BGP oh the joys

For reasons unknown my internal routing protocol 'lost' it's route to our provider independant address space this morning. The symptoms were a complete loss of access to the Internet. Logging a fault with the relavent ISP returned a 'no problem here' response.

We have redundant Internet feeds so I was confounded that both of them should fail at the same time. Further investigation determined that access to the Internet worked fine using an address from the /30 each ISP provided for connectivity. So it was just our address space.

Whilst waiting for the ISPs to get back to me (I had made it clear it was a routing issue not a service issue) I double checked and lo and behold my gateway routers no longer had a route for our address block. I'm sure I had one before but not having one now meant BGP had nothing to advertise.

BGP is different from other routing protocols in that it will only advertise to other parties (people with a different ASNUM) that which is already in your routing table.

I'm sure I had a route before but thinking about it, I believe the route came from BGP in the first place. It's like a circular argument, it works as longs as you don't stop. So some network change stopped BGP advertising to itself our block of address space and thus it no longer existed in the routing table of my gateway routers, and thus BGP could no longer advertise our block to the upstream providers.

Talk about a chain of events.

So I now have a static route to Null0 for our block to ensure BGP always has something to advertise. I should make it a backup route (high admin distance) so my IGP can insert something if it needs to.

Oh the joys.

New Years Resolution

Ok, I've decieded what to do next after CCNA Security certification. I will give myself this year to acheive CCNP certification. I have access to CBT Nuggets through work so I will use that to get my CCNP exams.

Wish me luck.

Cisco Terminal Server

Today I have been setting up my new secure management network. This consists of a little segment behind a firewall that I will VPN to to get console access to critical routers in the network.

I had a 32 ASYNC module from ages ago and went about configuring it.

Mostly it was reasonably straight forward but I seemed to remember something about setting the modem type. So far I could get console access onto my PIx firewall and an old 2600 router acting as the console server. I just couldn't get the console on the switch working.

As it turns out, if you set the modem to DialIn then that gets the switch console working.

Useful information for anyone out there trying this.

Blast from the Past

I managed to stumble across this famous piece of writing from the formative years of the commercial Internet...

http://w2.eff.org/Censorship/Internet_censorship_bills/barlow_0296.declaration

I remember reading that whilst trying to patch together my degree at university, the same place I learnt about the Internet and how big it was. Of course the Internet of the early 90s fame was far different from the one most people know today. Yet even then the potential of the medium was overwhelming to me a struggling computing student.

The very concept of near instant communication over the entire globle using email was astounding. I remember showing my sister the joys of real time chat to random people in Perth. Of course this was before IM or even the web. This was back when search was via Archie.au and you could finger university servers to see who was logged in then 'talk' to them directly.

Wow, what a flashback. How things have changed. Now almost everything is web based, just like everything is TCP/IP. I guess it's nice to have a little perspective and understand a bit about where things have come from.

A Difficult Choice

I have made a new years resolution to blog more...

I am coming up on ten years in my current job. Logic says its time for a change but after ten years, change is a difficult thing to contemplate. I have the problem of having reasonable job satisfaction coupled with the nagging sensation that I could do better. Add to that the fact that I can't easily define my current position and it makes the thought of changing jobs daunting.

I have considered network engineer, generic manager, project manager and can't think of what else.

Any ideas? I had been waiting for my boss to move up the food chain but I fear he's in the same boat as me, likes what he does, reluctant to move and just in a cushy place.

I have recently aquired my CCNA Security specialization but I just can't see work rating that worth of a pay increase considering I'm not a network engineer.

Oh the pain of it all.

100% v6

I think that would make a good marketing slogan!

My current v6 experiment involves seeing how much of the networking into a particular machine can I get to be over IPv6? The machine I have chosen runs a web application and also has a windows file share on it (via samba).

So far the application is mostly using v6 as web stuff is easy. Samba was also easy as long as the clients where v6 enabled.

Its now down to the little things. DNS over v6 is the latest thing I'm working on but getting strange errors as the resolver can not do reverse lookups on IPv4 embedded addresses. These look like:

::ffff:10.1.2.3

I get loads of resolver errors on these. Command line nslookup works for name to IPv6 but reverse lookups are problematic.

Backups might be a difficult one to get working as its a vendor I will have to consult who might not care.

We'll see how far I can get.

My long term goal is to have all my internal systems use v6 by default.

Here's hoping.

CCNA Security

Yeah, I've been suckered in but hey, can't be that hard if it's a CCNA right?

So the other day I ordered my book and booked my exam. I've now got two months to get my brain into CCNA Security land but this shouldn't be that hard 'cos most of it is familiar already.

Here's hoping I make it through.

Pix Trix

For a long time, I had always assumed that hardware with no moving parts was almost bullet proof. Well the other day I had a switch loose is configuration out of the blue. Everything. When a bunch of machines dropped off the network it took me some time to track it down. When I finally connected a console to this switch I found it at the initial setup dialog.

Whoops!

So I set about restoring its configuration. No, I did not have a backup but I borrowed the configuration from another switch. The tricky part was working out the port configurations. I started by putting them all on the same VLAN which worked for most machines, until I discovered a PIX firewall that should have a trunking port.

Trunking to a firewall? Not the best way to do things, but hey it was a pissy little 506E so I didn't have a lot of choice beyond the two physical NICs. Configured on the firewall were two logical interfaces onto the physical. My first mistake was assuming that the physical interface would correspond to the native VLAN and the other two would be tagged via 802.1q

Well, would you believe that's not the case? I was scratching my head for a while since the other two interfaces were working fine as the switch was tagging their traffic but since I'd made the VLAN of the physical interface a native VLAN this meant its frames were not getting tagged by the switch and thus the firewall was not recognising them.

So after much deliberation I tested this by changing the native VLAN back to 1 and what do you know? It worked. Upon closer inspection of the firewall configuration it should have been obvious. Despite being listed as a physical interface there was still and entry in the VLAN field which meant that interface was looking for tagged traffic.

So now I know. Did you know?

Way Cool

I want one.

Sleepy Vista

I was very excited yesterday setting up my new work computer. I thought I should finally take the Vista plunge. It can't be that bad I said. This morning I turn up and hit some keys to wake it up. Nothing. Well no display. Had to power cycle the box to get something up. Google it. Yep, lots of people have had this issue. Yay, go Vista.

Now I have to spend an indefinite amount of time trying to solve this issue or turn of power saving, which is probably better 'cos my machine gets backed up at night.

Loading Fibre onto cable ship

Wow what a labour intensive process this is.

Back to my roots

I like my job. The reason? I get to wear many different hats by which I mean I get to exercise lots of different skills. This afternoon I have had a lot of fun getting back into my C programming. That's something that I hadn't done in a while and I was pleased to know most of it came back.

I have mostly finished a piece of glue software to import call detail records from our PABX into our database for billing. I have previously written it in C++ but wanted to whip something up very simple for testing and so in an afternoon (or two) I 've managed to get it working so that it can suck in files like the ones the PABX will spit out.

Of course that's only half the job, the next part is the data manipulation which will be tricky. Deciding who made a call is complicated and will most likely be a manual process. Deciding what room a call came from is easier. Putting that information together we can work out who we should bill for a call.

I believe it's still useful for programmers these days to have some old world skills like C. Yes C lets you make mistakes but how on earth do you learn to program without making some mistakes? When a language takes care of everything for you and hides all the details then you loose the perspective that you gain from understanding these things. Garbage collection is nice but it's good to understand why it's there and how it's a comprimise. Similarly pointers are ugly at times but they are very powerful. Sure you can abstract them out in C++ whilst retaining most of the power but real power must be dangerous and the pointers in C certainly are.

If you've only ever programmed in java or C# then you haven't really programmed. Sure logically thinking the problem through and breaking it down itno smaller problems is a useful skill but where's the debug skills in that? How do you learn what not to do and what is a bad way of getting a result if you don't break things in the process?

Oh well, I guess I'm still old school to boot.

XML Love In

Ok, so realize that to some people XML is just a bit overrated and not worth getting excited about. I know, I used to be one. Sure there's some benefit in having a standardized syntax but when I first learn about XML I couldn't see beyond that. It was just a way of adding a standard structure to your file yet to me that structure was still arbitrary.

Fast foward to the present and I'm starting to realize that the real benefit of XML is having lots of standards use it. When my web pages, my images and my data are all in XML I can begin to do some powerful things like covert my data into an image automatically (XML -> SVG via XSLT). I can also do powerful things like create a form that automatically binds to the XML data I give it without me having to carefully construct it. XForms (though support is currently weak) will be a huge improvement over the current HTML forms as you can throw many inputs into your form and only the ones that match your XML data will be used! Great concept.

So yes, I've gotten the XML bug just a little though it's not all straight sailing. Despite knowing that I can convert my XML data into images I still haven't managed to get it working as I expect it should. Browsers are still weak on allowing you to debug XSLT. Sure I could generate the SVG server side, still using XSLT if I wished but that's not the point. I want to deliver the data to the browser and let it render it as needed.

I've got the bug so bad that Im' now thinking of all the ways I can use XML in my intranet site. I want to experiment with submitting XForms via SOAP (though I thnk thats XForms 1.1) and I want to look at being able to pull an XForms instance via SOAP also. I would like to be able to use XSLT to completely transform my data into a web page that looks the same as my existing pages. Then all I would need to worry about was the correct generation of my XML data. I would also like to better validate my data against my still growing schema. I would like to be able to use XSLT to transform my XML data into formats for use by other applications.

So many things to think about. The power of XML is just begining to dawn on me and I'm enjoying it. Just though I would share all this with you nice folks.

If anyone out there has managed to get embedded SVG (ie in an XHTML page) working form an XSLT tranformation of XML data withing firefox then I'd love to hear about it.

Thanks.

Magical Mystical iPhone

I must be an old school shopper but I don't like walking into a store and buying something that doesn't require delivery yet not walking out with the product.

Yet every Optus store I walk into (yes I know other people have stock) tells me it's going to be 6-8 weeks to get them in and that's only if I sign up now!

I don't know about you but I don't like the idea of paying for an iPhone plan (more $$ than my current plan) without actually having an iPhone. Is Optus going to reimburse me? I don't think so.

So instead I am waiting until I can walk into a store sign up and walk out with an iPhone. I don't think that's unreasonable. Given that, one can hardly say that the iPhone is generally available. I mean if you can't walk into a store and get one how is that available? If every store has to effectively 'order in' you iPhone that's not really available is it?

Really the iPhone has had a limited release. Even the Optus resellers don't have any iPhones and won't for some time so it would appear.

Apple should have gauaged the demand better and had sufficient stocks on hand. You don't made a really cool device that everyone wants then limit stocks for months after release. How does that help anyone. Surely there are loosing sales to people who unlike me can't be bothered waiting.

Heavens knows.

So still I wait.

Crowd Sourcing the Semantic Web

I've always been interested in the potential power of the semantic web but until now there hasn't appeared to be any killer application. I mean sure there's semantic information out there but most of it is what I would consider high brow. Databases of scientific information converted to semantic web form.

Yet what I always thought was the most obvious use of the semantic web technology would be to build a repository of human knowledge.

Ok, first you think wikipedia then if you're savvy you think of all the efforts out there to turn things like wikipedia into semantic information.

What I am thinking is something much more. I am imagining a website, or even a series of websites where people could input semantic information. I guess a semantic version of wikipedia though I can't think of a cool name.

People would go to this website with the intent of creating semantic knowledge. For instance you could go there and input the information that table is flat and has legs and that an average table will have four legs. The idea is not that I now become the authoratative source on tables but that I have just input a tiny piece if information.

From there we apply the crowd sourcing principle and probability networks to weigh each piece of information that the crowd has entered. If enough people input information about a table that is similar, that information becomes a fact. I believe this is the closest approximation to how we as humans learn.

The biggest failing of wikipedia is that even though I can input fantastic information the next person can overide that information. I would prefer that the next person input their information under the same heading and the system work out what most people believe based on the most popular information.

There are reasoning systems out there that can work on information like this. This would allow anyone to input any information (like wikipedia) but rather than anyone being able to overright any information you would have to fight against the crowd. So if 50,000 people put in information about a table being flat with legs and 6 people said that they were round and squishy a reasoning system would still come to the right conclusion.

So that's my great idea. Perhaps it's already being done but I don't know of it. I think if we were to stay standards compliant then we would have to have some way of crowd sourcing the ontology that goes with everything. I think there is potential here.

Then people could point their probability reasoners at this store of knowledge and could actually begin to understand human knowledge.

Google are you listening?

XSLT

After spending so much time generating my XML data I decided that I wanted to be able to see it presented in a user friendly fashion. Enter XML Stylesheets.

Boy what a frustrating time I had getting these to work. I found two big problems that took some time to solve.

The first problem that I had was originally the browser complained about my stylesheet because the web server reported its mimetype as text/xml and suggested it should be text/css. I reconfigured the webserver thinking this was the problem (of no output) but found that the browser then tried to interpret my XML stylesheet as CSS and produces a multitude of errors as a result.

So after changing it back (and still not working) I finally hit upon the solution. The web server has to report the file as text/xml but the source XML file has to tell the browser that it is text/xsl so the browser knows how to interpret it.

Secondly, I found that although I wrote a valid stylesheet for reasons that I couldn't fathom it produced either no output or wrong output. The browser will only complain at you when your stylesheet is not valid or well formed but if it passes these two tests there is no way to ask it what is wrong with the stylesheet.

So then I had to start with the most basic stylesheet and work my way up from there. One of the things that caught me out was the matching system. If for some reason your templates didn't match everything in the XML file the the browser would just dump any XML that was left over. This was a huge source of frustration as I had the impression that anything not matched would be ignored.

I did finally get a reasonablly working stylesheet:

https://netdb.alphawest.com.au/xml/netdb-style.xsl

Now it is a simply task as I add a new node to the XML output to create a new template into the stylesheet and get it parsed as the appropriate place. Simple now that it works!

XML and Schemas

I have embarked upon a project to output XML data from my intranet application. For what end I don't know yet but I thought it would be a useful exercise to have the ability to have my data in XML format.

My first attempt was the usual ad hoc method of simply outputting some XML but as I progressed I realized that I had no clear picture of what the XML should look like.

So this time around I have started with the other end and begun developing an XML schema.

https://netdb.alphawest.com.au/xml/netdb.xsd

I have done this with the assistance of Eclipse which has a nice GUI based tool for generating XML Schema. I now understand how it all hangs together and thus now have a nicely structured schema file describing what the XML form of my data should look like.

It has now become a much easier task to write the PHP code to output XML that complies with the schema. I have yet worked out a method to validate my generated XML against the schema without paying for software. Perhaps someone can recommend something.

My lesson learned from this experience is it pays to design your data first.

The next challenge is to find a useful application of this XML data. I would love to do some semantic web stuff with it but it tends to require RDF formatted data which would throw out the schema and probably require instead an OWL file describing what triples can exist.

I'll keep you posted on that.

The wonderful world of XSD

I have decided that for reasons that I don't yet understand, I am delving into the world of XML Schemas. From starting out thinking it's a relatively easy thing to describe your data to realizing what a huge task it is, I am now getting the hang of this and hopefully will be able to move on up to OWL once I am done here.

Understanding you data is the first task in creating a good schema definition. I have a standard relational database where I store all the information for my intranet web application. Sounds simply so far. Things start to get complicated when I mention that the database is actually an object relational one and yes I have tables that are inherited from other tables. Then most of these tables are represented at the middleware level by a bunch of PHP classes all inherited from a single parent.

With me so far? So from all that I want to create a schema that describes all the data that I have. Except that not all the data exists in the database and the data fakes some heirarchical information that has to now be represented in XML.

So, as you can guess, I'm having fun so far. I have an idea of the size of the task now and realize that I must spend some time making the right choices so that I end up with a useful and complete model of my data.

Wish me luck.

Apache SSL on Solaris

Ok, this is not a how to but a caveat. I downloaded Apache 2.2.8 onto my Solaris 9 box with the intention of upgrading from 2.0.47 and also enabling SSL. The upgrade part went fine after I managed to work out that to enable mod_ssl you need to provide two options to ./configure those being:

$ ./configure --enable-ssl --with-ssl=/usr/local/ssl

Or wherever your ssl is located. That took me a while as previously there was just the one option.

Secondly, (and this was a hard one) after installing the new apache I could not get SSL to work. On startup apache logged that it had loaded mod_ssl and generated some keys but it would not listen on port 443. I had a clue when I removed the Listen 80 statement for normal web traffic. This made apache complain that there were no ports to listen on. Ahh, it was ignoring my ssl config (contained in ssl.conf). That config was encased in a tag which it turns out was invalid (perhaps hangover from previous ssl config). Commenting it out (and the closing tag) made everything work after fixing a few more errrors.

So I guess the lesson to be learned here is that we shouldn't trust the config from the previous version of software. Too many assumptions are being made. I also don't understand why the ssl.conf file was conditionally included depending on the presense of the mod_ssl module yet the ssl.conf file had another conditional (which turned out to be broken). Why the double checking?

Oh well, at least it works now.

Feels good to be on the blu side

In case you haven't heard, HD-DVD is dead. Toshiba have officially pulled the plug. Some may want to cling onto their players but without any new content it will be a lonely ride.

Having just gotten a PS3 (for the games) it feels good to be on the winning side either way. From the beginning I was hoping that blu-ray would win, it just seemed like the better thought out design.

Either way, the deed is done and we can all look forward to every dvd we know being rereleased on blu-ray. Yay.