January 2012 - Roundtable

wireless basics
by Dan Martin 22 Jan '12

22 Jan '12

I want to do some (hopefully minor) tinkering with my wireless network, but it is clear that I don't get some basic concepts. To help me visualize my network at the NIC / MAC address level, could someone explain who has MAC addresses and why? I have a network connected (indirectly) to a cable modem. A linux box serves as a gateway. It is connected by ethernet to the WAN port of an airport extreme base station. 2 windows machines are connected to LAN ports on the base station. 1 windows machine and 2 Macs are connected by wireless. All the machines have manually assigned IP addresses, and the base station is configured in "bridge mode" since it appears the other options involve NAT or DHCP. My gateway box is acting as a router. It has 2 NICs (hence 2 MAC addresses), 1 for inet connection and 1 to the LAN. When I used a CentreCom router, on the other hand, it appeared invisible, or at least I wasn't aware of any MAC addresses for the router. The utility for the base station lists what appears to be 2 MAC addresses: an "AirPort ID" and an "Ethernet ID". I have assigned the base station an IP address. The Mac computer I'm using, attached by wireless, does not show the base station in the routing tables [except the "Ethernet ID" does show in the IPv6 tables]. traceroute shows only a single hop to the gateway. Am I to assume that dedicated routers - unlike my Linux gateway - appear invisible in the network and just magically connect nodes to each other? If so, what are the MAC addresses on the base station for? Just to access the box itself for configuration? To access something connected to its USB port? Dan Martin GP Hospital Practitioner Computer Scientist ummar143(a)shaw.ca (204) 831-1746 answering machine always on

6 10

Bizarre netfilter behaviour
by John Lange 21 Jan '12

21 Jan '12

I'm hoping someone suggest a fix for this. We moved some applications over to a new server which still had the default firewall rules in place which included a rate limiting "drop" rule that looks like this: iptables -A input_ext -m limit --limit 3/min -m conntrack --ctstate NEW -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options In short, limit to 3 new connections per minute. It turns out this was way to short for our application and so I just removed all firewall rules by stopping the firewal (this is on OpenSUSE). The last firewall log message indicates that a packet was being dropped to a specific IP due to a rate limit but now the server will not send packets to that IP at all! tcpdump shows that the packets are not even attempting to leave the interface. It seems like netfilter blocked the ip on the rate limit rule and now its "stuck". I tried specifically allowing that IP and even recreated the limit rule thinking that would "reactivate" the chain but it doesn't work. My guess is that a reboot would fix it but the server is in production and can not be rebooted without a scheduled outage. The only other thing I can think of is to reload all of the netfilter kernel modules but again that is too risky on a production system. Any other ideas on how to clear the filter? Is there a command to display the current status of what netfilter is tracking and dropping? -- John Lange

6 9

FW: CIRA consultation on accented domain names
by Adam Thompson 21 Jan '12

21 Jan '12

CIRA, the .ca domain registrar, is proposing to allow a restricted subset of IDNs (Internationalized Domain Names) in order to support accented French characters in domain names. If you speak or write in French, this will likely affect you at some point. If you use any .ca domain names, this may still affect you, although probably in less direct ways. Speaking only on my own behalf (specifically: MUUG does not currently have an official position on the matter), I encourage anyone who cares about our national ccTLD to review the information CIRA has made available, form an opinion, and voice your opinion promptly. IMHO, this is even more important than voting – if we choose poorly in an election, we have the opportunity to collectively change our minds in five years or less (usually four), whereas the CIRA IDN policy is likely to affect Canadians and Canada itself for decades to come. There’s no automatic reconsultation in four years, and there’s no built-in review process for decisions taken by NGOs like CIRA. In fact, once a decision like this is made, there may be no recourse at all if we collectively decide we don’t like the result. It’s obvious to me that CIRA is expecting to make a tidy sum of money by doing this (otherwise I believe they would be taking a different direction altogether), which I believe is OK as long as the internet-using-public’s interests are still served. I already have an opinion on the matter, and I’ll be making a submission. CIRA is effectively an NGO [I can’t tell what their legal status is right now], and they’re voluntarily doing the right thing by consulting the public – they’re not obligated to do so – but that consultation process is only effective if CIRA members express their opinions. Please express your opinion. -Adam Thompson <mailto:athompso@athompso.net> athompso(a)athompso.net From: CIRA / ACEI [mailto:communications.ca@cira.ca] Sent: Thursday, September 22, 2011 10:29 To: athompso(a)athompso.net Subject: CIRA consultation on accented domain names <http://sm01.ott.cira.ca:80/track?mailingid=4906&messageid=3713&databaseid=2…> Consultation on accented doman names <http://www.cira.ca/assets/Images/mass-mail/CA-logo.jpg> Have your say: Join CIRA’s consultation on accented domain names _____ Dear Adam Thompson, As part of our effort to continually enhance the .CA domain, the Canadian Internet Registration Authority (CIRA) is considering the implementation of French character Internationalized Domain Names (IDNs) at the second level (to the left of the dot). An Internationalized Domain Name is simply a domain name that contains characters other than a-z, 0-9 or hyphens. CIRA is planning the addition of the following accented characters to .CA domain names: * é, ë, ê, è * à, â * ô * ù, û, ü * ç * î, ï This means you could soon see domain names like préside.ca, grâce.ca, etc. Before we can implement IDNs, CIRA is preparing a framework that will help us create a policy for launching accented domain names. As a Registrant, we are seeking your input on our proposed framework. On September 20, 2011, CIRA opened a public consultation concerning our planned launch of IDNs. The feedback received from .CA holders like you, as well as our Members, Registrars and other stakeholders, will help us shape the final IDN launch policy. Learn more about the proposed policy and share your views at <http://www.idnconsultation.ca/community/en> www.idnconsultation.ca. About CIRA The Canadian Internet Registration Authority is the Member-driven organization that manages Canada’s .CA domain name registry, develops and implements policies that support Canada’s Internet community, and represents the .CA registry internationally. <http://www.idnconsultation.ca/community/en/learn-about-it> LEARN MORE ABOUT IDNs CIRA has developed a great interactive tool to map out all the basics about IDNs. <http://www.idnconsultation.ca/community/en/learn-about-it> View our great new IDN road map. <http://www.idnconsultation.ca/community/en/have-your-say> HAVE YOUR SAY! Tell us what you think about our proposed IDN launch process. You can <http://www.idnconsultation.ca/community/en/have-your-say/make-a-submission> make a submission or <http://www.idnconsultation.ca/community/en/have-your-say/discussions> join the discussion. <http://www.cira.ca/assets/Images/mass-mail/member/bubble-left.jpg> Connect with CIRA <http://www.cira.ca/assets/Images/mass-mail/member/bubble-right.jpg> <http://twitter.com/ciranews> <http://www.facebook.com/cira.ca?ref=ts> <http://www.linkedin.com/groups?mostPopular=&gid=2456714> <http://www.youtube.com/ciranews> <http://www.slideshare.net/ciranews> _____ Email Information Please do not reply directly to this email. This email was sent from a notification-only address that cannot accept incoming email. Inquiries regarding your .CA domain name should be directed to CIRA's Registration Support Department: Email: <mailto:info@cira.ca> info(a)cira.ca Telephone: 1-877-860-1411 Unsubscribe If you prefer not to receive future non-mandatory emails from CIRA, you may unsubscribe by sending an email to <mailto:unsubscribe@cira.ca> unsubscribe(a)cira.ca. Please allow 10 business days for processing. If you unsubscribe, CIRA will continue to send mandatory transactional messages related to your .CA domain name registration. If you are a .CA Member, you will also continue to receive mandatory messages related to your membership. Please note that if you are currently using the privacy services of your Registrar, or have your Registrar listed as your Administrative Contact, you will not be able to unsubscribe through CIRA. View CIRA's <http://www.cira.ca/privacy/policy.html> Privacy Policy. © 2011 Canadian Internet Registration Authority. All rights reserved.

2 1

Aligning Linux Distributions With Presidential Hopefuls
by Gilles Detillieux 20 Jan '12

20 Jan '12

This article is good for a chuckle or two amongst us Linux geeks... http://www.thevarguy.com/2012/01/17/aligning-linux-distributions-with-presi… -- Gilles R. Detillieux E-mail: <grdetil(a)scrc.umanitoba.ca> Spinal Cord Research Centre WWW: http://www.scrc.umanitoba.ca/ Dept. Physiology, U. of Manitoba Winnipeg, MB R3E 0J9 (Canada)

1 0

UG News - Last Chance to Register: Advanced HTML5 JavaScript, Top 10 New Google Advertiser Mistakes, Creating Mobile Apps and More
by Gilbert E. Detillieux 17 Jan '12

17 Jan '12

FYI... ------------------------------------------------------------------ View in browser <http://post.oreilly.com/rd/9z1zqbim09bd8nkd1e75ogd820jhtom9bmrjd4j8ue0>. *Forward this announcement to your user group or a friend* <http://post.oreilly.com/f2f/9z1z19f64b62g6qtfspf9f9fh30eog8v6vcv65hmq98> O'Reilly Webcasts <http://post.oreilly.com/rd/9z1zib30l8im8kfhabb7ej6lm2fi9srmpomhr7phh6o> Meet experts online. Join us for these free, live webcasts. Attendance is limited, so register now. We'll send you a reminder before the webcast. And please feel free to *forward this invitation* <http://post.oreilly.com/f2f/9z1z19f64b62g6qtfspf9f9fh30eog8v6vcv65hmq98> to others. Harold Davis <http://post.oreilly.com/rd/9z1z7rcgdn3oict7g233irfkc816br9bgtjm6ksguao> Digital Black & White: Craft & Vision <http://post.oreilly.com/rd/9z1zd1ou9o8sueh4e7cb89ko7d0hoevk5snbhomm6vo> Presented by *Harold Davis* <http://post.oreilly.com/rd/9z1zgsj7eu93a2npegd6divck9c91h1lpbvfmadf3vg>, author of *Google Advertising Tools, Second Edition* <http://post.oreilly.com/rd/9z1zbrletlv272mdbtc6u4j99jj94rhg3b4la7j27go> Add to iCal <http://post.oreilly.com/rd/9z1zckqak15an3ao42481sfebcn4hd3klcpdt1acfcg> *Thursday, Jan 19, 2012 at 10:00AM PT* Last Chance to Register <http://post.oreilly.com/rd/9z1z1s5i0ck00tk69itki0k32de9vh8accfsu5ofqi0> In this webcast, master photographer Harold Davis, author of the best-selling /Creative Black & White: Digital Photography Tips & Techniques/ examines the vision required to create black & white photos in the digital era, and explains the craft involved in his monochromatic images. Anastasia Holdren <http://post.oreilly.com/rd/9z1z7fs6jfrq8am0i06uohsss4jienvtl3dah0u0o20> Top 10 Google New Advertiser Mistakes (and how to avoid them) <http://post.oreilly.com/rd/9z1zgqbc66d9f79tu90nhlt318gbe6kacj9v66k1pu0> Presented by *Anastasia Holdren* <http://post.oreilly.com/rd/9z1za28ds03c8llartqv6ped0bfo8egru9gtsvlr2tg>, author of *Google AdWords* <http://post.oreilly.com/rd/9z1zo966c0iop803shijac1l45idan8v8abu2q31t40> Add to iCal <http://post.oreilly.com/rd/9z1zhfn5vhgma5bp3nolqhef6qrjomd5fqkgg8ogvug> *Friday, Jan 20, 2012 at 10:00 PT* Last Chance to Register <http://post.oreilly.com/rd/9z1z9lhchlccl73niveej59965pvgv4h16eu1vm102o> This webcast session will cover the most common pitfalls new AdWords advertisers face. We'll discuss ways to avoid them and correct issues in existing accounts to improve overall performance. Kyle Simpson <http://post.oreilly.com/rd/9z1zi1ah7kliq3dukjfev7qf0dcb1mluer9qcqcic1o> Advanced HTML5 JavaScript: Down 'n Dirty <http://post.oreilly.com/rd/9z1zc1e55tjj9ebj6ljinicoq6pgki4isp1pfmq7meg> Presented by *Kyle Simpson* <http://post.oreilly.com/rd/9z1zmc7bk9baqucegnk99254tvftdr8lb88cgqm888g>, author of *HTML5 Cookbook* <http://post.oreilly.com/rd/9z1zj5p81h2frgfabdhfdecuuqs3snmkqte3v0c5f7g> Add to iCal <http://post.oreilly.com/rd/9z1zv3aqu2pfbe3ooank93pogtubnfqqsc0j9c56bg8> *Tuesday, Jan 24, 2012 at 10:00AM PT* Register now <http://post.oreilly.com/rd/9z1z620b6csiblom3hv46ukn8j184415617eap1ubkg> This webcast will explore various advanced JavaScript API's in the context of how to weave them all together into a multi-player web-based game. Topics include: Canvas, History API, localStorage/sessionStorage, appCache, Web Sockets, Local Files, Web Workers. Joshua Marinacci <http://post.oreilly.com/rd/9z1zm1ndvbpab9gnjf7std1e5re1i043dmbuo6n3fng> Creating Mobile Apps with GWT and PhoneGap <http://post.oreilly.com/rd/9z1zh0jn4gqk1us1fvmvdo3rso2tu9bsq0kfgddtd0o> Presented by *Joshua Marinacci* <http://post.oreilly.com/rd/9z1zcnrdv8902aog2q3ek1blnr4h33k6lhu0p44vdoo>, author of *Building Mobile Applications with Java* <http://post.oreilly.com/rd/9z1zd8m6thd70hj61nsn728ofqfqlt9m6m66om76un0> Add to iCal <http://post.oreilly.com/rd/9z1zpnk5sdvmkp0gqkau98ugu3knvoabqls7hmft57g> *Thursday, Jan 26, 2012 at 10:00 PT* Register now <http://post.oreilly.com/rd/9z1z872gopp6pe68au0a668k1od63h143ck1l7b2h58> Not all mobile devices support Java but with GWT and PhoneGap you can code in Java and compile to native apps on virtually any smartphone platform. This webcast presentation will introduce you to the basics of building some apps. John Zablocki <http://post.oreilly.com/rd/9z1zi7r2e9kpfpfm37dg5jnm6qu1lkg5emg15psqph8> Developing with .NET and Couchbase Server <http://post.oreilly.com/rd/9z1zaqeoip1ghp8i7pnldc36cnm83giiqu2e3ahiiqg> Presented by *John Zablocki* <http://post.oreilly.com/rd/9z1zh92h4dhsno0jtha9vblbgdn5oiplp3sd3r0itj0> Add to iCal <http://post.oreilly.com/rd/9z1zmfb0r2qth8b0uucvgjraknks166phdf1b7fg5t8> *Friday, Jan 27, 2012 at 10:00AM PT* Register now <http://post.oreilly.com/rd/9z1zukd0ogj3jdv9gv4dcqieqfo7nvdoeemq01qp8j0> In this webcast John Zablocki, Developer Advocate at Couchbase, will introduce the .NET client library for Couchbase Server. To learn more about O'Reilly Webcasts, and watch on--demand videos of previous webcasts, visit: *oreilly.com/webcasts* <http://post.oreilly.com/rd/9z1zcd49vkhsujp1q0ol51jhftfbi3mids2rtoa1dh0> Spreading the knowledge of innovators - oreilly.com <http://post.oreilly.com/rd/9z1z8bfqofik0lncoo70maq4qjjountmj54ksc5au80> You are receiving this email because you are a User Group contact with O'Reilly Media. Forward this announcement <http://post.oreilly.com/f2f/9z1z19f64b62g6qtfspf9f9fh30eog8v6vcv65hmq98>. If you would like to stop receiving these newsletters or announcements from O'Reilly, send an email to *usergroups(a)oreilly.com* <mailto:usergroups@oreilly.com>. O'Reilly Media, Inc. 1005 Gravenstein Highway North, Sebastopol, CA 95472 (707) 827-7000

1 0

Here's a groan-inducing comment
by Kevin McGregor 13 Jan '12

13 Jan '12

One of our "operators" submitted an incident (like a problem report) this morning: Oper was able to ping server. Oper was able to open a console. There is no > real OS on the server it's like a dos logon screen.. Systems please verify > server status. This is a virtual machine. Here's what's on the screen: Symantec Messaging Gateway Version 9.5.1-6 Copyright (c) 1998-2001 Symantec Corporation. All rights reserved. cowsvpsbg1 login: Sigh. The VM is configured as "Red Hat Linux". I guess some training or at least documentation is in order. But really, "no real OS"? It's an uphill battle, that's for sure. Kevin

1 0

load throttling
by Trevor Cordes 12 Jan '12

12 Jan '12

(A real question this time!) I have a web (+ other tasks) server that sometimes does a lot of tasks in a short time that spike the load up to large values (like 30). The tasks are all long jobs of lots (tens of thousands) of little (10/s) jobs. I've written code to, between each little job, check the /proc/loadavg load (1 and 5 min) and insert usleeps (.5+ secs) based on the loadavg (exponential relationship). My goal is to keep the load < 2.0 on a 2 core system. Anyhow, it seems to be working fine. The weird thing is, at 2.0 loadavg, looking at top, I see the CPUs mostly at idle. Not even very much wait going on. Why would the load be 2 when both CPUs are mostly at 5-10% including wait? I basically want to make sure the system doesn't get overloaded and can respond to non-batch request (like a web hit) promptly. What loadavg should I target if not (1.0 * numcores)? I guess I can arbitrarily pick numbers and see what happens, but I like things like this to make sense, and to me 1.0 * numcores makes sense, unless I'm not understanding loadavg properly. Thanks!

4 4

Re: [RndTbl] load throttling
by Adam Thompson 12 Jan '12

12 Jan '12

If you A) only run as many jobs in parallel as you have cores, and B) run them under both nice and ionice, Then you should achieve your goal without any manual intervention. This, of course, does not produce maximum efficiency. -Adam Trevor Cordes <trevor(a)tecnopolis.ca> wrote: >(A real question this time!) > >I have a web (+ other tasks) server that sometimes does a lot of tasks in >a short time that spike the load up to large values (like 30). The tasks >are all long jobs of lots (tens of thousands) of little (10/s) jobs. I've >written code to, between each little job, check the /proc/loadavg load (1 >and 5 min) and insert usleeps (.5+ secs) based on the loadavg (exponential >relationship). My goal is to keep the load < 2.0 on a 2 core system. > >Anyhow, it seems to be working fine. The weird thing is, at 2.0 loadavg, >looking at top, I see the CPUs mostly at idle. Not even very much wait >going on. Why would the load be 2 when both CPUs are mostly at 5-10% >including wait? > >I basically want to make sure the system doesn't get overloaded and can >respond to non-batch request (like a web hit) promptly. What loadavg >should I target if not (1.0 * numcores)? I guess I can arbitrarily pick >numbers and see what happens, but I like things like this to make sense, >and to me 1.0 * numcores makes sense, unless I'm not understanding loadavg >properly. > >Thanks! >_______________________________________________ >Roundtable mailing list >Roundtable(a)muug.mb.ca >http://www.muug.mb.ca/mailman/listinfo/roundtable >

1 0

procmail global rule?
by Trevor Cordes 12 Jan '12

12 Jan '12

I'd like to have a global procmail rule that applies to all users on a system. I tried putting it in /etc/procmailrc, but that doesn't seem to execute at all. Each user on the system has their own ~/.procmailrc. I'd like to have the global one always apply, and the user's own apply also (after) the global rule. Anyone know how to do this? Thanks!

1 1

OpenBSD DUID
by Sean 12 Jan '12

12 Jan '12

I was asked at the meeting about converting an existing setup and update from device names in fstab to duid. It is easier than I expected... sudo disklabel sd0 | awk '/duid:/{print $2}' ef02643ce3b571a4 That's your DUID for the device /dev/sd0. In fstab replace: /dev/sd0a with ef02643ce3b571a4.a The pattern from this should be obvious. Maybe try with a swap slice first to see if it works for you. The advantage of swapping to DUID's is that no matter where you put that drive in the device chain it will be recognized as the particular disk and mounted accordingly. Also solves an issue if the order of disk detection is somehow not consistently ordered on detected. -- Sean

1 0