Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Impotence
Nov 8, 2010
Lipstick Apathy
Have dumb thing I can't seem to figure out.

Periodically (at least every hour), all new TCP connections fail. UDP works fine. ICMP works fine. Most of it is attached through a Mikrotik Routerboard and a handful of Meraki switches. I have no idea where to begin debugging this, but I'm unable to plug directly into the handoff due to cable length. The Mikrotik also can ping stuff while it's "down", but it's "down" for every connected device including itself (it can't pull packages to update, for example, but can ping/traceroute from the router console).

traceroutes all work during this, and have no packet loss.

Also odd: ssh for example stays connected if it's already connected, typing `uptime` works and gets a response, but any large responses like `ls -la` in a large folder will send 5-6 lines and then the ssh session drops.

Impotence fucked around with this message at 12:01 on Jun 27, 2020

Adbot
ADBOT LOVES YOU

Impotence
Nov 8, 2010
Lipstick Apathy

H110Hawk posted:

How does this resolve? If the Microtik cannot download a package to itself directly then I'm going to blame that. You should bring a laptop or something down to it so you can directly plug in and test. Something about its state table is being overwhelmed. (UDP and ICMP being stateless.) No firmware updates available? It might simply be failing - power brick, motherboard, flash memory, etc. Is it under warranty? Can you overnight a new one for testing? (This sounds like a corporate setup.)

After a few minutes things start working again. It lasts a random amount of time each time. The same thing happened to an EdgeRouter, with the same characteristics

Impotence
Nov 8, 2010
Lipstick Apathy

rufius posted:

Assuming you left the ports default, forward 443/TCP and 1149/UDP to the local IP of your NAS.

You’d do this in the ER-X in the firewall section.

Might have typoed, 1194

Impotence
Nov 8, 2010
Lipstick Apathy

Rexxed posted:

That sounds more like your modem than the router if it's happened to two routers. It could be bad noise on your lines. I know that I used to have almost yearly problems with comcast due to water getting into the taps on the poles and freezing and exposing them to the elements which would result in weird connection problems and signal loss in the spring. It almost always required a line technician to come out but you'd have to call a normal tech first who would then be able to contact a line tech. They seem to have improved things lately as I haven't had an issue in the last couple of years.

This is FTTH and I have a single ethernet handoff. I do not have an ONT or whatever.

Some days it doesn't happen at all, some days it happens hourly. I'm going to try to plug in a rpi on a battery bank for investigation to a port directly, but really hoping it's not their problem because there's basically zero tech visits due to covid.

Impotence fucked around with this message at 23:23 on Jun 28, 2020

Impotence
Nov 8, 2010
Lipstick Apathy
If you have coaxial in each room already consider MoCA 2.5

Impotence
Nov 8, 2010
Lipstick Apathy
Parsec/etc act as a giant video stream. RDP handles video fine if it's extremely low latency and high bandwidth, but doesn't seem to compress all that much. They are intended for two completely different use cases.

Also: this is a D3D game - top is RDP, bottom is Parsec on the highest quality it can do - notice the hand/glove sharp lines completely disappear into a mess on the bottom:

Impotence
Nov 8, 2010
Lipstick Apathy

Smashing Link posted:

That is interesting. I am more of a Mac guy, trying to move into the Linux/VM realm, so not as familiar with RDP. Parsec does seem amazingly fast to me however.

Something amusing is that if you play multiplayer (think MMO) games, Parsec, Teamviewer, etc will all generally be blocked by anticheat systems for attempting to inject keystrokes into the stream. They either render as a black window (uncapturable), no sound, and you can't type or click or do anything into them. Some anticheats kill any form of remote service. RDP is usually excluded from all of this.

Impotence
Nov 8, 2010
Lipstick Apathy
What kind of home automation? Virtually all of it I've seen is Zwave or Zigbee, not Wifi. (I also don't see a doorbell needing more bandwidth)

Impotence
Nov 8, 2010
Lipstick Apathy

Lifespan posted:

Now that I am hearing you guys have Comcast fiber in the PNW, how much does it cost? I am "semi-rural" outside of Seattle and pay an insane $150/month for 300/15 with unlimited data and am none too happy. It functions and I need it to make a living, but the price is insane for what I get.

Is this a separate product from the 2000/2000 Comcast Fiber that's 2-5 year contract only?

Impotence
Nov 8, 2010
Lipstick Apathy

Lifespan posted:

Just had another interesting Comcast discussion. I pay $50 to get rid of my data cap. I was told they would waive my data cap completely if I rented a modem from them for $25. I guess I can continue to use my own modem and just keep theirs in the box, but what is their angle with that?

https://billfixers.com/blog/comcast-is-charging-some-customers-35-to-own-their-own-modem

quote:

The huge disconnect in that pricing means customers who have already gone out and purchased perfectly good modems now have to rent a completely superfluous modem they don’t want. The alternative is to spend an extra $35 a month extra just to use their own modem. This is something we’re now hearing about from Comcast customers who aren’t sure what to do. On top of that, there are considerable downsides to renting a modem.

Comcast uses rental routers as public Wi-Fi hotspots. They were sued for it in 2014, but have only accelerated. It’s now a hugely advertised feature of their wireless offering, Xfinity Mobile. One analysis found that hosting their “free” Xfinity hotspot could actually cost consumers $22.80 in electricity. The cost isn’t the only downside.

A bug last year found that a user connected to a Xfinity Wi-Fi hotspot could access private user data. Connecting to an Xfinity Hotspot gave you access to the Wi-Fi network name and password for the device in plain text. It also revealed the full account service address. That’s a serious security flaw that put every rental customer at risk. Meanwhile, customers who owned their own modems were safe. That kind of issue is part of the reason customers have a right to own their own modem.

The FCC regulations state that “no multichannel video programming distributor shall prevent the connection or use of navigation devices to or with its multichannel video programming system,” except in cases where the device would harm the provider’s system. In 2016, the FCC ruled that the provision specifically covered a right to customer-owned cable modems. Under Comcast’s new offer, technically you’re not prevented from owning your own modem. In practice, though, it essentially comes with a $35 penalty.

Impotence
Nov 8, 2010
Lipstick Apathy
I am curious if they will enforce your use of their modem (because it phones home, runs their firmware, and is remote-controlled, wifi password set remotely etc too) and surcharge you heavily if you rent it and toss it in the closet.

Impotence
Nov 8, 2010
Lipstick Apathy

Internet Explorer posted:

Oof. That's real bad.

but hey, ui have augmented reality mobile apps now!

Impotence
Nov 8, 2010
Lipstick Apathy
I don't know what NPM is but I'd just have 3 server blocks with a location / { proxy_pass 172.whatever.docker:1234 } in it.

Impotence
Nov 8, 2010
Lipstick Apathy

Henrik Zetterberg posted:


e: I've never used coax for my network, other than the last 200 feet from the provider box to my house/modem. How would I use coax to hook up APs? I'm completely in the dark on using coax.

I have used something like this before: https://www.amazon.com/goCoax-Adapter-2-5Gbps-Ethernet-WF-803M/dp/B07XYDG7WN

Impotence
Nov 8, 2010
Lipstick Apathy

Hadlock posted:

I think most modern parts of the internet use ipv6 at this point

Maybe 10 years ago it might have been a problem for some devices, but the last time I ran into problems with it was at work in 2015 and really it was misconfiguration, not an actual routing bug

Pretty much this, the majority of US traffic to Facebook is over IPv6 (and UDP), Google is almost half, it's already well past the time ISPs should get over their poo poo and have native v6 for everyone already


H110Hawk posted:

And some isp's had really lovely uplinks for ip6. "Hey hurricane electric will give us free ip6 if we hit this peering exchange" or "$0.50/mbps for ip6 this checks a box." when in reality HE is garbage. (Pretend they're buying where 50¢ is cheap.)


Cogent's IPv6 implementation and network is orders of magnitude worse than HE at a higher price point

Impotence
Nov 8, 2010
Lipstick Apathy

H110Hawk posted:

I mean calling it a network is pretty disingenuous don't you think?

It can only reach 1/3 of the internet!

(They've also recently started charging per BGP session... when you buy IP transit ...)

Impotence
Nov 8, 2010
Lipstick Apathy

stevewm posted:

I think a lot of this is because a large portion of Facebook access is done over cellular networks. All the cellular carriers natively implemented IPv6 during their 4G buildouts. I'm pretty sure v6 support was a requirement of the various 4G standards...

My own ISP I can see their ASN has several IPv6 peers, but v6 has not been enabled on their own network yet. :/

I think the UDP part (HTTP/3 or QUIC) is also because of Chrome or native app on mobile devices, since it's significantly faster on high latency/mobile devices than normal TCP-based HTTPS with handshaking and all.

For whatever reason, my ATT hotspot doesn't give IPv6 addrs anyway (still).

Impotence
Nov 8, 2010
Lipstick Apathy

SwissArmyDruid posted:

Your aversion is well-founded, I got burned by the J-series Celerons in NAS enclosures, and I still eye the newer hardware we used to replace it with suspicion and distrust.

I had a huge deployment of Atom Avoton SoCs and they pretty much all died. Not even a 'bad AES performance or something' type of problem but just dies after a while.

Impotence
Nov 8, 2010
Lipstick Apathy
Yeah it was the LPC thing. I have weird usecases where I colo software routers (usually a low power PC with a CPU that supports AES-NI running vyatta/vyos or bird for bgp).

Impotence
Nov 8, 2010
Lipstick Apathy
Joke option: link aggregation and just put everything on 3/3


Are they still providing some $xxxx-xxxxx switch/handoff rental equipment for $10/month? I think my friend got a Juniper from that

Impotence
Nov 8, 2010
Lipstick Apathy
My nvidia shield can't connect to several 5ghz bands, seemingly mostly the upper ones. It sees it, it just hard fails when connecting with no particular error message.

The Meraki did band steering or otherwise dynamically changed bands too, so it would drift in and out of connectivity at random.

Impotence
Nov 8, 2010
Lipstick Apathy
Maybe a wired outlet in living room - TVs, streaming, consoles, all massive high bandwidth hogs

Impotence
Nov 8, 2010
Lipstick Apathy
What's the cheapest thing that can do BGP with about 400 peers and not be terrible at it? Was considering a mikrotik.

Impotence
Nov 8, 2010
Lipstick Apathy

SamDabbers posted:

I'd be interested to know more about your home networking use case for BGP with 400 peers :allears:

incredibly stupid, but it's cheaper for me to announce a /24 instead of pay $30-50/m/IP for my NAS, gameserver/homelab VMs, plex server, etc

H110Hawk posted:

Real question is what size tables per peer? We talking about 400 full tables or 400 default routes? How often do peers come and go?

peers are largely stable, 1-2 fulltable and rest just announce their own customer prefixes

Impotence
Nov 8, 2010
Lipstick Apathy
probably in the 300-400 range - i have a few meraki items that are about to go unlicenced at the end of the year and i figure i could replace some things since the licence fee is way out of my not-enterprise budget.

the bgp part is partially for homelabbing/learning in a not-lab environment, and i have very strict prefix filters to not leak routes anyway that take priority. re: nat - yeah i know. i host stuff for friends, back up my colos/side projects, run a couple of gameservers from the bedroom closet.

Impotence
Nov 8, 2010
Lipstick Apathy
iirc there are some routers that are also sold with gigabit ports but a 100mbit only wan port

Impotence
Nov 8, 2010
Lipstick Apathy

Buff Hardback posted:

I wanted to like Cloudflare DNS, but archive.today/.is/whatever tld they're using this week replies to Cloudflare DNS with bogus A records, as Cloudflare doesn't send any client-subnet information which archive.today uses for balancing. I found NextDNS on hackernews or something and switched to that and it's been working perfectly for me along with blocking ads on my phone.

I'd avoid them as much as possible, they almost certainly don't use this for balancing, but explicitly for user tracking.
archive.whatever also returns fake clones of the Cloudflare error and captcha pages (ripped 1:1), they also attempt to tie your resolver back to you and other sorts of creepiness

Impotence
Nov 8, 2010
Lipstick Apathy
i believe they also added some kind of obnoxious to disable / no UI option / default turned on phone home analytics to just about everything?


edit: lol, when it launched after the blowback they were just like "block trace.svc.ui.com in your fw to turn it off"

Impotence
Nov 8, 2010
Lipstick Apathy

SwissArmyDruid posted:

UDM (the Trashcan Mac, non-rackmount one) also demands that you create a Ubiquiti cloud account with no options for local credentials only, before you can access any functions. It won't even function as a dumb switch in the meantime.

Combined with their most recent data breach of customer information, and it's enough to put anyone off Ubiquiti.

In case anyone was wondering, I've decided on getting something midway up the stack from Netgate.

Netgate has had a few interesting scandals/history of hating open source, including one this month regarding some apparently ludicrously insecure and rushed security code

Impotence
Nov 8, 2010
Lipstick Apathy
really the big difference is moving from cable to fibre completely, where you get no additional latency and symmetrical upload.

Impotence
Nov 8, 2010
Lipstick Apathy
the omada line is the "everything is managed in the cloud, gently caress off locally" line right?

Impotence
Nov 8, 2010
Lipstick Apathy

rufius posted:

In my case, I actually run my own DNS forwarder on my network and have captive DNS setup because I want to force all queries through my DNS forwarder. That ensures IoT devices can’t hardcode their own DNS as well as ensuring all queries are encrypted.

What happens when the IoT device cert-pins a DNS over HTTPS provider for its own use?

Impotence
Nov 8, 2010
Lipstick Apathy
who came up with the name procurve, or ethertwist?

Impotence
Nov 8, 2010
Lipstick Apathy
how much do you like the cloud

Impotence
Nov 8, 2010
Lipstick Apathy
i just use a rpi zero w with an otg plug, one USB into printer, one into power.

wireless printing, total cost under $10-15.

the only caveat is that you should know how to apt-get install cups

Impotence
Nov 8, 2010
Lipstick Apathy
I don't think I have ever seen a good powerline adapter. Moca 2.5 maybe. But I have never once seen powerline be decent.

Are you also sure you're plugging it directly into the wall on the same circuit? No UPS, no power strips, no surge suppressors, etc allowed.

Impotence
Nov 8, 2010
Lipstick Apathy
These are $5 if you absolutely don't want to punch things. Port on both ends.

Impotence
Nov 8, 2010
Lipstick Apathy

fletcher posted:

With Unifi how do I make sure somebody can't unplug one of my devices and plug in their own to get on the LAN? I thought I could use the MAC address filter set at the port level, but when I added the MAC address of the access point plugged into that port, it seemed like it blocks all the traffic coming from all the different MAC addresses connected to that AP.

This physical access to the port level security is definitely overkill for my use case, but it seemed like something that should be doable so I figured why not.

I was thinking maybe I could set the port profile to the VLAN the access point uses, so at least they go to my "insecure" VLAN if they plug into where the AP is plugged in, but does this screw anything up if both the network the AP is configured to use is set to the VLAN as well as the port profile the AP is plugged into is also the VLAN?

Isn't this logical, though? If you want port security, you want the ability to block someone from plugging in whatever they want into that port => you have to selectively allow every single device you have.

That includes anything bridging onto the network, AP or switch. What is the point if you allow a switch through as a whole and someone just unplugs one of your things on the switch and plugs in their own?

Impotence
Nov 8, 2010
Lipstick Apathy

Pilfered Pallbearers posted:

I know this may be a little specific for the thread, but google/VZWs forums don't give me anything so it's worth a shot.

I have 1gig/FIOS F3100 router. Hooked up to ONT via ethernet. Literally every 1 minute on the second, I get this log message.

code:
2021 Jun 18 20:03:01	arc_led	info	[SYS.6][SYS] set led name=moca_lan_red state=0 time=0 blink_on:0 blink_off:0
This occurs even if I manually disable MoCa in the settings of the router.

Anyone have any idea why the router is constantly pinging the LED for moca even with no Moca connected and MoCa disabled?


On the same topic, any idea how to get this dumb router to stop considering my plex server as a DNS attack? Googling gives other people with the error, but no solution that I can decipher.

code:
2021 Jun 18 20:05:13	dnsmasq	warning	[SYS.4][SYS] possible DNS-rebind attack detected: xxx-xxx-x-x.abcdefghijklmnopqrstuvwxyz012345.plex.direct
something like
rebind-domain-ok=/abcdefghijklmnopqrstuvwxyz012345.plex.direct/

or just access it by ip:port

Impotence fucked around with this message at 05:48 on Jun 19, 2021

Adbot
ADBOT LOVES YOU

Impotence
Nov 8, 2010
Lipstick Apathy
doesn't comcast charge you additional fees (technically a "discount on the plan" if you rent the xfi gateway from them) if you use your own modem?

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply