Re: [c-nsp] rate limit dns

2013-12-30 Thread Mack McBride
Now you are using the straw man argument. Phishing has little to do with DNS per se. If a known address is doing phishing a provider can certainly falsify that DNS to protect their customers. BUT, forcing customers to use your DNS results in the possibility of all of your customers suffering in

Re: [c-nsp] rate limit dns

2013-12-30 Thread Mike
On 12/29/2013 04:00 AM, Dobbins, Roland wrote: On Dec 29, 2013, at 2:00 AM, MIke mike-cisconspl...@tiedyenetworks.com wrote: Open internet. I don't want to dictate to anyone which port numbers or protocols they are limited in using, and I want to impose only the absolute minimum of controls

[c-nsp] Quick question on HSRP...

2013-12-30 Thread Jeff Kell
Quick question for someone that's been there, done that, as I'm a bit rushed to try to lab test this... We're adding some new routers (4500Xs) for an upgraded server farm arrangement with a number of server-side vlans / VRFs. The plan was to trunk it with the existing L3 router, and fire up HSRP

Re: [c-nsp] Quick question on HSRP...

2013-12-30 Thread Jean-Francois . Dube
Hi Jeff, My understanding is that you are basically going to replace the default gateway for in a couple of vlans. (Same IP but different MAC.) Active HSRP router will issue gratuitous ARP (gARP) when it becomes Active so there should be little disruption for the hosts inside the vlan trying to

Re: [c-nsp] rate limit dns

2013-12-30 Thread Dobbins, Roland
On Dec 31, 2013, at 2:19 AM, Mike mike-cisconspl...@tiedyenetworks.com wrote: Not true. I've seen more than 600mbps of traffic and, while not in the league of what you see, is still a sizable total of my transit and we kept chunking along. This is a pretty trivial amount of traffic; also,

Re: [c-nsp] rate limit dns

2013-12-30 Thread Dobbins, Roland
On Dec 31, 2013, at 1:27 AM, Mack McBride mack.mcbr...@viawest.com wrote: Phishing has little to do with DNS per se. Some does, actually. BUT, forcing customers to use your DNS results in the possibility of all of your customers suffering in a DDoS situation where your DNS servers are