Networking

How To Upgrade Cisco ASA Software And ASDM

After writing about how to upgrade a Cisco ASA license, I received a few messages asking about upgrading the Cisco ASA software. Fortunately, just like upgrading IOS on a Cisco router, it's an easy, straightforward process that you can knock out in a few minutes. In this walkthrough, we'll be upgrading the the ASA software via the command-line interface (CLI). As an added bonus at no extra charge for lucky Evil Routers readers we'll also upgrade ASDM while we're at it. Okay, enough bullshit.

Cisco ASA: “read-only file system”

Ly, while upgrading a Cisco ASA that belongs to a customer and hasn't been touched in a long time, the following took place ciscoasa copy tftp flash Address or name of remote host 10.10.10.42 Source filename asa842-k8.bin Destination filename asa842-k8.bin Accessing Writing file disk0 asa842-k8.bin Error opening disk0 asa842-k8.

BGP Route Reflectors

Hopefully you recall that when running iBGP, a full mesh is required between all iBGP speaking peers within an autonomous system (AS). This can quickly lead to a huge number of peerings and the associated management overhead as we add more iBGP speakers. The total number of peerings needed to satisfy the full mesh requirement is illustrated by the following formula, where n is the number of iBGP speakers n(n-1) 2 Thus 5 routers 10 peerings 10 routers 45 peerings 25 routers 600 peerings Would...

Why I Use Jungle Disk and Tarsnap

Xkcd security Two weeks ago, Derek Newton wrote an article entitled Dropbox authentication insecure by design after discovering that one could take Dropbox's config.db file, copy it to another host, and gain access to that Dropbox account. Dropbox is a free service that lets you bring your photos, docs, and videos anywhere and share them easily. Dropbox has been criticized since Derek's post for that but a new round of Dropbox bashing started Tuesday after Dropbox updated its terms of service.

Why Gigamon Scares The Crap Out of Me

I had the opportunity to visit with some of the Gigamon folks at their Milpitas, California, office last week as part of the Net Field Day 2 event and, frankly, what they showed us scared the shit out of me. Gigamon has a variety of products in their line-up. At the most basic is the G-TAP, a totally photonic tapping system. Each G-TAP unit supports up to 8 optical uplinks single mode, multi-mode, 1 gig, 10 gig, you name it.

Configuring Multilink PPP Dynamips

This is just a quick lab I whipped up to demonstrate how to configure multilink PPP between a pair of routers. According to Cisco Multilink PPP (also referred to as MP, MPPP, MLP, or Multilink) provides a method for spreading traffic across multiple physical WAN links while providing packet fragmentation and reassembly, proper sequencing, multivendor interoperability, and load balancing on inbound and outbound traffic.

Configuring Basic BGP

Here's a quick demonstration on how to configure two routers to be BGP neighbors. I'm using dynamips and the same topology from yesterday's multilink PPP lab (for simplicity) Autonomous Systems R1 42 R2 69 Networks Advertised We'll configure a loopback 0 interface on each of the two routers and then advertise those networks to our BGP neighbors. R1 Loopback0 42.42.42.1 24 R2 Loopback0 69.69.69.

Access Controls for HP Pro Curve Devices

Yesterday, the Internet Storm Center published a diary called Access Controls for Network Infrastructure . That particular diary is Cisco-centric, so I thought I'd put together something similar for HP ProCurve gear (at least the 2650, 2910s, and 5400s I've worked with). Default CredentialsHP ProCurve gear ships without any type of authentication, by default. This is similar to Cisco, however Cisco gear will not let us login via the network if a password has not been configured.

Configuring Basic OSPF Dynamips

In this lab, we have three routers at multiple locations that are connected through a switch, as shown in the diagram below We have been tasked with setting up OSPF on this network, with a few specific requirements We must ensure that the ISP router is the designated router (DR) We must ensure that the Remote1 router is the backup designated router (BDR) We must ensure that the Remote2 router never participates in the election process Each router's OSPF router ID should be the IP address of its...

Port forwarding a range of ports on Cisco IOS

One question that routinely comes up in a particular forum that I frequent is How do I port forward a range of ports Usually, this question is met with one of two answers 1) you don't, or 2) manually enter 10000 ip nat statements. The correct answer is actually number three. It turns out that it is, indeed, possible to forward a range of ports in IOS. I tested this in my lab and everything works just as I would want it to. Here's the topology We have a single router that we're using.

Why Is Cisco Crawling My Website?

A while back, I noticed my website was being hit by a new crawler at IP address 72.163.33.126 host 72.163.33.126126.33.163.72.in-addr.arpa domain name pointer srch-prod-170.cisco.com. Cisco has apparently decided to keep an eye on me. Okay, whatever, that's fine, but since you never know what Cisco's up to, I decided to keep my eye on them too. Then, something happened. On August 10th, the crawler showed up in the logs just as it normally did.

Using weights to influence BGP routing

Today I'm expanding on to our previous BGP lab, Configuring Basic BGP . We're going to demonstrate how we can use BGP's weight attribute to influence routing out of an autonomous system (AS). We've got a new network topology consisting of four routers arranged in a square Dynagen topology Here's what our .

BGP load sharing, dual-homed to one SP

Here's another lab that I just made up using dynamips dynagen. There is a download link to the .net file I used (modify it as needed) at the bottom of this post. NOTE See the video demonstration below For this lab, here's the topology we're working with Our scenario here is pretty basic. We are AS 65065 and are dual-homed to our service provider, AS 65001. We have two T-1 connections R1 to R2 and R1 to R3.

Getting BGP routes into dynamips with video

UPDATE If you're not interesting in doing this yourself and just want to see it in action, check out the video, Dumping 265k BGP routes into dynamips . When I went through these steps to document, I ended up with 298,870 prefixes in my dynamips router. When I did it the second time, to record the video, I only ended up with 265,857 prefixes.

Creating a Netmap file for IOU

Those of you who use Dynamips and Dynagen are familiar with the .net files that are necessary for the virtual routers to interoperate (example). IOU also uses a file, named NETMAP to describe the virtual topology. Here's a simple NETMAP file 101 0101 18 102 2102 0 There are two routers represented here, identified by application ID values 101 and 102 (which you pass to the IOU images when starting them up). The first and last lines represent an interface which is connected to nothing.

Iou2net.pl, an IOUlive replacement

In the months since Cisco IOU leaked out, many people have began using it for study purposes instead of or in addition to dynamips. One advantage that dynamips has over IOU is the ability to communicate with a physical network which comes in handy sometimes, like when you want to do pointless things like dumping full BGP routing tables into dynamips. Cisco IOU has similar functionality, although it requires another binary executable called IOUlive.

Basic Frame Relay Lab for Dynamips

Last night I put together a basic frame relay lab for dynamips, made up of three routers one hub and two spokes. I'm sure there are a thousand others out there like it but I was putting something together to get a friend started on dynamips and it's what I came up with. First, the physical topology R1 is our hub router and R2 and R3 are our spoke routers. Each router has loopback0 configured with an IP address of 172.16.x.

Using AS path prepending to influence inbound routing

As you may remember, the BGP Best Path Algorithm decides how the best path to an autonomous system is selected. Probably the most common value that is used to determine the best path is the AS Path length. When two or more routes exist to reach a particular prefix the default in BGP is to prefer the route with the shortest AS Path length. If we are a multi-homed customer of one or more service providers, we may prefer that incoming traffic take a particular path to reach our network.

Using BGP communities to influence routing

Previously I've covered using weight, local preference, and AS path prepending to influence routing between autonomous systems running BGP. Today we'll look at one of the common methods for influencing routing, and that is BGP community values. BGP communities are simply values attached to a route that is sent to BGP peers. This values have special meanings to the peers and cause specific actions to be taken, depending upon the values assigned.

The right way to host your website

Recently, I moved the web site over from shared hosting at 1and1 to a VPS running FreeBSD 8.0 from ARP Networks ( arpnetworks and bsdvps). They have a special going on right now, for a VPS with 768 MB of memory, 20 GB of disk space, and 200 GB of bandwidth for 20 mo. (that's cheaper than Slicehost and Linode, who I also looked into), and they support FreeBSD I signed up online and within about half an hour, my VPS had been provisioned and I had the details needed to log in.

LACP Between HP and Cisco Switches

Does anyone have any opinion or pointers for HP Procurve 2900s Had issues setting up LACP trunks w c2960s, opted for single connections I thought I had written up how to configure LACP between HP and Cisco switches before, but after checking I realized that I didn't. What I had mentioned was a gotcha regarding how a ProCurve calculates the spanning tree cost of an LACP link (a.k.a. the wrong way ).

Switch-based security features

New security features are being added to many enterprise switches. the availability of those features varies based on what vendor's equipment you're using (as well as the firmware) and each vendor offers similar features but call them by different names. this table illustrates a few cisco hp problem benefit watch out for dhcp snooping dhcp snooping dhcp, a critical network service, is inherently trusted and easily spoofed.

How to Upgrade the License on a Cisco ASA

The different licensing levels available on the Cisco Adaptive Security Appliances allow an organization to buy only what they need while retaining the option to upgrade in the future, if necessary. For example, a small business with 15 employees may start out with a Cisco ASA 5505 with a 25-user (or, more correctly, 25-host) license.

Using BGP's local preference to influence outbound routing

At the end of my last article, Using AS path prepending to influence inbound routing , I mentioned Notice anything weird there Yeah, traffic from R6 is first going to R7, then to R9 over that T1 connection, NOT the much faster 100 Mbit s connection How can we change that The next article will continue on from here and we'll change the configuration of our routers in AS 67 to address that.

Why You Should Be Blogging

As a network engineer, systems administrator, or just a general IT guy (or girl), you probably don't think of yourself as a brand . You probably just think of yourself as an average person who happens to have a fairly marketable skill. Each of us, however, are our own unique brand and blogging can help you increase and fine-tune your skills. In this article, I'll tell you why you should be blogging and give you some great ideas for getting started.

The long road to the CCNP

A couple years ago, I decided to make an attempt at earning the Cisco CCNA certification. On March 11th, 2008, I went and took the ICND1 exam and passed with flying colors. Inspired by my achievement, I went back on March 19th and took the ICND2, thus earning the CCNA certification (my complete Cisco exam history is below, for the interested). Afterwards, still inspired, I decided I would work towards the CCNP certification.

Installing a Premium License on a Pro Curve

Although I like to complain about the HP ProCurve switch line, they do make great layer 2 switches. I'm not a big fan of using them for layer 3, but sometimes we have to do things we don't want, right The come with basic layer 3 functionality, but you'll need a Premium License to unlock some advanced features .

Upgrading Pro Curve firmware via TFTP

I had a new HP ProCurve 2610 arrive today, and one of the first things I do to new devices is load up the latest firmware. I thought I'd document the procedure since 1) I'm about to do just that, and 2) my post Upgrading HP Procurve firmware via USB flash drive gets quite a few hits. A few items to note 192.168.1.12 is the IP address of my TFTP server 192.168.1.

SNMPv3 Configuration for Pro Curve 5400s

I found myself recently setting up new HP ProCurve 5400 switches in production. Because I'm a network guy, I like to keep an eye on them (interface counters, traps, etc.), thus setting up SNMPv3 was necessary. In addition, these devices come ( out of the box ) with a default read-write community string set to you guessed it public , open to anywhere. That had to be taken care of first.

Hp Ase Certified

I wrote previously about the Fast Track to HP Certification for Cisco Certified Professionals in which a current CCxP or CCIE could earn either HP Accredited Systems Engineer (ASE) or Master Accredited Systems Engineer (MASE) by passing one online exam. I was having trouble sleeping last night so I thought I'd go ahead and give it a shot. As is the case with Cisco examinations, you are required to agree to a confidentiality agreement prior to taking the examination.

Configuring Basic NAT with overloading

Here's a lab that might be helpful for those working towards the CCNA examination. We have a simple topology consisting of three routers. R8 will simply be used as a host on our internal network and R7 will be used as our border router (the serial connection between R5 and R7 will represent our connection to the Internet) The goal is to NAT any traffic originating on our internal network (R8) as it leaves the serial 0 0 interface on R7 on it's way to the Internet (R5).

IOU License Generator on Github

If you're in need of a license key for Cisco IOU, you're in luck. A new license generator, iougen , has popped up on Github in the last day or two. From the README file iougen is a python module cli script that can be ran to generate IOU license keys. IOU stands for IOS on Unix and is a full IOS environment that can run as a Unix process. IOU requires a valid key to operate and that is where this module comes in. The code used for generating the license code came from a user who goes by Kel.

Iou2net and IOUlive86 now available on Github

From the Cisco IOU FAQ page Cisco IOS on UNIX (IOU) is a fully working version of IOS that runs as a user mode UNIX (Solaris) process. IOU is built as a native Solaris image and run just like any other program. IOU supports all platform independent protocols and features. Many of you are already making use of Cisco IOU in your certification studies. What you might not have been able to do is connect those virtual routers to your physical network to interact with real devices but now you can.

Example Cisco IOU Topology

Here's an example topology for Cisco IOU to help you get started In this example, SF is an IOU instance running on host solaris . IOUlive is also running on this host, bridging SF's Ethernet0 0 interface to my physical network (and to the world). SJ1, SJ2, and SJ3 are IOU instances running on host helium . The Ethernet1 0 interface on SF is connected to Ethernet0 1 on SJ1 are connected, even though they are on separate physical hosts.

Configuring a dhcp server on a cisco router running ios

Below i'm going to illustrate how to configure a dhcp server on a cisco router running ios. in this example, i have two cisco 2621xm's running c2600-ik9s-mz.123-22.bin. each router's fastethernet 0 0 interface is plugged into a cisco 2950 switch (ports 1 & 2) on the same vlan. r1, which has an ip address of 192.168.1.1 ( 24), will be our dhcp server. it will be configured to hand out ip addresses in the range from 192.168.1.100 through 192.168.1.254.

Fun with hping3

I was bored so decided to play with hping3 a bit tonight. jlgaddis bertram sudo hping3 --udp -p 10000 --destport 10000 --flood 192.168.1.12 HPING 192.168.1.12 (eth0 192.168.1.12) udp mode set, 28 headers + 1400 data byteshping in flood mode, no replies will be shown I have the same thing running 192.168.1.12 as well, for bi-directional traffic. c1811 sh int fa7 in put rate 5 minute input rate 96657000 bits sec, 8404 packets sec 5 minute output rate 93537000 bits sec, 11389 packets sec

Cisco Ccnp Tshoot exam topology

Philip Vancil, part of the exam development team , posted the TSHOOT Exam Topology on The Cisco Learning Network website last Tuesday. He notes that what am sic about to reveal is not part of some secret NDA , so it seems safe to assume it can be freely shared. To be honest, I haven't spent much time looking into the new exams (ROUTE, SWITCH, and TSHOOT), as the amount of studying I have done in the last few months has went downhill significantly. In other words, I haven't studied a bit.

You know you're a computer security guy when…

No idea where this originated, but I received it several months ago via e-mail. For your enjoyment You know you're a computer security guy (or girl) when You not only lock your laptop with a physical cable leash, but you change the combination of the lock when it's not in use so that it can't be compromised .

When CCIEs Get Bored

Now that Ryan Werber ( Scrye on Freenode cisco) has passed the CCIE exam and became 38168, he apparently has some extra free time on his hands. Update This Star Wars Traceroute has been propagating (see what I did there ) like wildfire in the nerd-o-sphere since I first published this post. Since then, Ryan has originated (get it ) a Tumbler page where he explains how and why he did it and also posted the configs that he used.

10 Things Your IT Guy Wants You to Know

If you come to me to ask technical questions, please don't argue when you don't like my answer. If you think you know more about what you're asking than I do, then why even ask On that same note, if I am arguing with you, it's because I'm certain that I am correct otherwise I'd just tell you I don't know or perhaps point you somewhere that you could look it up. We don't argue just for the sake of arguing. When you start a conversation by insulting yourself (e.g.

Bitcoin: Wave of the future or just a fad?

Unless you've been living under a rock, you've surely heard of Bitcoin by now. From the Bitcoin wiki Bitcoin is one of the first implementations of a concept called crypto-currency, which was first described in 1998 by Wei Dai on the cypherpunks mailing list. Building upon the notion that money is any object, or any sort of record, accepted as payment for goods and services and repayment of debts in a given country or socio-economic context, Bitcoin is designed around the idea of using...

How To Make Your Routers Reload Faster

When doing labs, one thing that really annoyed me was how long it took some of my routers to reload. After doing a lab exercise, I would always erase the configuration and reload in order to start from a blank configuration. I just recently discovered a way to speed up this process. It's pretty basic and, since the feature has been around since 12.3(2)T, I'm not sure how I hadn't heard about it. Since I hadn't, I will assume somebody else out there hasn't either, so here's the details.

Using BGP's MED to influence inbound routing

If you remember how BGP's best path selection algorithm works, you'll likely remember hearing about the multi-exit discriminator, or MED. The MED is an optional, non-transitive attribute of BGP. When we have multiple entry points (connections) to another AS, this allows us to tell the other AS how we would like them to route traffic to us. Remember that, unlike weight and local preference, lower MEDs are preferred over higher MEDs.

NAT Based Upon Source Address

The idea for today's post came from a question that someone asked earlier today (paraphrasing) how do I NAT some hosts to one IP address while NAT'ing others to a different IP address Here's the topology we'll be working with R3 will serve as our Internet router our connection to the Internet. R2 will serve as a random host outside of our local network. R1 will masquerade as different internal hosts on our network, using loopback interfaces to simulate separate hosts.

Using etckeeper with git on Ubuntu

Though I think we would all agree that it's important, the unfortunate fact is that myself and other members of my team don't necessarily document things as well as we always should. I'm fairly certain that a lot of knowledge would be gone forever if one of us fell asleep in a bathtub and drown while reading a UNIX book (otherwise referred to as the bus factor ). Recently, I've been trying to remind myself to better document more of the things I do and, in the process, discovered etckeeper .

Y U No Monitor Datacenter Temperature!?

Post image for Y U NO MONITOR DATACENTER TEMPERATURE In a previous life, I worked at a .edu and lived, roughly, across the street from the building that housed IT. I don't recall what it was that caused me to go to work that Monday evening, the third day of a three-day (holiday) weekend, but as anyone who works in IT would likely agree, it's not unusual to be working at the office or data center at weird hours.

Basic NTP Configuration for Cisco Routers

What is NTP The Network Time Protocol (NTP) is a protocol for distributing the Coordinated Universal Time (UTC) by means of synchronizing the clocks of computer systems over packet-switched, variable-latency data networks. Wikipedia Why is NTP important Time is inherently important to the function of routers and networks. It provides the only frame of reference between all devices on the network. This makes synchronized time extremely important.

High-Availability failover w/ Apache and Red Hat Enterprise Linux

A few days ago, I wrote about the beginning of a web site migration from IIS5 on Windows 2000 Server to Apache2 on Red Hat Enterprise Linux 4. For those who didn't read the original article (above), the machine that will serve as the new web server is a dual Pentium 3 600MHz box quite old, but it should serve us well.

Cisco 1941, 2900sm, 2901, and 3900 routers!?

Hmm In Cisco IOS Release 15.0(1)M, this feature was introduced on the Cisco 1941, 2900sm, 2901, and 3900 routers. Well now, this certainly looks interesting Router show versionCisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Experimental Version 12.4(20090904 044027) guraman-revpi12 577 Copyright (c) 1986-2009 by Cisco Systems, Inc.Compiled Fri 04-Sep-09 09 22 by guramanROM System Bootstrap, Version 12.

RIP Authentication

I found this post saved and realized that it had never been uploaded to the site, so here you go. Two routers, R1 and R2, directly connected via their serial 0 0 interfaces. We want to authenticate the routing updates sent and received by these two routers. Note that we have to use RIP version 2 (RIPv2), since RIP version 1 does not support authentication. For RIP authentication, we have two options plain text or MD5.

Hold Yourself Accountable, in Public

Last week, I wrote an article aimed at those studying for any of the various networking certifications entitled, Why You Should Be Blogging . I talked about the benefits of blogging and how to get started. There's a real easy way you can use your blog to help ensure your meet your goals and that's by simply holding yourself accountable, in public. Let's assume that you're studying for Cisco's CCIE certification.

Allowing customers to manipulate routing using BGP communities

UPDATE I made a video demonstration of this as well. You can find it at the bottom of this post. Let me know what you think Thanks. Upon request, and as a sort of continuation of a prior post, Using BGP communities to influence routing , I'm going to demonstrate how to permit this to occur (and configure it ) from the service provider perspective.

Why Dell Buying Force 10 Is A Smart Move

As you've probably already heard, Dell has acquired Force 10 Networks. Personally, I think this was a pretty smart move. Dell's core business has always been selling PCs and servers. In the last few years, they've acquired a number of companies (Compellent, EqualLogic, Scalent, who else ) in order to expand their product line. I've never been impressed by PowerConnect and don't know of many people who have.

Why Best Practices Are Important or: How I Pwn'd The Shit Out Of My ISP

Note The events described herein took place many, many years ago (the statute of limitations has long since expired ), but the moral of the story remains the same. This topic came up on IRC a few nights ago and since a) several were interested in the story and b) I'm heading out to DerbyCon shortly, the timing seemed appropriate. It's 2 a.m. and I'm the stereotypical inquisitive teenager furiously typing away on the PC in the corner of my darkened bedroom.

ARIN Regains 45/8 from Interop

Today, Interop announced that it would return the 45 8 IPv4 address block to ARIN, the American Registry for Internet Numbers in an effort to drive IPv6 adoption. This announcement came on the heels of Monday's announcement by the Number Resource Organization that less than 5 of the world's IPv4 addresses remained unallocated. The Internet Assigned Numbers Authority, IANA, recently distributed two 8s to APNIC, leaving twelve 8s remaining.

Pv6 - It's Not An Option

Those of you who know me in real life are probably quite aware of just how much of a dislike I have for sales and marketing people. That's why whenever they make themselves look like idiots, I like to acknowledge it and recognize them for it. Besides, marketing folks tend to believe that any publicity is good publicity so I'm certain that they don't mind me pointing out just how retarded they so often are.

Advertising a default route over BGP

After a little hiatus, I'm back with another post. Today (or tonight, in my neck of the woods), I'm writing about how to advertise a default route to a BGP peer. Our topology looks like this This is a typical hub-and-spoke frame-relay network, with R3 having a point-to-point connection to each of R4 and R5. For this scenario, let's assume that R3 is an ISP router and that R4 and R5 each belong to a customer that is single-homed to the ISP.

Upgrading DD-WRT on the Buffalo WHR-G125

While browsing through my archives tonight, my thoughts went back to the reliable little Buffalo WHR-G125 router access point over in the corner. Back in January, I wrote about having issues with my MacBook's wireless and upgrading to at the time the latest version of DD-WRT to see if it would help with the issues. Many months have passed since then and the wireless issues have went away. Unfortunately, I don't really remember when they went away.

Free Two-Factor Auth for your Servers and VPNs

Last week, I wrote about bitcoin and its reliance on exchanges such as Mt. Gox. A few days later, Mt. Gox had a few more issues including their entire user database being leaked to the Internet. In various online discussions afterwards, the use of two-factor authentication came up repeatedly. I wondered if there was a cheap, reliable way to handle two-factor authentication for my own systems. Fortunately, there is.

Reason #693 Why I Love UNIX

Recently, I had a need for a list of MAC addresses for several hundred of our computers. These were all computers on particular subnets and I needed the MAC addresses to be in the xx xx xx xx xx format. We use Microsoft's DHCP server so that seemed like a great place to get the MAC addresses (we use DHCP pretty much everywhere it makes sense). I got an export from the DHCP snap-in into a plain-text file and was met with a mess similar to what you see here cat dhcp-export.

Online backups using amazon s3

A month or so ago, i downloaded jungle disk. i installed it on an older laptop i have running windows xp that has quite a few files on it i'd like to have backups of. i uploaded a few hundred megabytes of files to disk storage on the amazon s3 system and pretty much forgot about it. a few days ago i was looking at my bank statement and seen a charge from amazon for 0.04 for the s3 storage. that got me thinking about backups again.

Installing Rancid on Ubuntu 10.04 LTS

RANCID monitors a router's (or more generally a device's) configuration, including software and hardware (cards, serial numbers, etc) and uses CVS (Concurrent Version System) or Subversion to maintain history of changes. RANCID is, in my opinion, a must for anyone who must manage and or maintain network devices. It will automatically backup the configurations on all your devices, as well as providing notification of any changes that have occured.

Cisco Needs to Return to Core Business

At the peak of the dot com era, Cisco shares peaked at nearly 80. Less than four years ago, shares were at double the 16.01 they closed out at this past week. What's changed, you might ask Well, a lot. You might remember in early 2009 when Cisco announced that it would start selling computer systems. You might also remember that shortly after that they acquired Pure Digital Technologies and the Flip video camera.

Cisco Nexus 3548 Switch: 190 nanosecond latency

Hot on the heels of the new Arista Networks 7150S series top-of-rack switches that offer latencies as low as 350 nanoseconds, Cisco came out with an announcement of their own, shattering the land speed record in the process. The newest addition to the Nexus line of high-performance datacenter switches, the Cisco Nexus 3548 is a top-of-rack switch that crams 48 SFP+ ports of up to 10 GbE goodness into a 1RU form factor. Industry-standard latency is 380+ nanoseconds.

Want a free shot at the Solar Winds Certified Professional exam?

Are you currently studying for the SolarWinds Certified Professional certification If so, read on. At the first Gestalt IT Tech Field Day event aimed specifically at networking, Josh Stephens, Joel Dolisy, and Brandon Shopp from SolarWinds gave us a great presentation on the Orion Network Performance Monitor (read my thoughts here) and gave all of the delegates a gift box filled with assorted goodies.

If Toasters Were Operating Systems

Windows toaster the windows toaster looks great, but sometimes it just won't make toast. it either comes out burnt or raw, and you have to unplug the toaster and plug it back in again each time you want to try and make some toast. for every loaf of bread you buy you are forced to buy a new toaster to go with it. linux toaster the linux toaster looks absolutely awful it has wires crimped together, things are just hanging out of it.

My Holiday Out of Office Auto Reply

If you were to e-mail me over the holidays, you'd get a response like this. Unfortunately, I had to tone it down a bit (couldn't make it as funny as I would have liked). ) ---------- Original message ----------Date Tue, 23 Dec 2008 17 35 03 -0500From Jeremy L. GaddisSubject Out of Office AutoReply This message was generated by an automated system. Greetings and salutations I am out of the office and my current whereabouts are unknown. Even I do not knowwhere I am.

CCNA Got Me a Bonus

A couple of months ago, I decided to break down and take the Cisco CCNA certification exams which I had no problems with. I passed the 640-822 exam and then passed the 640-816 exam a week later. Just prior to the end of our fiscal year (June 30th), we have our annual performance evaluations which precede any raises we might receive on July 1st.

Using BGP communities to influence routing, part

I wanted to follow-up to an earlier post, Using BGP communities to influence routing , and show some more ways we can use BGP communities to influence routing on the Internet. What we're going to see today is very common in the real world, although it does take the cooperation of your service provider. If you're lucky, your service provider will have already published a listing of communities that they accept and what effect they have.

Pingdom Monthly Report

I recently started using the free monitoring service available from Pingdom to monitor (via simple ICMP echo requests) the VPS that this website runs on. Here's the monthly report that I received from them via e-mail for the month of February For the month of February, there were a total of two outages detected for a total downtime of exactly three minutes. The first outage was for two minutes from 01 20 38 to 01 22 38 on February 13th.

Rpmdb: Lock table is out of available locker entries

This morning, I received an e-mail from a cronjob on one of my production RHEL 5.2 servers From Cron DaemonTo Jeremy L. GaddisCc Subject Cron run-parts etc cron.weekly etc cron.weekly makewhatis.cron rpmdb Lock table is out of available locker entriesrpmdb Unknown locker ID b4a0error db4 error(22) from db- close Invalid argumenterror cannot open Pubkeys index using db3 - Cannot allocate memory (12) There were probably a couple hundred errors in that e-mail.

Conferences, certifications, and such…

I've been on what seems like a virtual scavenger hunt today. For some reason, I feel like going to some more conferences. A few months ago, I went to the Security 505 Securing Windows course put on by SANS (yes, I passed the exams). I'd like to take the SSCP exam sometime within the next few months. It's actually being offered in Indianapolis and Louisville in May, so I may try to do that.

Cakephp on os x can't connect to mysql

Just a heads up if you're trying to use cakephp on os x with a mysql database, you'll probably have problems connecting to the database server (by default).in my case, i created the mysql database (using the mysql command-line client), created a mysql user for the application (and gave it the appropriate permissions), configured cakephp's database.php configuration file, and tried to access the default page. i was presented with the following error Warning mysql_connect() function.

Ubuntu 9.10 and 10.04 LTS vulnerability

Update your Ubuntu 9.10 and 10.04 LTS servers (see USN-959-1) if you haven't already, especially if they're multi-user systems jlgaddis homer ssh helium jlgaddis helium.lab.evilrouters.net's password Linux helium 2.6.32-22-generic-pae 36-Ubuntu SMP Thu Jun 3 23 14 23 UTC 2010 i686 GNU LinuxUbuntu 10.04 LTSWelcome to Ubuntu * Documentation https help.ubuntu.com 7 packages can be updated.4 updates are security updates.Last login Sat Jul 10 10 35 49 2010 from homer.lab.evilrouters.

Manage Your Word Press Theme Using Git

When I first started this website, my purpose was to simply have a place I could post things that were useful to me and that I could access from anywhere. It didn't take me long to realize that the things I was documenting were also helpful to lots of other people. This is one of those posts. The great majority of my readers work in IT (or aspire to) and several of you run your own blogs.

Cloud That Shit

Greg Ferro (I think) coined the term blah blah cloud and, like Greg and many, many others, I hate the term. The cloudtards would have you believe that the cloud is some revolutionary concept but, the fact is, the cloud has been around for probably longer than most of them have been in marketing. IT folks who are old enough to remember mainframes know that the concept of the cloud isn't anything new.

Comodo's SSL certificates: the underlying problem

Ten days ago, a hacker obtained legitimate (but fraudulent) SSL certificates that gave them the ability to impersonate some of the highest trafficked websites on the Internet login.yahoo.com, mail.google.com, login.skype.com, and addons.mozilla.org, among others. Comodo, the vendor with such lax security that allowed this to happen, quickly pointed out that the attack originated mainly from Iran (and was likely to be a state-driven attack ). Of course, there's no way for them to know this.

HP Should Open Source webOS, But Won't

A little over a month ago, we read a press release from HP announcing they were going to Drive Innovation, Scale and Growth of webOS As part of our investment in the future of webOS, we are working in lock step with the developer community, our channel partners and the start-up community to create an application ecosystem that delivers on HP's mobile connectivity strategy.

Scientific inquiry into santa claus

As a result of an overwhelming lack of requests, and with research help from that renown scientific journal SPY magazine (January, 1990) I am pleased to present the annual scientific inquiry into Santa Claus. 1) No known species of reindeer can fly. BUT there are 300,000 species of living organisms yet to be classified, and while most of these are insects and germs, this does not COMPLETELY rule out flying reindeer which only Santa has ever seen.

Bypassing the Internet Kill Switch

Nearly 100 years ago, in the middle of the Atlantic, Jack Phillips began sending out CQD, the international distress signal, over wireless. Phillips was a wireless operator aboard the RMS Titantic which had struck an iceberg a couple of hours earlier. Since then, radio has been responsible for saving countless lives and providing information and news to the world. Thursday, the Mubarak regime in Egypt recently ordered an effective shutdown of the country's Internet access.

HP Eliminates Premium Licenses; Existing Customers Shafted

A few weeks ago, Sreeram Krishnamachari, Global Product Line Manager at HP Networking, authored a post on the HP Networking blog entitled Say goodbye to firmware licenses in wired network switch products . In that article, HP has acknowledged, finally, that firmware licenses in addition to easily adding tens of thousands of dollars in CAPEX costs to a project are a huge pain in the ass for network managers.

It's time to move on from CentOS

Friday, a mere three months after Red Hat announced general availability of RHEL 5.6, CentOS 5.6 has been officially released. For those unfortunate enough to still be running CentOS, however, it's time to move on. Those of you who have been around for a while may recall that the CentOS project sprang up out of the ruins of the White Box Enterprise Linux project. Unfortunately, it appears that CentOS is heading towards the same demise.

Even quicker packet capture data extraction using Wireshark

A couple hours ago, Jeremy Stretch posted an article entitled Quick and dirty packet capture data extraction in which he shows how one can extract a JPEG image from a packet capture containing the HTTP stream. Stretch's method uses foremost to recover the original file which works, but there's an even quicker way to do it. Actually, just like with Perl, TMTOWTDI. I made two videos showing how to extract files from data streams within Wireshark.

Send Email from Postgresql

At work, i use both the mysql and postgresql relational database systems. my personal preference is for postgresql, though i'm often forced to use mysql as more software seems to support it. for homebrew applications, however, i almost always use postgresql. in addition, i am a huge fan of perl. i use it almost exclusively for my various scripts which interact with databases (dbi ftw ).

OpenBSD Violates NTP Pool Guidelines

Note When I began writing this, I was going to go into a lot more detail, explaining ntpd (the reference implementation), OpenNTPD, the NTP Pool Project, etc. I may do that in a follow-up post but, for now, I'll keep it short and to the point. The NTP Pool Project has a set of basic guidelines whose intended audience is anyone distributing an appliance, operating system or some other kind of software using NTP .