Slashdot Mirror


User: Cramer

Cramer's activity in the archive.

Stories
0
Comments
3,954
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 3,954

  1. Re:No thanks on IPv6 Essentials · · Score: 1
    Most (or all?) modern Linux distributions have IPv6 enabled by default
    (a) The entire world doesn't run linux. Sitting right here in my "warehouse" are solaris, aix, tru64, windows (2000, xp, 2003), BeOS, etc. (b) Just because your linux distribution calls "insmod ipv6" does not mean it's setup for IPv6. (c) The end-user machines aren't the only things that need configuration. Where do you think IPv6's "DHCP" comes from? (answer: from the router(s) that have to be explicitly configured with IPv6) (d) In Windows environments where there are "login scripts", the users aren't admins and thus cannot alter the network configuration.

    Of course, firewalls...
    It's more like most commercial firewall appliances being used today will have to be REPLACED because they don't support IPv6, and never will. As an example, look at all the Cisco PIXen in the world. Only the lastest designs (515, 515E, 525, and 535) can run v7.0+. All those "older" systems (like the 506, 506E, 520, even the 501) will, in all likelihood, never support IPv6. Cisco might, someday, make 7.0 work on a 501, but I doubt it. It's not that the older gear cannot handle IPv6 (they certainly can, they're f'ing PCs), Cisco simply doesn't want to update them. (read: "Buy our NEW $20,000 IPv6 capable PIX. We'll give you a ($5) trade-in.")

    [When I say "firewall", I mean a real firewall and not a stupid packet filter.]

    I guess old, incompatible hardware is a showstopper, but then again, they are showstoppers in moving from 100mbit to gigabit as well. :-)
    Yes, old IPv4 hardware will forever be a problem because the brilliant idiots that designed IPv6 didn't build it to be backwards compatible. IPv4 devices cannot talk to IPv6 devices, and vice versa.

    Unlike ethernet... 100Mb/s and even 10Mb/s ethernet devices are not (and never have been) a showstopper for migration to 1Gb/s. Because there are switches that do all three at the same time. The protocol hasn't changed; only the way it's signaled has changed. There's an (OMG!) actual migration path; you don't have to rip out your entire infrastructure at once; you don't have to have two nics in every machine.

    Even a move from tokenring to ethernet had an interoperable migration plan. Every machine didn't have to have both. In fact, there only needed to be one device with both interfaces to handle protocol translation. The tokenring machines continue to talk tokenring, completely oblivious to the existance of ethernet -- and v.v. (granted, that's a far more localized, and thus less problematic, transition.)

    IPv6 has no such plan. There's no workable system for "NATing" IPv6 addresses into IPv4 so v4 only systems can talk to v6 only systems. Because the IPv6 space is so large and the IPv4 space is still active, it becomes an unmaintainable nightmare. In order for v4 to talk to v6, something has to assign an IPv4 address to the IPv6 address and translate all the packets in both directions -- NAT, which IPv6 was supposed to eliminate. But, it has to pick an IPv4 address that doesn't collide with any existing real IPv4 address -- IPv4 will remain in use for decades to come -- and doesn't collide with any internal, private addresses. And it gets worse from there... if you think IPv4/IPv4 NAT is a pain in the ass, IPv4/IPv6 NAT is a nightmare.
  2. Re:What is the "killer app" for IPv6? on IPv6 Essentials · · Score: 1
    ISPs pay for their address space
    No... they don't.
    Oh hell yes they do... ARIN Fee Schedule RIPE Fee Schedule (2006) ... IP address space is not handed out for free.
  3. Re:No thanks on IPv6 Essentials · · Score: 1
    It's no problem to run a computer with dual-stacks
    Says the man with one machine. A smooth transition is one where only a single change is necessary at one's convenience. Dual-stack migration means going around to each machine (potentially THOUSANDS) to enable IPv6, then going back around some time later to remove the IPv4 stack; assuming every machine is even capable of IPv6.[*] This "smooth transition" becomes a great deal of work and requires maintaining two network infrastructures over an indeterminate period.

    [*] Cisco PIX firewalls aren't IPv6 aware. The older ones never will be. I suspect the little 501 never will be, either.
  4. Re:What is the "killer app" for IPv6? on IPv6 Essentials · · Score: 1
    I've never come across an ISP who charges for additional IPv4 addresses.
    Keep living under that rock... I've not seen one that doesn't. ISPs pay for their address space, so they charge for it. Mostly because they can. But also to limit people's own wasteful misuse... you don't need a /24 for a single laptop, etc. (TW gave us 8 addresses, yes *8* usable addresses... damned bridging. We're only using 2.)
  5. Re:What is the "killer app" for IPv6? on IPv6 Essentials · · Score: 1

    Really? Why? How much do you and your employer(s) communicate with China?

    As most of the spam I block every day is coming from that part of the world... by all means, switch to IPv6 and lock yourselves away from the rest of the IPv4 Internet.

  6. Re:NAT is the IPv4 version of segmented memory on IPv6 Essentials · · Score: 1

    He's not saying it's irrelevant. It simply doesn't fix the real problem: everyone needs to be using IPv6 before everybody will be using IPv6. A machine using only one address will be unable to talk to machines on both networks. My machines only have IPv4 addresses; therefore they can only talk to IPv4 addressed machines. A machine with only IPv6 addresses are invisible to me. If I were to switch to IPv6 only -- which requires network wide configuration changes, then I would similarly lose access to all the IPv4 machines.

    It's a "two internets" problem. As long as everything is on the old internet, there's no reason to switch to the new internet. And until there's a reason, no one will. I have an IPv4 address; everything I need to talk to has an IPv4 address. So, I have no reason to switch. If I did switch, I'd be unable to talk to all those things with only IPv4 addresses -- I'd be locking myself in the closet.

    Everything has an IPv4 address. Nothing has an IPv6 address. IPv6 cannot talk to IPv4. So, why, exactly, would I want an IPv6 address?

    DJB's second point is that until there's a migration path that doesn't require people reconfigure their machines, no one is going to do it. The "builtin DHCP" doesn't matter; someone will still have to touch every machine to switch them to IPv6 from IPv4. It doesn't matter that an address can be provided by the network. The IPv6 network stack still has to be switched "on".

  7. Re:so uh on IPv6 Essentials · · Score: 1

    Actually, most of the IPv4 checksuming occurs directly on the NIC these days. The RX logic checks it on receipt, and the TX logic calculates it on the way out. In any case, the TTL update is, at best, 2 instructions... TTL-- and csum--. (basically)

  8. Re:so uh on IPv6 Essentials · · Score: 1

    I'm not so sure it's an "obvious" benefit. While NAT doesn't make something a firewall, it is one of the most powerful things protecting almost everyone's network(s). A true firewall is a lot more complex than anything found on the shelves at CompUSA, Best Buy, Frys, etc. Calling a packet filter a firewall is just as lame as calling NAT a firewall. (NAT's actually more effective because there's no requirement of constant tweaking. Filters are only effective if they are kept up-to-date.)

    I think we'll find the internet a much nastier place once NAT is wholesale removed.

    (And from my chair, all of the anti-NAT crusaders I've ever met qualify as too stupid to correctly write a network protocol. They always complain about the need for "nat helpers" to rewrite addresses in packet payloads. However, they fail to see how stupid such protocols are; they are broken even without NAT -- on any machine with more than one address, the app has a damn good chance of guessing the wrong one. Any system that requires me to tell the remote end my address is broken from the start; my address is right there is the f'ing packets I've already sent.)

  9. Re:Vonage isn't secure on Comcast Lying About Vonage · · Score: 1

    DOCSIS 1.0 is just simple DES, unless someone left off the '3' when they wrote their summary. 1.1 has extendable crypto. Last I checked, my modem hadn't been updated in several years. (SB5100-2.3.1.6-SCM01-NOSH)

  10. Re:DSLAM power And Comcast product vs. Vonage on Comcast Lying About Vonage · · Score: 1

    I'm not talking about T1 repeaters; I'm talking about DSLAMs. And DSLAMs are not tiny things -- not the ones with enough ports make them worth the expense. I have a spreadsheet around here that lists (listed... it's dated 2004) every installed DSLAM in bellsouth's network. (hey, they put it on the web...) I don't recall seeing any "tiny" line powerable hardware (~30W) in that list. Basically, because Bellsouth isn't going to waste their time installing a DSLAM for 24 lines. (Zhone makes one that's 48 ports, but that's still too small.) 26AWG can safely provide max. 15W to ~12k ft. (depending on how much voltage the local laws permit.) [Pedestal Networks did the math for me.] Almost all of BS's wiring is 26AWG.

    I'll be sure to look at what's on the corner next time I head to the grocery store. In theory, there's one right there, but I think Google is about 100ft too far to the right. However, at 1am I don't think I'll be stopping to take any pictures :-)

  11. Re:Vonage isn't secure on Comcast Lying About Vonage · · Score: 1

    That's the "challenge" part. That means your average garage tinkerer won't be able to build anything sensitive enough. But, the gear to do so does exist. It isn't specifically designed to decode DSL, but it will show you the crosstalk and in some cases isolate the individual channels.

    There is a limit to the number of DSL lines possible in a given trunk. Basically that pair of wires is an AM radio antenna -- it just happens to be touching both the radio and the radio station. The reason there are distance limits is due to the power required to reach a given distance and the resulting amount of power bleeding into the surounding cables. The 25 or 50 pair trunk may be shielded, but the individual pairs inside aren't.

    (I bet I could find DSL xtalk on my phone lines if I cared to look. Hint: the inductive pickup of a wire tracer is good enough; filtering out just one modem's signal will be a little more work.)

  12. Re:DSLAM power And Comcast product vs. Vonage on Comcast Lying About Vonage · · Score: 1
    If there is a DSLAM that is not at a central office it is powered off the supply in the multiple pair cable.
    Incorrect. DSLAMs use more power than can be (safely) run down a 26AWG pair of a 25 or 50 pair trunk. Plus, the telco's aren't licensed for power distribution (which is what that would be.) [at least, not in NC.] I'll be glad to take pictures of various pads around here so you can clearly see the CP&L power meter feeding the things. (And the one behind the Raleigh Grand is often standing wide open so you can see exactly how it's powered. (read: from an industrial UPS))

    Fiberoptic cables commonly have conductors for power as well.
    Also incorrect. I have about 60ft of fiber cable (left from a bellsouth run) and there's no conductors in it at all. Also, the mile long spools I saw sitting in the warehouse also had NO conductors in them. None of the 4k miles of fiber in my former employer's network has any conductors running with them.

    The (TW) T1 here in the office is -48VDC UPS powered. The westel smartjack is grid powered -- no UPS at all. I didn't see the fiber mux they installed in the building phone room, but I'd guess it's 48V battery powered.
  13. Re:Dirty tricks not new on Comcast Lying About Vonage · · Score: 1
    It doesn't guarantee that this happens within a certain time period.
    Actually TCP/IP does have time limits. They're on the order of minutes, so not really useful in terms of voice communications. But generally, if an IP network is dropping any packets, it's broken and should be fixed. In most instances, dropped packets are the result of ISPs far over selling their bandwidth. (and they'll quickly point to file sharing as the root cause...)
  14. Re:I'm shocked, shocked... on Comcast Lying About Vonage · · Score: 1

    You're assuming they're sending trucks... I bet they ignore it, the water drys up, and everything goes back to working. At which point, there's nothing to fix. :-) I doubt the rain is leaving behind any measurable conductive silt.

    (In fact, I used to have a serial port "brick" (specialix 8 port rs232 module) from a netblazer that flooded after some storm. It was a common thing for the Wilmington, NC POP -- we just mounted our shit higher in that rack. *grin* It worked just fine once it was dry.)

  15. Re:Vonage isn't secure on Comcast Lying About Vonage · · Score: 5, Insightful

    DSL is no better than Cable. While you are somewhat more electrically isolated from your neighbors, it's still ultimately shared... On cable, yes, my packets and my neighbor's packets are on the same physical wire all the way to the head end (where thousands of other's meet on their way to the ISP.) On DSL, they travel down the same trunk to the DSLAM (where they meet and travel down a T1/T3/OC-3 (depending on how cheap your provider is) to the ISP.) While it looks easy to snoop your neighbor's traffic on cable -- it's right there on the cable just the same as yours, the volume (and number of channels) means you have a lot to hunt through to find one specific modem. And cablemodems support "baseline privacy" that scrambles the data making it harder to decode. (but it's still "simple" crypto, designed to limit cloning.)

    DSL is a bit of a challenge, too. However, DSL can be monitored from other pairs in the same trunk just like a cable modem. (listen for weak cross-talk.) The DSL physical layer isn't scrambled at all, so if you can see the signal (no matter how weak), it can be decoded with ease.

    The PSTN ceased to be truly circuit switched decades ago. It's been digitized, packet switching for a long time. The only circuit is in the "last mile" from the CO to CPE. And more often than not these days, your copper wires don't even go all the way back to the CO; they go to a multiplexer. (or "remote DSLAM" if we're talking DSL.)

    As to which is "secure"... neither. POTS/DSL is easiest to sniff if you're willing to sneak around to plant a physical tap -- on the NID or any of the boxes on down the line, right down to breaking into the DSLAM itself. Cable just requires you be somewhere in the neighborhood (no sneaking required), and willing to sift through a lot of noise to find one specific modem's traffic.

    On the issue of power, both DSL and cable are endpoint powered. If your house loses power, your modem will stop working. It doesn't matter if it's a DSL modem or a Cable modem. Telco's may have more experience with keeping their equipment powered, but they aren't going to give a shit if the DSLAM loses power during a storm; they'll only care about keeping "lifeline" services (read: POTS) functional. That DSLAM in the cabinet at the top of the hill doesn't have a generator backing it up.

  16. Re:Tranquility base on Computer Analysis Sets NASA History Straight · · Score: 1
    Because that's how it works. Go look at a LM some time. See the contact probes? See how close the engines are to the ground (and the lack of a small crater from those 45,000N engines)? And the Lunar Module Structures Handout (pdf), p. 6, uses the word IMPACT. (Moon gravity is 1/6th Earth's, so "dropping" the lander a few feet really isn't a problem.)

    From the Apollo 11 logs:
    When the 68-inch probes beneath three of the spacecraft's four footpads touch down, flashing a light on the instrument panel, Armstrong shuts off the ship's engine.
    (I've not been able to find any of the docs on how to actually land a LM. I'm sure someone has scaned them.)
  17. Re:Tranquility base on Computer Analysis Sets NASA History Straight · · Score: 1

    That contact light just means a probe was touching the surface. They were still flying until several milliseconds AFTER the engines were cut off and they fell the remaining feet (+/-) to the surface. Only then are they "on" the moon.

    Just because a rope hanging out the door of your helicopter is touching the ground doesn't mean you've landed. (you've landed when the skids -- or wheels -- are on the ground and the rotors are no longer providing lift.)

  18. Re:Ingrained Quotes, and hearing what you think on Computer Analysis Sets NASA History Straight · · Score: 1

    And listen to the rest of it (and much of the the other transmissions); his "a"'s are clearly heard. He may have intended to say it, but it's not on the tape. I don't buy this 35ms crap. Give me the original tape and I'll see what's there... anything else is junk. (mp3's are destructive as are most modern compression formats.)

  19. Do the math on 500 Miles on a 5-Minute Recharge? · · Score: 1

    $9 worth of power at the national average $0.10kWh is 90kWh's... over a 5 minute period, that's 1080kW. Yes. One. F'ing. Megawatt.

    Please correct my insanity.

  20. Re:ASICs Issues on Open Source Router on Par With Cisco, Users Say · · Score: 1

    I'm not sure about cost, but you only need 2 slots using one of these -> Six Port Copper Gigabit Ethernet PCI Express Server Adapter

    I'm using the PCI-X versions of those cards right now. PCI-X is a bit limiting, but we need the ports more than the bits.

  21. Re:if it is only "Standard PC Hardware" on Open Source Router on Par With Cisco, Users Say · · Score: 1

    Most of the sub-$10k cisco routers are far inferior to even a crappy, "junk" PC. However, the PC ceases to be cheap when you start to plug a T1 into it.

    At work, we get away with not caring because the T1's data is handed to us as ethernet from the device that's sharing voice on it. If it were a straight T1, we'd need a "router" with a T1 interface.

  22. Re:if it is only "Standard PC Hardware" on Open Source Router on Par With Cisco, Users Say · · Score: 1

    where x=2, yes. Most of the time.

    x=5... why would anyone use a 7500 for ethernet switching?

    x=4; Hell no. The 7400's (7300's, 7600's, ...) use an NSE, not NPE, that has Cisco's newest uber-hardware -- PXF, parallel express forwarding -- that can (and does) do line rate packet inspection. And I've configured one to do so with my own hands. It was designed for broadband aggregation -- termination of L2TP/PPPoE -- for 10k+ users.

    But, yes, Cisco's gear is expensive. Period.

  23. Re:if it is only "Standard PC Hardware" on Open Source Router on Par With Cisco, Users Say · · Score: 1

    why would you expect companies to step down from decent DSL speeds to T1 rates
    Because they want the reliablity. Or, as is true in my case, your phone lines are crossing it too.

    I defy you to be able to route 4 Gbit interfaces through a single low end PC
    Define "low end"... using a SuperMicro PDSMi-LN4, I can push nearly 700Mb/s out each port, at the same time, from userland (libpcap, which isn't exactly efficient.) [That's 4 PCIe gig interfaces.]

    Anyone have any Packets Per Second (PPS) rates for a generic PC
    Not with linux... There were reports of ?BSD pushing over 1mil.

  24. Re:His own fault... on Alan Cox's Exploding Laptop · · Score: 1

    Yes. The monitor is plugged into the VGA port on the side of the laptop.

  25. Re:my school on Students Protest Turnitin.com · · Score: 1

    Actually, you'd be very surprised how closely students of the same set of teachers in the same set of schools write and even think. Given the saturation of computers and word processors, you cannot even look at grammer and spelling anymore.

    Eventually, that database is going to be large enough to show we're all "cheaters".