (barring major equipment failure) -- that networks
& security should be about as reliable as the electrical mains
(i.e., something that can taken for granted nearly all the time,
and repairs should take only a few minutes.)

You've received some good answers, and I'll add my 3 cents (CDN).

As many have said -- two different questions here. Networks are
generally very reliable. The occasional fried port or hung router.

Security is a _whole_ 'nother thing. Ideally, the network should be
fully open, and the devices (computers/servers) secure. No network
security required. With Microsoft products so insecure, the network
is called to help provide security by closing down. This is a PITA,
and doesn't stop trojans which the network is falsely blamed for.

I was informed that "millions of businesses every day"
have that kind of LAN reliability.

They do. Mostly small businesses with a few printers
and a file server. The problem is that MS scales horribly.

Is that level of reliability the norm in real SMBs,
with 500-ish hosts, multiple subnets, and a mandatory
deny-by-default firewall policy?

No. If single server uptime is 99.0% from random causes, and you
have 10 servers, only 90% of the time do you have all 10 servers.

a late night (or marathon repair session)?

This is the norm. People are loaded until they break.

and I don't recall hearing anyone reply "Our network never
goes down"... not for anything short of a Service Provider.

The network hardware at my home & work almost never go down.
I can almost always access Unix & other Linux-like hosts.
However, fairly frequently MS Windows desktops are out of action.

Whoa. The right approach is defense in depth.

so guess what most of the traffic on the "fully open"
network was.

99% uptime is piss poor. That's one minute of outage every hour
and a half or so. Any server on which that happens is broken.

why your system is so unreliable. And if you're focussed on
"Windows" and think that eliminating Windows would solve
the problem then you're not really looking at the problem.

If you're running XP and your desktop machines in a place
of business are "out of action" "fairly frequently" you
need to find out why and fix it.

J. Clarke <jclarke.usenet@snet.net.invalid> wrote:
Whoa. The right approach is defense in depth.

When you need to defend. What to defend is a decision.

so guess what most of the traffic on the "fully open"
network was.

Through traffic, of course. The Internet was designed that way.
the boundary routers could have been easily configured to drop
non-source/dest packets and it would have stopped. A better
solution would have been to negotiate with the various ISPs for
peering and/or cost to carry traffic. But that may have been
beyond the administrations skills.

99% uptime is piss poor. That's one minute of outage every hour
and a half or so. Any server on which that happens is broken.

That isn't the usual granularity. It's more like 2 hours
every month or two, counting only core time. That includes
diagnosis time and is in addition to non-core hours server
routine maintenance and reboots to recover leaked memory.

why your system is so unreliable. And if you're focussed on
"Windows" and think that eliminating Windows would solve
the problem then you're not really looking at the problem.

Well, yes. It's a long series of dependant chains. Any link
can break. I have no idea if Unix could be configured as
dependantly as MS-ActiveDirectory becomes when large.

If you're running XP and your desktop machines in a place
of business are "out of action" "fairly frequently" you
need to find out why and fix it.

First, we do not use MS-WinXP. MS-Win2kPro is bad enough.
Second, failures are not global. People can usually work
at their desktops. But they lose access to some resources
like shared drives or email. Bizarrely, others are unaffected.

-- Robert

Recently, I had it put to me that LANs (and firewalls) should be 100%
reliable (barring major equipment failure) -- that networks & security
should be about as reliable as the electrical mains (i.e., something
that can taken for granted nearly all the time, and repairs should take
only a few minutes.)

I was informed that "millions of businesses every day" have that
kind of LAN reliability.

Is that level of reliability the norm in real SMBs, with 500-ish
hosts, multiple subnets, and a mandatory deny-by-default firewall
policy?

Which is the truer picture in a growing organization with fluid network
access requirements: that the network & security person has barely
anything to do because they set up the equipment "right" the
first time?

Or that keeping up with the network & security
changes and failures and planning is more than a full-time job
that can involve many a late night (or marathon repair session)?

How much truth is there, in real organizations, to those old
cartoons of a skeleton with cobwebs in front of a computer terminal,
with the caption "The network's down again." ?

It seems to me that more than once I've been in a major bank and been
told "The network's down",

and no-one, staff or customer, seemed
surprised. I also seem to recall hearing a number of casual
conversations along the lines of "Oh yeah, the network
went down again at work today"... and I don't recall
hearing anyone reply "Our network never goes down"... not
for anything short of a Service Provider.

Lastly: has anyone observed a network "freak out", with a series
of normally reliable devices getting confused and staying confused
all through hours of standard problem isolation procedures, with no
discernable reason for the multiple failures -- and for the devices
to eventually settle down, and start working properly with
configurations that didn't work before?

J. Clarke <jclarke.usenet@snet.net.invalid> wrote:
Whoa. The right approach is defense in depth.

When you need to defend. What to defend is a decision.

so guess what most of the traffic on the "fully open"
network was.

Through traffic, of course. The Internet was designed that way.
the boundary routers could have been easily configured to drop
non-source/dest packets and it would have stopped.

A better
solution would have been to negotiate with the various ISPs for
peering and/or cost to carry traffic. But that may have been
beyond the administrations skills.

99% uptime is piss poor. That's one minute of outage every hour
and a half or so. Any server on which that happens is broken.

That isn't the usual granularity. It's more like 2 hours
every month or two, counting only core time. That includes
diagnosis time and is in addition to non-core hours server
routine maintenance and reboots to recover leaked memory.

why your system is so unreliable. And if you're focussed on
"Windows" and think that eliminating Windows would solve
the problem then you're not really looking at the problem.

Well, yes. It's a long series of dependant chains. Any link
can break. I have no idea if Unix could be configured as
dependantly as MS-ActiveDirectory becomes when large.

If you're running XP and your desktop machines in a place
of business are "out of action" "fairly frequently" you
need to find out why and fix it.

First, we do not use MS-WinXP. MS-Win2kPro is bad enough.
Second, failures are not global. People can usually work
at their desktops. But they lose access to some resources
like shared drives or email. Bizarrely, others are unaffected.

-- Robert

In article <d40mgf04kp@news3.newsguy.com>,
J. Clarke <jclarke.usenet@snet.net.invalid> wrote:

:If you're running XP and your desktop machines in a place of business are
:"out of action" "fairly frequently" you need to find out why and fix it.

I've been isolated for some years [this city is blooming nicely
in biotechnology, but the nearest "high tech city" is ~900 miles away].

Perhaps I don't get around as much as I should... but as best I recall,
I don't think I've ever met anyone who was actually skilled in
configuring and debugging and repairing MS Windows. I've met a number
of good unix/linux hackers, who could repair just about any software
problem -- but with MS Windows, having a good clue about the Registry
has been about the upper limit, after which the standard problem
resolution stream seems to be "Reinstall the application. Reinstall
Windows. Re-Ghost from a known-good system."

I'm certainly not trying to provoke a Unix vs Windows war here:
I'm asking more: Has my sample been biased? Is there a good
representation in IT of people who can -fix- MS Windows problems
beyond "Search the Knowledgebase and check out the registry, and if you
don't find the answer, then re-install?" And I certainly don't mean
to cast stones at MS Windows specialists with this question: I'm
asking seriously whether MS Windows gurus are uncommon or if I've
just not noticed them.