Re: Public DNS64

2014-08-15 Thread Rubens Kuhl
On Fri, Aug 15, 2014 at 3:29 PM, Tim Durack wrote: > Anyone know of a reliable public DNS64 service? > > Would be cool if Google added a Public DNS64 service, then I could point > the NAT64 prefix at appropriately placed boxes in my network. > > Why? Other people are better than me at running DNS

Re: Mikrotik RouterBoard and Ubiquiti Networks Routing and Switching Solutions

2014-08-12 Thread Rubens Kuhl
On Tue, Aug 12, 2014 at 1:44 PM, Denis Fondras wrote: > Le 12/08/2014 17:15, Justin Wilson a écrit : > > Another thing to consider is how you feel about the configuration. > > Mikrotik has a more polished GUI and command subset. UBNT is still > > working things out. A lot of what you have

Re: Mikrotik RouterBoard and Ubiquiti Networks Routing and Switching Solutions

2014-08-11 Thread Rubens Kuhl
> > I personally feel like at this level of traffic, A entry level of linux > server (like dell r210) with adequate domain knowledge is the best > combination. It would happily do most stuff you throw at it, if you know > how to use it. Entry level hardware solution tries to hide details from >

Re: Mikrotik RouterBoard and Ubiquiti Networks Routing and Switching Solutions

2014-08-11 Thread Rubens Kuhl
On Mon, Aug 11, 2014 at 9:22 PM, Colton Conor wrote: > I am interested to hear opinions on Mikrotik and Ubiquiti Networks routing > and switching products. I know both hardware providers are widely deployed > in WISP networks, but I am less interested in their wireless solutions and > more in the

Re: Net Neutrality...

2014-07-15 Thread Rubens Kuhl
> > > The things that are making my life difficult at the moment include the > following: > > * Government agencies attempting to impose requirements upon us and then > denying us the resources we need to fulfill them; > > * Government agencies trying to dictate what users can buy rather than > all

Re: Inevitable death, was Re: Verizon Public Policy on Netflix

2014-07-15 Thread Rubens Kuhl
On Tue, Jul 15, 2014 at 3:59 PM, Brett Glass wrote: > At 12:18 PM 7/15/2014, Rubens Kuhl wrote: > > If you are picky enough to prefer other radios that cost more on Mbps/$, >> that's your call, >> > > We need reliability. That particular radio wouldn't cut i

Re: Inevitable death, was Re: Verizon Public Policy on Netflix

2014-07-15 Thread Rubens Kuhl
On Tue, Jul 15, 2014 at 3:08 PM, Brett Glass wrote: > At 11:40 AM 7/15/2014, Rubens Kuhl wrote: > > Read again. You answered thinking about AirFiber 24, while he mentioned >> AirFiber 5, which goes much longer. >> > > Ah. I assumed that you were talking about the

Re: Inevitable death, was Re: Verizon Public Policy on Netflix

2014-07-15 Thread Rubens Kuhl
> > >Given your expertise seems to be wireless links, you could also backhaul > >using Ubiquiti Airfiber: http://www.ubnt.com/airfiber/airfiber5/ > > That Ubiquiti radio reaches at most one mile reliably due to rain fade. > Most of > our links go much farther. Wireless is our specialty and we do kn

Re: Inevitable death, was Re: Verizon Public Policy on Netflix

2014-07-15 Thread Rubens Kuhl
On Tue, Jul 15, 2014 at 12:12 PM, Brett Glass wrote: > At 08:48 AM 7/15/2014, Naslund, Steve wrote: > > The name of the game is to decongest your network for the least amount of >> money. >> > > I disagree with some of your other points, but on this we agree. And > caching is the best way. Netfl

Re: Verizon Public Policy on Netflix

2014-07-14 Thread Rubens Kuhl
> > If Netflix were a good citizen, it would (a) let ISPs cache content; (b) > pay them > equitably for direct connections (smaller and more remote ISPs have higher > costs > per customer and should get MORE per account than Comcast, rather than > receiving > nothing); and (c) work with ISPs to dev

Re: Verizon Public Policy on Netflix

2014-07-13 Thread Rubens Kuhl
On Sun, Jul 13, 2014 at 8:55 PM, Brett Glass wrote: > At 05:33 PM 7/13/2014, Tom Hill wrote: > > By the way, don't think you're not going to have to pay us for all for >> that dirt you're hurling... >> > > Building new things often does involve digging up dirt. Unlike Netflix, > we'd gladly pay

Re: Verizon Public Policy on Netflix

2014-07-10 Thread Rubens Kuhl
On Thu, Jul 10, 2014 at 5:01 PM, Jay Ashworth wrote: > Here's a link to a post from VZN's public policy blog, about Netflix. > > Now, just as a matter of principle, I tend to assume that anything VZN > says in public is a self-serving lie based on a poor understanding of the > Real World... but I

End of IPv4 addresses in LAC region

2014-06-10 Thread Rubens Kuhl
It has been just announced in LAC network operator mailing lists that the LAC region just crossed the /10 boundary, triggering exhaustion policies that now only allow assignments of /22 IP address blocks, either for initial assignments or additional requests. Next in line, ARIN region. Is February

Re: World Cup Streaming

2014-06-08 Thread Rubens Kuhl
Sports events have their rights sold on per country basis; this leads to some fragmentation of those numbers as network X has the rights for country 1, network Y for country 2, and they account their numbers separate even if they use the same CDN. Considering Soccer (or Football as we non-US call

Re: IPv6 at 50% for VZW (Re: NAT IP and Google)

2014-05-22 Thread Rubens Kuhl
> > > Jared, > > Akamai has been v6 enabled for years. Customers have choices and know best. > > Isn't your network still offering both as customer choices? :-) > Making new customers dual-stack by default for the last two years would have gone far in increasing IPv6, unless Akamai is only losing

LACNIC becomes the first RIR to go below /9 of available IP space

2014-05-20 Thread Rubens Kuhl
http://www.lacnic.net/en/web/lacnic/inicio Website is still showing phase 0 of address depletion, but the updated quantity means that the /9 trigger has been reached. Rubens

Re: Route Server Filters at IXPs and 4-byte ASNs

2014-01-25 Thread Rubens Kuhl
> > What happens, if the IXP uses a 4-byte ASN? RFC5668 (4-Octet AS Specific > BGP Extended Community) defines : 2bytes>. > > I have been asking some IXP operators, about their practice and their > reply was "4-byte ASNs are supported by our RS". What's your experience? > Did you see IXPs, that do

Re: "trivial" changes to DNS (was: OpenNTPProject.org)

2014-01-16 Thread Rubens Kuhl
On Thu, Jan 16, 2014 at 2:27 PM, Andrew Sullivan wrote: > On Tue, Jan 14, 2014 at 09:18:30AM +0200, Saku Ytti wrote: > > > > mid term, transport area in IETF. DNS, NTP, SNMP, chargen et.al. could > > trivially change to QUIC/MinimaLT > > Oh, yes, it'd obviously be trivial to change DNS to use a d

Re: Mikrotik Cloud Core Router and BGP real life experiences?

2013-12-31 Thread Rubens Kuhl
On Fri, Dec 27, 2013 at 6:47 AM, Martin Hotze wrote: > Hi, > > looking at the specs of Mikrotik Cloud Core Routers it seems to be to good > to be true [1] having so much bang for the bucks. So virtually all smaller > ISPs would drop their CISCO gear for Mikrotik Routerboards. > The issue with Ro

Re: turning on comcast v6

2013-12-09 Thread Rubens Kuhl
On Mon, Dec 9, 2013 at 5:08 PM, Christopher Morrow wrote: > > On Mon, Dec 9, 2013 at 1:28 PM, Michael Brown wrote: > > On 13-12-09 01:19 PM, John Lightfoot wrote: > >> > >> We don't even support IPv5 yet, so it will be a while before we support > >> v6. > > > > Naturally, as the odd-numbered rele

Re: nanog.org website - restored

2013-10-07 Thread Rubens Kuhl
For those interested, we would like to share some details of this event. > It was noticed a couple weeks ago that a lack of memory conditon was > present on the NANOG servers in Chicago. Temporary measures were taken > to clear processes and restart the server, but this only temporarialy > restor

Re: DNS Reliability

2013-09-12 Thread Rubens Kuhl
On Thu, Sep 12, 2013 at 5:03 PM, Phil Fagan wrote: > Everything else remaining equal...is there a standard or expectation for > DNS reliability? > > 98% > 99% > 99.5% > 99.9% > 99.99% > 99.999% > > Measured in queries completed vs. queries lost. > > Whats the consensus? > ICANN new gTLD agreemen

Re: RPKI and Trust Anchor question

2013-08-05 Thread Rubens Kuhl
NRO, the RIRs collective, is still working on this. It's listed as an open action item since Q2 this CY at NRO Executive Council meetings: http://www.nro.net It's very unlikely that ICANN, which sees the NRO as it's address support organization, will move on this before NRO does. Rubens On

Re: .nyc - here we go...

2013-07-04 Thread Rubens Kuhl
On Thu, Jul 4, 2013 at 12:00 PM, Ted Cooper wrote: > On 03/07/13 11:12, Scott Weeks wrote: > > "As of July 2, 2013, .nyc has been approved by ICANN as a > > city-level top-level domain (TLD) for New York City" > > Do they have DNSSEC from inception? It would seem a sensible thing to do > for a vir

Re: .nyc - here we go...

2013-07-02 Thread Rubens Kuhl
> Great, Let's see what happens. > > If history is any teacher... > > There is not much history here to look at... .cc and .tk are ccTLDs, based out of sovereign states. They are delegated into the root by ICANN (more precisely by IANA, which is currently a contract also granted to ICANN) and that'

Re: .nyc - here we go...

2013-07-02 Thread Rubens Kuhl
On Wed, Jul 3, 2013 at 12:21 AM, Paul Ferguson wrote: > > On Tue, Jul 2, 2013 at 8:12 PM, Rubens Kuhl wrote: > > > Summary: there are residual risks, but the checks and balances of the > > process are likely to stop bad actors, at the cost of also stopping some > > goo

Re: .nyc - here we go...

2013-07-02 Thread Rubens Kuhl
> > Thank you for explaining this. Again, probably. > > So the cities in those countries could buy them (if they could > afford them) but not the countries? So .portvila is available, > but not .vanuatu? > Yes. Country names will be part of the expansion of the ccTLD space, where usually countri

Re: .nyc - here we go...

2013-07-02 Thread Rubens Kuhl
On Tue, Jul 2, 2013 at 10:12 PM, Scott Weeks wrote: > > > < careful there may be a troll in here... :) > > > https://en.wikipedia.org/wiki/.nyc > > "As of July 2, 2013, .nyc has been approved by ICANN as a > city-level top-level domain (TLD) for New York City" > .nyc has been approved by ICANN M

Re: Re: This is a coordinated hacking. (Was Re: Need help in flushing DNS)

2013-06-20 Thread Rubens Kuhl
On Thu, Jun 20, 2013 at 8:41 PM, Timothy Morizot wrote: > On Jun 20, 2013 5:31 PM, "Randy Bush" wrote: > > and dnssec did not save us. is there anything which could have? > > Hmmm. DNSSEC wouldn't have prevented an outage. But from everything I've > seen reported, had the zones been signed, val

Re: Looking for Netflow analysis package

2013-05-14 Thread Rubens Kuhl
On Tue, May 14, 2013 at 11:18 PM, Jason Lester wrote: > ManageEngine's NetFlow Analyzer will do most of that (not sure about AS > Path Analysis.) It is priced per monitored interface, but is pretty > reasonable for what it does. They have a 30-day demo available. We use > their full OpManager+N

Re: Suggestions for managed DNS provider?

2013-02-15 Thread Rubens Kuhl
On Thu, Feb 14, 2013 at 10:31 PM, Bill Woodcock wrote: > > On Feb 14, 2013, at 12:06 PM, Rubens Kuhl wrote: >> Not tested under attack, but this DNS provider is worth a look since >> it's the only one with both IPv6 and DNSSEC a colleague could find: >> http://www.dn

Re: Suggestions for managed DNS provider?

2013-02-14 Thread Rubens Kuhl
On Thu, Feb 14, 2013 at 5:58 PM, David Hubbard wrote: > Hi all, anyone have suggestions for very stable/reliable managed DNS? > Neustar/UltraDNS is an obvious option to look at, just curious about > alternatives. Cost effective would be nice, but stable under attack is > better. Not tested under

Re: Heads-Up: GoDaddy Broke the Interwebs...

2012-09-11 Thread Rubens Kuhl
On Tue, Sep 11, 2012 at 6:04 PM, ryanL wrote: > when patrick is referring to "taking their word for it", he's referring to a > post on outages@ by godaddy's network engineering manager that stated "bgp, > and more details to follow". "more" is the operating word here. > i tend to align with patr

Re: Heads-Up: GoDaddy Broke the Interwebs...

2012-09-11 Thread Rubens Kuhl
> No large flows reported to the affected NSes, tweets were suspicious at best, > other anon-ops denied the attack was them, and GoDaddy admitted internal > error. > > I'm going to take GoDaddy at their word, and give them major kudos for owning > up to the mistake - in public. That doesn't mea

Re: Wacky Weekend: The '.secure' gTLD

2012-05-31 Thread Rubens Kuhl
On Thu, May 31, 2012 at 9:19 PM, Jay Ashworth wrote: > - Original Message - >> From: "Jay Ashworth" > >> Subject: Wacky Weekend: The '.secure' gTLD > > I see that LWN has already spotted this; smb will no doubt be pleased to > know that the very first reply suggests that RFC 3514 solves t

Re: [lacnog] Peering in Brazil

2012-05-03 Thread Rubens Kuhl
> I am looking for any guidance and advice people have regarding first > time peerings in South America. Currently I am doing some work with a > content provider in North America and I want to get them better > routers into South America, to South American ISPs. I am looking to > get them an interc

Re: rpki vs. secure dns?

2012-04-28 Thread Rubens Kuhl
> In case you feel a BGP announcement should not be "RPKI Invalid" but > something else, you do what's described on slide 15-17: > > https://ripe64.ripe.net/presentations/77-RIPE64-Plenery-RPKI.pdf The same currently happens with DNSSEC, doing what Comcast calls "negative trust anchors": http://t

Re: Attack on the DNS ?

2012-04-01 Thread Rubens Kuhl
On Sat, Mar 31, 2012 at 10:09 PM, Greg Ihnen wrote: > I manage a tiny network in the Amazon, a satellite internet connection and > decent sized wireless network. > Is DNS traffic being directed to bogus servers? Are the real servers being > overloaded? Am I seeing the results of some kind of DD

Re: airFiber

2012-03-31 Thread Rubens Kuhl
On Thu, Mar 29, 2012 at 1:34 PM, Eugen Leitl wrote: > > Claim: 1.4 GBit/s over up to 13 km, 24 GHZ, @3 kUSD/link price point. > > http://www.ubnt.com/airfiber Claims are actually "Up to 1.4 Gbps" and "Up to 13 km"; those two conditions probably cannot be satisfied together. 1.4 Gbps is actually

Re: Concern about gTLD servers in India

2012-03-10 Thread Rubens Kuhl
> I can tell you with 100% certainty that when I was responsible for > handling ccTLD delegation changes that we took the issue of ccTLDs being > operated for the benefit of the Internet community in that country, and > the global Internet community as a whole, very seriously. I have no > reason to

Re: Optimal IPv6 router

2012-02-06 Thread Rubens Kuhl
>> With IPv6 growing, if we were to design a native IPv6 router, with >> IPv4 functionality thrown in, then is it possible to design a more >> optimal IPv6 router, than what exists today? > > OK, I'll bite.  What would qualify as a "native IPv6" router?  Is this > another concept as silly as "hardw

Re: Verisign deep-hacked. For months.

2012-02-03 Thread Rubens Kuhl
On Thu, Feb 2, 2012 at 10:34 PM, Jeff Wheeler wrote: > On Thu, Feb 2, 2012 at 7:26 PM, Suresh Ramasubramanian > wrote: >> So what part of VRSN got broken into?  They do a lot more than just DNS. > > Indeed, VeriSign owns Illuminet, who are mission-critical for POTS. > Illuminet is also in the bus

Re: Akamai/Integra issue?

2012-01-25 Thread Rubens Kuhl
May be the attack on Facebook put Akamai into DEFCON 1 ? http://www.readwriteweb.com/archives/anonymous_claims_responsibility_for_facebook_outag.php Rubens On Wed, Jan 25, 2012 at 10:14 PM, Thomas Magill wrote: > This morning we began having issues at one of our sites.  Eventually the > syste

Re: De-bogon not possible via arin policy.

2011-12-14 Thread Rubens Kuhl
> Fyi, I just was rejected from arin for an ipv4 allocation. I demonstrated I > own ~100k ipv4 addresses today.> > My customers use over 10 million bogon / squat space ip addresses today, > and I have good attested data on that. > But all I can qualify for is a /18, and then in 3 months maybe a /17

Re: Contact for Telefonica (AS12956)

2011-11-23 Thread Rubens Kuhl
On Wed, Nov 23, 2011 at 12:54 PM, Brandon Ewing wrote: > Greetings, > > Can someone put me in contact with someone with clue in the Telefonica > backbone?  One of their downstreams is hijacking a prefix of mine as a /24. > I've also started advertising the /24 to my upstreams, but many Telefonica

Re: Minimum Allocation Size by RIRs (IPv4)

2011-11-15 Thread Rubens Kuhl
On Tue, Nov 15, 2011 at 12:56 PM, Fredy Kuenzler wrote: > I'm trying to compile a comprehensive and up-to-date list of Minimum > Allocation Sizes by the various RIRs. Any hint would be appreciated. I have > so far: NIRs (National Internet Registries) in the APNIC and LACNIC area need to be mapped

Re: Ok; let's have the "Does DNAT contribute to Security" argument one more time...

2011-11-14 Thread Rubens Kuhl
For the common good it doesn't matter if the "NAT is good" guys are right or the "NAT is useless" guys are right, as they both fail to decrease the numbers of their opposing parts. We must get IPv6 done for both of them. It seems that application reverse-proxies can make "NAT is good" guys happy,

Re: Nxdomain redirect revenue

2011-09-27 Thread Rubens Kuhl
On Tue, Sep 27, 2011 at 7:29 PM, David E. Smith wrote: > On Tue, Sep 27, 2011 at 17:08, Jimmy Hess wrote: >> That is, HTTPs should become assumed. > > As much as that would be wonderful from a security standpoint, IMO > it's not realistic to expect every mom-and-pop posting a personal Web > site

Re: Nxdomain redirect revenue

2011-09-27 Thread Rubens Kuhl
On Tue, Sep 27, 2011 at 11:48 AM, wrote: > On Tue, 27 Sep 2011 10:20:25 EDT, William Allen Simpson said: > >> It's not legal for an ISP to modify computer data.  Especially >> digitally signed data.  That's a criminal offense. > > Citation? Could tampering with DNSSEC and/or TLS fall into DMCA g

Re: best practices for management nets in IPv6

2011-07-12 Thread Rubens Kuhl
On Tue, Jul 12, 2011 at 6:31 PM, Tom Ammon wrote: > Hi All, > > We're pushing to get IPv6 deployed and working everywhere in our operation, > and I had some questions about best practices for a few things. > > On your management nets (network device management nets) , what's the best > approach

Re: Verisign Internet Defence Network

2011-05-30 Thread Rubens Kuhl
ms made by the product descriptions seem suspect to me. > > it claims to be "Carrier-agnostic and ISP-neutral", yet "When an event is > detected, Verisign will work with the customer to redirect Internet traffic > destined for the protected service to a Verisign Internet Defense Network > site." >

Re: Rogers Canada using 7.0.0.0/8 for internal address space

2011-05-24 Thread Rubens Kuhl
> Is the DoD releasing this range to Rogers? Or has Rogers squatted on > this space due to exhaustion of their 10/8 use? We've seen other > Squatting resources from an organization that can deploy F/A-18 > Hornets, F/A-22 Raptors, Predator drones or Navy SEALs is probably bad > to your health. > >

Re: Rogers Canada using 7.0.0.0/8 for internal address space

2011-05-24 Thread Rubens Kuhl
On Mon, May 23, 2011 at 12:28 PM, Mark Farina wrote: > As of April 27th I have started to receive dhcp broadcast requests > originating from the 7.0.0.0/8 network. Based on MAC addresses, it > seems that this is communication between the Rogers border/node > hardware (MAC assigned to Cisco) and my

Re: How do you put a TV station on the Mbone? (was: Royal Wedding...)

2011-04-29 Thread Rubens Kuhl
On Fri, Apr 29, 2011 at 2:48 PM, Jay Ashworth wrote: > - Original Message - >> From: "Rubens Kuhl" > >> >> Isn't the real problem with global multicast: "How do we ultimately >> >> bill the broadcaster for all that traffic amplifi

Re: How do you put a TV station on the Mbone? (was: Royal Wedding...)

2011-04-29 Thread Rubens Kuhl
>> Isn't the real problem with global multicast: "How do we ultimately >> bill the broadcaster for all that traffic amplification that happened >> *inside* every other AS?" It seems like you'd have to do per-packet >> accounting at every router, and coordinate billing/reporting amongst >> all provi

Re: RES: Anyone still maintaining altdb.net?

2011-04-23 Thread Rubens Kuhl
>> You can try the SCW IRR [1]. >> It's free, but is in Portuguese. >> >> Reference: >> [1] http://whois.scw.net.br/ >> >> -- >> Eduardo Schoedler > > Sounds like that doesn't help the OP, who wanted help with RPSL, not > *really* help from AltDB. Actually it does, because of a wizard (http://irr.

Re: IPv4 address exchange

2011-04-18 Thread Rubens Kuhl
>> perhaps, if you are seeking support for commercial activity, you should >> make your employment more clear and declare any conflicts of interest. > > Fair enough. > > I am employed by Cisco Systems, but all of my statements are my own and I do > not represent my employer.  I believe that my emp

Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Rubens Kuhl
> That is extremely curious. How can they justify taking 4 million addresses > for research two days before running out of regularly allocatable address > space? They could have taken that /10 out of the final /8 rather than taking > it from the last scraps of regular space if they really need a

Re: Nortel, in bankruptcy, sells IPv4 address block for $7.5 million

2011-03-24 Thread Rubens Kuhl
On Fri, Mar 25, 2011 at 12:15 AM, Jimmy Hess wrote: > On Thu, Mar 24, 2011 at 10:07 PM, Matthew Kaufman wrote: >> On 3/24/2011 7:59 PM, Jimmy Hess wrote: >>> Because that's what IP addresses are.  Totally worthless unless community >>> participants voluntarily route traffic for those IPs to the a

Re: Switch with 24x SFP PVLAN QinQ Layer 2

2011-03-02 Thread Rubens Kuhl
> Requirements are basically just 24/48 SFP ports, PVLAN and selective QinQ. > Most devices that fit the requirements are Layer 3, which pushes the cost > per port too high. Cisco ME6524 has a model with 32 SFP ports (24 with 3:1 oversubscription, 8 non-oversubscribed) and "IP Base" IOS which has

Re: Self-referential whois queries

2011-02-10 Thread Rubens Kuhl
>> I'm noticing an increase in getting "query rate exceeded" at whois >> services that might be connected to a symptom described by ARIN at >> NANOG 48/ARIN XXV and ARIN XXVI where machines ask for the whois >> record of their own IP address. >> >> Are there any clues of what is causing this ? > >

Self-referential whois queries

2011-02-10 Thread Rubens Kuhl
I'm noticing an increase in getting "query rate exceeded" at whois services that might be connected to a symptom described by ARIN at NANOG 48/ARIN XXV and ARIN XXVI where machines ask for the whois record of their own IP address. Are there any clues of what is causing this ? Rubens

Re: And so it ends (slightly off topic)

2011-02-03 Thread Rubens Kuhl
On Thu, Feb 3, 2011 at 2:04 PM, Ronald Bonica wrote: > Folks, > > Somehow, it is appropriate that this should happen on February 3. On February > 3, 1959, Buddy Holly, Richie Valens and JP Richardson (aka The Big Bopper) > died in a plane crash. Don McLean immortalized that day as "The Day The M

Re: Connectivity to Brazil

2011-02-02 Thread Rubens Kuhl
CTBC has capacity from GBLX, TIWS and SEABONE, although not all prefixes are announced to all providers. TIWS usual path in the US is thru Level 3, so steering the traffic to Level 3 might do the trick. Rubens On Wed, Feb 2, 2011 at 11:08 AM, Steve Danelli wrote: > Thanks Vinny - how did you r

Re: Bovespa

2011-02-02 Thread Rubens Kuhl
On Wed, Feb 2, 2011 at 2:22 AM, Philip Lavine wrote: > 1. Does anyone know where the Bovespa is located and if colocation is a > possibility at that datacenter/s. Sao Paulo downtown, although it is unclear at this time if it will stay there or not. They do not provide colocation at their datacent

Re: ipv4's last graph

2011-02-01 Thread Rubens Kuhl
On Tue, Feb 1, 2011 at 6:11 PM, Geoff Huston wrote: > > On 01/02/2011, at 7:02 PM, Randy Bush wrote: > >> with the iana free pool run-out, i guess we won't be getting those nice >> graphs any more.  might we have one last one for the turnstiles?  :-)/2 >> >> and would you mind doing the curves now

Re: A top-down RPKI model a threat to human freedom? (was Re: Level 3's IRR Database)

2011-02-01 Thread Rubens Kuhl
> There is not a single RIR that is not physically located in a country. > You can hope they are more stable from a policy point of view, but, the > reality is that if someone shows up at the front door with tanks and > mortars, my money is not on the RIR. But they might choose a country in that

Re: Some truth about Comcast - WikiLeaks style

2010-12-14 Thread Rubens Kuhl
On Tue, Dec 14, 2010 at 3:07 AM, Backdoor Santa wrote: > > Ever wonder what Comcast's connections to the Internet look like? In the > tradition of WikiLeaks, someone stumbled upon these graphs of their TATA > links. For reference, TATA is the only other IP transit provider to Comcast > after Le

Re: starwars.com subdomain hijacked?

2010-11-22 Thread Rubens Kuhl
On Mon, Nov 22, 2010 at 1:46 PM, Matt Disuko wrote: > It seems the subdomain "shop.starwars.com" is being redirected. > Anybody else seeing this? The Rebel Alliance managed to hit that site, but the Empire struck back and it's back online again. Rubens

Re: Tools for teaching users online safety

2010-10-25 Thread Rubens Kuhl
One can start with http://antispam.br/videos/english/ Rubens On Mon, Oct 25, 2010 at 11:13 PM, Alex Thurlow wrote: > I'm trying to find out if there are currently any resources available for > teaching people how to be safe online.  As in, how to not get a virus, how > to pick out phishing ema

Re: Routers in Data Centers

2010-09-26 Thread Rubens Kuhl
On Sun, Sep 26, 2010 at 8:54 PM, wrote: > As far as I know open source solutions doesn't have support for fabric or > high speed asics. So the throughput will always be a big difference. Unless > you are comparing a pure packet software interrupt platform. Not high speed ASICs, but there are h

Re: DNSSEC and SSL

2010-08-23 Thread Rubens Kuhl
The fact hat Verisign kept the domain business and sold the CA business to Symantec tells which business they think is stronger. Rubens On Sat, Aug 21, 2010 at 10:00 PM, ML wrote: > Would a future with a ubiquitous DNSSEC deployment eliminate the market > for commercial CAs? > > Would function

Re: IPv4 Exhaustion...

2010-07-26 Thread Rubens Kuhl
> Between e-discovery and RIAA issues, retention times are probably shrinking > even though capacity for retention is growing. Capacity for retention has grown but one still needs fast searching of data, or a few LEA requests on the same day or week will overflow your capacity to answer them. Dis

Re: Mikrotik & OC-3 Connection

2010-07-04 Thread Rubens Kuhl
If your routing platform doesn't have POS OC-3, you can use a converter to map Ethernet services to it and keep using the platform you've been using. You lose a little on efficiency and failure detection, but turning BFD on might help: http://wiki.mikrotik.com/wiki/Manual:Routing/BFD I've worked w

Re: Future of WiMax

2010-06-16 Thread Rubens Kuhl
The future of WiMAX seems a lot less promising now that FD-LTE is the clear winner for wide-scale mobile deployment, and TD-LTE, 802.11n and proprietary technologies will compete for non-paired spectrum and/or niche markets. But one can build a network with WiMAX and make money out of it; global m

Re: Upcoming Improvements to ARIN's Directory Service

2010-06-10 Thread Rubens Kuhl
> I'm ok with whatever system they provide if the functionality stays > the same.  I don't understand what they gain by making a human login > and download the file. Accountability. If versions X and Y of database got abused (breach of ToS), and only user U has downloaded such versions, gotcha. Us

Re: Google Issues?

2010-06-10 Thread Rubens Kuhl
This usually indicates a heavily malware-contaminated userbase or 1-to-N NAT/PAT with a large N. Having both is what usually triggers this, but sometimes if you are strong on one, it could be enough. Rubens On Thu, Jun 10, 2010 at 4:23 PM, Thomas Magill wrote: > Is anyone seeing warnings toda

Re: Junos Asymmetric Routing

2010-05-30 Thread Rubens Kuhl
On Sun, May 30, 2010 at 1:46 PM, Florian Weimer wrote: > * Randy Bush: > >>> your perfectly fine multihop BGP session could break when rerouting >>> occurs. >> >> one of the many reasons that there are no perfectly fine multi-hop bgp >> sessions. > > Uhm, is there a way around them when building t

Re: Junos Asymmetric Routing

2010-05-30 Thread Rubens Kuhl
> You need to put a filter on your interfaces that references a filter later on > to not session track a flow.  I think you need to be running Junos-jsr[0] > 10.0 or 10.1 to use this : The same goes for 9.x, just be sure to except traffic to the router (like BGP session) from the packet-mode, th

Re: Root Zone DNSSEC Deployment Technical Status Update

2010-05-16 Thread Rubens Kuhl
You probably need a trust anchor as well. See http://ftp.isc.org/isc/pubs/tn/isc-tn-2006-1.html. Rubens On Sun, May 16, 2010 at 3:14 PM, itservices88 wrote: > Hi, > > I was building a test domain for trying out the dnssec. However as mentioned > on various websites "ad" appears in the flags, bu

Re: Router for Metro Ethernet

2010-04-13 Thread Rubens Kuhl
On Tue, Apr 13, 2010 at 3:06 PM, Holmes,David A wrote: > We use Cisco 3750 L3 switches for Metro Ethernet connectivity. The 3750 > SFPs can run at wire speed up to 1 GiGE. The 3750s are very reliable, > and have good, follow-the-sun technical support in case of problems. > Some caveats: > > 1. onl

Re: Juniper's artificial feature blocking (was legacy /8)

2010-04-05 Thread Rubens Kuhl
On Sun, Apr 4, 2010 at 4:33 PM, Michael Sokolov wrote: > Tore Anderson wrote: > >> Juniper.  If you want to run OSPFv3 on their layer 3 switches, you need >> a quite expensive "advanced" licence.  OSPFv2, on the other hand, is >> included in the base licence. > > Really?  My level of respect for

Re: CPE Ethernet switch suggestions

2010-04-05 Thread Rubens Kuhl
Although also being a small SOHO switch, may be Netgear GS-108T can suit your needs. > I want remove the initial staging step by allowing the installer to just > plug the switch in and have the switch grab a config from a TFTP server > noted by a DHCP option. Not quite, it can download config fr

Re: Network Naming Conventions

2010-03-14 Thread Rubens Kuhl
On Sat, Mar 13, 2010 at 6:01 PM, Paul Stewart wrote: > Yeah, just learning that... got a *tonne* of offline replies. > > Planets won't work well, simpson characters we'll run out very > quickly umm.. forgot the rest.  We were looking for something that > makes sense to the function of the box

Re: 10GBase-t switch

2010-03-11 Thread Rubens Kuhl
> "Arista EOS" - what good/bad things do you have to say about their > management capabilities? which "known" brand can it be compared to? I couldn't help myself thinking that the name of an operanting system shouldn't resemble "End of Sales" that much. Rubens

Re: CRS-3

2010-03-09 Thread Rubens Kuhl
On Tue, Mar 9, 2010 at 4:51 PM, Brian Feeny wrote: > > So who is going to be the first to deploy these? > > http://newsroom.cisco.com/dlls/2010/prod_030910.html > > > - Download the entire Library of Congress in just over 1 second > - Stream every motion picture ever created in less than four minu

Re: Cisco hardware question

2010-03-04 Thread Rubens Kuhl
> We have noticed that a number of Cisco appliances we have recently purchased > and paid (AS NEW), are being shipped as if they have been already > used/refurbished. In other words, several times we have seen brand new Cisco > hardware, out of the box, that has pre-existing configuration (Inter

Re: Competition for Internap's FCP product.

2010-02-25 Thread Rubens Kuhl
Is your burstable bandwidth cost high enough to pay 100K for a gear just to meet the commitments ? NAGIOS/CACTI monitoring alerts sent to someone (which may be hired help from any place in the world) would probably beat that in cost effectiveness. The performance requirement is where a line is dra

40G/100G options at this time

2010-02-19 Thread Rubens Kuhl
Hi. Are there solutions already available implementing 40GBASE-LR4, 100GBASE-LR4 and 100GBASE-ER4 draft standards ? By solutions it means both switches with CFP-MSA/QSFP/CXP ports and the modules. Rubens

Re: Using /126 for IPv6 router links

2010-01-24 Thread Rubens Kuhl
> During the days of the IPng directorate, quite a number of different > alternatives were considered.  At one point, there was a compromise proposal > known as the "Big 10" design, because it was propounded at the Big Ten > Conference Center near O'Hare.  One feature of it was addresses of leng

Re: Consumer Grade - IPV6 Enabled Router Firewalls.

2009-12-12 Thread Rubens Kuhl
> I challenge the usual suspects to deliver actual working dual stack IPv6 ADSL > CPE rather than feigning interest.   None of the major CPE vendors appear to > have a v6 plan despite your claims.   We have an IPv6 dual stack trial for > ADSL going on and not a single CPE from the _major consume

Re: Consumer Grade - IPV6 Enabled Router Firewalls.

2009-12-12 Thread Rubens Kuhl
>> You're correct, out of the box there aren't many.  The first couple that >> come to mind are the Apple Airport Express and Airport Extreme, but I don't >> believe Linksys/Netgear/etc. have support out of the box. > > The Apple products do 6to4 out of the box, but don't support v6 natively. > >

Re: NetFlow analyzer software

2009-10-19 Thread Rubens Kuhl
Manage Engine flow receiver with no user sessions viewing statistics runs at 100% CPU for 200+ Mbps unsampled traffic. It's suited to SMBs only. Rubens On Mon, Oct 19, 2009 at 4:36 PM, Michael J McCafferty wrote: > ManageEngine's product is the one that kills browsers because you can tell it >

Re: Network Ring

2009-09-07 Thread Rubens Kuhl
My vote goes to proprietary ring protection from the vendor you choose: - EAPS (Extreme) - REP (Cisco) - MRP (Foundry/Brocade) - EPSR (Allied Telesis) Although EAPS is implemented in all Extreme switches, select models from the other vendors implement ring protection, but these models also do othe

Re: Cisco 6524 and MTU

2009-05-29 Thread Rubens Kuhl
We use Cisco 6524s with packets up to 1546 bytes with no issues. IOS ZU2, but we are testing SXI1 with no MTU issues so far. Rubens On Fri, May 29, 2009 at 8:35 PM, Warren Bailey wrote: > Has anyone encountered a 6524 dropping packets larger than 1492? IOS > 12.2(33)SXH2a > > Warren Bailey > G

Re: MRTG in Fourier Space

2009-04-23 Thread Rubens Kuhl
As IP traffic is assumed to be self-similar, my EE origins tell me to look for parameters that could measure it from stochastic process theory. On a Google search this paper sounded interesting: http://www.sparc.uni-mb.si/OPNET/PDF/IWSSIP2007Fras.pdf (...) We estimated the Hurst parameter (H) for t

Re: SkypeSetup Rogue Download

2009-04-19 Thread Rubens Kuhl
Could be a local trojan inserting bogus entries on the hosts file, could be DNS poisoning on one particular resolver, or an infection on the distribution source. Rubens On Sun, Apr 19, 2009 at 5:55 PM, Mari Nichols wrote: > I believe the file is originating directly from Skype.  Our writer >

Re: Do we still need Gi Firewall for 3G/UMTS/HSPA network ?

2009-04-09 Thread Rubens Kuhl
On shared media like radio access, every unwanted packet means less performance you will get out of the network. This can be done by NAT, stateful filtering with public IPs or stateless filtering with public IPs; the advantage of doing NAT is making it easier for the end-point software to know that

Re: Dynamic IP log retention = 0?

2009-03-11 Thread Rubens Kuhl
Covad telling you they don't keep logs is different from them not really having the logs... but, if they really don't keep logs, they are posing a risk that FBI or DHS might not be happy with. The feds will probably be more persuasive than you, so maybe hinting them about this situation may change

Re: Shaping on a large scale

2009-01-31 Thread Rubens Kuhl
Besides the other solutions listed, you can also take a look at Arbor (formerly Ellacoya) and Sandvine. Rubens On Fri, Jan 30, 2009 at 3:33 AM, Bruce Grobler wrote: > Hi, > > Does anyone know of any Shaping appliances to shape customers based on IP, > allow for a quota per IP and qos mechan

<    1   2   3   4   >