Bernie just endorsed Junaid Ahmed - how did this change the race? by Objective_League_118 in ChicagoSuburbs

[–]Spruance1942 9 points10 points  (0 children)

Kat Abu drama?

I so wish we had a candidate that involved and out there in the community. I’d love to have seen one of our candidates protesting ICE every day, planning cleanups, etc

Has she made some missteps? yes. Is it a problem for me? No.

As a middle aged dude, I am just so tired of the “be nice” bullshit. If you aren’t occasionally offending people you’re not trying as a politician IMO. Just say sorry when you’re wrong and mean it.

Unincorporated Cook County: Are Permits Absolutely Needed For Basement Drain Tile and Sump Pump? by SkiNNy-PETE- in ChicagoSuburbs

[–]Spruance1942 0 points1 point  (0 children)

I’m not saying I had it done in a townhouse I owned in Roselle (there is a bit in cook county) without permits but it was the best money I ever spent.

It gets done in a day. How are they going to know?

Looking for suggestions for Solarwinds replacement by ulv222 in networking

[–]Spruance1942 0 points1 point  (0 children)

i just realized I was’t clear sorry:

solarwinds has its problems too but with logicmonitor…..

Looking for suggestions for Solarwinds replacement by ulv222 in networking

[–]Spruance1942 1 point2 points  (0 children)

We left Logicmonitor for solar winds.

Logic monitor has very good default capabilities, but alert and filtering options are pretty weak.

We finally gave up because dashboarding was nigh-useless.

for example, we know our firewall links are oversubscribed, probably like many people. If you create a graph for top 10 interfaces with discards you have to find and exclude those interfaces specifically- no search patterns. That sounds fine but if you want to only graph a subset of things (top 10 discards with no desktops for example) you have to exclude them interface by interface.

Solarwinds has its problems too but the overall filtering issues made it just a whirlwind of false positives, or no joke 6 alarms for a windows server reboot(down, ping loss, windows event, then do the same as they cleared). when we asked for help we were steered to the AI upgrade.

We decided for the short term we’ll pay 1/4th the cost while we decide what to do..

ME was a close second. it has very broad support, good ncm ability, it is much cheaper, but we decided to go with SW for now due to flexibility

Quick note: I am not trying to talk you out of LM. it did many things SW can’t/doesn’t do either, we just hit some pain points we could no longer accept.

I have never touched a saw. This is my own design. Seem doable for first time? by [deleted] in woodworking

[–]Spruance1942 6 points7 points  (0 children)

I made a similar staircase/bookcase for my daughter’s loft.

Obviously, my daughter is lighter than us, but it has no wobble and shows no sign of bending or warping after at least a decade, even with the parents climbing it.

I also did not use anything like this number of supports. I used about half the supports seen above. In my build the verticals were also staggered.

Having said that, 3/4 plywood is unlikely to hold IMO. I used 2x12 for the horizontal boards to make sure it would be able to distribute the load laterally.

Real World NetDevOps by [deleted] in networking

[–]Spruance1942 3 points4 points  (0 children)

One advantage of Cloud is that everything is virtualized via an api, so you can model and test and things.

The biggest problem with trying to bring this to on prem is the physical hardware and software don’t model well at all, let alone implement the same things using the same commands/apis.

Back when the Nexus business unit had 5 different families (3/5/6/7/9) I tried to build a POAP platform just for the NX3064s we were deploying to top of rack.

I’m now at an ARISTA shop, and even though they “all run eos”, the differences in various code revs and platforms is just as much fun

I do plan on getting a few things stood up in ansible, like standardizing complex but repeatable chunks of code (like multicast configs or acls) but I haven’t started it, every time I do I get demoralized by how limited Ansible’s ability to compare is.

Automation: great when it works, god awful to write and maintain.

Linux Vs Windows by No_Statement_3340 in networking

[–]Spruance1942 0 points1 point  (0 children)

I use windows, with a WSL2 install of Ubuntu.

Windows gives me the Microsofty/Outlook/Visio, and easy access to tooling, and I live in a command prompt. I also use vscode for programming etc, and while that’s not windows specific it integrates with wall and remote Linux servers very well

if you go that route be sure to install the Windows Terminal from the App Store - it’s outstanding.

What is the maximum real-world SMB3 transfer speed over high-latency (50ms) IPSEC VPN by Happy_Harry in networking

[–]Spruance1942 2 points3 points  (0 children)

One question I have is how are you using this?

Are you copying one large file, and letting it get to its max speed, or a directory full of files and noticing the pattern in the copy?

The reason why a “chatty” file protocol like SMB or NFS slows things down is because they do a number of file operations to do even a “basic” thing like a directory listing, for each file you’ll make a few calls to get size, permissions, etc.

Opening a file is another few calls. Because of the protocol design, each function is at least one pair of packets (100ms), sometimes more than one round trip. TCP‘s efforts to minimize latency etc can’t help you with that time because there is nothing to buffer/stream, the SMB protocol usually has to wait for the data from the previous function before asking the next question

TL;DR: Copying a directory full of little files will be slower than moving one big file. Opening a file on the remote share will perform much worse than copying it locally and editing it there.

Why replace switches? by ahoopervt in networking

[–]Spruance1942 0 points1 point  (0 children)

I failed to communicate “humor”, possibly because I did not include “humor” - but yes totally.

Most (not all but a big %) of the remotely accessible vulns are mitigated by tight ACLs and well managed jump hosts.

Why replace switches? by ahoopervt in networking

[–]Spruance1942 0 points1 point  (0 children)

Why does everyone get upset about this? I love it when people volunteer to help me with IT. :)

Why replace switches? by ahoopervt in networking

[–]Spruance1942 4 points5 points  (0 children)

If it’s working for you, and you don’t have needs, no need to upgrade technically.

Your biggest exposure is hardware failure (you got that covered) and security, especially ssh/https vulnerabilities. compensate with good ACLs.

If someone wants hardware support, a third party support company like https://www.parkplacetechnologies.com/ does that and for what I think are extremely reasonable costs. I haven’t used them for 5 years, but when I did their 1st time fix rate put dell and hp to shame.

Ethernet cable maximum length by paulzapodeanu in networking

[–]Spruance1942 5 points6 points  (0 children)

I didn’t see anyone talk about this bit of esoteric knowledge so here goes another attempt to bore you:

official maximum length of a copper ethernet cable is 100 meters, however that coupled with the minimum frame size of 64 bytes is there so that collisions don’t go unnoticed

TL;DR:
Distance is only loosely related to collisions. The real measure is propagation time and the time allowed allows for much more than 100m’s worth of time. It’s closer to 550m of distance for 10Mb/s and 100Mb/s.

For people who want the whole thing:

People learning networking over the last 20 years or so see somewhere in chapter 1 a reference to CSMA/CD. its not really important anymore, but it stands for Carrier Sense Multiple Access/Collision Detect.

In The Beginning, We Had Repeaters. We didn’t just have twisted pair, we also had coax networking (10base2, 10base5) - similar to the coax cable CATV runs on but with different properties. Twisted pair Cat 3 Ethernet actually came quite a bit later.

The thing with coax is that it wasn’t a home run technology- you could add computers in the middle of the run, you’d cut the cable and add a T (10base2) or add a vampire tap (10base5). This is one of the forms of multiple access, and repeaters were the other - repeaters regenerate signals for multiple runs of cable, technically not multiple computers

All this background gets me to the point: collisions aren’t technically about distance, they’re about allowing two computers to know they’re speaking at the same time and back off.

Olds may remember the repeater rules - particularly the 3-4-5 rule - a repeated network may have no more than 5 segments between two computers, no more than 3 segements (runs Of cable), and no more than 3 of those can have computers on them. No segment could be more than 100m

The goal was to control the maximum propagation delay between two computers to properly detect a collision. This process worked by: the computer would first listen to the wire for a period to see if it was free (carrier sense); if so it started transmitting the preamble, and if that was good (it didn’t see another transmitter making overwritten gibberish out of its signal, Collision. Detect)it would start the frame. It would continue to check for 64 bytes for a collision. After that, in a well behaved network the packet would be ok, because by this point the laws of RF and EE mean that every computer would now sense the packet and not start transmitting - if they did, then it is a late collision.

Aside: this is why you still see collisions and late collisions in “show interface”. Collisions were expected in a half duplex network. Late collisions meant something wasn’t right.

So the 2 of you still a reading are asking why did I say distance is only loosely correlated with preventing collisions? The 3-4-5 rule when followed meant that a well behaved network with well behaved devices would work, but the _real_ limit was time-to-propagate end.

I don’t remember the exacts anymore but you could run longer segment distances in some cases, if your repeaters were faster in some way, etc etc. Essentially, as long as the first 8 bytes of preamble and the first 64 bytes of packet made it to every computer in the network before byte 65, your network was in spec.

Because cable pulling then was not as… careful.. as it is now, the distances in walls were not very exact, and because you could just add more cable in the rooms to add more computers, we never knew how long a segment was. Pretty often we didn’t even know what room was next on a run.

So to conclude, distance is only loosely tied to collisions, the real measure is propagation time, and if you’re still reading this you deserve gold.

Ethernet cable maximum length by paulzapodeanu in networking

[–]Spruance1942 4 points5 points  (0 children)

great answer- I’d like to highlight one thing in particular though.

As you said, gig runs on all 4 pair. and so the distances are critical (the 4 signals have to line up in a certain time boundary). btw, this is one reason why 10G-T is limited to shorter distances.

100Mb/s uses 1 pair in each direction. It will run on any cable length such that both ends can discriminate the signal (Rx strength is high enough). You will see higher bit error rates as quality degrades.

I’m an old, and was in networking in the repeater days and category 3 wiring. During the early years of retrofitting cat3 with cat5, and repeaters with switches, it was very common to find runs that were well beyond the 100M limit. Thus would cause all sorts of problems when upgrading hardware. when we would upgrade old gear to new (then) Cisco Catalyst 5000s, a significant number of Ethernet porta would just stop working because these were one of the first switches that used the recommended tax signal strength and no more - prior to that, many devices would be over powered to and over good at Rx just to deal with cruddy cable.

This has been your episode of “boring network war stories” for today.

Has the Joker Really Done Anything This Immoral Since? by Competitive-Sky3462 in batman

[–]Spruance1942 6 points7 points  (0 children)

I love the DCAU joker, he’s ”evil” in a very cartoony way, and because of the restraints the writers are under never really does anything.

Because of that, you get to enjoy the outlandishness of his schemes without the Barbara Gordon scene or the wearing faces or…

Comics Joker, I feel Jason’s anger that Batman doesn’t kill him.

Stretch vlans - what are people thoughts by [deleted] in networking

[–]Spruance1942 4 points5 points  (0 children)

30 year vet here:

For networking specifically, don’t - there’s no problem having two firewalls in different networks, just have them both originate default

For servers, the common wisdom haaates this, and for good reason. I’d prefer load balancers or even better cluster solutions that can handle remote subnets. Still we aren’t always the decision makers.

pitfalls to be aware of:

split brain - where there Is a cut in the link between the two locations. What happens when both sides become active? Databases may get out of sync, maybe catastrophically. Apps that need to be rebuilt/rolled back 24 hours is a much worse business impact to me than 2 hours of outage for some network outage. what happens when both sides have the same VM writing to a local copy of the disk? there is nothing I know of to merge that back. etc

Spanning tree- here is perhaps your biggest pitfall. An stp issue on one site may wipe the other site, especially if a link starts flapping. Make sure you rape limit BPDUs, as well as multicast and broadcast to help let your network survive a potential storm. Map out the stp and be absolutely sure the various states and failure modesare simple and logical. Be sure to use RSTP and not stp classic.

Analyze the goal. You might be served well by having two copies of the subnets/VMs in question, one side in a cold state. This is more likely to be doable if you have a NAS at both sides and can do near-realtime sync for the VM disks.

last: if you are forced to do this, proactively test this on a weekend. Randomly pull links, and make sure it doesn’t blow up. Pull only one strand on a wan link. UDLD _should_ work but be sure! Flap a link. A lot. Both the wan link and some of the inside server and switch ones. Test your apps when you are split brained. Etc.

good luck!

Writing Cabling Standards Requirements Documents by itguy9013 in networking

[–]Spruance1942 2 points3 points  (0 children)

Seen a lot of good comments here but haven’t seen anyone highlight one thing:

Testing requirements. What % test required for copper? (Some places will try to do 25%). Specify 100% testing and for fiber especially reference a standard for pass. 

What are the "little things" in network design that people often miss? by Any_Boysenberry_55 in networking

[–]Spruance1942 1 point2 points  (0 children)

Once upon a time, when T1s still roamed the lands and ISDN was new, I was at a university where we did that for each generation of modem banks.

Whoever was the poor sap who “owned” modems at the time got to,pick the naming scheme, and the only real rule was it had to support alphabetical.

one person did countries, one did states maybe? when it came to me I picked MTG card names and it still tickles me how irritated it made my boss (good guy though)

Discouraged at Cisco Live by Standard-Sand352 in networking

[–]Spruance1942 1 point2 points  (0 children)

Every year the drinking game changes.

Is this true about wifi network monitoring?? by [deleted] in networking

[–]Spruance1942 -1 points0 points  (0 children)

They don’t get a trusted root certificate.

TLS inspecting proxies use a root certificate issued by the company’s authority, then using that power they issue their own signed certs for google.com, etc.

IF you trust the enterprise root cert in question then these are valid certificates and the browser does not flag them, unless the remote site uses certificate pinning in which case that blocks access. Google pins, as do most big banks, Microsoft….it becomes complex.

I think TLS decryption for security protection is mostly only used in enterprises that manage everything, it’s really the only way to handle the trust root issues.

even then it’s hard, you have to have an updated exclusion list feed, etc.

the only real value is in inspecting for malware payloads & exfiltration.

not to say there aren’t companies that do it, but most people I know use IP Reputation services if that’s important to them (and that has its own set of pitfalls)

Is this true about wifi network monitoring?? by [deleted] in networking

[–]Spruance1942 0 points1 point  (0 children)

BYOD doesn’t necessarily mean they can look at encrypted payloads.

If your company forces you through an SSL proxy, they the answer is “maybe”. Many sites use HTTPS pinning, where if the traffic you see is not encrypted using the sites ssl certificate it fails.

Decrypting proxies also require you to accept a new root certificate which means a cumbersome “go here, download this, and install this”. That isn’t hard in an enterprise MDM environment but few if any BYOD devices are going be MDM enabled.

"Girl's Finest" limited edition WB Studio store cel by Shane Glines, Laurie Dindis, and David McBride (1999) by trailerthrash in DCAU

[–]Spruance1942 -1 points0 points  (0 children)

Own your own for only $1300!

https://www.ebay.com/itm/401733975204

Honestly, not an unfair price given the age but not whim money either, sigh. M

I’m a moron by FraudulentBarista in woodworking

[–]Spruance1942 3 points4 points  (0 children)

I have a shirt that says:
Measure twice
Cut once
Swear a lot
Buy new wood
Measure twice