Wednesday, February 6, 2013

Killer Packets

They'll kill your ethernet link!

you can read the full article here.

For those too busy to read here's the skinny: a problem with specific Intel Gigabit network controller's onboard EEPROM creates a condition that can only be described as extremely strange. basically if you receive a packet with a specific set of numbers at a specific offset in any packet and poof. your ethernet connection goes away.

Neat stuff, but ultimately, not favorable.

if you have an Intel NIC, start looking for a firmware update.

Sunday, January 20, 2013

Communication Speed

Continuing in my (just starting) series of explaining the underpinnings of internet communication, I'd like to discuss PING.

This is, of course, a follow up to my posting about Bandwidth.

PING is the time it takes to transmit a simple (usually very small 100bytes or less) packet of information, for your system to a remote system, and back again.  The return trip is often referred to as a "Pong".

Ping has several factors that can contribute to the time it takes to communicate. These factors include the number of nodes between you and the destination.  these nodes can be entire networks, single routers, a computer, or just about anything designed to relay information from one connection to another.  Typically, the more complicated the system, the longer the time a router (or other type of relaying device) will take to forward a packet.

My complicated, I mean that some routers are setup to perform various intrusion prevention scans, antivirus and antimalware detection, etc.  There's also a number of rules that the information needs to be scanned to check for a match, before the router will allow the packet to be forwarded.  In addition to that, the more complicated the routing table on-board on that device, the longer it can take to find a match.

Let's compare the typical home-based router, to a corporate-level router with integrated firewall.

On the consumer end, the most complicated thing the device is doing is called Network Address Translation.  This type of NAT is one-to-many; meaning one address (on the internet) to many addresses (internally on the network), so your PC is on the network, all the router has to do is forward the information, and track who is sustaining the connection (so it knows to send responses to you).  On the other hand, with a corporate firewall, often it will have a few-to-many NAT (meaning multiple internet addresses for maintaining connections for a v.large group of systems); it will have to monitor which connection on which address goes to which internal system... there's a long, very complicated way in which it does this... I won't elaborate for now.  In addition to keeping track of a lot more sessions, the router also performs security profile matching, meaning the systems administrator will define firewall rules to say X type of traffic from X networks is not allow to talk to X systems - in a typical high-end network, there are thousands of these types of commands, both allowing, and disallowing network traffic to/from certain locations.  The router will also often have a network antivirus and antimalware system embedded, where it will scan all network traffic to ensure no viruses or malware is matched coming in or out of the network.  After all that, the router can finally pass the traffic.

All in all, the corporate router will take longer to process the packet, but usually not by much, since often they're built on much more capable hardware.

Transaction time through a router or entire network, can take tens of miliseconds. it doesn't sound like a lot, but it is.  You're only dealing with about 1.5kb of information at a time, and millions of these tiny packets of information need to be processed almost all the time; depending on network load.  I've mentioned the figure of about 10ms here, to contrast between transaction times.

Most switching methods (this is different than routing, which I was talking about above), use store-and-forward methods of transmission, this ensures a high data consistency rate.  Basically it weeds out the errors.  It does a good job at this, and considering the transaction times for 100megabit and gigabit networking, for the average packet, the speed gains using another method for forwarding, are nearly non-existant.  That being said, in a 100mbit network, the time it takes to process a packet through the connection at wire-speed, is aproximately 12microseconds.  Considering that's about 0.012 ms (miliseconds), that's a good, short amount of time to have a transaction. At gigabit networking, that number is further reduced to 1.2 microseconds, or 0.0012 ms.  Compare that to the 10ms or so, for a routed transaction, and you start to see the value in switching when you can, and routing when you have to.

With all this in the mix, faster network speeds; moving up from megabit to gigabit, or even higher, isn't always about network capacity. it's about network linespeed. being able to transact a message between two points in as short of an amount of time as possible.

These times are specifically important when dealing with online gaming.  Gamers refer to the phenomenon of having "high ping times" (somewhere above 100ms) as "LAG"  though, most lag can be attributed to the server going unresponsive for a fraction of a second.

With this said, this is the primary reason why so many gamers choose to have "LAN Parties" - they have the lowest ping time over a local LAN (12 microseconds or so), so LAG is almost entirely eliminated as a possibility.

One other good reason to have the lowest ping times possible is in the case of VoIP.  You may not realize it, but VoIP is becoming very popular.  If you own a cellphone with the ability to make a call over WIFI, you're using VoIP.  Almost all business telephones are now based on VoIP technology.  Many ISPs and telephone providers that deliver information to your home in any manner other than the standard 2-wired RJ11 telephone jack, is using VoIP to deliver that information to your doorstep.  In terms of VoIP, delay in delivering sound to your destination is referred to as "jitter".  You can test your jitter at Pingtest.net. The functional result of jitter is gaps and bursts in speech.

It's important to deliver information from end-to-end as quickly as can be possible done, however there's a limit where costs meets practicality  we won't be seeing 10gigabit networks hitting homes in the next year, but they'll eventually become necessary.  Hopefully by the time we need that much capacity, that quick of a transaction, these technologies will be very affordable.

Sunday, January 13, 2013

Virus alert

Yet again, another unintelligble, propaganda-ridden, mac-loving post about a miscellaneous blogger...

This post brought to you by: Beatweek!

I didn't really make it through the whole article before getting myself tied up in such a way that I knew I had to write something about it...

To be fair, I want to do an eloquent series about bandwidth, ping, latency, transaction time, etc. detailing the finer points of all, in such language that people can follow along at home, and this is going to be....  kind of in the middle of all that... but that's ok.

Here's what the article got wrong; what gets to me about the misinformation of integrated systems...

Mac's don't have viruses, there are no computer viruses, there are only windows viruses.

WRONG.

dead wrong.

there are viruses for Android, iPhone, Mac, Windows, Linux, Unix, Solaris... every flavor of "computing device" possible.  some systems are more susceptible than others. let's discuss a few.

many of these variants use some kind of "market", "store" or "repository" to obtain new programs.  I'll talk about Linux, but these concepts apply to the android market, iTunes store, etc.  In linux, the repository, or "Repo", contains all open-source, pre-approved (and often pre-compiled) applications that are supported by the people who made the software running on the OS. when you stick to the supported repo, you'll often get a large amount of good, working software that is completely virus free.  When you start installing programs from outside sources (in linux, you can add additional repos, on android, you can "sideload" applications, and on iPhone/iOS, if you jailbreak, you can load your own/free apps), you open yourself up to accepting programming made by someone who is not inherently trusted by the creator of your chosen OS.  To be fair, many times, this is not a problem, with a good understanding of who is providing the software and why; you can avoid any viruses or issues. - you hit problems when the software is coming from somewhere you're unsure of.

for these closed environments, risk only enters when you add software that can possibly do something you wouldn't like happening on your device.  Often, you can avoid this software with little, to no, effort.

on more open platforms like Mac's OS X and Microsoft Windows (especially windows), there are no markets to buy apps from and no "fully trusted" sources to use; you have to make the decision yourself.  Many viruses that have affected mac systems, have been snuffed out pretty quickly, and often, Apple will disavow any knowledge that such a virus exists at all, often denying it fiercely to someone who is currently infected with the virus; though the evidence is clear.  Windows makes no such claims.

So what makes Windows such a target? that's an easy answer.  Market share.

Market share is the percentage of the market currently running one system or another.  While Apple has made great strides to regain a massive amount of consumers, and the numbers of people running OS X are vastly improved over a decade ago, in comparison to how many windows systems there are, there's no competition.  a huge number of companies and corporations run windows, almost exclusively. From Servers, to workstations to mobile devices; windows is everywhere in business.  Being that I see IT from a business perspective, and I see how many people even have macs at all, nevermind use them as a primary computer system for anything or anyone, I can clearly, and honestly say, that OS X is a rare occurrence compared to windows.

When it comes down to it, Mac is selling primarily to consumers, not businesses, and frankly, if I were a virus programmer, I don't care about you. I care about big business.  Despite how much money you may THINK you have; the business you work for, works through your yearly contribution to GDP and your entire net worth, often in less than a day.  So why would I care about you, when a few hours of transactions for a large business, is more than you make in a month?  If I break into a company mainframe, or server, and I can access user data, and remotely connect to, and administrate their accounting computers, I've hit a gold mine.  Those are not mac systems, those are windows systems, with Excel and Quickbooks Enterprise. that's the information hackers and virus programmers want.

nobody cares about the few thousand you have stashed away for retirement, it's small cheese to these guys. even if the idea is to cause havoc and take down systems, there are still far more windows systems than there are macs.

Windows is targeted simply because it is everywhere. that and the constant analysis of the OS, looking for so-called "zero-day" exploits (those that were discovered today and/or too recently for anyone to know about them), that other OSes simply don't get the attention of.

I'm waiting for the day that Macs become popular enough to have a major virus outbreak, so that all these pompous, self-righteous windows-hating bloggers can stuff a sock in their "Mac's don't get viruses" mouths.

Please don't get me wrong, I don't hate macs, if you use a mac, that's nice, I'm happy for you. Please don't be all self-righteous about it. I don't hate macs, I hate the people that use them because of a perceived notion that windows is bad, then they take all the time and life they can to convince everyone else this is true. it's not.

Windows, Mac, Linux, Android, iPhone... whatever. use what you want, stick with what you like, enjoy what you're comfortable with.  These products are different for a reason, because we're not all the same.

Saturday, January 5, 2013

Understanding Bandwidth

Hello again everybody!

I felt it was about time to dust off the blog and give it a go. I think I should start a series on the essentials of networking and what you should know about it, to make an informed decision about what to buy, etc.

This could get very technical, so try to follow along as I take you through all this.

How do I know this: Years in college and hands-on experience working I.T. in my local area. I've seen the effects of everything I'll be discussing.

When deciding on a network type, you really have to start with, what will I be doing with the network. For many, the answer is easy, I want to get on the internet; for others, the answer is a bit more complicated.

When talking about speed, it's important to note that there are two major measurements of indicating speed, they're closely related but give very different numbers. Think about it like temperature, Celsius and Fahrenheit, if the temperature goes up, both will rise, if it goes down, they both will fall, but not necessarily at the same speed, or to the same numbers, or by the same amounts.
These two are in bits per second (bps) and Bytes per second (Bps)

Confused yet? you should be.
The way this works is that a bit is a single 1 or 0 in a computer system; a byte is a set of 8 bits that contains information, one value of a possible 255. Why the strange numbers? because a bit has two options, either be a 1, or a 0. which means that if you want 3 options, you need to use two bits, but two bits gives you 4 options, one of which is simply invalid. but what if you want 5 options? you need 3 bits, but three bits means you have 8 options (000, 001, 010, 011, 100, 101, 110, 111), 3 of which will simply be invalid. It's because of this (factoring by 2), which is why we see the same numbers cropping up with computers a lot.

2, 4, 8, 16, 32, 64, 128...

so what happens when bps meets Bps?

well, the speed in bps, is much higher in number than the speed in Bps.

For simplicity, lets use a value very close to the national average, that divides nicely, so it's easy to follow: 16. a majority of internet connections in north america are running at aproximately 16 megabits per second. that means, at any given second, 16,000,000 bits can travel across your internet link. sound like a lot? it used to be.
Truth is, 16,000,000 bits is only 2MB (megabytes in this case)

I want to point something out before moving further. the difference between bits and bytes is supposed to be indicated by the use of capital or lower case lettering. eg. 16 megabits per second is supposed to be indicated with 16 mbps (with a capital on the M being optional), and 16 megabytes per second is supposed to be indicated with 16 mBps (again, capital on the M is optional). the capital "B" indicates bytes, where the lower-case "b" indicates bits. Unfortunately, not everyone (especially marketing departments) understand this; so we get ISPs selling 16MBPS speeds, which is actually in bits.

so, with an average connection speed of 16mbps, that means we get 2MBps (16/8, because there's 8 bits per byte)

This trend of using bits per second, penetrates the telecom world. whenever dealing with communication speeds between two points, whether they are connected by ethernet, wireless, fiber optics, or a string with two cans, generally, we use bits per second. The problem with this, of course, is that everyone else uses bytes per second.

Example: in windows, all file transfer dialogs are in bytes per second, not bits. This means if you have a 16mbps line to the internet and download something, windows will show your speed (given that you're using the entire thing for just this download) as 2MBps. This has caused (in the past) a lot of confusion about what actual speed consumers are getting and what they should expect to get.
one of the most common misconceptions I've seen with internet is "I pay for 10mb service, but I can only download at 1.2mbps" - that's about what you should expect from 10mb service...

Bandwidth is a crazy thing too, since we have USB 2.0 which, in theory, runs at 480mbps, and the fastest I've seen it transfer has been about 200mbps (aproximately 25MBps) - what they don't tell you is that some of these connection types require overhead, USB more than most. Ethernet is actually rather slim on it's overhead, running about 40 bytes of overhead per packet (1500bytes or so): about 2.5% overhead. obviously it's much higher with USB.

So how much bandwidth do you need? depends on what you're doing. For an example, let's talk about HD video. If, by chance, you wanted to stream full-frame HD video from a blu-ray disk to a computer across a network, you would need to be able to sustain a minimum transfer speed, which is the same or greater than the amount of data per second in the blu-ray video files. Luckily, the specifications for these formats are published: first some facts from the specs.

BluRay disks when playing video, have a defined maximum bitrate of 54mbit/s - so, for example, if you wanted to send the bluray to a media player on wireless, you're going to have a bad time, depending on the wifi.

I say that because of duplexing. Full-Duplex is when you have a dedicated line of communication to/from a source, Half-Duplex is when you have to share a send/receive channel. Think of this like trying to shout over someone: nobody can understand either of you, so one person can talk at a time - this is half-duplex. If you have a direct line to someone's ear, and they have a direct line to yours, you and they can both talk, hearing only the other's voice, which makes more sense.

okay, so the example broke down at the end, give me a break. :)

so wireless, by nature (since you're only using one channel) is half-duplex, meaning the theoretical 54mbps on Wireless G (802.11g) is shared amongst send and receive, which would be fine, if you didn't have to send confirmations that you received information, and requests for more. This means your real-bandwidth on wireless will be significantly less than the 54mbps as advertised. This is the reason behind Wireless N being recommended for 'streaming' media.

wired networking could definitely handle it, transferring, on average, 100mbps in full-duplex mode. This far out performs the 54mbps coming off the blu-ray, and stutter-free playback should be possible... provided the rest of the network is fairly quiet.


Bandwidth is a topic that seems to confuse many people, here I'm talking about bandwidth in your house, and I hope that clears things up for you and yours. Soon I'll have discussions more in-depth about why wireless bandwidth isn't nearly what it should be, moreso than just being half-duplex. why we don't have full-duplex wireless, as well as internet bandwidth (why so slow). All this among many other topics to help clarify your digital life.

Be safe, enjoy.

Monday, April 9, 2012

Blackberry, BES and Email Hosting.

it's all garbage.

Honestly, email is the biggest load of garbage I've ever had the displeasure of knowing. Yet, we rely on it, every single day, on our smartphones and computers, to communicated with colleagues and coworkers, bosses and subordinates.

There is a better way, but that's completely irrelevant, since the entire market is so ingrained in this concept of email that it's no longer worthy of any discussion. So put away your high hopes of a wave-like interface for communication. Email is horrible, and it's not going anywhere. With email being so prevelant, it's impossible to keep up. Users get bombarded with hundreds, if not thousands of new messages every day, many are never deleted, instead left to waste in the enterprise server's inbox, unopened, unread, unloved, and irrelevant.

Aside from the growing problems of users inboxes being too bloated with unread messages, you have costs on costs on costs.

What's nice is that Microsoft has made it pretty easy, buy Windows Server, buy Exchange, voila, a nice, simple, easy solution. works, add your users, give them mailboxes, and set quotas based on how many people you have, and how much disk space there is on the server. done.

Cost: 1xServer, 1xOS, 1xExchange.

If you want to add mobile access, tick a box to enable Activesync, voila, now iPhone, Android and (last but not least) Windows Phone (formerly Windows Mobile) can now obtain any and all Exchange content. What's more, they can enjoy instant delivery with push notifications. Users can access their Exchange calendar, contacts, email and more, all sync'd with the server, and to their enterprise outlook. ... Wonderful!

Cost: whatever you want to spend on a mobile phone.

Now let's add... let's say, 5 blackberry users. We want full integration of the system, so BES is the way to go. and let's say, just for kicks, that the server we previously purchased is powerful enough to run BES along side Exchange, etc. So no new hardware here, besides the phones. Well, That's great, the Blackberry users have full exchange sync and can access their stuff.

Cost: BES (not cheap, look it up) plus a licence for every blackberry device, and, obviously, the phones.

.... okayyy, what the...

so it's going to cost me how much to just get blackberries working? okay, what if we go hosted?

Well, no server cost, no cost for base exchange or BES, so that's good right?

I have to pay an amount for every email account, but that's okay, I suppose, and for every email account I have access to it from iPhone, Android and Windows Phone, as expected.... but what about blackberry, I have to pay DOUBLE for BES ACCESS? are you joking?

just to have a blackberry?

I'm sorry, but I will continue to rage hard about this, Blackberry isn't special, their system isn't significantly better than Android, or Windows Phone. this is unjust, and the market is realizing that.

I've never really been on the "RIM is dying!" train, but I think I'll have to jump, because with this, as an IT professional, I would never suggest for any organization to buy into this. avoid it at all costs. Unless a company REQUIRES blackberry for some SPECIFIC reason, that no other platform and fulfill, there is no reason to buy it, or use it.

Wednesday, January 18, 2012

SOPA/PIPA

Today is SOPA awareness day. The day were many sites are "blacking out" to show their support of stopping the bills, commonly known as SOPA, and PIPA (or Stop Online Privacy Act, and Protect IP Act).

I'll start by saying I support the Anti-SOPA/Anti-PIPA movements; and I want to move quickly into HOW this affects us. Everyone knows about the screening of sites for privacy, what will be their criteria etc, what they can do, etc. but I see, more and more, people saying something along the lines of "I don't care, I don't live in the U.S.A."; I have news for those people: You're going to be very unhappy if this bill passes.

Here's why. The bills don't target US based websites, they target any websites. Those sites can be closed at any time for any reason... well, how? They revoke your DNS entry. What does that mean?

DNS, or Domain Name System, for those that don't know, translates something 'human-readable' into something a computer can work with. You see, the internet is not made up of google's and yahoo's, it's made up of 10.12.111.233's and 172.18.222.32's. That's how computers see the internet. These fancy names we've made up are called Domain Names; the Domain Name System (or DNS) was created to make reaching a site, easier than typing in (up to) 12 numbers that you would have to memorize for each site.

DNS basically is the internet equivilent of the yellow pages. You want to get an oil change at mr.lube, look in the yellow pages, and find the phone number for Mr. Lube. hey, there's an address too. In this analogy (which is fairly accurate), SOPA/PIPA type legislation would basically blast Mr. Lube from the Yellow pages, so you couldn't look them up if you wanted an oil change (all because they didn't pay their contribution to the RIAA's profit margin because they were caught playing Britney Spears in their customer waiting area).

Sure, if you have the phone number (or in SOPA/PIPA's case, IP Address) memorized, you can still call them, and if you know their address, you can still drop in for an oil change, but you can no longer find that information from the yellow pages.

Well, on the internet, the name you type in, EG GOOGLE.COM is the name of the place you want to go, the IP address returned, is the "phone number" to connect to that location. Without the DNS "yellowpages" on the internet, there would never be a connection. Simple as that.

So how does all this work? simple. DNS works backwards, which is to say, the last item comes first in terms of registration. so ".com", ".net", ".org", ".gov", etc. are all what are known as "Top Level Domains" or TLD's for short. so what SOPA will boil down to, is what DNS registrations they can revoke. Well that's simple, any TLD's where the company that owns that TLD is in the United States will be vulnerable.

Sorry to tell you this, but all the common ones you love so much, are owned by the states. That means all ".com" websites, and ".net" and ".org"... all vulnerable to SOPA. and since the distribution system for DNS all stems from the TLD servers, which is dictated by the central servers (all of them are America-based), nothing is safe. We're talking about the potential that an entire TLD is reposessed due to SOPA. That's right, poof, all of the .cn addresses, now property of SOPA. or .ca, or .uk, or whatever. GONE, like that.

Sure, the sites will still be there, and the pages will still be able to be accessed.... but NONE OF THAT MATTERS, because YOU WONT BE ABLE TO REACH THEM.

So pull your head out of the sands of "I don't live in America, it's not my problem", and realize, THIS IS YOUR PROBLEM TOO! Do whatever you can about it, even if that means yelling at your american friends, to yell at their elected representatives, DO IT, DO IT NOW! or you, me, this blog, google, youtube, and the internet as we know it, will simply cease to exist.

... Here's some links to get you started and help you out:
http://americancensorship.org/
http://fightforthefuture.org/
http://demandprogress.org/
http://www.fsf.org/

Joining in the protest today:
http://sopastrike.com/on-strike/

Tuesday, January 17, 2012

MIMO the best thing ever?

I've just been studying wireless a lot in the last little while and I was considering how MIMO could be one of the best innovations since 802.11a.

For those that don't know, MIMO, or Multi-in, Multi-out (to paraphrase), is a transceiver method that uses multiple radios for a single line to enhance throughput and clarity of signal, being able to be fine tuned to even make reflections and phase shifting due to environmental disturbances, helpful to your wifi signal.

That being said, a lot of newer, mid to high end wireless b/g/n and a/b/g/n cards are coming out with multiple radio chains. The 802.11n standard supports up to 4x4 radio chains, but I have yet to see anything utilize that. Most commercial grade hardware has a max of 3x3 radio chains, which is to say 3 full transceivers in a single card. A good example of this would be the Intel 4965, 5300, and 6300 cards; all of which, I believe, are 3x3 radio chains for a/b/g/n wireless at 2.4ghz and 5ghz. The maximum rates differ, but that's another matter entirely.

My thought is, how useful is this? I mean that. It's beyond what I thought could be useful, but it really depends on what the hardware, driver, and software is capable of. I havn't checked into this, but if you have 3 almost entirely independent radio chains on a single card, would that not mean that you could, in theory, develop a WDS where roaming is entirely seamless? Having all wifi distribution traffic go through a single vlan to a central server that switches the 802.11 traffic into the 802.3 backbone? Then the question becomes, would you be able to separate a single radio chain for roaming and connection discovery? It could have the new connection, to a new AP, with better signal, fully authenticated before the previous (poorer signaled) connection is interrupted. Furthermore, you could simply configure it for a layer 2 notification, to now send all layer 2 packets destined for this layer3 address through this route instead (maybe by a gratuitous ARP or a ping type packet to the WDS Server?) - Meaning no more interruptions while roaming between nodes....

That is, provided the wireless nodes in your network support it.

Furthermore, network troubleshooting and analysis would be further simplified. Considering that you require 2 full channels on either side of the centre channel in order to not interfere with neighbouring networks, that interference could work in your favour when doing network analysis. With a 4x4 radio chain, you could potentially configure each radio chain to listen to a different channel, and catch all overlapping channel traffic too, getting a much faster, much clearer picture of the entire topology of the area that updates more frequently with less work on the hardware side.

I mean, the possibilities here are awesome. No more frequency hopping and incessant probing to try and find your AP.

Of course, the beamforming and everything else included in the 802.11n specification are also nice; and yes, they rely on the MIMO underpinnings to work, but that type of benefit, I believe, would be second to this... at least from a network adminstration point of view.

That's just my thoughts on it. I might be way off base or key, but I find this to be rather exciting. I know they're already working on the next standard, so we'll see.