Archive for the ‘Networking’ Category

Venting

3 Comments

Fuck ATM. Seriously, who the fuck uses that anymore?

RCOB

0 Comments

I got this link in my inbox today. Head over there if you feel like testing the pressure seals on your arteries. At a time when our national debt is skyrocketing out of control, a time when ISPs are struggling to meet our margins because people have decided that high speed internet isn’t as important as, say, food or shelter, the Federal Government wants to help us all get broadband internet! Let’s see what they’re on about.

Goal 1: At least 100 million U.S. homes should have affordable access to actual download speeds of at least 100 megabits per second and actual upload speeds of at least 50 megabits per second.

Well, at least it’s only 1/3 of the population. DOCSIS3 cable is technically capable of providing those speeds, but not with any kind of guarantee and not with a high oversubscription rate. Fiber to the home can do it a lot more easily, but not affordably except in areas with a relatively high population density. It’s branching out, but you’re still not going to see folks in Sedona, AZ with FTTH for at least a few years, probably longer if the current recession continues.

Goal 2: The United States should lead the world in mobile innovation, with the fastest and most extensive wireless networks of any nation.

Great idea. I’d love to see how we’re going to pay for it.

Goal 3: Every American should have affordable access to robust broadband service, and the means and skills to subscribe if they so choose.

I don’t even know what this means. There are a number of Federal subsidies to encourage ISPs to build their networks out into otherwise unprofitable and remote areas, but are they also suggesting that we help people finance their internet connections?

Goal 4: Every community should have affordable access to at least 1 Gbps broadband service to anchor institutions such as schools, hospitals and government buildings.

This one is actually doable. As long as we’re building leagues of (government subsidized) fiber across the US, it’s trivially easy to get 1Gbps service for any given city. The cost is only a few thousands of dollars per site compared to the millions required for the other goals. The ISP that I work for provides Metro Ethernet to a large number of cities, schools, and hospitals.

Goal 5: To ensure the safety of Americans, every first responder should have access to a nationwide public safety wireless network.

And, folks, here is the real goal. The Government would like to turn Internet access into a public utility so that they can regulate it like one. It will be done under the guises of “safety” and “fairness.” Innovation in the Internet sector will slow to a halt as it comes under increasingly byzantine regulation, drafted by people who couldn’t tell you the difference between a bit and a byte and think a “firewall” is a bad movie starring Harrison Ford.

Goal 6: To ensure that America leads in the clean energy economy, every American should be able to use broadband to track and manage their real-time energy consumption.

This is just bullshit environmental fuzziness to gloss over the “safety” they just shoved up your internet tubes.

Here’s the deal.

The Internet is not a basic human right. It’s awesome (in the original sense), I love it, and it keeps me employed. But it’s optional. It’s a luxury, just like cable TV or owning a car. The Internet, cable, and cars are useful tools. They make us more productive, they can help us stay informed, and an informed population is a more free population, but we don’t have the money to give everyone in the country free Internet, free cable, or free cars. Trust me when I say that we also don’t have the money to subsidize the upgrades necessary to accomplish the government’s goals; they’ll have to come at the speed the market is capable of supporting.

Frankly, I don’t understand this drive to be “#1!” at teh intarwebs. Fine, Japan has 100M symmetrical access across the country. Whoop-de-doo. I frequently see municipal governments and schools with 100M pipes that don’t use more than 10% of their available bandwidth. If you want people to be “connected” to surf the web and download some pr0n movies and stuff, 5M is sufficient. 100M is overkill for greater than 99% of users. If we let the market run its course, we will get 100M to residences across the states in a few years when there is an actual demand for the service. There’s no need for the .gov to pump in billions of dollars for negligible benefit.

Frak, wasting this kind of money just pisses me off.

Goal 1: At least 100 million U.S. homes should have affordable access to actual download speeds of at least 100 megabits per second and actual upload speeds of at least 50 megabits per second.

Remote Cat Feeder

0 Comments

Do you wish you could feed your cats from across the world? Well, check this out:

This guy built a pet-feeding device out of a cool machine and an old Cisco switch. The details of how he did it are here. (Via Jeremy)

IPv6 Security: It Matters

1 Comment

The long-promised IPv6 security post. This was a tough one to write, because when I started five months ago I realized that I don’t really know that much about end system security. I don’t know how Borepatch does it every day.

I’ve written before about IPv6 and about how US service providers are starting to dip their toes into the pool. European and Japanese providers have been dealing with this stuff for a while. A lot of the information in this post comes from a breakout session I attended at Cisco Live in June led by Eric Vyncke, a Cisco Distinguished Engineer and all-around security guru who helped roll out IPv6 in France and other places. He also literally wrote the book on IPv6 security. Some of it is also from NANOG47.

You might be thinking, “Wait a minute, IPv6 isn’t widely deployed, and I’m not even using it. Why should I care?” That may not be a correct assumption. If you run Windows Vista or later, MacOS 10.2 or later, or a recent distribution of Linux, then your computer knows how to speak IPv6 and it’s just waiting for network traffic to start talking.

One example Vyncke used at Cisco Live was that the wireless network at the conference was running over IPv6. Most of us had no idea, but run a quick check revealed that all of our laptops had global (as in public) IPv6 addresses and, moreover, could reach IPv6 enabled websites natively. There were over 800 laptops connected to the wireless network at the conference with IPv6 during peak hours. How many people noticed? No one that I asked after I left that session had noticed. The transition from v4 to v6 was completely seamless, as it should be.

Still, this seamless transition is a bit alarming because, as Vyncke pointed out, lots of folks harden their gear against IPv4 threats, but few have considered IPv6 as an attack vector. However, even if you don’t run IPv6 in your network, if your computer speaks IPv6 then there are a few attacks that you should be aware of.

The first one occurs when an attacker sends false Router Advertisement packets to your computer. They have to be on the same broadcast domain as your computer for it to work. In other words, they have to be on your home wired network or a wireless network that you are connected to. The way it works is the attacker tells your computer, “You can get to the internet through me,” by sending a Router Advertisement message. Since Router Advertisements are not authenticated in most implementations of IPv6, your computer will automatically trust the attacker and send all of its IPv6 traffic through their gateway, setting up a man-in-the-middle attack.

Most of the other end-system vulnerabilities come from tunnels. In this case, a tunnel is a way for a host connected to an IPv4-only system to speak IPv6 with another host across the internet. This makes your system vulnerable to IPv6 attacks from whoever is on the other side of that tunnel. One of the most popular types of tunnel is a Teredo tunnel, which carries a couple of risks. Specifically, in Windows Vista Teredo tunnels bypass the Windows firewall. As far as I can tell, this issue is fixed in Windows 7. Also, some applications (most notably utorrent) will setup Teredo tunnels automatically if you let them. This behavior will open potentially unmonitored connections, so if you see this option in your apps don’t turn it on unless you have IPv6-aware security software on your PC.

That’s the bad news, but Don’t Panic. The good news is that most major security vendors, including Kaspersky, McAfee, and Symantec, have had IPv6 support in their software firewalls for years. Commercial hardware firewall vendors also generally have good support for IPv6, but most home routers (such as Linksys, D-Link, and Netgear) have no support for v6. If you’ve purchased or upgraded your security software since 2007, you’re probably protected.

Even so, to prevent any possible attacks, I would recommend disabling IPv6 on your PC if you do not currently use it in your home network. Truthfully, there’s no compelling reason to use IPv6 at home right now, and you can turn it back on when you do make the move. Here are instructions for disabling it:

In Windows Vista/7 – Only do the first four steps unless you are familiar with the Windows Registry. In fact, I wouldn’t do the last steps even so, because they make it a pain to turn the protocol back on when you do need it (and in a couple of years, you will).

In Mac OS X – Predictably, it’s super easy to do on a Mac.

And in Linux.

Rock City

0 Comments

I have arrived in Detroit for NANOG 47. This is the first event I’ve attended where there is an actual PGP key signing party. I think that makes this the nerdiest place I’ve been since college.

Epic Win

3 Comments

Yesterday I passed the CCIE Routing and Switching Lab Exam on my first attempt. I guess I owe myself an AR-15.

Radio Silence

2 Comments

I’ve scheduled my CCIE Lab exam for 26 August in RTP, NC. Wish me luck.

One to go.

0 Comments

I passed the CCIE Routing and Switching written exam today with flying colors. What a difference a good night’s sleep can make. The only thing now between me and a unique CCIE number is the lab exam, which is a little like saying the only thing between me and millions of dollars is a bank vault door. I’ve got another post on IPv6 in the works based on some of the stuff I learned at Cisco Networkers from folks who’ve actually deployed it on a large scale (mostly from Europe and Asia). Hopefully I’ll get that up by the end of the week.

Cisco in ‘Cisco

0 Comments

Sorry about not updating. There’s been lots to write about but no time to do so.

I’ve gotta say, flying from Phoenix to San Francisco is like travelling from Arrakis to Caladan. It might seem odd, but the first thing I noticed about San Francisco is the water. It’s everywhere! Imagine that.

I registered for the convention late so I ended up in a different hotel than my co-workers. They’re in a hotel about a mile closer to the convention Moscone Convention Center but I got a room larger than a broom closet and in a place that serves a great steak. I figure I got the better deal. Both hotels charge for internet, though. $13 a day when I’m only awake in my hotel room for 2 hours a night is pretty crappy, even if it does go on the company card.

I’ve been doing a lot of reading on the Kindle instead. Can’t say that I mind all that much. I think I actually read faster on the Kindle, but I’m not sure. I do know that I’m almost done with Hitchhiker’s Guide to the Galaxy and I’ve only been reading it for abut three hours.

So far the convention has been pretty awesome. On Monday I took a mentored CCIE routing and switching practice lab, which was a great experience. I learned a bit about some areas where I’m weak, specifically IPv6 and multicast configuration. I’ve got a good grasp of IPv6 concepts, but there’s so seldom an opportunity to actually configure and troubleshoot IPv6 that it’s going to be a significant hurdle when I take the CCIE Lab exam in a few months. I also got a good look at the format of the exam and the sorts of ‘gotcha’ scenarios Cisco puts on the lab exams. Normally I’d have had to pay $1500 to fail the test to get that kind of experience.

This morning I attended a session on deploying scalable OSPF in a service provider network. The Open Shortest Path First routing protocol is the most common routing protocol in the world, because it’s easy to configure, every vendor supports it, and every engineer learns it forward and backward. It’s a lot like IPv4 (or VHS) in that it’s not the best tool for the job, but everyone knows how to use it and everyone supports it.  It was a good lecture but I spend all day hip deep in OSPF at work, and I didn’t really learn anything new. I’m not sure what I expected. . . I think I was hoping that there was some secret OSPF juju that I don’t know about.

Of course, as I mentioned before, I took the CCIE written exam a couple of hours ago. I failed the exam by 14 points out of 1000. In other words, I failed by one difficult question or two easy questions out of 100. It’s the worst way to fail, in my opinion. The earliest I can retake the exam is Monday, so I’ll study over the weekend and hopefully pass then.

This afternoon I have a class on IPv6 security and tomorrow I’ve got a couple of sessions on multicast deployment and MPLS. These are my weakest subjects, so hopefully they’ll also do some good both on the certification front and in my job, where we’re currently designing a multicast video deployment.

I’ve got to run to the IPv6 session now.

On a Jet Plane

0 Comments

In 12 hours I’ll be on a flight to San Francisco in order to attend the annual Cisco Live conference (formerly Cisco Networkers) until Thursday. Should be interesting, I’ll be attending seminars on IPv6 security, MPLS traffic engineering[1], multicast routing, and a CCIE Routing and Switching lab tutorial. On Tuesday afternoon I’ll be taking the CCIE R&S written exam.

I’m taking my Eee in addition to my work laptop, so I’ll try to blog frequently, there should be plenty of network coverage. . .

  1. I couldn’t find any good articles to explain MPLS traffic engineering simply. Basically, it’s a way to implement end-to-end QoS and policy-based path selection using label switching. In other words, it’s faster and less CPU intensive than true packet-switched QoS. However, it’s only useful in high-bandwidth, large-scale networks. The benefits are negligible in smaller networks. []