The anatomy of a silly network attack

It has been a satisfying week at work. I have recently been working with ${organization} on a weird network problem that they've been having. Actually, "working with ${organization}" isn't really right -- they've been complaining and I've been telling the staff that runs ${organization}'s network that I strongly suspected that their network was suffering from a certain type of problem. But the staff at ${organization} won't follow my simple recommendations...not without any evidence of my theory.

So, I decided to put together some proof for my theory. The network problem that ${organization} is suffering from only happens during odd hours, and it was my observation that this problem involves a particular computer protocol. Specifically, this problem involves a particular verb in this computer protocol. Even more specifically, this problem involves too many of these verbs being transmitted onto the network at once. This is sort-of a denial-of-service attack....

In order to prove my theory as to what was going wrong on ${organization}'s network, I put together a simple deep packet analysis tool. Next I hacked together a postprocessor that went through all of the data that was collected and produced a histogram from this. Here's the final product:


Like I said, the problem occurs at odd hours. I thought I had some pretty compelling evidence of my theory at 10:30pm (their time) on March 11th. But then at 3:30am on March 14th my evidence became overwhelming.

For my analysis, a graph like this is invaluable. With this graph, I was able to zero right in on the problematic traffic on the network.

I'm still working with ${organization} on addressing their network problem. I wish I could say that one evil villain caused this problem, but my evidence shows that multiple end-users were involved with this problem and I have to assume that the problem is more of a mis-configuration problem rather than an actual network attack....

bash programmable completion

I am a huge fan of the bash programmable completion project. Just this morning I found myself typing:

scp remote-host:some-long

...and then I hit tab. At this point, the "bash programmable completion" code took over and within a half-second my terminal window was updated with:

scp remote-host:some-long-long-filename

...and if you really understand what went on when I hit that simple tab character, you should be truly impressed.

I love this package! This is one of the neatest, most well-put-together projects I have seen in a long time.

Cut the Carbon Kits

Cool! I just read in the newspaper yesterday that every public library in New Hampshire is now equipped with a "Cut the Carbon' kit, which consists of a Kill-a-Watt meter as well as some worksheets to calculate energy usage. I try to keep what is plugged into my house down to a bare minimum, but I look at this as a good opportunity to gather more data about a few items that I haven't gotten around to plugging into power strips yet.

I love libraries and the public service they provide.

I am a fan of xkcd

I continue to enjoy xkcd. Here are two of my favorites:




....and...


There is only one word for cartoons like this: brilliant!

Nexus One

This is a humble suggestion to the good folks at Google: given the name of your new phone, if and when you ever decide to put together a marketing campaign that involves any sort of audio, can you please hire Rob Zombie as a creative consultant? I'm sure he would have some ideas for a soundtrack.

ipsCA: fail

After trying to debug a boffo customer problem for around 15 minutes today, I finally figured out the root cause of the problem. The problem itself causes me to laugh a little bit, now that I know all of the details.

One of the important certificates issued and used by ipsCA (who I'd never heard of before today) expired on 29-december-2009. It's one thing for a certificate that helps secure a single website to expire ; it is another thing entirely when a CA's certificate expires.

This blog posting is where I was alerted to this problem.

This is a spectacular failure. Wow.

Lentil Soup

I learn something new every day.

So, the other day I was out and about snowshoeing with some friends. It was a cold and windy day, and we were traveling at a good clip.

Eventually, it was time for lunch, and I was cold and hungry and thirsty.

I had my usual lunch for such trips: a PB&J sandwich. It was a challenge to wolf down my sandwich in these conditions: my hands were cold, I needed to drink water, it was windy, I didn't have a lot of time, etc. The conditions were so challenging that I had to focus all of my efforts on just eating my sandwich and drinking water.

While I was struggling with my sandwich, I watched one of my fellow travelers pull a thermos out of his backpack. Then he unscrewed the top, and I saw steam come out of the top. Now he put the thermos to his mouth and poured. After a big gulp he told the rest of the people in the group that he was eating wonderful lentil soup.

I have to tell you, at this point in time, I was pretty envious. My sandwich was nice and all, but given the conditions, hot soup would have been much better. This gentleman had come up with a perfect meal for the conditions: his meal was hot, it came in a package that he could open even with heavy mittens on, he didn't have to pause to drink water along with his meal, etc. He didn't need a spoon either.

I learned something on this trip. The next time I go on a hike, especially a cold winter hike, I am going to seriously think about bringing along a thermos of soup. I like PB&J sandwiches and all, but clearly on some days hot soup would be better.