Re: Oracle DBA

2019-03-15 Thread valdis . kletnieks
On Thu, 14 Mar 2019 07:26:40 -0400, Alain Hebert said: > ��� Run away from... And what realistic competitors does Oracle really have at the high end, when whatever MySQL calls itself now isn't sufficient? Remember to consider all factors, including whether you have a good supply of DBAs for hire

Last Call: (Operational Security Considerations for (fwd)

2019-11-11 Thread valdis . kletnieks
Those of you who worry about opsec for IPv6 but aren't already following this IETF draft may wish to get your comments in. --- Begin Message --- The IESG has received a request from the Operational Security Capabilities for IP Network Infrastructure WG (opsec) to consider the following document: -

Re: GeoIP database issues and the real world consequences

2016-04-15 Thread Valdis . Kletnieks
On Thu, 14 Apr 2016 16:43:00 -0700, Todd Crane said: > You do realize that this is the exact kind of thing that caused this > discussion in the first place. I'm well familiar with that case. I was talking > about my own experiences in the food service industry, but of course you > barely > read a

Re: carrier grade fax boards?

2016-04-27 Thread Valdis . Kletnieks
On Thu, 28 Apr 2016 04:30:23 -, Ryan Finnesey said: > I was wondering if anyone had any recommendations on carrier grade fax boards > that are SIP based? What would "carrier grade" even *mean* for a fax board? pgpnbu6lUPiJ5.pgp Description: PGP signature

Re: Superfluous advertisement (was: Friday's Random Comment)

2016-05-01 Thread Valdis . Kletnieks
On Sat, 30 Apr 2016 19:10:44 -, "Jakob Heitz (jheitz)" said: > A use case for a longer prefix with the same nexthop: > >F > / \ > D E > | | > B C > \ / >A Am I the only one thinking "RFC4264" here? :) pgpI3q583g2Ao.pgp Description: PGP signature

Re: NIST NTP servers

2016-05-10 Thread Valdis . Kletnieks
On Tue, 10 May 2016 16:39:54 +0200, Stephane Bortzmeyer said: > You mean the GPS network is not managed by an external entity? With > budget issues? > > http://www.schriever.af.mil/GPS Note that they *do* have motivation to keep it working, simply because so much of their *own* gear (from gear fo

Re: NIST NTP servers

2016-05-10 Thread Valdis . Kletnieks
On Tue, 10 May 2016 08:07:15 -0700, Brandon Vincent said: > On May 10, 2016 7:59 AM, "Stephane Bortzmeyer" wrote: > > Yes, but they may switch it off for civilian use (by going encrypted, > > for instance) at any time, if it is better for *their* operations. > > I think you are referring to select

Re: NIST NTP servers

2016-05-11 Thread Valdis . Kletnieks
On Wed, 11 May 2016 15:36:34 -, "Jay R. Ashworth" said: > CDMA and GSM are false diversity: both network types nodes *get their time* > from GPS, so far as I know. I'll make the fairly reasonable assumption that most readers of this list have networks that span multiple buildings. If somebod

Re: NIST NTP servers

2016-05-11 Thread Valdis . Kletnieks
On Wed, 11 May 2016 21:07:21 +0200, Florian Weimer said: > * Chris Adams: > > > First, out of the box, if you use the public pool servers (default > > config), you'll typically get 4 random (more or less) servers from the > > pool. There are a bunch, so Joe Random Hacker isn't going to have a > >

Re: NIST NTP servers

2016-05-11 Thread Valdis . Kletnieks
On Wed, 11 May 2016 17:23:31 -0700, Eric Kuhnke said: > average of $150/mo x 500 = $75,000 Id worry more about the fact that somebody is willing to spend $75K/mo to attack me than the fact that it might be possible to wiggle my time base a bit. At that point, you *really* have to worry about othe

Re: Cost-effectivenesss of highly-accurate clocks for NTP

2016-05-15 Thread Valdis . Kletnieks
On Sun, 15 May 2016 15:21:02 -, Mel Beckman said: > But a more critical deployment of rubidium clocks is in cash-strapped public > safety institutions, such as local police dispatch centers. Timing is crucial > for the squad car communication systems, which these days are all digital, > based o

Re: craigslist.com admin

2016-06-02 Thread Valdis . Kletnieks
On Thu, 02 Jun 2016 15:45:33 -0500, Darin Steffl said: > Have been getting reports of the same thing. Went to the craigslist help > forums where some people there decided to call us a fake ISP because we > don't hand out publics to every customer. They were VERY rude and hopefully > none of them we

Re: craigslist.com admin

2016-06-02 Thread Valdis . Kletnieks
On Thu, 02 Jun 2016 14:11:57 -0700, Todd Crane said: > According to bgp.he.net and ARIN, craigslist has 2620:7E::/44 which is > announced on several transits. Curious as to what they use it for if not > Web, MX, or DNS. Well, for starters, they could put a quad-A in the DNS for www.craigslist.com

Re: Netflix VPN detection - actual engineer needed

2016-06-03 Thread Valdis . Kletnieks
On Fri, 03 Jun 2016 17:21:16 -0700, Blair Trosper said: > ...IF (and that's a big IF in the Bay Area at least) you can get the newest > modems. Easier said than done. http://www.amazon.com/ARRIS-SURFboard-SB6141-DOCSIS-Cable/dp/B00AJHDZSI/ $68.75 and Done. And the damned thing even pays for its

Re: Netflix VPN detection - actual engineer needed

2016-06-06 Thread Valdis . Kletnieks
On Mon, 06 Jun 2016 20:30:02 +0100, Aled Morris said: > Maybe HE's IPv6 tunnel packets could be flagged with a destination option > (extension header field) that records the end-user's IPv4 tunnel endpoint > so geolocation could be done in the "old fashioned" way on that address. > > Similar to the

Re: syslog server

2016-06-06 Thread Valdis . Kletnieks
On Mon, 06 Jun 2016 14:59:51 -0600, Maximino Velazquez said: > What is the best syslog server (opensource)? Step 0: Define what "best" means in your environment. What features do you need? Routing to a central aggregation server over TLS? Powerful regex-based routing? Ingestion into a databas

Re: Netflix banning HE tunnels

2016-06-10 Thread Valdis . Kletnieks
On Fri, 10 Jun 2016 07:19:22 +0100, "t...@pelican.org" said: > All the business systems that sit around it? Not so much. $DAYJOB has > plenty of code, database structures etc that are built around "an IP address > is > no more than 15 characters long and matches > '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]

Re: Enough about Netflix banning HE tunnels [really: IPv6 adoption]

2016-06-10 Thread Valdis . Kletnieks
On Fri, 10 Jun 2016 19:39:38 -, "STARNES, CURTIS" said: > - Unix such as System V/BSD/Open Systems/AIX/SCO/HP-UX/Sun Solaris would each > rule the world. Compare the number of Android devices (basically every single smartphone on the planet that doesn't say iPhone) to the number of laptops and

Re: Enough about Netflix banning HE tunnels [really: IPv6 adoption]

2016-06-10 Thread Valdis . Kletnieks
On Fri, 10 Jun 2016 20:12:43 -, "STARNES, CURTIS" said: > and the Chromebook content filtering is not IPv6 compatible either So what are you using for content filtering? A quick google search indicates that there do exist filtering solutions that are IPv6 capable? And what *non* Chromebook so

Re: Netflix banning HE tunnels

2016-06-10 Thread Valdis . Kletnieks
On Sat, 11 Jun 2016 00:21:52 +0900, Masataka Ohta said: > As such, the fish passages can be constructed, if translation > behavior of the NAT boxes are known to end systems so that > the end systems have sufficient knowledge to reverse the > translation. This requires each end system to restrict

Re: Detecting Attacks

2016-06-12 Thread Valdis . Kletnieks
On Fri, 10 Jun 2016 22:22:31 -0700, subashini hariharan said: > The aim is to detect DoS/DDoS attacks using the application. I am going to > use ELK (ElasticSearch, Logstash, Kibanna) for processing the logs (Log > Analytics). Bad approach. At that point, not only is the application being DDoS'e

Re: Netflix banning HE tunnels

2016-06-12 Thread Valdis . Kletnieks
On Mon, 13 Jun 2016 03:27:41 +0200, Baldur Norddahl said: > On 13 June 2016 at 02:05, Owen DeLong wrote: > > 1) lower case > 2) as short as possible, except do not shorten just one :0: into ::. > 3) if there is more than one possible :: block that results in the same > shortest length, choose the

Re: Measuring the quality of Internet access

2016-06-13 Thread Valdis . Kletnieks
On Mon, 13 Jun 2016 22:11:47 +0300, Max Tulyev said: > Is it possible in general to measure the quality of Internet access? And > if yes - how? First, *define* "quality". Raw bandwidth to a test server? Raw bandwidth to a weighted average of the Alexa Top 100? Does RTT/bufferbloat count? What ab

Re: Netflix banning HE tunnels

2016-06-14 Thread Valdis . Kletnieks
On Tue, 14 Jun 2016 14:57:40 -0400, "Ricky Beam" said: > I've seen many "IPv6 Capable" CPEs that apply ZERO security to IPv6 > traffic. IPv4 goes through NAT, so one gets the pseudo-security of not > being directly touchable from the internet. And a very big *PSEUDO* on that. It's amazing how ma

Re: IPv6 deployment excuses

2016-07-04 Thread Valdis . Kletnieks
On Tue, 05 Jul 2016 11:16:31 +0900, Masataka Ohta said: > A large ISP should just set up usual NAT. In addition, the ISP > tells its subscriber a global IP address, a private IP address > and a small range of port numbers the subscriber can use and > set up *static* bi-directional port forwarding.

Re: NAT firewall for IPv6?

2016-07-05 Thread Valdis . Kletnieks
On Fri, 01 Jul 2016 21:28:54 -0500, Edgar Carver said: > We're having problems where viruses are getting through Firefox, and we > think it's because our Palo Alto firewall is set to bypass filtering for > IPv6. Do you have any actual evidence (device logs, tcpdump, netflow, etc) that support th

Re: NAT firewall for IPv6?

2016-07-05 Thread Valdis . Kletnieks
On Tue, 05 Jul 2016 11:54:14 -0400, Spencer Ryan said: > The Palo-Alto's also don't support anything but NAT64, They don't support proper dual-stack?? Or NAT64 is the only NAT flavor they support on the v6 side? pgpMGuNc6KiEk.pgp Description: PGP signature

Re: New ICANN registrant change process

2016-07-06 Thread Valdis . Kletnieks
On Wed, 06 Jul 2016 13:23:04 -0400, Christopher Morrow said: > On Mon, Jul 4, 2016 at 3:03 PM, Jay Ashworth wrote: > > > Seems to me that the proper thing to be done would have been for > > Registries to deauthorize registrars on the grounds of continuous streams > > of complaints. > > > > > > On

Re: Leap Second planned for 2016

2016-07-09 Thread Valdis . Kletnieks
On Sat, 09 Jul 2016 12:14:03 +0300, Saku Ytti said: > Check the implementation on your PC. This is why code is broken and > people don't even know it's broken. You have to use monotonic time to > measure passage of time, which is not particularly easy to do > portable, in some languages. It doesn

Re: New Office, New Network. Questions.

2016-07-11 Thread Valdis . Kletnieks
On Sun, 10 Jul 2016 21:53:52 +0300, Nikolai Petrov said: > 1. Currently we do not have IPv6 in our network but I have seen the ISP is > giving us a "/56 Block" which from what I understand is a couple hundred "/64 > Subnets". I think you can only have /64 subnets in IPv6. In our IPv4 setup we You

Re: New Office, New Network. Questions.

2016-07-13 Thread Valdis . Kletnieks
On Tue, 12 Jul 2016 15:30:11 +0300, Nikolai Petrov said: > Is there any way to limit the amount of devices in a subnet to avoid problems > and attacks? I don't think the equipment will work with 2^64 devices in a > single subnet.. Sure. Just don't connect that many devices to one subnet, just the

Re: IPv6 Deployment for Mobile Subscribers

2016-07-22 Thread Valdis . Kletnieks
On Fri, 22 Jul 2016 10:54:48 +0200, Ricardo Ferreira said: > Is there anyone here working in an ISP where IPv6 is deployed? > We are starting to plan the roll-out IPv6 to mobile subscribers (phones) I > am interesting in knowing the mask you use for the assignment; whether it > is /64 or /128. > >

Re: EVERYTHING about Booters (and CloudFlare)

2016-07-27 Thread Valdis . Kletnieks
On Wed, 27 Jul 2016 11:21:02 -0700, Dan Hollis said: > On Wed, 27 Jul 2016, b...@theworld.com wrote: > > There isn't even general agreement on whether (or what!) Cloudfare is > > doing is a problem. > > aiding and abetting. at the very least willful negligence. aiding and abetting of what, *exactl

Re: EVERYTHING about Booters (and CloudFlare)

2016-07-27 Thread Valdis . Kletnieks
On Thu, 28 Jul 2016 10:48:47 +1000, Mark Andrews said: > As soon as a transaction takes place, conspiricy to harm by > . If the DoS actually occurs you can add additional charges for > the actual actions. If the claim is that a law has been broken, you have to show that is actually a crime in

Re: EVERYTHING about Booters (and CloudFlare)

2016-07-28 Thread Valdis . Kletnieks
On Wed, 27 Jul 2016 22:55:54 -0400, Miles Fidelman said: > On 7/27/16 10:48 PM, Randy Bush wrote: > >> They just lost all respect from here. Would someone from USA please > >> report these guys to the feds? What they are doing is outright > >> criminal. > > hyperbole. it is not criminal. you just

Re: EVERYTHING about Booters (and CloudFlare)

2016-07-28 Thread Valdis . Kletnieks
On Thu, 28 Jul 2016 12:00:00 +0200, Baldur Norddahl said: > DDoS attacks using stolen resources and fake identities is not legal Are you making a blanket statement that covers all jurisdictions on the planet? For bonus points - is it more like "illegal as in murder", or "illegal as in jaywalking

Re: Cloudflare, dirty networks and politricks

2016-07-29 Thread Valdis . Kletnieks
On Fri, 29 Jul 2016 07:50:09 -0500, "J. Oquendo" said: > In my ramblings on "Why network operators love filth", I > associate a landlord that knowingly allows his/her tenant > to sell drugs. In America, your house is gone. This should > be the case on the Internet as well. Oh, do *NOT* go there.

Re: NFV Solution Evaluation Methodology

2016-08-02 Thread Valdis . Kletnieks
On Tue, 02 Aug 2016 19:16:04 -0700, Eric Kuhnke said: > But but but... cloud! THE CLOUD! Cloudy clouds fluffy white flying > through the air, you should move everything to the Cloud (tm). Running the stuff you need to keep your own network running on the cloud? That's the sort of thing I encour

Re: Host.us DDOS attack -and- related conversations

2016-08-03 Thread Valdis . Kletnieks
On Wed, 03 Aug 2016 10:53:22 -0400, Alain Hebert said: > Between you and me, if only Elbonia are left DDoSing at 100Gbps, we > simply de-peer the commercial subnets from that country (leaving the > govt subnets up obviously) Explain why, for those of us who don't see it as obvious. pgpYJVA

Re: Zayo Extortion

2016-08-15 Thread Valdis . Kletnieks
On Mon, 15 Aug 2016 11:16:26 -0400, Jon Lewis said: > Obvious first question would be, have you fallen behind paying your bill? And if you're in fact up-to-date, make sure you have *proof* of same. It's not unheard of for providers to mis-credit your payments and then think you're behind. Usually

Re: Zayo Extortion

2016-08-16 Thread Valdis . Kletnieks
On Tue, 16 Aug 2016 17:53:23 +0200, Niels Bakker said: > An actual lawyer! Where were you in the CloudFlare booters thread, though? Keeping sensibly quiet, I think... :) pgp7DwJ_2f90w.pgp Description: PGP signature

Re: Zayo Extortion

2016-08-17 Thread Valdis . Kletnieks
On Wed, 17 Aug 2016 01:11:09 +0200, Jonathan Hall said: > And either way, defamation requires some form of punitive damage be proven in > order to act ually win that case. In addition to the other things already pointed out, punitive damage doesn't need to be proven. *Actual* damages have to be p

Re: Why the internal network delays, Gmail?

2016-08-27 Thread Valdis . Kletnieks
On Sat, 27 Aug 2016 10:34:36 -, Mel Beckman said: > But mailop doesn't have the same odd mix of people as nanog. For example, I'm > not on mailop. :) And apparently you need to know the secret handshake to get on. After Chrome complained the SSL cert on the subscription page had expired 6 m

Re: Cloudflare reverse DNS SERVFAIL, normal?

2016-08-30 Thread Valdis . Kletnieks
On Tue, 30 Aug 2016 14:39:10 -0700, Owen DeLong said: > I run a pair of nameservers. Let’s call them ns1.company.com > and ns2.company.com > Someone registers example.com and points NS records in the COM zone at my > nameservers. I would have expected that the resulting NXDOMAIN replies from n

Re: Use of unique local IPv6 addressing rfc4193

2016-09-08 Thread Valdis . Kletnieks
On Thu, 08 Sep 2016 23:09:28 -, Pshem Kowalczyk said: > If I give them public IPs then they're routable and potentially can reach > the internet via devices that don't police the traffic. They can potentially reach the Internet even without public IPs. All it takes is one idiot with a laptop

Re: "Defensive" BGP hijacking?

2016-09-12 Thread Valdis . Kletnieks
On Mon, 12 Sep 2016 14:07:47 -0400, Jean-Francois Mezei said: > So there are some cases where BGP hijacking may be desirable. I guess > this is where judgement kicks in. I don't see "hijacking" in your description of the iStop case - it appears to have been fully coordinated and with permission.

Re: Lawsuits for falsyfying DNS responses ?

2016-09-13 Thread Valdis . Kletnieks
On Tue, 13 Sep 2016 08:29:25 -0400, Alain Hebert said: > Well "may" is not "must". > > “260.34. An Internet service provider may not give access to an online > gambling site whose operation is not authorized under Québec law. Note that most legal jurisdictions don't include RFC2119 as part o

Re: QWEST.NET can you fix your nameservers

2016-09-15 Thread Valdis . Kletnieks
On Thu, 15 Sep 2016 09:22:10 -0700, "Aaron C. de Bruyn" said: > On Thu, Sep 15, 2016 at 12:31 AM, Mark Andrews wrote: > > > QWEST isn't the only DNS provider that has broken nameservers. One > > shouldn't have to try and contact every DNS operator to get them to > > use protocol compliant servers

Re: PlayStationNetwork blocking of CGNAT public addresses

2016-09-18 Thread Valdis . Kletnieks
On Mon, 19 Sep 2016 10:41:59 +1200, "Tony Wicks" said: > Interestingly, Sony (SNEI-NOC-Abuse replied to being forwarded back one of their notification blocks requesting > more detailed information with a csv file in under an hour! So I guess name-and-shame *does* work? :) pgp2syZkWt95D.pgp Desc

Re: PlayStationNetwork blocking of CGNAT public addresses

2016-09-20 Thread Valdis . Kletnieks
On Wed, 21 Sep 2016 11:29:49 +1000, Mark Andrews said: > What we need is business tech reporters to continually report on > these failures of content providers to deliver their services over > IPv6. 20 years lead time should be enough for any service. Interestingly enough, the Playstation 4 has

Re: Domain renawals

2016-09-21 Thread Valdis . Kletnieks
On Mon, 19 Sep 2016 13:19:43 -0400, Jeff Jones said: > networksolutions.com and am looking for input on who is cheap, secure, > reliable registrar. Thanks for your input. cheap, secure, reliable - pick any two. (The driver here is "cheap" - the other two criteria can be almost anything, but to d

Re: PlayStationNetwork blocking of CGNAT public addresses

2016-09-22 Thread Valdis . Kletnieks
On Thu, 22 Sep 2016 14:31:12 +0200, Alexander Maassen said: > Maybe its time then for a global accepted, unified way to send/report abuse? YOu mean ike these RFCs? (OK, so it's an XML schema. Just be glad it isn't ASN.1 :) 5070 The Incident Object Description Exchange Format. R. Danyliw, J.

Re: BCP38 deployment [ was Re: Krebs on Security booted off Akamai network after DDoS attack proves pricey ]

2016-09-26 Thread Valdis . Kletnieks
On Sun, 25 Sep 2016 21:19:31 -0700, Hugo Slabbert said: > Linux: > From /etc/sysctl.conf: > > # Uncomment the next two lines to enable Spoof protection (reverse-path=20 > # filter) > # Turn on Source Address Verification in all interfaces to > # prevent some spoofing attacks > net.ipv4.conf.defaul

Re: BCP38 adoption "incentives"?

2016-09-28 Thread Valdis . Kletnieks
On Tue, 27 Sep 2016 20:44:35 -, "White, Andrew" said: > This assumes the ISP manages the customer's CPE or home router, which is > often not the case. Adding such ACLs to the upstream device, operated by the > ISP, is not always easy or feasible. Hopefully, if you've been burnt by this, you r

Re: Legislative proposal sent to my Congressman

2016-10-03 Thread Valdis . Kletnieks
On Mon, 03 Oct 2016 11:58:10 -0700, Stephen Satchell said: > > THEREFORE the Consumer Product Safety Commission shall require that > > the manufacturer provide a security update to the device within 30 day > > of first notice; or failing that, to issue a complete recall of the > > defective device

Re: Legislative proposal sent to my Congressman

2016-10-03 Thread Valdis . Kletnieks
On Mon, 03 Oct 2016 18:33:38 -0700, Matthew Petach said: > If you hold the executives of the hardware manufacturer > responsible for the software running on their devices, > then the next generation of hardware from every > manufacturer is going to be hardware locked to > ONLY run their software.

Re: Level 3 voice outage

2016-10-04 Thread Valdis . Kletnieks
On Tue, 04 Oct 2016 18:14:54 -, Mel Beckman said: > This could be DoS attack. Or a missing comma in a code update. Or a fumble-fingered NOC monkey. Or You have any reason to suspect a DoS attack rather than all the other possibilities? pgp03Ijae5BSG.pgp Description: PGP signature

Re: Level 3 voice outage

2016-10-04 Thread Valdis . Kletnieks
On Tue, 04 Oct 2016 20:10:44 +0100, Marco Teixeira said: > Had it been an approved chance it would have been > rolled back i guess... See the 1990 ATT long-distance collapse for a worked example. pgp_Sro2vzM5h.pgp Description: PGP signature

Re: Questions re: VPN protocols globally

2016-10-05 Thread Valdis . Kletnieks
On Wed, 05 Oct 2016 12:06:07 -0400, Eric Germann said: > Customers will connect to their respective regional sites separately. > Any ITAR concerns there? If there are serious concerns there, I recommend spending the coin for an actual ITAR expert. pgpEfSfJNvtPM.pgp Description: PGP signature

Re: IoT security, was Krebs on Security booted off Akamai network

2016-10-09 Thread Valdis . Kletnieks
On Sun, 09 Oct 2016 14:31:54 -, Mel Beckman said: > I just bought a $20 Lacrosse remote RF temperature sensor hub for home, the > GW-1000U. It does the usual IoT things: after you plug it in, it gets a DHCP > address and phones home, then you register it using a smartphone on the same > LAN, w

Re: IoT security, was Krebs on Security booted off Akamai network

2016-10-09 Thread Valdis . Kletnieks
On Sun, 09 Oct 2016 18:05:20 -, Mel Beckman said: > I don't know why it's "sub optimal" to use the cloud from an isolated > network. Can you elaborate? Why should something out in the cloud have any part of the communication, other than perhaps telling your cellphone the current address of yo

Re: Death of the Internet, Film at 11

2016-10-23 Thread Valdis . Kletnieks
On Sat, 22 Oct 2016 19:22:04 -0400, Jean-Francois Mezei said: > 10s of millons of IP addresses. Is it realistic to have 10s of millions > of infected devices ? Or is that the dense smoke that points to IP > spoofing ? A few years ago, Vint Cerf gave a keynote speech at a conference, where he clai

Re: Death of the Internet, Film at 11

2016-10-25 Thread Valdis . Kletnieks
On Tue, 25 Oct 2016 18:54:22 -0500, Larry Sheldon said: > What is it? 20 years? since the first time I was banned from NANOG for > saying that the world would be a nicer place if EVERY true router > refused to forward a packet whose SOURCE could not be reached from the > port question. (May not b

Re: Spitballing IoT Security

2016-10-26 Thread Valdis . Kletnieks
On Wed, 26 Oct 2016 20:53:51 +0200, JORDI PALET MARTINEZ said: > Even if we speak about 1 dollar per each product being sold, it is much > cheaper than the cost of not doing it and paying for damages, human resources, > etc., when there is a security breach. This only works if the company perceiv

Re: Spitballing IoT Security

2016-10-26 Thread Valdis . Kletnieks
On Wed, 26 Oct 2016 15:02:46 -0700, "Ronald F. Guilmette" said: > i.e. a multitude of wall plates in every room, each one bristling with a > multitude of RJ11 sockets into which all manner of shiny new IoT things > will be directly plugged, thence to be issued their own IPv6 addresses > directly v

Re: OSPF vs ISIS - Which do you prefer & why?

2016-11-10 Thread Valdis . Kletnieks
On Thu, 10 Nov 2016 18:54:36 -0600, Josh Reynolds said: > Oops, forgot link. Cooking dinner :) > > http://www.nongnu.org/quagga/ So you have *one* implementation that admits it's still somewhat lacking? Color me.. underwhelmed. pgpzgDayRUSxr.pgp Description: PGP signature

Re: SNMP syslocation field for GPS coordinates, and use with automation tools

2016-12-09 Thread Valdis . Kletnieks
On Fri, 09 Dec 2016 22:09:40 +, Alan Buxey said: > Yes. But don’t just put in coordinates... Put in other details and use a > standard separator You want to tell that to the creator of some software I recently encountered that used a non-breaking space rather than a tab, or comma, or other s

Re: Recent NTP pool traffic increase

2016-12-19 Thread Valdis . Kletnieks
On Mon, 19 Dec 2016 12:52:59 -0700, David said: > From a source network point of view we see devices come online and hit > ~35 unique NTP servers within a few seconds. Am I the only one who read that and started wondering if some engineer writing CPE code read a recommendation someplace to "quer

Re: Recent NTP pool traffic increase

2016-12-20 Thread Valdis . Kletnieks
On Tue, 20 Dec 2016 18:11:11 -0500, Peter Beckman said: > Mostly out of curiosity, what was the reason for the change in the Snapchat > code, and what plans does Snap have for whatever reason the NTP change was > put in place? >From other comments in the thread, it sounds like the app was simply l

Re: Recent NTP pool traffic increase

2016-12-20 Thread Valdis . Kletnieks
On Tue, 20 Dec 2016 18:41:37 -0800, Keenan Tims said: > Better for whom? I'm sure all mobile operating systems provide some > access to time, with a least 'seconds' resolution. If an app deems this > time source untrustworthy for some reason, I don't think the reasonable > response is to make indep

Re: Wanted: volunteers with bandwidth/storage to help save climate data

2016-12-21 Thread Valdis . Kletnieks
On Wed, 21 Dec 2016 19:49:41 -0500, Ken Chase said: > "If it's a politically-generated thing I'll have to deal with at an > operational level, it's on topic." Hmm.. works for me. pgp0FlidUAEkD.pgp Description: PGP signature

Re: Wanted: volunteers with bandwidth/storage to help save climate data

2016-12-21 Thread Valdis . Kletnieks
On Wed, 21 Dec 2016 21:54:42 -0500, Andrew Kirch said: > I can't for the life of me see why we'd have to deal with it in the course > of our jobs beyond calling someone and having them install more A/C. This > is, flat-out, off topic. You don't have any fiber that runs into regen shacks in low-ly

Re: Benefits (and Detriments) of Standardizing Network Equipment in a Global Organization

2016-12-26 Thread Valdis . Kletnieks
On Fri, 23 Dec 2016 15:36:10 -0500, Chris Grundemann said: > A global hospitality organization with 100+ locations recently asked us how > to weigh the importance of standardizing infrastructure across all their > locations versus allowing each international location to select on their > own kit.

Re: Benefits (and Detriments) of Standardizing Network Equipment in a Global Organization

2016-12-29 Thread Valdis . Kletnieks
On Thu, 29 Dec 2016 07:44:45 -0800, Leo Bicknell said: > But I think the question others are trying to ask is a different > hyptothetical. Say there are two vendors, of of which makes perfectly > good edge routers and core routers. What are the pros to buying all > of the edge from one, and all

Re: SoCal FIOS outage(?) / static IP readdressing

2017-01-04 Thread Valdis . Kletnieks
On Wed, 04 Jan 2017 00:28:57 -0800, "Paul B. Henson" said: > I'm about at the point where next time it goes down and it appears to be > a remote issue I'm not going to bother to call it in; I'll just cross my > fingers and hope it fixes itself within a day or so and only report it > if it doesn't.

Re: Bandwidth Savings

2017-01-11 Thread Valdis . Kletnieks
On Tue, 10 Jan 2017 23:08:45 -0500, Keenan Singh said: > do have a Layer 2 Circuit between the Island and Miami, I am seeing there > are WAN Accelerators where they would put a Server on either end and sort > of Compress and decompress the Traffic before it goes over the Layer 2, I > have never us

Re: ICMPv6 PTBs and IPv6 frag filtering (particularly at BGP peers)

2017-01-13 Thread Valdis . Kletnieks
On Sat, 14 Jan 2017 09:58:21 +1100, Mark Andrews said: > In message , Fernando > Gont writes: > > Disagree. Microsoft "reinvented" ping-o-death in IPv6, there have been > > several one-packet crashes disclosed for Cisco's (an the list continues). > > And they would have issued fixes for them. Mac

Re: Brainstorming acceptance issues - WAN impediment

2017-02-07 Thread valdis . kletnieks
On Mon, 06 Feb 2017 11:10:11 -0800, Kasper Adel said: > From the top of my head, I can think of the basic tests like introducing > jitter and delay but i would appreciate more ideas or even test cases that > i can re-use. Introduce packet loss. Trigger timeouts. Arrange to have packets arrive o

Re: IoT security

2017-02-08 Thread valdis . kletnieks
On Wed, 08 Feb 2017 21:04:07 -0800, clinton mielke said: > As an ISP, scan your customers netrange, and notify customers with known > vulnerable devices. With regards to the current Mirai threat, theres only a > handful of devices that are the most critical importance. IE, biggest > fraction of th

Re: IoT security

2017-02-09 Thread valdis . kletnieks
On Wed, 08 Feb 2017 22:19:01 -0800, clinton mielke said: > Yup! All the mapping Ive done is over port 80. Id have a lot more than I > currently have if I was looking at other ports, probably. Wow. How does this work if more than one IoPT(*) device is in play in the home network, especially from

Re: IoT security

2017-02-09 Thread valdis . kletnieks
On Thu, 09 Feb 2017 14:54:26 -0500, William Herrin said: > Is there some way an industry association could overcome this? Perhaps > have some trivial way to assign each model of IoT device some kind of > integer and have the device report the integer instead of its plain > text manufacturer and ha

Re: Someone's scraping NANOG for phishing purposes again

2017-02-10 Thread valdis . kletnieks
7 06:27:24 +0600 (Wed 19:27 EST) To: "Ronald F. Guilmette" , "Robert Webb" , "Valdis Kletnieks" , "Scott Brim" pgp6i7U7ebtoB.pgp Description: PGP signature

Re: Dev. Mfg & ISP Filtering Requirements as set forth in Florida HB337/SB0870, and under similar bills in about 30 other states...

2017-02-10 Thread valdis . kletnieks
On Sat, 11 Feb 2017 03:28:11 +, Kraig Beahn said: > NANOG note: Our objective in starting this tread is not to question the > intent, moral purpose or potential political agendas surrounding Florida > House Bill 337 or bills of similar nature, only it's technical impact on > device manufacture

Re: Is WHOIS going to go away?

2018-04-20 Thread valdis . kletnieks
On Fri, 20 Apr 2018 12:03:37 +0200, Tei said: > Maybe a good balance for whois is to include organization information > so I know where a website is hosted, but not personal information, so > I can't show in their house and steal their dog. In many cases, the *OWNER* of a website doesn't have any

Re: Is WHOIS going to go away?

2018-04-20 Thread valdis . kletnieks
On Fri, 20 Apr 2018 20:53:06 -, "Naslund, Steve" said: > "Those who would give up essential Liberty, to purchase a little temporary > Safety, deserve neither Liberty nor Safety." > > No one ever had the liberty of publishing information to the public without > accountability. > You are givi

Re: Is WHOIS going to go away?

2018-04-20 Thread valdis . kletnieks
On Fri, 20 Apr 2018 21:25:09 -, "Naslund, Steve" said: > And you would be violating the law if it was ruled that your publication was > in fact a publication under the law. Citation please, where anonymous publication is, in and of itself, illegal under US law pgp3RkhByE_QC.pgp Descript

Re: Is WHOIS going to go away?

2018-04-26 Thread valdis . kletnieks
On Wed, 25 Apr 2018 13:47:24 -0400, Rob McEwen said: > SUGGESTION: Initially register with private registration - then change > it to regular non-hidden registration a few weeks later or so. That will work for about 2 weeks - until the people who currently run automated software looking for new r

Re: How are you configuring BFD timers?

2018-05-07 Thread valdis . kletnieks
On Sun, 06 May 2018 14:23:11 +0200, Mark Tinka said: > We have links as short as 5km, all the way to 14,500km. Any words of wisdom / battle scars regarding running links that are in the 10K+ distance? pgpGUy0drh8FA.pgp Description: PGP signature

Re: Curiosity about AS3356 L3/CenturyLink network resiliency (in general)

2018-05-19 Thread valdis . kletnieks
On Sat, 19 May 2018 22:28:07 +0200, Baldur Norddahl said: > What happened to do not trust anyone? Create your own resiliency by being > multihomed to as many transits you can afford. Re-read what David Hubbard said: > unacceptable period of time (many hours). I’m learning that the entire > mar

Re: Curiosity about AS3356 L3/CenturyLink network resiliency (in general)

2018-05-20 Thread valdis . kletnieks
On Sun, 20 May 2018 09:16:25 +0200, Baldur Norddahl said: > He is complaining about AS3356 in specific and claiming they COULD > reroute around it but choose not to. This leads me to assume there are > alternatives. Two places, Miami and Texas, are mentioned and that a > double fault, one in Miami

Re: Whois vs GDPR, latest news

2018-05-21 Thread valdis . kletnieks
On Thu, 17 May 2018 14:06:27 -0400, Fletcher Kittredge said: > What about my right to not have this crap on NANOG? procmail is your friend. pgpSkSM4c3_8E.pgp Description: PGP signature

Re: Whois vs GDPR, latest news

2018-05-26 Thread valdis . kletnieks
On Sat, 26 May 2018 10:31:29 +0200, "Michel 'ic' Luczak" said: > "When the regulation does not apply > Your company is service provider based outside the EU. It provides services > to customers outside the EU. Its clients can use its services when they > travel > to other countries, including w

Re: Need /24 (arin) asap

2018-06-11 Thread valdis . kletnieks
On Mon, 11 Jun 2018 10:27:04 -0600, Michael Crapse said: > For an eyeball network, you cannot count on an IPv6 only network. Because > all of your "customers" will complain because they can't get to hulu, or > any other ipv4 only eyeball service. You still need the ipv4s to operate a > proper netwo

Re: What are people using for IPAM these days?

2018-06-12 Thread valdis . kletnieks
On Tue, 12 Jun 2018 17:23:14 -0700, Randy Bush said: > emacs! > >>> vim! > >> ed! > > TECO! > cat IBM 029. pgpdETe0f_upT.pgp Description: PGP signature

Re: Impacts of Encryption Everywhere (any solution?)

2018-06-19 Thread valdis . kletnieks
On Tue, 19 Jun 2018 11:33:50 -0400, William Herrin said: > The innovation I'd like to see is a multi-level streaming cache. > Here's the basic idea: > > Define a network protocol such as "mlcache" > > mlcache://data.netflix.com/starwars/chunk12345 is a chunk of some > video that netflix has. It's

Re: IPv6 faster/better proof? was Re: Need /24 (arin) asap

2018-06-23 Thread valdis . kletnieks
On Sat, 23 Jun 2018 12:27:35 -0400, "Jean | ddostest.me via NANOG" said: > Because, Apple adds a 25 ms artifical penalty to ipv4 dns resolution. > > https://ma.ttias.be/apple-favours-ipv6-gives-ipv4-a-25ms-penalty/ Umm.. It's 3 year old news that Apple implemented Happy Eyeballs. And if you read

Re: Time to add 2002::/16 to bogon filters?

2018-07-09 Thread valdis . kletnieks
On Mon, 09 Jul 2018 15:21:31 +0200, "Fabien VINCENT (NaNOG)" said: > I think it's still used a bit ? I see today announcements over the > following OriginAS over more than 2000 peers. > > as1103SURFnet bv > as1835Forskningsnettet - Danish network for Research and Education > as2847Kau

Re: Anyone from Delta on list?

2018-07-13 Thread valdis . kletnieks
On 13 Jul 2018 15:21:52 -0400, "John Levine" said: > Delta the airline? Delta the hotel chain? Delta the plumbing fixture > maker? Delta the construction company? The joys of mapping an address space defined by trademark law into an address space defined by '.com'. And it just went downhill

Re: Proving Gig Speed

2018-07-17 Thread valdis . kletnieks
On Tue, 17 Jul 2018 13:44:07 -0400, b...@theworld.com said: > Do they need 10gb? Or do they need multiple 1gb (e.g.) channels which > might be cheaper and easier to provision? Doesn't DOCSIS channel bonding already do that? pgp9iFUM4Ez85.pgp Description: PGP signature

Re: NANOG list errors

2018-07-17 Thread valdis . kletnieks
On Tue, 17 Jul 2018 23:24:51 -0500, Andy Ringsmuth said: > Fellow list members, > The last several days, I’ve been receiving mail forwarding loop errors for > the list. I’ll receive them several hours after sending a message. I’ll > paste > the latest two of them below, separated by % symbo

  1   2   3   4   5   6   7   8   9   10   >