Re: RFC becomes Visio

2012-09-28 Thread Nick Hilliard
On 28/09/2012 19:08, Joe Maimon wrote: Just got told by a Lightpath person that in order to do BGP on a customer gig circuit to them they would need a visio diagram (of what I dont know). Has anybody else seen this brain damage? I was once asked by a vendor support department for a network

Re: /. Terabit Ethernet is Dead, for Now

2012-09-27 Thread Nick Hilliard
On 27/09/2012 14:58, Darius Jahandarie wrote: I recall 40Gbit/s Ethernet being promoted heavily for similar reasons as the ones in this article, but then 100Gbit/s being the technology that actually ended up in most places. Could this be the same thing happening? no. the IEEE working group

Re: The Department of Work and Pensions, UK has an entire /8

2012-09-21 Thread Nick Hilliard
On 21/09/2012 00:47, Tony Hain wrote: You are comparing IPv6 to the historical deployment of IPv4. Get with the times and realize that CGN/LSN breaks all those wonderful location-aware apps people are so into now, not to mention raising the cost for operating the network which eventually get

Re: The Department of Work and Pensions, UK has an entire /8

2012-09-21 Thread Nick Hilliard
On 21/09/2012 19:23, Tony Hain wrote: App developers have never wanted to be aware of the network. By not sitting down and thinking about the user experience of a dual-stacked network, we have now forced them to be aware of the network and that's not a good thing because they are as clued out

Re: Real world sflow vs netflow?

2012-09-20 Thread Nick Hilliard
On 20/09/2012 17:59, Peter Phaal wrote: What do people think? Flows are good for measuring some things; raw packet sampling is good for measuring others. Decide on what you're trying to measure, then pick the best tool for the job. Nick

Re: The Department of Work and Pensions, UK has an entire /8

2012-09-20 Thread Nick Hilliard
On 20/09/2012 20:14, Tony Hain wrote: Once the shift starts it will only take 5 years or so before people start asking what all the IPv4 fuss was about. Tony, ipv4 succeeded because it was compelling enough to do so (killer apps of the time: email / news / ftp, later www instead of limited

Re: The Department of Work and Pensions, UK has an entire /8

2012-09-19 Thread Nick Hilliard
On 19/09/2012 22:02, David Conrad wrote: Assuming for the sake of argument that the 51/8 is actually unused (which it apparently isn't), the UK gov't would be under no contractual obligation to return the address space to IANA (which is (arguably) the allocating registry, not RIPE) -- I

Re: The Department of Work and Pensions, UK has an entire /8

2012-09-18 Thread Nick Hilliard
On 18/09/2012 15:07, Eugen Leitl wrote: Department of Work and Pensions UK in Possession of 16.9 Million Unused IPv4 Addresses unused? sez who? Oh, it said it on the internet so it must be true. Other than that, I'm totally failing to see what's newsworthy about who or what happens to hold

Re: Big Temporary Networks

2012-09-18 Thread Nick Hilliard
On 18/09/2012 21:24, William Herrin wrote: IPv6 falls down compared to IPv4 on wifi networks when it responds to a router solicitation with a multicast (instead of unicast) router advertisement. You mean it has one extra potential failure mode in situations where radio retransmission doesn't

Re: IPv6 Ignorance

2012-09-17 Thread Nick Hilliard
On 17/09/2012 14:37, Adrian Bool wrote: It seems a tad unfair that the bottom 80 bits are squandered away with a utilisation rate of something closely approximating zero You are thinking in ipv4 mode. In ipv6 mode, the consideration is not how many hosts you have, but how many subnets you are

Re: Big Temporary Networks

2012-09-17 Thread Nick Hilliard
On 17/09/2012 00:42, Masataka Ohta wrote: OTOH, IPv6 requires many multicast received by STAs: RA and NS for DAD, for example. Worse, minimum intervals of ND messages are often very large, which means a lot of delay occurs when a message is lost. So, what you're saying here is that a wifi

Re: Big Temporary Networks

2012-09-16 Thread Nick Hilliard
On 14/09/2012 12:38, Paul Thornton wrote: Veering slightly off-topic for NANOG, but is this worth taking onto the address policy mailing list ahead of RIPE65 to ensure people who aren't in the WG session are aware of the issue - and can therefore support (or question) any proposed changes? I

Re: Big Temporary Networks

2012-09-16 Thread Nick Hilliard
On 16/09/2012 19:30, Masataka Ohta wrote: Thus, protocols heavily depending on broadcast/multicast, such as ND, will suffer. ok, you've trolled me enough to ask why ND is worse than ARP on a wavelan network - in your humble opinion? Nick

Re: Big Temporary Networks

2012-09-14 Thread Nick Hilliard
On 13/09/2012 21:32, Måns Nilsson wrote: Get lots of IP addresses. A /16 probably still can be borrowed for this kind of event. I know RIPE had rules and addresses for this kind of use a couple years ago, at least. yes, you can get a bunch of IP addresses from the ripe ncc if you only need

Re: Big Temporary Networks

2012-09-14 Thread Nick Hilliard
On 14/09/2012 11:50, Nat Morris wrote: The RIPE hostmaster would only allocate us address space 7 days before the event started, needed longer than this to begin building out the network which span multiple data centres. Especially with time, access and change freeze constraints due to the

Re: Big Temporary Networks

2012-09-14 Thread Nick Hilliard
On 14/09/2012 12:11, Mikael Abrahamsson wrote: I've used it a couple of times and then a week was sufficient (start rigging on monday, everything done by thursday morning where 5000 people show up with their computers (this was mainly 10/100 ports, people brought their own cables), teardown

Re: The End-To-End Internet (was Re: Blocking MX query)

2012-09-10 Thread Nick Hilliard
On 09/09/2012 23:24, Masataka Ohta wrote: Oliver wrote: Just because something is documented in RFC does not automatically make it a standard, nor does it necessarily make anyone care. That's not a valid argument against text in the RFC proof read by the RFC editor as the evidence of

Re: Are people still building SONET networks from scratch?

2012-09-10 Thread Nick Hilliard
On 10/09/2012 21:43, Matthew Petach wrote: If service is critical enough to me that 20 second hiccups make a difference, I'll find two providers to provide connectivity um, what do you mean, two providers? to the location via relatively cheap waves This *is* a troll, right...? just sayin'

Re: Are people still building SONET networks from scratch?

2012-09-06 Thread Nick Hilliard
On 06/09/2012 17:38, Will Orton wrote: The customer has a location in the relative middle of nowhere that they are trying to build a protected OC3 to. Not sure if I see the problem here. Show them the bill for an OC3 service, and then show them the bill for the equivalent ethernet service.

Re: Return two locations or low TTL [was: DNS caches that support partitioning ?]

2012-08-20 Thread Nick Hilliard
On 20/08/2012 14:18, Patrick W. Gilmore wrote: On Aug 20, 2012, at 08:47 , Chris Adams cmad...@hiwaay.net wrote: Most anything that supports IPv6 should handle this correctly, since getaddrinfo() will return a list of addresses to try. Ah, the amazing new call which destroys any possibility

Re: HSRP vs VRRP for IPv6 on IOS-XE - rekindling an old flame

2012-08-20 Thread Nick Hilliard
On 20/08/2012 15:41, -Hammer- wrote: Correction. Still looking for something IPv6 specific. Last time I looked, the support looked like this: XR: v4: HSRPv1, VRRP v6: VRRP IOS: v4: HSRPv1, HSRPv2, VRRP, GLBP v6: HSRPv2, GLBP You'll notice a certain lack of joined-up

Re: DNS Changer items

2012-08-16 Thread Nick Hilliard
On 16/08/2012 01:07, Randy Bush wrote: ripe caved at the time. yes it was a yank court order propagated as a dutch police order. in ljubljana, ncc staff said that they regretted caving, had not really needed to do so, it was a mistake that they would not repeat. present company excluded, we

Re: DNS Changer items

2012-08-15 Thread Nick Hilliard
On 15/08/2012 22:34, Randy Bush wrote: at the time, ripe caved to the court order. took some weeks before they woke up. now a lot of noise, lawyers, and whitewash. whoa, wait up there, you cocky youngster. It wasn't a court order; it was a police order consequent to a request for

Re: Testing 1gbps bandwidth

2012-08-14 Thread Nick Hilliard
On 14/08/2012 15:43, valdis.kletni...@vt.edu wrote: case trying to use one of the speedtest.net servers - we had a clear 10G path out through like 3 AS's in a row, the bottleneck was speedtest.net's server. :) you'll have to forgive me for being the cynical type, but I gave up on Speedtest

Re: US House to ITU: Hands off the Internet

2012-08-04 Thread Nick Hilliard
On 04/08/2012 16:55, Justin M. Streiner wrote: On Sat, 4 Aug 2012, Jimmy Hess wrote: it is the consistent and unequivocal policy of the United States to promote a global Internet free from government control. Now if they would only practice what they preach. It will be interesting to

Re: Real world sflow vs netflow?

2012-07-17 Thread Nick Hilliard
On 17/07/2012 16:32, Simon Leinen wrote: That's one reason, but another reason would be that at least in Netflow (but sFlow may be similar depending on how you use it), the reported byte counts only include the sizes of the L3 packets, i.e. starting at the IP header, while the SNMP interface

Re: Real world sflow vs netflow?

2012-07-15 Thread Nick Hilliard
On 14/07/2012 09:30, Łukasz Bromirski wrote: And that's the biggest problem with sFlow. Packets are sampled, not flows. You may miss the big or important flow, you don't have visibility into every conversation going through the device. Unless you enable sampling, which is pretty much necessary

Re: job screening question

2012-07-06 Thread Nick Hilliard
On 06/07/2012 16:12, valdis.kletni...@vt.edu wrote: On Fri, 06 Jul 2012 17:42:42 +1000, Matthew Palmer said: Ugh, I know someone (thankfully no longer a current colleague) who ardently *defends* his use of questions like what does the -M option to ps do? on Is that an African ps or a

Re: job screening question

2012-07-06 Thread Nick Hilliard
On 06/07/2012 23:25, valdis.kletni...@vt.edu wrote: The Friday afternoon cynic in me says it's because it's a move with positive paybacks. There's 3 basic possibilities: 1) You send the puffed resume to a company with clue, it gets recognized as puffed, and you don't get the job. Zero

Re: F-ckin Leap Seconds, how do they work?

2012-07-05 Thread Nick Hilliard
On 05/07/2012 11:34, Jared Mauch wrote: Live further north and you will see the difference dst makes. This is true. Ireland, UK, NL, Denmark, northern Germany and northern Poland are at a similar latitude to Polar Bear Provincial Park by Hudson Bay. With DST, we get much more usable evenings

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread Nick Hilliard
On 03/07/2012 18:59, Saku Ytti wrote: Leap bugs are NOT known. Most people have no idea unixtime is not monotonically increasing. I had no idea myself until sunday, I had assumed we really go 59 - 60 - 00, but we go 59 - 59 - 00. So 59.1 can happen before or after 59.2. To me this is

Re: Collecting flows at an IXP

2012-06-26 Thread Nick Hilliard
On 26/06/2012 07:06, Graham Beneke wrote: Just to clarify - there are 3 switch fabrics involved here. One from vendor C, one from vendor J and a third new fabric from an unchosen vendor. So ideally something that can accept the flows from various vendors. I'm also hoping for some insight

Re: Net::Perl::SSH for MRLG

2012-06-26 Thread Nick Hilliard
On 26/06/2012 14:48, Peter Ehiwe wrote: Has anyone successfully implemented Net::perl::ssh with mrlg . If yes please unicast me. The Perl module works fine but mrlg dosent seem to be able to connect to the routers using that module . I take it you're referring to Net::SSH::Perl? If so, why

Re: Simple Peering Agreement

2012-06-15 Thread Nick Hilliard
On 15/06/2012 18:24, Justin Wilson wrote: Does anyone have a simple (1-2 page) peering agreement in plain English they would care to share offlist? http://www.google.com/search?q=peering%20agreement%20%2Bfiletype%3Adoc Nick

Re: very confusing.

2012-06-13 Thread Nick Hilliard
Be advised that Im following your posts and have your threating messages to me. If there is an ddos or restraint of trade due to my ACCIDENTAL email I'll escalate to commerce and FBI. 1. spam a big pile of network operators 2. threaten legals on aforementioned prospective customers 3.

Re: AUT-NUM ROUTE OBJECT

2012-06-08 Thread Nick Hilliard
On 08/06/2012 17:55, Peter Ehiwe wrote: Authorisation for parent [as-block] using mnt-lower: not authenticated by: RIPE-NCC-RPSL-MNT http://apps.db.ripe.net/whois/lookup/ripe/mntner/RIPE-NCC-RPSL-MNT.html Nick

Re: HE.net BGP origin attribute rewriting

2012-05-31 Thread Nick Hilliard
On 31/05/2012 11:23, Daniel Suchy wrote: In my experience, there're not so many service providers doing that. Plenty of providers do it. IIWY, I would universally rewrite origin at your ingress points to be the same; otherwise you'll find that providers will merely use it as a means of

Re: HE.net BGP origin attribute rewriting

2012-05-31 Thread Nick Hilliard
On 31/05/2012 12:55, David Barak wrote: I disagree. Origin is tremendously useful as a multi-AS weighting tool, and isn't the blunt hammer that AS_PATH is. The place where I've gotten the most benefit is large internal networks, where there may be multiple MPLS clouds along with sites

Re: HE.net BGP origin attribute rewriting

2012-05-31 Thread Nick Hilliard
On 31/05/2012 16:46, David Barak wrote: On what precisely do you base the idea that a mandatory transitive attribute of a BGP prefix is a purely advisory flag which has no real meaning? Let's say network A uses cisco kit and injects prefixes into their ibgp tables using network statements.

Re: Vixie warns: DNS Changer ‘blackouts’ inevitable

2012-05-31 Thread Nick Hilliard
On 31/05/2012 17:11, cncr04s/Randy wrote: My comment was directed at government spending... no need to have such a angry tone about the comment. I was only comparing to what I spend on my large volumes of queries and what this so called expensive stuff the government is running... And I

Re: HE.net BGP origin attribute rewriting

2012-05-31 Thread Nick Hilliard
On 31/05/2012 21:04, Keegan Holley wrote: If you consider not mucking with my advertisements and those of my customers free love then I hope you don't work for one of my upstreams. Likewise, if you consider not hijacking my traffic to drive up revenue as cost. Anything to make a buck I

Re: Vixie warns: DNS Changer ‘blackouts’ inevitable

2012-05-24 Thread Nick Hilliard
On 23/05/2012 22:00, bmann...@vacation.karoshi.com wrote: One thing is clear, Paul is able to tell a great story. Bill, can you please take your snide remarks about Paul Vixie offline? Nick

Re: mulcast assignments

2012-05-03 Thread Nick Hilliard
On 03/05/2012 21:00, Greg Shepherd wrote: Sure, but GLOP predated SSM, and was really only an interim fix for the presumed need of mcast address assignments. GLOP only gives you a /24 for each ASN where SSM gives you a /8 for every unique unicast address you have along with vastly superior

Re: rpki vs. secure dns?

2012-04-29 Thread Nick Hilliard
On 28/04/2012 14:04, Alex Band wrote: At RIPE 63, six months ago, the RIPE NCC membership got a chance to vote on RPKI at the general meeting. The result was that the RIPE NCC has the green light to continue offering the Resource Certification service, including all BGP Origin Validation

Re: rpki vs. secure dns?

2012-04-28 Thread Nick Hilliard
On 28/04/2012 14:04, Alex Band wrote: they do not trust, or have a specific local policy for. In the toolsets for using the RPKI data set for routing decisions, such as the RIPE NCC RPKI Validator, every possible step is taken is taken to ensure that the operator is in the driver's seat.

Re: rpki vs. secure dns?

2012-04-28 Thread Nick Hilliard
On 28/04/2012 18:27, Phil Regnauld wrote: To me that seems like the most obvious problem, but as Alex put it, Everyone has the ability to apply an override on data they do not trust, or have a specific local policy for. So what do you suggest to do with a roa lookup which

Re: [IPv6] Monitoring BGP IPv6 Sesions

2012-04-19 Thread Nick Hilliard
On 19/04/2012 09:58, Carlos Asensio wrote: Anyone can help us on that matter? We need BGP4MIBv2. We've needed it for years. I am tired of screen-scraping terminal sessions looking for signs that ipv6 sessions are down or broken. Nick

Re: DNS noise

2012-04-06 Thread Nick Hilliard
On 06/04/2012 18:41, Nathan Eisenberg wrote: Anyone else seeing this sort of noise lately? There has been a bit of that recently for ripe.net and several other well known DNSSEC enabled domains (e.g. isc.org). It turns out that DNSSEC makes a respectable traffic amplification vector: twinkie#

Re: SORBS?!

2012-04-05 Thread Nick Hilliard
On 05/04/2012 17:48, goe...@anime.net wrote: But they will care about a /24. I'm curious as to why they would want to stop at /24. If you're going to take the shotgun approach, why not blacklist the entire ASN? Nick

Re: Muni Fiber

2012-03-25 Thread Nick Hilliard
On 25/03/2012 16:56, Leo Bicknell wrote: Fiber has a 20-50 year life. most of the expense of laying fibre is associated with ducting + wayleave. Once you have that in place, blowing new fibre is relatively inexpensive. So rather than amortising the cost according to the lifetime of the fibre,

Re: Muni Fiber

2012-03-25 Thread Nick Hilliard
wiring center you enable all technologies. GPON today, direct GigE or 10GE where necessary, and all future technologies. yep, agreed - much more sensible, much more resilient to failure and only marginally more expensive. It'll never be done though. Too much to lose by creating a topology

Re: $1.5 billion: The cost of cutting London-Tokyo latency by 60ms

2012-03-24 Thread Nick Hilliard
On 24/03/2012 00:32, George Bonser wrote: I suggested this once when it was decided that the latency from California to the UK was too high and that I should reduce it. The company wouldn't go for it, though. I assume they had a practical alternative to your proposition? Perhaps making light

Re: $1.5 billion: The cost of cutting London-Tokyo latency by 60ms

2012-03-23 Thread Nick Hilliard
On 23/03/2012 15:16, Joel jaeggli wrote: Notwithstanding how bad an idea high speed trading from the vantage point of those who don't participate in it, 60ms would place you at a competitive disadvantage to traders that are collocated at or near the exchange, such that if you're engaged in an

Re: Monitoring other people's sites (Was: Website for ipv6.level3.com returns HTTP/1.1 500 Internal Server Error)

2012-03-20 Thread Nick Hilliard
On 20/03/2012 14:54, Jeroen Massar wrote: For everybody who is monitoring other people's websites, please please please, monitor something static like /robots.txt as that can be statically served and is kinda appropriate as it is intended for robots. Depends on what you are monitoring. If

Re: BGP MD5 at IXP

2012-03-11 Thread Nick Hilliard
On 10/03/2012 11:24, Robert E. Seastrom wrote: Hopefully your modern exchange point router has some sort of control plane policing. My gut feeling is that lots don't. The behaviour of various operating systems regarding MD5 processing is interesting. *BSD (and I assume consequently junos)

Re: RANCID script for monitoring the routes received from peers.

2012-03-08 Thread Nick Hilliard
On 08/03/2012 10:47, Phil Regnauld wrote: Finally, another way to do this that could spare the CPU on on your routers if you run this often would be to setup a peer running Quagga (or BIRD) on a Linux/BSD host and run the monitoring there. that will only provide the

Re: cable markers for marine environments

2012-03-08 Thread Nick Hilliard
On 08/03/2012 22:02, James Downs wrote: Don't bother. Unless something revolutionary has come out recently, attach-on-to products are the only way to go. In my experience all the labels have to be maintained along with everything else that's in contact with that environment/liquid. Use

Re: Huawei edge routers..

2012-03-07 Thread Nick Hilliard
On 07/03/2012 10:31, Saku Ytti wrote: But again, I don't think crappy or good CLI is very important matter, when using systems. it isn't - if you're large enough that you have an automated provisioning system. Most of us aren't in that category though, and for those who aren't, it's the L3

Re: did AS174 and AS4134 de-peer?

2012-03-07 Thread Nick Hilliard
On 7 Mar 2012, at 23:19, Darius Jahandarie djahanda...@gmail.com wrote: On Wed, Mar 7, 2012 at 17:55, Greg Chalmers gchalm...@gmail.com wrote: Isn't this journalism a bit yellow? No facts / based on speculation.. - Greg Now all they need to do is link back to this NANOG thread as a

Re: do not filter your customers

2012-02-25 Thread Nick Hilliard
On 25/02/2012 06:07, Shane Amante wrote: OTOH, I would completely agree with Geoff's comment that the policy language of RPSL has the ability to express routing _policy_, a.k.a. intent, recursively across multiple ASN's ... (please note that I'm specifically talking about the technical

Re: do not filter your customers

2012-02-24 Thread Nick Hilliard
On 24/02/2012 20:04, Shane Amante wrote: Solving for route leaks is /the/ killer app for BGPSEC. I can't understand why people keep ignoring this. I'd be interested to hear your opinions on exactly how rpki in its current implementation would have prevented the optus/telstra problem. Could

Re: do not filter your customers

2012-02-24 Thread Nick Hilliard
On 24/02/2012 20:59, Leo Bicknell wrote: It turns out the real world is quite messy though, often full of temporary hacks, unusual relationships and other issues. ... and, if you create a top-down control mechanism to be superimposed upon the current fully distributed control mechanism, you

Re: IX in France

2012-02-23 Thread Nick Hilliard
On 23/02/2012 18:00, Jared Mauch wrote: Buying transit isn't as dirty as people think it is, sometimes its the right business decision. If you connect to an IX for $4000/mo at gig-e, Anyone prepared to pay $4000/m for a gig IX connection is making the wrong business decision. Nick

Re: Cisco CAT6500 IOS Simulator

2012-02-22 Thread Nick Hilliard
On 22/02/2012 15:36, Carlos Asensio wrote: Any alternative? Ebay. Nick

Spam from Telx

2012-02-17 Thread Nick Hilliard
So, anyone else get spammed by Telx after posting to nanog? This is massively unprofessional. Nick Original Message Subject: RE: telx Date: Fri, 17 Feb 2012 13:47:25 + From: George Fitzpatrick gfitzpatr...@telx.com To: Hi ,

Re: time sink 42

2012-02-16 Thread Nick Hilliard
On 16/02/2012 21:14, George Herbert wrote: Brothers' are fine; buy the tapes that have the split-down-the-middle backing on them. It reduces the unpeeling problem from more-time-than-the-label-took-to-type-in to about 2 seconds. You just grab the edges at an end and bend it, so the backing

Re: Console Server Recommendation

2012-01-31 Thread Nick Hilliard
On 31/01/2012 09:11, Saku Ytti wrote: For me, required features are This is part of the problem here. You want a terminal server which was designed for console access. Most of the terminal servers on the market are by-products of the modem dialin era and their development function was aimed at

Re: IPv6 BGP MIBs

2012-01-31 Thread Nick Hilliard
On 31/01/2012 16:42, chip wrote: Can anyone point me to ongoing discussion about IPv6 BGP SNMP MIBs going on in the IETF? As I understand it RFC 4293 was somewhat abandoned by most vendors. Cisco has a new BGPV4-2 Mib but that still doesn't address all the needs. While I can try and push

Re: Console Server Recommendation

2012-01-31 Thread Nick Hilliard
On 31/01/2012 17:27, George Bonser wrote: Wouldn't a program such as conserver running on a linux box someplace potentially provide these (maybe with a little extra hackery)? We use that quite a bit. One interesting option is that it allows another person to also watch the console session.

Re: 10GE TOR port buffers (was Re: 10G switch recommendaton)

2012-01-27 Thread Nick Hilliard
On 27 Jan 2012, at 23:08, bas kilo...@gmail.com wrote: Im my (our) busines model _is_ the internet connectivity... We could give the customer double the port capacity, if they were willing to pay, but in real life they do not care... While all respondents replies hold truth a (technial

Re: juniper mx80 vs cisco asr 1000

2012-01-25 Thread Nick Hilliard
On 25/01/2012 15:17, Julien Goodwin wrote: 2. Backspace doesn't work. Seriously (ok Ctrl-h works, and you can patch your terminal emulator for it, but it's the only hardware I've used in the last 15 years like that) I ended up remapping backspace to CTRL-H too. Yeah, seriously, this is

Re: Polling Bandwidth as an Aggregate

2012-01-20 Thread Nick Hilliard
On 20/01/2012 15:36, Keegan Holley wrote: using cacti for this. My last question is if there is any easy/automated way to pull interfaces into cacti and configure graphs for them either via SNMP or reading from a mysql DB. I suddenly remember how much I hate importing large routers into

Re: Polling Bandwidth as an Aggregate

2012-01-20 Thread Nick Hilliard
On 20/01/2012 15:48, Leo Bicknell wrote: I find using MRTG is easier than Cacti for _automation_ purposes. It also has another slightly subtle but hugely useful advantage: the primary index reference of a graph does not refer to an interface name or a number, but can be defined as an arbitrary

Re: RIS raw data

2012-01-19 Thread Nick Hilliard
On 19/01/2012 11:24, andra.l...@imdea.org wrote: I am working on getting a better grasp on what data we have in the RIS project from RIPE. To this end, I am checking the export policies of the ASes peering with RIPE AS12654 at different IXPs. I am wondering if anybody knows what these ASes

Re: DNS Attacks

2012-01-18 Thread Nick Hilliard
On 18/01/2012 14:18, Leigh Porter wrote: Yeah like I say, it wasn't my idea to put DNS behind firewalls. As long as it is not *my* firewalls I really don't care what they do ;-) As you're posting here, it looks like it's become your problem. :-D Seriously, though, there is no value to

Re: IP Management Software

2012-01-13 Thread Nick Hilliard
On 13/01/2012 22:31, Phil Regnauld wrote: Like, TIPP or Netdot ? http://tipp.tobez.org/ http://netdot.uoregon.edu/ Unfortunately, netdot is a complete curse to install. It's not necessarily a bad idea to use the preinstalled VM image, although I don't know how they intend

Re: Nexus emulation? Anyone?

2011-12-20 Thread Nick Hilliard
On 20/12/2011 13:55, -Hammer- wrote: I know we can't throw NX code on Dynamips but I figured I would ask the group anyway. We are starting to discuss Nexus platform options and I can only get so much from demo depot before our AM gets whiny. Is anyone currently emulating Nexus on anything that

Re: Dynamic (changing) IPv6 prefix delegation

2011-11-21 Thread Nick Hilliard
On 21/11/2011 16:33, Bjørn Mork wrote: But you should be prepared to handle the situation anyway. s/be prepared to handle the situation/plan to handle this as default/ Nick

Re: ARIN-2011-1: ARIN Inter-RIR Transfers - Last Call (expires in one week)

2011-11-11 Thread Nick Hilliard
On 11/11/2011 15:56, valdis.kletni...@vt.edu wrote: And yes, there's some RA/DHCP issues - but the *practical* upshot is that it's hard to DHCP a v6-only host and get stuff like DNS and NTP servers to them. another practical upshot is that switch manufacturers now need to support both RA

Re: ARIN-2011-1: ARIN Inter-RIR Transfers - Last Call (expires in one week)

2011-11-10 Thread Nick Hilliard
On 10/11/2011 16:59, David Conrad wrote: Tell King Canute's advisors I said hi. My OCD is screaming at me to point out that King Knut was attempting to show his advisers that even he couldn't control the tides. Nick

Re: where was my white knight....

2011-11-09 Thread Nick Hilliard
On 09/11/2011 03:14, Randy Bush wrote: once again, o when you have no connection to a cache or no covering roa for a a prefix, the result is specified as NotFound o we recommend you route on NotFound so the result is the same as today. Well no, not really because when the cache

Re: Firewalls - Ease of Use and Maintenance?

2011-11-09 Thread Nick Hilliard
On 09/11/2011 12:22, Richard Kulawiec wrote: You will find it very difficult to beat pf on OpenBSD for efficiency, features, flexibility, robustness, and security. Maintenance is very easy: edit a configuration file, reload, done. There are several areas where pf falls down. One is

Re: Firewalls - Ease of Use and Maintenance?

2011-11-09 Thread Nick Hilliard
On 09/11/2011 15:18, Jonathan Lassoff wrote: I've found that this works decently well, via pfsync. I meant config sync, not state sync. Nick

Re: Firewalls - Ease of Use and Maintenance?

2011-11-09 Thread Nick Hilliard
On 09/11/2011 19:07, C. Jon Larsen wrote: put the main portion of the conf in subversion as an include file and factor out local differences in the configs with macros that are defined in pf.conf Easy. As I said, it's not a pf problem. Commercial firewalls will do all this sort of thing off

Re: where was my white knight....

2011-11-08 Thread Nick Hilliard
On 08/11/2011 18:14, bmann...@vacation.karoshi.com wrote: the answer seems to be NO, it would not have helped and would have actually contributed to network instability with large numbers of validation requests sent to the sidr/ca nodes... i'm curious about sidr cold bootup, specifically when

Re: where was my white knight....

2011-11-08 Thread Nick Hilliard
On 08/11/2011 19:19, Randy Bush wrote: what comes to my mind is that NotFound is the default and it is recommended to route on it. I understand what the manual says (actually, i read it). I'm just curious as to how this is going to work in real life. Let's say you have a router cold boot with

Re: where was my white knight....

2011-11-08 Thread Nick Hilliard
On 08/11/2011 21:32, valdis.kletni...@vt.edu wrote: Anybody who puts their rpki cache someplace that isn't accessible until they get the rpki initialized gets what they deserve. One solution is to have directly-connected rpki caches available to all your bgp edge routers throughout your

Re: meeting network

2011-10-11 Thread Nick Hilliard
On 11/10/2011 14:12, John Curran wrote: is far better today then in the past, as there have been many conferences over the years where step 1 was pulling the coax or fiber through the hotel to establish their first-ever network infrastructure... :-) There is nothing more dispiriting than

Re: meeting network

2011-10-10 Thread Nick Hilliard
On 10/10/2011 13:28, Randy Bush wrote: perhaps as an educational exercise in network troubleshooting whoever is operating the meeting network could explain what the frack is wrong with the meeting network, how it is being debugged, and what they have learned about the cause of the suckage. if

Re: meeting network

2011-10-10 Thread Nick Hilliard
On 10/10/2011 14:50, Christopher Morrow wrote: hotel registration machines were all broken :( The hotel's network people (in NYC) are supposedly 'on a fix', who knows... (is expanding the nat subnet THAT hard?) Sigh, if only there were people somewhere near the hotel who knew how to configure

Re: nanog53 network status

2011-10-10 Thread Nick Hilliard
On 10/10/2011 16:01, Anton Kapela wrote: Please relay any outstanding issues my way--I'll route to Verilan, which is handling the network and wireless support for the meeting. If Verilan has the ability to limit client power settings, these should also be reduced as far as possible. Some

Re: Cisco 7600 PFC3B(XL) and IPv6 packets with fragmentation header

2011-09-30 Thread Nick Hilliard
On 30/09/2011 15:45, Christopher Morrow wrote: traceroute could certainly be handled in the fastpath. which traceroute? icmp? udp? tcp? Traceroute is not a single protocol. what is that limit? from a single port? from a single linecard? from a chassis? how about we remove complexity here

Re: Cisco 7600 PFC3B(XL) and IPv6 packets with fragmentation header

2011-09-30 Thread Nick Hilliard
On 30/09/2011 16:38, Mohacsi Janos wrote: They are pushing sup2T - however more for enterprise ip layer (6500 series). they are now, yes. But until the sup2t started becoming available a couple of weeks ago the only option for the 6500 was a sup720. You're right that this was only pushed on

Re: Cisco 7600 PFC3B(XL) and IPv6 packets with fragmentation header

2011-09-30 Thread Nick Hilliard
On 30/09/2011 17:30, Christopher Morrow wrote: traceroute is really an example of 'packet expired, send unreachable'... that, today is basically: o grab 64bytes of header (or something similar) o shove that in a payload o use the src as the dst o stick my src on o set icmp o

Re: Nxdomain redirect revenue

2011-09-27 Thread Nick Hilliard
On 27/09/2011 19:31, John Levine wrote: For case law confirming that similar language in the Stored Communication Act doesn't apply to data on your own equipment, see the recently dismissed cases of Holomaxx vs. Microsoft and Holomaxx vs. Yahoo. In Europe, things are slightly different.

Re: Nxdomain redirect revenue

2011-09-25 Thread Nick Hilliard
On 25/09/2011 12:39, Alexander Harrowell wrote: I think a special mention should go to hardware vendors who adopt this dreadful practice in network equipment. I recently encountered an enterprise-grade WLAN router from vendor D that has the horrible habit It is not libellous to associate a

Re: RADB/RIR Scraper

2011-09-21 Thread Nick Hilliard
On 21/09/2011 14:56, Christopher Morrow wrote: http://www.nanog.org/meetings/nanog36/presentations/steenbergen.pdf has some pointers to tools Richard wrote (and presented a few times now) at nanog meetings. (to save you reading the pdf... which is a good read: http://irrpt.sourceforge.net/

Re: ouch..

2011-09-14 Thread Nick Hilliard
On 14/09/2011 11:42, Martin Hepworth wrote: http://www.overpromisesunderdelivers.net/ Wow, classy. Nick

Re: vyatta for bgp

2011-09-12 Thread Nick Hilliard
On 12/09/2011 20:08, Michael K. Smith - Adhost wrote: How do you come to this conclusion? I think a software-based router for enterprise level (let's say on the 1G per provider level) can handle a fair amount of zorching. I presume by a fair amount, I presume you mean barely any? At large

Re: ISP support for use of 4-byte ASNs in peering

2011-08-09 Thread Nick Hilliard
On 09/08/2011 14:47, John Curran wrote: At ARIN, we are still having parties returning 4-byte ASN's (seeking 2-byte instead), indicating that the 4-byte ones are not sufficiently accepted in peering to be usable. This is obviously a less than desirable situation, and it appears that

<    1   2   3   4   5   6   7   8   >