Re: Water Utility SCADA 'Attack': The, um, washout

2011-11-28 Thread Leif Nixon
"andrew.wallace" writes: > These reports are ment for private sector eyes only. I suggest new secrecy > legislation, for fusion centres. Making it harder to share information on incidents and vulnerabilities is not the best of ideas. Over the last ten years I have seen much, much, MUCH more da

Re: Water Utility SCADA 'Attack': The, um, washout

2011-11-28 Thread Owen DeLong
On Nov 28, 2011, at 1:43 AM, Leif Nixon wrote: > "andrew.wallace" writes: > >> These reports are ment for private sector eyes only. I suggest new secrecy >> legislation, for fusion centres. > > Making it harder to share information on incidents and vulnerabilities > is not the best of ideas.

Re: Water Utility SCADA 'Attack': The, um, washout

2011-11-28 Thread Dobbins, Roland
On Nov 28, 2011, at 5:31 PM, Owen DeLong wrote: > Making it harder to spread misinformation and FUD is good. > Making it harder to share information is bad. Unfortunately, it's often quite difficult to distinguish between the two when formulating policies, regulations, legislation, and so forth

Re: Water Utility SCADA 'Attack': The, um, washout

2011-11-28 Thread Owen DeLong
On Nov 28, 2011, at 2:40 AM, Dobbins, Roland wrote: > > On Nov 28, 2011, at 5:31 PM, Owen DeLong wrote: > >> Making it harder to spread misinformation and FUD is good. >> Making it harder to share information is bad. > > Unfortunately, it's often quite difficult to distinguish between the two

IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Dmitry Cherkasov
Hello everybody, It is commonly agreed that /64 is maximal length for LANs because if we use longer prefix we introduce conflict with stateless address autoconfiguration (SLAAC) based on EUI-64 spec. But SLAAC is not used in DOCSIS networks. So there seems to be no objections to use smaller netwo

Bandwidth prediction tool?

2011-11-28 Thread Luis Palma
Hi, Does anyone know a good Bandwidth Prediction tool?. We have a DPI solution based on SCE8000 + SM/CM from Cisco and we are looking a tool that can take a data from Collector Manager Database and make traffic Bandwidth prediction and customer behavior prediction. Any idea will be welcome. Reg

Re: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Ray Soucy
It's a good practice to reserve a 64-bit prefix for each network. That's a good general rule. For point to point or link networks you can use something as small as a 126-bit prefix (we do). When it comes to implementation, though, it's not as simple as a yes or no answer. The actual use of 64-bi

Re: Water Utility SCADA 'Attack': The, um, washout

2011-11-28 Thread Kyle Creyts
I would actually carry this to another level, and say this "leak" could be considered evidence that the fusion centers are working quite well. The fact is that a fusion center, in this case, enabled the community to: 1)respond to an event (together); 2)know where to contribute any coordinating in

Re: Network device command line interfaces

2011-11-28 Thread Steve Gibbard
What this really comes down to, I think, is figuring out how your "gut level" concerns fit into the big picture, and to then put that into terms that the people responsible for the big picture can use to make a good decision. Finances do matter. Getting your employer to spend money it doesn't h

Re: Network device command line interfaces

2011-11-28 Thread Ray Soucy
One of the biggest benefits to a CLI is the ability to easily script tasks. In a Cisco environment I can roll out major changes to hundreds of switches in seconds, for example. A lot of network vendors have been trying to make network devices more simple and easier to use while the complexity of

Re: Network device command line interfaces

2011-11-28 Thread James Jones
On Mon, Nov 28, 2011 at 1:25 PM, Ray Soucy wrote: > One of the biggest benefits to a CLI is the ability to easily script tasks. > In a Cisco environment I can roll out major changes to hundreds of > switches in seconds, for example. > > A lot of network vendors have been trying to make network d

Re: Network device command line interfaces

2011-11-28 Thread Alex Harrowell
Ray Soucy wrote: >One of the biggest benefits to a CLI is the ability to easily script >tasks. > In a Cisco environment I can roll out major changes to hundreds of >switches in seconds, for example. > >A lot of network vendors have been trying to make network devices more >simple and easier to us

Re: Network device command line interfaces

2011-11-28 Thread Jay Ashworth
- Original Message - > From: "Ray Soucy" > If someone wants a managed switch, they probably intend to manage it. And that's all there is to be said about that. Nicely played, Ray. Cheers, -- jra -- Jay R. Ashworth Baylink j...@baylink.com Designe

Re: Network device command line interfaces

2011-11-28 Thread Valdis . Kletnieks
On Mon, 28 Nov 2011 13:25:21 EST, Ray Soucy said: > Even companies like Vyatta have invested time in a Web UI rather than > expanding the core functionality offered (multicast routing support, for > example), which doesn't seem like the best idea. Compare the number of customers that insist on a

Re: Network device command line interfaces

2011-11-28 Thread Jay Ashworth
- Original Message - > From: "James Jones" > Well said. I write scripts all day long to perform automation on networking > equipment. A device needs to have a CLI, but if you have a GUI too make for > darn sure that I can access all features in either one. It is a relatively well establi

Re: Network device command line interfaces

2011-11-28 Thread Ray Soucy
> If you've done a proper CLI, you can easily do a good REST API. If you've > done that a good Web GUI is possible. This. I would love a good REST API for everything; I would almost be willing to give up the CLI for it (almost). -- Ray Soucy Epic Communications Specialist Phone: +1 (207) 561-

Re: Network device command line interfaces

2011-11-28 Thread James Jones
Would love to a good open source TR69 interface. On Mon, Nov 28, 2011 at 3:35 PM, Ray Soucy wrote: > > If you've done a proper CLI, you can easily do a good REST API. If > you've done that a good Web GUI is possible. > > This. > > I would love a good REST API for everything; I would almost be wi

Re: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Owen DeLong
You can probably do it, but, what do you gain by doing so? Owen On Nov 28, 2011, at 3:37 AM, Dmitry Cherkasov wrote: > Hello everybody, > > It is commonly agreed that /64 is maximal length for LANs because if > we use longer prefix we introduce conflict with stateless address > autoconfiguratio

Re: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Owen DeLong
On Nov 28, 2011, at 7:29 AM, Ray Soucy wrote: > It's a good practice to reserve a 64-bit prefix for each network. > That's a good general rule. For point to point or link networks you > can use something as small as a 126-bit prefix (we do). > Technically, absent buggy {firm,soft}ware, you can

Re: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Steven Bellovin
On Nov 28, 2011, at 4:51 52PM, Owen DeLong wrote: > > On Nov 28, 2011, at 7:29 AM, Ray Soucy wrote: > >> It's a good practice to reserve a 64-bit prefix for each network. >> That's a good general rule. For point to point or link networks you >> can use something as small as a 126-bit prefix (w

Re: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Brzozowski, John
Dmitry, You could consider the use of prefixes longer than the /64 on CMTS interfaces, however, it is not clear to me why this would be done. Further, most DHCPv6 implementations do not require that the generated IPv6 address be eui-64 based. A randomized algorithm could also be used. Another co

Re: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Brzozowski, John
On 11/28/11 10:29 AM, "Ray Soucy" wrote: >It's a good practice to reserve a 64-bit prefix for each network. >That's a good general rule. For point to point or link networks you >can use something as small as a 126-bit prefix (we do). [jjmb] for point to point I agree with this point. If a /64

Re: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Brzozowski, John
I mentioned this in an earlier reply. CM vs CPE vs CPE router are all different use cases. From a CPE or CPE router point of view SLAAC will likely not be used to provisioned devices, stateful DHCPv6 is required. As such Vista/7 machines that are directly connected to cable modems will receive an

Re: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Fred Baker
Basically, if the address used by a host is allocated using RFC 3971/4861/4941, the host assumes a /64 from the router and concocts a 64 bit EID as specified. If the address used by the host is allocated using DHCP/DHCPv6, it is the 128 bit number assigned by the DHCP server. I see no reason you

Re: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Brzozowski, John
On 11/28/11 6:13 PM, "Fred Baker" wrote: >Basically, if the address used by a host is allocated using RFC >3971/4861/4941, the host assumes a /64 from the router and concocts a 64 >bit EID as specified. If the address used by the host is allocated using >DHCP/DHCPv6, it is the 128 bit number ass

Re: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Jeff Wheeler
On Mon, Nov 28, 2011 at 4:51 PM, Owen DeLong wrote: > Technically, absent buggy {firm,soft}ware, you can use a /127. There's no > actual benefit to doing anything longer than a /64 unless you have > buggy *ware (ping pong attacks only work against buggy *ware), > and there can be some advantages t

Re: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Valdis . Kletnieks
On Tue, 29 Nov 2011 00:15:02 EST, Jeff Wheeler said: > Owen and I have discussed this in great detail off-list. Nearly every > time this topic comes up, he posts in public that neighbor table > exhaustion is a non-issue. I thought I'd mention that his plan for > handling neighbor table attacks a

Re: IPv6 prefixes longer then /64: are they possible in DOCSIS networks?

2011-11-28 Thread Jonathan Lassoff
On Mon, Nov 28, 2011 at 10:43 PM, wrote: > On Tue, 29 Nov 2011 00:15:02 EST, Jeff Wheeler said: > > > Owen and I have discussed this in great detail off-list. Nearly every > > time this topic comes up, he posts in public that neighbor table > > exhaustion is a non-issue. I thought I'd mention t