Re: Bogon ASN Filter Policy

2016-06-07 Thread Arnold Nipper
On 03.06.2016 15:08, Jay Borkenhagen wrote: > AT&T/as7018 is also now in the process of updating its as-path bogon > filters to match those cited below. We have long employed such > filters, and our changes at this time are primarily to extend them to > prohibit as23456 and the reserved blocks >

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Mikael Abrahamsson
On Wed, 8 Jun 2016, Tore Anderson wrote: I wonder if anyone has attempted to estimate approx. how much RIB/FIB space a single DFZ route requires in total across the entire internet... You mean in money? A lot. The problem is that we have so far no feasible way to make "polluter pay". So peopl

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Mark Andrews
In message <20160608070525.06fd5...@echo.ms.redpill-linpro.com>, Tore Anderson writes: > * Davide Davini > > > On 04/06/2016 20:46, Owen DeLong wrote: > > > Get your own /48 and advertise to HE Tunnel via BGP. Problem > > > solved. > > > > Even though that sounds like an awesome idea it does

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Tore Anderson
* Davide Davini > On 04/06/2016 20:46, Owen DeLong wrote: > > Get your own /48 and advertise to HE Tunnel via BGP. Problem > > solved. > > Even though that sounds like an awesome idea it does not seem trivial > to me to obtain your own /48. Which is a good thing, as every new PI /48 advertise

Re: Netflix banning HE tunnels

2016-06-07 Thread Michael Brown
Or even easier, just block the he.net tunnel networks! Have them reject the traffic‎ so it falls back to IPv4! Better than a vague error message combined with poorly or mistrained ‎support staff. M.   Original Message   From: Elvis Daniel Velea Sent: Tuesday, June 7, 2016 22:12 To: nanog@nanog

Re: Netflix banning HE tunnels

2016-06-07 Thread Ca By
On Tuesday, June 7, 2016, chris wrote: > I disagree. if they have no native v6 then theres no reason why they > shouldnt be able to use the v6 from HE and why should the internet treat > that users traffic any differently because its coming from HE or tunneled? > > This is not about ipv6, it is a

Re: Netflix banning HE tunnels

2016-06-07 Thread chris
I disagree. if they have no native v6 then theres no reason why they shouldnt be able to use the v6 from HE and why should the internet treat that users traffic any differently because its coming from HE or tunneled? Theres also tons of folks affected who arent on HE, arent tunneling, etc. Theres

Re: Netflix banning HE tunnels

2016-06-07 Thread Ca By
On Tuesday, June 7, 2016, chris wrote: > it really feels alot like what net neutrality was supposed to avoid. making > a policy where there is different treatment of one set of bits over another > > "your ipv6 bits are bad but if you turn it off the ipv4 bits are just fine" > > someone mentioned

Re: Netflix banning HE tunnels

2016-06-07 Thread chris
it really feels alot like what net neutrality was supposed to avoid. making a policy where there is different treatment of one set of bits over another "your ipv6 bits are bad but if you turn it off the ipv4 bits are just fine" someone mentioned the fact that netflix is not just a content company

Re: Netflix banning HE tunnels

2016-06-07 Thread Elvis Daniel Velea
apparently, all they see is 3 people complaining on this mailing list.. well, this makes it 4 with me (and I have a bunch of people in various countries complaining on facebook that they have been banned from using netflix because they use an HE tunnel. their answer - TURN IPV6 OFF!!! you're a

RE: syslog server

2016-06-07 Thread Cashell, Christopher P.
There is no "best" when it comes to something like Syslog. There is only "best fit for your requirements". In order to determine that, you'll have to figure out what your goals and requirements are. If you're just trying to do something basic and simple, like get logs from one machine to anot

Re: syslog server

2016-06-07 Thread Andrew Kirch
Journald is excellent. The binary storage format is a huge leap forward. Andrew On Tuesday, June 7, 2016, Grant Ridder wrote: > +1 for ELKK (with kafka) > Doing several hundred GB of log per day with a dozen instances on AWS (ES > cluster + logstash hosts + kafak cluster) > > -Grant > > On Mon,

Re: syslog server

2016-06-07 Thread Grant Ridder
+1 for ELKK (with kafka) Doing several hundred GB of log per day with a dozen instances on AWS (ES cluster + logstash hosts + kafak cluster) -Grant On Mon, Jun 6, 2016 at 11:25 PM, wrote: > On Mon, 06 Jun 2016 14:59:51 -0600, Maximino Velazquez said: > > What is the best syslog server (opensou

Re: Netflix banning HE tunnels

2016-06-07 Thread chris
I am also in the same boat with a whole subnet affected even without a tunnel, tried multiple netflix support channels starting in early march and the ranges is still blocked 3 months later. I was a big fan of the service and somewhat of an addict up till this but I've really been shocked how this

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread bzs
Some of this reminds me of talking to IBM the the other day about problems I was having with their "Rapport Trusteer" security package which one of my banks requires to be running when I try to log in. Invariably the bank claims it's not running, I restart it that software, still no-go, the e

Re: syslog server

2016-06-07 Thread Peter Loron
I’m a big fan of Graylog. -Pete On 6/6/16, 13:59, "NANOG on behalf of Maximino Velazquez" wrote: >Hi nanog community > >I need help !! > >What is the best syslog server (opensource)? > >Thanks for your help > >Regards. > >-- > > > >Max Velazquez | >

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Davide Davini
On 07/06/2016 17:00, Ca By wrote: > fixed line: Comcast, AT&T, TWC, just to name the largest in the nation have > meaningful deployments of ipv6. The only thing holding back greater > deployment for those networks are legacy CPE that will age out slowly. It is probably totally off topic as this is

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Davide Davini
On 04/06/2016 20:46, Owen DeLong wrote: > Get your own /48 and advertise to HE Tunnel via BGP. Problem solved. Even though that sounds like an awesome idea it does not seem trivial to me to obtain your own /48. I mean: "You can only request IPv6 assignments and Autonomous System Numbers through a

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Ca By
On Tuesday, June 7, 2016, Cryptographrix wrote: > Very true - I was being a bit extremist out of frustration, but I think > you're spot on - he.net tunnels and even 6to4 are toys to provide IPv6 > support, not actually IPv6 support. > > And I'm quite frustrated because there's so little actual v6

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Cryptographrix
Very true - I was being a bit extremist out of frustration, but I think you're spot on - he.net tunnels and even 6to4 are toys to provide IPv6 support, not actually IPv6 support. And I'm quite frustrated because there's so little actual v6 support, and I *do* actually need it on a daily basis for

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Ca By
On Tuesday, June 7, 2016, Cryptographrix wrote: > As I said to Netflix's tech support - if they advocate for people to turn > off IPv6 on their end, maybe Netflix should stop supporting it on their > end. > > It's in the air whether it's just an HE tunnel issue or an IPv6 issue at > the moment, a

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread joel jaeggli
On 6/7/16 6:55 AM, Cryptographrix wrote: > As I said to Netflix's tech support - if they advocate for people to turn > off IPv6 on their end, maybe Netflix should stop supporting it on their end. > > It's in the air whether it's just an HE tunnel issue or an IPv6 issue at > the moment, and if thei

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Cryptographrix
As I said to Netflix's tech support - if they advocate for people to turn off IPv6 on their end, maybe Netflix should stop supporting it on their end. It's in the air whether it's just an HE tunnel issue or an IPv6 issue at the moment, and if their tech support is telling people to turn off IPv6,

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Mike Hammett
(not specifically to Cryptographrix) Anyone that expects any consumer-focused support to be able to address any legal or high level technical situation is a fool for having thought appropriate. These sorts of issues are things you start with Tempkin and others that frequent NOGs and other teleco

Re: Netflix banning HE tunnels

2016-06-07 Thread Michael Brown
On 2016-06-07 07:23 AM, Davide Davini wrote: > Who did it say on this ML that the best way to solve these issues is > Netflix tech support? :) Netflix tech support isn't useful for *anything* - even when asked about this specific issue while I was going through my own diagnosis: Me: are you blocki

Re: IPv6 is better than ipv4

2016-06-07 Thread Christopher Morrow
On Tue, Jun 7, 2016 at 7:51 AM, Mikael Abrahamsson wrote: > Slashdot, Github etc, still no IPv6 though. ​oddly github has ipv6 being announced from their ASN: AS​36459 | 2620:112:3000::/44 | GITHUB - GitHub, Inc., US

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Mark Felder
> On Jun 6, 2016, at 22:25, Spencer Ryan wrote: > > The tunnelbroker service acts exactly like a VPN. It allows you, from any > arbitrary location in the world with an IPv4 address, to bring traffic out > via one of HE's 4 POP's, while completely masking your actual location. > Perhaps Netflix

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Mark Felder
> On Jun 6, 2016, at 18:12, Baldur Norddahl wrote: > > It is a bit surprising that your browser would choose the ipv6 path via > tunnel over the more direct ipv4 path. Anyway, you could blackhole the > Netflix ipv6 prefix to force the situation. > On modern Apple devices IPv6 is chosen 99% of

Re: Netflix banning HE tunnels

2016-06-07 Thread Davide Davini
On 07/06/2016 13:23, Davide Davini wrote: > Today I discovered Netflix flagged my IPv6 IP block as "proxy/VPN" and I > can't use it if I don't disable the HE tunnel, which is the only way for > me to have IPv6 at the moment. Apologies I saw the huge thread only after I posted. Ciao, Davide Davini

Re: Monitoring system recommendation

2016-06-07 Thread Mike Hammett
I'm not at that scale, but I've seen some fairly impressive performance searching through a friend's NetXMS system with a couple years of verbose syslog and monitoring to go through. - Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest Internet Exchange ht

Re: syslog server

2016-06-07 Thread Alain Hebert
Well, I'll say an ELK stack, but seeing the original question... I got to ponder on the capacity of the OP. - Alain Hebertaheb...@pubnix.net PubNIX Inc. 50 boul. St-Charles P.O. Box 26770 Beaconsfield, Quebec H9W 6G7 Tel: 514-990

Re: Monitoring system recommendation

2016-06-07 Thread Crier, Brent
We use Zabbix here pretty heavily. Monitoring roughly 10,000 hosts 13,000 interfaces and a mirage of services. -Brent > On Jun 7, 2016, at 2:42 AM, Mikael Falkvidd wrote: > >> >> On Monday, June 6, 2016, Manuel Marín wrote: >> >>> Dear Nanog community >>> >>> We are currently planning to

Re: IPv6 is better than ipv4

2016-06-07 Thread Mikael Abrahamsson
On Tue, 7 Jun 2016, John Curran wrote: There is a large number of Internet service providers who: Not only ISPs, but also content: https://tech.slashdot.org/story/16/06/05/1744246/distrowatch-finally-adds-support-for-ipv6 "When asked why DistroWatch enabled IPv6 access to their server at thi

Re: IPv6 is better than ipv4

2016-06-07 Thread John Curran
On Jun 2, 2016, at 1:38 PM, Mike Hammett wrote: > > I would be surprised if more than 10% - 20% of networks have received > effective marketing on IPv6. > > Look at how many network operators that don't "get" basic network security > alerts like "There is a long since patched vulnerability be

RE: syslog server

2016-06-07 Thread STARNES, CURTIS
+1 on Graylog -Original Message- From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of David Hubbard Sent: Tuesday, June 07, 2016 2:02 AM To: Maximino Velazquez ; nanog@nanog.org Subject: Re: syslog server https://www.graylog.org/ On 6/6/16, 4:59 PM, "NANOG on behalf of Maximino Vela

Netflix banning HE tunnels

2016-06-07 Thread Davide Davini
Today I discovered Netflix flagged my IPv6 IP block as "proxy/VPN" and I can't use it if I don't disable the HE tunnel, which is the only way for me to have IPv6 at the moment. But the fun part has been Netflix tech support: "Oh I see, yeah we have been receiving reports of some other members with

Re: Monitoring system recommendation

2016-06-07 Thread Mikael Falkvidd
> > On Monday, June 6, 2016, Manuel Marín wrote: > > > Dear Nanog community > > > > We are currently planning to upgrade our monitoring system (Opsview) due > to > > scalability issues and I was wondering what do you recommend for > monitoring > > 5000 hosts and 35000 services. We would like to us

Re: Netflix VPN detection - actual engineer needed

2016-06-07 Thread Nikolay Shopik
RDAP is same across RIRs. Yes old REST API was PITA On 07/06/2016 02:08, Ricky Beam wrote: > Yes, ARIN and RIPE have REST APIs, but they're completely different > interfaces with different schemas (and different capabilities.) I have > independent applications for talking to each. And those are th

Re: syslog server

2016-06-07 Thread David Hubbard
https://www.graylog.org/ On 6/6/16, 4:59 PM, "NANOG on behalf of Maximino Velazquez" wrote: >Hi nanog community > >I need help !! > >What is the best syslog server (opensource)? > >Thanks for your help > >Regards. > >-- > > > >Max Velazquez |