How does Firefox decide which TLS version to "Hello" with?

Looking at some TCP dumps I realized that hellos https://example.com with TLS v1.3 but my personal website with 1.2. My server should support TLS v1.3 but Firefox just never even asks for it.

How can I find BASE priority (severity) levels for alerts?

I'm in the middle of doing my homework, and I have to answer some questions on something I'm doing in BASE (basic analysis and security engine). One of the questions is

​

What is the priority (severity) level of both alerts? (Enter a number here)

​

I'm looking at the unique alert page, but I don't see anything on the levels. 1 alert's classification is policy-violation and another is protocol-command-decode. I looked online and I can't find anything on this. The answer is looking for some number

​

Where can I find the priority (severity) level?

​

When looking into the alerts this is a pretty good example of what I see. http://cs.uccs.edu/~cs591/hw/hw5/baseReportRajshri.html

​

On the main alert page I'm only seeing the signature, classification, total, sensor, source address, dest address, first time, and last time.

​

I did a bit more digging and I think I found it. http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node31.html

​

Crtl+F the classification

​

Can someone confirm if I'm right?

Problem with ISE and Infoblox

Hi Community,

Currently I have some issue's with ISE and SRV records we are getting the following error: "SRV record found.Not all SRV records have IP, will need to run additional query for get IP.".

​

We just migrated our DNS from MS to Infoblox and as you can see ISE can find the SRV records but also need the additional A records for the IP.

​

I have 2 TCP dumps where I can see from MS DHCP > ISE with the query answers with the SRV records and Additional
A records.

And I can see from the Infoblox DHCP > ISE with the querty only with the SRV records as Answers and no Additional records.

​

Does somebody else have or had this problem?

Any help would be great.

CEF and LoadSharing

Hello IT people,

I have a simple question regarding that cisco express forawrding stuff. I have to double-check correct configuration from not-so-much trustworthy provider. Mainly composed of C800 series (15.2(4)M6 , 15.4(2)T3, etc..)

For few ios version , output of my Sh ip cef X.X.X.X platform is something like :

Loadinfo wxyz => assuming refering to the pointer in the loadshare table? per-session => Is it the type of load-sharing ? Per-session as oppose to per-packet or per-flow ?

Correct me if I'm wrong but the load sharing is very different from load balancing isn't it ? I mean for N parallel path it's possible that the hash mecanic forward lot's of @ip dst/src flow on one link leaving the others whitout trafic. So the opposite is true : the more couple of session you have more redistributed your trafic is across those N parallel link ?

Is there any solution to "split" more when the bulk of the trafic is to a single IP adress (proxy) ? Assuming per-flow load sharing but not sure.

Bonus : How do I see the loadsharing table built by CEF along FIB and adjacency table ?

Juniper SRX TIFU

Before you start reading this I should clarify that I'm not a Juniper expert, but I'm pretty decent at most network stuff and I am pretty familiar with IPsec and have set up a large number of tunnels on Linux and other firewalls (Watchguard, Sophos UTM etc).

We have a client we deployed an SRX300 to for an office environment on a 100/100 connection.

They have an Azure Active Directory Domain Services configuration and after some research I configured an IPSEC connection from the Juniper SRX to an Azure Virtual Network Gateway.

I based my configuration on the SRX route based example here: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices#devicetable

I enabled VPN Monitor functionality which was described as monitoring the connection (when it did not detect traffic) for drops and re-establishing/re-keying.

Here is where the tifu comes in.

I assumed VPN Monitor was a smarted Dead Peer Detection replacement, it is not.

DPD operates on IKE (Phase 1) and re-keys it as required.

VPN Monitor does a similar job more intelligently, but operates only on Phase 2.

It took me about 8-10 hours of testing other stuff, checking azure, etc, etc to figure it out.

Hopefully this helps someone else avoid this particular pain.

Please tell me if I understand this correctly (PIM-SM)

Obligatory not a network professional, but am tasked with maintaining a few networks as part of my job. We are making some changes to our internet connection and am trying to understand how a few things work.

First off, there are 3 networks involved here.

The first (N1) is a network of machines which process data from hardware "data collectors" if you will. These collectors are cameras and other various sensors. This data is then transmitted through the use of this network's servers and internet connection (4-T1 lines) to a monitoring center which processes the data. This center also monitors all of the devices on this network remotely.

The second (N2) is a network of with it's own router, multiple hardened switches and many cameras. This network is managed by a desktop with a wired connection. This network currently has to active internet connection and is split into several VLANS.

Network 3 (N3) is a government network which receives the multicast traffic from N2 and then hosts it on a public website. N3 receives this traffic through a port on the router of N2, set up in PIM-Sparse Mode.

Currently, we are upgrading the internet connection of N1 to a fiber connection, and wish to share this internet with N2, for the purposes of remotely managing and monitoring the cameras on that network.

Am I understanding what PIM-SM is correctly? I believe that it means that N3 is setup to receive the traffic from N2, but cannot interact with N2 in any other fashion. Transversely, N2 has no other access to N3. Does that sound correct? So does the PIM-SM create a virtual barrier which only allows one way traffic, being multicast data to a preallocated point, the RP?

Bonus Question: What is the most efficient way to share N1's internet connection with N2 while ensuring the two networks remain separate on their own. Both N1 and N3 have a router and a variety of switches.

If any clarification or additional information is needed, let me know.

Thanks in advance.

Edit: Would having multiple static IPs from the ISP achieve sharing the connection to two networks? To do this, I'm guessing there is a modem type device which splits the connection correct?

Amazon now own 3.0.0.0/8

https://whois.arin.net/rest/net/NET-3-0-0-0-1.html

https://whois.arin.net/rest/net/NET-3-128-0-0-1.html

​

Public Resolver on 3.3.3.3 coming soon?

Rant Wednesday!

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

What to do with Static IP Block

I've got Comcast business with five static IP's. Curious if there is anything useful that i could do with the static IPs. I am using the USG=Pro-4 and comcast gateway modem. One IP is assigned to the WAN but not sure how i can best utilized the other four. TIA

When would I disable IGMP Snooping in a smart switch? Fast Leave?

When I look at it, IGMP snooping seems like it should always be enabled to stop unknown multicast traffic from flooding the network. Does enabling IGMP snooping interfere with streaming devices on the network?

​

Also is explicit tracking or IGMP Fast Leave just an added bonus to avoid IGMP control traffic on the LAN? Why aren't IGMP Snooping/Fast Leave enabled by default on all L2/L3 switches?