***: brycec is now known as bryces_mom
bryces_mom is now known as brycec
mus1cbox has joined #arpnetworks
mus1cbox: can anyone think of why all of a sudden i started getting port 22: Connection refused when trying to ssh into my vps?
i haven't made any recent pf rule changes, and i can ping it
***: dj_goku_ has joined #arpnetworks
dj_goku_ has quit IRC (Changing host)
dj_goku_ has joined #arpnetworks
dj_goku has quit IRC (*.net *.split)
novae has left
RandalSchwartz: linux?
some linux are set up with an autothrottle... too many failures and the port is shut down for a while.
that's part of why I don't run sshd on 22 any more
I use a high port
it's too expensive to do a full netscan on high ports to see if there's an sshd
when so many people run them on 22
mercutio: i don't think it usually connection refuses, i think it usually just accepts and disconnects?
there may be ssh rate limit though
up_the_irons: mus1cbox: http://support.arpnetworks.com/kb/main/is-there-a-firewall-filter-rate-limit-or-similar-device-applied-to-my-traffic
mercutio: hmm that's per ip, so he'd have to be doing 15 connections within 60 seconds from his ip to hit that.
you can actually easily configure opensshd to listen on multiple ports too
RandalSchwartz: Yup
I just stopped listening to 22 because I was tired of, as Steve Gibson puts it, listening to the "background radiation" of the net
mercutio: i prefer ip acl's.
RandalSchwartz: if I ever knew where I was sshing from... sure.
mercutio: well yeah it doesn't work if you ssh from random locaitons
RandalSchwartz: "nomad" is my middle name
which looks weird on my passport yes.
mercutio: then maybe running on port 443 would help you
RandalSchwartz: yeah, I actually do that for one box
so I can tunnel through https firewall
mercutio: i'm dumping on an unused ip
i haven't seen anything yet
RandalSchwartz: CONNECT some.box:443
mercutio: dropbears easy bouncing can be handy
RandalSchwartz: socat can do it on the command line :)
mercutio: telnet scan
from turkey.
then sip scan from US
open sip server is scarier than open ssh server.
***: dj_goku_ has quit IRC (Ping timeout: 245 seconds)
dj_goku has joined #arpnetworks
dj_goku has quit IRC (Ping timeout: 246 seconds)
dj_goku has joined #arpnetworks
dj_goku has quit IRC (Changing host)
dj_goku has joined #arpnetworks
dj_goku has quit IRC (Read error: No route to host)
dj_goku has joined #arpnetworks
dj_goku has quit IRC (Changing host)
dj_goku has joined #arpnetworks
mnathani_: Does any of this mean my unmanaged / dumb switch has spanning tree? 802.3, 802.3u, 802.3ab, 802.3x, 802.1P
also 802.1P QoS
***: dj_goku has quit IRC (Ping timeout: 244 seconds)
dj_goku has joined #arpnetworks
dj_goku has quit IRC (Changing host)
dj_goku has joined #arpnetworks
mercutio: don't think so
having qos seems curious though
http://en.wikipedia.org/wiki/IEEE_802.1D
BryceBot: IEEE 802.1D :: 802.1D is the IEEE MAC Bridges standard which includes Bridging, Spanning Tree and others. It is standardized by the IEEE 802.1 working group. It includes details specific to linking many of the other 802 projects including the widely deployed 802.3 (ethernet), 802.11 (Wi-Fi) and 802.16 (WiMax) standards. VLAN (virtual LAN) is not part of 802.1D, but specified in 802.1Q. Publishing history: 1990 — Original publication...
mercutio: think that's what you're looknuig for
mnathani_: mercutio: thanks
mercutio: mnathani_: you shouldn't need stp anyway.
mnathani_: I like loop detection / automatic blockiing
mercutio: does it do snmp?
mnathani_: doubt it
mercutio: maybe you can trigger on high packet counts.
i suppose you could awlays get a manged switch
mnathani_: it cost like $35 - 8 port gigabit unmanaged
mercutio: i'm using a cheap managed switch that has stp
mnathani_: brand?
mercutio: edgecore
ECS2000-26T
there's a few similar ones to that though
fanless 24 port gigabit+2 sfp
low power usage, minimal management
mnathani_: http://www.edge-core.com/ProdDtl.asp?sno=393&ECS4210-28T
I was going to guess ^
mercutio: i think the one you linked is newer
http://www.amazon.com/Cisco-SG200-26-Ethernet-Mini-GBIC-SLM2024T/dp/B004GHMU5G/ref=sr_1_2?ie=UTF8&qid=1423719865&sr=8-2&keywords=26++port+managed+switch
BryceBot: Amazon: "Cisco SG200-26 Gigabit Ethernet Smart Switch with 24 10/100/1000 Ports and 2 Combo Mini-GBIC Ports (SLM2024T)"
mercutio: i think that does stp
maybe the 8 port one does even
oh i can do sflow
huh it has upnp too
why would upnp be ona layer 2 switch?
wow it even has dual firmware versions on it
http://www.edge-core.com/qapage.asp?sno=138
that's kind of cool
not that i need it
mnathani_: your Amazon switch: Shipping: Currently, item can be shipped only within the U.S.
mercutio: which item was that?
mnathani_: Cisco SG200-26 Gigabit Ethernet Smart Switch
mercutio: there's cheap ram on amazon atm btw
ahh
did you want that many ports?
mnathani_: 16 should be plenty
mercutio: did you want sfp?
mnathani_: no need for sfp
mercutio: http://www.amazon.com/TP-LINK-TL-SG3210-10-port-Pure-Gigabit-1000Mbps/dp/B006B7R3YC/ref=sr_1_11?ie=UTF8&qid=1423721081&sr=8-11&keywords=managed+switch
BryceBot: Amazon: "TP-LINK TL-SG3210 10-port Pure-Gigabit L2 Managed Switch, 8 10/100/1000Mbps ports, 2 Gigabit SFP slots"
mercutio: this switch is cheaper
mnathani_: however my mikrotik came with one sfp
BryceBot: That's what she said!!
mercutio: dunno if that hips to you
it doesn't ship to me
you can use direct attach cables for like $10
but limited length
so yeah there's a few options for cheapish managed switches now
they usually have terrible interfaces
but if you just setup and forget it's probably a non issue really
mnathani_: this is the one I have now: http://www.amazon.com/dp/B00A121WN6/ref=psdc_281414_t3_B006B7R3YC
BryceBot: Amazon: "TP-LINK TL-SG108 8-Port 10/100/1000Mbps Desktop Gigabit Steel Cased Switch, IEEE 802.1p QoS, Up to 72% Power Saving"
mercutio: it used to be that all the managed switches had fans
which put me off
because tehy're always tiny fans
that has tiny buffer
you'll probably find most managed switches have slightly bigger buffers
and it used to be only netgear had cheap managed switch
then they had a newer version which was worse
mnathani_: whats the highest throughput one can expect across a gigabit link - server to server?
mercutio: i get a little over 970 megabit i think
with linux to linux
but i disable tcp time stamps
but yeah with 1.5k mtu it's around 970 megabit.
i seem to recall at least.
mnathani_: @wa 970 megabits per second to megabytes per second
mercutio: some ethernets do lower
BryceBot: convert 970 Mb/s (megabits per second) to megabytes per second;121.3 MB/s (megabytes per second);0.97 Gb/s (gigabits per second);9.7×10^8 b/s (bits per second);~~ 0.78 × OC24 speed ( 1.244×10^9 b/s );~~ 0.97 × 1000BASE-T speed ( 1 Gb/s );~~ OC18 speed ( 9.331×10^8 b/s );information rate;[time]^(-1) [information];Time to transfer 1 gigabyte:, ->8.2 seconds, ->0.14 minutes;Time to transfer 1 terabyte:, ->8247 seconds, ->137 minu
mercutio: err some cards
[ 4] 0.0-10.0 sec 1.09 GBytes 938 Mbits/sec
this is one random test
maybe i had higher mtu
mnathani_: @wa 938 megabits per second to megabytes per second
BryceBot: convert 938 Mb/s (megabits per second) to megabytes per second;117.3 MB/s (megabytes per second);0.938 Gb/s (gigabits per second);9.38×10^8 b/s (bits per second);~~ 0.94 × 1000BASE-T speed ( 1 Gb/s );~~ OC18 speed ( 9.331×10^8 b/s );~~ 1.2 × FireWire (IEEE 1394b) 800 speed ( 786432 kb/s );information rate;[time]^(-1) [information];Time to transfer 1 gigabyte:, ->8.5 seconds, ->0.14 minutes;Time to transfer 1 terabyte:, ->8529 se
mercutio: i used to think ethernet had higher latency than it does.
but a lot of it's the cards, computer etc.
like you can do 50 micro seconds latency for ethernet
but it's still common to see over 0.1 msec
on intel cards changing ethtool can help
and linux's scheduling seems to help with ping -f
realtek don't do colaescing so lower delay, and higher overhead.
but anyway, at high speeds it's easy to get a drop in performance from packet loss
and larger queue sizes can decrease the chance of that happening, but can also increase jitter
but you can use fq_codel in linux to not go faster than gig and so point to ponit is fine
but multi point to point can still suck
it only matters if you're sharing between file server and internet on the pipe
and you can always just rate limit file server to 900 megabit or something
http://www.amazon.com/Cisco-SG200-26-Ethernet-Mini-GBIC-SLM2024T/dp/B004GHMU5G/ref=sr_1_2?ie=UTF8&qid=1423719865&sr=8-2&keywords=26++port+managed+switch
BryceBot: Amazon: "Cisco SG200-26 Gigabit Ethernet Smart Switch with 24 10/100/1000 Ports and 2 Combo Mini-GBIC Ports (SLM2024T)"
mercutio: this says it ships to me
oh
it doesn't link the 8 port
i mean the $88.99 one
adn it seems to suggest it still supports stp on cisco's site
but amazon comments semeed to suggest annoying firmware issues
http://www.amazon.com/NETGEAR-ProSAFE-GS108T-Gigabit-1000Mbps/dp/B003KP8VSK/ref=pd_cp_e_2
BryceBot: Amazon: "NETGEAR ProSAFE GS108T 8-Port Gigabit Smart Switch 10/100/1000Mbps"
mercutio: even this says stp support
mnathani_: lol @ "2)Breaking UDP is unacceptable, as its widely used."
BryceBot: That's what she said!!
mercutio: but it's netgear so it may be crap
yeah i hadn't notice that when i mentioned it mnathani_ :)
i assumei t's one of their linksys products.
mnathani_: why would they deliberately cheapen their brand by using the cisco name on inferior products?
mercutio: i dunno
do you remember how bad linksys modems were?
maybe they weren't around there
but they were terrible here.
but the linksys phones were fine.
mnathani_: all I seem to recall Linksys related were there wrt54 line of wireless routers
mercutio: newegg rates that netgear switch low
the ones that overheated?
and people ranted and raved about being able to run custom firmware.
the default firmware sucked :/
tp-link routers have terrible firmware too.
but their hardware seems to be "surprisingly good"
and their price is always great.
i took a gamble with my switch
there were like no reviews around
http://www.amazon.com/TP-LINK-TL-SG108E-8-Port-Gigabit-Tag-Based/dp/B00K4DS5KU/ref=sr_1_33?s=pc&ie=UTF8&qid=1423722704&sr=1-33
BryceBot: Amazon: "TP-LINK TL-SG108E 8-Port Gigabit Easy Smart Switch with 8 10/100/1000 Mbps RJ45 Ports, MTU/Port/Tag-Based VLAN, QoS and IGMP"
mercutio: that says it has loop protection too
hangon isn't that what you had
mnathani_: TP-LINK TL-SG108
no E at the end
mercutio: ahh
yeh so it still has short queue length
but it allows port mirroring and loop protection
mnathani_: the one you linked?
or the one I have
mercutio: 108E
there's table down the bottom
it includes your one too
it doesn't have a web based gui too
i don't think it supports lacp either
i don't know if you want to do lacp
http://www.amazon.com/dp/B009LEJJM6/ref=psdc_281414_t3_B00K4DS67C
BryceBot: Amazon: "TP-LINK TL-SG2216 16-Port Gigabit Smart Switch with 2 Combo SFP Slots, 802.1Q VLAN, L2/L3/L4 QoS, IGMP Snooping, Port Security, Storm Control, Web-based Management"
mercutio: what about this one?
mnathani_: I like that one
managed, gigabit, under $200
mercutio: it also does port mirroring
and snmp
lacp
i can't see sflow support :/
mnathani_: is sflow kind of like netflow?
mercutio: yeah
except it's not usually every packet
oh rmon is like sflow too apparently
oh but it doesn't do the useful groups :/
mnathani_: can windows do lacp / link aggregation
mercutio: yeah
but you need two connections normally
mnathani_: server OS only?
mercutio: don't think so
http://hardforum.com/showthread.php?t=1762818
so yeah you need proper network drivers.
oh the switch can store a network key :)
for ssh
mnathani_: nice
mercutio: http://www.tp-link.com/resources/document/TL-SG2216_V2_UG.pdf
hmm it can do dhcp filtering too
mnathani_: the doc / manual is quite extensive
mercutio: they're all like that
mnathani_: explains stuff + theory with diagrams etc
mercutio: one guy was complaining about vxworks having security vulnerabilities
but i think most of them are like that too
oh my switch has ssh too
Welcome to Vitesse Command Line Interface (v1.0).
dunno what that is :)
brycec: FWIW I have a TP-Link TL-SG2424 I've been quite happy with.
mercutio: is that the same series?
brycec: (24 GbE w/4 SFP, fully managed, etc)
mercutio: dyeah looks same specs but sfp
brycec: I'd say a similar series
mercutio: oh and still fanless
brycec: how bad is the web interface?
brycec: mercutio: It's meh
No worse than netgear's
mercutio: that's not saying anything :)
netgear are bottomo f the barrel :)
brycec: I prefer it to its commandline, but that's not saying much either.
mercutio: heh
but stability is fine?
brycec: I'd disagree, but the only managed switches I've ever admin'd were Netgear (7326 and 7?24) and this TP-Link
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (1099870606) 127 days, 7:11:46.06
mercutio: ahh you're doing snmp to it :)
brycec: (I am because otherwise I'd have to proxy to get to its web interface, but I have ssh on a machine local to it)
mercutio: oh the web interface says uptime
System Uptime217d 18:37:03
my computers definitely have lower uptime than that :)
brycec: It's crashed just once in its 1+ years. It was overloaded due to a loop I'd introduced, before I'd setup loop detection / rSTP
mercutio: i've only used one buggy switch
brycec: (And that was on a previous firmware too)
mercutio: and it would bug out again and again
but only when configing things
was still damn annoying
it was to do with vlan config
heh i saw my switch has new firmware, but no changelog
i'm not really racing to update it
brycec: This switch isn't doing too much, bunch of vlan tagging, igmp snooping (both v4 and v6), basic broadcast throttling and STP / loop detection (off the top of my head)
mercutio: yeah most people don't even use vlans
brycec: I like the TP-link has native ipv6 support
mercutio: i'm not using vlans atm
-: brycec <3 VLANs
mercutio: for management?
brycec: Even for such simple things as wifi network as guests, all of that ssid traffic is pushed to a dedicated vlan
mercutio: hmm
yeah that's a nice idea
i wonder if i can do that
brycec: I don't see why not.. but I have no idea what equipment you have :P
mercutio: tp-link ac1750
i can't see it
i could just use separate router for guest wireless
brycec: Is this at all relevant? http://www.tp-link.com/en/article/?faqid=418
mercutio: well yeah i saw that
but i can't see anything like that in the web ui :)
i could just stick openwrt on it :)
i have it on the secondary anyway
brycec: Well then ditch the stock fw and put something like openwrt on it :p
lol
***: jlgaddis has quit IRC (Ping timeout: 250 seconds)
jlgaddis has joined #arpnetworks
vissborg has quit IRC (Remote host closed the connection)
vissborg has joined #arpnetworks
mercutio: apparently cisco has announced 2.5 gigabit ethernet support now
http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/catalyst-multigigabit-switching/multigigabit-ethernet-technology.pdf