October 2014 - Test - lists.nanog.org

Re: wifi blocking [was Re: Marriott wifi blocking]
by Larry Sheldon 09 Oct '14

09 Oct '14

On 10/8/2014 16:11, William Herrin wrote: > On Wed, Oct 8, 2014 at 4:37 PM, joel jaeggli <joelja(a)bogus.com> wrote: >> On 10/8/14 1:29 PM, Larry Sheldon wrote: >>> On 10/8/2014 08:47, William Herrin wrote: >>>> BART would not have had an FCC license. They'd have had contracts with >>>> the various phone companies to co-locate equipment and provide wired >>>> backhaul out of the tunnels. The only thing they'd be guilty of is >>>> breach of contract, and that only if the cell phone companies decided >>>> their behavior was inconsistent with the SLA.. >>> >>> OK that makes more sense than the private answer I got from Roy. I >>> wondered why the FCC didn't take action if there was a license violation. >> >> http://www.nytimes.com/2012/03/03/technology/fcc-reviews-need-for-rules-to-… > >>From the article: "Among the issues on which the F.C.C. is seeking > comment is whether it even has authority over the issue." > > Also: "The BART system owns the wireless transmitters and receivers > that allow for cellphone reception within its network." > > I'm not entirely clear how that works. Several things fail the "entirely clear" test. (I'm not entirely clear on where the interruption was, but the pictures made me think "San Francisco". And I'm too lazy to look it up.) In San Francisco, the Muni is in a pipe above (if I remember correctly) BART--did they interrupt cell service there as well? I wonder if there is any leakage. As I recall, BART does not permit anything on their trains--water, baby bottles, and I thought radios. How do they get the authority to do that? -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

2 1

Re: wifi blocking [was Re: Marriott wifi blocking]
by Larry Sheldon 09 Oct '14

09 Oct '14

On 10/8/2014 08:47, William Herrin wrote: > On Wed, Oct 8, 2014 at 8:42 AM, Roy <r.engehausen(a)gmail.com> wrote: >> On 10/7/2014 10:35 PM, Larry Sheldon wrote: >>> On 10/7/2014 23:44, Valdis.Kletnieks(a)vt.edu wrote: >>>> On Tue, 07 Oct 2014 23:10:15 -0500, Larry Sheldon said: >>>>> The cell service is not a requirement placed upon them, I am pretty >>>>> sure. >>>> >>>> However, once having chosen to provide it, and thus create an expectation >>>> that cellular E911 is available, they're obligated to carry through on >>>> that. >>>> >>> Obligated by what law, regulation, rule or contract? >> >> Obligated by the FCC license > > Hi Larry, Roy: > > BART would not have had an FCC license. They'd have had contracts with > the various phone companies to co-locate equipment and provide wired > backhaul out of the tunnels. The only thing they'd be guilty of is > breach of contract, and that only if the cell phone companies decided > their behavior was inconsistent with the SLA.. OK that makes more sense than the private answer I got from Roy. I wondered why the FCC didn't take action if there was a license violation. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

5 4

speaking of wifi
by William Herrin 08 Oct '14

08 Oct '14

Speaking of wifi and the NANOG conference that just finished in Baltimore, we have some words from Maryland Governor Martin O'Malley: http://www.washingtonpost.com/blogs/the-fix/wp/2014/10/08/martin-omalley-an… -- William Herrin ................ herrin(a)dirtside.com bill(a)herrin.us Owner, Dirtside Systems ......... Web: <http://www.dirtside.com/> May I solve your unusual networking challenges?

1 0

verizon postmaster here?
by Mark E. Jeftovic 08 Oct '14

08 Oct '14

Hi, is there a verizon postmaster around who could contact me off-list? thx -- Mark E. Jeftovic <markjr(a)easydns.com> Founder & CEO, easyDNS Technologies Inc. +1-(416)-535-8672 ext 225 Read my blog: http://markable.com

1 0

Re: wifi blocking [was Re: Marriott wifi blocking]
by Larry Sheldon 08 Oct '14

08 Oct '14

I have a question for the company assembled: Suppose that instead of [name of company] being offended by people using their own data paths instead to the pricey choice offered, [name of company] took the position that people should use the voice telephone service they offered and block cell phone service on (and near) their property. What would change in the several arguments that have been presented? -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

8 8

Re: wifi blocking [was Re: Marriott wifi blocking]
by Larry Sheldon 08 Oct '14

08 Oct '14

On 10/8/2014 16:17, Keenan Tims wrote: > There is a provision in the regulations somewhere that allows > underground/tunnel transmitters on licensed bands without a license, > provided certain power limits are honoured outside of the tunnel. > Perhaps they are operating under these provisions? Which, if unlicensed, brings us back to the question of "by what authority, other than popular rioter opinion, are they REQUIRED to provide the service?". -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

1 0

2014.10.08 NANOG62 notes
by Matthew Petach 08 Oct '14

08 Oct '14

So, I suspect I'm going to spend a little time tonight renaming the files to make more sense; I'm uploading the rest of my notes now to http://nanog.cluepon.net/index.php/NANOG62 but you should probably ignore the more specific links I sent out earlier, as those will end up changing. Starting from that top-level-page will definitely still work, though, and then you can just click on the talk you want from there. Thanks everyone for coming--this has been an absolutely whirlwind conference this time around! Thanks! Matt

1 0

netfilter/iptables synproxy; need help deciding
by Paige Thompson 08 Oct '14

08 Oct '14

Hi, I guess syncookies wasn't enough and the SYNPROXY target is a relatively new addition to netfilter. If I remember correctly this has been a part of BSD PF for quite some time and is pretty easy to get up and working. I recently tried to set this up on one of my gateways considering that it's just one less uncovered means for somebody to be a dick that I have to deal with in the future. But, after spending some time researching and asking on Freenode I have been unable to determine whether or not it works, or even makes any sense. I'm starting to think it's a moot point. pastie.org/private/gjsypxkpjs8kuev0tlbxrw#22 (iptables rules, plenty of things to pick at but please try to focus on the subject of synproxy for the purpose of this e-mail.) based on the following table I want to say its not working because it seems to never change: http://pastie.org/private/xwct5opbb0aajcko2tnpw more info on /proc/stat/synproxy: http://www.spinics.net/lists/netdev/msg264350.html My only guess is that you can't do this at all with NAT because it relies on conntrack or maybe it will only work with SNAT? I don't understand this well enough to say; are proper firewall rules really a science that need to be understood that far in depth? Why is this not documented? This tutorial seems to indicate that you could use this with a NAT'd network: http://www.academia.edu/6773989/Homemade_DDoS_Protection_Using_IPTables_SYN… I really would like to come to some closure on this subject. Whether it needs to be done right or not done at all, I'm tired of it looming over me. I really want to believe I should do the very best to have all mitigation techniques already in place, but I'm having a hard time understanding why this is next to impossible to figure out if it's so important. #netfilter on freenode is next to no help, the mailing list seems to be unavailable.... the things people are saying about how I should "just switch" back to using pf seem like a drastic solution when people in #netfilter are so content (yet many of them have never heard of synproxy before.) Any thoughts on this are appreciated, -Paige

3 4

netfilter/iptables synproxy; need help deciding
by Paige Thompson 08 Oct '14

08 Oct '14

Hi, I guess syncookies wasn't enough and the SYNPROXY target is a relatively new addition to netfilter. If I remember correctly this has been a part of BSD PF for quite some time and is pretty easy to get up and working. I recently tried to set this up on one of my gateways considering that it's just one less uncovered means for somebody to be a dick that I have to deal with in the future. But, after spending some time researching and asking on Freenode I have been unable to determine whether or not it works, or even makes any sense. I'm starting to think it's a moot point. pastie.org/private/gjsypxkpjs8kuev0tlbxrw#22 (iptables rules, plenty of things to pick at but please try to focus on the subject of synproxy for the purpose of this e-mail.) based on the following table I want to say its not working because it seems to never change: http://pastie.org/private/xwct5opbb0aajcko2tnpw more info on /proc/stat/synproxy:http://www.spinics.net/lists/netdev/msg264350.html My only guess is that you can't do this at all with NAT because it relies on conntrack or maybe it will only work with SNAT? I don't understand this well enough to say; are proper firewall rules really a science that need to be understood that far in depth? Why is this not documented? This tutorial seems to indicate that you could use this with a NAT'd network: http://www.academia.edu/6773989/Homemade_DDoS_Protection_Using_IPTables_SYN… I really would like to come to some closure on this subject. Whether it needs to be done right or not done at all, I'm tired of it looming over me. I really want to believe I should do the very best to have all mitigation techniques already in place, but I'm having a hard time understanding why this is next to impossible to figure out if it's so important. #netfilter on freenode is next to no help, the mailing list seems to be unavailable.... the things people are saying about how I should "just switch" back to using pf seem like a drastic solution when people in #netfilter are so content (yet many of them have never heard of synproxy before.) Any thoughts on this are appreciated, -Paige

2 3

Re: Belkin Router issues this morning?
by Larry Sheldon 08 Oct '14

08 Oct '14

On 10/7/2014 17:32, Mike Lyon wrote: > And this, my friends, is why friends don't let friends buy Belkin... Amen. Side question? What happens is somebody is unwise to use Belkin routers on an internal, not-connected-to-the-Interatubes network (Like, for example, the network I tried to get ex-employer to install to serve the un-patched Windows 98 heart monitors and stuff that were favored targets of the crackers. I am having trouble understanding why a router would need a heartbeat from some foreign location. Or even what it would do with one. > Apparently, you still can't fix stupid, no matter how hard you try. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

3 3