Re: IPv6 PMTUD and OS-X

2010-08-21 Thread bmanning
On Fri, Aug 20, 2010 at 11:34:23PM +0200, Jeroen Massar wrote: > On 2010-08-20 23:27, Franck Martin wrote: > > I'm trying to debug a pesky PMTUD issue with IPv6 on Mac OS-X 10.6. > > > > It happens only from home, on wireless, when connected to a mac aiport > > that does an automatic tunnel (tere

Re: IPv6 PMTUD and OS-X

2010-08-21 Thread Jeroen Massar
On 2010-08-21 09:18, bmann...@vacation.karoshi.com wrote: > On Fri, Aug 20, 2010 at 11:34:23PM +0200, Jeroen Massar wrote: >> On 2010-08-20 23:27, Franck Martin wrote: >>> I'm trying to debug a pesky PMTUD issue with IPv6 on Mac OS-X 10.6. >>> >>> It happens only from home, on wireless, when conne

Re: Should routers send redirects by default?

2010-08-21 Thread Jack Bates
Eric J. Katanich wrote: You disable it on the host and if no host is using it, you might as well disable it on the router as wel. Others mentioned some routers need to handle this in software instead of hardware, which is obviously slower. Most redirects are limited in their rate, so it gene

Re: Should routers send redirects by default?

2010-08-21 Thread Jared Mauch
On Aug 21, 2010, at 2:11 AM, Yann GAUTERON wrote: > > > 2010/8/20 Jared Mauch > > Personally (and as the instigator in the ipv6/6man discussion) if the > vendors could be trusted to expose their default settings in their > configs, i would find a default of ON to be more acceptable. As their

Re: Should routers send redirects by default?

2010-08-21 Thread Jared Mauch
On Aug 21, 2010, at 10:12 AM, Jack Bates wrote: > Eric J. Katanich wrote: >> You disable it on the host and if no host is using it, you might as well >> disable it on the router as wel. Others mentioned >> some routers need to handle this in software instead of hardware, which is >> obviously s

Re: Should routers send redirects by default?

2010-08-21 Thread Christopher Morrow
I appreciate the discussion.. Eric, are you reflecting messages back to the list without additional content for a reason? list-admin folks, could we ping eric and see what's busted? On Fri, Aug 20, 2010 at 9:08 PM, Eric J. Katanich wrote: > On 08/21/2010 02:08 AM, Brandon Ross wrote: >> On Fri,

Re: end-user ipv6 deployment and concerns about privacy

2010-08-21 Thread Joel Jaeggli
On 8/18/10 4:20 PM, Hannes Frederic Sowa wrote: > On Wed, Aug 18, 2010 at 11:16 PM, Mark Smith wrote: >>> In IPv4-land I have the possibility to >>> reconnect and get a new unrelated ip-address every time. >>> >> >> They're issued by the same ISP, to they're related. > > Ups. Unrelated in the sens

on network monitoring and security - req for monitoring tools

2010-08-21 Thread travis+ml-nanog
Hi, I'm putting together a book on security*, and wanted some expert input onto network monitoring solutions... http://www.subspacefield.org/security/security_concepts.html Nagios, Net-SNMP, ifgraph, cacti, OpenNMS... any others? Any summaries of when one is better than the other? Any suggestio

Re: end-user ipv6 deployment and concerns about privacy

2010-08-21 Thread Joel Jaeggli
On 8/19/10 10:58 AM, Joakim Aronius wrote: > * Joel Jaeggli (joe...@bogus.com) wrote: >> >> manual configuration of ip address name mappings seems like a >> rather low priority for the average home user... >> >> I don't expect that will be a big activity in the future either, >> more devices mean

Re: on network monitoring and security - req for monitoring tools

2010-08-21 Thread François D. Ménard
Mikrotik TheDude -- fmen...@xittel.net On 2010-08-21, at 17:57, travis+ml-na...@subspacefield.org wrote: > Hi, I'm putting together a book on security*, and wanted some expert > input onto network monitoring solutions... > > http://www.subspacefield.org/security/security_concepts.html > > Nagi

Re: end-user ipv6 deployment and concerns about privacy

2010-08-21 Thread Mark Smith
On Thu, 19 Aug 2010 01:35:50 +0200 Hannes Frederic Sowa wrote: > On Wed, Aug 18, 2010 at 11:41 PM, Jack Bates wrote: > > Web portals work fine, and honestly, it's not like you need to switch > > subnets, either. PPPoE/A implementations work great, as they are already > > designed to utilize radiu

Re: Should routers send redirects by default?

2010-08-21 Thread Mark Smith
On Sat, 21 Aug 2010 10:32:00 -0400 Jared Mauch wrote: > > On Aug 21, 2010, at 10:12 AM, Jack Bates wrote: > > > Eric J. Katanich wrote: > >> You disable it on the host and if no host is using it, you might as well > >> disable it on the router as wel. Others mentioned > >> some routers need to

Re: Should routers send redirects by default?

2010-08-21 Thread Mark Smith
On Sat, 21 Aug 2010 09:12:47 -0500 Jack Bates wrote: > Eric J. Katanich wrote: > > > > You disable it on the host and if no host is using it, you might as well > > disable it on the router as wel. Others mentioned > > some routers need to handle this in software instead of hardware, which > >

DNSSEC and SSL

2010-08-21 Thread ML
Would a future with a ubiquitous DNSSEC deployment eliminate the market for commercial CAs? Would functioning DNSSEC + self signed certs be more secure/trustworthy than our current system of trusted CAs chosen by OS/browser developers?

Re: DNSSEC and SSL

2010-08-21 Thread Gary Buhrmaster
On Sat, Aug 21, 2010 at 18:00, ML wrote: > Would a future with a ubiquitous DNSSEC deployment eliminate the market > for commercial CAs? > > Would functioning DNSSEC + self signed certs be more secure/trustworthy > than our current system of trusted CAs chosen by OS/browser developers? See Dan Ka

Re: DNSSEC and SSL

2010-08-21 Thread Mikael Abrahamsson
On Sat, 21 Aug 2010, ML wrote: Would a future with a ubiquitous DNSSEC deployment eliminate the market for commercial CAs? No, but it might eliminate the cheapest certs that people might use. I'd like my personal server to have a self-signed cert with it's fingerprint handled via DNSSEC, bec

Re: end-user ipv6 deployment and concerns about privacy

2010-08-21 Thread Owen DeLong
> > I can remember early network printers using bootp and the assuming that > they could use that one ip address forever. today the printer will dhcp > and advertise it's availability in the same broadcast domain and may > well reregister it's name in dynamic dns if possible. Funny... I remember