- Test - lists.nanog.org

LACNOG 2011 - Buenos Aires - Oct 4-7
by Christian O'Flaherty 28 Jul '11

28 Jul '11

LACNOG2011 - Call for presentations - Due date - July, 31st English: http://www.lacnog.org/en/lacnog-2011-call-presentations Español: http://www.lacnog.org/es/lacnog-2011-llamado-a-presentaci%C3%B3n-trabajos Portugues: http://www.lacnog.org/es/lacnog-2011-llamado-a-presentaci%C3%B3n-trabajos

1 0

Comcast Bussiness Class and GRE Tunnels
by Nate Burke 28 Jul '11

28 Jul '11

Hello, I'm hoping that someone here might have run into a similar issue and might be able to offer me some pointers. I have a customer that I am providing redundant paths to, one link over a microwave connection, and a backup link over a Comcast Business Class Connection. Everything on the Microwave link is working fine. On the Comcast Connection, I have a Static IP from Comcast, and I want to setup a vendor specific GRE tunnel (Mikrotik EoIP) from my NOC to the Comcast Static IP Address. It looks like the SPI Firewall inside the SMC Gateway required by comcast is blocking the GRE packets, I'm basing this on the fact that when I power cycle the modem, I get 1 ICMP Packet through the GRE Tunnel while the modem is booting up, then it stops again. I have gotten to Tier2 support who swears that all Firewalls on the SMC Gateway are disabled. As a workaround, I was able to establish a PPTP tunnel to my NOC, however it seems like the tunnel will only run for a few hours, then becomes slow to the point of being unusable. In my mind this would be no different than setting up a permanent VPN back to a corporate office, which I would think happens all the time, so I'm not sure why I'm running into issues with it. Anyone with Insights or comments would be appreciated. Thanks, Nate Burke

13 18

OOB
by harbor235 27 Jul '11

27 Jul '11

I am curious what is the best practice for OOB for a core infrastructure environment. Obviously, there is an OOB kit for customer managed devices via POTS, Ethernet, etc ... And there is OOB for core infrastructure typically a separate basic network that utilizes diverse carrier and diverse path when available. My question is, is it best practice to extend an inband VPN throughout for device management functions as well? And are all management services performed OOB, e.g network management, some monitoring, logging, authentication, flowdata, etc ..... If a management VPN is used is it also extended to managed customer devices? What else is can be done for remote management and troubleshooting capabilities? Mike

16 20

Re: dynamic or static IPv6 prefixes to residential customers
by Scott Weeks 27 Jul '11

27 Jul '11

------ jeroen(a)unfix.org wrote: ------- It of course all depends what the adversary is and what you are protecting against ;) -------------------------------------- Thanks for all the responses. It is (and has been for the last 14 years on nanog) the best way for me to learn. :-) I am only protecting against what I see as improper actions (bullying) by corpment drones. One can't hide everything, but it doesn't help the internet overall to make it easy for them to do these things. scott

1 0

Re: dynamic or static IPv6 prefixes to residential customers
by Scott Weeks 27 Jul '11

27 Jul '11

--- jeroen(a)unfix.org wrote: From: Jeroen Massar <jeroen(a)unfix.org> On 2011-07-27 03:25 , Scott Weeks wrote: > -------- matt.addison(a)lists.evilgeni.us wrote: --------------------- >> [..] 1: http://panopticlick.eff.org/ > > All you need to do with what that site says is write a sh script that > deletes and then creates the same user. And there you sprung into a trap. You will be the only one doing this and having no history and thus you stick out very well, as the new guy on the Internet every single day, from a similar prefix, but still accessing a similar set of hosts etc. I think I did a talk about that at CCC last year ;) ------------------------------------------------- Not from the same prefix. I have multiple networks coming into my house and I cycle through them. next... :-) Is there anything you can point me to on the talk? I'd be really interested in reading it. ----------------------------------------------------------------- You are blocking all the facebook/google+ like and the insane amount of advertisement (read: tracking) networks who are included on almost every page do you? As everytime you fetch a page, even if it is not the main site, you also hit them for an ad or a like-button (even if it is just the image and you don't actually click you hit their server) and voila you are tracked anyway. ----------------------------------------------------------------- I have never done facebook and I do very little google (mainly just Earth as nothing free can compete with it afaik) for just these reasons. See Urchin (http://www.google.com/urchin/features.html) and watch your browser for _utma, _utmb, etc cookies. And, yes, I block every cookie (except the few I want to allow) as the various browsers I use all are set to "ask me every time". The bad thing, though, is what they send 'back home'. I am curious and have been looking into that recently. scott Giving dynamic addresses out thus only still have one valid reason: nomadic users and the ability to aggregate prefixes inside a network. Because when users are static, you just route a /36 to a location and route prefixes out of that to the users and voila. When they are nomadic/mobile you don't want all those millions of /48s polluting your iBGP though. For every other case, dynamic addresses just make no sense, except for the cash cow that they are and that is the real reason that is the default being offered, as technically they cost more money. Greets, Jeroen

2 1

XO Contact
by Robert Haas 27 Jul '11

27 Jul '11

Can someone from XO contact me (or if someone has a contact within XO, I'd appreciate it). We are having reachability issues from our network 74.91.64.0/20 AS36243 to the XO network. Thanks, Robert Haas 573-293-2638

2 2

Re: dynamic or static IPv6 prefixes to residential customers
by Scott Weeks 27 Jul '11

27 Jul '11

--- Valdis.Kletnieks(a)vt.edu wrote: On Tue, 26 Jul 2011 18:25:30 PDT, Scott Weeks said: > (who's still bristling from the last discussion about this where Valdis kept > saying "Privacy is dead. Get used to it." Man, leave one smiley off and it follows you for life. ;) ------------------------------------------------- Ok, I'll do my best to remember that. Also, I should've had a smiley at the end of my ps... :-) scott

1 0

Re: dynamic or static IPv6 prefixes to residential customers
by Scott Weeks 27 Jul '11

27 Jul '11

-------- matt.addison(a)lists.evilgeni.us wrote: --------------------- On Jul 26, 2011, at 20:08, Valdis.Kletnieks(a)vt.edu wrote: > There's a subtle but significant difference between what cookies give you, > which is "This is the same entity that visited our page at 7:48PM last > Tuesday", and what easily trackable IP addresses give you, which is "This is an > entity located at 1948 Durhof Street". With how much identifying information user agents leak nowadays [1] this is almost a moot point. If you can be uniquely identified through the user agent- does it really matter that they can uniquely ID the household as well based on prefix information? 1: http://panopticlick.eff.org/ ------------------------------------------------------------------- All you need to do with what that site says is write a sh script that deletes and then creates the same user. Stick it in a crontab. Your browser ID changes each time. In addition to browser cookies, be sure to manage your flash cookies... http://www.macromedia.com/support/documentation/en/flashplayer/help/setting… So, force the DHCP server to give you new addresses (in IPv4; don't know about IPv6, yet), manage your cookies, change your browser IDs regularly. What did I miss? ;-) scott (who's still bristling from the last discussion about this where Valdis kept saying "Privacy is dead. Get used to it." I don't want to roll over and just take it... >;-) )

3 2

"L3DSR -- Overcoming Layer 2 Limitations of Direct Server Return Load Balancing" Video?
by Matt Hite 27 Jul '11

27 Jul '11

Might someone have the video for this presentation in their personal stash? http://www.nanog.org/meetings/nanog51/presentations/Monday/NANOG51.Talk45.n… http://www.nanog.org/meetings/nanog51/abstracts.php?pt=MTc1MyZuYW5vZzUx&nm=… It would be much appreciated! -M

2 3

Google corporate network - could someone please help me?
by Andrei Ivanov 27 Jul '11

27 Jul '11

Good day, everyone! There is a web site, and thousands of users are visiting it every day. Some web users, connected to a number of corporate networks, are getting results that are not consistent with other users' experiences. One of these corporate networks is Google. Could someone from Google, who would be willing to help with troubleshooting, contact me off-list? Thank you. -- andrei

1 0