#arpnetworks 2014-07-09,Wed

BryceBot

Los Angeles, CA: Partly Cloudy ☁ 76°F (24°C), Humidity: 71%, Wind: From the WNW at 1.0 MPH Gusting to 10.0 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=34.059711,-118.256401 or re-request this with: @weather -v 90012

up_the_irons

@weather 91344

BryceBot

Granada Hills, CA: Clear 82°F (27°C), Humidity: 51%, Wind: From the SSE at 2.9 MPH Gusting to 4.9 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=34.287365,-118.484680 or re-request this with: @weather -v 91344

up_the_irons

6°F cooler at the office

brycec

up_the_irons: closer to the water too

[10:23]

dangel_

brycec: Feature request... noaa stations. :)

[10:23]

***

dangel_ is now known as dav

[10:23]

brycec

dav: Take it up with wunderground.com

[10:24]

dav

brycec: Copy that.

[10:24]

brycec

@weather San Joaquin Valley, CA

BryceBot

Multiple locations matched your query: San Diego International-Lindbergh, CA (zmw:92140.5.99999), San, ML (zmw:00000.1.61277),

brycec

Apparently wunderground hates the Sierra Nevada Mountains

dav

dav chuckles.

brycec

@weather Hanford, CA

[10:26]

BryceBot

Hanford, CA: Clear 82°F (28°C), Humidity: 50%, Wind: From the West at 2.7 MPH Gusting to 3.7 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=36.355957,-119.656898 or re-request this with: @weather -v Hanford, CA

[10:26]

brycec

Close enough
(Actually wunderground redirects to Lakeshore, CA for the lat/lon of CAZ096
@weather 37.29833,-119.10333

[10:26]

BryceBot

Lakeshore, CA: Clear 77°F (25°C), Humidity: 17%, Wind: From the East at 5 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=37.62405777,-118.83875275 or re-request this with: @weather -v 37.29833,-119.10333

[10:28]

dav

Oh! Coordinates work. Sweet.

[10:28]

brycec

I love that http://forecast.weather.gov/MapClick.php?zoneid=CAZ096 says it's -18C there

[10:28]

dav

Busted sensor I guess?

[10:29]

brycec

(coordinates need to be comma-separated, no spaces)
(again, that's just how wunderground works)

[10:29]

........ (idle for 35mn)

***

twobithacker has quit IRC (Quit: ZNC - http://znc.in)
twobithacker has joined #arpnetworks

[11:05]

..... (idle for 24mn)

tooth_ is now known as tooth

[11:33]

.......... (idle for 46mn)

jpalmer

wow, I haven't seen that in forever. someone joined a channel and instantly start begging for ops.
"Can I have ops, plz?"
up_the_irons: I can haz ops?!?! I need it to hang out in this channel! it's sooper important!!!11!11oneeleven

[12:19]

brycec

up_the_irons: CAN I OPS HAZ???????
Not that #arpnetworks needs more ops really
But I'm sure I would make a good op :p

[12:26]

staticsafe

staticsafe bans brycec from the internets

[12:27]

brycec

bawwwww :(

[12:27]

jpalmer

haha not just a k or g-line, an internet-line!

[12:28]

brycec

brycec instantly begins losing weight, now that he's not sitting 50% of the work day

[12:29]

mnathani

up_the_irons: hey, if everyone else gets ops, I would like ops too

[12:29]

jpalmer

+o for all. now we just need an eggdrop bot network!

[12:30]

brycec

#arpnetworks could do something like #devious does, +V users that are smart, well established, good community members etc (and +o for admins)
It's used as a means of saying "these people know what they're talking about, they aren't just random people spouting bad advice"

[12:32]

jpalmer

I don't know that it'd be necessary here. I really was just making fun of the fact that I hadn't seen that behavior in several years..

[12:34]

brycec

Heh yeah #arpnetworks seems to work just fine. Since it's pretty quiet in here, there's very little need for the "endorsement" of +V

[12:38]

mnathani

halfops would work for me : %

[12:42]

meingtsla

if only they existed on freenode

[12:51]

brycec

[13:01]

...... (idle for 27mn)

acf_

anybody else notice SIP brute forcing getting particularly bad?

[13:28]

m0unds

is that like ops for hobbits?

[13:28]

acf_

it just crashed asterisk

[13:29]

m0unds

no idea, i don't run any sip boxes connected to the internet without firewall rules or nat in front of them

[13:29]

acf_

probably wise
http://unixcube.org/who/acf/tmp/sipgraph.png
^ mostly SIP traffic
notice the outbound is significantly above the inbound in that last part
maybe a SIP amplification attack of some sort?

[13:29]

***

acf_ has quit IRC (Ping timeout: 240 seconds)

[13:43]

.... (idle for 15mn)

acf_ has joined #arpnetworks

[13:58]

acf_

up_the_irons: are you around?
m0unds: do you happen to have ARP metal?

[13:58]

up_the_irons

acf_: don't ask to ask, just ASK ;)

[14:03]

acf_

can you sign a new ipmi vpn cert for me please? :/
I forgot the passphrase

[14:04]

up_the_irons

yeah, send the csr to support@

[14:04]

acf_

thanks

[14:04]

m0unds

acf_: nope

[14:13]

..... (idle for 22mn)

acf_

up_the_irons: okay, I've sent it

[14:35]

brycec

I've seen nasty SIP brute forcing too, at the firewall :P

[14:43]

acf_

how do you firewall your sip?

[14:43]

brycec

Sorry that it's chewing up so much of your bandwidth acf_
acf_: One of two approaches. 1) Only open ports for specific hosts, 2) Fail2Ban

[14:43]

acf_

hm. I guess it's option 2 for me

m0unds

fail2booooooooooo

brycec

acf_: why not #1?

acf_

SIP clients on dynamic addresses
unless there is some other way to restrict based on host?

brycec

*how* dynamic? I have clients whose IPs only change once a blue moon. Others I have the client update a dyndns host and pf refreshes from that hourly.

[14:45]

acf_

Comcast dynamic IP
also cellular network
that's what I'm most worried about

[14:45]

brycec

Comcast - once a month at most
Cellular... blech
acf_: you could run SIP on a non-standard port too

[14:45]

acf_

I was thinking about that

[14:46]

m0unds

vpn :D

[14:46]

brycec

VPN is a perfect solution, if you have perfect users.

[14:46]

acf_

VPN would be great, except for mobile devices

brycec

[mobile devices do VPN...]

acf_

have you had any experience with VPN on mobile devices?
I haven't...

brycec

Yes

acf_

but it seems like it could be bad

brycec

OpenVPN, l2tp, and ipsec

m0unds

it's fine
i've used l2tp and ipsec

brycec

oh and pptp

m0unds

ugh
yuck

acf_

I'll have to try that

brycec

m0unds: PPTP still easiest for $users to setup and configure

acf_

and comments on device support?

brycec

For a simple voice VPN, I wasn't too worried

acf_

Android, Symbian, iOS, etc...

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cumc/7_1/english/BlackBerry/installation_user_guide/install_user_guide/calls.pdf

brycec

I can say for certain that Android and iOS do PPTP and L2TP+IPsec natively.
Android has good OpenVPN client support
(last I checked, iOS had to be jailbroken for opencpn)

[14:49]

acf_

apparently Symbian supports PPTP also
I might try that

[14:50]

brycec

PPTP isn't the most secure, but it's simplest (username+password) and "good enough" for a simple voice vpn
Plus with VPN, you don't have to deal with NAT issues

[14:50]

acf_

have you any experience with voip handoff between wifi and 3g?
ie, you go in range of wifi, phone connects, drops call

[14:51]

brycec

If it's in a VPN, you're just waiting for the VPN tunnel to reesatablish
but if that's quick, the call stays up and nobody notices.

[14:51]

m0unds

i typically just dump sip calls to my phone# directly
if i don't answer my ext

[14:52]

acf_

how about outbound calls? the cid gets all messed up...

[14:52]

m0unds

i just block my outbound cid
and dial from my phone

[14:52]

acf_

[14:53]

m0unds

if the call recipient went through the trouble to block anonymous calls, they can wait til i get to the office
haha

[14:53]

brycec

m0unds++ on all points
In theory you can setup a DISA, call the PBX and then route back out
Or just *67

[15:03]

acf_

I've been looking for a way to do that cleanly for a long time
ie, click on a contact, it dials the PBX, etc...

[15:04]

brycec

There are craploads of click2call
Many of them work well, even

[15:04]

acf_

not for Symbian users :/

[15:05]

m0unds

a buddy of mine did that to allow him to dial in to his PBX to have outbound calls routed via his toll-free
whoa, symbian?

[15:05]

brycec

acf_: if the Symbian user is just a cellphone, then what does it matter?
ie you click the link on your computer, the PBX calls your phone (the Symbian or whatever) and when you pickup and confirm, then the PBX bridges that to an outbound call to $wherever
A phone call is a phone call, regardless of the receiving device.

[15:05]

acf_

ah yes
I was hoping for some tighter integration
so that you can initiate the call using the built in ui and it just works

[15:06]

brycec

acf_: i seem to recall that Blackberry (because that's what I used at the time) had a means to program a prefix so you could dial through the office phone system
To do just that
No idea if Android etc can do that nowadays

[15:07]

acf_

yeah. any idea what that's called? my google searches have yeilded nothing...

[15:08]

brycec

In theory though, you can just prefix the destination with 1800mypbx{pauses}$disaextension{pause}
prefix dialing i think

[15:08]

acf_

ok cool

[15:09]

brycec

or "dial via office"

obviously that's the blackberry specific stuff :p[

[15:09]

acf_

yeah

[15:10]

brycec

but you could google for $platform dial via office
looks like Android uses a Cisco app for it
Symbian seems to be left with click2call/"reverse callback"

[15:10]

acf_

that's what I was afraid of
I wonder if GSM/UMTS has any out-of-band signalling capabilities at call setup
you could change the software stack to dial a fixed number, and signal the actual number to dial

[15:11]

brycec

Besides the messaging layer that SMS is built atop?

[15:13]

acf_

I guess that could work

[15:13]

brycec

I don't know if it supports that function specifically though
Maybe that's what this "fixed dialing numbers" stuff is about
on second though, FDN wouldn't solve the problem

[15:13]

acf_

I'm kind of surprised that the telecoms don't have services that allow easy integration into PBXes

brycec

It's not the telecoms prerogative

acf_

it seems like it would be a useful service for companies that use cell phones

brycec

it's Android/WinMo/Symbian
And companies that use cellphones also use Cisco (with their own Android app), or Blackberries (builtin)

staticsafe

who uses Symbian anymore

acf_

Europe

brycec

(Lync might even have an 'app' hook to do it)

staticsafe

really now

brycec

Europe is a myth

acf_

well, yeah
people are moving away from it

[15:17]

m0unds

4.4% global market share as of 2012 according to wookiepedia

[15:17]

acf_

that's not too bad
4 out of every 100 cell phones are Symbian
up_the_irons: still around?

[15:18]

brycec

acf_: BTW the SIP brute forcing should be somewhat limited already http://support.arpnetworks.com/kb/main/is-there-a-firewall-filter-rate-limit-or-similar-device-applied-to-my-traffic
Unless ^ doesn't apply to Metal customers

[15:21]

acf_

I think I had that removed a while ago
so I could run OpenVPN instances on non-standard ports

brycec

btw acf_ I can't resolve your unixcube.org

acf_

I know
:/
bad things happened

m0unds

uh oh

staticsafe

o_o

brycec

so I can't even see that graph you linked :p

acf_

I'm waiting for up_the_irons to sign me a VPN cert so I can get a console

[15:23]

brycec

that's weird... ns[0123].unixcube.org should have entries in the DNS root to be proper "nameservers"

[15:23]

acf_

they don't?
hm

[15:24]

brycec

don't seem to
I'm only cursorily investigating

[15:24]

acf_

brycec: you wouldn't happen to have arp metal would you?

staticsafe

brycec: you mean glue?

brycec

sorry acf_

acf_

aww

m0unds

they should just call them horse records

brycec

acf_: scratch that, the records are there, but dig was being stupid

acf_

ah, that's good

[15:26]

brycec

staticsafe: I meant A records for the nameserver entries

[15:26]

acf_

is there a way to do a broadcast ipv6 ping?

[15:37]

staticsafe

ping6 ff02::1%$interfacename
(not broadcast as that is not really a thing in IPv6)
that is the All nodes on the local network segment address
multicast all the things!

[15:38]

acf_

hm
so my ARP metal box lost network

m0unds

there's a moron who used to work here who couldn't grasp the word "multicast"
he always used to refer to it as "multitask"
drove me nuts

staticsafe

o_o

acf_

that's great
sending multitask packets

m0unds

that's what happens when you bolt people with no networking experience (VCR + DVR + analog video) into an updated position where it's important to know it

[15:41]

acf_

I have a VPS on the same logical network
shouldn't I be able to ssh into it via its IPv6 link local address?

[15:41]

staticsafe

"what do you mean by converged network?!"
"voice, video and internets on the same network?!"

[15:42]

brycec

Yes, acf_

[15:42]

acf_

or is there some case where the interface could lose its link local address

staticsafe

brycec

If it's down or unconfigured...

staticsafe

well that

acf_

so here's what happened:
IPv4 things broke
I ran /etc/init.d/networking restart in Debian
^ bad idea
IPv6 things broke

brycec

acf_: and you don't have IPMI console up yet?

[15:44]

acf_

no
I used to
if I had an IPMI console, I could just reconfigure the interfaces

[15:44]

m0unds

staticsafe: he thought that i assigned ip addresses for devices purely based on the port on the switch that they're connected to

[15:45]

brycec

acf_: I assume console.cust.arpnetworks.com doesn't tie in to any physical serial port or whatnot?

[15:45]

m0unds

like..with analog video, there's an electrical signal chain you have to follow or you won't get video on the far end. he htought that's how an ip network functions, haha

staticsafe

heh

brycec

When you put it that way, it's not illogical, just wrong.

m0unds

right

acf_

brycec: unfortunately it doesn't appear so

m0unds

but he'd argue it as truth
and would actively refuse or reject explanation to the contrary :)
also, i think i'm giving him too much credit w/the signal thing. he didn't really understand how that worked either, just that if he put a camera on a cable, and plugged the cable in, it would show up
this is why he's no longer here..that and he was offered an enormous $250 sign on bonus to work for a company that repairs automatic card shufflers

brycec

Wow a whole $250?

[15:49]

m0unds

yup
gave up ~$3800/yr in benefits, 10hrs/period of PTO and 4 day set schedule for $250

[15:51]

brycec

m0unds: is he doing the repairs? or he's doing IT for them?

m0unds

repairs
so it's better for him

brycec

Sounds like it

m0unds

i do X because Y is broken
also, i rarely see him which is great for my mental health
hahaha

http://i.imgur.com/nQdjKIp.png

............... (idle for 1h11mn)

http://i.imgur.com/KAD0QvN.png this graph is depressing
although, the one day where there was no real spike was the 4th of july

[17:06]

acf_

yeah
that's Comcast right?

[17:06]

m0unds

yep

[17:07]

acf_

I think he was willing to try and reroute some Verizon routes
don't think it's happened yet though
up_the_irons that is

[17:07]

m0unds

acf_

what's that?

m0unds

cut over to a different box running the same services

acf_

m0unds

i was kind of hoping that whatever party is causing congestion would lay off at some point

[17:11]

acf_

nope

[17:11]

m0unds

i haven't been able to figure out what common svcs traverse ntt via comcast

[17:11]

acf_

not too many from the looks of it

m0unds

netflix doesn't, hulu doesn't, amazon vod doesn't, xbox live/video doesn't, psn doesn't

acf_

bigger providers likely have monitoring systems in place for all of the major ISPs
and reroute traffic accordingly

m0unds

well, the ones i mentioned have peering arrangements w/comcast

acf_

that's why Amazon has such great connectivity I think
not Amazon
(I think)
oh maybe they do
they don't with Verizon though

m0unds

the ELB addresses i've seen w/VOD do for sure
and just checking an east coast AZ EC2 instance, it's comcast -> amazon directly

[17:13]

acf_

yeah I see that here too
Amazon appears to have direct peering with HE too
it was a bit congested last time I checked my smokeping
I was surprised

[17:14]

m0unds

does it seem like they use ntt to reach vz?

[17:15]

acf_

I can't check atm

[17:15]

m0unds

[17:16]

acf_

but a while ago it seems they used NTT for the forward path (from me)
I can't remember the reverse path, but I think it was via Telia or something

[17:16]

m0unds

NTT is their #2 v4 peer according to bgp.he.net (amzn)

[17:17]

acf_

what AS are you looking at?

[17:18]

m0unds

16509

[17:18]

acf_

I see
Telia is #4
Level3 is #8

[17:18]

m0unds

yea, -z flag on mtr is handy
mtr -z4 somev4host.domain.tld

[17:19]

acf_

ah, didn't think to try that

[17:19]

................... (idle for 1h30mn)

brycec

m0unds: what does the -z flag do? And what version of mtr?
mtr 0.82 (Debian Wheezy) only has -hvrwctglspniu46

[18:49]

m0unds

oh
-z does ASN lookups

[18:50]

acf_

but it doesn't work with the GTK GUI

m0unds

i'm on .85

acf_

same here

m0unds

doesn't bother me, i just use mtr in a temrinal
...
temrinal? really?

acf_

for some reason it defaults to GTK for me unless I specify --curses

[18:52]

m0unds

http://pastebin.com/K35UgeWz
brycec: ^
curses
CURSES

[18:52]

acf_

NCURSES
actually
anyone know about what time up_the irons gets back?

[18:54]

brycec

Ah m0unds has a newer mtr
I was hoping someone would port that from traceroute
Nice to see that it has been

[18:55]

acf_

yeah
I think I looked for that option in the man page a while ago and didn't see it
so I had to revert to traceroute if I needed AS lookups

[18:56]

brycec

damn not in wheezy-backports
m0unds: Out of curiosity, what OS is that on? Or did you compile from source?

[18:57]

acf_

I use Debian jessie
it's stable enough for me :D

[18:58]

m0unds

brycec: netbsd 6.1.4
same v on freebsd 10
so installed via pkgin or from ports respectively
.85 on 14.04 LTS too (just looked)

[18:58]

brycec

Cool
thank you

[18:59]

m0unds

sho 'nuff

[18:59]

acf_

so basically everything has mtr 0.85 except debian stable

[19:00]

brycec

Which is typical
I'm surprised at the lack of a backport for it though

[19:00]

m0unds

haha
what version of nginx is debian stable on?

[19:00]

acf_

Source Package: nginx (1.2.1-2.2+wheezy2)

[19:01]

m0unds

oh, that's not too bad
better than i figured
haha

[19:01]

acf_

for jessie: Package: nginx (1.6.0-1)

[19:01]

brycec

^ and wheezy-backports

[19:02]

m0unds

nginx version: nginx/1.5.12 netbsd, and 1.6.0 for freebsd

[19:02]

brycec

When is jessie going to be released as stable, anyone know?
brycec asked Google and simply got https://www.debian.org/releases/testing/

[19:02]

acf_

I guess they don't define a date
I think at some point they freeze everything, so that only bugs can be patched (no package version upgrades)

[19:03]

m0unds

dates are for suckers maaaaaaaaaan

[19:04]

acf_

and when everything passes QA, they release it
if I set my distribution to "testing" in /etc/apt/sources.list
every time they do a release, sid goes into testing
and I end up upgrading to it :/

[19:04]

brycec

Freeze is Nov 5 https://release.debian.org/jessie/freeze_policy.html
lol

[19:04]

m0unds

so..soon? haha

brycec

m0unds: they're aiming for January

m0unds

m0unds doesn't know much about debian

brycec

or maybe Feb?
I'm not too clear on their release policy either
But I do know that it won't be this year