Re: Root Zone DNSSEC Deployment Technical Status Update

2010-05-16 Thread Rubens Kuhl
You probably need a trust anchor as well. See http://ftp.isc.org/isc/pubs/tn/isc-tn-2006-1.html. Rubens On Sun, May 16, 2010 at 3:14 PM, itservices88 itservice...@gmail.com wrote: Hi, I was building a test domain for trying out the dnssec. However as mentioned on various websites ad appears

Re: Junos Asymmetric Routing

2010-05-30 Thread Rubens Kuhl
You need to put a filter on your interfaces that references a filter later on to not session track a flow.  I think you need to be running Junos-jsr[0] 10.0 or 10.1 to use this : The same goes for 9.x, just be sure to except traffic to the router (like BGP session) from the packet-mode, they

Re: Junos Asymmetric Routing

2010-05-30 Thread Rubens Kuhl
On Sun, May 30, 2010 at 1:46 PM, Florian Weimer f...@deneb.enyo.de wrote: * Randy Bush: your perfectly fine multihop BGP session could break when rerouting occurs. one of the many reasons that there are no perfectly fine multi-hop bgp sessions. Uhm, is there a way around them when

Re: Google Issues?

2010-06-10 Thread Rubens Kuhl
This usually indicates a heavily malware-contaminated userbase or 1-to-N NAT/PAT with a large N. Having both is what usually triggers this, but sometimes if you are strong on one, it could be enough. Rubens On Thu, Jun 10, 2010 at 4:23 PM, Thomas Magill tmag...@providecommerce.com wrote: Is

Re: Upcoming Improvements to ARIN's Directory Service

2010-06-10 Thread Rubens Kuhl
I'm ok with whatever system they provide if the functionality stays the same.  I don't understand what they gain by making a human login and download the file. Accountability. If versions X and Y of database got abused (breach of ToS), and only user U has downloaded such versions, gotcha.

Re: Future of WiMax

2010-06-16 Thread Rubens Kuhl
The future of WiMAX seems a lot less promising now that FD-LTE is the clear winner for wide-scale mobile deployment, and TD-LTE, 802.11n and proprietary technologies will compete for non-paired spectrum and/or niche markets. But one can build a network with WiMAX and make money out of it; global

Re: Mikrotik OC-3 Connection

2010-07-04 Thread Rubens Kuhl
If your routing platform doesn't have POS OC-3, you can use a converter to map Ethernet services to it and keep using the platform you've been using. You lose a little on efficiency and failure detection, but turning BFD on might help: http://wiki.mikrotik.com/wiki/Manual:Routing/BFD I've worked

Re: IPv4 Exhaustion...

2010-07-26 Thread Rubens Kuhl
Between e-discovery and RIAA issues, retention times are probably shrinking even though capacity for retention is growing. Capacity for retention has grown but one still needs fast searching of data, or a few LEA requests on the same day or week will overflow your capacity to answer them.

Re: DNSSEC and SSL

2010-08-23 Thread Rubens Kuhl
The fact hat Verisign kept the domain business and sold the CA business to Symantec tells which business they think is stronger. Rubens On Sat, Aug 21, 2010 at 10:00 PM, ML m...@kenweb.org wrote: Would a future with a ubiquitous DNSSEC deployment eliminate the market for commercial CAs?

Re: Routers in Data Centers

2010-09-26 Thread Rubens Kuhl
On Sun, Sep 26, 2010 at 8:54 PM, ym1r...@gmail.com wrote: As far as I know open source solutions doesn't have support for fabric or high speed asics. So the throughput will always be a big difference. Unless you are comparing a pure packet software interrupt platform. Not high speed ASICs,

Re: Tools for teaching users online safety

2010-10-25 Thread Rubens Kuhl
One can start with http://antispam.br/videos/english/ Rubens On Mon, Oct 25, 2010 at 11:13 PM, Alex Thurlow a...@blastro.com wrote: I'm trying to find out if there are currently any resources available for teaching people how to be safe online.  As in, how to not get a virus, how to pick

Re: starwars.com subdomain hijacked?

2010-11-22 Thread Rubens Kuhl
On Mon, Nov 22, 2010 at 1:46 PM, Matt Disuko gourmetci...@hotmail.com wrote: It seems the subdomain shop.starwars.com is being redirected. Anybody else seeing this? The Rebel Alliance managed to hit that site, but the Empire struck back and it's back online again. Rubens

Re: Some truth about Comcast - WikiLeaks style

2010-12-14 Thread Rubens Kuhl
On Tue, Dec 14, 2010 at 3:07 AM, Backdoor Santa backdoorsan...@hotmail.com wrote: Ever wonder what Comcast's connections to the Internet look like? In the tradition of WikiLeaks, someone stumbled upon these graphs of their TATA links. For reference, TATA is the only other IP transit provider

Re: A top-down RPKI model a threat to human freedom? (was Re: Level 3's IRR Database)

2011-02-01 Thread Rubens Kuhl
There is not a single RIR that is not physically located in a country. You can hope they are more stable from a policy point of view, but, the reality is that if someone shows up at the front door with tanks and mortars, my money is not on the RIR. But they might choose a country in that

Re: ipv4's last graph

2011-02-01 Thread Rubens Kuhl
On Tue, Feb 1, 2011 at 6:11 PM, Geoff Huston g...@apnic.net wrote: On 01/02/2011, at 7:02 PM, Randy Bush wrote: with the iana free pool run-out, i guess we won't be getting those nice graphs any more.  might we have one last one for the turnstiles?  :-)/2 and would you mind doing the curves

Re: Bovespa

2011-02-02 Thread Rubens Kuhl
On Wed, Feb 2, 2011 at 2:22 AM, Philip Lavine source_ro...@yahoo.com wrote: 1. Does anyone know where the Bovespa is located and if colocation is a possibility at that datacenter/s. Sao Paulo downtown, although it is unclear at this time if it will stay there or not. They do not provide

Re: Connectivity to Brazil

2011-02-02 Thread Rubens Kuhl
CTBC has capacity from GBLX, TIWS and SEABONE, although not all prefixes are announced to all providers. TIWS usual path in the US is thru Level 3, so steering the traffic to Level 3 might do the trick. Rubens On Wed, Feb 2, 2011 at 11:08 AM, Steve Danelli the76po...@gmail.com wrote: Thanks

Re: And so it ends (slightly off topic)

2011-02-03 Thread Rubens Kuhl
On Thu, Feb 3, 2011 at 2:04 PM, Ronald Bonica rbon...@juniper.net wrote: Folks, Somehow, it is appropriate that this should happen on February 3. On February 3, 1959, Buddy Holly, Richie Valens and JP Richardson (aka The Big Bopper) died in a plane crash. Don McLean immortalized that day as

Self-referential whois queries

2011-02-10 Thread Rubens Kuhl
I'm noticing an increase in getting query rate exceeded at whois services that might be connected to a symptom described by ARIN at NANOG 48/ARIN XXV and ARIN XXVI where machines ask for the whois record of their own IP address. Are there any clues of what is causing this ? Rubens

Re: Self-referential whois queries

2011-02-10 Thread Rubens Kuhl
I'm noticing an increase in getting query rate exceeded at whois services that might be connected to a symptom described by ARIN at NANOG 48/ARIN XXV and ARIN XXVI where machines ask for the whois record of their own IP address. Are there any clues of what is causing this ? Some spam bots

Re: Switch with 24x SFP PVLAN QinQ Layer 2

2011-03-02 Thread Rubens Kuhl
Requirements are basically just 24/48 SFP ports, PVLAN and selective QinQ. Most devices that fit the requirements are Layer 3, which pushes the cost per port too high. Cisco ME6524 has a model with 32 SFP ports (24 with 3:1 oversubscription, 8 non-oversubscribed) and IP Base IOS which has very

Re: Suggestions for managed DNS provider?

2013-02-14 Thread Rubens Kuhl
On Thu, Feb 14, 2013 at 5:58 PM, David Hubbard dhubb...@dino.hostasaurus.com wrote: Hi all, anyone have suggestions for very stable/reliable managed DNS? Neustar/UltraDNS is an obvious option to look at, just curious about alternatives. Cost effective would be nice, but stable under attack is

Re: Suggestions for managed DNS provider?

2013-02-15 Thread Rubens Kuhl
On Thu, Feb 14, 2013 at 10:31 PM, Bill Woodcock wo...@pch.net wrote: On Feb 14, 2013, at 12:06 PM, Rubens Kuhl rube...@gmail.com wrote: Not tested under attack, but this DNS provider is worth a look since it's the only one with both IPv6 and DNSSEC a colleague could find: http

Re: Cisco 6524 and MTU

2009-05-29 Thread Rubens Kuhl
We use Cisco 6524s with packets up to 1546 bytes with no issues. IOS ZU2, but we are testing SXI1 with no MTU issues so far. Rubens On Fri, May 29, 2009 at 8:35 PM, Warren Bailey wbai...@gci.com wrote: Has anyone encountered a 6524 dropping packets larger than 1492? IOS 12.2(33)SXH2a

Re: NetFlow analyzer software

2009-10-19 Thread Rubens Kuhl
Manage Engine flow receiver with no user sessions viewing statistics runs at 100% CPU for 200+ Mbps unsampled traffic. It's suited to SMBs only. Rubens On Mon, Oct 19, 2009 at 4:36 PM, Michael J McCafferty m...@m5computersecurity.com wrote: ManageEngine's product is the one that kills browsers

Re: Consumer Grade - IPV6 Enabled Router Firewalls.

2009-12-12 Thread Rubens Kuhl
You're correct, out of the box there aren't many.  The first couple that come to mind are the Apple Airport Express and Airport Extreme, but I don't believe Linksys/Netgear/etc. have support out of the box. The Apple products do 6to4 out of the box, but don't support v6 natively. Apple

Re: Consumer Grade - IPV6 Enabled Router Firewalls.

2009-12-12 Thread Rubens Kuhl
I challenge the usual suspects to deliver actual working dual stack IPv6 ADSL CPE rather than feigning interest.   None of the major CPE vendors appear to have a v6 plan despite your claims.   We have an IPv6 dual stack trial for ADSL going on and not a single CPE from the _major consumer

Re: Nxdomain redirect revenue

2011-09-27 Thread Rubens Kuhl
On Tue, Sep 27, 2011 at 11:48 AM, valdis.kletni...@vt.edu wrote: On Tue, 27 Sep 2011 10:20:25 EDT, William Allen Simpson said: It's not legal for an ISP to modify computer data.  Especially digitally signed data.  That's a criminal offense. Citation? Could tampering with DNSSEC and/or TLS

Re: Nxdomain redirect revenue

2011-09-27 Thread Rubens Kuhl
On Tue, Sep 27, 2011 at 7:29 PM, David E. Smith d...@mvn.net wrote: On Tue, Sep 27, 2011 at 17:08, Jimmy Hess mysi...@gmail.com wrote: That is, HTTPs should become assumed. As much as that would be wonderful from a security standpoint, IMO it's not realistic to expect every mom-and-pop

Re: Ok; let's have the Does DNAT contribute to Security argument one more time...

2011-11-14 Thread Rubens Kuhl
For the common good it doesn't matter if the NAT is good guys are right or the NAT is useless guys are right, as they both fail to decrease the numbers of their opposing parts. We must get IPv6 done for both of them. It seems that application reverse-proxies can make NAT is good guys happy, so

Re: Minimum Allocation Size by RIRs (IPv4)

2011-11-15 Thread Rubens Kuhl
On Tue, Nov 15, 2011 at 12:56 PM, Fredy Kuenzler kuenz...@init7.net wrote: I'm trying to compile a comprehensive and up-to-date list of Minimum Allocation Sizes by the various RIRs. Any hint would be appreciated. I have so far: NIRs (National Internet Registries) in the APNIC and LACNIC area

Re: Contact for Telefonica (AS12956)

2011-11-23 Thread Rubens Kuhl
On Wed, Nov 23, 2011 at 12:54 PM, Brandon Ewing nicot...@warningg.com wrote: Greetings, Can someone put me in contact with someone with clue in the Telefonica backbone?  One of their downstreams is hijacking a prefix of mine as a /24. I've also started advertising the /24 to my upstreams, but

Re: De-bogon not possible via arin policy.

2011-12-14 Thread Rubens Kuhl
Fyi, I just was rejected from arin for an ipv4 allocation. I demonstrated I own ~100k ipv4 addresses today. My customers use over 10 million bogon / squat space ip addresses today, and I have good attested data on that. But all I can qualify for is a /18, and then in 3 months maybe a /17.

Re: Akamai/Integra issue?

2012-01-25 Thread Rubens Kuhl
May be the attack on Facebook put Akamai into DEFCON 1 ? http://www.readwriteweb.com/archives/anonymous_claims_responsibility_for_facebook_outag.php Rubens On Wed, Jan 25, 2012 at 10:14 PM, Thomas Magill tmag...@providecommerce.com wrote: This morning we began having issues at one of our

Re: Verisign deep-hacked. For months.

2012-02-03 Thread Rubens Kuhl
On Thu, Feb 2, 2012 at 10:34 PM, Jeff Wheeler j...@inconcepts.biz wrote: On Thu, Feb 2, 2012 at 7:26 PM, Suresh Ramasubramanian ops.li...@gmail.com wrote: So what part of VRSN got broken into?  They do a lot more than just DNS. Indeed, VeriSign owns Illuminet, who are mission-critical for

Re: Optimal IPv6 router

2012-02-06 Thread Rubens Kuhl
With IPv6 growing, if we were to design a native IPv6 router, with IPv4 functionality thrown in, then is it possible to design a more optimal IPv6 router, than what exists today? OK, I'll bite.  What would qualify as a native IPv6 router?  Is this another concept as silly as hardware vs

Re: Concern about gTLD servers in India

2012-03-10 Thread Rubens Kuhl
I can tell you with 100% certainty that when I was responsible for handling ccTLD delegation changes that we took the issue of ccTLDs being operated for the benefit of the Internet community in that country, and the global Internet community as a whole, very seriously. I have no reason to

Re: airFiber

2012-03-31 Thread Rubens Kuhl
On Thu, Mar 29, 2012 at 1:34 PM, Eugen Leitl eu...@leitl.org wrote: Claim: 1.4 GBit/s over up to 13 km, 24 GHZ, @3 kUSD/link price point. http://www.ubnt.com/airfiber Claims are actually Up to 1.4 Gbps and Up to 13 km; those two conditions probably cannot be satisfied together. 1.4 Gbps is

Re: Attack on the DNS ?

2012-04-01 Thread Rubens Kuhl
On Sat, Mar 31, 2012 at 10:09 PM, Greg Ihnen os10ru...@gmail.com wrote: I manage a tiny network in the Amazon, a satellite internet connection and decent sized wireless network. Is DNS traffic being directed to bogus servers? Are the real servers being overloaded? Am I seeing the results of

Re: rpki vs. secure dns?

2012-04-28 Thread Rubens Kuhl
In case you feel a BGP announcement should not be RPKI Invalid but something else, you do what's described on slide 15-17: https://ripe64.ripe.net/presentations/77-RIPE64-Plenery-RPKI.pdf The same currently happens with DNSSEC, doing what Comcast calls negative trust anchors:

Re: [lacnog] Peering in Brazil

2012-05-03 Thread Rubens Kuhl
I am looking for any guidance and advice people have regarding first time peerings in South America. Currently I am doing some work with a content provider in North America and I want to get them better routers into South America, to South American ISPs. I am looking to get them an

Re: Wacky Weekend: The '.secure' gTLD

2012-05-31 Thread Rubens Kuhl
On Thu, May 31, 2012 at 9:19 PM, Jay Ashworth j...@baylink.com wrote: - Original Message - From: Jay Ashworth j...@baylink.com Subject: Wacky Weekend: The '.secure' gTLD I see that LWN has already spotted this; smb will no doubt be pleased to know that the very first reply suggests

Re: Heads-Up: GoDaddy Broke the Interwebs...

2012-09-11 Thread Rubens Kuhl
No large flows reported to the affected NSes, tweets were suspicious at best, other anon-ops denied the attack was them, and GoDaddy admitted internal error. I'm going to take GoDaddy at their word, and give them major kudos for owning up to the mistake - in public. That doesn't mean

Re: Shaping on a large scale

2009-01-31 Thread Rubens Kuhl
Besides the other solutions listed, you can also take a look at Arbor (formerly Ellacoya) and Sandvine. Rubens On Fri, Jan 30, 2009 at 3:33 AM, Bruce Grobler br...@yoafrica.com wrote: Hi, Does anyone know of any Shaping appliances to shape customers based on IP, allow for a quota per IP

Re: Dynamic IP log retention = 0?

2009-03-11 Thread Rubens Kuhl
Covad telling you they don't keep logs is different from them not really having the logs... but, if they really don't keep logs, they are posing a risk that FBI or DHS might not be happy with. The feds will probably be more persuasive than you, so maybe hinting them about this situation may change

Re: Do we still need Gi Firewall for 3G/UMTS/HSPA network ?

2009-04-09 Thread Rubens Kuhl
On shared media like radio access, every unwanted packet means less performance you will get out of the network. This can be done by NAT, stateful filtering with public IPs or stateless filtering with public IPs; the advantage of doing NAT is making it easier for the end-point software to know

Re: SkypeSetup Rogue Download

2009-04-19 Thread Rubens Kuhl
Could be a local trojan inserting bogus entries on the hosts file, could be DNS poisoning on one particular resolver, or an infection on the distribution source. Rubens On Sun, Apr 19, 2009 at 5:55 PM, Mari Nichols m...@imarsolutions.com wrote: I believe the file is originating directly from

Re: MRTG in Fourier Space

2009-04-23 Thread Rubens Kuhl
As IP traffic is assumed to be self-similar, my EE origins tell me to look for parameters that could measure it from stochastic process theory. On a Google search this paper sounded interesting: http://www.sparc.uni-mb.si/OPNET/PDF/IWSSIP2007Fras.pdf (...) We estimated the Hurst parameter (H) for

Re: Using /126 for IPv6 router links

2010-01-24 Thread Rubens Kuhl
During the days of the IPng directorate, quite a number of different alternatives were considered.  At one point, there was a compromise proposal known as the Big 10 design, because it was propounded at the Big Ten Conference Center near O'Hare.  One feature of it was addresses of length

40G/100G options at this time

2010-02-19 Thread Rubens Kuhl
Hi. Are there solutions already available implementing 40GBASE-LR4, 100GBASE-LR4 and 100GBASE-ER4 draft standards ? By solutions it means both switches with CFP-MSA/QSFP/CXP ports and the modules. Rubens

Re: Competition for Internap's FCP product.

2010-02-25 Thread Rubens Kuhl
Is your burstable bandwidth cost high enough to pay 100K for a gear just to meet the commitments ? NAGIOS/CACTI monitoring alerts sent to someone (which may be hired help from any place in the world) would probably beat that in cost effectiveness. The performance requirement is where a line is

Re: Cisco hardware question

2010-03-04 Thread Rubens Kuhl
We have noticed that a number of Cisco appliances we have recently purchased and paid (AS NEW), are being shipped as if they have been already used/refurbished. In other words, several times we have seen brand new Cisco hardware, out of the box, that has pre-existing configuration

Re: CRS-3

2010-03-09 Thread Rubens Kuhl
On Tue, Mar 9, 2010 at 4:51 PM, Brian Feeny bfe...@mac.com wrote: So who is going to be the first to deploy these? http://newsroom.cisco.com/dlls/2010/prod_030910.html - Download the entire Library of Congress in just over 1 second - Stream every motion picture ever created in less than

Re: 10GBase-t switch

2010-03-11 Thread Rubens Kuhl
Arista EOS - what good/bad things do you have to say about their management capabilities? which known brand can it be compared to? I couldn't help myself thinking that the name of an operanting system shouldn't resemble End of Sales that much. Rubens

Re: Network Naming Conventions

2010-03-14 Thread Rubens Kuhl
On Sat, Mar 13, 2010 at 6:01 PM, Paul Stewart pstew...@nexicomgroup.net wrote: Yeah, just learning that... got a *tonne* of offline replies. Planets won't work well, simpson characters we'll run out very quickly umm.. forgot the rest.  We were looking for something that makes sense to the

Re: CPE Ethernet switch suggestions

2010-04-05 Thread Rubens Kuhl
Although also being a small SOHO switch, may be Netgear GS-108T can suit your needs. I want remove the initial staging step by allowing the installer to just plug the switch in and have the switch grab a config from a TFTP server noted by a DHCP option. Not quite, it can download config from

Re: Juniper's artificial feature blocking (was legacy /8)

2010-04-05 Thread Rubens Kuhl
On Sun, Apr 4, 2010 at 4:33 PM, Michael Sokolov msoko...@ivan.harhan.org wrote: Tore Anderson tore.ander...@redpill-linpro.com wrote: Juniper.  If you want to run OSPFv3 on their layer 3 switches, you need a quite expensive advanced licence.  OSPFv2, on the other hand, is included in the base

Re: Router for Metro Ethernet

2010-04-13 Thread Rubens Kuhl
On Tue, Apr 13, 2010 at 3:06 PM, Holmes,David A dhol...@mwdh2o.com wrote: We use Cisco 3750 L3 switches for Metro Ethernet connectivity. The 3750 SFPs can run at wire speed up to 1 GiGE. The 3750s are very reliable, and have good, follow-the-sun technical support in case of problems. Some

Re: How is IPv6 deployment going in the APNIC region?

2011-04-14 Thread Rubens Kuhl
That is extremely curious. How can they justify taking 4 million addresses for research two days before running out of regularly allocatable address space? They could have taken that /10 out of the final /8 rather than taking it from the last scraps of regular space if they really need a

Re: IPv4 address exchange

2011-04-18 Thread Rubens Kuhl
perhaps, if you are seeking support for commercial activity, you should make your employment more clear and declare any conflicts of interest. Fair enough. I am employed by Cisco Systems, but all of my statements are my own and I do not represent my employer.  I believe that my employer

Re: RES: Anyone still maintaining altdb.net?

2011-04-23 Thread Rubens Kuhl
You can try the SCW IRR [1]. It's free, but is in Portuguese. Reference: [1] http://whois.scw.net.br/ -- Eduardo Schoedler Sounds like that doesn't help the OP, who wanted help with RPSL, not *really* help from AltDB. Actually it does, because of a wizard (http://irr.scw.net.br/new) to

Re: How do you put a TV station on the Mbone? (was: Royal Wedding...)

2011-04-29 Thread Rubens Kuhl
Isn't the real problem with global multicast: How do we ultimately bill the broadcaster for all that traffic amplification that happened *inside* every other AS? It seems like you'd have to do per-packet accounting at every router, and coordinate billing/reporting amongst all providers that

Re: How do you put a TV station on the Mbone? (was: Royal Wedding...)

2011-04-29 Thread Rubens Kuhl
On Fri, Apr 29, 2011 at 2:48 PM, Jay Ashworth j...@baylink.com wrote: - Original Message - From: Rubens Kuhl rube...@gmail.com Isn't the real problem with global multicast: How do we ultimately bill the broadcaster for all that traffic amplification that happened *inside* every

Re: Rogers Canada using 7.0.0.0/8 for internal address space

2011-05-24 Thread Rubens Kuhl
On Mon, May 23, 2011 at 12:28 PM, Mark Farina markfarin...@gmail.com wrote: As of April 27th I have started to receive dhcp broadcast requests originating from the 7.0.0.0/8 network. Based on MAC addresses, it seems that this is communication between the Rogers border/node hardware (MAC

Re: Rogers Canada using 7.0.0.0/8 for internal address space

2011-05-24 Thread Rubens Kuhl
Is the DoD releasing this range to Rogers? Or has Rogers squatted on this space due to exhaustion of their 10/8 use? We've seen other Squatting resources from an organization that can deploy F/A-18 Hornets, F/A-22 Raptors, Predator drones or Navy SEALs is probably bad to your health. It's

Re: Verisign Internet Defence Network

2011-05-30 Thread Rubens Kuhl
ms made by the product descriptions seem suspect to me. it claims to be Carrier-agnostic and ISP-neutral, yet When an event is detected, Verisign will work with the customer to redirect Internet traffic destined for the protected service to a Verisign Internet Defense Network site. anyone

Re: best practices for management nets in IPv6

2011-07-12 Thread Rubens Kuhl
On Tue, Jul 12, 2011 at 6:31 PM, Tom Ammon tom.am...@utah.edu wrote: Hi All, We're pushing to get IPv6 deployed and working everywhere in our operation, and I had some questions about best practices for a few things. On your management nets (network device management nets) , what's the best

Re: Looking for Netflow analysis package

2013-05-14 Thread Rubens Kuhl
On Tue, May 14, 2013 at 11:18 PM, Jason Lester jles...@wcs.k12.va.uswrote: ManageEngine's NetFlow Analyzer will do most of that (not sure about AS Path Analysis.) It is priced per monitored interface, but is pretty reasonable for what it does. They have a 30-day demo available. We use

Re: Re: This is a coordinated hacking. (Was Re: Need help in flushing DNS)

2013-06-20 Thread Rubens Kuhl
On Thu, Jun 20, 2013 at 8:41 PM, Timothy Morizot tmori...@gmail.com wrote: On Jun 20, 2013 5:31 PM, Randy Bush ra...@psg.com wrote: and dnssec did not save us. is there anything which could have? Hmmm. DNSSEC wouldn't have prevented an outage. But from everything I've seen reported, had

Re: .nyc - here we go...

2013-07-02 Thread Rubens Kuhl
On Tue, Jul 2, 2013 at 10:12 PM, Scott Weeks sur...@mauigateway.com wrote: careful there may be a troll in here... :) https://en.wikipedia.org/wiki/.nyc As of July 2, 2013, .nyc has been approved by ICANN as a city-level top-level domain (TLD) for New York City .nyc has been approved

Re: .nyc - here we go...

2013-07-02 Thread Rubens Kuhl
Thank you for explaining this. Again, probably. So the cities in those countries could buy them (if they could afford them) but not the countries? So .portvila is available, but not .vanuatu? Yes. Country names will be part of the expansion of the ccTLD space, where usually countries are

Re: .nyc - here we go...

2013-07-02 Thread Rubens Kuhl
On Wed, Jul 3, 2013 at 12:21 AM, Paul Ferguson fergdawgs...@gmail.com wrote: On Tue, Jul 2, 2013 at 8:12 PM, Rubens Kuhl rube...@gmail.com wrote: Summary: there are residual risks, but the checks and balances of the process are likely to stop bad actors, at the cost of also stopping some

Re: .nyc - here we go...

2013-07-02 Thread Rubens Kuhl
Great, Let's see what happens. If history is any teacher... There is not much history here to look at... .cc and .tk are ccTLDs, based out of sovereign states. They are delegated into the root by ICANN (more precisely by IANA, which is currently a contract also granted to ICANN) and that's

Re: .nyc - here we go...

2013-07-04 Thread Rubens Kuhl
On Thu, Jul 4, 2013 at 12:00 PM, Ted Cooper ml-nanog0903...@elcsplace.comwrote: On 03/07/13 11:12, Scott Weeks wrote: As of July 2, 2013, .nyc has been approved by ICANN as a city-level top-level domain (TLD) for New York City Do they have DNSSEC from inception? It would seem a sensible

Re: RPKI and Trust Anchor question

2013-08-05 Thread Rubens Kuhl
NRO, the RIRs collective, is still working on this. It's listed as an open action item since Q2 this CY at NRO Executive Council meetings: http://www.nro.net It's very unlikely that ICANN, which sees the NRO as it's address support organization, will move on this before NRO does. Rubens

Re: DNS Reliability

2013-09-12 Thread Rubens Kuhl
On Thu, Sep 12, 2013 at 5:03 PM, Phil Fagan philfa...@gmail.com wrote: Everything else remaining equal...is there a standard or expectation for DNS reliability? 98% 99% 99.5% 99.9% 99.99% 99.999% Measured in queries completed vs. queries lost. Whats the consensus? ICANN new gTLD

Re: nanog.org website - restored

2013-10-07 Thread Rubens Kuhl
For those interested, we would like to share some details of this event. It was noticed a couple weeks ago that a lack of memory conditon was present on the NANOG servers in Chicago. Temporary measures were taken to clear processes and restart the server, but this only temporarialy restored

Re: turning on comcast v6

2013-12-09 Thread Rubens Kuhl
On Mon, Dec 9, 2013 at 5:08 PM, Christopher Morrow morrowc.li...@gmail.com wrote: On Mon, Dec 9, 2013 at 1:28 PM, Michael Brown mich...@supermathie.net wrote: On 13-12-09 01:19 PM, John Lightfoot wrote: We don't even support IPv5 yet, so it will be a while before we support v6.

Re: Mikrotik Cloud Core Router and BGP real life experiences?

2013-12-31 Thread Rubens Kuhl
On Fri, Dec 27, 2013 at 6:47 AM, Martin Hotze m.ho...@hotze.com wrote: Hi, looking at the specs of Mikrotik Cloud Core Routers it seems to be to good to be true [1] having so much bang for the bucks. So virtually all smaller ISPs would drop their CISCO gear for Mikrotik Routerboards. The

Re: trivial changes to DNS (was: OpenNTPProject.org)

2014-01-16 Thread Rubens Kuhl
On Thu, Jan 16, 2014 at 2:27 PM, Andrew Sullivan asulli...@dyn.com wrote: On Tue, Jan 14, 2014 at 09:18:30AM +0200, Saku Ytti wrote: mid term, transport area in IETF. DNS, NTP, SNMP, chargen et.al. could trivially change to QUIC/MinimaLT Oh, yes, it'd obviously be trivial to change DNS

Re: Route Server Filters at IXPs and 4-byte ASNs

2014-01-25 Thread Rubens Kuhl
What happens, if the IXP uses a 4-byte ASN? RFC5668 (4-Octet AS Specific BGP Extended Community) defines Global Admin,4bytes:Local Admin, 2bytes. I have been asking some IXP operators, about their practice and their reply was 4-byte ASNs are supported by our RS. What's your experience? Did

LACNIC becomes the first RIR to go below /9 of available IP space

2014-05-20 Thread Rubens Kuhl
http://www.lacnic.net/en/web/lacnic/inicio Website is still showing phase 0 of address depletion, but the updated quantity means that the /9 trigger has been reached. Rubens

Re: IPv6 at 50% for VZW (Re: NAT IP and Google)

2014-05-22 Thread Rubens Kuhl
Jared, Akamai has been v6 enabled for years. Customers have choices and know best. Isn't your network still offering both as customer choices? :-) Making new customers dual-stack by default for the last two years would have gone far in increasing IPv6, unless Akamai is only losing

Re: World Cup Streaming

2014-06-08 Thread Rubens Kuhl
Sports events have their rights sold on per country basis; this leads to some fragmentation of those numbers as network X has the rights for country 1, network Y for country 2, and they account their numbers separate even if they use the same CDN. Considering Soccer (or Football as we non-US call

End of IPv4 addresses in LAC region

2014-06-10 Thread Rubens Kuhl
It has been just announced in LAC network operator mailing lists that the LAC region just crossed the /10 boundary, triggering exhaustion policies that now only allow assignments of /22 IP address blocks, either for initial assignments or additional requests. Next in line, ARIN region. Is

Re: Verizon Public Policy on Netflix

2014-07-10 Thread Rubens Kuhl
On Thu, Jul 10, 2014 at 5:01 PM, Jay Ashworth j...@baylink.com wrote: Here's a link to a post from VZN's public policy blog, about Netflix. Now, just as a matter of principle, I tend to assume that anything VZN says in public is a self-serving lie based on a poor understanding of the Real

Re: Verizon Public Policy on Netflix

2014-07-13 Thread Rubens Kuhl
On Sun, Jul 13, 2014 at 8:55 PM, Brett Glass na...@brettglass.com wrote: At 05:33 PM 7/13/2014, Tom Hill wrote: By the way, don't think you're not going to have to pay us for all for that dirt you're hurling... Building new things often does involve digging up dirt. Unlike Netflix, we'd

Re: Verizon Public Policy on Netflix

2014-07-14 Thread Rubens Kuhl
If Netflix were a good citizen, it would (a) let ISPs cache content; (b) pay them equitably for direct connections (smaller and more remote ISPs have higher costs per customer and should get MORE per account than Comcast, rather than receiving nothing); and (c) work with ISPs to develop

Re: Inevitable death, was Re: Verizon Public Policy on Netflix

2014-07-15 Thread Rubens Kuhl
On Tue, Jul 15, 2014 at 12:12 PM, Brett Glass na...@brettglass.com wrote: At 08:48 AM 7/15/2014, Naslund, Steve wrote: The name of the game is to decongest your network for the least amount of money. I disagree with some of your other points, but on this we agree. And caching is the best

Re: Inevitable death, was Re: Verizon Public Policy on Netflix

2014-07-15 Thread Rubens Kuhl
Given your expertise seems to be wireless links, you could also backhaul using Ubiquiti Airfiber: http://www.ubnt.com/airfiber/airfiber5/ That Ubiquiti radio reaches at most one mile reliably due to rain fade. Most of our links go much farther. Wireless is our specialty and we do know our

Re: Inevitable death, was Re: Verizon Public Policy on Netflix

2014-07-15 Thread Rubens Kuhl
On Tue, Jul 15, 2014 at 3:08 PM, Brett Glass na...@brettglass.com wrote: At 11:40 AM 7/15/2014, Rubens Kuhl wrote: Read again. You answered thinking about AirFiber 24, while he mentioned AirFiber 5, which goes much longer. Ah. I assumed that you were talking about the 24 GHz version

Re: Inevitable death, was Re: Verizon Public Policy on Netflix

2014-07-15 Thread Rubens Kuhl
On Tue, Jul 15, 2014 at 3:59 PM, Brett Glass na...@brettglass.com wrote: At 12:18 PM 7/15/2014, Rubens Kuhl wrote: If you are picky enough to prefer other radios that cost more on Mbps/$, that's your call, We need reliability. That particular radio wouldn't cut it. As I've mentioned

Re: Net Neutrality...

2014-07-15 Thread Rubens Kuhl
The things that are making my life difficult at the moment include the following: * Government agencies attempting to impose requirements upon us and then denying us the resources we need to fulfill them; * Government agencies trying to dictate what users can buy rather than allowing

Re: Mikrotik RouterBoard and Ubiquiti Networks Routing and Switching Solutions

2014-08-11 Thread Rubens Kuhl
On Mon, Aug 11, 2014 at 9:22 PM, Colton Conor colton.co...@gmail.com wrote: I am interested to hear opinions on Mikrotik and Ubiquiti Networks routing and switching products. I know both hardware providers are widely deployed in WISP networks, but I am less interested in their wireless

Re: Mikrotik RouterBoard and Ubiquiti Networks Routing and Switching Solutions

2014-08-11 Thread Rubens Kuhl
I personally feel like at this level of traffic, A entry level of linux server (like dell r210) with adequate domain knowledge is the best combination. It would happily do most stuff you throw at it, if you know how to use it. Entry level hardware solution tries to hide details from

Re: Mikrotik RouterBoard and Ubiquiti Networks Routing and Switching Solutions

2014-08-12 Thread Rubens Kuhl
On Tue, Aug 12, 2014 at 1:44 PM, Denis Fondras xx...@ledeuns.net wrote: Le 12/08/2014 17:15, Justin Wilson a écrit : Another thing to consider is how you feel about the configuration. Mikrotik has a more polished GUI and command subset. UBNT is still working things out. A lot of

Re: Public DNS64

2014-08-15 Thread Rubens Kuhl
On Fri, Aug 15, 2014 at 3:29 PM, Tim Durack tdur...@gmail.com wrote: Anyone know of a reliable public DNS64 service? Would be cool if Google added a Public DNS64 service, then I could point the NAT64 prefix at appropriately placed boxes in my network. Why? Other people are better than me at

Re: Akamai charges for IPv6 support?

2014-08-18 Thread Rubens Kuhl
On Mon, Aug 18, 2014 at 1:38 PM, Aaron Hopkins li...@die.net wrote: Is it normal to bill for IPv6 service as a separate product? I was surprised to hear from from my Akamai rep they they do: Hi Aaron, We can add the IPV6 service to the contract at an additional cost of $XXX/month. Please

Re: Akamai charges for IPv6 support?

2014-08-18 Thread Rubens Kuhl
On Mon, Aug 18, 2014 at 10:03 PM, Justin M. Streiner strei...@cluebyfour.org wrote: On Tue, 19 Aug 2014, Mark Andrews wrote: No, I expect it to be part and parcel of the basic fees, as IPv4 is, which I'm happy to hear it is in this case. Based on a response I saw in this thread earlier

Re: The Next Big Thing: Named-Data Networking

2014-09-06 Thread Rubens Kuhl
There would be a root, or multiple roots, which would respond to requests to locate who should be asked about a domain, for example if you want to know the ip address for world.std.com the conversation goes roughly: (To Root Server): Where is the COM server? (From Root Server):

  1   2   3   >