- Test - lists.nanog.org

Re: job screening question
by Derek Andrew 10 Jul '12

10 Jul '12

Isn't MTU discovery on IP and not TCP? On Thu, Jul 5, 2012 at 11:11 AM, Oliver Garraux <oliver(a)g.garraux.net>wrote: > Seems fairly straightforward to me. It'll break path MTU discovery. > > I would hope someone applying for an "IP expert" position would know that. > > Could HR be mangling the question or something? > > Oliver > > ------------------------------------- > > Oliver Garraux > Check out my blog: www.GetSimpliciti.com/blog > Follow me on Twitter: twitter.com/olivergarraux > > > On Thu, Jul 5, 2012 at 1:02 PM, William Herrin <bill(a)herrin.us> wrote: > > Hi folks, > > > > I gave my HR folks a screening question to ask candidates for an IP > > expert position. I've gotten some "unexpected" answers, so I want to > > do a sanity check and make sure I'm not asking something unreasonable. > > And by "unexpected" I don't mean naively incorrect answers, I mean > > oh-my-God-how-did-you-get-that-cisco-certification answers. > > > > The question was: > > > > You implement a firewall on which you block all ICMP packets. *What* > > *part of the TCP protocol (not IP in general, TCP specifically)* > > *malfunctions as a result?* > > > > > > My questions for you are: > > > > 1. As an expert who follows NANOG, do you know the answer? Or is this > > question too hard? > > > > 2. Is the question too vague? Is there a clearer way to word it? > > > > 3. Is there a better screening question I could pass to HR to ask and > > check the candidate's response against the supplied answer? > > > > Thanks, > > Bill Herrin > > > > > > -- > > William D. Herrin ................ herrin(a)dirtside.com bill(a)herrin.us > > 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> > > Falls Church, VA 22042-3004 > > > > -- Copyright 2012 Derek Andrew (excluding quotations) +1 306 966 4808 ICT University of Saskatchewan Peterson 120; 105 North Road Saskatoon,Saskatchewan,Canada. S7N 4L5 Timezone GMT-6 Typed but not read. [image: Description: Description: Description: Description: Description: cid:image002.png@01CCD52C.EA7400D0] <http://www.usask.ca/> --

21 31

Re: U.S. spy agencies ... email for cybersecurity
by Jeff Shultz 10 Jul '12

10 Jul '12

One thing that GEN Alexander has is a clue. He was my Battalion Commander in Germany in the early 90s and he is one of those guys you don't give a second thought to following. Very competent.

1 0

Carrier assistance
by Darrell Hyde 09 Jul '12

09 Jul '12

Could anyone from Qwest/CenturyLink, TW Telecom, or XO with the ability to assist with some null routing please drop me a line off-list? Got a customer getting attacked in one of my sites and our calls are languishing in hold queues. Thanks in advance, - Darrell

5 4

Any advantage of announcing IPv6/64s Or purely misconfiguration?
by Anurag Bhatia 09 Jul '12

09 Jul '12

Hello everyone I was just looking around and say a major Indian provider Sify (AS9583) is announcing /64s via BGP along with main /32 which is their allocation from APNIC. inet6num: 2001:0E48::/32 netname: SILNET descr: Sify Limited descr: Value Added Network service provider country: IN admin-c: HS51-AP tech-c: HS51-AP status: ALLOCATED PORTABLE mnt-by: APNIC-HM mnt-lower: MAINT-IN-SIFY changed: hm-changed(a)apnic.net 20040211 changed: hm-changed(a)apnic.net 20060117 source: APNIC As per IPv6 prefixes announced by AS9583 via bgp.he.net - http://bgp.he.net/AS9583#_prefixes6 we can see multiple /64s. Prefix <http://bgp.he.net/AS9583#>Description <http://bgp.he.net/AS9583#> 2001:0e48::/32 <http://bgp.he.net/net/2001:0e48::/32>Sify Limited [image: India] 2001:0e48:0000:0001::/64 <http://bgp.he.net/net/2001:0e48:0000:0001::/64>Sify Limited [image: India] 2001:0e48:0000:0002::/64 <http://bgp.he.net/net/2001:0e48:0000:0002::/64>Sify Limited [image: India] 2001:0e48:0000:0004::/64 <http://bgp.he.net/net/2001:0e48:0000:0004::/64>Sify Limited [image: India] I see Tata Comm (Sify's upstream) is accepting /64s while Tinet (one of other upstream) is dropping and taking only /32. Other major backbones like HE, Level3 dropping but Telia still accepting. Pretty much mixed result. Is it simply a misconfiguration or there is some use of announcing /64s along with main /32? Thanks. -- Anurag Bhatia Web: anuragbhatia.com Skype: anuragbhatia.com Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter<https://twitter.com/anurag_bhatia>| Google+ <https://plus.google.com/118280168625121532854>

7 7

Re: FYI Netflix is down
by gb10hkzo-nanog＠yahoo.co.uk 09 Jul '12

09 Jul '12

Steve at pirk, I fail to grasp the concept in your argument. You do realise, do you not, that your $$$$$ black boxes from your favourite brand name vendor have software running inside of them do you not ? Case in point for example, the recent LINX issues.... it wasn't the hardware that gave them the headaches, but the software running on it sure did ! >I am a big believer in using hardware to load balance data centers, and not >leave it up to software in the data center which might fail.

3 2

Re: job screening question
by Scott Weeks 08 Jul '12

08 Jul '12

--- jason(a)thebaughers.com wrote: From: Jason Baugher <jason(a)thebaughers.com> Geez, I'd be happy to find someone with a good attitude, a solid work ethic, and the desire and aptitude to learn. :) --------------------------------------- Yeah, that. But how do you get those folks through the HR process to you, so you can decipher their skill/work ethic level? What can the HR person ask to find out if someone has these qualities? OSPF LSA type questions will not help. I definitely would rather work with a person willing to learn the nuances of the particular network, rather than someone that can spit out canned answers. scott

22 29

FW: job screening question
by Keith Medcalf 08 Jul '12

08 Jul '12

(now copied to list as well) On Sat 07 July, 2012 at 20:32, Owen DeLong wrote: >>> "What TCP destination port numbers should be allowed through the >>> perimeter stateful firewall device to and from a mail server whose >>> only purpose is to proxy SMTP mail from internal sources?" >>> (one number answer) >> Short Answer: There is no answer to the question that can be expressed in >> one number. > Sure there is, if you count "none" as a number. None, NIL, NUL, NULL would be valid I suppose if nulls were permitted. 0 however is not correct. >> Outbound connections to TCP destination port 25 only. Returning traffic >> (including associated ICMP) should be automatically handled by your stateful >> inspection firewall. If not, you need to buy a better firewall. > I'd allow 25 and 465 outbound, myself. No reason to block SSL if the remote > side offers the capability. http://www.imc.org/ietf-apps-tls/mail-archive/msg00204.html SMTPS is deprecated and port 465 is no longer registered for SMTPS (SMTP over SSL), it is now for <record> <name>urd</name> <protocol>tcp</protocol> <description>URL Rendesvous Directory for SSM</description> <number>465</number> </record> So even though many folks may still run SMTPS on port 465, you SHOULD be using STARTTLS on port 25. > ICMP wouldn't be a TCP destination port number anyway. Very true. The again, there is a significant proportion of the same experts who think DNS only runs over UDP ... > > Any applicant who provides any answer should the rejected out of hand as > (a) being unable to read (b) being a threat to security. > LoL... Some truth to that. You would be surprised how many people think that if you permit tcp host x.x.x.x any eq 25 to let traffic out, then you need permit tcp any eq 25 host x.x.x.x as the inverse to permit returning traffic. This is more of a problem when using packet filtering than it is when configuring stateful inspection firewalls. Nonetheless, the question does ask what should be opened "to and from" in order to "proxy SMTP mail from internal sources". It could of course just be a brilliant question designed to detect such problems ... > Owen Keith --- () ascii ribbon campaign against html e-mail /\ www.asciiribbon.org

1 0

July DNS
by NIG NOG 08 Jul '12

08 Jul '12

The guard’s face reddened again, and the veins in his thick neck stood out. “I said take offyour pants, faggot!You can’t hide your tiny little cock any more!” Chris jumped back, startled, and James began to chuckle. Chris could feel a slow heat rising up from his neck. I’ll show this guy. “You asked for it, asshole!” Chris grabbed his suspenders and tore them off his shoulders, letting the baggy black pants drop around his ankles. Before the guard could say anything, Chris grabbed the waistband of the sweats with one hand, and plunged the other in to wrap under the massive girth of his anaconda. He put his hand under the middle of his shaft, and twisted his whole body as he pulled upward, wriggling his nineteen inch limp cock out of his pants. He lifted it as best he could, and struggling, freed both of his huge, heavy balls from the sweats as well. Swinging free, the sheer weight threatened to almost throw him off balance, and Chris staggered around the room a bit, further unbalanced by the pants around his ankles. Chris clapped both hands on his thick cock and lifted it upward, waving it at the guard. “There! Here’s my tiny dick that I was hiding! See how little it is! I’m sooo ashamed of having a tiny penis! If only I could be big like you, Officer James!” Chris swung his huge prick from side to side, reveling in the weight of his cock and balls. The guard stood stock still, eyes wide with amazement. He turned bright red, from his collar to the tops of his ears. He started to stammer. “S-s-sir.. I’m really…I apologize…it was my mistake. I..” Chris cut him off, still holding his huge meat in both hands. “It’s damn right it was your mistake! Your mistake messing with the biggest fucking dick on the planet! You’re lucky I don’t beat you senseless with my huge cock!” Chris could feel the blood surging into his prick, and felt it beginning to swell and thicken in his hands. Yeah! Thought youwere the big boy, did you! Wait till you see how big this boy gets! Suddenly, Tracy’s voice came through the door. “James! What is going on in there?!? You’re just supposed to escort him to the office! Are you OK, sir? I’m coming in.” Chris heard her keys rattling at the lock.

2 1

RE: FYI Netflix is down
by Ryan Malayter 07 Jul '12

07 Jul '12

James Downs wrote: > For Netflix (and all other similar > services) downtime is money and money is downtime. There is a > quantifiable cost for customer acquisition and a quantifiable churn > during each minute of downtime. Mature organizations actually calculate > and track this. The trick is to ensure that you have balanced the cost > of greater redundancy vs the cost of churn/customer acquisition. If you > are spending too much on redundancy, it's as big of mistake as spending > too little. Actually, for Netflix, so long as downtime is infrequent or short enough that users don't cancel, it actually saves them money. They're not paying royalties for movies being streamed during downtime, but they're still collecting their $8/month. There is no meaningful SLA for the end user to my knowledge. I imagine the threshold for *any* user churn based on downtime is very high for Netflix. So long as they are "about as good as cable/sattelite TV" in terms of uptime Netflix will do fine. You would have to get into 98% uptime or lower before people would really start getting irritated enough to cancel. Of course multiple short outages would be more painful than a few longer ones from a customer's perspective. I imagine Netflix is mature enough to track this data as you suggest, and that's why they use AWS - downtime isn't a big deal for their business unless it gets really, really bad.

4 3

Re: [outages] www.dns-ok.us down
by Jay Ashworth 06 Jul '12

06 Jul '12

So... might large and medium ISPs not redirect DNS to those known addresses to a resolver in house, which would log the client IPs and let them know whom to address? Cheers, -- jra ----- Original Message ----- > From: "Eric J Esslinger" <eesslinger(a)fpu-tn.com> > To: "outages(a)outages.org" <outages(a)outages.org> > Sent: Friday, July 6, 2012 12:39:56 PM > Subject: [outages] www.dns-ok.us down > As per subject, the DNS Changer Working Group (DCWG) site for the US > is down atm. Also another very probably related issue; Foxnews, CNN, > and MSNBC have all apparantly run stories in the last few hours about > how the internet end is nigh, everyone is infected, and if you have > any questions call your isp. (Hype levels varied per channel, I'm told > as well). > > __________________________ > Eric Esslinger > Information Services Manager - Fayetteville Public Utilities > http://www.fpu-tn.com/ > (931)433-1522 ext 165 > > This message may contain confidential and/or proprietary information > and is intended for the person/entity to whom it was originally > addressed. Any use by others is strictly prohibited. > > _______________________________________________ > Outages mailing list > Outages(a)outages.org > https://puck.nether.net/mailman/listinfo/outages -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

3 2