Re: Filter NTP traffic by packet size?

2014-02-26 Thread Keegan Holley
On Feb 25, 2014, at 12:22 PM, Staudinger, Malcolm wrote: > Why wouldn't you just block chargen entirely? Is it actually still being used > these days for anything legitimate? > More politely stated, it’s not the responsibility of the operator to decide what belongs on the network and what d

Re: Managing IOS Configuration Snippets

2014-02-27 Thread Keegan Holley
Putting aside the fact that snippets aren’t a good way to conceptualize deployed router code, my gut still tells me to question the question here. The first is does this stuff change often enough to warrant a fancy versioning solution? I have yet to see NTP deployed in a different way than whe

Re: Filter NTP traffic by packet size?

2014-02-27 Thread Keegan Holley
On Feb 26, 2014, at 12:44 PM, Brandon Galbraith wrote: > On Wed, Feb 26, 2014 at 6:56 AM, Keegan Holley wrote: > > More politely stated, it’s not the responsibility of the operator to decide > > what belongs on the network and what doesn’t. Users can run any services

Re: Managing ACL exceptions (was Re: Filter NTP traffic by packet size?)

2014-02-27 Thread Keegan Holley
nal Message - >> From: "Brandon Galbraith" > >> On Wed, Feb 26, 2014 at 6:56 AM, Keegan Holley >> wrote: >>> More politely stated, it’s not the responsibility of the operator to >>> decide what belongs on the network and what doesn’t. Users can r

Re: Managing IOS Configuration Snippets

2014-02-28 Thread Keegan Holley
nterface IP’s or static routes that may be different across different boxes or location. If you’re referring to the latter I may have misunderstood your question.. > > > On Thu, Feb 27, 2014 at 10:03 PM, Christopher Morrow > wrote: > On Thu, Feb 27, 2014 at 8:38 PM, Keegan Hol

Re: Managing ACL exceptions (was Re: Filter NTP traffic by packet size?)

2014-02-28 Thread Keegan Holley
+1 in my experience uRPF get’s enabled, breaks something or causes confusion (usually related to multi-homing) and then get’s disabled. On Feb 28, 2014, at 11:49 AM, Christopher Morrow wrote: > On Fri, Feb 28, 2014 at 9:02 AM, Ray Soucy wrote: >> If you have uRPF enabled on all your access ro

Re: Managing IOS Configuration Snippets

2014-02-28 Thread Keegan Holley
On Feb 28, 2014, at 9:35 PM, Dale W. Carder wrote: > Thus spake Keegan Holley (no.s...@comcast.net) on Fri, Feb 28, 2014 at > 09:49:19AM -0500: >> I wasn’t saying just fix it. I was saying that router configs don’t lend >> well to versioning. > > Um, what? >

Re: Any experience with Comcast digital voice for OOB (offlist is fine)

2014-03-01 Thread Keegan Holley
As others have said modems require POTS or at least a PBX line. Also isn’t the hand-off fog VoIP ethernet? You wouldn’t be able to stick that into the RJ-11 port in the modem. It would be easier to use the comcast internet connection with some sort of IPsec tunnel for OOB. It’s cheap and mos

Re: How to catch a cracker in the US?

2014-03-13 Thread Keegan Holley
I’ve seen past employers contact the FBI for a similar issue, but we had control of the network and logs in question so that made it easier. You may be able to contact interpol or a similar agency in the EU. They will at least be able to tell you the right agency to call. You can also have a

Re: Level 3 blames Internet slowdowns on Technica

2014-03-21 Thread Keegan Holley
On Mar 21, 2014, at 12:13 PM, Naslund, Steve wrote: > We don't know because the service provider rolls that cost up along with the > services they sell. That is my point. They are able to spread the costs out > based on the profitable services they sell. If they were not able to sell us >

Re: Level 3 blames Internet slowdowns on Technica

2014-03-21 Thread Keegan Holley
How come no one ever asks if competition is required? On Mar 20, 2014, at 11:47 PM, David Miller wrote: > Unless I am reading the tea leaves wrong "competition" will require > "regulation". > > > > Original message > From: "Mike." > Date: 03/20/2014 21:56 (GMT-05:00) >

Re: competition (was: Level 3 blames Internet slowdowns on Technica)

2014-03-21 Thread Keegan Holley
On Mar 21, 2014, at 2:21 PM, Jared Mauch wrote: > > On Mar 21, 2014, at 2:08 PM, Keegan Holley wrote: > >> How come no one ever asks if competition is required? > > I think the issue here is there is competition, but those you are seen as > competing with a

Re: What's a reasonable attack surface? (was: Re: wet-behind-the-ears whippersnapper yada yada)

2011-09-21 Thread Keegan Holley
I think people tend to go overboard in the planning phases for something like this. I remember rumors of a certain large ISP getting along fine for several years installing routers with a password like "getsmein". There are plenty of groups that publish guidelines on ISP configuration as well as

Re: Authoritative DNS server for 12.54.94.0/23 PTR

2011-09-27 Thread Keegan Holley
it looks like ATT still answers the queries. I'd assume that any changes would have to be authorized by the customer though. Why not just call Siemens Medical? ; <<>> DiG 9.6.0-APPLE-P2 <<>> -x 12.54.91.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id:

Re: Authoritative DNS server for 12.54.94.0/23 PTR

2011-09-27 Thread Keegan Holley
Looks like I typo'd the third octet. 2011/9/27 Keegan Holley > it looks like ATT still answers the queries. I'd assume that any changes > would have to be authorized by the customer though. Why not just call > Siemens Medical? > > ; <<>> DiG 9.6.0-AP

Re: facebook spying on us?

2011-09-29 Thread Keegan Holley
Well what's making the connection? It looks like unencrypted http, if your social security number and last known addresses are streaming by you should be able to see them. It's a bit of a jump to say that FB (not that I'm particularly fond of them) is spying on you from a single netstat command.

Re: SP / Enterprise design (dis)similarities

2011-10-10 Thread Keegan Holley
2011/10/10 Tom Lanyon > Hi all, > > Looking for some advice or experience in a small enterprise / hosting > provider context. > > There's plenty of BCP information around for SPs in the network design > realm, and I'm curious how much of this applies to enterprises too. > Commonly advised items

Re: SP / Enterprise design (dis)similarities

2011-10-10 Thread Keegan Holley
2011/10/11 Christopher Morrow > On Tue, Oct 11, 2011 at 1:12 AM, Keegan Holley > wrote: > > The definition of clean is also subjective. There are many who would run > > the IGP only for loopbacks and /30's and force everything into BGP even > at > > small scale.

Re: [routing-wg] BGP Update Report

2011-10-15 Thread Keegan Holley
+1 good to get a view from multiple sources even if they are automated. Should be easy enough to filter for those that do not want them. 2011/10/15 William F. Maton Sotomayor > On Sat, 15 Oct 2011, Lynda wrote: > > On 10/15/2011 4:26 AM, Geoff Huston wrote: >> >>> While I am at it, does anyon

Re: 4.2.2.2 acting up? or is it just me?

2011-10-19 Thread Keegan Holley
I can hit it from home (comcast) and from my company's network. 2011/10/19 brian nikell > same > > On Wed, Oct 19, 2011 at 11:15 AM, Lorell Hathcock >wrote: > > > All: > > > > > > > > I am experiencing trouble with reaching 4.2.2.2 right now from my > netblock. > > ASN 23077. > > > > > > > > I

SaudiTelecom

2011-10-21 Thread Keegan Holley
Despite this being a north american list anyone know how I can speak with someone from saudi telecom. Preferably someone with the ever illusive clue?

Re: Colocation providers and ACL requests

2011-10-25 Thread Keegan Holley
Depends on the provider. Many just do not want to manage hundreds of customer ACL's on access routers. Especially when it would compete with a managed service (firewall, IDP, DDOS) of some sort. Some still are under the impression that ACL's are software based and their giant $100k+ edge box wou

Re: Colocation providers and ACL requests

2011-10-25 Thread Keegan Holley
2011/10/25 Brandon Galbraith > On Tue, Oct 25, 2011 at 1:46 PM, Keegan Holley > wrote: > >> Depends on the provider. Many just do not want to manage hundreds of >> customer ACL's on access routers. Especially when it would compete with a >> managed service (f

Re: Colocation providers and ACL requests

2011-10-25 Thread Keegan Holley
I'm assuming colo means hosting, and the OP misspoke. Most colo providers don't provide active network for colo (as in power and rack only) customers. 2011/10/25 Paul Graydon > On 10/25/2011 08:43 AM, Christopher Pilkington wrote: > >> Is it common in the industry for a colocation provider, whe

Re: Colocation providers and ACL requests

2011-10-26 Thread Keegan Holley
2011/10/25 Jay Ashworth > - Original Message - > > From: "Keegan Holley" > > > I'm assuming colo means hosting, and the OP misspoke. Most colo providers > > don't provide active network for colo (as in power and rack only) > customers. >

Re: Colocation providers and ACL requests

2011-10-27 Thread Keegan Holley
2011/10/26 Jay Ashworth > - Original Message - > > From: "Keegan Holley" > > > > - Original Message ----- > > > > From: "Keegan Holley" > > > > > > > I'm assuming colo means hosting, and the OP misspoke

Re: Route server: Route-server.ip.att.net

2011-11-04 Thread Keegan Holley
Did you do a show ip route for 12.122.83.91? It's probably a loopback of the nearest BGP peer it may not be the actual next hop interface IP though. Not sure about the blocked hops, but I can think of a few explanations. Overall the point of that router is to provide a view of the route table an

Re: Bandwidth Upgrade

2011-11-17 Thread Keegan Holley
Start with why you think it's necessary and what happens if mgt doesn't listen. Bandwidth is like electricity in a sense. Either you have what you need or you go belly up until some utility company can give you more juice. If you notice a growth pattern and are trying to get in front of it that'

Re: Bandwidth Upgrade

2011-11-17 Thread Keegan Holley
That depends on the network configuration though. If you have redundant links and one link is at 65% and the other is at 35% or more you won't be able to get through a circuit flap or outage without dropping packets. 2011/11/17 Karl Clapp > Ideally, when our 95th-percentile hits 65% utilizatio

Re: economic value of low AS numbers

2011-11-17 Thread Keegan Holley
Besides standing at the water cooler at 1:23PM on 12/3 telling AS123 jokes I'm not sure a particular AS number has any relevance or any monetary value unless there is scarcity. 2011/11/17 Kevin Loch > Dave Hart wrote: > >> AS path geeks: >> >> At the risk of invoking ire and eliciting compariso

Re: economic value of low AS numbers

2011-11-17 Thread Keegan Holley
2011/11/17 David Conrad > On Nov 17, 2011, at 8:16 AM, Keegan Holley wrote: > > Besides standing at the water cooler at 1:23PM on 12/3 telling AS123 > jokes > > I'm not sure a particular AS number has any relevance or any monetary > value > > unless there is s

Re: economic value of low AS numbers

2011-11-17 Thread Keegan Holley
2011/11/17 Dave Hart > On Thu, Nov 17, 2011 at 18:55, Keegan Holley > wrote: > > I suppose I can't argue with that, but anyone technical enough to know > > what an AS is should know better. Also, would it really count? What if > I > > opened a small ISP in

Re: Looking for a Tier 1 ISP Mentor for career advice.

2011-11-21 Thread Keegan Holley
2011/11/21 > On Sun, 20 Nov 2011 21:40:08 EST, Tyler Haske said: > > > I'm looking for a mentor who can help me focus my career so eventually I > > wind up working at one of the Tier I ISPs as a senior tech. I want to > > handle the big pipes that hold everyone's data. > > OK, so I'm not a mentor

Re: Odd router brokenness

2011-11-23 Thread Keegan Holley
2011/11/23 Saku Ytti > On (2011-11-23 09:41 -0500), Mark Radabaugh wrote: > > > The question is: How does a router break in this manner?It > > appears to unintentionally be doing something different with traffic > > based on the source address, not the destination address.I > > realize

Re: Network device command line interfaces

2011-11-24 Thread Keegan Holley
I may have a different opinion here, but I not sure I'd call any CLI easy to work with. Cisco's training machine is so efficient that some learn IOS before leaving high school, so the fact that we all consider IOS easy to work with is relative. Just look at the "router" command. Most of us know

Re: Network device command line interfaces

2011-11-24 Thread Keegan Holley
e was already some sort of usability guide around that > could be shown to the manufacturers with a "please read this" note attached. > Is anyone aware of such a thing? > > > Jonathon. > > > From: Keegan Holley [mailto:keegan.hol...@sungard.com] > Sent: Friday, 25 N

Equinix

2011-11-29 Thread Keegan Holley
Assuming it's not owned by the NSA does anyone know the address of the equnix colo in the Denver area? I'm working on pricing access circuits into it. A contact from equinix would be helpful as well. We haven't gotten a response to our queries. Regards, Keegan

Re: On Working Remotely

2011-12-04 Thread Keegan Holley
Maybe I have a different personality, but I find it much easier to work from home (provided home is empty). I think "networking" from home, which I do periodically during the week is different from coding from home which I do on the weekends. It does take some getting used to. I find I'm much mo

Writable SNMP

2011-12-06 Thread Keegan Holley
For a few years now I been wondering why more networks do not use writable SNMP. Most automation solutions actually script a login to the various equipment. This comes with extra code for different vendors, different prompts and any quirk that the developer is aware of and constant patches as new

Re: Writable SNMP

2011-12-06 Thread Keegan Holley
2011/12/6 Christopher Morrow > On Tue, Dec 6, 2011 at 11:16 AM, Jared Mauch > wrote: > > > > On Dec 6, 2011, at 11:07 AM, Keegan Holley wrote: > > > >> For a few years now I been wondering why more networks do not use > writable > >> SNMP. Most au

Re: Writable SNMP

2011-12-07 Thread Keegan Holley
> > > There's no reason one can't program a device with SNMP, the main issue > IMHO > > has always been what I dubbed "config drift". You have your desired > > configuration and variances that happen over time. If you don't force > > a 'wr mem' or similar event after you trigger a 'copy tftp run'

Re: Writable SNMP

2011-12-07 Thread Keegan Holley
> > > > I can see the other comments about interactive commands and bulk > > read/writes, but what's the harm of doing it on internet connected boxes > vs. > > non-internet boxes. Just about everyone uses snmp reads in the interwebs > > I think the general feeling is that snmp is udp so it's spoof

Re: Writable SNMP

2011-12-09 Thread Keegan Holley
> > > > assumption that writable SNMP was a bad idea but have never actually > tried > > it. I was curious what others were using, netconf or just scripted > logins. > > I'm also fighting a losing battle to convince people that netconf isn't > > evil. It strikes me as odd that if I wanted to talk

Re: Writable SNMP

2011-12-09 Thread Keegan Holley
2011/12/9 Joel jaeggli > On 12/9/11 18:22 , Keegan Holley wrote: > >> > >> > >>> assumption that writable SNMP was a bad idea but have never actually > >> tried > >>> it. I was curious what others were using, netconf or just scripted &

Re: Writable SNMP

2011-12-09 Thread Keegan Holley
> > > > In lieu of a software upgrade, a workaround can be applied to certain IOS > > releases by disabling the ILMI community or "*ilmi" view and applying an > > access list to prevent unauthorized access to SNMP. Any affected system, > > regardless of software release, may be protected by filteri

Re: Sad IPv4 story?

2011-12-10 Thread Keegan Holley
Sent from my iPhone On Dec 10, 2011, at 2:58 AM, Randy Bush wrote: >> I just had a personal email from a brand new ISP in the Asia-Pacific >> area desperately looking for enough IPv4 to be able to run their >> business the way they would like… > > and we are supposed to be surprised or feel s

Re: Sad IPv4 story?

2011-12-10 Thread Keegan Holley
2011/12/10 > On Sat, Dec 10, 2011 at 03:15:01AM -0500, Keegan Holley wrote: > > > > > > Sent from my iPhone > > > > On Dec 10, 2011, at 2:58 AM, Randy Bush wrote: > > > > >> I just had a personal email from a brand new ISP in the Asia-Pacific

Re: Your Christmas Bonus Has Arrived

2011-12-13 Thread Keegan Holley
Do the blocks have to come from a company I still work for? If not I have a boat load.. 2011/12/13 IPv4 Brokers > Do you have subnets that are not in use, or only used for specific > purposes? If so, please contact us. > > We are paying up-front (or escrow) for the use of networks that are n

Re: Your Christmas Bonus Has Arrived

2011-12-13 Thread Keegan Holley
... Heh > > ipv4brok...@gmail.com > > -.- > > If domain squatting and patent trolling are both legitimate sometimes multi-million dollar businesses are you really surprised?

Re: Range using single-mode SFPs across multi-mode fiber - was Re: NANOG Digest, Vol 47, Issue 56

2011-12-14 Thread Keegan Holley
> > inappropriate. We are attempting to use Juniper single-mode SFPs (LX > > variety) across multi-mode fiber. Standard listed distance is always > > for SFPs using the appropriate type of fiber. Does anyone out there > > know how much distance we are likely to get? Thanks for your help in > > adva

Re: Range using single-mode SFPs across multi-mode fiber - was Re: NANOG Digest, Vol 47, Issue 56

2011-12-14 Thread Keegan Holley
2011/12/14 Justin M. Streiner > On Wed, 14 Dec 2011, Keegan Holley wrote: > > inappropriate. We are attempting to use Juniper single-mode SFPs (LX >>>> variety) across multi-mode fiber. Standard listed distance is always >>>> for SFPs using the appropriate typ

Re: Range using single-mode SFPs across multi-mode fiber

2011-12-14 Thread Keegan Holley
2011/12/14 Jeff Kell > On 12/14/2011 3:37 PM, Keegan Holley wrote: > > > Single mode just has a smaller core size for the smaller "beam" emitted > by > > laser vs. LED. it works although I've never done it outside of a lab (MM > > is cheaper). As for th

Re: Range using single-mode SFPs across multi-mode fiber

2011-12-14 Thread Keegan Holley
2011/12/14 oliver rothschild > Thanks to all who responded to my clumsy first question (both on > matters of etiquette and technology). The group I work with (we are a > small project acting as a last mile provider) was in the midst of > deploying this solution when I posed the question. We put t

Re: Range using single-mode SFPs across multi-mode fiber

2011-12-14 Thread Keegan Holley
I stand corrected, but I haven't dealt much with 100BASE-FX. I was just talking in terms of 1G/10G. 2011/12/14 Mark Foster > On 15/12/11 16:38, Keegan Holley wrote: > > 2011/12/14 oliver rothschild > > Thanks to all who responded to my clumsy first question (both on &g

local_preference for transit traffic?

2011-12-14 Thread Keegan Holley
Had in interesting conversation with a transit AS on behalf of a customer where I found out they are using communities to raise the local preference of routes that do not originate locally by default before sending to a other larger transit AS's. Obviously this isn't something that was asked of th

Re: local_preference for transit traffic?

2011-12-14 Thread Keegan Holley
r > some years now, and checking periodically for the expected path, as it > became obvious from investigating traceroutes that traffic was not being > routed as intended using AS prepends. > > -Original Message- > From: Keegan Holley [mailto:keegan.hol...@sungard.com] >

Re: local_preference for transit traffic?

2011-12-14 Thread Keegan Holley
tomer traffic to their peers without complaint? 2011/12/15 Jeff Wheeler > On Thu, Dec 15, 2011 at 1:07 AM, Keegan Holley > wrote: > > Had in interesting conversation with a transit AS on behalf of a customer > > where I found out they are using communities to raise the local >

Re: local_preference for transit traffic?

2011-12-15 Thread Keegan Holley
2011/12/15 Mark Tinka > On Thursday, December 15, 2011 10:42:37 PM Leo Bicknell > wrote: > > > However, there may be a simpler explanation. If you bill > > by the bit as a transit provider it's in your best > > interest to make sure your customer gets as many bits > > through you as possible. P

Savvis Route Server/Looking Glass

2011-12-18 Thread Keegan Holley
Does anyone know of a working Savvis route server or looking glass. The http://as3561lg.savvis.net/lg.html site doesn't seem to be able to query BGP routes. For example it says they don't have a route to 12.0/9 which seems to be a pretty common aggregate. The traceroute tool works normally thoug

Re: IPTV and ASM

2011-12-28 Thread Keegan Holley
Isn't source discovery and efficiency a big concern for ASM? If individual streams are tied to a specific source then it's possible to live without some of the overhead involved in ASM. Joins go straight to the source, traffic is disseminated via direct paths instead of being replicated by the RP

Re: Notifying customers of upstream modifications

2011-12-28 Thread Keegan Holley
Most transit networks have some sort of blanket notification that they can send to customers. Something like between 12AM and 6AM sometime next week you may or may not have a moderate or severe impact, but we're not going to give you details. It also depends on the peering that is being added or

Polling Bandwidth as an Aggregate

2012-01-19 Thread Keegan Holley
re an easy way to do this with cacti/rrd or another open source kit? Keegan Holley ▪ Network Architect  ▪ SunGard Availability Services ▪ 401 North Broad St. Philadelphia, PA 19108 ▪ (215) 446-1242 ▪ keegan.hol...@sungard.com Keeping People and Information Connected® ▪

Re: Polling Bandwidth as an Aggregate

2012-01-20 Thread Keegan Holley
Thanks all for the responses. I think I'm going to use cacti and plugins to aggregate. Aggregated billing is kind of something that would be nice to have but wasn't required. It's nice to know there are concerns with using cacti for this. My last question is if there is any easy/automated way t

Re: Polling Bandwidth as an Aggregate

2012-01-20 Thread Keegan Holley
Is there a plugin for MRTG that allows you to go back to specific times? I like MRTG better for this as well but cacti's graphs are much more flexible. 2012/1/20 Leo Bicknell > In a message written on Fri, Jan 20, 2012 at 10:36:38AM -0500, Keegan > Holley wrote: > > using ca

Re: Polling Bandwidth as an Aggregate

2012-01-20 Thread Keegan Holley
2012/1/20 Chris Adams > Once upon a time, Leo Bicknell said: > > To suggest Netflow is more accurate than rrdtool seems rather strange > > to me. It can be as accurate, but is not the way most people > > deploy it. > > Comparing Netflow to RRDTool is comparing apples to cabinets; one is a > so

Re: MD5 considered harmful

2012-01-27 Thread Keegan Holley
2012/1/27 Jared Mauch : > > On Jan 27, 2012, at 3:52 PM, Patrick W. Gilmore wrote: > >> Your network, your decision.  On my network, we do not do MD5.  We do more >> traffic than anyone and have to be in the top 10 of total eBGP peering >> sessions on the planet.  Guess how many times we've seen

Re: MD5 considered harmful

2012-01-27 Thread Keegan Holley
2012/1/27 Jeff Wheeler : > On Fri, Jan 27, 2012 at 6:35 PM, Keegan Holley > wrote: >> realizes that it's ok to let gig-e auto-negotiate.  I've never really >> seen MD5 cause issues. > > I have run into plenty of problems caused by MD5-related bugs. >

Re: ARP is sourced from loopback address

2012-01-30 Thread Keegan Holley
Even though TCP dump doesn't show it the ARP packets should have a source mac address that is reachable on the link. I think the reply is unicast to that mac address regardless of the IP in the request. Otherwise the receiving station would have to do an arp request for the source IP in the packet

Re: MD5 considered harmful

2012-01-30 Thread Keegan Holley
I suppose so but BFD certainly has alot more moving parts then adding MDF checksums to an existing control packet. I'm not saying everyone should turn it on or off for that matter. I just don't see what the big deal is. Most of the shops I've seen have it on because of some long forgotten engine

Re: ARP is sourced from loopback address

2012-01-31 Thread Keegan Holley
: Request who-has 192.168.76.1 tell 209.54.140.64, length > 28 > > ^C > > > root@debian31:~# ifconfig eth1 > eth1      Link encap:Ethernet  HWaddr 00:0c:29:b8:2a:14 >          inet addr:192.168.76.16  Bcast:192.168.76.255  Mask:255.255.255.0 > > > > > Keegan

Re: Hijacked Network Ranges

2012-01-31 Thread Keegan Holley
You can break your blocks into /24's or smaller and readvertise them to your upstreams. You can also modify local preference using community tags with most upstreams. If you have tier 1 peerings you may be able to get them to filter the bad routes if you can prove they were assigned to you by ARI

Re: Hijacked Network Ranges

2012-01-31 Thread Keegan Holley
2012/1/31 Justin M. Streiner > On Tue, 31 Jan 2012, Grant Ridder wrote: > > What is keeping you from advertising a more specific route (i.e /25's)? >> > > Many providers filter out anything longer (smaller) than /24. > Some will accept it but not propagate it upstream. This may be useful in re

Re: Hijacked Network Ranges - paging Cogent and GBLX/L3

2012-01-31 Thread Keegan Holley
To be honest I haven't had much success it convincing a tier 1 to modify someone else's routes on my behalf for whatever reason. I also have had limited success in getting them to do anything quickly. I'd first look to modify your advertisements as much as possible to mitigate the issue and then

Re: [#135346] Unauthorized BGP Announcements (follow up to Hijacked Networks)

2012-01-31 Thread Keegan Holley
That may not be a bad idea. Have you gotten your company's lawyers involved? They may be able to get some sort of court action started and get things moving. They may also be able to compel the ISP's to act. 2012/1/31 Kelvin Williams > I hope none of you ever get hijacked by a spammer housed a

Re: UDP port 80 DDoS attack

2012-02-05 Thread Keegan Holley
There aren't very many ways to combat DDOS. That's why it's so popular. Some ISP's partner with a company that offers a tunnel based scrubbing service where they DPI all your traffic before they send it to you. If you only have a few upstreams it may be helpful to you. I spoke to them last year

Re: UDP port 80 DDoS attack

2012-02-05 Thread Keegan Holley
se against DDOS. 2012/2/5 Dobbins, Roland > > On Feb 6, 2012, at 7:21 AM, Keegan Holley wrote: > > > There aren't very many ways to combat DDOS. > > Start with the various infrastructure/host/service BCPs, and S/RTBH, as > outlined in this preso: > >

Re: UDP port 80 DDoS attack

2012-02-05 Thread Keegan Holley
2012/2/5 Dobbins, Roland > > On Feb 6, 2012, at 8:10 AM, Keegan Holley wrote: > > > An entire power point just to recommend ACL's, uRPF, CPP, DHCP snooping, > and RTBH? > > Actually, no, that isn't the focus of the preso. > > > The first four will

Re: UDP port 80 DDoS attack

2012-02-05 Thread Keegan Holley
2012/2/5 Dobbins, Roland > > On Feb 6, 2012, at 8:37 AM, Keegan Holley wrote: > > > Source RTBH often falls victim to rapidly changing or spoofed source > IP"s. > > S/RTBH can be rapidly shifted in order to deal with changing purported > source IPs, and it isn

Re: UDP port 80 DDoS attack

2012-02-05 Thread Keegan Holley
2012/2/5 Steve Bertrand > On 2012.02.05 20:37, Keegan Holley wrote: > >> 2012/2/5 Dobbins, Roland >> > > S/RTBH - as opposed to D/RTBH - doesn't kill the patient. Again, suggest >>> you read the preso. >>> >>> >> Source RTBH often

Re: UDP port 80 DDoS attack

2012-02-06 Thread Keegan Holley
2012/2/6 Jeff Wheeler > On Mon, Feb 6, 2012 at 8:43 PM, Sven Olaf Kamphuis > wrote: > > there is a fix for it, it's called "putting a fuckton of ram in -most- > > routers on the internet" and keeping statistics for each destination > > ip:destination port:outgoing interface so that none of them

Re: UDP port 80 DDoS attack

2012-02-08 Thread Keegan Holley
2012/2/8 George Bonser > > > > -Original Message- > > From: bas > > Sent: Tuesday, February 07, 2012 11:56 PM > > To: Dobbins, Roland; nanog > > Subject: Re: UDP port 80 DDoS attack > > > > Say eyeball provider X has implemented automated S/RTBH, and I have a > > grudge against them. > >

Re: UDP port 80 DDoS attack

2012-02-08 Thread Keegan Holley
eturn traffic to come in a different link for some reason. ISP's would suddenly become giant traffic registries. 2012/2/8 George Bonser > > > >From: Keegan Holley > > >How do you stop it? > > A provider knows what destination IP traffic they route TO a customer, &

Re: UDP port 80 DDoS attack

2012-02-08 Thread Keegan Holley
Providers don't even check the registries for bgp advertisements. See the thread on hijacked routes for proof. Not to mention how do you handle a small transit AS? Do you trust that they have the correct filters as well? Do you start reading their AS paths and try to filter based on the regi

Re: UDP port 80 DDoS attack

2012-02-08 Thread Keegan Holley
On Feb 8, 2012, at 4:51 AM, George Bonser wrote: > > >> From: Keegan Holley >> Subject: Re: UDP port 80 DDoS attack > >> It works in theory, but to get every ISP and hosting provider to ACL their >> edges and maintain those ACL's for every customer

Re: UDP port 80 DDoS attack

2012-02-08 Thread Keegan Holley
2012/2/8 Dobbins, Roland > On Feb 8, 2012, at 8:07 PM, bas wrote: > > > As far as I see it S/RTBH is in no way a solution against smart > attackers, of course it does help against all the kiddie attacks out > > there. > > Once again, I've used S/RTBH myself and helped others use it many, many > t

Re: UDP port 80 DDoS attack

2012-02-08 Thread Keegan Holley
2012/2/8 George Bonser > > 77% of all networks seem to think so. > > http://spoofer.csail.mit.edu/summary.php > > And it would be the remaining 23% that really need to understand how > difficult they are making life for the rest of the Internet. > 23% of 4.29 billion addresses is still more than

Re: UDP port 80 DDoS attack

2012-02-09 Thread Keegan Holley
2012/2/8 Steve Bertrand > On 2012.02.08 14:23, Drew Weaver wrote: > >> Stop paying transit providers for delivering spoofed packets to the edge >> of your network and they will very quickly develop methods of proving that >> the traffic isn't spoofed, or block it altogether. =) >> > > I firmly be

Re: Common operational misconceptions

2012-02-16 Thread Keegan Holley
Alot of people are unclear on how hard it is for someone to sniff internet traffic if the aren't physically located at or near one of the endpoints IE: connected to the same access point or same switch. 2012/2/15 John Kristoff > Hi friends, > > As some of you may know, I occasionally teach netw

Re: time sink 42

2012-02-16 Thread Keegan Holley
If you're building a datacenter probably not. Other than giving the remote hands some identifier and making them label the servers themselves. If you're at a conference you could get away with using masking tape and a sharpie. If you think it was time consuming applying the labels wait until you

Re: Programmers with network engineering skills

2012-02-28 Thread Keegan Holley
+1 on both. Senior network guys learn programming/scripting as a way to automate configuration and deal with large amounts of data. It's an enhancement for us and most network people are willing to expand their programming skills given the time. On the other hand there are way too many jobs wher

Re: Programmers with network engineering skills

2012-03-02 Thread Keegan Holley
2012/3/2 Randy Bush > > In my experience the path of least resistance is to get a junior > > network engineer and mentor he/she into improving his/hers programming > > skills than go the other way around. > > and then the organization pays forever to maintain the crap code while > the kiddie lear

Re: Programmers with network engineering skills

2012-03-05 Thread Keegan Holley
2012/3/2 Randy Bush > >>> In my experience the path of least resistance is to get a junior > >>> network engineer and mentor he/she into improving his/hers programming > >>> skills than go the other way around. > >> > >> and then the organization pays forever to maintain the crap code while > >>

Re: Programmers with network engineering skills

2012-03-05 Thread Keegan Holley
2012/3/5 Owen DeLong > Given my experience to date with the assumptions made by programers about > networking in the following: > >Apps (iOS apps, Droid apps, etc.) >Consumer Electronics >Microcontrollers >Home Routers > > I have to say that the strategy being used

Re: Whitelist of update servers

2012-03-12 Thread Keegan Holley
2012/3/12 Maverick > Is there a whitelist that applications have to talk to in order to > update themselves? > > sometimes

Re: Whitelist of update servers

2012-03-12 Thread Keegan Holley
2012/3/12 Maverick > Like list of sites that operating systems or applications installed on > your machines go to update themselves. One way could be to go on each > vendors site and look at their update servers like > microsoft.update.com but it would be good if there is a list of such > servers

Re: Programmers with network engineering skills

2012-03-12 Thread Keegan Holley
2012/3/12 Tei > On 12 March 2012 09:59, Carlos Martinez-Cagnazzo > wrote: > > Hey! > > > > On 3/8/12 8:24 PM, Lamar Owen wrote: > >> On Monday, March 05, 2012 09:36:41 PM Jimmy Hess wrote: > >> ... > >>>(16) The default gateway's IP address is always 192.168.0.1 > >>>(17) The user porti

Re: Programmers with network engineering skills

2012-03-12 Thread Keegan Holley
On Mar 12, 2012, at 5:32 PM, Owen DeLong wrote: > > On Mar 12, 2012, at 2:12 PM, Keegan Holley wrote: > >> 2012/3/12 Tei >> >>> On 12 March 2012 09:59, Carlos Martinez-Cagnazzo >>> wrote: >>>> Hey! >>>> >>>> On 3/

Re: Verizon FiOS - is BGP an option?

2012-03-14 Thread Keegan Holley
In defense of the tier 1's it's not as easy as it looks to run BGP with the lower end business customers. On the technical side the edge boxes and links to them would be as overloaded with routes and peers and all of the other PE boxes in an ISP network. Not to mention the changes in routing poli

Re: Looking for some diversity in Alabama that does not involve ATT Fiber

2012-03-21 Thread Keegan Holley
I feel a topic shift coming... 2012/3/21 Jay Ashworth > - Original Message - > > From: "Eric Wieling" > > > I don't know about AT&T, but Verizon physically removes the copper > > connections when they install fiber into a building. Oddly, this is > > legal. Verizon is required to open

Re: last mile, regulatory incentives, etc (was: att fiber, et al)

2012-03-22 Thread Keegan Holley
2012/3/22 Jared Mauch > > On Mar 22, 2012, at 11:05 AM, chris wrote: > > > I'm all for VZ being able to reclaim it as long as they open their fiber > > which I don't see happening unless its by force via government. At the > end > > of the day there needs to be the ability to allow competitors in

  1   2   >