We’re Now Available Over IPv6!

You probably won’t have noticed but this site is now available over IPv6:

$ host www.barryodonovan.com
www.barryodonovan.com has address 87.232.16.35
www.barryodonovan.com has IPv6 address 2a01:268:3002::35

I spend a lot of my working hours doing a lot with IPv6 and, as any sys admin knows, it’s quite often the case that you get around to doing these things for yourself last. In our case, there was a bit of work involved as we had to first get our ISP’s core network dual stacked with IPv6 – luckily they’re a customer of ours 😉

Stay tuned here and over on the company blog for upcoming IPv6 posts and announcements.

In the meantime, if your ISP isn’t offering IPv6 to end users yet, head on over to SixXS where you can get an IPv6 tunnel for free. If you’re based in Ireland be sure to chose HEAnet or Airwire as your PoP as they’re both based in Ireland and members of INEX so your latency will be as low as possible.

UPDATE: Much more on this an why over on the company blog: We’re IPv6 Ready – Finally!

Asterisk SIP Brute Force Attacks on the Rise

See my article on the company blog for a discussion on this, and a how to on using Fail2ban to help stop these attacks.

Kubuntu 8.10 and Mobile Broadband (and KDE 4.1)

Kubuntu 8.10 and mobile broadband – the KNetworkManager has come a long way!

I updated my laptop from Kubuntu 8.04 to 8.10 (just released) yesterday. I do 90% of my work on my desktop which needs to just work and, as such, it’s running Kubuntu 7.10. My laptop, however, I play around with.

Most people’s first impression of 8.10 will be based on the upgrade process and post install issues. To date, I’ve always had to fix a lot of problems with the system after an upgrade to make it work. Not this time – it was absolutely seamless.

I was also apprehensive about KDE 4.1 and, to be honest, I was really worried that in a crunch I’d have to fall back to Gnome before degrading back to 8.04. I just don’t have the time these days to follow KDE development as much as I used to and I briefly installed KDE 4 a few months ago and thought it was far from finished.

I’m delighted to report KDE 4.1 is very slick and very polished. I’ve only had it for just over 24 but I have no complaints yet.

However, my main motivation for the upgrade was mobile broadband. Like most people, I use my laptop when on the move and my desktop when in the office. My laptop has an Ethernet port and a wi-fi card which both worked great with KNetworkManager but not mobile broadband. I got O2’s broadband dongle (the small USB stick) about four months ago and rely on it heavily.

I’ve been using Vodafone’s Mobile Connect Client to great effect but there were some issues:

  • setting up the connection was a manual process (change X window access control; su to root; export the DISPLAY setting; and start the application);
  • if I suspended the laptop then I needed to reboot the system to use the dongle again.

While both of the above could be solved, it’s just not plug and play. 8.10 is. With the dongle plugged into the USB port, KNetworkManager discovered the tty port. Configuring it was as easy as right clicking on the KNetworkManager icon and selecting New Connection… icon for the tty port.

The next step requires knowledge of the O2 / provider settings but this is readily available online. For O2:

KNetworkManager - Settings for O2 Ireland
KNetworkManager - Settings for O2 Ireland

After the above, I just accepted the defaults for the rest of the options. And – to my delight – it just worked. And it worked after suspended the laptop. And after popping the USB dongle in and out for the heck of it. By clicking the Auto Connect option as part of the process, it also just works when I pop the dongle in.

lft :: Layer Four Trace

Colin pointed out a useful utility called lft in response to a question on IIU. lft looks like a useful alternative traceroute application as it claims to have the ability to identify stateful inspection firewalls and other useful information.

What I found immediately attractive was the -A option which displays the AS numbers of addresses along the path and also the -N which looks up and displays the network names.

e.g.

# lft -S -A  www.yahoo.com

TTL  LFT trace to f1.us.www.vip.ird.yahoo.com (87.248.113.14):80/tcp
 ...
 ...
 3   [AS35272] lns3.net.imagine.ie (87.232.0.26) 27.3ms
 4   [AS35272] ve5.core.net.imagine.ie (87.232.0.129) 9.0ms
 5   [AS35272] ge0-0.border1.net.imagine.ie (87.232.0.1) 8.6ms
 6   [AS3257] ge-2-0-0-207.dub20.ip.tiscali.net (213.200.67.145) 13.8ms
 7   [AS3257] yahoo-overture-gw2.dub20.ip.tiscali.net (213.200.67.202) 13.9ms
 8   [AS34010] ge-1-4.bas-b1.ird.yahoo.com (87.248.101.13) 10.9ms
 9   [AS34010] [target] f1.us.www.vip.ird.yahoo.com (87.248.113.14):80 12.6ms

and

# lft -S -N www.heanet.ie

TTL  LFT trace to www.heanet.ie (193.1.219.79):80/tcp
 ...
 ...
 3   [87-RIPE/IMAGINE-IRL] lns1.net.imagine.ie (87.232.0.24) 24.0ms
 4   [87-RIPE/IMAGINE-IRL] ve5.core.net.imagine.ie (87.232.0.129) 22.3ms
 5   [87-RIPE/IMAGINE-IRL] ge0-0.border1.net.imagine.ie (87.232.0.1) 60.6ms
 6   [RIPE-CBLK/IE-INEX-IPV4-PI-NETBLK1] gige6-1-cr1-cwt.hea.net (193.242.111.16) 8.7ms
 7   [RIPE-CBLK/HEANET-EXT] gige6-1-ar1-cwt.hea.net (193.1.195.177) 45.4ms
 8   [RIPE-CBLK/HEANET-EXT] blanch-sr1-po1.services.hea.net (193.1.195.139) 25.6ms
 9   [RIPE-CBLK/HEANET-LAN] [target] www.heanet.ie (193.1.219.79):80 9.4ms

 

OpenVPN “Just Works”

When it comes to OSS, it very often happens that I find something I like and stick with it.

OpenVPN is a good example of this.

I have a number of OpenVPN installations for various purposes and today I had need of yet another for a new client.

I often thought about writing a how-to for OpenVPN. But why bother? It’s quick and easy to implement and they already have a brief but comprehensive how-to which always does the job for me – once you’ve set it up once, the next time will take just 30 minutes.

OpenVPN just works. It does what it says on the tin and it’s reliable and robust.

IPv6 Blasts Into Orbit

http://www.dmcii.com/news.htm:

On Thursday, 29 March 2007, a Cisco Systems router, flying in low Earth Orbit onboard the UK-DMC satellite built by Surrey Satellite Technology Ltd (SSTL), was successfully configured by NASA Glenn Research Center to use IPsec and IPv6 technologies in space.

The five DMC satellites in orbit rely on standard IP networking to send mission-critical imagery to ground stations and to interact with terrestrial networks.

Working together, Cisco Systems, NASA Glenn Research Center and SSTL are the first to configure and test IPsec and IPv6 on a satellite.

Interesting UKNOF Talks

In reviewing the agenda from UKNOF which I was regrettably unable to attend, three talks of an Irish origin stood out.

  • The realities of LLU in Ireland from Colin Whittaker of Magnet (the title says it all). There was also a British view offered: LLU in the UK;
  • NOC Tools from Donal O’Cearbhaill where he discussed the many tools they use at HEAnet to manage, provision and monitor the Broadband for Schools project; and
  • Network Architecture of Joost by Colm MacCarthaigh. This one is really interesting in terms of how they plan to manage the massive data transmission requirements of on-demand video and the design of a fault tolerant network service. I really like the way they their code is prefix aware and are planning AS-level awareness. Nice. Actually an interesting thread broke out about this on NANOG at the start of the year.

SNMP Polling Cisco AS5300’s for E1 Channel Usage (with Cacti)

This post is as much a reference for myself as it is for others. I had a need today to start graphing E1/PRI channel usage on some Cisco AS5300’s. The current priority is a simple graphical representation of the actual usage:

AS5300 E1 Channels in Use

Hopefully at some point over the next couple of weeks I may expand this to other more interesting information such as average call duration, etc that can be useful to diagnosing issues almost as they happen.

The Cacti XML can be found here and I just posted the same to Cacti’s own forums here.

The CISCO-POP-MGMT-MIB provides the MIBs for this information and the ones I specifically used (for my AS5300 which are all identical with 4 E1/PRI ports) are cpmDS1ActiveDS0s.0.x (or .1.3.6.1.4.1.9.10.19.1.1.9.1.3.0.x). Replace x with the appropriate port number (0-3) as required.

Explore the available information yourself with:

$ snmpwalk -Os -c <community> <host> .1.3.6.1.4.1.9.10.19