Re: GeoIP database issues and the real world consequences

2016-04-11 Thread Joel Maslak
On Mon, Apr 11, 2016 at 3:09 PM, Owen DeLong wrote: > So really, what is needed is two additional fields for the lat/lon of > laterr/lonerr so that, for example, instead of just 38.0/-97.0, you would > get 38.0±2/-97.0±10 or something like that. > It does seem needed to the geo location compani

Re: Internet Exchanges supporting jumbo frames?

2016-03-10 Thread Joel Maslak
On Wed, Mar 9, 2016 at 9:27 AM, joel jaeggli wrote: > PMTU blackhole detection implemented in all hosts. IPv4 is lost cause in > > my opinion (although it's strange how many hosts that seem to get away > > with 1492 (or is it 1496) MTU because they're using PPPoE). > > if your adv_mss is set acco

Static IPs

2015-10-19 Thread Joel Maslak
A helpful hint from a local broadband provider (I'm trying to wade through broadband options at home): "If your business is online, then you should have an IP address." I do find that helps. (in fairness, they are talking about static IPs, but it kind of fits with the rest of their marketing whi

Re: Extraneous "legal" babble--and my reaction to it.

2015-09-10 Thread Joel Maslak
Postel's Law seems relevant to this issue. Sorry for contributing to the noise.

Re: RES: Exploits start against flaw that could hamstring huge swaths of

2015-08-04 Thread Joel Maslak
On Tue, Aug 4, 2015 at 4:53 PM, Randy Bush wrote: > i love the devops movement; operators discover that those computers can > be programmed. wowzers! > Maybe we can give them a new title. I'm thinking, "System Programmer."

Re: Android (lack of) support for DHCPv6

2015-06-09 Thread Joel Maslak
Of course I've been up too long, ignore the idiot (me). :) On Tue, Jun 9, 2015 at 9:37 PM, Joel Maslak wrote: > Most APs don't support bridging, not enough addresses in the protocol > (without enabling WDS or whatever modern versions of that are). > > On Tue, Jun 9,

Re: Android (lack of) support for DHCPv6

2015-06-09 Thread Joel Maslak
Most APs don't support bridging, not enough addresses in the protocol (without enabling WDS or whatever modern versions of that are). On Tue, Jun 9, 2015 at 9:14 PM, Chris Adams wrote: > Once upon a time, valdis.kletni...@vt.edu said: > > On Wed, 10 Jun 2015 12:59:47 +1000, Karl Auer said: > >

Re: Android (lack of) support for DHCPv6

2015-06-09 Thread Joel Maslak
Agreed - apparently the solution is to implement SLAAC + DNS advertisements *AND* DHCPv6. Because you need SLAAC + DNS advertisements for Android, and you need DHCPv6 for Windows. Am I the only one that thinks this situation is stupid? On Tue, Jun 9, 2015 at 1:17 PM, Randy Bush wrote: > i love

Re: gmail security is a joke

2015-05-27 Thread Joel Maslak
I also suspect not every telco validates number porting requests against social engineering properly. A telephone number isn't something you have, it is something your provider has. On Wednesday, May 27, 2015, Saku Ytti wrote: > On (2015-05-27 14:19 +0200), Owen DeLong wrote: > > Hey, > > > If

Re: Rasberry pi - high density

2015-05-11 Thread Joel Maslak
Rather then guessing on power consumption, I measured it. I took a Pi (Model B - but I suspect B+ and the new version is relatively similar in power draw with the same peripherials), hooked it up to a lab power supply, and took a current measurement. My pi has a Sandisk SD card and a Sandisk USB

Re: Network Segmentation Approaches

2015-05-05 Thread Joel Maslak
I'd certainly forget anything with "service provider" in the name. Different problem, different architecture. Last time I built this, I built a core network (WAN links, routers, etc) that enforced anti-spoofing rules, so I knew if I saw an "internal" IP address (either public assigned to me or RFC

Re: BCOP appeals numbering scheme -- feedback requested

2015-03-13 Thread Joel Maslak
You'll get more comments about the numbering scheme than any actual BCOP... On Thu, Mar 12, 2015 at 1:01 PM, Yardiel D. Fuentes wrote: > > > Hello NANOGers, > > The NANOG BCOP committee is currently considering strategies on how to > best create a numbering scheme for the BCOP appeals. As we al

Re: Checkpoint IPS

2015-02-06 Thread Joel Maslak
On Thu, Feb 5, 2015 at 10:47 AM, Roland Dobbins wrote: > > On 6 Feb 2015, at 0:38, Raymond Burkholder wrote: > > > There must some sort of value in that? > > No - patch the servers. > Patching servers protects against >0 Day attacks only. This does not protect against 0 day attacks, unless you

Re: DDOS solution recommendation

2015-01-11 Thread Joel Maslak
On Sun, Jan 11, 2015 at 6:46 AM, Mike Hammett wrote: > You hit my honeypot IPs, blackholed for 30 days. You do a DNS request to > my non-DNS servers, blackholed for 30 days. Same goes for NTP, mail, web, > etc. You have more than say 5 bad login attempts to my mail server in 5 > minutes, blackho

Re: Cisco CCNA Training

2014-11-02 Thread Joel Maslak
You might look at your local community college's offerings. Probably better bang for the buck than many other offerings. On Sun, Nov 2, 2014 at 10:02 AM, Colton Conor wrote: > We have a couple of techs that want to learn cisco and networking in > general. What do you recommend for learning and

Re: L6-20P -> L6-30R

2014-03-19 Thread Joel Maslak
You probably should ask your facility operator or electrician what the requirements are (who, unlike most network engineers, is qualified to decide what to do), but it sounds like replacing the PDU is simple and easy, and unquestionably not a bad thing to do. Alternatively, you can replace the 30A

Re: valley free routing?

2014-03-05 Thread Joel Maslak
I have worked for the middle network when I was responsible for a government network - typically we were the middle network. Logic was it was good for citizens for us to essentially act like a peering exchange for certain types of entity (who also typically were government affiliated). One I can t

Re: home network monitoring and shaping

2013-02-12 Thread Joel Maslak
I've had great luck with Cisco's fair-queue option (and similar techniques). Using RED, small queues (think on the order of 10-20 packets), and creating a choke point in and out of the network, I've implemented similar behavior on plenty of DSL lines on the CPE-side. My most successful was sharin

Re: Issues encountered with assigning all ones IPv6 /64 address? (Was Re: Issues encountered with assigning .0 and .255 as usable addresses?)

2012-10-23 Thread Joel Maslak
On Tue, Oct 23, 2012 at 9:18 AM, Mike Jones wrote: > IPv4 addresses ending in .0 and .255 can't be used either because the > top and bottom addresses of a subnet are unusable. > > Why would hetzner be making such assumptions about what is and is not > a valid address on a remote network? if you ha

Centurylink Contact

2012-10-19 Thread Joel Maslak
Does anyone have a good contact to report outside plant issues in the Denver, CO area? Some construction equipment in my neighborhood snagged and snapped a messenger cable between poles, and probably stretched some copper. I'd like to make sure that CL actually gets notified and gets it fixed. My

Re: Color vision for network techs

2012-08-31 Thread Joel Maslak
On Aug 31, 2012, at 12:27 PM, JC Dill wrote: > So if you DO decide to test for color vision, make sure you know your rights > and responsibilities for handling any employee or applicant who fails the > test. > > IANAL - if you have any questions be sure to get advice from an attorney - > pref

Re: DDoS using port 0 and 53 (DNS)

2012-07-25 Thread Joel Maslak
On Wed, Jul 25, 2012 at 8:43 AM, John Kristoff wrote: > Some UDP applications will use zero as a source port when they do not > expect a response, which is how many one-way UDP-based apps operate, > though not all. This behavior is spelled out in the IETF RFC 768: That would only be applicable

Re: technical contact at ATT Wireless

2012-06-28 Thread Joel Maslak
On Thu, Jun 28, 2012 at 1:35 PM, PC wrote: > While you're at it, I've been also trying to complain about them using > RFC1918 (172.16.) address space for the DNS servers they assign to their > datacard subscribers.  Causes all sorts of problems with people trying to > VPN in as the same IP range

Re: CVV numbers

2012-06-09 Thread Joel Maslak
On Jun 9, 2012, at 1:06 AM, Hal Murray wrote: > Should I really take them seriously? Your call. That said, the purpose of CVV is to stop *one* type of fraud - it's to stop a skimmer from being able to do mail-order/internet-order with your card number. The CVV is not on the magnetic strip, s

Re: IPv6 day and tunnels

2012-06-04 Thread Joel Maslak
On Jun 4, 2012, at 1:01 AM, Owen DeLong wrote: > Any firewall/security device manufacturer that says it is will not get any > business from me (or anyone else who considers their requirements > properly before purchasing). Unfortunately many technology people seem to have the idea, "If I don't

Re: IPv6 day and tunnels

2012-06-03 Thread Joel Maslak
On Jun 3, 2012, at 7:38 PM, Joe Maimon wrote: > www.arin.net works and worked for years. www.facebook.com stopped June 1. > > So IPv6 fixes the fragmentation and MTU issues of IPv4 by how exactly? It doesn't fix the fragmentation issues. It assumes working PMTU. For what it's worth, I also us

Re: Comcast Paid Peer Pricing

2012-06-02 Thread Joel Maslak
On Jun 2, 2012, at 3:08 PM, Nabil Sharma wrote: > Dear NANOG: > I seek pricing on Comcast AS7922 paid peer at following commit level: > 1G > 10G > 100G > Please reply in private and I will sum up on list. > Sincerely, > Nabil I'd suggest contact Comcast sales.

Re: Outdoor Wireless Access Point

2012-04-01 Thread Joel Maslak
On Apr 1, 2012, at 3:44 PM, Masataka Ohta wrote: > With 802.11, you can connect to an AP and, if the AP > fails, you may be connected to another AP, but the > transition takes considerable amount of time not > tolerable for voice communication, which is why it > is not called mobility. True und

Re: Outdoor Wireless Access Point

2012-03-31 Thread Joel Maslak
On Mar 31, 2012, at 3:38 AM, Shahab Vahabzadeh wrote: > As I look for maps we need at least 3 or 4 outdoor radio, I think in these > networks the best solution is to have only one SSID in whole network to > give mobility for the network, is this called ad-hoc? or it has an other > name? No, it's

Regex validation, was Re: Programmers with network engineering skills

2012-03-13 Thread Joel Maslak
On Mon, Mar 12, 2012 at 9:18 PM, Mark Andrews wrote: > Only if you don't properly quote/escape the arguments you are passing. You're using your OS wrong if you are quoting/escaping the arguments. You do not need a shell involved to use fork() + exec() + wait(), as the shell is not involved (assu

Re: VLAN Troubles

2012-03-06 Thread Joel Maslak
I've never had problems setting up multiple VLANs on a link between Cisco, HP, Dell switches, IBM mainframes, VMWare servers, 3COM/Nortel, Polycom Phones, Linux servers, etc. If both ends supported 802.1q, it just worked, if the admin read the manual for both pieces of gear and knew how to trouble

Re: Please help our simple bgp

2012-01-30 Thread Joel Maslak
On Mon, Jan 30, 2012 at 7:27 PM, Ann Kwok wrote: > We discover the routes is going to ISP A only even the bandwidth 100M is > full There are several ways to handle this is, if you have at least two /24s of space. Let's say you just have two /24s, both part of the same /23. Option 1: Announce

Re: bgp question

2012-01-19 Thread Joel Maslak
On Thu, Jan 19, 2012 at 6:27 AM, Deric Kwok wrote: > We are planning to have 3 x 1G bgp connections (full tables) eg: Path A, B, C > > Can I say that we have 3G output totally? Sure. > From my understanding, the bgp chooses the best path to route automatically It doesn't. It typically chooses

Re: Misconceptions, was: IPv6 RA vs DHCPv6 - The chosen one?

2011-12-29 Thread Joel Maslak
On Dec 29, 2011, at 7:00 PM, Jeff Kell wrote: > The real-world case for host routing (IMHO) is a server with a public > interface, an administrative interface, and possibly a third path for > data backups (maybe four if it's VMware/VMotion too). Unless the > non-public interfaces are flat subnet

Re: Speed Test Results

2011-12-28 Thread Joel Maslak
On Fri, Dec 23, 2011 at 10:13 AM, Livingood, Jason wrote: > If you want to understand the issue in detail, check out the report from > MIT this year, written by Steve Bauer and available at > http://mitas.csail.mit.edu/papers/Bauer_Clark_Lehr_Broadband_Speed_Measurem > ents.pdf. They should have

Re: subnet prefix length > 64 breaks IPv6?

2011-12-27 Thread Joel Maslak
On Dec 27, 2011, at 4:28 PM, Glen Kent wrote: > I had assumed that nodes derive their link local address from the > Route Advertisements. They derive their least significant 64 bytes > from their MACs and the most significant 64 from the prefix announced > in the RAs. No, link local addresses ar

Re: Speed Test Results

2011-12-23 Thread Joel Maslak
On Fri, Dec 23, 2011 at 2:18 AM, jacob miller wrote: > Am having a debate on the results of speed tests sites. > > Am interested in knowing the thoughts of different individuals in regards to > this. It's one data point of many. Depending on the speed test site, the protocols it uses, where th

Re: Recent DNS attacks from China?

2011-12-02 Thread Joel Maslak
Other than being non-compliant, is an "ANY" query used by any major software? Could someone rate limit ANY responses to mitigate this particular issue? On Fri, Dec 2, 2011 at 8:17 AM, Leland Vandervort < lel...@taranta.discpro.org> wrote: > Yup.. they're all "ANY" requests. The varying TTLs ind

Re: Network device command line interfaces

2011-11-25 Thread Joel Maslak
On Fri, Nov 25, 2011 at 12:01 AM, Robert Bonomi wrote: > The trick to deailing with this as a propellorhead[sic] is to include a > *monetized* estimate of the increased manpower OPEX of using the 'dog to > work with' box. And a TCOS figure over the projected lifetime of the > units. No need to

Re: Dynamic (changing) IPv6 prefix delegation

2011-11-22 Thread Joel Maslak
On Nov 22, 2011, at 8:05 AM, Ray Soucy wrote: > As long as a static allocation can be billed as a premium service, > most providers will unfortunately do it. Exactly. ISPs are in business to make as much money as they can - go figure. For myself, having a static IP is the least of my concerns

Re: Strange static route

2011-09-25 Thread Joel Maslak
On Sep 25, 2011, at 3:37 AM, Tom Storey wrote: > I found I had to do this many years ago on some Cisco routers to get them to > load balance (per packet) across two links. Adding 0.0.0.0/0 routes across > both links just resulted in traffic routing across one link. Broke it into > two /1's per li

Re: Strange static route

2011-09-23 Thread Joel Maslak
Protection against learning a bad default route through whatever routing protocol they are learning, since these two routes would be more specific than any typical default route. They probably got burned learning a default route. On Sep 23, 2011, at 7:12 PM, Glen Kent wrote: > Hi, > > I have

Re: OT: Given what you know now, if you were 21 again...

2011-07-14 Thread Joel Maslak
On Wed, Jul 13, 2011 at 3:08 PM, Larry Stites wrote: > Given what you know now, if you were 21 and just starting into networking / > communications industry which areas of study or specialty would you > prioritize? > Make sure you are always learning. You can't stop learning in this industry.

Re: best practices for management nets in IPv6

2011-07-12 Thread Joel Maslak
Public IPs. At some point you will have to manage something outside your current world or your organization will need to merge/partner/outsource/contract/etc with someone else's network and they might not be keen to route to your ULA space (and might not be more trustworthy than the internet at

Re: ICANN to allow commercial gTLDs

2011-06-20 Thread Joel Maslak
I wonder what sort of money .wpad would be worth...

Re: Question about migrating to IPv6 with multiple upstreams.

2011-06-13 Thread Joel Maslak
On Mon, Jun 13, 2011 at 6:59 PM, Randy Carpenter wrote: This is precisely what we are doing on the main network. We just want to > keep the general browsing traffic separated. > If you're worried about browsing traffic and not worried about occasional other things slipping through, set up Squid

Re: user-relative names - was:[Re: Yahoo and IPv6]

2011-05-17 Thread Joel Maslak
On Tue, May 17, 2011 at 9:37 PM, wrote: > Unless you end up behind a fascist firewall that actually checks that the > EUI-64 half of the SLAAC address actually matches your MAC address - but we > all > know that firewalls are weak at IPv6 support, so probably nobody's actually > doing that check

Re: Clearing DF bits...

2011-05-13 Thread Joel Maslak
On May 13, 2011, at 6:02 PM, Warren Kumari wrote: > Years This was done both to deal with multiple encapsulations and for the > folk that block all ICMP for "security reasons." I did it as recently as last month, for the same reasons.

Re: IPv6 foot-dragging

2011-05-12 Thread Joel Maslak
Who sees the most AS's?

Re: Yahoo and IPv6

2011-05-09 Thread Joel Maslak
On Mon, May 9, 2011 at 3:57 PM, Jeff Wheeler wrote: I do take issue with your suggestion that /64 LANs are in any way > smart in the datacenter. They are not. I have some slides on this > topic: http://inconcepts.biz/~jsw/IPv6_NDP_Exhaustion.pdf There are ways of mitigating this (the easiest

Re: riverbed steelhead

2011-04-21 Thread Joel Maslak
upport these things). In my experience, the problem isn't that the line is too small for the workload, but rather that bulk transfers keep everyone from doing work over it - that's where fair queuing and WRED come in. If you've already done this, than please ignore this suggestion. :) -- Joel Maslak