Re: tool to wrangle config file changes

2010-08-18 Thread Alexander Merniy
I'm using this for configuration backup: http://nocproject.org/ On 19/08/2010, at 5:16 AM, Rogelio wrote: Long story short, a really crappy vendor is being shoved down our NOC's throat. They have a horrid CLI (if you can call it that). People don't understand it (it's non-intuitive) and are sc

Re: (cisco, or any) acl *reducers* out there?

2010-08-18 Thread George Michaelson
On 19/08/2010, at 1:38 PM, Randy Bush wrote: > one more comment. be careful aggregating filters. the peer may > actually announce all those damed frags, especially in massively > de-aggregated places such as india, indonesia, ... > > randy I should have been clearer that I really only want t

Re: (cisco, or any) acl *reducers* out there?

2010-08-18 Thread Randy Bush
one more comment. be careful aggregating filters. the peer may actually announce all those damed frags, especially in massively de-aggregated places such as india, indonesia, ... randy

Re: Numbering nameservers and resolvers

2010-08-18 Thread Lyndon Nerenberg
because most of the end users who would be querying it are in Canada, and, with one nameserver in Canada and one in Japan, they would get a long RTT on DNS queries roughly half the time. But only, say, once per week if you're running a reasonable TTL on your zone.

Re: (cisco, or any) acl *reducers* out there?

2010-08-18 Thread George Michaelson
On 19/08/2010, at 1:00 PM, Randy Bush wrote: >> something which can take a couple of hundred basic and extended ACLs and >> tell you >> these don't work >> these conflict >> the remaining have a sequence and can reduce to this basic set > > maybe you could go the other direction. as oppose

Re: Numbering nameservers and resolvers

2010-08-18 Thread Phil Vandry
On Tue, Aug 17, 2010 at 08:52:20AM -0400, Jared Mauch wrote: > Selecting a site outside of your control is valuable. When I was > hostmas...@cic.net, we "traded" with mr.net. These days, if I were > in the same role, I would want to have three instead of two. Asia, > Europe and US someplace. If

Re: (cisco, or any) acl *reducers* out there?

2010-08-18 Thread Randy Bush
> something which can take a couple of hundred basic and extended ACLs and tell > you > these don't work > these conflict > the remaining have a sequence and can reduce to this basic set maybe you could go the other direction. as opposed to trying to digest and correct cruft, generate the

Re: (cisco, or any) acl *reducers* out there?

2010-08-18 Thread Christopher Morrow
On Wed, Aug 18, 2010 at 8:47 PM, Dobbins, Roland wrote: > > On Aug 19, 2010, at 7:38 AM, George Michaelson wrote: > >> (we've got the usual "acquisition of rule by accretion" problem across 4 >> edge/core routers with a mix of public facing, internal, WiFi, guest rules, >> and I hate to think th

Re: (cisco, or any) acl *reducers* out there?

2010-08-18 Thread Dobbins, Roland
On Aug 19, 2010, at 7:38 AM, George Michaelson wrote: > (we've got the usual "acquisition of rule by accretion" problem across 4 > edge/core routers with a mix of public facing, internal, WiFi, guest rules, > and I hate to think this is either start from scratch, or intractable. The > evidence

(cisco, or any) acl *reducers* out there?

2010-08-18 Thread George Michaelson
I have been looking at acl management s/w in the freecode space and I can find lots of tools which manage/distribute and test ACLs in routers. I'm wondering if anyone has written a parser which can construct rule-trees and get rid of the cruft, unusable, order-misorder and other issues in a larg

tool to wrangle config file changes

2010-08-18 Thread Rogelio
Long story short, a really crappy vendor is being shoved down our NOC's throat. They have a horrid CLI (if you can call it that). People don't understand it (it's non-intuitive) and are screwing up things all the time. In the hopes of coping with the madness, some of us are looking to put togethe

Re: end-user ipv6 deployment and concerns about privacy

2010-08-18 Thread Hannes Frederic Sowa
On Wed, Aug 18, 2010 at 11:41 PM, Jack Bates wrote: > Web portals work fine, and honestly, it's not like you need to switch > subnets, either. PPPoE/A implementations work great, as they are already > designed to utilize radius backends to quickly alter static/dynamic on a > session. For bridging s

Re: end-user ipv6 deployment and concerns about privacy

2010-08-18 Thread Hannes Frederic Sowa
On Wed, Aug 18, 2010 at 11:16 PM, Mark Smith wrote: > They help because you're concerned about privacy. You didn't qualify > that you're only concerned about privacy from geolocation services, so > I described a mechanism that would provide you as much privacy as > possible, while also being automa

Re: end-user ipv6 deployment and concerns about privacy

2010-08-18 Thread Mark Smith
On Wed, 18 Aug 2010 20:04:47 +0930 Mark Smith wrote: > On Wed, 18 Aug 2010 01:12:19 +0200 > Hannes Frederic Sowa wrote: > > > Hello! > > > > As the first IPv6 deployments for end-users are in the planning stage > > in Germany, I realized I have not found any BCP for handling > > addressing in

Re: end-user ipv6 deployment and concerns about privacy

2010-08-18 Thread Jack Bates
Hannes Frederic Sowa wrote: the other one will be dynamically allocated. I have no clue how the user would switch between these subnets (without using some kind of command line tools). Web portals work fine, and honestly, it's not like you need to switch subnets, either. PPPoE/A implementation

Re: end-user ipv6 deployment and concerns about privacy

2010-08-18 Thread Mark Smith
On Wed, 18 Aug 2010 16:18:00 +0200 Hannes Frederic Sowa wrote: > On Wed, Aug 18, 2010 at 12:34 PM, Mark Smith wrote: > > Haven't really thought about it before. > > > > One thing to consider is that unless the preferred and valid lifetimes > > of an IPv6 prefix are set to infinity, IPv6 prefixes

Re: iPhone updates and required bandwidth

2010-08-18 Thread JoeSox
Thank you. this is good info. -- Joe On Wed, Aug 18, 2010 at 12:29 PM, Joachim Tingvold wrote: > On Wed, Aug 18, 2010, at 21:20:52PM GMT+02:00, Greg Whynott wrote: >> >> perhaps a squid caching server in-between the device network and internet? > > That would be my suggestion, as well. iTunes p

Re: iPhone updates and required bandwidth

2010-08-18 Thread Brandon Galbraith
On Wed, Aug 18, 2010 at 2:29 PM, Jared Mauch wrote: > I'm sure if you approached the CDN that hosts the #apple updates they would > be willing to put a copy of swcdn.apple.com on your network, as well as > appldnld.apple.com > > The squid user forums have lots of tips about how to do this for

Re: iPhone updates and required bandwidth

2010-08-18 Thread Justin Wilson
Apple is ultra protective of their mobile stuff. It¹s just going to get worse in the attempts to circumvent the devices being ³Jailbroken². Quite a bit of behind the scenes checksums and re-checks going on. They want to make sure the device cleanly downloads, cleanly installs, and is not tam

Re: iPhone updates and required bandwidth

2010-08-18 Thread Jared Mauch
On Aug 18, 2010, at 3:20 PM, Greg Whynott wrote: > sorry Joe if i wasn't clear, what i was trying to say is I know there is a > solution to address the bandwidth issue caused by updates for OS X machines, > I am unsure if they have a similar solution for their hand held devices. > I am a

Re: iPhone updates and required bandwidth

2010-08-18 Thread Joachim Tingvold
On Wed, Aug 18, 2010, at 21:20:52PM GMT+02:00, Greg Whynott wrote: perhaps a squid caching server in-between the device network and internet? That would be my suggestion, as well. iTunes pulls the updates from appldnld.apple.com.edgesuite.net or appldnld.apple.com, so you'd only need to ca

Re: iPhone updates and required bandwidth

2010-08-18 Thread Greg Whynott
sorry Joe if i wasn't clear, what i was trying to say is I know there is a solution to address the bandwidth issue caused by updates for OS X machines, I am unsure if they have a similar solution for their hand held devices.I am assuming they do or soon will. I'm on the road right now,

Re: iPhone updates and required bandwidth

2010-08-18 Thread JoeSox
Interesting. Do you have to configure the iPhone devices or just use its standard settings? -- Thanks, Joe On Wed, Aug 18, 2010 at 12:03 PM, Greg Whynott wrote: > I set up an OS X server which hosts updates for the rest of the company,  so > the OS X client machines poll/pull updates from the

Re: iPhone updates and required bandwidth

2010-08-18 Thread David E. Smith
On Wed, Aug 18, 2010 at 13:54, JoeSox wrote: > Am I the only one that gets ticked off at the Apple iPhone update > procedure and the amount of bandwidth it needs? > Is there any secret I am missing to cut down on the required bandwidth > needed for it (caching the update somewhere etc)? I don't

Re: iPhone updates and required bandwidth

2010-08-18 Thread Greg Whynott
I set up an OS X server which hosts updates for the rest of the company, so the OS X client machines poll/pull updates from the internal machine as opposed to 100 of them pulling the same updates over the internet. saves bucket loads of bandwidth and you can "pre ok" individual packages, so

iPhone updates and required bandwidth

2010-08-18 Thread JoeSox
Am I the only one that gets ticked off at the Apple iPhone update procedure and the amount of bandwidth it needs? Is there any secret I am missing to cut down on the required bandwidth needed for it (caching the update somewhere etc)? I don't own an iPhone (DroidX user here) and am unfamiliar with

Re: end-user ipv6 deployment and concerns about privacy

2010-08-18 Thread Hannes Frederic Sowa
On Wed, Aug 18, 2010 at 12:34 PM, Mark Smith wrote: > Haven't really thought about it before. > > One thing to consider is that unless the preferred and valid lifetimes > of an IPv6 prefix are set to infinity, IPv6 prefixes are always dynamic > - they'll eventually expire unless they're refreshed.

Re: Numbering nameservers and resolvers

2010-08-18 Thread Robert E. Seastrom
Mikael Abrahamsson writes: > On Tue, 17 Aug 2010, Nick Olsen wrote: > >> So lets say that you have multiple DNS resolvers in the same ip space that >> you advertise from multiple locations. All would be fine for the most part. >> But if you had a location equidistant network wise from two POP's

Re: end-user ipv6 deployment and concerns about privacy

2010-08-18 Thread Mark Smith
On Wed, 18 Aug 2010 01:12:19 +0200 Hannes Frederic Sowa wrote: > Hello! > > As the first IPv6 deployments for end-users are in the planning stage > in Germany, I realized I have not found any BCP for handling > addressing in those scenarios. IPv6 will make it a lot easier for > static address de

Re: end-user ipv6 deployment and concerns about privacy

2010-08-18 Thread Marco Hogewoning
On 18 aug 2010, at 09:35, Hannes Frederic Sowa wrote: > On Wed, Aug 18, 2010 at 7:53 AM, Marco Hogewoning wrote: >> >> On 18 aug 2010, at 01:12, Hannes Frederic Sowa wrote: >> >>> prefer static addressing. But in the world of facebook and co. I >>> wonder if it would be a better to let the use

Re: Recycling old cabling?

2010-08-18 Thread Ricky Beam
On Wed, 18 Aug 2010 02:38:12 -0400, wrote: I worked with a company that threw away / recycled nearly an entire 100k sq. foot datacenter. All of the gear still in working order. It's just one those things... There are constraints beyond the logic of "common sense". And it flows from the a

Re: end-user ipv6 deployment and concerns about privacy

2010-08-18 Thread Hannes Frederic Sowa
On Wed, Aug 18, 2010 at 7:12 AM, Mikael Abrahamsson wrote: > For people who want to use DNS and run services, they'll most likely want a > static address/subnet that doesn't change in the first place (even though it > should be handed out via DHCPv6-PD for ease). If someone wants to be > anonymous

Re: end-user ipv6 deployment and concerns about privacy

2010-08-18 Thread Hannes Frederic Sowa
On Wed, Aug 18, 2010 at 7:53 AM, Marco Hogewoning wrote: > > On 18 aug 2010, at 01:12, Hannes Frederic Sowa wrote: > >> prefer static addressing. But in the world of facebook and co. I >> wonder if it would be a better to let the user have the choice. A > > What does facebook have to do with it ?