As the world burns...

The world burns.  I study. 

I’m concerned with Dora (Discover, Offer, Request, ACK) the DHCP explorer and her friend Bubu  (broadcast, unicast, broadcast, unicast) and learn on source, forward on destination.    

Open suckiest path first:  Hello, dead beat dad.  Losers suck right?  Losers suck up.  Ack.  (link state packets for OSPF.)

Basic ACL near destination

Extended ACL near source

Deploy access class to limit access to console

Default information-orginate

Ip helper-address

I’ll know Thursday if I pass.  Wish me luck.

Rats vs Unicorns and the educational system

I’ve been spending a lot of time thinking about many different things.  Mostly “why” type of questions.  Perhaps I should elaborate.  Or not.  I don’t know.  I think the real problem is two-fold.  See, I don’t think I learned what I should have learned in school.  Reading, writing, and arithmetic are general subjects, but those aren’t the primary purpose of sending people though school.  As a creator of success, school is an absolute failure.  It’s been highly touted, though I’m not sure highly researched, that if you take 100 people out of any school the results will be vastly different.  Out of those 100, perhaps 10 will be moderately wealthy.  1 will be supremely wealthy.  And 90 will have zero or negative net worth. 

If that’s the case, then what are schools teaching?  Because if 90 out of 100 have a negative net worth, then that’s a fairly large failure rate.  What metric is being used to measure success?

I went through those systems.  I spent a lot of time learning the wrong thing.  And I’ve also spent a lot of time trying to learn and relearn the correct things.   The only problem with that is I don’t know what I need to be learning.  This shouldn’t be something that I have to redesign by hand.  It’s 2015.  Why haven’t we figured out how to train and teach for success yet?  Is the answer so complex that humans are incapable of understanding or developing the solution?  Or is it that our mental concept is so self-centric that we can’t think of long term solutions for education? 

I’m beginning to think the answer relates to rats and unicorns.  There’s a mental separation between those two animals.  They are more different than they are the same.  Unicorns are special, unique creatures.  They are these magical beings that are impossible to catch.

Rats are simple creatures.  There are more of them than humans.  There are rats everywhere.  There is roughly nothing unique about them.  A good 80% (assumption thrown in based on Pareto principle) of what makes a rat a rat is no different than any other rat.  It’s only via minor parts is the average rat ever special. 

So what do rats and unicorns have to do with education and technology in general? 

There aren’t any unicorns. 

There are a lot of rats.

Remember those two facts.  The next time someone discusses the uniqueness of what their selling, try to determine what is truly unique.  Mostly what you will find is a rat in a hat.  80% the same as every other alternative.  Really. 

There are no unicorns.  Just a bunch of rats with different color fur, or a hat, or something else that makes the rat not look like a rat.  

Garbage In/Garbage Out

I’ve been thinking of the concept of garbage in / garbage out.  It’s a computer science concept.  It’s an interesting concept.  The idea is that a computer is capable of processing all sorts of data, not just good data.  So if you give a computer bad data, it will spit out bad results.  Makes perfect sense in the computer world.  But what about applying the concept to life? 

Seems perfectly applicable to me, but it’s hard to interpret what constitutes good or bad information.  The basic concept I’m trying is limit the type of music I intentionally listen to.  I find that it’s hard to maintain the correct mindset when being assaulted by lyrics that preach the wrong kind of information.

Building the concept of where I want to be in relation to where I am is only limited by what my mind thinks I’m capable of.  But when you feed your mind information telling it that something can’t be done, then you are defeating yourself.  Logically, your brain is sitting there telling you that the music you are listening to is not affecting you.  But it is, and the effect is incredibly subtle.  It’s something easy to test, though it requires a bit of discipline.  What I did was eliminate music with words from my day to day listening. 

I guess I spent too much time listening to people doing bad things to other people.  Or listening to music written by people who are convinced the world is out to get them.  Or those that think the world owes them something.  I’m generally more inclined to think the world is ambivalent to individual existence.  Life is not fair, or easy.  But that doesn’t mean there is plenty of great stuff to pull out of the world.  In the grand scheme of things, the individual human life spans a very short period and has very little impact.  So really, our lives don’t matter all that much.

But mentally, people don’t want to believe that.  They want to believe in the importance and reach of their life.  But it’s simply not the case for the most part.  So you get a collection of garbage thrown in your brain that tells you the wrong thing and leads you to the wrong conclusions.  And generally, these conclusions are very logical.  Andy Andrews describes it as “thinking logically to the wrong conclusion”. 

So my recent approach has been to take in less garbage with the hopes of getting better information out.  I recently took a 4 day weekend after 17 straight days at work.  I had to work 17 straight days because I had been focusing on solving the wrong problem.  See, there’s the right problem and the wrong problem.  If you solve the wrong problem, you have to keep solving the problem over and over again.  It just doesn’t work.  What I finally realized in those last three or four days was I could have easily avoided working 17 days straight if I had done the correct thing.  What I needed to do was document better.  If I had documented better, then I could have turned anyone calling me to look at the document in question and follow it to its conclusions.  If the document was incapable of producing an answer, then there must have been some other issue.

What good does it do to create wonderful systems that have no documentation or notes? 

Leg Work

I always wanted to write a program that took forever to run just due to the amount of processing it did.  Now, I think I’ve got one. 

Unless I remember to run the thing frequently, it takes about 85 minutes to process through all the files I’ve collected to watch the status of my network.  That’s not pleasant, but it’s working on getting better.  It shouldn’t take as long the next time, as I’ve written in a few checks and balances that prevent it from re-checking every single file over again.  I end up running a “select everything and see if you return nothing” comparison.  Afterwards, I move the folder off to a different directory to archive and eventually clean up that directory.

Which, all of that seems to be working properly.  For the most part.  There are still some issues I need to debug, and some error conditions that need to be solved.  But it’s working better than it did.  The second part is that I’ve finally got it to where it will take multiple input units in the same file, so you don’t have to have multiple scripts logging in every five minutes.  The next part is to start working on NAT table translating and interpretation.  I’m not sure how I want to do that as of yet.  Show ip nat translations gives all the translations, but is that enough information?   What else would I want?

I think that’s the basic problem of all network security people.  You want to gather information, but it begs the question of what the correct amount of information is, and what really needs stored.  And there is always the question of when enough is enough.  

Flipping back through my Cisco book, it looks like I’m going to need show ip nat translations verbose for several different reasons.  The main reason is that is tells when that connection was last used, and that’s vital to proper identification of what has happened.  It provides the “when” and “how long” needed to trace information back to the source.

Show ip nat translations just gives a static view of an event that happened. The connection could have lasted for seconds or it could have lasted for hours.  There is no way to tell.  So the need is to translate the verbose method of the call.  

Where do I go from there?  I don’t know.  At some point I’ve got to figure out how make Apache work the way I want it to.  But that?  That’s another day.

Note: bold notations are specific Cisco commands.  

The next steps

Now that the Routing and Switching class is over, it's time to get ready for the CCENT.  I'm aiming for that in the next month.  I was aiming for two weeks, but I can get a voucher for half-priced testing, so I'm going to go for the voucher.

That being said, let's go back to network security.

I had a AHA! moment last week on network security, and it leads me to believe a very large vendor does not really provide security updates.  They also have some serious problems with their code.  It's all Apache web server, but it's an unpatched version of Apache that still has some serious vulnerabilities.

About a year ago, or maybe a little less, I realized when we replaced a router, all of our internal vulnerability scans started passing.  It was weird.  But I didn't know what it could have been.  Over the past couple of weeks, I've been working on replacing their router with my own.  After breaking our internal vulnerability scanner for a couple of weeks, our vendor finally fixed the device.

About the same time, we ran into a situation where a location suddenly started showing up as failing when it had been passing.  Thinking back, during the intervening period we had upgraded the site and swapped out the equipment.  At that point, we had swapped out a router.  And suddenly the site started failing scans.

Not suddenly, but it seems like it.  So I started thinking about what could have gone wrong during the upgrade.  Everything is built from standard equipment.  The results are pretty predictable and cookie cutter.  So how did this cookie fall out of the cutter mess up?  We'd tried a different configuration with the router, and the site ended up failing internal scans.

So, why did this router fail and other pass?  It's pretty simple: access control lists.  There was an implicit deny on the VLAN with the internal scanner.

Now I know why my scans are all passing.  The door to the scanner is closed.  And the equipment we're dealing with is no way near as secure as we thought.  All because of Apache.

It's also the realization that I can fake a passing scan in less than 30 minutes by simply throwing an ACL in every single router we have.  It'd be easy.  I already know the syntax.  Come to think of it, I could make it highly precise, so it wouldn't be something I could automate.

Anyways.

It just pisses me off that a multi-national company can't patch Apache.  Or, that I have to find the holes in their system.

Now, off to figure out Apache on my own so I can ramp up my network base lining and turn all the data I've collected into something usable.

I should probably write an article on that.   It's basically a combination of Java, mySQL, and some Ubuntu cron jobs.

end of a semester

Routing and Switching is over.   Finished the final with an 85, closed book closed notes.

That should give me an A for the semester.  I need to prepare for the CCENT for the next 2-3 weeks, and then go take that.  Based on the Routing and Switching final, I need to study OSPF more.  I missed more than I would have liked on that.

Scaling Networks is next.   The book is on order.  I spent a few minutes looking through the chapter headings on the final book, and found the PPPOE section.   Yeah.  Book 4, right before the CCNA.

Moving on.   Back to site construction tomorrow, now that finals are complete.   Yay.

construction

Working on a site out of town.   Learning many new things.  The crash course in PPPOE was interesting.

Routing and Switching class final is tomorrow.  Need to schedule the CCENT for about 2 weeks from then.  That should give me enough time, without being too much time.

I think I've come to the conclusion that IPv6 will permanently be a WAN interface technology, while the world uses dual stack routers to NAT into IPv4 private addresses.  

One bad tracert and a nefarious person could find your entire inner networking scheme.  But that doesn't work if NAT is involved.  The door shuts at the front door, and not somewhere inside.  That's really the problem with globally routable IP addresses inside your network.  If you don't have tracert blocked, you'll end up giving away your entire network structure.

It's not the "one shot, one kill" approach to network security.  There isn't such a thing.  There is only security in depth.   Walls and trenches and gates and guards and ACLs and NAT and every other thing you can possibly through between you and the outside world.  Maybe some machine gun nests and razor wire, as well.