August 2010 - Test - lists.nanog.org

aol postmaster?
by Matt Kelly 24 Aug '10

24 Aug '10

If there is an AOL postmaster contact available, can you please contact me off list? Thanks. -- Matt

2 1

end-user ipv6 deployment and concerns about privacy
by Hannes Frederic Sowa 24 Aug '10

24 Aug '10

Hello! As the first IPv6 deployments for end-users are in the planning stage in Germany, I realized I have not found any BCP for handling addressing in those scenarios. IPv6 will make it a lot easier for static address deployments but I wonder weather this is in the best sense for the customers. As I normally come from the technical side I prefer static addressing. But in the world of facebook and co. I wonder if it would be a better to let the user have the choice. A major provider of dsl here in Germany recently blogged about this [1]. Their proposal is to serve two subnets, one being a static one while the other one will be dynamically allocated. I have no clue how the user would switch between these subnets (without using some kind of command line tools). This is not about using privacy extensions as the subnet is sufficient for identification. Did you reach any conclusion on this matter? Thanks, Hannes [1] http://translate.google.com/translate?js=y&prev=_t&hl=en&ie=UTF-8&layout=1&…

10 25

on network monitoring and security - req for monitoring tools
by travis+ml-nanog＠subspacefield.org 24 Aug '10

24 Aug '10

Hi, I'm putting together a book on security*, and wanted some expert input onto network monitoring solutions... http://www.subspacefield.org/security/security_concepts.html Nagios, Net-SNMP, ifgraph, cacti, OpenNMS... any others? Any summaries of when one is better than the other? Any suggestions on section 13-15? I imagine I'll offend some of you by not distinguishing between system and network adminsitration, but... it's a small section right now, maybe if it grows. OT: I had issues with understanding MIBs and SNMP tools... specifically, I wanted to query and graph the pf-specific MIB... any suggested places to ask? Do I ask on the Net-SNMP list, or is there a better place? Also, cacti... seemed to behave differently based on whether the target was Linux-based or BSD-based... I suppose the cacti-users is the right place to ask, but if anyone has any suggestions, please LMK. I hate the UI. -- My emails do not have attachments; it's a digital signature that your mail program doesn't understand. | http://www.subspacefield.org/~travis/ If you are a spammer, please email john(a)subspacefield.org to get blacklisted.

6 5

Re: IPv6 PMTUD and OS-X
by Vyto Grigaliunas 24 Aug '10

24 Aug '10

>> 1220? I am pretty sure the minimal IPv6 MTU is 1280 and that below it fragmentation should be handled by the medium that transports packets smaller than that.... Can you enlighten me >> Bill? :) Please correct me if I'm wrong, but last I heard IPv6 routers do not do fragmentation...it's up to the IPv6 end hosts to properly determine the path MTU. Thanks... Vyto Date: Sat, 21 Aug 2010 11:42:04 +0200 From: Jeroen Massar <jeroen(a)unfix.org> Subject: Re: IPv6 PMTUD and OS-X To: bmanning(a)vacation.karoshi.com Cc: nanog(a)nanog.org Message-ID: <4C6F9F6C.80609(a)unfix.org> Content-Type: text/plain; charset=UTF-8 On 2010-08-21 09:18, bmanning(a)vacation.karoshi.com wrote: > On Fri, Aug 20, 2010 at 11:34:23PM +0200, Jeroen Massar wrote: >> On 2010-08-20 23:27, Franck Martin wrote: >>> I'm trying to debug a pesky PMTUD issue with IPv6 on Mac OS-X 10.6. >>> >>> It happens only from home, on wireless, when connected to a mac >>> aiport that does an automatic tunnel (teredo) to IPv6 backbone. >> >> Welcome to the great world of Teredo/6to4 where the endpoints/relays >> of the tunnel are anycasted in both IPv4 and IPv6 and thus can be >> quite difficult to debug, it can be done but requires quite a lot of >> vision in the network on both IPv4 and which will be generally near impossible. >> >>> There are IPv6 web site that I cannot browse until I lower the MTU >>> to >> 1400. >> >> Why don't you just do 1280 which is the default? >> >> Do also note that you have two levels of PMTU, the IPv6 one and the >> IPv4 one. If you configure your MTU of the tunnel incorrectly >> compared to the relay that you are using you will not see the PMTU's >> coming through either or they might not accept your large packets. >> >> Both MTUs can be broken due to folks filtering ICMP which is >> generally a bad thing to do. >> >> Greets, >> Jeroen > > > or - if you are tunneled more than once, you might be ultra conservative > and drop your MTU to 1220 - that should weed out the edge cases where even 1280 > is too large. 1220? I am pretty sure the minimal IPv6 MTU is 1280 and that below it fragmentation should be handled by the medium that transports packets smaller than that.... Can you enlighten me Bill? :) Greets, Jeroen

1 0

Motorola Canopy & Prizm
by Alan Bryant 24 Aug '10

24 Aug '10

I'm looking for some help with Motorola's Prizm software which is used for provisioning of subscriber modules with their Canopy wireless products. We are having some issues with authentication of some customer's and I believe it to be related to the management software (Prizm). Is there anyone on this list with experience with this software? -- Alan Bryant | Systems Administrator Gtek Computers & Wireless, LLC. alan(a)gtekcommunications.com | www.gtek.biz O 361-777-1400 | F 361-777-1405

3 3

Real ops talking to future ops
by John Kristoff 24 Aug '10

24 Aug '10

I'm afraid this is only slightly operational and limited to a subset of the NANOG crowd. I apologize profusely in advance for abusing the list as I might, but I can't think of a more suitable group of people to approach. I think the essence of the request is in line with the spirit of NANOG. As some of you know, I teach networking classes at DePaul University in Chicago. What has gone over extremely well in the past is when I've had a real op come talk to the students, even if its just about what they do on a daily basis. If any of you are in or around the Loop in Chicago area on a Wednesday night between September and November of this year and wouldn't mind getting up in front a few geeky undergrads, I would be forever grateful if you do so with my class. I'm not asking for anything polished. If you've presented something recently that you think a computer science undergrad should be able to grasp or even if just have enable, your future ops want you to tell them about it. ...and yes, many of the other instructors they come into contact with are focusing only on class A, B, C addressing. So you'll be doing the world a favor and maybe even me, by saying some things I'm not the only one saying to them before they interview circuit. Here's what things looked like last quarter to give you an idea of the general topics covered: <http://condor.depaul.edu/~jkristof/tdc375/> Thanks, John

6 8

Tagged vlan inside isolated pvlan
by lorddoskias 24 Aug '10

24 Aug '10

Hello, I have a catalyst 6503 with sup32 and was trying to set a tagged vlan inside a pvlan. Basically I wanna have the behavior of: switchport mode access switchport access vlan 101 switchport protected. So that other machines connected to the 6503 won't be able to communicate with this port (apart from the uplink) and in the same time I want to have vlan 101 tagged in the isolated port. Regards, Nikolay

3 2

PacketShader
by Michael Painter 23 Aug '10

23 Aug '10

Researchers in South Korea have built a networking router that transmits data at record speeds from components found in most high-end desktop computers. A team from the Korea Advanced Institute of Science and Technology created the router, which transmits data at nearly 40 gigabytes per second--many times faster than the previous record for such a device. The techniques used by the researchers could lead to a number of breakthroughs, including the use of cheaper commodity chips, such as those made by Intel and Nvidia, in high-performance routers, in place of custom-made hardware. The software developed by the researchers could also serve as a testbed for novel networking protocols that might eventually replace the decades-old ones on which the Internet currently runs. http://www.technologyreview.com/communications/26096/?nlid=3423

9 9

web site counter-phishing services
by Tim Sanderson 23 Aug '10

23 Aug '10

My company has used Perimeter E-Security's CounterPhish service for a while but we are not completely happy with it. Is anyone familiar with any other vendors that provide such service and are you happy with it?

1 0

DNSSEC and SSL
by ML 23 Aug '10

23 Aug '10

Would a future with a ubiquitous DNSSEC deployment eliminate the market for commercial CAs? Would functioning DNSSEC + self signed certs be more secure/trustworthy than our current system of trusted CAs chosen by OS/browser developers?

12 15