[00:53] cdns care about tcp access times i think [00:53] and prefer faster loading pages [00:53] like from cdns [00:55] actually when i say search engines, i mean google, and it's only what i've heard [00:56] acf: i have limited anycast [00:56] usually you use your normal asn for anycast, but you do have to kind of dedicate a /24 to it [00:57] the most used case for anycast atm is dns [00:58] and dns resolvers often consult dns servers that aren't the cloesst location. if using anycast you still should have more than one server location [00:58] err, i mean you shouldn't just advertise a /24 in multiple locations, and all of your name servers as seperate hosts at that location, as if location has an issue thigns can become unreachable. [01:16] *** brycec has quit IRC (*.net *.split) [01:16] *** CaZe has quit IRC (*.net *.split) [01:16] *** hazardous has quit IRC (*.net *.split) [01:16] *** NiTeMaRe has quit IRC (*.net *.split) [01:16] *** Hien has quit IRC (*.net *.split) [01:16] *** eryc has quit IRC (*.net *.split) [01:16] *** pjs has quit IRC (*.net *.split) [01:16] *** BryceBot has quit IRC (*.net *.split) [01:16] *** up_the_irons has quit IRC (*.net *.split) [01:16] *** josephb has quit IRC (*.net *.split) [01:16] *** m0unds has quit IRC (*.net *.split) [01:16] *** phlux has quit IRC (*.net *.split) [01:16] *** KILLALLHUMANS01 has quit IRC (*.net *.split) [01:16] *** mike-burns has quit IRC (*.net *.split) [01:16] *** pcn has quit IRC (*.net *.split) [01:16] *** meingtsla has quit IRC (*.net *.split) [01:16] *** kevr has quit IRC (*.net *.split) [01:16] *** KDE_Perry has quit IRC (*.net *.split) [01:16] *** mercutio has quit IRC (*.net *.split) [01:16] *** twobithacker has quit IRC (*.net *.split) [01:20] *** Hien has joined #arpnetworks [01:20] *** eryc has joined #arpnetworks [01:20] *** hazardous has joined #arpnetworks [01:20] *** brycec has joined #arpnetworks [01:20] *** CaZe has joined #arpnetworks [01:20] *** pjs has joined #arpnetworks [01:20] *** NiTeMaRe has joined #arpnetworks [01:20] *** BryceBot has joined #arpnetworks [01:20] *** up_the_irons has joined #arpnetworks [01:20] *** josephb has joined #arpnetworks [01:20] *** barjavel.freenode.net sets mode: +o up_the_irons [01:21] *** m0unds has joined #arpnetworks [01:21] *** phlux has joined #arpnetworks [01:21] *** KILLALLHUMANS01 has joined #arpnetworks [01:21] *** mike-burns has joined #arpnetworks [01:21] *** pcn has joined #arpnetworks [01:21] *** meingtsla has joined #arpnetworks [01:21] *** kevr has joined #arpnetworks [01:21] *** KDE_Perry has joined #arpnetworks [01:21] *** mercutio has joined #arpnetworks [01:21] *** twobithacker has joined #arpnetworks [01:21] *** barjavel.freenode.net sets mode: +o mike-burns [01:21] *** novae has quit IRC (Ping timeout: 255 seconds) [01:21] *** jpalmer has quit IRC (Ping timeout: 255 seconds) [01:24] *** novae has joined #arpnetworks [01:24] *** jpalmer has joined #arpnetworks [01:24] *** tabthorpe has quit IRC (Ping timeout: 255 seconds) [01:25] *** CaZe_ has joined #arpnetworks [01:28] *** CaZe has quit IRC (Remote host closed the connection) [01:28] *** CaZe_ is now known as CaZe [01:28] *** tabthorpe has joined #arpnetworks [01:28] *** tabthorpe has quit IRC (Changing host) [01:28] *** tabthorpe has joined #arpnetworks [01:29] mercutio: Anycasting dns resolvers is very commonplace. We do that within our network mainly for resiliance, so resolvers in one city are reachable on the same IPs the clients are using if one set fail [01:31] mercutio: Doing it on the authoritative side is slightly more controversial though. When DNS was invented hostnames were never intended to change IP rapidly, or to have different records depending on where you were asking from. [01:32] It was intended that record caching would keep the answers local in the resolver for popular hosts, and only be re-fetched from the authoritative server once a day/week/month/whatever [01:33] In that model it doesn't really matter if the authoriative server is 500ms away, as you're only sending it one query a week [01:33] *** tabthorpe has quit IRC (*.net *.split) [01:33] *** brycec has quit IRC (*.net *.split) [01:33] *** hazardous has quit IRC (*.net *.split) [01:33] *** NiTeMaRe has quit IRC (*.net *.split) [01:33] *** Hien has quit IRC (*.net *.split) [01:33] *** eryc has quit IRC (*.net *.split) [01:33] *** pjs has quit IRC (*.net *.split) [01:33] *** BryceBot has quit IRC (*.net *.split) [01:33] *** up_the_irons has quit IRC (*.net *.split) [01:33] *** josephb has quit IRC (*.net *.split) [01:44] *** tabthorpe has joined #arpnetworks [01:44] *** Hien has joined #arpnetworks [01:44] *** eryc has joined #arpnetworks [01:44] *** hazardous has joined #arpnetworks [01:44] *** brycec has joined #arpnetworks [01:44] *** BryceBot has joined #arpnetworks [01:44] *** up_the_irons has joined #arpnetworks [01:44] *** josephb has joined #arpnetworks [01:44] *** NiTeMaRe has joined #arpnetworks [01:44] *** pjs has joined #arpnetworks [01:44] *** barjavel.freenode.net sets mode: +o up_the_irons [02:41] *** jcv has quit IRC (Ping timeout: 255 seconds) [02:41] *** jcv has joined #arpnetworks [03:01] well now ttl's are like 300 seconds etc plett [03:02] peltt: dns resolvers and authorative are both commonly anycast now [03:02] but it's also common for people to anycast primatry and secondary dns servers [03:02] it's also common not to [03:02] but if you anycast to the same dc... [03:02] one of the cdn's was doing it i think [03:02] and i'm pretty sure opendns do it too [03:06] plett it is actually realyl hard to benchmark dns performance though, most isp's are fast for google etc, but when you get to werid domain names they can vary [03:06] so do you take notice of "average request time" or how quick the less common domain name lookusp are [08:40] *** ant has quit IRC (Ping timeout: 252 seconds) [08:40] *** ant has joined #arpnetworks [09:02] you could always test w/dnsbench (late reply) [09:02] it can be a handy way to test recursive resolver perf [09:22] (no later a reply than up_the_irons ...) [09:23] He must have overexerted himself last week upgrading 2 hosts [09:30] *** ^Erick^ has joined #arpnetworks [10:32] *** ^Erick^ has left "Textual IRC Client: www.textualapp.com" [13:06] *** abthorpet has joined #arpnetworks [13:11] *** abthorpet has quit IRC (Remote host closed the connection) [13:11] *** tabthorpe has quit IRC (Remote host closed the connection) [13:19] *** jcv has quit IRC (*.net *.split) [13:19] *** hazardous has quit IRC (*.net *.split) [13:19] *** NiTeMaRe has quit IRC (*.net *.split) [13:19] *** Hien has quit IRC (*.net *.split) [13:19] *** eryc has quit IRC (*.net *.split) [13:19] *** pjs has quit IRC (*.net *.split) [13:19] *** BryceBot has quit IRC (*.net *.split) [13:19] *** up_the_irons has quit IRC (*.net *.split) [13:19] *** josephb has quit IRC (*.net *.split) [13:19] *** dr_jkl has joined #arpnetworks [13:20] *** jcv has joined #arpnetworks [13:20] *** Hien has joined #arpnetworks [13:20] *** eryc has joined #arpnetworks [13:20] *** hazardous has joined #arpnetworks [13:20] *** pjs has joined #arpnetworks [13:20] *** josephb has joined #arpnetworks [13:20] *** up_the_irons has joined #arpnetworks [13:20] *** BryceBot has joined #arpnetworks [13:20] *** barjavel.freenode.net sets mode: +o up_the_irons [13:22] up_the_irons: wb [13:23] *** NiTeMaRe has joined #arpnetworks [13:24] *** brycec has quit IRC (*.net *.split) [13:30] *** brycec has joined #arpnetworks [13:31] http://i.imgur.com/uqmZK9v.png wee [13:32] heh [13:32] * brycec grumbles about Freenode [13:32] nice netsplit there [13:33] m0unds: yep [13:34] m0unds: btw, up_the_irons emailed NTT [13:34] got the same response as I did [13:34] fantastic [13:35] bummer [13:35] it's rendering my use of this vm as a ts/murmur server sort of moot since 80% of my users are on comcast or centurylink [13:35] both of which have heavily congested ntt peering during peak hrs [13:35] yeah, I know what you mean [13:36] i moved murmur and teamspeak to a box on my home cable connection temporarily so we can actually use voice [13:36] haha [13:36] up_the_irons hasn't been around in a while, maybe he'll do something when he gets back [13:36] yeah, it kills voip [13:36] i'd only use ts, but some of the guys who play project reality really like the positional audio stuff you can do w/PR and mumble [13:37] hmm, interesting [13:37] @last up_the_irons [13:37] brycec, I last saw up_the_irons 4 days 19 hours 51 min 15 sec ago saying in a channel: m0unds: roger. [13:37] nearly 5 days... [13:39] he'll have a giant /away log to go through [13:39] hahaha [13:58] up_the_irons: my vps is still network-deaf :| [14:36] who's roger [14:38] "The International Civil Aviation Organization (ICAO) officially defines the word "roger" to mean "I have received all of your transmission."" [14:44] i wonder why roger of all things [14:47] *** m0unds has quit IRC (Quit: derf) [14:52] *** m0unds has joined #arpnetworks [15:13] *** jlgaddis has quit IRC (Ping timeout: 245 seconds) [15:22] hazardous: Before 'r' was romeo in phonetic alphabets, 'roger' was used. [15:22] @wiki Voice procedure [15:22] Voice procedure :: Voice procedure includes various techniques used to clarify, simplify, and standardize spoken communications over two-way radios, in use by the military, in civil aviation, police and fire dispatching systems, citizens' band radio (CB), etc. Specially, for civil aviation - it used to be called aeronautical phraseology. Voice procedure communications are intended to... http://en.wikipedia.org/wiki/Voice%20procedure [15:52] "Roger" was the U.S. military designation for the letter R (as in received) from 1927 to 1957.[4] [15:54] *sigh* [15:54] *sigh* [15:58] no ticket update in 24h for a deaf server :| [16:00] dr_jkl: what exactly is happening? [16:00] acf_: account was reactivated from suspension and the vlan is supposedly active but the vps can't ping it's gateway or the world [16:00] networking is configured correctly [16:01] and while the initial response to the ticket was nice and fast, i updated the ticket at around 6pm last night and here we are at 7pm today and i have the cube root of sweet fuck-all to show for it [16:02] out of curiosity, what happens if you run tcpdump on the interface [16:02] and try to ping the machine from outside [16:03] i can't, because tcpdump isnt installed on this box [16:03] and i cant reach the world :D [16:03] so [16:03] traceroute stops at r1.lax.arpnetworks.com so it's not my issue [16:04] s1.lax? [16:04] r1.lax.arpnetworks.com (208.79.88.2) [16:04] thats the last hop before the void [16:05] is that normally the last hop before your box? [16:06] So what you do is open hexedit and start copying over tcpdump :p [16:06] lol [16:06] or zmodem [16:06] maybe check the output of ifconfig [16:06] Heck you could base64 encode/decode files and paste it through console.arpnetworks.com [16:06] acf_: tbh i do not know, i haven't had a reason to poke this box for ~6months [16:06] see if it says it received anything [16:07] RX bytes:250505173287 (233.3 GiB) TX bytes:257057917197 (239.4 GiB) [16:07] also arp -a [16:07] my rx/tx counts are in the kilobyte range, the thing is deaf as a post [16:08] my arp cache is empty [16:08] ahh darn [16:08] well, hope you get that fixed soon [16:08] I'm sure you'll get a reply within 48 hours of your posting [16:09] yeah considering i have to do stuff on this box today i am kinda hoping it gets fixed sooner rather than later [16:09] I just up up_the_irons wasn't run over by a bus or similar [16:09] up_the_irons: you werent run over by a bus were you [16:09] It's very unusual for him to be silent so long [16:10] when did he reply to your support ticket the first time? [16:10] brycec: i know... i mean [16:10] The upside: Free service until things break down. <.< [16:10] >.> [16:10] (at least for those with working VPSs) [16:10] acf_: 6/16/14 @ 06:02pm (T+6 minutes [16:10] so it was rly fast [16:11] June 16? That would be last night... [16:11] so he was alive then :) [16:11] yeah [16:11] So where was he??? Why wasn't he here then? [16:11] Unless you're referring to the autoresponder... [16:11] im just getitng shit from people who need stuff the box provides [16:11] and i mean [16:11] i cant really be mad [16:11] thing got suspended because the card expired and nobody noticed [16:12] & the lack of response is very atypical [16:12] its almost like the ethernet interface isnt attached properly in whatever hypervisor etc is being used [16:13] I think he probably just disabled your vlan config thingy on the router [16:13] do you have multiple boxen with arp? [16:13] he said he enabled it [16:13] acf_: no [16:13] Perhaps he reused your IP on another vlan? [16:13] thats the thing, he said it was enabled, so i poked around and im like 'nope, use a bigger hammer' [16:14] well, in the mean time, you *could* try brycec's base64 idea [16:14] get the .deb or whatever, base64 encode it, write a perl/python script... [16:15] i'm not sure i want to put the effort into that for a $10 vps [16:15] It can't be that much effort... [16:15] what variant of Linux? [16:15] debian wheezy [16:15] oh cool [16:16] The binary is only 16,741 lines base64-encoded [16:16] do you have libpcap? [16:16] 'only' lol [16:16] acf_: probably not - i made this box a mailserver and didnt really put anything else on because i was in a hurry [16:16] dr_jkl: just curious, what's the IP of your host? [16:16] won't make that mistake again [16:16] brycec: 174.136.100.58 [16:17] Yep, the router just doesn't know where to go with it. [16:17] dpkg-query -l libpcap0.8 [16:17] dpkg-query -l libssl1.0.0 [16:17] dpkg-query -l multiarch-support [16:17] So I'm guessing that the VLAN was reenabled, but the router didn't get the /29 readded to it. [16:18] acf_: nada [16:18] brycec: ever heard of r1.lax? [16:18] yes [16:18] brycec: the irritating problem is it's like 30 seconds worth of work for something that has me dead in the water :P [16:18] Maybe the Debian ISO has the package? [16:18] oh good idea [16:18] brycec: i was given the netinst iso, i doubt it [16:18] Or at least boot to one of the other ISOs that has tcpdump on it [16:18] if the iso is still there, i mean [16:19] you can change ISOs in the portal [16:19] to basically anything [16:19] There are some "rescue" ones that might [16:19] oh yeah i forgot i can do that [16:20] but he only hsa the debian netinst [16:20] :| [16:20] * dr_jkl uses SUMMON up_the_irons [17:11] *** mus1cb0x has joined #arpnetworks [17:12] happy to report back that enabling the green status bar (and therefore clock->minutely network traffic for update) has caused my connection to vps on kvr14 to become stable [17:12] 2 days and no d/c which wouldn't have happened before [17:13] so is the most likely cause of the silent broken pipe my pf config losing state after some time and treating the connection traffic as unknown? [17:23] mus1cb0x: is this since the node update? [17:23] last monday? [17:23] something like that [17:23] i'm on kvr15 so i can't be sure :) [17:24] it seemed like it, however i doubt it now. i think it's a config problem on my end [17:24] i don't really use state with pf myself [17:24] why not? [17:25] i don't see the point [17:25] and it can break things :) [17:25] i hate it when i have a ssh open for a couple of days, adn i type something on it, and it closes [17:25] and that kind of problem is quite common when using state [17:26] which means applications have to send regular puluses to stay alive [17:26] yea true [17:26] ssh has rekeying at least [17:27] i use the arguement sometimes that state doesn't work with ddos [17:27] but really on a "good" ddos nothing works [17:27] rekeying? [17:27] ssh changes it's key between client/server [17:28] acf_: no response, just requested a quote for a dedi from prq [17:28] i don't get your point on state and ddos 'working' [17:28] sadly, the person i was doing the work for has decided to go with another company over arp because of this :| [17:28] *shrug* i tried... [17:29] over what dr_jkl? [17:29] itll be spensive but tired of waiting and presumably they can get it done Ive had good experiences with them in the past [17:29] mus1cb0x: no update to ticket in 24h for a server with a netowrking problem on arp's end [17:29] i tried. sorry guys. [17:29] *** dr_jkl has left [17:30] erratic: dedi sounds expensive [17:31] did they say the could route you a /29 ? [17:31] it might be nice to have it at prq actually if you're going to be in Europe [17:31] what's prq? [17:32] http://prq.se/ [17:32] acf_: waiting to find out from them [17:33] looks good [17:34] acf_: yeah I donno it means a lot to me I've wanted this for a long time now and finally I found arp and they seem too busy [17:34] I'd give it a bit more time [17:35] usually up_the irons is pretty fast on the response time [17:35] it's also a really nice service once it's set up [17:37] ooo [17:37] http://prq.se/?p=special&intl=1 [17:38] lol [17:38] ddos often overflows state tables [17:38] BryceBot: 625 SEK to USD [17:38] its about 90 dollars [17:39] not too bad [17:39] it really would make more sense to colo with them [17:39] http://prq.se/?p=colo&intl=1 [17:39] ...alright, going through a ton of scrollback. This was my b-day weekend and also Father's Day, so i've been pretty afk... [17:39] definitely if you have a nice 1U lying around [17:40] up_the_irons: good to see you back [17:40] up_the_irons lives :) [17:40] and happy birthday [17:40] happy bday :) [17:40] aol me too happy birthday [17:41] is that gemini or cancer [17:41] gemini i imagine [17:41] gemini [17:42] acf_: well I know tpb doesn't use prq anymore, wonder if I could contact that neij fellow and get him to colo my box in some unknown location (pirate party data center cough cough) for me [17:42] aol? [17:42] mus1cb0x: people on aol used to say me too to a whole lot of posts [17:42] without adding anything useful to the discussion. [17:43] was that just an aol thing? [17:43] no, but aol typified it [17:43] oh [17:43] lol/win 4 [17:44] http://www.catb.org/jargon/html/A/AOL-.html [17:44] the great up_the_irons returns! [17:44] "See also September that never ended." [17:44] hahaha [17:44] no doubt [17:45] acf_: @exch [17:46] @exch 625 SEK to USD [17:46] 625 SEK -> 94.164966172931 USD (as of Tue, 17 Jun 2014 17:00:44 -0700) [17:46] ah thanks brycec [17:46] PS happy birthday up_the_irons [17:46] today is my lady's birthday... and I'm still at the office :( [17:49] ty all for the birthday wishes [17:49] @exch 400 eur to usd [17:49] 400 EUR -> 541.87031959511 USD (as of Tue, 17 Jun 2014 17:00:44 -0700) [18:03] mnathani: IPv6 BGP and IPv4 BGP work similarly, yes [18:12] up_the_irons: good to know [18:16] *** mus1cb0x has left "WeeChat 0.4.2" [18:19] erratic: "do you guys have any clients who need large numbers of instances?" -- I can answer this, but i'm not sure i understand the question... [18:20] mnathani: basically, everything is a tagged port [18:22] yeah I wreckon anybody would want that would just go with rackspace or ec2 [18:22] sorry to ask [18:23] mnathani: brycec : mercutio : the backup VLAN is indeed a single VLAN, so everyone who has the dedicated NIC for the backup server is on a "shared switch", so-to-speak; and yeah, you can see other customers' backup port [18:25] up_the_irons: so, technically I could request the dedicated NIC on 2 VMs, and pass traffic between them using their link local IPv6 at Gigabit speeds? [18:26] and those vms dont necessarily need to be on the same customer account [18:26] mnathani: yeah that sounds right [18:26] up_the_irons: cool [18:27] erratic: well, we don't have too many customers that have like 30 VMs, but there are some [18:27] up_the_irons: do you create a bridge interface for each VPS to communicate on a different VLAN on each KVR host [18:28] bridges are involved, yes [18:29] mnathani: no plans for a looking glass in the near future, i just don't have the time to set it up [18:31] acf_ | I think he uses Qemu/KVM with an in-house management system [18:31] acf_: ^^ that's correct [18:39] up_the_irons: Happy birthday! [18:39] erratic: btw, i'm sorry for the slow response times; it's not typical. Father's Day and my b-day weekend all at once, so things got behind. [18:39] novae: tnx! [18:41] sorry about that [18:48] *** erratic has quit IRC (Quit: Reconnecting) [18:48] *** erratic has joined #arpnetworks [18:48] *** erratic is now known as Guest85668 [18:48] *** Guest85668 is now known as erratic_ [18:56] I'll volunteer to run+admin the ARP Networks NTP server, up_the_irons :) (I'm already running one http://www.pool.ntp.org/scores/2607:f2f8:a650::3 http://www.pool.ntp.org/scores/174.136.103.130) [18:56] (But I'm rubbish on LG, sorry) [18:57] brycec: tell me what you need to get started (or if you just want to use your existing one(s), that's cool too) [18:58] looking glass is pretty easy to do with openbsd [18:59] up_the_irons: I'd be happy to use my existing one, but it's tied to my account so I'd rather not (what if my CC should fail, then ARP's NTP would be down). It's exceedingly minimal, the "small" package would be more than enough. (Could probably do it in 128MB and 2GB) And since you're familiar with Debian/Ubuntu, I'd say put up a Debian image. [19:00] it would be neat to have a hardware GPS reference on it [19:00] not sure about feasablity though [19:00] acf: yeah [19:00] That's less feasible... [19:00] it's probably not unfesasable [19:00] if it'll go through the datacenter ceiling? [19:01] brycec: ok, i'll have to set up a new VM for it then [19:01] can't ti go through the window [19:01] It would require an antenna on the roof and patching the antenna down to the datacenter, probably $$ for it. [19:01] i suppose it depends how close to window it is :) [19:01] mercutio: windows... like to the outside world? in the middle of a datacenter? [19:01] ok that sounds complicated bryce [19:01] it might "just work" [19:01] bryce: that's what the dc where iam is like haha [19:01] i forget they're not all like that [19:02] not all datacentres are in basements [19:02] I think arp machines are at 900 N Alameda [19:02] source: I've worked with cell companies, which require GPS signal [19:02] it's a post office? [19:02] Probably a former post office ;) [19:02] i see windows :) [19:03] Big fancy datacenters with all kinds of safeguards and security don't have windows on to the floor [19:03] up_the_irons can see if his phone gets GPS in there? [19:03] http://www.coresite.com/locations/los-angeles [19:03] What if there's a storm and the window breaks? [19:03] i'm looking at that top image, which i got when searching for 900 n [19:03] or an earth quake [19:03] bryce: tehy're reinforced. [19:03] well earthquake is more relevant [19:04] or like that movie right at your door [19:04] i've been in a big earthquake, and server issues wren't that major [19:04] the biggest problems were things ilke generator power [19:04] and refuqeling [19:04] because of restricted access etc [19:04] I'm just going to let up_the_irons answer whether there are windows exposed to the floor... [19:04] but what about this http://en.wikipedia.org/wiki/Right_at_Your_Door [19:04] Right at Your Door :: Right at Your Door is a 2006 American thriller film about a couple and follows the events surrounding them when multiple dirty bombs detonate in Los Angeles. Chris Gorak both wrote the screenplay and directed the film in his writing and directorial debuts. It was first screened at the Sundance Film Festival in January 2006 where it was nominated for Cinematography Award and the Grand Jury Prize, winning the Cinematography.. [19:04] * brycec has to go home anyways [19:04] lol [19:05] with that flooding in new york i think that was the general problem too [19:05] no windows in the suite that my cage is in [19:05] there are windows on the same floor [19:05] Im going to watch this now on netflix [19:05] ok well gps is off :) [19:05] well probably off [19:05] is there cellphone reception there ok? [19:05] GPS isn't impossible, but a whole lot more work than it's worth. Being a stratum 2 is plenty. [19:07] general recommendation for ntp servers is 3 [19:07] or more [19:07] is the idea to have one arp ntp in the pool? [19:07] mercutio: the idea is to have an NTP server on-net, for low-latency and in case The Internet implodes [19:07] in the normal pool? [19:07] (It's been requested a few times) [19:08] If up_the_irons is okay with it, sure. Or maybe he'd prefer it were ARP customer only [19:08] what if it goes down? what if it has widely wrong time? [19:08] what if theres a zombie virus out break and the zombies start attacking the servers [19:08] mercutio: both of which are addressed in NTP protocol [19:08] the idea of 3 servers or more is that if one has widely inaccruate time, you need 3 of them to balance it out [19:09] s/balance it out/invalidate it [19:09] the idea of 3 servers or more is that if one has widely inaccruate time, you need 3 of them to invalidate it [19:09] heh [19:09] *whoosh* [19:09] Bye brycec! [19:12] acf_: how is the latency using a tunnel? [19:12] prq was guranteed at least 200ms [19:12] depends on where you are [19:12] since I'm not too far from lax, I get ~10ms sometimes [19:13] when Comcast and NTT aren't being stupid :) [19:13] how is the comcast issue going [19:13] afaik not good [19:13] up_the_irons got the same response as I did for the Verizon one [19:13] and nothing has changed on NTT/Comcast end [19:14] did anyone see the level3 blog? [19:14] http://blog.level3.com/global-connectivity/observations-internet-middleman/ [19:15] erratic_: I get 154ms from ARP to xs4all.nl fwiw [19:15] thats cool [19:15] mercutio: yeah, saw that a while ago [19:16] very interesting read [19:16] *** erratic_ has left [19:16] "interesting" is one way to put it [19:16] *** erratic_ has joined #arpnetworks [19:16] the problems are mostly us-centric [19:16] yep. US ISPs suck [19:16] and mostly in areas were monopolys exist [19:16] which is everywhere? [19:16] heh [19:17] so if comcast/verizon/at&t have issues to cogent/ntt/level3 [19:17] which side is to blame [19:17] yeah I dont understand the us anymore, pretty much everything is comcast [19:17] there's at&t dsl quite commonly available i thought? [19:17] I wont buy service from them anymore [19:17] Comcast, TWC, AT&T, Cox, Verizon, CenturyLink [19:17] that's all of them afaik [19:17] cox is cheap and nasty right? [19:17] but still better than the others? [19:18] we have Comcast here, Cox next door [19:18] I've heard relatively good things about Cox actually [19:18] that youtube thing was saying that twc and comcast won't compete? [19:18] haven't heard of any peering congestion issues, but that doesn't mean the don't exist [19:18] yeah, they have their regional monopolies [19:18] i've heard bad things about comcast and verizon [19:18] they want to merge, and they're arguing that it won't reduce competition [19:19] and i've heard that at&t is ok if you wsant a cheap slow service. [19:19] verizon sucks super duper bad [19:19] yep yep yep [19:19] f*** verizon [19:19] at&t is like $30/month for a cheap plan? [19:19] they will never get a dime from me [19:19] acf_: frontier ? [19:19] i get disconcerted when i read price for 6 months [19:19] frontier did some pretty stupid stuff when I used them [19:19] frontier is old verizon afaik. I guess I should count them? [19:20] $25 for 3 megabit for 6 months [19:20] http://kremvax.acfsys.net/smokeping.cgi?target=Remote.verizon-snloca-dsl [19:20] look at the graph for ec2 [19:20] dunno how much it changes to [19:20] yeah theyre pretty much fios (which is nice and terrible support wise) [19:20] http://kremvax.acfsys.net/smokeping.cgi?target=Remote.verizon-snloca [19:20] non DSL router in the same building as from the previous one [19:21] we don't have fios here [19:21] I heard they stopped deploying it completely? [19:23] so how much of the market does comcast have? [19:23] *** dj_goku has quit IRC (Remote host closed the connection) [19:23] here, probably Verizon's only market is people who don't know what the Internet is [19:24] everybody else has Comcast [19:24] Verizon's speed/service is just unbearable [19:24] is it just a location thing? [19:24] idk about other places. I would guess it's pretty much the same everywhere for DSL [19:24] fios is very competitive though [19:25] Comcast and Verizon compete aggressively in areas with fios [19:25] i dunno my friend had verizon and it seemed to have ok speeds, just terrible peering [19:25] it was vdsl [19:25] oh and it had higher pings [19:25] strange. was it on the west or east coast? [19:25] they're independent systems I think [19:25] kansas? [19:25] what is that considered [19:26] not sure [19:26] middle [19:26] if you look at a map, it seems it's bsaically in the middle of the US [19:26] yeah, DSL uses an error correction algorithm that basically adds 32ms [19:26] atleast ADSL [19:26] dsl varies in that respect, but yes [19:26] my adsl has 10 msec pings [19:26] to next hop [19:27] probably east coast system. I've never seen vdsl anywhere around here [19:27] I guess your adsl is on "fastpath" [19:27] I want candy and cookies and cupcakes [19:27] "is Kanasas on the east or west coast?" "Neither, it's right in the middle" [19:28] it's really hard to determine which it is isn't it [19:28] yeah my adsl is fast path [19:28] Verizon won't do fast path here [19:28] vdsl on fast path is more like 5 msec [19:28] that would be nice to have [19:28] there's a low interleaving settings too, which is aruond 9 msec extra ping [19:29] Im gonna go buy some food [19:29] (not food cupcakes) [19:30] 64 bytes from 114.134.4.74: icmp_req=1 ttl=62 time=4.62 ms [19:30] thats my vdsl [19:30] nice [19:30] yeah so you're on fast path [19:30] it's close enough to 5 msec [19:31] yeah i am on the second best vdsl noise profile i think [19:31] looks like VDSL is only available where fios is [19:31] up_the_irons: happy birthday [19:31] it's like a fttn thing [19:31] they like to rip out your POTS wiring for FTTN [19:31] btw [19:31] do you have 10 megabit upload? [19:31] the copper going to your NID will be removed in favor of that GPON thing [19:31] except in cases where you have legacy land line for things like alarm dialers [19:32] m0unds: keep the copper! [19:32] i wouldn't let verizon touch my house [19:32] m0unds: tnx! [19:32] they also don't svc my area [19:32] https://encrypted.google.com/search?hl=en&q=verizon%20house%20fire [19:32] ^ [19:32] lol [19:32] oh up_the_irons you're on comcast right? [19:32] their installers have a history of drilling into elec utility, gas utility, sewage, etc [19:32] so you get to experience the comcast congestino for yourself :) [19:36] i am kind of curious what will happen with NZ domestic transit with all these fibre plans etc coming out, and the biggest isp not peering [19:36] mercutio: twc [19:36] up_the_irons: oh, so no issues to them? [19:37] not that i can tell [19:37] usually congestion issues are easily noticable with ssh [19:37] doo doo doo, i have this weird hourly spike at 37 past the hour [19:37] and it just hit [19:41] up_the_irons: any plans for the Comcast/Verizon/CentryLink issues? [19:41] I know you're busy, just wondering what you think it would be best to do next [19:42] NTT basically said "screw off" [19:43] can anyone come up with a Cisco route-map that says "if the route is from Verizon, set local pref to XXX" [19:43] or, "if route is from ASN 12345, set local pref" [19:43] i would prepend not set local pref [19:44] that could work too, i think.. [19:44] * staticsafe tries to remember CCNP route knowledge [19:45] yeh prepend works [19:45] and local preference is messier [19:45] mercutio: you had some other peer weighting idea earlier? [19:45] nah just prepepnding? i just think verizon, comcast, at&t should be prepepnded? [19:45] i usually prepend routes with cogent anywehere in them too [19:46] well, I'm not qualified, but I'll look into it [19:47] i've done it in zebra years back [19:47] but i been using openbgp recently [19:47] it's where you have match ip address ... you have to change it to the source-as [19:48] oh i remember my other weighting idea that was simpler now [19:49] just change the weight for level3/ntt [19:49] so if the as path length is the same it prefers levl3 [19:49] which means checking that the lengths are the same first [19:50] mercutio: change it to match the source as? [19:50] I found this [19:50] so if localpref, bgp path length, are the same, .. then weight can tip the balance [19:50] http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/49111-route-map-bestp.html [19:50] yea [19:51] so show ip bgp route 69.252.80.75 first [19:51] and check length is the same [19:51] comcast has that public route server if you want to look at fwd from comcast [19:51] would match as-path work? [19:52] yes [19:52] it's regexp frmo memory [19:52] you just put as 701 in the list, and match as-path and prepend if it matched? [19:53] then set as-path prepend [19:53] which is 25795 [19:54] hmm arp stopped advertising so many routes to me [19:55] i used to see the any2ix ones [19:56] i imagine that's since the routes shifted off the old router [19:57] ip as-path access-list crappylist permit _701_ [19:57] route-map crappymap permit [19:57] match as-path crappylist [19:57] as-path prepend 25795 [19:57] think you need someting more like ^.701$ [19:58] ah ok [19:58] it's not a directly connected peer, does _701_ mean something? [19:58] err mean anywehre [19:58] _: Matches a comma, left brace, right brace, the beginning of an input string, the end of an input string, or a space. [19:59] afaik, if as 701 is in the path, it will match, right? [19:59] and does set weight +1 work? [19:59] or do you haev to define weights [20:00] yeah i think that's the case [20:00] idk about this bgp stuff [20:00] but normally it's free anywhere [20:00] I'm just making it up [20:00] acutally it may be that it's only if it immediately ocnnected still [20:00] for as-path ? [20:00] and it's good practice to always do it based on 701$ or such [20:01] f you want only the networks that have passed through AS 4 to enter AS 3 from Router 3, you can apply an inbound filter on Router 3. [20:01] ip as-path access-list 1 permit _4_ [20:01] yeah so i think it does mean anywehre [20:02] If you want to deny all the networks that have originated in AS 4 and permit all other routes to enter AS 3 from Router 3, you can apply an inbound filter at Router 3, as follows: [20:02] ip as-path access-list 1 deny _4$ [20:02] ip as-path access-list 1 permit .* [20:02] oh cool [20:02] so that works [20:02] _701$ [20:02] yeah and _703 [20:02] actually [20:03] maybe just do _701_ and _703_ [20:03] and get them anywehre [20:03] as they are used as transit networks too [20:03] that would probably be best [20:03] we want to push everything that goes via Verizon over Level3 anyway [20:03] # bgpctl show rib transit-as 703 | wc -l [20:03] 34206 [20:03] # bgpctl show rib source-as 703 | wc -l [20:03] 167 [20:04] # bgpctl show rib transit-as 701 | wc -l [20:04] 30111 [20:04] # bgpctl show rib source-as 701 | wc -l [20:04] 2900 [20:04] kind of [20:04] well verizon is safer than most thinsg [20:04] as they're only in the US [20:04] but for instance, if verizon was in japan, it'd probably be better over ntt [20:05] as NTT is Japanese provider [20:05] but not if they still had crappy peering with NTT [20:05] primarily [20:05] hence the problem of traffic engineering by ASN alone [20:05] up_the_irons: which is why i say influence, rather than enforce [20:05] and more in favour of prepending, or setting weight, than setting local prefernce [20:06] up_the_irons: can you check the as path lengths? [20:07] i believe so [20:07] i'm not really a route-map guru, i just know the basics [20:09] heh [20:09] so bgp neighborhood [20:09] defines a group of routes? [20:09] like North America only? [20:09] show ip bgp route from memory [20:09] err show ip route [20:10] *bgp community? [20:10] the feds took everything, they even took my tr-808 maaaan [20:10] community is provider dependant, and usually tells you which country a route announces from [20:10] or where it's learned from [20:12] * erratic_ offers qfc cookies to channel [20:12] could you weight/prepend based on community? [20:12] and asn [20:13] to only weight/prepend Verizon routes in North America? [20:16] since i'm not a Verizon customer, i won't necessarily get their communities [20:18] ok, got it [20:20] acf: just do it on path, but yes you can [20:20] but you'd have to look at ntt's communitiys [20:20] that ntt say when something is learned from verizon [20:20] and the matching as path is less problematic [20:20] http://www.us.ntt.net/support/policy/routing.cfm#communities [20:21] verizon are only in north america i think [20:22] but communities for ntt for US learned routes appears to be 2914:10-- [20:23] according to [20:23] http://www.peeringdb.com/view.php?asn=701 [20:23] Geographic Scope: Global [20:24] it may be peering locations [20:24] I'd be less concerned about Comcast and CentutyLink though [20:24] but do they have customers overseas [20:24] oh hangon [20:24] duh verizon is alter.net [20:24] they're in new zealand even [20:24] yeah, so I think that would be a problem [20:24] or maybe it won't be? [20:24] i bet nz is bad too though via ntt [20:24] yeah [20:24] so Level3 is good anyway [20:25] for those routes too [20:25] i think it's 703 used in NZ [20:25] well we still need to check as path length [20:25] AS703 is marked as [20:25] Geographic Scope: Asia Pacific [20:26] fwiw [20:26] yeah and it's on peering port in nz [20:26] although it says 100 megabit haha [20:26] is it really? [20:26] no idea [20:26] that's kind of suckey [20:26] i'll see if they're on the route-servers [20:27] nah they're not [20:27] darn [20:27] pings of like 1 msec [20:27] so they're probably not even local to it [20:28] it's not varying much though [20:28] i'm so used to routers that vary pings heaps [20:28] verizon's seem to be okay actually [20:28] like ping a juniper and it's like 0.5 msec, 1.1 msec [20:44] *** wacker has joined #arpnetworks [20:53] this is cool [20:53] http://oreilly.com/catalog/bgp/chapter/ch06.html [20:53] Example 6-4: Setting the Local Preference depending on AS path [20:54] yeah that basically tells you how it works [20:54] prepending is in there too [20:56] match from 60.234.80.173 transit-as 174 set prepend-neighbor 1 [20:56] that's how you do it in openbgpd [20:56] i kind of like that way myself :) [20:56] *** novae has quit IRC (Ping timeout: 252 seconds) [20:57] up_the_irons: would you consider doing this? ^ [20:57] ip as-path access-list 4 permit _701_ [20:57] ip as-path access-list 4 deny .* [20:58] @up_the_irons ? can anyone come up with a Cisco route-map that says "if the route is from Verizon, set local pref to XXX" [20:58] route-map crappyisp permit 10 [20:58] set as-path prepend 25795 [20:58] that's the Cisco syntax afaik [20:59] *** novae has joined #arpnetworks [20:59] it's basically copied from that tutorial above [20:59] they usually have names [20:59] the access-list s? [20:59] yeah [20:59] ip as-path access-list crappyasns permit _701_ [21:00] permit 10 is a number normally [21:00] s/crappy/congested/ [21:00] ip as-path access-list congestedasns permit _701_ [21:00] fair enough [21:00] I'm looking at [21:00] Example 6-6: Prepending the AS path [21:01] and usui think you can stick the as-path straight in the route map too [21:01] but maybe having it in access list is better [21:01] idk. it didn't look like it in the cisco docs [21:01] http://www.cisco.com/c/en/us/td/docs/ios/iproute_bgp/command/reference/irg_book/irg_bgp3.pdf [21:02] Autonomous system path access list. An integer from 1 to 199. [21:02] oh [21:02] ok you're right :) [21:02] god i hate ciscso :) [21:03] I tend toward the junipers [21:05] does juniper implement weight? [21:05] Weight is a Cisco proprietary thing and cannot be used with a Juniper [21:05] device. Maybe you could use preference (not local-preference). [21:06] I don't do bgp with either one [21:06] ahh [21:06] I would definitely play around with it if I could get my hands on an ASN [21:07] you don't need an asn, you just need a router [21:07] just make up an ASN :) [21:07] and get a bgp feed [21:07] really? you can use a private asn? [21:07] how about IP announcements? [21:07] yes, you can't advertise any routes [21:07] but you can at least get a list of routes :) [21:08] you could advertise routes if the provider stripped off your asn, and you owned that IP block.. [21:08] there's some private ones [21:08] like 65020 [21:08] The first and last ASNs of the original 16-bit integers, namely 0 and 65535, and the last ASN of the 32-bit numbers, namely 4,294,967,295 are reserved and should not be used by operators. ASNs 64,512 to 65,534 of the original 16-bit AS range, and 4,200,000,000 to 4,294,967,294 of the 32-bit range are reserved for Private Use by RFC 6996, meaning they can be used internally but should not be announced to [21:08] the global Internet. All other ASNs are subject to assignment by IANA.2w [21:09] so private ASNs are like RFC1918 [21:09] yeh [21:09] i'm using a private asn somwehere [21:10] err i was [21:10] will providers (like HE or something) let you do BGP with their IP blocks? [21:10] ie, without an ARIN allocation [21:10] i was using 65461 [21:11] when i had bird on a private vm [21:11] nope [21:11] i don't thin so [21:11] i mean i don't think you can readvertise it [21:12] darn. so it's basically impossible for individuals to do BGP? [21:12] with ipv6 it's recommended to not advertise anything less than /32 to the itnernet [21:12] peering exchagnes are generally ok with /48s though [21:12] I was reading that [21:12] yeah most individuals doing bgp have legacy ip blocks [21:12] before it got insanely expensive [21:12] NTT says they're okay with /48 though [21:12] it depends how far it gets [21:13] mainly I guess ARIN just won't issue allocations to individuals [21:13] also, if someone else is advertising the /32 and you advertise the /48, and it can still go via the normal /32 [21:13] you shoudl be safe [21:13] i think arin will probably [21:13] you just need to form some kind of use case [21:13] start a vps business ors oemthing :/ [21:13] you also need $$$$ [21:13] I asked them actually :( [21:13] http://paste.unixcube.org/k/958025 [21:13] that too [21:14] oh so you nede registered business name [21:14] just start a company [21:14] is it easy there? [21:14] not sure, never done it [21:14] acf incorporated [21:15] lol if I could [21:16] anyway, you'd need more than one provider [21:16] you can often advertise providers addresses [21:16] you just need to get permission first. [21:17] I was thinking doing anycast might be fun [21:17] on ipv4 or ipv6? [21:17] so I could get providers in multiple locations [21:17] doesn't matter too much, just for experimenting with it [21:17] whatever is easier [21:18] i see [21:18] hostvirtual will do that on their own ip address space. [21:18] but they're some expensive setup fee [21:18] do that == let you announce their addresses? [21:18] or give you VMs in different places with anycast [21:20] hmm [21:20] "(includes LOA so it can be used outside of our network)" [21:20] http://pastebin.com/raw.php?i=TDuPg7vj [21:20] damn i hate captcha's [21:20] i got it wrong ilke 4 times [21:21] wow that's expensive [21:21] exactly [21:22] i think 2 is the best way to go [21:22] in general [21:22] but i think it's prohibitatively expensive [21:22] it'd be cool if arp could do that cheap when they get two locations, as i iamgine a few people would ilke to play [21:23] yeah, I was thinking about that actually [21:23] there's no way you can do less than a /24 [21:23] I'm sure it could be done pretty cheap [21:23] over all the customers [21:23] and he's charging $1/ip/month [21:23] you just have to announce one /24 in both locations, right? [21:23] so it'd be similar to $250/month cost for ip usage [21:23] yeah [21:24] but i'd want to be able to pull ip [21:24] there are various ways to go about that [21:25] what are those? [21:25] but you'd want to tunnel between locations [21:25] that's definitely what I'd do [21:25] bgp on virtual machine, a bgp trigger mechanism outside the virtual machien [21:25] so that when it's down it gets pulled [21:25] a host check that takes it out when it doesn't respond [21:26] but for it to continue working, you'd need to be able to reach between the virtual machine facilities [21:26] you could also have the same ip on more than one virtual machine in one location [21:26] you could do the whole thing with software load balancer and not actually have the /32 on the machines too [21:27] i think that in itself it wouldn't really make money if it was at affordable cost. [21:27] it's just a cool thing to do. [21:27] yeah, I see what you mean [21:27] it would be fun though [21:29] hmm, i have /24 at arp [21:33] if we could get a shared vlan it'd be kind of nifty to have local route-server that accept's private asn's, /30s, etc.. and to be able to advertise a /32 based on acl or such, that can be advertised frmo multiple locations [21:34] i mean in theory the backup network works for that atm, but that'd be kind of misuse of resources. [21:35] so, like an internal BGP network? [21:36] yeah [21:36] comedy option: pay jump.ro $50 for a /24 [21:37] i mean it's not like much traffic would go over it :) [21:37] but it lets you play a little [21:37] so it wouldn't be connected to the public internet, right? [21:37] yeah [21:38] sounds nifty [21:38] so the idea would be to encourage up_the_irons to have an opt-in vlan for talking betwen each other [21:38] would that be on a separate NIC? [21:38] nah [21:38] well separate virtual nic [21:38] right [21:39] I mean, that is what the backup network is right? [21:39] yeah [21:39] it'd be just like the backup network [21:40] maybe up_the_irons would just rename the 'backup network' to the 'internal inter-customer communication network' [21:41] i don't think that's a good idea [21:41] i think is good to keep it separate [21:41] yeah, I see your point [21:43] probably only 5 people would use it [21:44] it shouldn't be too difficult though [21:44] i think the biggest problem with the anycast thing is bandwidth accounting [21:45] is it done using SNMP now? [21:45] yeh [21:45] on the switch port [21:45] you would have to aggregate the data from the switches at both locations I guess [21:45] which means trafifc has to come through that port [21:45] but i was hoping that route-server traffic could be zero-rated :) [21:46] ah [21:46] I guess the backup network is? [21:46] yeh [21:47] any idea how that works for dedicated customers? [21:47] (ie, no virtual NICs) [21:47] so like right now, a limited ip address pool could be used for anycast from multiple servers [21:47] rather than locations [21:47] but you'd have to route via normal link for accounting to work [21:48] and maintain acl's so people don't advertise each other's ip's [21:48] oh I see [21:48] so you would advertize a /30 to the bgp router [21:48] from multiple boxen [21:48] well the /30 to route server is a bit different [21:49] as that would be just for sharing traffic [21:49] you advertise /32s for anycast normally [21:49] /32 ipv4? [21:49] yaeh for ipv4 [21:49] you'd probably do a /128 for ipv6 [21:50] but lots of people are using /64s [21:50] you could do either. [21:50] why use a /32 or /128? I didn't think you were supposed to do that [21:51] because they're floating ip's [21:51] ah [21:51] you don't reach anything else on the same network [21:51] you route to get to them [21:52] makes sense [21:52] so you'd have a route server with a /28 routed statically to it from arp [21:52] and we would all announce /32s to it [21:52] from different boxen? [21:52] yeah [21:52] that sounds easy enough [21:53] then when tehre's two locations, you have openvpn tunnel or such between them [21:53] so that traffic can come in from one location, and hit a box in the other location [21:53] right [21:54] but you still send outbound traffic normally [21:54] actually this is slightly more complicated. [21:54] as i'm pretty sure arp is filtering using random source ip's. [21:54] they are [21:54] I did a test a while ago :) [21:54] so you'd also need a bypass rule per customer to allow sending from that ip out their normal internet link [21:55] or perhaps just whitelist the blocks announced at both locatons? [21:55] or to use source-routing to send out route server [21:55] yeah [21:56] i actually haven't heard anything about the second location recently [21:56] I think up_the irons has been really busy with other stuff recently [21:57] we shouldn't say his name [21:57] it probably beeps :) [21:57] does it match without the second _? [21:57] no idea [21:57] oh i see what you didd there [22:09] i also have 202.49.64.0/24 advertised from my personal vm [22:09] which has bgp too [22:09] i did it on my personal vm first [22:10] but like 202.49.64.0/24 and 202.49.65.0/24 were basically not being used [22:10] oh oops :) [22:10] i meant to say it in private haha [22:10] but yeah i been doing anycast for a while [22:25] you have two /24's on a single vps?! [22:28] one is on vps and one is on dedicated [22:29] you nede to use /24 for anycast [22:52] not to worry mercutio : [FBI] has logged your ip prefixes for consumption by search engines and the like. :-) [22:53] haha [22:53] oh god does that mean i'll get more spam [22:53] trying to buy ip adddreses for spamming from [22:53] or "rent" [22:55] can i cull it somehow [22:56] for the coming ip shortage [23:19] *** acf_ has quit IRC (*.net *.split) [23:19] *** z310 has quit IRC (*.net *.split) [23:24] *** acf_ has joined #arpnetworks [23:24] *** z310 has joined #arpnetworks [23:41] acf_: i would consider it, but i don't know the "Cisco" way of doing it [23:43] the route-map syntax you mean? [23:43] acf figured it out [23:54] i didn't see an all-in-one paste [23:54] just some ideas [23:54] ahh ok [23:54] i'll find it [23:54] he should really have pastebin'ed it :) [23:56] http://pastebin.com/raw.php?i=B11AEnMd [23:57] erk that's missing a bit isn't it [23:58] it needs match as-path 4 [23:58] in the route-map bit