Re: Question about the use of NO_EXPORT in BGP route announcements

2024-09-20 Thread Justin Krejci
Right. Just because someone with whom you have an eBGP connection established is also a transit provider doesn't mean you have to or even want to make use of transiting into other networks across that connection. We've done exactly this to avoid trombone routing to get to a set of customers. -

Re: charging for config changess

2024-07-02 Thread Justin Krejci
Reminds me of some colo providers that charge you to cancel a service. Want to disconnect a cross connect? *bam* $250, or some such obscene amount. -Original Message- From: Aaron C. de Bruyn via NANOG mailto:%22aaron%20c.%20de%20bruyn%20via%20nanog%22%20%3cna...@nanog.org%3e>> Reply-To:

Re: [c-nsp] Firepower Threat Defense Geolocation DB

2024-03-27 Thread Justin Krejci via cisco-nsp
Also it doesn't hurt to otherwise advertise your 8805 geofeed as per: https://datatracker.ietf.org/doc/html/rfc9092 -Original Message- From: Hank Nussbacher via cisco-nsp mailto:hank%20nussbacher%20via%20cisco-nsp%20%3ccisco-...@puck.nether.net%3e>> Reply-To: Hank Nussbacher mailto:hank

Re: Verizon Business Contact

2024-02-19 Thread Justin Krejci
told "your ISP needs to set the correct bits in the IP packets to designate the traffic as coming from the correct geography." I laughed and I cried at that one. -Original Message- From: Richard Laager mailto:richard%20laager%20%3crlaa...@wiktel.com%3e>> To: Justin

Re: Verizon Business Contact

2024-02-09 Thread Justin Krejci
For a good long while (months) we have had similar issues with various Verizon destinations. I observed it only happens when passing through certain geographic regions of the US. Other regions make it through without issue. This is directly observable and repeatable using Cogent's Looking glass

Re: Sling TV Geolocation

2024-01-26 Thread Justin Krejci
I have Digital Element in my own internal wiki page for managing/documenting IP geolocation services headaches. Searching them up on my page I see noted they have a contact us form that specifically lists "IP Address Data Update" as a contact reason. Maybe that will give you or others some aven

Re: [mailop] SOLVED Verizon text to email on vtext.com - connection refused error

2024-01-02 Thread Justin Krejci via mailop
024 12:45:47 -0500 On Tue, 2024-01-02 at 17:32 +, Justin Krejci via mailop wrote: When a Verizon mobile user sends a text to an email recipient, I understand it goes through some mail gateway system that converts the message to a standard email and I think uses the @vtext.com as the se

[mailop] Verizon text to email on vtext.com - connection refused error

2024-01-02 Thread Justin Krejci via mailop
: Connection refused Thank you for any assistance! -- Justin Krejci Network Engineer 952.253.3200 12450 Wayzata Blvd. Suite 320 | Minnetonka, MN 55305 [1616694896307] ___ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop

Re: ipv6 address management - documentation

2023-11-20 Thread Justin Krejci
I give +1 for phpipam -Original Message- From: Justin Wilson (Lists) mailto:%22justin%20wilson%20%28lists%29%22%20%3cli...@mtin.net%3e>> To: NANOG mailto:nanog%20%3cna...@nanog.org%3e>> Subject: Re: ipv6 address management - documentation Date: Sun, 19 Nov 2023 23:38:28 -0500 Netbox or

Re: Akamai Network Partnership

2023-10-17 Thread Justin Krejci
Hello Edy, Log into your peeringdb.com account and go to their network, they have a peering contact listed there. https://www.peeringdb.com/net/2 From: NANOG on behalf of em...@edylie.net Sent: Tuesday, October 17, 2023 5:10 PM To: nanog@nanog.org Subject

Prize Picks - gelocation/vpn/fraud system

2023-09-11 Thread Justin Krejci
contact to resolve an issue that the regular support channel is unable to do. Thanks! Justin Krejci

Re: [Kea-users] Stork Agent install via bash script

2023-09-11 Thread Justin Krejci
Yeah, you probably should take this to the Stork list but I believe the Stork server auto generates the contents of the .sh script, filling its own server address and the Stork agent package version details dynamically. Here is what mine looks like after downloading from my Stork server, replaci

Contact for androidpolice.com

2023-02-03 Thread Justin Krejci
Any contacts available that are responsible for androidpolice.com website hosting? Some of our IP space is not able to access their website. Other IP addresses of ours are working just fine. This appears to be some kind HTTP protocol layer issue but only affecting certain IP addresses. I am gues

Re: DNS Cookies Causing FORMERR

2023-01-16 Thread Justin Krejci
. From: Mark Andrews Sent: Friday, January 6, 2023 2:57 PM To: Justin Krejci Cc: bind-users@lists.isc.org Subject: Re: DNS Cookies Causing FORMERR Really there are very few servers that are broken and the numbers are decreasing. They are well under 1%. Just contact the

DNS Cookies Causing FORMERR

2023-01-06 Thread Justin Krejci
DNS Servers that do not properly support or properly ignore DNS cookies and instead return FORMERR is annoying. This is not new. However I have been seeing more or perhaps just have more users that are finding more domains that are hosted on authoritative servers with this unfortunate behavior.

Re: FIDO2/Passkey now supported for 2FA for ARIN Online (was: Fwd: [arin-announce] New Features Added to ARIN Online)

2023-01-03 Thread Justin Krejci
Very interesting news. Improving online security is a win and this sounds promising. Never having used FIDO2 for anything I am left, probably not uniquely, in the dark for hardware device support. The only link I found on the ARIN website for "hardware keys" was a link to another ARIN page, wh

Re: Sigh, friends don't let politicians write tech laws

2022-07-29 Thread Justin Krejci
Leave the private matter of private email handling in the hands of the private participants of the private email system. If congress wants to create a government mandate on political campaign emails, the political campaigns themselves ought to be forced to mark their emails as a political campa

Re: Disney+ Issues

2022-04-29 Thread Justin Krejci
I'd suggest you reach out to hosting company and have them mark the block(s) in question as re-allocated to your organization. Also Neustar does support self-published geofeeds so you could also publish your own + leased IP space and them get them to subscribe to your list. __

Re: Geolocation data management practices?

2022-04-21 Thread Justin Krejci
For corrections/updates, what I have found to be generally successful is 1. make sure to advertise the IP blocks into the DFZ from your ASN as soon as possible 2. make sure ARIN data is accurate (we use ARIN, you may use one of the other registries) 3. update my geofeed, as referenced already

[outages] Ping to Google 8.8.8.8

2022-02-08 Thread Justin Krejci via Outages
Seeing some hosts and not others get no reply to ICMP pings from the Minneapolis, MN area. I checked using HE's looking glass, 1 of their 2 Minneapolis routers gets no replies. Since many use and assume 8.8.8.8 is invincible, this has now started setting off monitoring alerts. DNS queries so fa

Telia is now Arelion

2022-01-19 Thread Justin Krejci
https://www.arelion.com/ Since all other work is now complete in the world I should have plenty of time to update documentation, billing, labels, port names, route-maps, contact email addresses, etc. After watching their marketing video I learned the pronunciation of Arelion is not R-Lion

Re: The great Netflix vpn debacle! (geofeeds)

2021-09-01 Thread Justin Krejci
Well apparently there are VPN applications that rely on fellow VPN users in a P2P fashion to share network connectivity. I guess it is like a commercialized version of Tor to some extent. Excluding any potential legal risks for illegal behavior tunneled through an unsuspecting fellow user, this

Re: The great Netflix vpn debacle!

2021-08-27 Thread Justin Krejci
+1 on Bryan's message. TL;DR It seems lots of ISPs are struggling to figure out the why and the where of many IP addresses or blocks that are suddenly being blacklisted or flagged as VPNs or as out of service area. I would really love to find, as Bryan said, if there is one particular IP

Venmo - Geolocation Challenges

2020-04-23 Thread Justin Krejci
appreciated. I don't mind working with any organization to straighten out any stale data, I just need some assistance getting to someone who has the info or access. Thanks!! Justin Krejci

NFL Sunday Ticket - Online Streaming service

2019-12-10 Thread Justin Krejci
I am looking for a contact in the network group (may be called National Escalation team or NatEsc team internally) within AT&T/DirecTV pertaining to the NFL Sunday Ticket online streaming service. I have been attempting to work through their normal support process for quite some time, they are e

Disney+ Streaming

2019-11-12 Thread Justin Krejci
I see the Disney service went live today, with some load issues according to various news reports and down detector. Is it well known where the newly released Disney+ streaming service content is sourced? Are they using their own servers on AS22604 or using one or more of the established CDNs? O

RE: New ASN Assignments in ARIN

2017-03-23 Thread Justin Krejci
Last few new ASN additions ARIN has issued: Add AS396022 Add AS396023 Add AS396024 Add AS396025 Add AS396026 Add AS396027 ARIN has a daily mailing list where they indicate all of their newly updated number resource registrations. http://lists.arin.net/pipermail/arin-issued/ _

RE: BGP Route Reflector - Route Server, Router, etc

2017-01-13 Thread Justin Krejci
at 08:32:44PM +, Justin Krejci wrote: > I am working on some network designs and am adding some additional routers to > a BGP network. I'd like to build a plan of changing all of the existing > routers over from full iBGP mesh to something more scalable (ie route > reflecti

BGP Route Reflector - Route Server, Router, etc

2017-01-12 Thread Justin Krejci
Nanog, I am working on some network designs and am adding some additional routers to a BGP network. I'd like to build a plan of changing all of the existing routers over from full iBGP mesh to something more scalable (ie route reflection). Fortunately, I am also going to be able to decommission

Re: [c-nsp] Cisco distribute-list configs

2016-10-28 Thread Justin Krejci
ht around zero experience implementing distribute-lists, I find this discussion informative. Thanks for the input everyone! From: Mark Tinka [mark.ti...@seacom.mu] Sent: Friday, October 28, 2016 2:17 AM To: Justin Krejci; Nick Cutting; Jared Mauch Cc: cisco-nsp@pu

[c-nsp] Cisco distribute-list configs

2016-10-27 Thread Justin Krejci
etworkworld.com/article/3128104/lan-wan/level-3-blames-huge-network-outage-on-unspecified-configuration-error.html Just curious and playing devils advocate :) From: Mark Tinka [mark.ti...@seacom.mu] Sent: Thursday, October 27, 2016 4:13 PM To: Justin Krejci; Nick Cut

Re: [c-nsp] Router memory problem

2016-10-27 Thread Justin Krejci
: Nick Cutting [ncutt...@edgetg.com] Sent: Thursday, October 27, 2016 1:54 PM To: Jared Mauch; Justin Krejci Cc: cisco-nsp@puck.nether.net Subject: RE: [c-nsp] Router memory problem We had a case where we used distribute lists matching prefix lists, but some engineers were forgetting the keyword

Re: [c-nsp] Router memory problem

2016-10-27 Thread Justin Krejci
What is wrong with distribute-lists? From: cisco-nsp [cisco-nsp-boun...@puck.nether.net] on behalf of Mark Tinka [mark.ti...@seacom.mu] Sent: Thursday, October 27, 2016 12:42 AM To: Joseph Mays; Chris Boyd; cisco-nsp@puck.nether.net Subject: Re: [c-nsp] Ro

Re: [outages] Dyn outage continuing

2016-10-21 Thread Justin Krejci via Outages
Previously it was not affecting upper midwest for me, traces went to Chicago. Now traces to twitter DNS servers in Chicago are failing. From: Neil Hanlon via Outages [outages@outages.org] Sent: Friday, October 21, 2016 11:16 AM To: Terry Hardie; outages@outages.o

RE: Krebs on Security booted off Akamai network after DDoS attack proves pricey

2016-09-23 Thread Justin Krejci
If you read the article, it is made clear he was "kicked off" of a free service being provided. He was not a paying customer of Akamai and does not fault Akamai for their decision. From: Grant Ridder [shortdudey...@gmail.com] Sent: Friday, September 23,

RE: Anyone with a clue at Zayo?

2016-09-16 Thread Justin Krejci
Might help if you indicate type of service as they have lots of services covered by different groups: IP transit, wave, dark fiber, voip, Colo, etc. Their Enterprise division does yet other services. Might also help if you provide at least a general location/region. -Original Message-

Re: [c-nsp] DHCP Snooping and tracking down rogue dhcp servers

2016-06-09 Thread Justin Krejci
I might guess it is the 3750's own DHCP server packet that is being looped back to itself, perhaps by one of the downstream customer connections, and thus identifies a "rogue" dhcp server that is actually itself. If it is actually a rogue DHCP server, is that a problem? Seems like that log mess

Equipment Supporting 2.5gbps and 5gbps

2016-01-27 Thread Justin Krejci
I've a couple 10 port Cisco switches that support 2.5 and 5gbps over cat5e, just wondering if there are any other vendors out there with offerings that support these newer ethernet speeds. Supporting cat5e for these multi-gig speeds is a real boon in many circumstances given the wide popularity

Re: [outages] Packet Loss in Chicago

2015-11-13 Thread Justin Krejci via Outages
I've now received a limited response indicating it was an excessive traffic issue this morning and that they've resolved the problem. From: Outages [outages-boun...@outages.org] on behalf of Justin Krejci via Outages [outages@outages.org] Sent: Friday

Re: [outages] Packet Loss in Chicago

2015-11-13 Thread Justin Krejci via Outages
Thanks to those that replied with additional data. With additional data, it appears likely it was actually a Cogent related issue, still waiting on a response from Cogent though. From: Outages [outages-boun...@outages.org] on behalf of Justin Krejci via

[outages] Packet Loss in Chicago

2015-11-13 Thread Justin Krejci via Outages
We observed around 45 minutes of packet loss (30% or more) in Chicago this morning (9:30-10:15 am central), possibly involving XO. The packet loss showed up across multiple mtr's out multiple carriers but all seemed to involve XO in Chicago. I am wondering if anyone else had seen similar issues

Re: Configuring DHCP for multiple interfaces

2015-03-29 Thread Justin Krejci
Based solely on the error message you provided in your original post I would say assigning two or more network interfaces on the same subnet at the same time is the problem. It is not that they are both getting the same IP address but different IP addresses on the same subnet. If you want to do

Comcast Static IP Changed With New Modem?

2015-02-09 Thread Justin Krejci
Has anyone run into the situation where their static IP address from Comcast (on the business class cable modem Internet service) was changed when the modem was replaced? We have a remote site that uses Comcast as a backup Internet connection and when we went to use it recently our VPN tunnel w

RE: Belkin Router issues this morning?

2014-10-07 Thread Justin Krejci
https://twitter.com/search?q=%23belkin Sounds like a bad firmware update most likely. Presumably the Belkin routers perform caching DNS for the LAN clients for if the LAN clients use alternate DNS servers (OpenDNS, Google, your ISPs, etc) there are no longer any issues for those devices, as repo

Re: [c-nsp] Cisco 4900M and Layer2 Broadcasts

2014-06-28 Thread Justin Krejci
Is the layer 3 traffic multicast? Your indication of HA makes me suspect it is and perhaps you have a multicast snooping/filtering on the Cisco or some other related limiter setting. Just a total guess without any configs or other pertinent data. -Original Message- From: Ivan [cisco-.

RE: Reaching google.com using Chrome

2014-01-13 Thread Justin Krejci
Also when troubleshooting HTTP connectivity in general but can be really help when dealing with a transition from IPv4 to IPv6 if you install the browser extension IPvFoo for Chrome (IPvFox for Firefox) it can take out a significantly complicated step in the troubleshooting process as it easily

Re: [c-nsp] 6509 "switchport block unicast" wrongly filtering ARP broadcasts (RESOLVED)

2013-11-12 Thread Justin Krejci
t in the same way as "no switchport block unicast" does as well. Seems like a bizarre and unfortunate problem but at least there it can be made to work. Thanks again! From: Dale W. Carder [dwcar...@wisc.edu] Sent: Thursday, November 07, 201

Re: [c-nsp] 6509 "switchport block unicast" wrongly filtering ARP broadcasts

2013-11-07 Thread Justin Krejci
port block unicast" should only filter out unicast packets that it wants to flood, not broadcast packets that it wants to flood. -Original Message----- From: Justin Krejci [jkre...@usinternet.com] Received: Wednesday, 06 Nov 2013, 4:01pm To: cisco-nsp@puck.nether.net [cisco-nsp@

[c-nsp] 6509 "switchport block unicast" wrongly filtering ARP broadcasts

2013-11-06 Thread Justin Krejci
I have a relatively simple hardware configuration and topology 6509-E (tried on 2 different units) Sup720 (also tried Sup720-3B) WS-6548-GE-TX WS-6748-GE-TX IOS Version 12.2(33)SXI6 int g1/1 switchport switchport access vlan 900 switchport mode access switchport block multicast switchport

Re: [arin-ppml] Initial ISP Allocation Policy

2013-07-17 Thread Justin Krejci
Here is my newbie and possibly naive response. Without additional details on individual cases in the list, I would expect all of those cases to be "end-users" as none of them are in the business of reallocating address blocks. Right or wrong I've always been under the impression this to be the

Re: samsung s3

2013-06-23 Thread Justin Krejci
Plus one for airdroid which has other useful functionality as well.  Original message From: Mike Erdely Date: To: Bryan Cc: openbsd-newbies Subject: Re: samsung s3 This or AirDroid.  It turns your phone into a webserver and allows you to transfer files over wifi. The

Re: [c-nsp] 10gig Link Bouncing Consistently (solved?)

2013-04-07 Thread Justin Krejci
illiard [n...@foobar.org] Received: Thursday, 04 Apr 2013, 8:41am To: cisco-nsp@puck.nether.net [cisco-nsp@puck.nether.net] Subject: Re: [c-nsp] 10gig Link Bouncing Consistently On 04/04/2013 00:03, Justin Krejci wrote: > Unfortunately SR/MMF transceivers have no DOM support. I'd better RMA

Re: [c-nsp] 10gig Link Bouncing Consistently

2013-04-03 Thread Justin Krejci
Netgear SPF+ transceivers: AXM761 Thanks!! From: Justin Krejci Sent: Wednesday, April 03, 2013 5:56 PM To: Justin M. Streiner; cisco-nsp Subject: RE: [c-nsp] 10gig Link Bouncing Consistently This is what I've got 1. Optics in Cisco are vanilla

Re: [c-nsp] 10gig Link Bouncing Consistently

2013-04-03 Thread Justin Krejci
cisco-nsp-boun...@puck.nether.net] on behalf of Justin M. Streiner [strei...@cluebyfour.org] Sent: Tuesday, April 02, 2013 7:44 PM To: cisco-nsp Subject: Re: [c-nsp] 10gig Link Bouncing Consistently On Tue, 2 Apr 2013, Justin Krejci wrote: 1. What types of optics are being used on these links? 2.

Re: [c-nsp] 10gig Link Bouncing Consistently

2013-04-03 Thread Justin Krejci
Unfortunately SR/MMF transceivers have no DOM support. We'll definitely get some fiber power meter tests ran during "the problem" time @ 850nm Physical inspection has been completed already as well. No obvious places where there would be any sort of environmental impact and no current signs of

[c-nsp] 10gig Link Bouncing Consistently

2013-04-02 Thread Justin Krejci
Cisco NSP, The Basics: We've a customer with two separate 10gig links to a pair of our 6509-E's. Both of our 6509-E's have dual Sup720-3BXL and the 6704-10GE line cards. Link 1: 6509 Router#1 routed port to Netgear#1. IPv4 only. Multimode fiber Link 2: 6509 Router#2 routed port to Netgear#2. IP

Re: Issues encountered with assigning .0 and .255 as usable addresses?

2012-10-22 Thread Justin Krejci
And since owen has not yet mentioned it, consider something that supports having : in its address as well.  Sort of tangentially related, I had a support rep for a vendor once tell me that a 255 in the second or third octet was not valid for an ipv4 address. Hard to troubleshoot a problem when

Re: [c-nsp] cable/dsl/ftth policing, traffic shaping or something else??

2012-06-19 Thread Justin Krejci
CTS and ZyXEL both make AE residential FTTH products with individual ingress/egress rate limiting on all ports. ZyXEL also has DSL products too though beyond the DSL train rate I am not sure if you can do further rate limiting on the LAN Ethernet ports or wifi where available. Also various pack

Re: Cogent for ISP bandwidth

2012-05-15 Thread Justin Krejci
+1 for cogent, problem free and good responsive support. Not sure why "don't use only 1 upstream if you care about accessibility" has anything to do with cogent specifically. Are peering/de-peering disputes more likely to occur than all other network/routing issues combined? its just another po

[c-nsp] Trunking Private VLANs on 6509

2012-03-01 Thread Justin Krejci
I am trying to trunk private vlans from a Cisco 6509 to some other switches. There does not appear to be a way to do this but it works great on a Cisco 4948. Does the 6509 not support doing this or is there something else needed to make this work? Here is some sample config. Cisco 49

Re: enterprise 802.11

2012-01-15 Thread Justin Krejci
No one has mentioned Belair yet? Serves the Minneapolis network pretty well. http://www.belairnetworks.com/ -Original Message- From: Greg Ihnen Date: Sun, 15 Jan 2012 19:06:26 To: Nathan Eisenberg Cc: nanog@nanog.org Subject: Re: enterprise 802.11 Since we're already top-posting… I'

Re: accessing multiple devices via a script

2012-01-15 Thread Justin Krejci
Parallel ssh (pssh) might help you too --Original Message-- From: Abdullah Al-Malki To: nanog@nanog.org Subject: accessing multiple devices via a script Sent: Jan 15, 2012 11:52 AM Hi fellows, I am supporting a big service provider and sometimes I face this problem. Sometimes I want to a

Re: [c-nsp] Can ASA support 2 WAN connections?

2011-11-23 Thread Justin Krejci
ASA should be able to do OSPF (maybe dual static routes?) to support load balancing though I've only ever used OSPF on a pix and then only for ease of populating routing tables on the network and not for load balancing. To do load sharing this way I imagine you'd also have to disable state track

[c-nsp] BGP neighbor with more specific prefixes

2011-09-13 Thread Justin Krejci
Cisco Folks, Internet Transit Providers Provider 1 Provider 2 Provider 3 Provider 4 We have aggregated prefixes (/19's, /18's etc) currently advertised to providers 1-3 on a single router. We are bringing on provider 4 but want to advertise only a few individual /24's within those aggregated pref

Re: [c-nsp] Cisco 7600 Power Supply Compatibility

2011-06-27 Thread Justin Krejci
Posting for list archival purposes as as previously I replied to sender only. The answer to your question and more is here 7600 http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SR/configuration/guide/pwr_envr.html excerpt: Note Installed power supplies in a system can be of different wattage

Re: [Dovecot] IMAP vs. POP3

2011-04-29 Thread Justin Krejci
On Thu, 2011-04-28 at 19:54 +0200, Stéphane Guedon wrote: > On Thursday 28 April 2011 19:31:49 Matt wrote: > > Does IMAP create much additional system load vs. POP3? > If you do use IMAP, server disk space capacity can become an important number to watch as most POP3 clients by default will del

Re: SOA RNAME Value

2011-04-18 Thread Justin Krejci
I do not understand why I did not get similar test and log results as you indicate below but I appreciate your feedback! Thank you!! On Thu, 2011-04-14 at 17:39 +0100, Tony Finch wrote: > Justin Krejci wrote: > > > > So I am wondering if this is normal/expected behavior for

Re: SOA RNAME Value

2011-04-14 Thread Justin Krejci
er.domain.com." instead BIND serves the records as expected. So I am wondering if this is normal/expected behavior for BIND and if so should debug logging or named-checkzone with debugging be able to identify this as the problem. Or am I missing something else altogether? Thank On Wed,

SOA RNAME Value

2011-04-13 Thread Justin Krejci
Hello List, When troubleshooting a particular reverse delegated zone to us we used the normal "d/26.c.b.a.in-addr.arpa" naming for the zone. A couple of zones did not get served correctly (tried on BIND 9.7.0-P2 and 9.7.3) and any query for a record within these zones always came back with a SERVF

Re: estimation of number of DFZ IPv4 routes at peak in the future

2011-03-11 Thread Justin Krejci
On Wed, 2011-03-09 at 09:32 -0500, John Curran wrote: > On Mar 9, 2011, at 12:43 AM, Majdi S. Abbas wrote: > > On Wed, Mar 09, 2011 at 12:44:05PM +0900, Randy Bush wrote: > >> i am more of a pessimist. i suspect that there will be enough v4-only > >> destinations out there that multi-homed enter

Re: BIND servfail from caching server

2011-03-04 Thread Justin Krejci
you own supernet.com, this problem is not your fault and not for you > to fix. You can work around it with conditional forwarding, or a zone of type > static-stub if you're using BIND 9.8 already, but that's strictly a > workaround and subject to breakage if the zone is moved.

Re: BIND servfail from caching server

2011-03-03 Thread Justin Krejci
SERVFAIL response comes back in <2 ms according to dig. On Thu, 2011-03-03 at 16:29 -0600, Justin Krejci wrote: > When doing a recursive query for MX supernet.com against a caching BIND > server, the BIND server responds back with the answer. The TTL is 300. > > After the TTL expire

BIND servfail from caching server

2011-03-03 Thread Justin Krejci
When doing a recursive query for MX supernet.com against a caching BIND server, the BIND server responds back with the answer. The TTL is 300. After the TTL expires the following recursive query for the same record returns a SERVFAIL from the caching server. If I do a +trace on the same query to

Re: [c-nsp] 6509 IPv6 OSPF Auth

2011-02-18 Thread Justin Krejci
On Fri, 2011-02-18 at 17:30 +, Nick Hilliard wrote: > On 18/02/2011 17:23, Oliver Boehmer (oboehmer) wrote: > > surry, but we don't have OSPF authentication for IPv6 (using IPSec) on > > the 6500 right now. can you please speak with your partner/account team > > about roadmap/plans for this f

[c-nsp] 6509 IPv6 OSPF Auth

2011-02-18 Thread Justin Krejci
I have IPv6 OSPF auth enabled on routers running 12.4 but I cannot find anywhere that IPv6 OSPF Auth is supported on the 6509 SXI3 code either in the CLI or documentation. Is there support for this? I spent several hours searching cisco docs and googing around but found nothing. Is it supported in

OpenBSD FTW?

2011-02-14 Thread Justin Krejci
Just released BIND 9.8.0 RC1, ChangeLog snip * A bug in NetBSD and FreeBSD kernels with SO_ACCEPTFILTER enabled allows for a TCP DoS attack. Until there is a kernel fix, ISC is disabling SO_ACCEPTFILTER support in BIND. [RT #22589] Is this another case of OpenBSD doing the right th

[c-nsp] SVI MTU on 6509

2011-01-12 Thread Justin Krejci
Specs 6509 Sup720-3bxl 6748-ge (cfc) 12.2(33)SXI3 What is the difference between the following as I note they have different minimums by 4 bytes? It looks if i set the "svi interface mtu" the IP MTU is increased as well which I am guessing cannot (or should not) be lower than the "svi interface" m

Re: [c-nsp] terminal server suggestions?

2011-01-04 Thread Justin Krejci
To add on to Vincent's suggestion, ser2net works great for this type of application. I have 2 usb-to-serial adapters I use regularly on my laptop. Then I can either work directly off my laptop or connect remotely with telnet to the ser2net app (optionally tunneled over ssh) from anywhere I choose.

Re: [c-nsp] Best practices for Cat6500

2010-11-01 Thread Justin Krejci
With regards to SSO-NSF and HSRP I've read documents on ciscos site that conflict when discussing the use of NSF. One indicates do not use HSRP and NSF together on the same box. http://www.cisco.com/en/US/docs/ios/12_2s/feature/guide/fsnsf20s.html#wp1467556 http://www.cisco.com/en/US/customer/doc

Re: [c-nsp] Network mapping...again

2010-08-13 Thread Justin Krejci
Very expensive but NetMRI has this functionality and does a good job mapping out the VLANs, route hops, switch hops, etc. It does a ton of other things too like change management, alerting, etc. The product is quite powerful but as I said it is also expensive. To setup the free trial I, using catt

Re: [Dovecot] Feature request: usernames and passwords

2010-07-21 Thread Justin Krejci
Check out splunk (or similar) for multiple disparate event log correlations. -Original Message- From: dovecot-bounces+jkrejci=usinternet@dovecot.org [mailto:dovecot-bounces+jkrejci=usinternet@dovecot.org] On Behalf Of Chris Hoogendyk Sent: Wednesday, July 21, 2010 10:19 AM To: Dove

Re: [Dovecot] basic conf error? v1.2.11

2010-06-17 Thread Justin Krejci
] basic conf error? v1.2.11 On 06/17/2010 03:27 PM Justin Krejci wrote: > . > auth_username_chars = > abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@/$!&\ > . > > Any ideas what is wrong here? It seems like the example conf file is not > correct. Yes the dov

[Dovecot] basic conf error? v1.2.11

2010-06-17 Thread Justin Krejci
I just downloaded 1.2.11 and compiled from source including mysql support and using default directory locations. I walked thru the included example conf file and tweaked it out and get an invalid configuration file. I trimmed out all of the commented sections to make the non-default config sup

Re: sendmail-postfix question

2010-06-15 Thread Justin Krejci
In general I prefer postfix over sendmail but in your case I would think sendmail would be easier as its already installed and likely will work for sending mail by default from local users such as yours. If you intend to host mail and receive incoming connections from the internet for delivery t

Re: [Dovecot] A dovecot book ?

2010-03-03 Thread Justin Krejci
Just print all of the dovecot documentation from the website, 3-hole punch them, stick them in a 3-ring folder and voila, a Dovecot book that has pretty current information. Kidding aside I find digital better in general as doing find is utterly important to me. When reading technical books in pri

RE: dns interceptors

2010-02-18 Thread Justin Krejci
While not covering all apps you may want to use, it does work for at least Firefox when web browsing (works on non-windows too) when using an ssh socks proxy Go to the address about:config filter for "dns" toggle "network.proxy.socks_remote_dns" to "true" and then firefox will send its own DNS q

Re: [Dovecot] virtual users with mysql

2010-01-28 Thread Justin Krejci
We use mysql auth and support username or usern...@domain.com for logins. Perhaps you just need to edit the auth_username_chars variable in the dovecot config to allow @ symbol in usernames? -Original Message- From: dovecot-bounces+jkrejci=usinternet@dovecot.org [mailto:dovecot-bounce

Re: [Dovecot] pop3+leave messages on server

2009-12-29 Thread Justin Krejci
Not to pick nits but pop3+leave on server does not mean you have all message from the dawn of time stored on the server. Outlook and presumably other MUAs have "remove from server after X time" and "remove from server when message is deleted" options when leaving pop3 messages on the server is enab

RE: Restricting source with dDNS (dynamic DNS)

2009-12-19 Thread Justin Krejci
Of Alvaro Mantilla Gimenez Sent: Saturday, December 19, 2009 12:28 PM To: Justin Krejci Cc: 'Karl O. Pinc'; pf@benzedrine.cx Subject: RE: Restricting source with dDNS (dynamic DNS) On Sat, 2009-12-19 at 06:05 -0600, Justin Krejci wrote: > While also not what the OP specifically request

RE: Restricting source with dDNS (dynamic DNS)

2009-12-19 Thread Justin Krejci
While also not what the OP specifically requested but a good option to consider in general is to use the overload option to allow PF to dynamically add abusing IPs to a table which is then blocked from ssh access. This is more for frequent TCP connections on port 22 (or any other) for brute force t

Re: [c-nsp] Smartnet pricing?

2009-09-28 Thread Justin Krejci
Replace (upgrade?) the hardware and get a new contract? Then you have a spare too. -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Jared Mauch Sent: Monday, September 28, 2009 4:11 PM To: Matthew Huff Cc: 'Cisco-NSP Mailing

RE: cisco.com

2009-08-04 Thread Justin Krejci
The IP is back in BGP and the website is working for me now.

Re: [Dovecot] E-Mail Encryption

2009-07-16 Thread Justin Krejci
Some companies and governments in the United States at least have very strict policy requirements regarding various aspects of security and encryption. Transit encryption (ssl/tls from MTA to MTA) and local encryption of messages sometimes is a requirement if you want to be able to bid on governmen

Re: [c-nsp] ASA ssh difficulties

2009-07-14 Thread Justin Krejci
If you provide your aaa configuration we might be able to assist like the output from these commands (assuming you have console access) show run aaa show run aaa-server I am not very familiar with ASDM so I don't know where the aaa config lives in ASDM but certainly you'll want to look around in

H3C Switches/Routers

2009-07-13 Thread Justin Krejci
, Justin Krejci

Re: [c-nsp] Netflow Collector shows minimal bandwidth from 6509

2009-07-06 Thread Justin Krejci
ject: Re: [c-nsp] Netflow Collector shows minimal bandwidth from 6509 -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, On Monday 06 July 2009 16:01:42 Justin Krejci wrote: > > > interface GigabitEthernet5/1 > > ip flow ingress > > ip flow egress ...ip flow egress will only catch t

[c-nsp] Netflow Collector shows minimal bandwidth from 6509

2009-07-06 Thread Justin Krejci
w int g5/1 | inc 30 second 30 second input rate 102688000 bits/sec, 18410 packets/sec 30 second output rate 136059000 bits/sec, 30058 packets/sec Sincerely and thanks, Justin Krejci ___ cisco-nsp mailing list cisco-nsp@puck.nether

Re: [c-nsp] LX vs LH Transceivers

2009-06-16 Thread Justin Krejci
ecked with them again on their point about "LX to LH are not compatible" to make sure they didn't hear "LH to SX" or something like that. Thanks for the tips everyone. -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.net

Re: [c-nsp] LX vs LH Transceivers

2009-06-15 Thread Justin Krejci
)#me Also I did not try the "speed nonegotiate" option, I will definitely have to try that. Thanks! -Original Message- From: dale.s...@gmail.com [mailto:dale.s...@gmail.com] On Behalf Of Dale Shaw Sent: Monday, June 15, 2009 6:57 PM To: Justin Krejci Cc: cisco-nsp@puck.nether.n

[c-nsp] LX vs LH Transceivers

2009-06-15 Thread Justin Krejci
l "LX" SFP for this circuit or figure something else out. Thanks! Justin Krejci ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/

  1   2   >