« first day (132 days earlier)      last day (4849 days later) » 

12:03 AM
@WesleyNonapeptide I hear that. I only have a single tree, a big honkin maple. Of course, there's also a good sized quince hedge as well. I hope to get enough fruit to make some jam some day.
 
Is this close-worthy?
0
Q: Recommend a good Hosted Exchange Provider?

dustinI am looking for a reliable Hosted Exchange provider, both in service quality as well as support/company reputation. The general requirements I am looking for are: Running Hosted Exchange 2010 Provide all of the usual services (Web access, Outlook client access, ActiveSync/Push to mobile devic...

It's subjective, and subjectivity is verboten on the ServerFaults.
 
I think it is worth closing. Recommending a service providers really isn't really very useful.
 
I do like those questions to get people's views on companies and services, but I think it's ill suited for ServerFault.
I'll save them for other forums and IRC channels.
And blog wars.
 
12:19 AM
@WesleyDavid close worthy
 
Hey @instanceofTom I just saw your response to that question. Good punt.
 
Posted by Jeff Atwood on November 23rd, 2010

Over the last 2.5 years, we’ve identified a few problematic classes of questions that tend to get asked on our sites. Many of these are documented in our standard set of close reasons: exact duplicate, off-topic, subjective and argumentative, not a real question, and too localized.

However, as we launched the great Super User experiment, a new, previously unknown class of problematic questions emerged — the shopping recommendation.

That is, on Super User we began encountering questions like: …

 
thanks, noticed the question when you pointed it out, figured itd be good to point them in the right direction before the question is closed
 
@KyleBrandt, you need to start being perfect, unlike me.
0
Q: rss feed for the serverfault blog double posts

davidsleepsThe Server Fault blog RSS feed always comes up twice in Google reader (with different timestamps)...The stackoverflow blog rss doesn't do this...anyone else have this problem? From my screenshot, this began happening on the 9th of december...My first guess is that this is just google reader bein...

 
I always say, edits are for the weak.
 
12:32 AM
@packs, did you just edit that comment on purpose.
 
@Zoredache I will take that secret to the grave!
 
His first sentence said something about eviscerating gerbils with bendy straws.
 
Time to go home.
 
As Tracy Ulman would say: "GO HOME! GO HOME!!"
 
@WesleyDavid Eviscerating is not quite the word I would use.
@sysadmin1138 Enjoy.
 
12:39 AM
Trying to think of who to vote for in the elections.
I wonder who else will show up in the running in the next week.
 
I thought you were going to find a way to vote for TomTom?
 
I was thinking about it, but I am not sure I want to. There is already good candidates.
Not being a mod means I can occasionally be mean to people in comments and not feel as bad about it as if I was a mod.
 
I don't have the time right now. Maybe next election cycle. I sincerely hope that mods don't stick around for more than a year.
I <3 TomTom
 
 
1 hour later…
1:44 AM
tap tap tap... this thing on?
 
Somewhat.
 
how goes?
anybody finding it hard to get an upvote/answer lately?
 
My Sun storage array took a nap for an hour this morning for no apparent reason. Sun is looking at the logs.
@gravyface, what do you mean? Do you mean it is hard to get an answer you asked, or hard to get credit for an answer you provided?
 
yikes. I'm about 3 firmware versions behind on one of my Dell MD3000i. Sigh.
@Zoredache: hard to get credit.
last month or so, just awful.
also, not getting much love on my Cisco questions for some reason but I usually muddle my way through it.
 
I haven't noticed any slowness. You do seem to have provided a lot of answers lately to low rep users. I find that it is pretty common that you don't get much from answering low rep questions unless you provide a really good answer.
 
1:58 AM
@Zoredache: fair enough, but usually there's upvoting from higher rep users. Perhaps avoiding low rep questions altogether might be a better strategy.
 
I don't know that you want to completely avoid them. Depending on the question it is likely that you will slowly gain some rep over time as people find the question on Google or in a search.
I just wouldn't suggest you spend much time on a bad/vague question. If you have a quick answer, it won't hurt to add it, but if the question isn't really clear then ignoring it isn't a bad thing.
Anyway, I am heading home, I'll be back later.
 
@Zoredache: ttyl
 
How about this. Freely give to all with no focus on recompense.
Less worry, more goodness.
From the pages of LMGTFY:
0
Q: Does Apple's Remote Desktop need OSX Server?

user65712Does Apple's Remote Desktop need OSX Server? Or are there better management options out there? I'm looking for something to manage a small Mac lab of ~20 machines joined to Active Directory.

 
2:42 AM
@WesleyNonapeptide: your name hasn't propogated here yet. I'm glad you didn't change it altogether, it took me months to get used to it when pauska changed his. Yes, I kinda keep track of people on the same users page.
This must've come up before, but I haven't been paying attention to chat: what's the number that seems related to but is higher than reputation that shows here?
 
@Ward What did Pauska change his to? Mine is changed from Wesley 'Nonapeptide' to the more personable WesleyDavid
So it's still Wesley, if that helps.
The number that is higher than your SF rep is your aggregate rep for all stack excahnge sites
@Ward Check out your full account stats:
Add up all the numbers and you'll get to 5679
 
@WesleyDavid Too many first names!
 
And I haven't even told you of my middle or last names.
 
2:59 AM
@WesleyNonapeptide: it's what Pauska changed it from, he was (I think, it's been a while now) Erik P Skaarland for a long time, and I got used to seeing that name.
 
 
4 hours later…
6:35 AM
@WesleyDavid: I've gotten some solicitations for business engagements and a couple of jobs. In the end none of it has panned out for various reasons (not being a good fit, being across a US border, etc). I'll keep the shingle out there, but I don't expect any business from Server Fault. I have referred prospective local Customers to my Server Fault profile, though, and had some very good reactions. I'm treating Server Fault as more a part of my personal "brand" than anything else.
 
 
3 hours later…
9:25 AM
@packs: :(
@Ward Yea, it was my full name, but I found it a bit too long, and it's nice to hide under some kind of alias
 
9:45 AM
@WesleyDavid I've been contacted once by someone who was looking for a networking guy. I hadn't said anywhere I was looking for a job; I suspect he went down the list of top users in the 'networking' tag until he found someone based in Dublin. :P
 
Sam
I've not had any job offers, but have had people wanting me to write blog posts for them.
 
10:00 AM
this is one of the best tests i've ever read
 
 
1 hour later…
11:04 AM
I'm currently gets job offers from Amazon around once a month.
 
Sam
11:35 AM
@pauska that's a really interesting read
 
12:05 PM
@Sam: Indeed. Heres a similar one for single AP testing: novarum.com/documents/…
 
Sam
sounds like they would be fun tests to do too
 
12:41 PM
I need a beer.. soon....
 
@pauska Currently auditing the OSPF setup on our network. Luckily there is decent documentation, but it's still "fun"
 
@pauska Nice... Added quite a bit more detail, eh?
 
@jscott: a little bit, yeah
 
Firewalls + OSPF can often mean lots of breakage, even from companies who sell proper routers! Not looking at Cisco in particular!
 
DMZ and two server LANs are still missing
and its still the logical layout...
I have 8 boxes with cisco gear sitting outside my office :P
transition from one ISP to another without provider independant space is.. torture
@NiallDonegan: I havent even considered OSPF
I dont trust the old firewall enough, doing static routing at HQ
I honestly feel like I'm building my own ISP here :P lucky I dont have anything to do with the MPLS network
 
12:49 PM
@pauska We're at a size where OSPF is essential. Space in three datacentres, connected to three transit providers and one IX, interconnections between data centres, and multiple routers and firewalls talking to each other.
 
What software are you using to do the diagrams, out of interest?
 
Looks like Visio
 
Yep, Visio
@NiallDonegan: Ok, thats a bit bigger ye
 
@pauska If you find youself having to add static routes more and more, consider OSPF. It also makes it very easy if you need to add extra links between offices which are transfering a lot of data.
Initial head scratching on setup is guaranteed though!
 
What make/model are the firewalls?
 
12:52 PM
@NiallDonegan: Yeah, I follow you on that one.. the thing is that this is a visio of the madness I'm going to have while transition from one ISP+IPVPN to another ISP+IPVPN
everything marked TDC is going to be removed after a few months
@MuraliSuriar: The new one (at the top) are dual Cisco ASA 5510 with Security Plus and active/passive failover
 
And the older ones?
(ASAs should handle OSPF fine, IIRC)
 
ASA's aren't too bad for OSPF (although OSPF3/IPv6 is another matter)
 
@MuraliSuriar: Netscreen NS25
(Juniper)
 
Hmmm. Never used Netscreens. Are they still running ScreenOS, or are they on JUNOS now?
If JUNOS, OSPF should also be pretty solid, although you'll probably want to do some interop testing with the Ciscos ahead of time.
 
Junos OSPF is rock solid. The newer Juni firewalls do use Junos, not sure if they backported to old SSGs.
 
12:56 PM
this is a very old firewall
IIRC it has OSPF and even BGP
 
The higher end fortinets also usually have no problems with OSPF, but the BGP implementation is absolutely dire.
 
I've not actually used OSPF on JUNOS, only IS-IS. But yes, I'd imagine it Just Works. (TM)
 
@MuraliSuriar Had an odd issue with it not accepting costs correctly with IPv6 on Junos 8.X, but that was fixed ages ago.
 
You were running OSPFv3 then?
 
1:06 PM
Pretty much everyone I've heard of that's using v6 switches to IS-IS so that they only need one IGP running.
 
Still do.
 
Interesting.
You don't find the administrative overhead annoying?
 
We are planning to migrate the core to IS-IS, however it's a legacy from the days when our core network was Quagga running on Dell 1950s!
 
LOL
Awesome.
If you're looking for a good ISIS reference, amazon.co.uk/OSPF---Choosing-Large-Scale-Networks/dp/0321168798 is what I used to study up with before moving to the current job.
 
On wish list, and the boss has gotten a gentle nudge :)
Really do prefer the Junos config over the Cisco config
 
1:21 PM
Absolutely.
Atomic commits, diffs, ability to stage config and roll back...
 
commit confirmed 2 has save my ass so many times!
 
but cisco iz the best! so is Apple!
 
Heh.
Cisco aren't horrible. The thing you have to bear in mind is that Juniper are expensive.
Seriously so.
 
Dan
What an awesome commute in, morning boys!
 
Cisco aint exactly wall mart either
 
1:22 PM
You do get what you pay for, but often you don't need everything they give you and can make do with Cisco.
 
Juniper certainly has no answer for a Cisco Cat6K with SUP720BXL that gives the same bang per buck
 
True, but when you go below Cisco (particularly for routing), things tend to just not work as well.
There are a bunch of switching vendors who are starting to look interesting.
HP, Arista, Force10 etc
Yeah - the Cat6k really is a switch though, rather than a router.
 
The Juniper J series are brilliant, but suffer from being a software based router.
 
Juniper are just getting in to switching, and they've made a conscious decision to build up their switching expertise in house, rather than acquire someone.
 
The Cat6K is really just a Chassis. The SUP720BXL is the routing element.
 
1:24 PM
While this is admirable, and will probably serve them well in the long run, it does mean their switching products suck in the datacentre.
 
You're talking way out of my league here anyways :) I like my little 3750's with ip services stack
 
Haven't tried any of the Juni switches yet. I do like Extreme thoughl.
 
and, after all, my ISP is the one managing the MPLS (IP VPN) connectivity.. they're bringing in dual 7000 routers
 
@NiallDonegan true enough - still, they seem to position the 6k more as a datacenter switch.
 
Most of our management tools and inhouse scripts do tend to rely on Cisco features.
 
1:25 PM
Trying to terminate any kind of WAN on it (POS, ATM etc) costs a fortune.
You need an SSC, SIP, and port adapters.
And if you want to do encryption on top of that, you need a VPN SPA.
 
@MuraliSuriar We deal exclusively in ethernet over Fibre or Cat6.
No ATM or similar!
Makes life a lot simpler.
 
Indeed.
You're using metro ethernet for the WAN stuff as well then?
 
Yup. Protected rings presented to us as fibre or cat6
 
Mmm. I've always been a bit suspicious of metro-E, only because it doesn't give you any path diagnostic information.
You can have up/up links on both ends, but not have end-to-end connectivity due to a failure in the middle, and you have to rely on your carrier having a clue to get stuff fixed.
The nice thing about SONET/SDH is the amount of detail the alarms give you.
 
Our provider can do the whole end to end thing. So if there isn't a full path, we don't get a link at either end.
 
1:29 PM
ah, link loss forwarding.
Yeah, fair enough.
 
And they're very good if something breaks, in that we get the full details and not a fob off.
 
Bleh. Carriers seem to universally suck, in my experience.
 
The only unplanned outage we had from them was JCB related.
 
That may be because we have to deal with so many of them.
 
GBLX are decent enough, TINETs support is good, but their routes are crap. The less said about Cogent the better! We're getting Level3 in to replace Cogent as Cogent are having a few peering splats in the EU at the moment.
We tried Packet Exchange for a while as well, but we weren't too impressed with their support.
 
1:39 PM
Bleh. prometric take 5 days to upload results to Juniper?
 
Sam
2:06 PM
Does anyone know any good tools for calculating required disk IO based on volume of data and time? I could work it out but it would be nice if there was some tool that allowed for a sliding scale etc
 
2:33 PM
@Sam: Can you expand on that thought a little?
 
2:46 PM
@Sam: If you are saying what I think you are saying keep in mind these sort of calculations are problematic. We are going through this at the moment... The problem is that spikes are not accounted for
Even if you know the peak amount, you can't really say if X storage will give you the speed you need on whatever activity (random reads, sequential writes, whatever) until you test that workload
At least, that is my current thinking
That being said to actually answer your question... Disk is irrelevant , you just need to move a certain amount of data in a certain amount of time right? Just go type something like "10 Megabytes in 11 seconds" into wolframalpha.com
 
It's BLOODY cold outside
 
yea ... and the snow suprised me too
 
@SpacemanSpiff How cold?
 
@ChrisS My thermometer says -13ºC/7ºF, don't know about where he is.
 
It's -12ºC/10ºF here.
 
3:03 PM
That should help the non-Imperial amongst us.
 
was right at 0 this morning
 
@packs There's a lot of Brits running around here... So it's best to always include units.
@SpacemanSpiff 0 what?
 
I think the British or more Metric than the US
 
@ChrisS My old university physics prof would always assume furlongs per fortnight if unspecified. I suppose it has been a bit too long for me.
 
0 F
I'm in Chicago
 
3:05 PM
@SpacemanSpiff Got me beat, it was 4ºF here this morning.
 
Anyone know of a free linux based netflow collector?
 
err ... damn i think it's call netflowd
 
@SpacemanSpiff Are you wanting to catch netflows from a Cisco device, or collect flow data using a linux system?
 
I want to collect flows from a Cisco/Juniper to a Linux system
 
3:09 PM
Damn @spacemanspiff I'm flying to Chicago this evening. 32 here in PA.
 
it was colder at 6am
 
I think that will do me. I'm working an interesting issue for a school district.
 
aaand its weekend! beer! soccer! sleep!
see you all on monday :)
 
Laters.
 
later
@SpacemanSpiff oh?
 
3:10 PM
Weekend= datacenter in Chicago... I'm tired.
 
@packs Unfortunately that's a pretty slow rate; would help if he mixed in some SI prefixes like kFur/4tnite
 
I'm going skiing tomorrow, can't wait.
 
Yeah... anytime I take out the deny rules in their edge firewall for HTTP the firewall just gets murdered with traffic
I'm thinking, it's a few hundred Macintosh boxes downloading updates, same with Windows machines
 
ahhh
yea that is a fun one ... and i'm with you on the updates
 
The end goal is to get content filtering through websense working. Originally I put in policy based routes to trombone the traffic back into the LAN over to a proxy server but saw the same network congestion. I thought I introduced a loop when to my surprise simply letting HTTP out has the same effect
 
3:13 PM
@SpacemanSpiff Have you looked at allowing a CDN to host on your network?
 
Destination QoS against microsoft and apple servers, if you can get the destination addresses?
wait, I should be leaving the office :( bye
 
@packs not really familiar
I'm going to suggest a WSUS server at the minimum.
 
yes was just about to say that @SpacemanSpiff
for now you could QoS down the ms and apple netblocks
 
@SpacemanSpiff That's true, I didn't actually notice if you said how much control you have over your endpoints.
 
until you get a better solution in place
 
3:16 PM
As a university employee, we can really only set the apple update or windows update server to less than a quarter of our nodes.
 
Well, first things first I'm standing up some monitoring tools before I throw darts at the dartboard.
 
At the risk of recommending a product, Akamai caches Apple updates, and possibly Windows, as well as others.
@SpacemanSpiff Have you looked at some kind of graphing/rrd tool for your network gear?
 
Yeah Zenoss is downloading, I'm quite familiar with that.
That's the thing, I'm brought in to fix the "web filtering issue" but theres so many unknowns right now.
 
@SpacemanSpiff And, it sounds like, no monitoring in place at all. Sounds like you'll be able to bill for a lot of hours :)
 
@Kyle which datacenter will you be in?
 
3:23 PM
@SpacemanSpiff: Huh?
 
@kyle other kyle
 
That doesn't work for me :-P
 
then change his nick ;)
 
Heh... yeah, the other Kyle.
 
@Spacemanspiff I'll be at the AT&T one in isle off ogden ave.
lisle that is, sry fat fingers...
 
3:29 PM
Gotcha... I'm on Ogden Avenue right now.
 
It's my first time going there... we are adding pcie ssd's for our db server so I figured this was a good time to go.
 
FusionIO?
 
yup
 
I was able to get 300,000 IOPS out of our demo card
 
Wow...
The guys in Marseilles tested our demo cards not sure what they got out of it though. It must have been good enough to purchase.
 
3:32 PM
We benched it against a double shelf of Equalogic SSD's and it still came out on top
 
@SpacemanSpiff: Oh this is good to know ...
@SpacemanSpiff: What was the pricing on equalogic shelf with SSDs?
 
We evaluated Equalogic before going with Fusion.
 
not sure they were on loan from Dell since dell is rebranding Fusion
I found it odd they were willing to let us demonstrate that the fusion card bests their priciest array
 
@SpacemanSpiff they have a new C series that is pricier now
and anyone who doesn't admit fusionIO is faster is lying to you
 
I want to re-do the testing with 10Gb links too
 
3:35 PM
@SpacemanSpiff: So how are you handing failure of a fusion drive?
 
oh ... you tested FusionIO against 1GB links?
yea really not suprised at the result :)
 
well, multi-path links, so it was really 4Gb
 
@SpacemanSpiff well .. you'd think that ... but most iSCSI SANs suck balls at multipath IO
 
according to them it "should" have been using all of them.
 
it probably wasn't
 
3:37 PM
@KyleBrandt haven't had one fail yet... they claim there is enough redundant storage on the card that you'll probably replace the server before the card fails
 
So no raid over them or anything?
 
@SpacemanSpiff FusioIO claims the ioDrive cards max out aound 150,000 IOps... maybe the documentation is outdated?
 
@ChrisS they're tweakable, and it depends on which ones you get... I was able to squeak out 300k with itty bitty block sizes... with realistic sizes we were holding 140-160k
 
@SpacemanSpiff Ah, that makes sense too.
Interesting results.
 
@SpacemanSpiff what is your IO use case - most sequential? mostly random?
 
3:41 PM
Sequential usually... most people put their DB logs on them
 
That seems odd... isn't random where they kick ass?
 
I'd like to get my hands on a RevoDrive, 70k IOps and only $215 for 50GB.
 
@KyleBrandt I think so. They seem to kick ass at everything though.
 
@SpacemanSpiff: We are looking at the exact same stuff at the moment
 
The tune from fusion also is that instead of using shared storage you build standalone boxes with cards and then use replication since things are so damn fast now.
 
3:45 PM
I'm kind of turned on by the Fusion -- @Zypher less so
@SpacemanSpiff: Sync or ASync?
 
We're looking at the Compellent storage at the moment. The Tiered system is very very handy.
 
@ChrisS Revo's are OCZ right?
 
@NiallDonegan Rumor is that Dell is buying them, our SE's are very tight lipped right now
 
@SpacemanSpiff s/buying/bought
 
3:47 PM
they are just at stage 1 not integrated at all yet
 
@SpacemanSpiff They have been bought by Dell. The tech is really really nice though
 
like equalogix about what a year and a half 2 years ago
 
The fibre channel kit for connecting it up is stupidly expensive though
 
@KyleBrandt Not sure really, none of our customers have asked for PS for us to get experience with them.
 
@Zypher Yep. OCZ seems to be making a name for themselves with prosumer SSD technology.
 
3:48 PM
I do believe they are doing async though
 
yea, CDW dropped them as a supplier due to performacne and quality issues ... so take that as you will
 
We're doing a ton of EQL installs right now... one or two arrays, three to four ESXi hosts...
 
@Zypher I thought that was supply chain problems and desktop memory quality issues?
 
@ChrisS check out crucials stuff - tomshardware.com/charts/ssd-charts-2010/…
at least that's what my rep told me ... so you know add in the sales creature fudge factor
just bought those RealSSD's for some of our office boxes
SATA III mmmmm
 
I know OCZ has a reputation for their supply chain being a mess. Anywhere that carries them you'll constantly see "Backordered".
 
3:52 PM
@KyleBrandt Have you actually gotten your hands on a Fusion card?
 
Not yet
 
@Zypher The RealSSDs look interesting; we just started putting the OCZ Vertex2 SSDs in our laptops; so much nicer than an normal disk drive. I'm quite happy so far.
 
yea i really shoudl get around to ordering one for my laptop
i jsut dread the re-install :)
 
Considering how much I abuse my laptop, I need to reinstall Windows every year, so this was just a good excuse.
 
ahh yea havn't hit the year mark yet
i shoudl do it every year
but realisticall it just gets comfortable around 9 months
then i push it to about a year and a half ...
 
3:56 PM
The Vertex2's are nice drives much better than the first gen. I personally prefer the Intels though, I'm running one now and love it.
 
Anyone around that could help me figure out a sql named instance firewall issue
 
what's going on @msarchet
 
Well I have the incoming ports set up 1433 TCP and 1434 UDP, and sqlbrowser get's the connectiong (see by using sqlbrowser.exe -c) but the client fails to connect
with Error 26 (the network related error)
However if I set up a rule to allow all incoming TCP connections it works
 
do you have any other instances running on the box?
 
nope
just one named instance on 2008 R2
 
3:59 PM
not even a default SQL instance?
 
nope
I just did the installs yesterday afternoon
brand new machine
 
hmm... ok so i've only ever seen this behavior when you have multiple instances
 
yea that's what I thought at first
but I checked
 
ok so what is probably happening is it decided for whatever reason to NOT use the defautl port
 
well
 
4:00 PM
and use RPC or random 14xx port
 
It's a named instance so it doesn't use 1433, and that's what SQL Browser is supposed to do
Well that's what SQL browser is supposed to do for you
 
yea ...
supposed to being the operative words there :)
 
Sorry I think my chat is messed up
I my messages vanished but looks like you saw them
 
yep i see em ... odd
so you can go into the sql connection manager and force the instance to 1433
 
yea but I don't want to have to do that
I shouldn't have to do that
 
4:03 PM
or you can chase the ports it is trying to connect on by looking at your firewall logs
 
but let me try it
 
RPC and firewalls don't get along too well
 
Trying to see if my Dell E6510 can accept a disk drive in the hot-swap DVD drive bay
 
Well on every other machine I've used it can do this with just the 1433, and the 1434 rules
 
yea i'm betting you're getting lucky with some other rule ... i've struggled with that before ... it woudl work on 1/2 the machines and not on the other 1/2 and the problem woudl float around as RPC decided on new ports
 
4:07 PM
Yea if I turn off dynamic ports and set it to 1433 it works
But I don't understand why it wouldn't work with dynamic ports and the way that it should be set up for named instances. Unless that's just intended behavior to not work with dynamic ports and a firewall
 
you can get it to work but it's a PITA cus RPC just randomly uses ports
not sure if you can limit this with SQL
but you end up openeing large swaths of ports if you can't
i think the last time i tried i opend 1400-6000 TCp
and had to keep growing the range
it's just easier to force it to 1433 if you are going through a firewall
 
Whatis the advantage of dynamic ports?
 
it's not just a SQL issue
but anything that uses RPC through a firewall
 
yea
no makes sense
 
linked servers are really fun though cus the remember the ports they tried
open 1466-1500 try it
next run "GAH it's using 1501"
 
4:12 PM
lol
 
or it'll do something fun like use 1601 .. so you think you've git it open 1466-1600 so it can incrmenet
shakes head
one night at liek 4 am i said f this and opened 1466-30k and emailed security telling them to deal with it i'm going to bed
 
RPC is a pain in the backside.
That said, there's an argument to be made that a security policy that relies on port numbers is probably not as secure as one would like.
HTTP and DNS are now viewed as Universal Tunnelling Protocols, after all. :P
 
yea ... it was between two internal segment for PCI compliance ... very strict no http, dns only to the dns only between the dns server on that segment and the master in another segment
 
The most common annoyance we're seeing recently is people looking to open up high ports in the firewall because they can't figure out virtual hosting on port 80, or they don't understand that https requires dedicated ip per cert
and yes, I do know about TLS SNI
 
4:33 PM
I've wondered about SNI. We're not using it, but I do not know how to measure uptake in browsers.
 
@sysadmin1138 Mostly only the newest (beta) browsers support it.. I wouldn't count on using it for another year or more. But that's just me.
 
@sysadmin1138 Any version of IE on windows XP won't support it
and Safari also lacks support.
As it turns about 35% of windows users visiting our main page still use Windows XP
 
Thanks. SNI is nifty for what it does, but as always have to wait 4 years after it shows up in a major browser before even considering going there.
 
Hell, IPv4 space is running out right now, and it'll still be years before IPv6 is properly supported.
 
@NiallDonegan There's a lot of FUD surrounding IPv6 and it isn't going away anytime soon.
 
4:49 PM
@ChrisS Yup. We've got it fully deployed in the core, however some of the edge devices are still proving a bit problematic. At least vendors are strating to listen now though.
 
Is everyone looking forward to World Break The Internet Day? :)
 
That's my biggest frustration with IPv6, devices that don't support it, or more commonly these days "partial support" (meaning it does 98% of what you need, but there's one feature that's a total show stopper that doesn't work yet).
 
It annoys me that consumer CPEs don't have proper firewall configuration for v6 yet, as far as I can see.
 
@ChrisS One that springs to mind is stateful failover on Cisco ASAs. Works a charm with IPv4, doesn't work at all with IPv6.
 
I've set up a couple of 6in4 tunnels, and one of the providers requires ICMP reachability to the v6 tunnel endpoint for health/stability checking
There isn't any way to do granular packet filtering on the Airport Extreme I'm using.
Yet another reason to hate NAT - it's made firmware writers lazy. >:/
 
4:59 PM
We've had native IPv6 in the office for years now. The only site that has had issues has been Nominet, after they went screwing around with MTUs
 

« first day (132 days earlier)      last day (4849 days later) »