July 2011 - Test - lists.nanog.org

3Com Total Control documentation
by Hector Herrera 28 Jul '11

28 Jul '11

Hi, I have "inherited" several 3Com Total Control racks that are used to provide dial-up service to rural areas. The racks have been running in auto-pilot for several years now and the last tech's comments with regard to the racks was along the lines of "I don't know". I would like to regain control over the network as recently the outages are becoming more frequent and extended and we don't usually know about it until customers call the support line a week later. Decommissioning the racks is not currently an option as there are no other reasonable alternatives for internet service (other than satellite). The ISP being an marginal area provider is also short in funds. I'm having a hard time finding documentation, firmware updates or support for these racks. As far as I can tell, the current owner of the product line is UTStarCom in China, but their website does not make any reference to the product. I also found a company that sells the equipment and provides support contracts, WRCA, but their pricing is out of the budget range for the ISP. I am hoping that some of you who used to work with this equipment may still have documentation CDs or firmware updates stored away somewhere. I'm looking for any documentation, firmware updates and some help figuring out which NAC goes with which NIC. Or perhaps you can suggest other companies that provide support for the equipment at more reasonable rates. I would be willing to setup a public repository to help other admins. Thanks, -- Hector Herrera

3 3

Re: 3Com Total Control documentation
by Alex Rubenstein 28 Jul '11

28 Jul '11

We recently dumped about 40 into a dumpster. I shed a tear. Sent via Blackberry while presumably driving with one hand ----- Original Message ----- From: Matthew Black <black(a)csulb.edu> To: hectorh(a)pobox.com <hectorh(a)pobox.com>; NANOG list <nanog(a)nanog.org> Sent: Thu Jul 28 11:19:11 2011 Subject: Re: 3Com Total Control documentation My sympathies to your unfortunate situation. The last tech probably doesn't want to be bothered...that's a management issue. A PortMaster 3 may solve your problems. I looked at 3Com Total Control about 15 years ago but know nothing about it. We employed US Robotics rack-mount chassis paired with Xyplex terminal servers. That was replaced with the Livingston PortMaster 3 (later bought by Lucent). Each PortMaster 3 connects to two T1 lines and a 10BaseT Ethernet, supporting 48 users. Use RADIUS authentication and you're all set. You can probably pick up some of those for a hundred dollars. You will need to learn about T1 phone lines and RADIUS. Best regards, matthew black california state university, long beach On Tue, 26 Jul 2011 19:35:35 -0700 Hector Herrera <hectorh(a)pobox.com> wrote: > Hi, > > I have "inherited" several 3Com Total Control racks that are used to > provide dial-up service to rural areas. > > The racks have been running in auto-pilot for several years now and > the last tech's comments with regard to the racks was along the lines > of "I don't know". > > I would like to regain control over the network as recently the > outages are becoming more frequent and extended and we don't usually > know about it until customers call the support line a week later. > > Decommissioning the racks is not currently an option as there are no > other reasonable alternatives for internet service (other than > satellite). The ISP being an marginal area provider is also short in > funds. > > I'm having a hard time finding documentation, firmware updates or > support for these racks. > > As far as I can tell, the current owner of the product line is > UTStarCom in China, but their website does not make any reference to > the product. > > I also found a company that sells the equipment and provides support > contracts, WRCA, but their pricing is out of the budget range for the > ISP. > > I am hoping that some of you who used to work with this equipment may > still have documentation CDs or firmware updates stored away > somewhere. > > I'm looking for any documentation, firmware updates and some help > figuring out which NAC goes with which NIC. > > Or perhaps you can suggest other companies that provide support for > the equipment at more reasonable rates. > > I would be willing to setup a public repository to help other admins. > > Thanks, > > -- > Hector Herrera > >

2 1

LACNOG 2011 - Buenos Aires - Oct 4-7
by Christian O'Flaherty 28 Jul '11

28 Jul '11

LACNOG2011 - Call for presentations - Due date - July, 31st English: http://www.lacnog.org/en/lacnog-2011-call-presentations Español: http://www.lacnog.org/es/lacnog-2011-llamado-a-presentaci%C3%B3n-trabajos Portugues: http://www.lacnog.org/es/lacnog-2011-llamado-a-presentaci%C3%B3n-trabajos

1 0

Comcast Bussiness Class and GRE Tunnels
by Nate Burke 28 Jul '11

28 Jul '11

Hello, I'm hoping that someone here might have run into a similar issue and might be able to offer me some pointers. I have a customer that I am providing redundant paths to, one link over a microwave connection, and a backup link over a Comcast Business Class Connection. Everything on the Microwave link is working fine. On the Comcast Connection, I have a Static IP from Comcast, and I want to setup a vendor specific GRE tunnel (Mikrotik EoIP) from my NOC to the Comcast Static IP Address. It looks like the SPI Firewall inside the SMC Gateway required by comcast is blocking the GRE packets, I'm basing this on the fact that when I power cycle the modem, I get 1 ICMP Packet through the GRE Tunnel while the modem is booting up, then it stops again. I have gotten to Tier2 support who swears that all Firewalls on the SMC Gateway are disabled. As a workaround, I was able to establish a PPTP tunnel to my NOC, however it seems like the tunnel will only run for a few hours, then becomes slow to the point of being unusable. In my mind this would be no different than setting up a permanent VPN back to a corporate office, which I would think happens all the time, so I'm not sure why I'm running into issues with it. Anyone with Insights or comments would be appreciated. Thanks, Nate Burke

13 18

OOB
by harbor235 27 Jul '11

27 Jul '11

I am curious what is the best practice for OOB for a core infrastructure environment. Obviously, there is an OOB kit for customer managed devices via POTS, Ethernet, etc ... And there is OOB for core infrastructure typically a separate basic network that utilizes diverse carrier and diverse path when available. My question is, is it best practice to extend an inband VPN throughout for device management functions as well? And are all management services performed OOB, e.g network management, some monitoring, logging, authentication, flowdata, etc ..... If a management VPN is used is it also extended to managed customer devices? What else is can be done for remote management and troubleshooting capabilities? Mike

16 20

Re: dynamic or static IPv6 prefixes to residential customers
by Scott Weeks 27 Jul '11

27 Jul '11

------ jeroen(a)unfix.org wrote: ------- It of course all depends what the adversary is and what you are protecting against ;) -------------------------------------- Thanks for all the responses. It is (and has been for the last 14 years on nanog) the best way for me to learn. :-) I am only protecting against what I see as improper actions (bullying) by corpment drones. One can't hide everything, but it doesn't help the internet overall to make it easy for them to do these things. scott

1 0

Re: dynamic or static IPv6 prefixes to residential customers
by Scott Weeks 27 Jul '11

27 Jul '11

--- jeroen(a)unfix.org wrote: From: Jeroen Massar <jeroen(a)unfix.org> On 2011-07-27 03:25 , Scott Weeks wrote: > -------- matt.addison(a)lists.evilgeni.us wrote: --------------------- >> [..] 1: http://panopticlick.eff.org/ > > All you need to do with what that site says is write a sh script that > deletes and then creates the same user. And there you sprung into a trap. You will be the only one doing this and having no history and thus you stick out very well, as the new guy on the Internet every single day, from a similar prefix, but still accessing a similar set of hosts etc. I think I did a talk about that at CCC last year ;) ------------------------------------------------- Not from the same prefix. I have multiple networks coming into my house and I cycle through them. next... :-) Is there anything you can point me to on the talk? I'd be really interested in reading it. ----------------------------------------------------------------- You are blocking all the facebook/google+ like and the insane amount of advertisement (read: tracking) networks who are included on almost every page do you? As everytime you fetch a page, even if it is not the main site, you also hit them for an ad or a like-button (even if it is just the image and you don't actually click you hit their server) and voila you are tracked anyway. ----------------------------------------------------------------- I have never done facebook and I do very little google (mainly just Earth as nothing free can compete with it afaik) for just these reasons. See Urchin (http://www.google.com/urchin/features.html) and watch your browser for _utma, _utmb, etc cookies. And, yes, I block every cookie (except the few I want to allow) as the various browsers I use all are set to "ask me every time". The bad thing, though, is what they send 'back home'. I am curious and have been looking into that recently. scott Giving dynamic addresses out thus only still have one valid reason: nomadic users and the ability to aggregate prefixes inside a network. Because when users are static, you just route a /36 to a location and route prefixes out of that to the users and voila. When they are nomadic/mobile you don't want all those millions of /48s polluting your iBGP though. For every other case, dynamic addresses just make no sense, except for the cash cow that they are and that is the real reason that is the default being offered, as technically they cost more money. Greets, Jeroen

2 1

XO Contact
by Robert Haas 27 Jul '11

27 Jul '11

Can someone from XO contact me (or if someone has a contact within XO, I'd appreciate it). We are having reachability issues from our network 74.91.64.0/20 AS36243 to the XO network. Thanks, Robert Haas 573-293-2638

2 2

Re: dynamic or static IPv6 prefixes to residential customers
by Scott Weeks 27 Jul '11

27 Jul '11

--- Valdis.Kletnieks(a)vt.edu wrote: On Tue, 26 Jul 2011 18:25:30 PDT, Scott Weeks said: > (who's still bristling from the last discussion about this where Valdis kept > saying "Privacy is dead. Get used to it." Man, leave one smiley off and it follows you for life. ;) ------------------------------------------------- Ok, I'll do my best to remember that. Also, I should've had a smiley at the end of my ps... :-) scott

1 0

Re: dynamic or static IPv6 prefixes to residential customers
by Scott Weeks 27 Jul '11

27 Jul '11

-------- matt.addison(a)lists.evilgeni.us wrote: --------------------- On Jul 26, 2011, at 20:08, Valdis.Kletnieks(a)vt.edu wrote: > There's a subtle but significant difference between what cookies give you, > which is "This is the same entity that visited our page at 7:48PM last > Tuesday", and what easily trackable IP addresses give you, which is "This is an > entity located at 1948 Durhof Street". With how much identifying information user agents leak nowadays [1] this is almost a moot point. If you can be uniquely identified through the user agent- does it really matter that they can uniquely ID the household as well based on prefix information? 1: http://panopticlick.eff.org/ ------------------------------------------------------------------- All you need to do with what that site says is write a sh script that deletes and then creates the same user. Stick it in a crontab. Your browser ID changes each time. In addition to browser cookies, be sure to manage your flash cookies... http://www.macromedia.com/support/documentation/en/flashplayer/help/setting… So, force the DHCP server to give you new addresses (in IPv4; don't know about IPv6, yet), manage your cookies, change your browser IDs regularly. What did I miss? ;-) scott (who's still bristling from the last discussion about this where Valdis kept saying "Privacy is dead. Get used to it." I don't want to roll over and just take it... >;-) )

3 2