Re: SNMP "bridging"/proxy?

2016-05-20 Thread Robert Drake
On 5/20/2016 7:43 PM, Nathan Anderson wrote: 'lo all, Is anybody out there aware of a piece of software that can take data from an arbitrary source and then present it, using a MIB or set of OIDs of your choosing, as an SNMP-interrogatable device? We have some CPE that supports SNMP, but

Re: Best practices for sending network maintenance notifications

2016-04-06 Thread Robert Drake
I've been on hold a few times with some companies that had great 80's music. I almost asked them to put me back on hold when they finally took me off. Sometimes it's a party when one of the people on the call hits the hold button, it depends on how bad the outage is :) On 4/6/2016 4:56 PM,

tel script

2016-03-28 Thread Robert Drake
This is a program for logging into devices. You can find it here: https://github.com/rfdrake/tel I don't like to self promote things, but I'm interested in feedback. I'm also interested in alternatives if someone wrote something better. I started it a long time ago as a lighter clogin

Re: About inetnum "ownership"

2016-02-22 Thread Robert Drake
On 2/22/2016 5:03 AM, Jérôme Nicolle wrote: I'm wondering how did we made "Temporary and conditionnal liabality transfer" a synonym of "perpetual and inconditional usufruct transfer". May you please enlight me ? There are always ways around the system. I suspect what has happened is that

Re: Automated alarm notification

2016-02-15 Thread Robert Drake
OpenNMS has direct support for SNMP traps and multistage alerting. It's a pain in the ass to setup (depending on what you're doing*) but it's free and very high performance. * if all your MIBS are already supported then 90% of the work is done and it's not so bad. Just setup multistage

Re: Devices with only USB console port - Need a Console Server Solution

2016-02-02 Thread Robert Drake
On 2/2/2016 5:02 AM, Bjørn Mork wrote: No inside pictures :) Assuming that this is really an USB device, and that the console port is really an USB host port, it would be useful to know the USB decriptors of the device. You wouldn't be willing to connect it to a Linux PC and run "lsusb -vd",

Re: Cisco CMTS SNMP OID's

2016-01-25 Thread Robert Drake
This is from some internal PHP thing that isn't very good (well, it's lovely actually.. the problem is that it uses a forking method to query everything and isn't that fast. I'm trying to rewrite it) Throw any of these into google if you're confused about them. It should return the correct

Re: SNMP - monitoring large number of devices

2015-09-29 Thread Robert Drake
OpenNMS has a poller that will do what you want. The problem is figuring out what you wish to collect and how to use it. Most of the time it's not as simple as pointing at the modem and saying go. I've added a few oids for some of the modems we support, just so I can get SNR on them. I

Re: Extraneous "legal" babble--and my reaction to it.

2015-09-06 Thread Robert Drake
On 9/4/2015 6:31 PM, Stephen Satchell wrote: I, for one, feel your pain in this matter. When I was a consultant in The Bad Ol' Days, I had so many telephone numbers where I *could* be that my .sig would be a run-on one as well. As a compromise, I had my cell number and a hyperlink to a

Re: A simple perl script to convert Cisco IOS configuration to HTML with internal links for easier comprehension

2015-08-07 Thread Robert Drake
I was going to look at this because it sounded interesting. Maybe some extra things it could do would be to set div/classes in some parts of the config to denote what it is so that the user could apply css to style it. That would allow user-defined color syntax highlighting of a sort.

Re: Bright House IMAP highwater warning real?

2015-08-05 Thread Robert Drake
On 8/2/2015 3:53 PM, Jay Ashworth wrote: I think the body text of the message should identify it as coming from the Bright House email system? I think it should be written in standard USAdian English, which that is decidedly not. Or perhaps the problem is that that subject line was supposed

Re: SEC webpages inaccessible due to Firefox blocking servers with weak DH ciphers

2015-07-17 Thread Robert Drake
On 7/17/2015 4:26 AM, Alexander Maassen wrote: Well, this block also affects people who have old management hardware around using such ciphers that are for example no longer supported. In my case for example the old Dell DRAC's. And it seems there is no way to disable this block. Ok, it is

Re: Fwd: [ PRIVACY Forum ] Windows 10 will share your Wi-Fi key with

2015-07-08 Thread Robert Drake
On 7/7/2015 5:39 PM, Joe Greco wrote: Unclear at best. The way it is implemented, the user has the potential to go either way. A network might not want the user to have the choice, clearly, but there is certainly a subset of users who will opt out of the feature and I cannot see how those

Re: Looking for information on IGP choices in dual-stack networks

2015-06-10 Thread Robert Drake
On 6/9/2015 11:14 AM, Victor Kuarsingh wrote: We are looking particularly at combinations of the following IGPs: IS-IS, OSPFv2, OSPFv3, EIGRP. If you run something else (RIP?) then we would also like to hear about this, though we will likely document these differently. [We suspect you run

Is anyone working on an RFC for standardized maintenance notifications

2015-05-13 Thread Robert Drake
Like the Automated Copyright Notice System (http://www.acns.net/spec.html) except I don't think they went through any official standards body besides their own MPAA, or whatever. I get circuits from several vendors and get maintenance notifications from them all the time. Each has a

PDU for high amp 48Vdc

2015-01-28 Thread Robert Drake
For larger DC devices with ~50amps per side, does anyone have a software accessible way to turn off power? I've looked into PDU's but the ones I find have a max of 10amps. I've considered building something with solenoids or a rotary actuator that would turn the switches on or off, but that's

Re: The state of TACACS+

2014-12-29 Thread Robert Drake
On 12/29/2014 10:32 AM, Colton Conor wrote: My fear would be we would hire an outsourced tech. After a certain amount of time we would have to let this part timer go, and would disabled his or her username and password in TACAS. However, if that tech still knows the root password they could

Re: The state of TACACS+

2014-12-29 Thread Robert Drake
On 12/28/2014 10:21 PM, Christopher Morrow wrote: and I wonder what percentage of 'users' a vendor has actually USE tac+ (or even radius). I bet it's shockingly low... true.. even in large-ish environments centralized authentication presents problems and can have a limited merit. Up to some

Re: The state of TACACS+

2014-12-28 Thread Robert Drake
Picking back up where this left off last year, because I apparently only work on TACACS during the holidays :) On 12/30/2013 7:28 PM, Jimmy Hess wrote: Even 5 seconds extra for each command may hinder operators, to the extent it would be intolerable; shell commands should run almost

Re: abuse reporting tools

2014-11-18 Thread Robert Drake
On 11/18/2014 8:11 PM, Michael Brown wrote: We need to come up with some sort of international Abuse Reduction and Reporting Engagement Suite of Tools as a Service. M. I've been considering a post for a couple of weeks but decided most of my complaints were petty. I've been getting lots of

Re: Greenfield Access Network

2014-08-01 Thread Robert Drake
On 7/31/2014 12:07 PM, Colton Conor wrote: 1. The article mentioned DHCP doesn't do the other part of what PPPoE or PPPoA does, which is generate RADIUS accounting records that give us the bandwidth information. So that’s one of the main challenges in switching to a DHCP based system. So, how

Re: Carrier Grade NAT

2014-07-29 Thread Robert Drake
On 7/29/2014 12:42 PM, Chris Boyd wrote: There's probably going to be some interesting legal fallout from that practice. As an ISP customer, I'd be furious to find out that my communications had been intercepted due to the bad behavior of another user. --Chris Usually, unless the judge is

Re: Carrier Grade NAT

2014-07-29 Thread Robert Drake
On 7/29/2014 6:42 PM, Matt Palmer wrote: Of course, getting anything back*out* of that again in any sort of reasonable timeframe would be... optimistic. I suppose if you're storing it all in hadoop you can map/reduce your way out of trouble, but that's going to mean a lot of equipment sitting

Re: Verizon Public Policy on Netflix

2014-07-12 Thread Robert Drake
On 7/11/2014 11:38 AM, Miles Fidelman wrote: Well... if you make a phone call to a rural area, or a 3rd world country, with a horrible system, is it your telco's responsibility to go out there and fix it? One might answer, of course not. It's a legitimate position, and by this argument,

Re: Question on Cisco EEM Policies

2014-07-07 Thread Robert Drake
On 7/6/2014 5:07 PM, Daniel van der Steeg wrote: Hello all, I have implemented two EEM Policies using TCL on a Cisco Catalyst 6500, both of them running every X seconds. Now I am trying to find a way to monitor the CPU and memory usage of these policies, to determine their footprint. Does

Re: Cheap LSN/CGN/NAT444 Solution

2014-06-30 Thread Robert Drake
On 6/30/2014 1:59 AM, Skeeve Stevens wrote: Hi all, I am sure this is something that a reasonable number of people would have done on this list. I am after a LSN/CGN/NAT444 solution to put about 1000 Residential profile NBN speeds (fastest 100/40) services behind. I am looking at a Cisco

Re: question about bogon prefix

2014-06-09 Thread Robert Drake
On 6/9/2014 11:00 PM, Song Li wrote: Hi everyone, I found many ISP announced bogon prefix, for example: OriginAS Announcement Description AS7018 172.116.0.0/24unallocated AS209 209.193.112.0/20 unallocated my question is why the tier1 and other ISP announce these unallocated bogon

Re: ipmi access

2014-06-04 Thread Robert Drake
On 6/2/2014 1:42 PM, Brian Rak wrote: They do publish it. The problem is, it's not documented, and it takes a bunch of work to get into a usable state.See ftp://ftp.supermicro.com/GPL/SMT/SDK_SMT_X9_317.tar.gz Plus, the firmware environment is pretty hostile. If you flash some bad

Re: US patent 5473599

2014-05-07 Thread Robert Drake
On 5/7/2014 9:47 PM, Rob Seastrom wrote: The bar for an informational RFC is pretty darned low. I don't see anything in the datagram nature of i'm alive, don't pull the trigger yet that would preclude a UDP packet rather than naked IP. Hell, since it's not supposed to leave the LAN, one could

Re: We hit half-million: The Cidr Report

2014-05-01 Thread Robert Drake
On 4/29/2014 10:54 PM, Jeff Kell wrote: Yeah, just when we thought Slammer / Blaster / Nachi / Welchia / etc / etc had been eliminated by process of can't get there from here... we expose millions more endpoints... /me ducks too (but you know *I* had to say it) Slammer actually caused many

Re: We hit half-million: The Cidr Report

2014-05-01 Thread Robert Drake
On 5/1/2014 7:10 PM, Jean-Francois Mezei wrote: Pardon my ignorance here. But in a carrier-grade NAT implementation that serves say 5000 users, when happens when someone from the outside tries to connect to port 80 of the shared routable IP ? you still need to have explicit port forwarding to

Re: DNSSEC?

2014-04-11 Thread Robert Drake
On 4/11/2014 5:47 PM, Matt Palmer wrote: That's not DNSSEC that's broken, then. - Matt You're correct about that, but everything depends on your level of paranoia. The bug has a potential to show 64k of memory that may or may not be a part of the TLS/SSL connection*. In that 64k their

Re: Cisco warranty

2014-04-06 Thread Robert Drake
On 4/3/2014 12:44 PM, Laurent CARON wrote: Hi, I bought a C3750G-12S which is now end of sale on cisco website. This device is now defective. Since I bought it from a reseller and not directly from cisco, cisco is refusing to take it under warranty and tells me to have the reseller take

Re: Just wondering

2014-03-31 Thread Robert Drake
On 3/31/2014 10:51 PM, Joe wrote: I received several reports today regarding some scans for udp items from shadowservers hosted out of H.E. Seems to claim to be checking for issues regarding udp issues, amp issues, which I am all fine for, but my issue is this. It trips several IDP/IPS traps

Re: why IPv6 isn't ready for prime time, SMTP edition

2014-03-30 Thread Robert Drake
On 3/30/2014 12:11 AM, Barry Shein wrote: I don't know what WKBI means and google turns up nothing. I'll guess Well Known Bad Idea? Since I said that I found the idea described above uninteresting I wonder what is a WKBI from 1997? The idea I rejected? Also, I remember ideas being shot down

Re: Cisco Security Advisory

2014-03-28 Thread Robert Drake
On 3/28/2014 4:11 PM, Scott Weeks wrote: If a person is on multiple of *NOG mailing lists a lot of these're received. For example, I got well over 30 of them this round. It'd be nice to get something brief like this: -- The Semiannual Cisco IOS

Re: IPv6 isn't SMTP

2014-03-26 Thread Robert Drake
On 3/26/2014 10:16 PM, Franck Martin wrote: and user@2001:db8::1.25 with user@192.0.2.1:25. Who had the good idea to use : for IPv6 addresses while this is the separator for the port in IPv4? A few MTA are confused by it. At the network level the IPv6 address is just a big number. No

Re: IPv6 address literals probably aren't SMTP either

2014-03-26 Thread Robert Drake
On 3/26/2014 11:28 PM, John Levine wrote: It's messier than that. See RFC 5321 section 4.1.3. I have no idea whether anyone has actually implemented IPv6 address literals and if so, how closely they followed the somewhat peculiar spec. R's, John I'm not sure why the SMTP RFC defines

Re: Managing IOS Configuration Snippets

2014-03-02 Thread Robert Drake
On 2/28/2014 9:19 PM, Dale W. Carder wrote: If I'm understanding what you're trying to do, you could script around our rather unsophisticated 'sgrep' (stanza grep) tool combined with scripting around rancid rcs to do what I think you are looking for.

Re: Managing IOS Configuration Snippets

2014-02-26 Thread Robert Drake
On 2/26/2014 4:22 PM, Ryan Shea wrote: Howdy network operator cognoscenti, I'd love to hear your creative and workable solutions for a way to track in-line the configuration revisions you have on your cisco-like devices. Let me clearify/frame: You have a set of tested/approved configurations

Re: Filter NTP traffic by packet size?

2014-02-26 Thread Robert Drake
On 2/26/2014 5:33 PM, valdis.kletni...@vt.edu wrote: On Wed, 26 Feb 2014 11:44:55 -0600, Brandon Galbraith said: Blocking chargen at the edge doesn't seem to be outside of the realm of possibilities. What systems are (a) still have chargen enabled and (b) common enough to make it a viable

Re: Managing IOS Configuration Snippets

2014-02-26 Thread Robert Drake
On 2/26/2014 5:37 PM, Robert Drake wrote: Most people roll their own solution. If you're looking to do that consider using augeas for parsing the configuration files. It can be really useful for documenting changes, and probably to diff parts of the config. You might also consider

Re: Filter NTP traffic by packet size?

2014-02-26 Thread Robert Drake
On 2/26/2014 11:03 PM, Jimmy Hess wrote: The well known port assignments are advisory or recommended, for use by other unknown processes. the purpose of well known port assignments is for service location; the port number is not a sequence of application identification bits. The QUIC

Re: Atlanta - Patch Cables

2014-02-24 Thread Robert Drake
Cables and Kits is local to Atlanta and is great for last minute orders. You can pickup there if needed. http://www.cablesandkits.com/ On 2/21/2014 5:06 AM, Bobby Lacey wrote: In Atlanta doing an install for a client this weekend and it appears that the fiber/ethernet patch cables won't be

Re: GEO location issue with google

2014-02-19 Thread Robert Drake
For future reference, the last time this issue came up someone said doing this was a good way to get their geo stuff fixed automatically: http://tools.ietf.org/html/draft-google-self-published-geofeeds-02 I haven't messed with it yet, but it seems like a good idea. I want to write something

Re: Everyone should be deploying BCP 38! Wait, they are ....

2014-02-18 Thread Robert Drake
On 2/18/2014 2:19 PM, James Milko wrote: Is using data from a self-selected group even meaningful when extrapolated? It's been a while since Stats in college, and it's very likely the guys from MIT know more than I do, but one of the big things they pushed was random sampling. JM Isn't it

Re: BCP38 [Was: Re: TWC (AS11351) blocking all NTP?]

2014-02-05 Thread Robert Drake
On 2/5/2014 1:20 PM, Christopher Morrow wrote: I here tell the spoofer project people are looking to improve their data and stats... And reporting. I know it's not possible due to the limitations of javascript sandboxing, but this really needs to be browser based so it can be like DNSSEC or

The state of TACACS+

2013-12-30 Thread Robert Drake
Ever since first using it I've always liked tacacs+. Having said that I've grown to dislike some things about it recently. I guess, there have always been problems but I've been willing to leave them alone. I don't have time to give the code a real deep inspection, so I'm interested in

Re: apt-mirror near ashburn

2013-10-07 Thread Robert Drake
My suggestion is to use http://http.debian.net/debian as your source. It uses geo thingie to figure out the closest mirror to you. Code is on github if you're interested in how it works. https://github.com/rgeissert/http-redirector On 10/5/2013 11:11 PM, Christopher Morrow wrote: On Sat,

NANOG58 bad helo for hotel reservation emails

2013-05-07 Thread Robert Drake
Sorry for the noise, but I thought this might be of interest to anyone waiting for their hotel confirmation: NOQUEUE: reject: RCPT from feport01.hiltonhhonors.net[63.122.201.171]: 450 4.7.1 ironport.hhonorscrm.net: Helo command rejected: Host not found;

Re: Programmers can't get IPv6 thus that is why they do not have IPv6 in their applications....

2013-01-31 Thread Robert Drake
On 1/30/2013 9:10 PM, David Barak wrote: IPv6 has been launched on all Arris DOCSIS 3.0 C4 CMTSes, covering over 50% our network. The update you sent is lovely, except I can tell you that the one (also an Arris, running DOCSIS 3.0) which was installed in late October in my house in

Re: DNS resolver addresses for Sprint PCS/3G/4G

2013-01-22 Thread Robert Drake
On 1/16/2013 7:13 PM, Jay Ashworth wrote: I've noticed, for quite some time, that there seems to be a specific category of slow that I see in using apps on my HTC Supersonic/Sprint EVO, on both their 3G and 4G networks, and I wonder if it isn't because the defined resolvers are 8.8.4.4 and

Re: Question about DOCSIS DHCP vs ARP

2013-01-12 Thread Robert Drake
On Friday, January 11, 2013 8:29:23 PM, Jean-Francois Mezei wrote: Many thanks. In particular, you need cable-source-verify dhcp to prevent self assigned IPs that are unused by neighbours. Is this something that is now basically a default for all cable operators ? Or does this command add

Re: the little ssh that (sometimes) couldn't

2012-10-29 Thread Robert Drake
On 10/29/2012 02:54 PM, Jon Lewis wrote: Bush league. I debugged a similar issue on Sprint's network about 15 years ago, also nailing it down to which router/router hop had the problem When I was working for Sprint about 12 years ago, we had a circuit where the customer complained that we

Re: Update from the NANOG Communications Committee regarding recent off-topic posts

2012-08-02 Thread Robert Drake
On 7/30/2012 1:42 PM, Patrick W. Gilmore wrote: I'm sorry Panashe is upset by this rule. Interestingly, Your search - Panashe Flack nanog - did not match any documents. So my guess is that a post from that account has not happened before, meaning the post was moderated yet still made it

Re: Outgoing SMTP Servers

2011-10-25 Thread Robert Drake
On 10/25/2011 11:17 AM, Owen DeLong wrote: But that applies to port 25 also, so, I'm not understanding the difference. Other people running open port 587s tends to be quite self-correcting. At this point, so do open port 25s. The differences is in intentions from the user. All SMTP

Re: Outgoing SMTP Servers

2011-10-25 Thread Robert Drake
On 10/25/2011 10:19 PM, Blake Hudson wrote: I didn't see anyone address this from the service provider abuse department perspective. I think larger ISP's got sick and tired of dealing with abuse reports or having their IP space blocked because of their own (infected) residential users sending

Re: Yahoo and IPv6

2011-05-14 Thread Robert Drake
On 5/10/2011 12:57 AM, Jeff Wheeler wrote: Your suggestion has two main disadvantages: 1) it doesn't work on some platforms, because input ACL won't stop ND learn/solicit -- obviously this is bad 2) it requires you to configure a potentially large input ACL on every single interface on the box,