January 2012 - Test - lists.nanog.org

AD and enforced password policies
by Jones, Barry 05 Jan '12

05 Jan '12

Hello all. Happy New Year. I have a requirement to enforce password policies on AD (a tacacs and windows domain). I don't have a great deal of Windows AD knowledge - so a newbie ;-) this is a little off topic, but I thought I'd ask... Specifically, I need to enforce the use of length, special characters, and be able to validate the enforcement of such. Looking at Nfront, Quest, etc..., and wanted to see if anyone out there had thoughts? Thank you.

15 24

Comcast Postmaster...
by Matt Kelly 05 Jan '12

05 Jan '12

Would a comcast postmaster be so kind as to contact me off list? Thanks. -- Matt

1 0

Internet Edge and Defense in Depth
by Holmes,David A 05 Jan '12

05 Jan '12

Some firewall vendors are proposing to collapse all Internet edge functions into a single device (border router, firewall, IPS, caching engine, proxy, etc.). A general Internet edge design principle has been the "defense in depth" concept. Is anyone collapsing all Internet edge functions into one device? Regards, David ________________________________ This communication, together with any attachments or embedded links, is for the sole use of the intended recipient(s) and may contain information that is confidential or legally protected. If you are not the intended recipient, you are hereby notified that any review, disclosure, copying, dissemination, distribution or use of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by return e-mail message and delete the original and all copies of the communication, along with any attachments or embedded links, from your system.

13 13

Looking for a Tier 1 ISP Mentor for career advice.
by Tyler Haske 05 Jan '12

05 Jan '12

Hi. I have some big goals and a lot of enthusiasm but I need direction. I'm looking for a mentor who can help me focus my career so eventually I wind up working at one of the Tier I ISPs as a senior tech. I want to handle the big pipes that hold everyone's data. This is what I want to do with my life. I have my CCNA, and when I graduate college I'll have a CCNP, and the ability to move anywhere in the USA. Please message me off-list. Thank you, Tyler.

23 26

IPv6 resolvers
by Seth Mos 04 Jan '12

04 Jan '12

Hi Nanog, Owen, I was wondering if many people are seeing horrendous latency on the free Hurricane Electric resolvers? Both accessing the v4 or v6 resolvers have horrendous latency. This could well be coupled to their free nature and popularity. So far when contacting Hurricane Electric they restart the resolver on their end and all is well again, but now other pfSense users in the US were noticing these latency issues as well, leading me to believe it is a larger issue. But I was wondering if a more permanent solution for these resolvers exist. 74.82.42.42 2373 msec 2001:470:20::2 2592 msec The google DNS server I'm using is doing swimmingly so far, OpenDNS seems ok too. 2001:4860:4860::8844 16 msec Kind regards, Seth Mos

6 9

2012-Big-Data-Big-Traffic
by Henry Linneweh 04 Jan '12

04 Jan '12

New issues for massive data movement http://www.infineta.com/sites/default/files/pdf/IRG-2012-Big-Data-Big-Traff… Henry

1 0

Does anybody out there use Authentication Header (AH)?
by John Smith 04 Jan '12

04 Jan '12

Hi, I am trying to see if there are people who use AH specially since RFC 4301 has a MAY for AH and a MUST for ESP-NULL. While operators may not care about a MAY or a MUST in an RFC, but the IETF protocols and vendors do. So all protocols that require IPsec for authentication implicitly have a MAY for AH and a MUST for ESP-NULL. Given that there is hardly a difference between the two, I am trying to understand the scenarios where people might want to use AH? OR is it that people dont care and just use what their vendors provide them? Regards, John

5 9

CenturyLink - DNS admin needed
by Graham Wooden 03 Jan '12

03 Jan '12

Hello, Any CenturyLink DNS admin folks lingering around? If so, can you contact me off-list? I believe there is some erroneous data lingering in the DNS caching servers and would like to get that resolved. TTL has appeared to have come and gone and it¹s not refreshing. FYI - I tried to go through our support channels (we¹re a TDM based customer), but that isn¹t proving to be getting us anywhere... Thank you, -graham

1 0

Problems with 100.42.32.0/20
by Josh Baird 03 Jan '12

03 Jan '12

Hi, We just received 100.42.32.0/20 from ARIN. According to ARIN, this block was received from IANA in November 2010 and was issued to us in November 2011. Since we started using it, we have seen many problems with different Geo-IP providers incorrectly classifying the block - both location and provider wise (lots of them think this is Verizon space for some reason in both Canada and Kansas). I have followed http://nanog.cluepon.net/index.php/GeoIP and contacted most of these providers already. Not one has returned my email/inquiry. The main problem that I am seeing is that Verizon/UUNET is filtering access to some of their networks from 100.42.32.0/20. We are currently unable to reach any of UUNET.net's authoritative DNS servers (198.6.1.83, 198.6.1.161, etc) and appear to be filtered by some Verizon Business/UUNET routers. $ traceroute 198.6.1.83 traceroute to 198.6.1.83 (198.6.1.83), 30 hops max, 40 byte packets 1 209.65.192.129 (209.65.192.129) 1.491 ms 1.716 ms 1.942 ms 2 vl41-irtr1.dan100.net.kywimax.com (209.65.192.45) 0.551 ms 0.582 ms 0.587 ms 3 rrcs-173-197-155-189.west.biz.rr.com (173.197.155.189) 0.474 ms 0.519 ms 0.505 ms 4 ae8.chcgill3-rtr1.kc.rr.com (65.28.199.197) 20.349 ms 20.340 ms 20.409 ms 5 ae-5-1.cr0.chi30.tbone.rr.com (66.109.6.112) 20.243 ms 20.235 ms 20.223 ms 6 107.14.17.147 (107.14.17.147) 27.982 ms 27.567 ms 27.540 ms 7 216.156.72.165.ptr.us.xo.net (216.156.72.165) 20.945 ms te1-2-0d0.cir1.chicago2-il.us.xo.net (216.156.72.5) 20.920 ms 216.156.72.157.ptr.us.xo.net (216.156.72.157) 20.912 ms 8 (204.255.168.97) 20.868 ms 20.826 ms 20.910 ms 9 (152.63.66.77) 36.133 ms 36.243 ms 36.233 ms 10 (152.63.43.109) 45.859 ms 45.853 ms 45.843 ms 11 (152.63.38.9) 45.177 ms 45.175 ms 45.168 ms 12 * * * 13 * * * 14 * (207.18.173.162) 46.105 ms !X * (pos5-0.soesr1.ash.ops.us.uu.net) I have contacted VZW Business' IP-NOC and was not really given a contact that could help me with this situation. I have also emailed filters(a)lists.verizonbusiness.com and I'm awaiting a response (hopefully). Would anyone happen to have an idea of why I am seeing so many problems with this block, and who I may be able to reach out to at VZB to hopefully get this issue resolved? Thanks.

1 1

Multicast video stream to EIA analog channel
by Matt Bernardi 03 Jan '12

03 Jan '12

Hello all, I am new to the mailing list and wanted to pick some of your guys brains about something. I work for a small cable service provider. What I am trying to do is receive a multicast stream, modulate it and send it out as an EIA analog channel. I know there is equipment built for this specific reason(RGP SEP, APEX1000, etc) but this is just going to be a temporary fix as we are doing a total video overhaul and moving to all MPEG4 capable equipment. I figured there is a way to accomplish this with linux as my budget isn't very large, but all of my reasearch hasn't really helped so I'm reaching out to you. Has anyone ever done this? or know of any good reference sites for this? Any info would be greatly appreciated. Thanks again, Matt Bernardi

2 2