| ↑back Search ←Prev date Next date→ Show only urls | (Click on time to select a line by its url) |
| Who | What | When |
|---|---|---|
| *** | gizmoguy has quit IRC (Ping timeout: 245 seconds)
gizmoguy has joined #arpnetworks Hien has quit IRC (Ping timeout: 264 seconds) solj has quit IRC (Ping timeout: 264 seconds) phlux has quit IRC (Ping timeout: 264 seconds) staticsafe-znc has quit IRC (Ping timeout: 264 seconds) SpeedBus has quit IRC (Ping timeout: 245 seconds) staticsafe-znc has joined #arpnetworks Hien has joined #arpnetworks gizmoguy has quit IRC (Ping timeout: 264 seconds) gizmoguy has joined #arpnetworks solj has joined #arpnetworks SpeedBus has joined #arpnetworks phlux has joined #arpnetworks SpeedBus has quit IRC (Ping timeout: 245 seconds) SpeedBus has joined #arpnetworks | [00:10] |
| .... (idle for 19mn) | ||
| robonerd has quit IRC (Read error: Connection reset by peer)
robonerd has joined #arpnetworks robonerd has quit IRC (Read error: Connection reset by peer) robonerd has joined #arpnetworks | [00:46] | |
| ..... (idle for 20mn) | ||
| LT has joined #arpnetworks | [01:12] | |
| ........ (idle for 36mn) | ||
| robonerd has quit IRC (Read error: Connection reset by peer)
robonerd has joined #arpnetworks | [01:48] | |
| .......................... (idle for 2h6mn) | ||
| staticsafe-znc has quit IRC (Ping timeout: 265 seconds)
staticsafe has quit IRC (Ping timeout: 265 seconds) xales has quit IRC (Ping timeout: 246 seconds) staticsafe has joined #arpnetworks staticsafe-znc has joined #arpnetworks | [03:55] | |
| ........... (idle for 51mn) | ||
| up_the_irons | mnathani: no i mean VPS customers | [04:51] |
| ....................... (idle for 1h54mn) | ||
| m0unds | i tried it in a vps once, it works fine - alias configuration is a PITA vs freebsd or openbsd though | [06:45] |
| ......... (idle for 42mn) | ||
| *** | dj_goku_ has quit IRC (Ping timeout: 248 seconds) | [07:27] |
| .... (idle for 15mn) | ||
| mjp_ has quit IRC (Ping timeout: 265 seconds)
abthorpet has joined #arpnetworks mhoran1 has joined #arpnetworks ChanServ sets mode: +o mhoran1 [FBI] has quit IRC (Ping timeout: 265 seconds) [FBI] starts logging #arpnetworks at Thu Feb 13 07:44:23 2014 [FBI] has joined #arpnetworks mhoran has quit IRC (Ping timeout: 265 seconds) tabthorpe has quit IRC (Ping timeout: 265 seconds) | [07:42] | |
| .............. (idle for 1h9mn) | ||
| brycec | What do you mean? Clicking buttons in a GUI versus just typing it in pf.conf? 06:43:51 < m0unds> i tried it in a vps once, it works fine - alias configuration is a PITA vs freebsd or openbsd though
In which case, I'd say that writing rules is similarly PITA :p | [08:54] |
| m0unds | brycec: no, when i messed with it somewhat recently, interface aliases don't work the way i expected them to (the way they work in freebsd or openbsd) | [09:01] |
| brycec | Do you mean "interface groups" as they're termed in pfSense? | [09:02] |
| m0unds | the UI element does some weird stuff with aliases that wasn't clear
i don't remember, but it felt kinda counterproductive at any rate, i only looked because i hadn't used it since like 2007 | [09:02] |
| brycec | heh
Well I'm happy to say pfSense has come a long, long way in 7 years :p | [09:02] |
| m0unds | and the thing that seemed like it should be alises wasn't
well, they're still on teh same release tree and the ui has some awful 90s UX to it that they need to get rid of asap :P the notification thing at the top in teh default theme is awful s/teh/the | [09:03] |
| BryceBot | <m0unds> the notification thing at the top in the default theme is awful | [09:03] |
| m0unds | i looked at m0n0 last night because i hadn't used it since probably 2003, and they just moved up to freebsd 8.3 last month, haha | [09:04] |
| brycec | I don't think I follow what you mean by same release tree - were you expecting them to just scrap everything and start over?
Nice, they're catching up to pfSense | [09:04] |
| m0unds | no, they were working on "2.0" forever | [09:04] |
| brycec | IIRC that 8.3 is due to the NanoBSD base.
True, but 1.2.3 was stable up until ~2 years ago *stable/current That 2.0 was effectively a total rewrite | [09:04] |
| m0unds | yeah, so i guess it was 2 years ago that i messed with it, haha
because it was 1.2.3 (i still have the disk image on my kvm server at home) | [09:06] |
| brycec | "Version 1.0 of the software was released on October 4, 2006.[5] Version 2.0 was released on September 17, 2011,[6] with updates 2.0.1 to 2.0.3 between then and 2013, and version 2.1 was released on September 15, 2013."
Or you can peruse http://www.pfsense.org/about-pfsense/versions.html 1.2.3 released Dec 2009, 2.0.1 released Dec 2011 at least they're somewhat consistent | [09:07] |
| Good news, up_the_irons, ARP was not on the list of the top 24 networks http://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack
It didn't make the list at all! https://docs.google.com/spreadsheet/ccc?key=0AhuvvqAkGlindHFtS0pJa0lYZGNlLXNONWtlY01qanc&usp=sharing#gid=0 | [09:17] | |
| m0unds | actually, i did try it more recently - i was trying to figure out how i knew about the thing at the top. i tried it on my small arp vps after i migrated stuff to the bigger arp vps
i do have a 1.2.3 disk image locally though which i don't remember doing anything with at any rate, maybe it was a quirk with the vps having a single if or something, or i could just be remembering something that doesn't exist, hahaha haha, chinanet. go figure. | [09:30] |
| brycec | srsly
and ovh | [09:33] |
| m0unds | yeah
color me surprised | [09:33] |
| brycec | brycec colours in m0unds | [09:33] |
| m0unds | what color is surprised? | [09:33] |
| *** | LT has quit IRC (Quit: Leaving) | [09:34] |
| brycec | m0unds: mauve | [09:35] |
| m0unds | eeewwwww
at least it's not taupe or chartreuse | [09:35] |
| brycec | Oh sweet, I'm getting hit with buttloads of DNS queries... | [09:35] |
| m0unds | m0unds throws DNS queries at brycec | [09:35] |
| brycec | I'm guessing my own DOS reflection
an attack of my very own. On a cable modem. woo | [09:36] |
| m0unds | sweet | [09:36] |
| brycec | I wonder how this IP was choosen... I don't really use it for anything, and it's not in DNS anywhere | [09:36] |
| m0unds | are you connected to IRC w/it?
or bot connected from it or something? the only time i ever had a box get ddosed was when i was connected to a provider's IRC channel w/v4 address and some kid decided to start ddosing people connected to the channel | [09:37] |
| brycec | nope and nope
It's the external IP of a router, but all traffic goes out a different IP | [09:37] |
| m0unds | huh.
is the address SWIP'd to another business or something? | [09:38] |
| brycec | dun think so | [09:38] |
| m0unds | you must just be lucky | [09:39] |
| brycec | holy crap, TWC actually filled in the business information
(protip: always smart to whois your own addresses once in awhile) ANY? . that's the query whee brycec wonders who to complain at | [09:39] |
| hazardous | this is probably odd question but does arp ratelimit dns or anything | [09:45] |
| brycec | UDP inbound as I recall
to 5mbps | [09:45] |
| hazardous | $ time host lightning.net >/dev/null
real 0m8.197s $ time host nac.net >/dev/null real 0m2.327s | [09:46] |
| brycec | ouch
real 0m0.946s | [09:46] |
| hazardous | using the official arp resolvers, and i don't get this kind of response time elsewhere even hitting the same authoritative ns
close to 1 second seems incredibly weird/bad as is | [09:46] |
| brycec | hazardous: for google.com real 0m0.161s | [09:47] |
| hazardous | yeah that seems cached maybe, idk | [09:47] |
| brycec | And nac.net now gives me real 0m0.027s | [09:47] |
| hazardous | i sometimes have periods of time when it's somewhat acceptable and periods of time where anything takes forever | [09:47] |
| brycec | http://support.arpnetworks.com/kb/main/is-there-a-firewall-filter-rate-limit-or-similar-device-applied-to-my-traffic
outbound UDP traffic is rate-limited to 5mbps I wonder if up_the_irons / ARP's resolvers are exempt from that, and/or being overwhelming it wow that was terrible grammar | [09:48] |
| m0unds | try again
hahah | [09:49] |
| hazardous | yeah i dunno, i just did host google.com and the A records returned instantly
then it hung for 3-4 seconds before returning the mx part | [09:49] |
| m0unds | huh.
was just gonna say maybe it wasn't cached but if it's hanging on mx recs, dunno the prev query, i mean since it returned google quickly | [09:50] |
| hazardous | yeah i have absolutely no idea
http://pastebin.aquilenet.fr/?1328915b0bfb2488#y8PHFMpIH159tKAd5vFItNbggiBNrLCLq4fJmGtx7oE= wat | [09:52] |
| brycec | oh man this dns ddos is terrible, how will i deal with the 50kbps of traffic pouring in???
Silliest. DOS. Ever. | [10:05] |
| ...... (idle for 26mn) | ||
| m0unds | omgz, you better mitigate it | [10:33] |
| ..... (idle for 24mn) | ||
| up_the_irons | brycec: <phew> ARP wasn't in the list ;) | [10:57] |
| mnathani | What is the purpose of running pfSense (a firewall) on a VPS with only one interface? | [11:01] |
| m0unds | m0unds shrugs
i did it to screw around; you can still use it as a gateway or firewall in front of another vps if you really wanted to you don't /have/ to have separate interfaces unless you're gonna nat | [11:02] |
| brycec | And even then, there are vlans ;) (or vlans inside of vlans, on ARP) | [11:16] |
| m0unds | yes | [11:16] |
| .......... (idle for 47mn) | ||
| toddf | vlans inside of vlans on ARP only work if you use svlan(4) (IEEE 802.1AD)
and then only if you're unblocked and permitted to do so I know from experience! now don't try to do svlan(4) on vio(4) on current, something about cksums kills it current openbsd that is | [12:03] |
| .......... (idle for 49mn) | ||
| mnathani | Does anyone know how much it costs to Akamaize a website? (Serve it using Akaamai's CDN) ? | [12:53] |
| m0unds | i've never seen $ amounts, but i've also never heard 'affordable' mentioned alongside their name
might look into edgecast or cachefly too | [12:58] |
| mnathani | Ofcourse it would depend on the size of the site / complexity beign served as well as actual traffic / bandwidth
s/beign/being | [12:59] |
| BryceBot | <mnathani> Ofcourse it would depend on the size of the site / complexity being served as well as actual traffic / bandwidth | [13:00] |
| m0unds | i googled and found pricing from an akamai partner showing a $4/GB x 500GB/mo commit
and that was 'cheap' | [13:01] |
| mnathani | so approx $2000/month for that setup? | [13:02] |
| m0unds | yea
later clarification showed $200/mo @ per GB and $375/mo for 500GB http://www.cachefly.com/pricing.html | [13:02] |
| mnathani | m0unds: thans
s/thans/thanks | [13:11] |
| BryceBot | <mnathani> m0unds: thanks | [13:11] |
| RandalSchwartz | cloudflare.com is free if you don't need SSL | [13:15] |
| m0unds | yeah, cloudflare
's free stuff is good if you just want the cdn features | [13:21] |
| toddf | indeed it does sound good | [13:22] |
| ......... (idle for 40mn) | ||
| up_the_irons | i'm not sure what i like better
allow(Mail).to receive(:all).and_return(@msgs) allow(Mail).to receive(:all) { @msgs } | [14:02] |
| staticsafe | http://www.pantz.org/software/pf/use_freebsd_10_as_a_pf_firewall.html | [14:03] |
| mike-burns | I like the #and_return. It's more clear what it's doing. | [14:05] |
| mercutio | m0unds: i prefer cahefly to akamai as a user | [14:06] |
| mike-burns | I save the block syntax for when I really need a block. | [14:06] |
| mercutio | akamai is often terrible performance with "cache misses"
akamai has closer nodes to me than cachefly, but cachefly's average performance is way up. | [14:06] |
| up_the_irons | mike-burns: ah | [14:07] |
| mercutio | it's harder to test cache miss performance though. you used to be able to send ?1 ?2 ?3 ?4 etc to get an uncached version of stuff to test... but that seemed to stop working
and with the number of akamai nodes, unless you're huge there are likely to be lots of cache misses cloudflrae is terrible i reckon | [14:07] |
| up_the_irons | CloudFlare should get on Any2 so I can peer with them
Akamai is, so is EdgeCast | [14:14] |
| mercutio | i don't think it'd make meuch difference?
cloud flare is in san jose atm isn't it? i can't think of any domains that use it off hand | [14:14] |
| up_the_irons | NO, peering with ARP makes ALL THE DIFFERENCE IN THE WORLD. Get it right mercutio ;) | [14:15] |
| mercutio | well i doubt there's much traffic being pushed to there, and with multiple upstreams ... incoming ins't likely to saturate
and hardly any users on arp are likely to be pulling large files off cloudflare | [14:15] |
| up_the_irons | but cloudflare pulls lots of files from arp | [14:16] |
| mercutio | oh
ok i didn't realise that | [14:16] |
| up_the_irons | :)
some dedi customers use CF heavily | [14:16] |
| RandalSchwartz | mercutio - anyone hosted at (mt) is using cloudflare by default | [14:17] |
| up_the_irons | yeah, shared hosting co's are starting to do that
we have some here | [14:17] |
| mercutio | mt? | [14:18] |
| up_the_irons | media temple | [14:19] |
| RandalSchwartz | (mt)® is Media Temple. Not sure what "mt" is. :) | [14:21] |
| brycec | me either. But I'm pretty sure a RandalSchwartz is a smartass :P | [14:22] |
| mercutio | i've only noticed cloudflare when sites have problems
i suppose that's one of the problems with those things | [14:22] |
| brycec | ditto | [14:22] |
| mercutio | some sites only shift to cloudflare when they're getting ddos'ed
or have load issues and if a site's going slow and you trace and it says cloudflare.. | [14:22] |
| RandalSchwartz | insightcruises.com had it enabled for a week, then they screwed up the DNS, and different people were getting different pages or even A records pointing to nowhere | [14:23] |
| staticsafe | O_o | [14:24] |
| RandalSchwartz | so we ripped it all out, and haven't gone back
might have been early growing pains | [14:24] |
| mercutio | who's using it right now? | [14:24] |
| RandalSchwartz | presume these guys: https://www.cloudflare.com/case-studies | [14:25] |
| up_the_irons | RandalSchwartz: you coming to any js.la meetups soon? it's kinda hard to believe the last one where we had a chance to chat was over a year ago! (christmas before last) | [14:25] |
| mercutio | imgur will do | [14:25] |
| up_the_irons | RandalSchwartz: or perhaps that was devops.la... hmmm
*ladevops | [14:26] |
| RandalSchwartz | interesting - http://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack | [14:26] |
| up_the_irons | up_the_irons brain is dying
RandalSchwartz: that was pasted earlier | [14:26] |
| RandalSchwartz | my client before this one was directly across the street from my hotel and a bar. I stopped going to meetups. :)
now I'm working in santa monica, and I have to actually drive around, so I can start doing meetups again. plus, it'll give me an excuse to drink a bit less. I was a bit out of control because I wasn't driving for 5 days at a time. | [14:27] |
| staticsafe | o_o | [14:27] |
| mercutio | oh cloudflare do have node in los angeles | [14:28] |
| staticsafe | they would be stupid not to | [14:28] |
| mercutio | and the ?1 ?2 trick works | [14:28] |
| m0unds | they've got lots of pops | [14:30] |
| mercutio | cache hit time in la, 20 msec, cache miss time 500 msec
cache hit time in nz, 85 msec, cache miss time 530 msec | [14:30] |
| brycec | not bad
pretty consistent anyways | [14:31] |
| mercutio | yeh i seen way worse from akamai
with > 1 second. | [14:31] |
| m0unds | gross | [14:31] |
| mercutio | it's only 15k file though
it seemed to get more consistent when i did it more | [14:31] |
| m0unds | my friend put their blog on the free cloudflare plan and saw spam comments just stop altogether - i think just as a side effect of cloudflare's anti-bot stuff | [14:32] |
| mercutio | imgur still loaded images slow
main imgur.com site isn't cdn'ed, jsut their images | [14:32] |
| m0unds | right
img.imgur.com | [14:33] |
| mercutio | nah i.imgur.com | [14:33] |
| m0unds | img.imgur.com is too | [14:33] |
| mercutio | oh ok | [14:33] |
| staticsafe | imgur is quite reliable
imgur++ | [14:33] |
| mercutio | i don't normaly look at it
http://imgur.com/gallery/oxn6ZMh but this is funny | [14:34] |
| staticsafe | heh | [14:34] |
| mercutio | damn now i want to test akamai
but they using https akamai is 56 msec hit, 1 second miss for apple 56k image and 17 msec hit, 260 msec miss from la i suppose that not so bad, i suppose it depends wehre origin servers are still even for 56k 1 second miss seems kind of bad to me | [14:37] |
| mnathani | Just setup my first site to site vpn in a lab, but I can't seem to ping from a subnet behind the vpn to a subnet on the other site. | [14:53] |
| mercutio | did you enable forwarding? | [14:53] |
| mnathani | The reverse ping works just fine. (pfSense with Openvpn btw) | [14:53] |
| brycec | Did you set the routing?
Non-overlapping subnets? Firewall? | [14:53] |
| mnathani | firewall - allow any/any
non-overlapping subnets yup | [14:54] |
| brycec | traceroute, tcpdump | [14:54] |
| mnathani | the server config section had local subnets and remote subnets | [14:54] |
| mercutio | i assume pfsense would enable forwarding :) | [14:54] |
| mnathani | client only had remote subnets
client side can ping server side, but not reverse how foolish of me, twice in as many days now, Windows Firewall got the better of me and dropped my icmp packets | [14:54] |
| mercutio | oh that's normal | [15:00] |
| brycec | lolol | [15:03] |
| mnathani | now I need to redo it to verify if all that config I did was necessary | [15:03] |
| brycec | @mnathani | [15:04] |
| BryceBot | Have you checked whether Windows Firewall is enabled and dropping packets? | [15:04] |
| mnathani | adding extra route statement etc | [15:04] |
| BryceBot | 425 results found. Here's #265 Dec 19, 2013 16:43:30 <mnathani > requests are going through, but not being cached I dont think | [15:04] |
| mnathani | lol BryceBot / brycec | [15:05] |
| brycec | You know what they say, if you use something 3 times, you sohuld buy it/script it.
Well, this was only twice but I'm proactive ;) | [15:05] |
| RandalSchwartz | Ugh - had some beans and rice (normally skipped) with my mexican dish for lunch
now I'm in a carb crash fog :( forgotten how bad these are | [15:10] |
| up_the_irons | RandalSchwartz: yeah they suck | [15:11] |
| m0unds | yeah, rice tends to knock me on my ass too
i think i'm gonna adjust my pf ruleset a bit - i got lazy and didn't define macros or anything so the rules are ugly as hell | [15:11] |
| toddf | when done.. var=..nvar=..nntable..ntable..nnmatch..nmatch..nnblock..npass..n done! ;-) | [15:15] |
| mercutio | y'll are lazy
oh i don't quite know how the y thing works i don't use macros with pf either | [15:19] |
| brycec | y'all are lazy'
well you get the idea I think... You need 2 or 3 separators it's a regex like any other | [15:20] |
| mercutio | oh | [15:21] |
| RandalSchwartz | ugh - this office has horrible "free" stuff in the kitchen. either sweetened beverages ("vitamin water", ugh), or decaffinated teas.
and all sorts of "hearthealthywholegrain" snacks it's sad how much I've found out that this stuff is all crap in the past 18 months | [15:22] |
| brycec | (well not exactly a regex... it's a PCRE verb, with sed expression syntax) | [15:23] |
| RandalSchwartz | PCRE is a misnomer :) | [15:23] |
| m0unds | i like macros because it keeps things readable - granted, i'm likely the only one who will ever see it, it's still nice to keep it concise
i do the same w/network hw configs on gear that actually supports macro type functionality (junos) | [15:26] |
| *** | m0unds has quit IRC (Quit: reloading) | [15:39] |
| mercutio | hmm cloudflare aren't on coresite | [15:40] |
| *** | mnathani_web has joined #arpnetworks | [15:41] |
| mercutio | so best hope is for bgp collective to spread to equinix | [15:41] |
| mnathani_web | are there network issues atm
I cant ping arpnetworks.com or my VPS | [15:42] |
| mercutio | weird
traceroute? | [15:42] |
| mnathani_web | sec. | [15:43] |
| toddf | I cannot ping arpnetworks.com | [15:43] |
| mnathani_web | http://pastebin.com/wZehQBW7
here is mtr | [15:43] |
| toddf | I can ping 2.v.freedaemon.com (which is on the 1gbps ports) | [15:43] |
| mercutio | blame nlayer? | [15:44] |
| mnathani_web | traceroute is taking a while | [15:44] |
| meingtsla | i can't resolve arpnetworks.com, weird
oh wait yes i can | [15:44] |
| mercutio | 208.79.89.243
i'm on arpnewtorks fine if anyone wants a traceroute in other direciton vl5.s1.lax.arpnetworks.com is giving packet loss | [15:44] |
| toddf | arpnetworks v6 is working, arpnetworks v4 is not for ns1 and ns2.arpnetworks.com | [15:44] |
| meingtsla | ah | [15:45] |
| toddf | just started responding | [15:45] |
| mercutio | ge0-arpnet.cust.lax07.mzima.net gives packet lsos too
i wonder what happend | [15:45] |
| mnathani_web | its back now | [15:46] |
| mercutio | oh
i never lost connectivity :) | [15:46] |
| RandalSchwartz | lsos! | [15:47] |
| brycec | Also showing IPv4 loss from INSIDE ARP https://smokeping.cobryce.com/?target=ARP.ThisGW
more accurately, packet loss on my own vlan to the router guessing router crash? | [15:48] |
| mercutio | nice
but not for me are you on gigabit? | [15:49] |
| brycec | Don't think so? | [15:49] |
| mnathani_web | could it be BIRD related? | [15:49] |
| mercutio | i'm not pinging the link address
don't think so hardly anyone goes over any2ix on the new range i think it's proably nlayer | [15:49] |
| brycec | fwiw I can ping arpnetworks.com and my VPS both. As far as I can tell from smokeping, there _was_ a brief outage but it's back up now. | [15:50] |
| mercutio | actually why would link address stop working then | [15:50] |
| brycec | only likely cause, something unplugged or reset | [15:51] |
| mercutio | wow you have a lot of sites in smokeping :) | [15:53] |
| brycec | About 250 probes | [15:54] |
| mercutio | i like the overlayed thing
how much bandwidth does that use? | [15:54] |
| brycec | 212 hosts to be precise
overlayed... When there's a whole bunch of hosts on one graph? like for the IRC networks? | [15:54] |
| mercutio | yeah | [15:55] |
| brycec | brycec asks graphs.arpnetworks.com how much b/w is used
A surprising amount. Reportedly 6.71GB in the last 24 horus | [15:55] |
| mercutio | 20 ping every 60 seconds | [15:56] |
| staticsafe | all that ICMP | [15:56] |
| mercutio | 212 sites | [15:56] |
| brycec | mercutio: 500byte packet size too | [15:57] |
| staticsafe | brycec: would you mind sharing your hosts file for smokeping? | [15:57] |
| mercutio | ahy are you doing 500 byte packet size
i was going to ask that but he has some local stuff in it too | [15:57] |
| brycec | mercutio: Because it's better than the default 5000 :P | [15:57] |
| mercutio | frguly isn't 500
err 5000 it's like 72 | [15:57] |
| brycec | According to the docs it's 5000 | [15:58] |
| mercutio | where | [15:58] |
| brycec | http://oss.oetiker.ch/smokeping/doc/smokeping_config.en.html | [15:58] |
| mercutio | oh wtf
that's example value which isnt' the default, but why are they suggesting that | [15:58] |
| brycec | er http://oss.oetiker.ch/smokeping/probe/FPing.en.html | [15:58] |
| mercutio | i'd suggest trying 32
and see if graphs look bsaically the same | [15:59] |
| brycec | You have in the past :P | [15:59] |
| mercutio | and identify issues just the same | [15:59] |
| brycec | And if the docs don't say "default" but do say "example" what am I to assume? | [15:59] |
| mercutio | well i thought i'd do it again
ikr | [15:59] |
| brycec | They aren't the world's best docs :/
Change made just in time for 4pm on the dot | [16:00] |
| mercutio | hmm.. up_the_irons have you considered making graphs of transit links visible to users? | [16:02] |
| brycec | Ah, 56 is the default. RTFS :/ | [16:02] |
| mercutio | hmm
i wonder why i saw 72 then oih maybe it was 76 i htink 56 doesn't include the IP header size of 20 bytes | [16:02] |
| brycec | probably
and actually it leaves it up to fping now that I read right | [16:03] |
| mercutio | just set it to 32 :) | [16:03] |
| brycec | "Default is 56, as in ping."
mercutio: 15:58:49 < brycec> Change made | [16:03] |
| mercutio | less load on the network
oh you did | [16:03] |
| brycec | But I like chewing up ~7GB/day | [16:03] |
| mercutio | heh | [16:04] |
| brycec | ~2MB/minute, from 5 monitoring hosts | [16:04] |
| mercutio | thing is it's every destination network
and the more people use larger packets etc the more people think it's a good idea to block icmp which is annyoing | [16:04] |
| brycec | I thought I'd dialed back the default to 10%, I was a Good Guy :p
dumb docs | [16:05] |
| staticsafe | some of the nlnog ring nodes seem to have stopped responding | [16:05] |
| brycec | staticsafe: if you're talking about my graphs, some never started responding :P (hurricane, I'm looking at you...) | [16:05] |
| staticsafe | ah | [16:05] |
| brycec | I wanted to give them time to fix themselves :p | [16:06] |
| *** | m0unds has joined #arpnetworks | [16:06] |
| mercutio | your smokeping responds so slowly
i dunno if it's cos it's swapping, or because you have so many hosts | [16:06] |
| brycec | what do you mean? | [16:06] |
| mercutio | like clicking things is slow | [16:06] |
| brycec | And no swapping | [16:07] |
| mercutio | oh maybe cos it's https | [16:07] |
| staticsafe | I like the idea of the NLNOG ring | [16:07] |
| brycec | me too
(mmm first page load after I restar the fastcgi, now THAT is slow) | [16:07] |
| mercutio | mine are slower than they could be on arp cos not using fastcgi | [16:09] |
| m0unds | brycec: it was pretty quick for me via comcast fwiw | [16:10] |
| mercutio | it seems your pages take ~2.5 seconds to generate | [16:10] |
| brycec | Thanks m0unds | [16:10] |
| m0unds | half a second or less for me | [16:10] |
| mercutio | it was 2.6 seconds from arp with curl
weird time curl -v 'https://smokeping.cobryce.com/?target=Internet.NLNOGRING' > /dev/null is what i was doing it's a bit up and down, now it's 1.4 seconds from arp | [16:10] |
| brycec | 2.47 to generate for me | [16:11] |
| mercutio | from arp? | [16:11] |
| m0unds | .947s for me from comcast in nm | [16:11] |
| brycec | images only 250ms each | [16:11] |
| m0unds | haha | [16:11] |
| brycec | mercutio: from my desk | [16:11] |
| mercutio | i just got a bad gateway error | [16:11] |
| brycec | damnit who broke smokeping | [16:11] |
| mercutio | from nginx | [16:11] |
| m0unds | ahahahahah | [16:11] |
| brycec | Sometimes the fastcgi crashes... | [16:11] |
| mercutio | hmm mayb eit is cos too many people using it | [16:11] |
| m0unds | womp womp | [16:11] |
| brycec | (And yes from nginx, because nginx is servingup the fastcgi) | [16:12] |
| mercutio | how many fastcgi processes does it run? | [16:12] |
| m0unds | 1100 | [16:12] |
| brycec | mercutio: Just the one process, because just the one cgi
Unless you're asking total on the system... In which case still just one. | [16:12] |
| mercutio | i think i have two
yeh two running as www-data and one running as smpokeping i wonder if that slows it down more for me cos i so far away oh images don't go via smokeping | [16:13] |
| brycec | (graphs is showing a reduction in b/w woo)
Yes. Those images are built on page load | [16:14] |
| up_the_irons | mercutio: not considered it | [16:17] |
| mercutio | i understand there may be some reluctance to
up_the_irons: any idea what happened aerlier? | [16:17] |
| up_the_irons | brycec: on v4 it would not be a router crash
s1.lax#sh ver ... s1.lax uptime is 4 years, 51 weeks, 4 days, 4 hours, 33 minutes | [16:18] |
| m0unds | lol | [16:19] |
| up_the_irons | mercutio: no idea | [16:19] |
| m0unds | what chassis is that one? | [16:19] |
| up_the_irons | 4500 | [16:19] |
| m0unds | cool | [16:19] |
| staticsafe | dat uptime | [16:21] |
| m0unds | my vss pair (2x6509E) is at 3y49w2d5h37m | [16:21] |
| up_the_irons | nice :) | [16:22] |
| m0unds | yup, pretty solid
our IS dept did a core upgrade to redundant 7009s - those have been horrible | [16:22] |
| mercutio | i think the longer you deal with IT the more you decide that everything is terrible | [16:23] |
| m0unds | 15 years in and i can't say i have that opinion at all | [16:23] |
| mercutio | really? | [16:23] |
| m0unds | some stuff is really bad, some stuff isn't as bad, some stuff is good | [16:23] |
| up_the_irons | yeah me either | [16:23] |
| mercutio | smtp, spam | [16:23] |
| up_the_irons | i've found some stuff to be very good | [16:24] |
| mercutio | oh right, but the conditions
get worse and worse bugs get more obscure etc i suppsoe the problem with things like routers is traffic volume goes up and up | [16:24] |
| m0unds | right | [16:25] |
| mercutio | if 100 gigabit connectinos were standard it wouldn't be such an issue
but tehy're new, and require new investment etc and heaps of "background" stuff to make it work i suppose one advantage of bandwidth going up over time is it's going to get harder and harder to sniff traffic | [16:25] |
| brycec | Heh, exactly at 4pm, my usage drops considerably https://dl.dropboxusercontent.com/u/3167967/screenshot_2014-02-13_16-26-15.png | [16:28] |
| mercutio | do the graphs look the same? | [16:28] |
| brycec | brycec hasn't looked
probably, yes | [16:28] |
| mercutio | yeh basically | [16:29] |
| brycec | I don't have side-by-side 500vs32, but seems right | [16:29] |
| mercutio | although you'd havd a few outages
to this tunnel | [16:29] |
| brycec | huh?
English please. | [16:29] |
| mercutio | ther's gaps in your grpahs | [16:29] |
| brycec | yes when I restart smokeping
Well 15:39 was the ARP outage | [16:29] |
| mercutio | i don't think it's that
https://smokeping.cobryce.com/images/Internet/NLNOGRING/doruknet01ringnlnognetv4~vps1_last_3600.png it looks like what smokeping does when it can't keep up | [16:30] |
| brycec | That's chunkhost though... those have always been shitty | [16:30] |
| mercutio | oh
it doesn't say loss though | [16:30] |
| brycec | I know | [16:30] |
| mercutio | are you doing dns lookups? | [16:30] |
| brycec | For whatever reason, that slave just doesn't keep up
some | [16:30] |
| mercutio | smokeping can have issues with graphs if it doesn't do all the hosts in the right time period | [16:31] |
| brycec | Yeah I know | [16:31] |
| mercutio | and i've seen it happen due to partial issues with connectivity to some hosts, making dns timeout before | [16:31] |
| brycec | brycec wishes smokeping bad better, or any logging | [16:31] |
| mercutio | it has logging
it tells you hwen it can't keep up | [16:31] |
| brycec | I only see logs when I start/stop | [16:32] |
| mercutio | weird
are you using rrdcached? i was just checking my logs and saw some stuff from rrdcached | [16:32] |
| brycec | Last I heard, smokeping doesn't support rrdcached | [16:33] |
| staticsafe | yea it doesn't | [16:33] |
| mercutio | hmm maybe i was using that for cacti | [16:34] |
| brycec | (I use rrdcached for munin stuffs though, but that's isolated) | [16:34] |
| staticsafe | staticsafe needs to completely redo his smokeping setup
i got rid of munin entirely I just use zabbix now | [16:34] |
| brycec | Ah that's why you wanted my configs
staticsafe: there's nothing special or unique to my Targets config, it's just long | [16:34] |
| mercutio | i'd like to see a standard set of test sites myself | [16:34] |
| staticsafe | brycec: yea, just want it to because I'm lazy :P | [16:35] |
| brycec | sure I'll sanitize and toss it on sprunge.us | [16:35] |
| staticsafe | ty | [16:35] |
| brycec | mercutio: that's my dream with nlnog
That I can use them as standard test sites | [16:35] |
| mercutio | ahh | [16:36] |
| staticsafe | brycec: my config isn't even monitoring v6 atm | [16:36] |
| mercutio | well i hvae google, gmail facebook twitter slashdot, nytimes, anandtech bbc, guardian godaddy, ubuntu archive wikipedia, | [16:36] |
| staticsafe | which is unacceptable | [16:36] |
| mercutio | which are some goodish sites to test
but like guardian hops around ubuntu archive always give packet loss when there is a new release and hmm i didn't comma right at all so it can make sense to do from multipel sources, to check whether it's the destination site or an in general thing | [16:36] |
| brycec | staticsafe: As requested http://sprunge.us/ZOhN | [16:38] |
| staticsafe | brycec: ty | [16:38] |
| brycec | It needs cleanup... I was inebriated at one point and forgot how Config::Grammar inherits | [16:38] |
| staticsafe | heh
config inheritance is my favorite thing nagios... | [16:38] |
| brycec | brycec was thinking fall-through, hence calling SlavesV4/6 over and over and over
(but it's actually parent/child inheritance) | [16:39] |
| staticsafe | # Boy this is getting annoying.
hehe | [16:40] |
| brycec | it really was! | [16:40] |
| mercutio | heh
so basically you're scraping | [16:42] |
| brycec | scraping?
referring to my regex? | [16:42] |
| mercutio | to get the destination sites | [16:42] |
| brycec | As opposed to inventing sites? :P | [16:43] |
| mercutio | or did you manually do mirrors?
yeh there's a lot of text | [16:43] |
| brycec | The scraping was not automated | [16:43] |
| mercutio | looks like you're relying on dns too | [16:43] |
| staticsafe | staticsafe dumps all existing smokeping data | [16:43] |
| mercutio | i wnoder if fpign can have a cache for dns
and use prior data if it cant' do a lookup | [16:44] |
| brycec | mercutio: I'd copy from a webpage into my text editor, apply the regex to mold into target configs, and paste that into Targets | [16:44] |
| staticsafe | mercutio: run a local resolver? | [16:44] |
| brycec | mercutio: Yes, some sites don't have fixed IP's. | [16:44] |
| mercutio | staticsafe: you could still hit expiring ttls | [16:44] |
| staticsafe | yep | [16:44] |
| mercutio | unless you use unbound with prefetch hmm | [16:44] |
| staticsafe | which is fine | [16:44] |
| brycec | (or are known to change their IP from time to time) | [16:44] |
| mercutio | you could still hit it though
static: not if the site goes down the problem is you don't want to fping to wait forever for dns s/to// | [16:44] |
| BryceBot | <mercutio> the problem is you don't want fping wait forever for dns | [16:45] |
| mercutio | oh
i just wanted to kill the first one | [16:45] |
| brycec | too bad :P | [16:46] |
| mercutio | so fping can lose all the results
does it assume /g ? | [16:46] |
| brycec | yes
Because that's what PHP's preg_replace does | [16:46] |
| staticsafe | looking at my traffic graphs and my machines are so idle :( | [16:47] |
| mercutio | heh
you should host wikileaks mirror | [16:49] |
| brycec | Is wikileaks still a "thing"? :p | [16:50] |
| mercutio | no idea | [16:50] |
| staticsafe | mercutio: or a tor relay :P | [16:50] |
| mercutio | gah no not tor
argh | [16:50] |
| brycec | up_the_irons has stated that he drops you at the first abuse report | [16:51] |
| mercutio | weird my vm just spiked to 20kbit bnadwidth | [16:51] |
| brycec | Tor seems liek an unnecessary risk | [16:51] |
| mercutio | it looks funyn on the graph | [16:51] |
| staticsafe | brycec: only exits get abuse reports
not relays | [16:51] |
| mercutio | but then 20kbit isn't much | [16:51] |
| brycec | true | [16:51] |
| staticsafe | but i wouldn't run it on ARP anyways | [16:51] |
| mercutio | i average 2kbit/sec inbound
and 1.68kbit/sec outbound | [16:52] |
| staticsafe | seed some linux ISOs too I guess | [16:54] |
| mercutio | i suspect most vm users don't use much bandwidth | [16:54] |
| staticsafe | agreed | [16:55] |
| mercutio | otherwise the ntp thing wouldn't ahve been as obvious
it's probably like 10% of the users use 90% of the bandwidth kind of thing | [16:55] |
| staticsafe | staticsafe nods | [16:56] |
| mnathani | Another pfSense issue, I have 4 interfaces: WAN, LAN, OPT1 and OPT2
LAN and OPT1 can ping 8.8.8.8 but OPT2 can not identical firewall rules OPT2 can ping LAN and OPT1 though | [16:56] |
| brycec | @mnathani | [16:57] |
| BryceBot | mnathani: Have you checked whether Windows Firewall is enabled and dropping packets?
432 results found. Here's #204 Dec 06, 2013 21:22:38 <mnathani > Anyone know of a method to Auto-BCC a copy of all outgoing mail to a specific address from within the Gmail Web Interface? | [16:57] |
| mnathani | packet capture shows pings leaving, but no reply
lol dont think 8.8.8.8 is behind a windows firewall lol though | [16:57] |
| brycec | Suuuure
opt1 and opt2 setup identically? routable subnets? | [16:58] |
| mnathani | yup | [16:58] |
| brycec | And just for kicks, swap (assign) them and see what happens | [16:58] |
| mnathani | after swapping, the vm that could ping can no longer ping and the vm that could not ping can ping now | [17:01] |
| brycec | Good
Just wanted to confirm it wasn't something besides configuration and that the vm's were confi'd right | [17:02] |
| mnathani | would you reset pfsense interface assignments at this point | [17:02] |
| brycec | If it didn't matter, I'd leave that and focus on the issue | [17:03] |
| mnathani | found it
it had a gateway assigned to it that needed to be removed from within the pfsense interface | [17:07] |
| brycec | awesome
lol why would you set the gateway on the internal interface? :p | [17:07] |
| mnathani | "It made sense at the time" ... | [17:09] |
| ............................ (idle for 2h15mn) | ||
| *** | dj_goku has joined #arpnetworks | [19:24] |
| .... (idle for 15mn) | ||
| dj_goku has quit IRC (Ping timeout: 260 seconds)
dj_goku has joined #arpnetworks | [19:39] | |
| jcv has quit IRC (Ping timeout: 265 seconds)
jcv has joined #arpnetworks | [19:50] | |
| ......... (idle for 40mn) | ||
| brycec | (Oh good, I just checked and the attempted DNS DOS on me subsided :D) | [20:30] |
| m0unds | whew, that was close
http://1drv.ms/1c4utnA i had a live wasp crawling its way across the floor in my server room | [20:30] |
| brycec | wasps are a "NOPE!" for me
practically send me running | [20:33] |
| m0unds | haha, i captured it in a cup and took it outside
this guy was super lethargic because of how cold it is in that room | [20:34] |
| brycec | oh shit... I just discovered my carp backup's ntpd is open. damnit damnit. | [20:37] |
| m0unds | YOU'RE PART OF THE PROBLEM | [20:38] |
| brycec | not according to monlist
at least, a very tiny part | [20:38] |
| m0unds | haha
someone in another channel said they had a supermicro board w/ntpd + monlist running on its ipmi interface | [20:38] |
| brycec | brycec decides it's easier to firewall rather than edit the conf
lolol | [20:39] |
| mercutio | brycec: you mean it tells you the time? | [20:44] |
| brycec | I mean it lists its recent peers, but it's a short list | [20:46] |
| mercutio | oh right
all the open to monlist hosts got blocked even the ones with shorter lists | [20:46] |
| brycec | I'm talking about a non-ARP system | [20:47] |
| mercutio | yeh on arp i mean | [20:47] |
| m0unds | (we were here yesterday when up_the_irons said he was gonna do it) | [20:47] |
| mercutio | i dunno if people trying to ddos differntiate
oh right was that eysterday | [20:47] |
| m0unds | yea, or the day before
the days all sort of blur together | [20:48] |
| brycec | brycec shakes his fist at pfSense | [20:48] |
| mercutio | openntpd hasn't taken off as much as openssh did | [20:49] |
| brycec | (pfSense has "pass in quick" rules to explicitly allow NTP access on all interfaces at the top :( grr) | [20:50] |
| m0unds | whoa, really? | [20:51] |
| brycec | yep
pfctl -sr http://sprunge.us/Vijb Ahahaha http://translate.google.com/#auto/en/%E8%87%AA%E5%8B%95%E3%82%A2%E3%82%AF%E3%82%BB%E3%82%B9%E3%81%AE%E5%A0%B4%E5%90%88%E3%81%AF%E3%80%81%E9%9B%BB%E5%AD%90%E3%83%A1%E3%83%BC%E3%83%AB%E3%82%92%20ntp-scan%40puck.nether.net%20%E3%81%B8%E3%81%8F%E3%81%A0%E3%81%95%E3%81%84 "For automatic access, please fart ntp-scan@puck.nether.net e-mail" | [20:51] |
| Reviewing some tcpdumps, I see people trying to use my (correctly configured) router to NTP DDOS. Yay for it being setup properly at least
wow, quite a bit in fact | [21:01] | |
| mnathani | what can you do using the command line / ssh with pfSense that can't be done from the web interface? | [21:02] |
| brycec | dd? :P
well even that can be done from the web On account of Diagnostics->Command mnathani: I find it easier to dump pfctl info, run tcpdumps and other diag tools | [21:02] |
| mnathani | I guess I meant in terms of managing / configuring the firewall | [21:03] |
| brycec | I leave all management and configuration to the web ui, unless I lock myself out. Since all changes get made to an XML config, best to leave it in the capable, tested, properly-formatting hands of the GUI
Though I suppose watching pflog could count as managing | [21:04] |
| mnathani | what distro is it easiest to setup / resolve dependencies of smokeping? | [21:07] |
| brycec | mnathani: Debian, I'd say
At least for slaves... I just launch an VZ container, apt-get install --no-install-recommends smokeping ; service smokeping stop ; $EDITOR /etc/default/smokeping /etc/smokeping/secrets ; set permissions ; service start smokeping 19... 1000 packets dumped, 19 different "sources" brycec takes a larger sample | [21:08] |
| mnathani | brycec: thanks | [21:14] |
| brycec | np
also, wtf my VPS load spiked to 33 christ on a cracker | [21:15] |
| mnathani | 00:20:50 up 6 days, 8:50, 1 user, load average: 0.00, 0.00, 0.00
00:21:09 up 17 days, 0 min, 1 user, load average: 0.08, 0.10, 0.07 my 2 ARP VPSen | [21:22] |
| brycec | @uptime host | [21:22] |
| BryceBot | host uptime: 140 days, 22 hours, 35 minutes, and 48.429999999702 seconds. | [21:22] |
| brycec | My one
(and loadavg is settling back to the .2 range | [21:22] |
| mercutio | brycec: so much more bw you doing an hour with smaller ping size? | [21:32] |
| brycec | mercutio: Funny you should ask, I was just looking at that https://dl.dropboxusercontent.com/u/3167967/screenshot_2014-02-13_21-31-44.png
You can clearly see when I added a bunch of hosts with size=500, and when I dropped that back down | [21:33] |
| mercutio | iyou're probably still doing a lot of pps
were you at defaults prior? i didn't quite get that whther you'd shifted to 500 byte packets today or ages ago there are still gaps i don't think fping does have a way to cache dns lookups you can use ps to find out what command line it's calling and cut and paste the fping and do one ping, to figure out long it's waiting on dns but would need to do it during some kind of outage to know for eusre how much it impacting comcast.net if you ping that has dns ttl of 30 seconds for instance so isn't likely to be cached between polls | [21:36] |
| ........ (idle for 37mn) | ||
| *** | kevr1 has joined #arpnetworks | [22:20] |
| kevr1 has quit IRC (Quit: WeeChat 0.4.3)
mnathani_web has quit IRC (Quit: Page closed) | [22:25] | |
| ......... (idle for 44mn) | ||
| xales has joined #arpnetworks | [23:12] | |
| ↑back Search ←Prev date Next date→ Show only urls | (Click on time to select a line by its url) |
