Willy Dobbe - TCP/IP

Cisco's IP Journal on IP spoofing

Tue, 12 Feb 2008 11:38:12 +0100

Over at the "Internet protocol Jornal (issue 10.4) you can find a good read on the dangers of IP spoofing. This problems is very old and very wide known. Even when I was in networking (1997-2002) this was wideley known and there was an easy cure. So I dont understand why Cisco decided to publish this now, a decade ago it would have been yesterdays news.

Everyone who ever read the TCP/IP bible (TCP/IP illustrated) knows this. All you have to configure on a router is IP UNICAST REVERSE PATH, in combination with cisco CEF. Then all packets that are routed are inspected. If the sender address (the From IP address) is in the routing table, it is checked to see if the router would route it the packet would have been send over the same interface the packet orginated from. If so, the sender is valid and the packet is routed, if not, it is proabbly a forged packet and it is dropped. That simple, one command and there is no IP spoofing anymore. In 1998 cisco released this feature I think, a decade ago!

All ISP's (at least in the Netherlands) have this kind of ingress filtering acitvated on their routers since a decade, it is impossible to spoof and route a packet in the Netherlands and most parts of the world for that matter.

I remember though that Casema (which I used as a cable modem provider between 1996-2001) didnt have this feature for some time. You could route a packet towards 1.1.1.1 with the sender address 10.255.255.255. 1.1.1.1 would give an "ICMP unreachable message" from the border routers of casema and it would be send towards the complete internal network -all systems- of Casema creating a kind of internal DoS.

But to publish this article one decade after a decade seems like rerunning old stories. 10 years is on the net a lifetime.

AOL corp on Drupal!

Mon, 04 Feb 2008 18:11:30 +0100

Via Steven Peck, via 21764, the corporate site of AOL is using... Drupal! Note that their developer site has been using Drupal since nearly a year.

I think it is great to see that the big corporations use Drupal, the showcases make it easier to sell Drupal to other corporations, there is more critical mass, more good things will come to and get out of "the community".

Note that there is (or might be) also a dark side. I will blog about the downside soon, but what do you think -apart from the brand AOL- is the downside of corps like AOL using Drupal?

The Day the routers died

Mon, 05 Nov 2007 05:08:05 +0100

Back in the old days... I did some netmastering for AS1136 (now AS286). And while I am not in to routing anymore, I still like this song performed at the RIPE 55

So bye bye, folks at RIPE 55
Be persuaded to upgrade it or your network will die
IPv6 just makes me let out a sigh
But I spose we'd better give it a try
I suppose we'd better give it a try

See also the grow of the internet and a report from cisco on IPv4 and v6

Other funny quotes:
* ...and all my traceroutes showing stars
* Saw a man with whom I used to peer
* My Cisco shares completely worthless

Do you know that feeling?

Tue, 17 Apr 2007 00:01:24 +0200

Do you know that feeling when you have more expertise than those helpdesk employees you're trying to explain your problem? But you need them to set your call through to someone who does know shit? And they are trying their best to help you but have absolutely no idea what you're talking about or what to do with it?

That feeling, I wonder if there's a name for it...

Now excuse me while I'm going to ~~kill someone~~
~~throw my phone against the wall~~
~~punch someone in the face~~
~~shout~~
cry.

Half Duplex ADSL Modem

Sun, 10 Sep 2006 11:30:36 +0200

Since my girlfriend and I are expecting another baby due around 20 November, Brecht will move from here current babyroom to the room that was used by me. So all my computers had to move as well. Last weekend we redid the wooden floor again (oiling), this weekend I moved my computers to the second floor. I rewired the PSNT/ADSL, moved my computers (closed the current case of Willt, this website since it had one harddisk outside), did the switches, the wireless etc. Then I booted and sure enought Linux was comming up fine. And even the ADSL worked, like a charm. Or so it seems.

The connection was very very slow. I open standard some 20 sites in firefox on my laptop and they loaded like when I had PSTN or even worse casema cable in the late 90ies. Showing Pat and mat videos to my doughter (buurman en buurman for the Dutch) from youtube, I found out that the loading took longer then the display time, not normal for the quality connection I have to XS4ALL. Doing some speedtest I saw that my download speed dropped from the normal 4Mb to 200Kb while my upstream capacity stayed at 600Mb (no torrents in the background).

And even worse, when I was doing a huge test download, the ADSL connection dropped after 10 seconds I had a link, so I had to shut the interface on my Linux box or my ADSL modem just to have 10 seconds of slow internet connection. Try to troubleshoot your connection without having a one!

Since I did some netmastering back in the 90-ies, I knew I was going to solve this one. The first thing I saw was that not the ADSL connection was dropping but the ethernet from my Linux box to my ADSL router. So it was local and should be easy to solve. Somehow, the link on my eth1 going to my modem was 10Mb full duplex auto negotiate. Now autonegotiate is bad and if you know the wirespeed on both sides, never use it!

So once I did a

ethtool -s eth1 speed 10 duplex half autoneg off

and the line was stable and fast again! I dont know how the wrong speed was changed. But I am sure glad to be online again. And I might have solved some other problems my website has as well. I'll keep you posted.

Drupal coding: How to handle text in a secure fashion

Fri, 08 Sep 2006 00:54:18 +0200

When I did my first Unix system administration back in 1996 or so, I immediately did have a lot of respect for the beauty of Unix and system adminstrators who know, eat, sleep and dream Unix. Shortly after I got my first root prompt, there was this buzz, there was an option to bring down any Unix (and every other BSD TCP/IP stack) system with just one simple "ping command".

This was later knowns as the Ping of Death. This was an attack against the network layer of the OSI stack. Soon followed by even easier Denial of Service attacks like flood, smurf and the likes.

A couple of years later, attacks moved to a higher level, all the lower stuff was less easy to "hack". So we saw a lot of "buffer overlow" attacks in the late 90ies. This kind of attack is still happening, but most attention is now focussed to once again a higher level. So a couple of years back, we saw a lot of attacks on the application level.

For webservices, Cross Site Scripting (XSS) was the most used one. Most CMS-es, including better ones like Drupal did have these vulnabilities in them. And still, there are some Drupal modules that still have this kind of potential abuse in them. So when you do coding, it is not so hard to make code that can do what is should; match the functional requirements thet you or your customer defined. It is hard to make code that wont do what you dont want. Most customers are very good in describing what they want; to come up with a functional design. But nearly all of them fail to define what shouldnt

be possible.

If you think you or your customer didnt define what shouldnt be possible, make sure you read the "How to handle text in a secure fashion" page on Drupal.org

When handling and outputting text in HTML, you need to be careful that proper filtering or escaping is done. Otherwise there might be bugs when users try to use angle brackets or ampersands, or worse you could open up XSS exploits.

In a year or two we will be done with these XSS exploits and label it as yesterdays news. But will we still suffer from "even higher" attacks like SQL injection with the automated test tools that are available for good or evil now?

XS4ALL heeft nu tijdelijk gratis VOIP dial out

Fri, 07 Jul 2006 19:03:53 +0200

Nadat de beste provider van Nederland, wellicht de wereld, gratis VOIP telefoons nummers aanbood, nu gratis dialout gedurende de zomer.

Van 7 juli t/m 31 augustus kunnen alle XS4ALL abonnees via hun XS4ALL VoIP Out account gratis bellen naar populaire vakantiebestemmingen en naar alle vaste telefoonnummers binnen Nederland. Voor VoIP Out betaalt u geen extra abonnementskosten; het is gewoon inbegrepen bij uw huidige abonnement. U betaalt slechts voor de gesprekken die u voert. En nu veel gesprekken gratis zijn, kunt u flink besparen op uw telefoniekosten.

Dank je XS!

Tuning Apache and PHP

Tue, 20 Jun 2006 19:06:21 +0200

On this thread o drupal.org some very good links to articles regarding tuning PHP and Apache (and IIS).

For example an article on how to optimize your PHP code and configurations. Here you can find some more thoughts about how gzipping webserver pages (both IIS and Apache) work. And this last excellent PDF is very lenghty but has some good points on why /not/ to use mod_gzipping or Zipping of pages in general. If you ever wanted to know anything about why and how to optimze, please read the articles in these links.

OSL Teams with TDS for Bandwidth Increase

Tue, 02 May 2006 02:07:17 +0200

OSL Teams with TDS for Bandwidth Increase — OSU Open Source Lab

The Open Source Lab at Oregon State University has received a large donation of Internet bandwidth from TDS Telecom that will allow it to more than double the number of visitors it can serve, in the future helping up to 50 million people a day review or download free software.
For a five-year period, the Open Source Lab will receive 600 megabits of bandwidth - a volume of Internet connectivity that is more than five times higher than the total used by the rest of the university. In addition, OSU servers will be hosted in a TDS Data Center.

See also this picture on the setup. A very nice gesture from TDS! 600Mb is worth something like 6.000 - 12.000 euro's per month. This news is a couple of weeks old but comes in very handy since Drupal just released 4.7 and is getting lots of hits from all over the world and was featured on digg as well. And with new new videos online we might need that bandwith!

Ed W aka Mr-T big plans...you are not going to like it...

Tue, 18 Apr 2006 17:38:39 +0200

I don't have a lot of time but read this Analysis by the Salon of the rumblings of Ed Whitacre (AT&T CEO) about a multi-teared Internet where content suppliers would have to pay to use Ed's pipes to deliver the content to your home..

After the merger with Bell South and with Verison on T's side the "Ma Bell re-incarnate" will control a large portion of the access into American homes.. It is a clever play because they will be extract money from the consumer through the triple play set-top box nonsense and on the other side from the content producers

I am sure Ed already figured out that he doesn't need the networks (ABC/NBC etc) at all if he can control the internet access to the consumer--access to the scarce medium of tv-broadcasting was what gave the networks their power..

In effect they will create the walled garden without a need to put a lock on the door because it is only dirt-roads outthere...

Ed W comes across a friendly and open southerner with an Texan accent but unlike the other W he is a very clever and sly..

And I don't think this a US only threat...every European broadband Telco/cable company is watching this one with a lot of interest..finally a way to regain control over these pesky consumers who don't want to play their little triple play game...

As the guys from Internet2 point out there is not a lot of technical need for a QOS/CoS Internet. An architect from Cisco told me once that QoS/CoS is poor substitute for bandwidth; using bigger pipes was going to make the client a lot happier. But Cisco makes more money selling expensive routers and management platforms (and consultantcy). Besides Cisco is better in making clever kit than making fast kit..

(and yes the Salon ad is very annoying...deal with it..)

Watch AKAMAI's NOC

Sat, 15 Apr 2006 03:36:30 +0200

Akamai is the world leader when it comes down to global content distribution. You can see pictures of their NOC.

See Akamai's Network Operations Command Center
From Akamai's unique vantage point of over 18,000 servers in 69 countries, we can not only see and manage our customers' networks, but also observe overall Internet activity. This insight helps our customers monitor e-business solution effectiveness, simplify e-business infrastructure management, and unleash the competitive advantage of superior information flow.

Now I have seen multiple NOC's and worked in a view as well. Adnd I have a couple of questions: why isnt there a movie on the mainscreen like every NOC has? Where is the pizza? And most of all, at what screens do the operators play Doom?

silver needle in the skype

Wed, 05 Apr 2006 09:23:10 +0200

One of the best researches I have seen on Skype, the disadvantages and how to block it. Great Stuff and must read if you are into routing, security or VOIP in general.

skype needle.

I will not use NMAP

Tue, 04 Apr 2006 18:27:42 +0200

Yesterday I did a portscan on an environment with NMAP. They owner of the sites complained to my (excellent) ISP and they... disconnected my IP addresses. I could only access the inetrnet through a proxy server since they thought my system was infected with a Windows trojan.

The downtime of Willy today wasnt caused by my lack of sysadmin skills, my girlfriend desire to turn of the power to do some work on the house, but due to my ISP.

I will never use NMAP again. Bad NMAP! Bad!

My WiFi

Sun, 05 Mar 2006 13:02:33 +0100

I havent spend much time finishing my PVR. But I did replace an old 10Mb hub and 11Mb accesspoint with a new b/g linksys accesspoint. No problems there, couple of minutes. The Windows install disk sucked camels ass though. The problem was that I use 10.0.1.0/24 inside where the default IP of the AP box was 192.168.1.1. As I said, couple of minutes.

I wanted to change the old AP (Asus 802.11b) to a client so it's ethernet can wire my PVR box. That want as trivial and didnt work out, will take a look at it later. However, I have now a full 100Mb switched network at home (wheee1) instead of an old 10Mb half duplex. And the new AccessPoint has both G and B and I was surpissed to find that my new laptop did G as well. So my internal network is once again up to speed with my internet connection. I have 4 Mb down so my fixed and wireless ethernet were becomming the slowerparts of my internetwork connection.

Asterisk at home

Fri, 24 Feb 2006 09:49:48 +0100

NewsForge has an article about Asterisk on OpenWrt

Asterisk is free software that lets you create a fully functional, easily customizable, private branch exchange (PBX). Businesses like Asterisk because they can save money by using it, and because it is open source, they can add functionality to it easily and inexpensively. Asterisk is also becoming popular with home office users -- so much so that it spawned a new project called Asterisk@Home, which released its 1.0 version last year. Now there's even a version of Asterisk that runs on OpenWrt, a Linux distribution designed to run on your wireless router (see "OpenWrt nears prime time"). I found it to be worthwhile, but I wouldn't depend on it for my home office.

. When I have finished my PVR (havent spend time at it for the last week), I'll be looking out for Asterisk, an opensource kickass VOIP gateway. And quess what kind of router I recently bought? Indeed! I'll be running my little VOIP * server within 12 month I hope