Killing the QoS Beast..

Ok i have been working on obtaining my CCIE SP # and along the road, i had to make some decision as i read and understand the technology. As you all know, CCIP is i would say, a good foundation for the SP Lab given the fact that it concentrates on Q0S, MPLS and BGP which i presume are the corestone for the SP Lab.

So of lately i have been reading lots of QoS stuff and now i have decided to give the 642-642 exam a shot. I am told its a tough one, but we will roll.

Lets see how it goes come January 2009.. :-) lol

Knowledge is like LOVE, the more u give the more u get.

I came across this from one of the blogs and though i would post so the visitors can read the same.

An Ancient Chinese scholar Confucius once said:

I hear and I forget.
I see and I remember.
I do and I understand.

And to that, my college professor added;

I teach others and I understand more.

Catalyst 3560 Cisco IOS QoS.

Well, sometimes i feel like the best way to understand a technology is to write about it. I was reading about QoS for Cisco based switched networks and i though maybe i could share my understanding of the technology with all visitors of this blog.

Qos which is an abbr to "Quality of Serice" according to Cisco; refers to the capability of a network to provide better service to selected network traffic over various technologies, including Frame Relay, Asynchronous Transfer Mode (ATM), Ethernet and 802.1 networks, SONET, and IP-routed networks that may use any or all of these underlying technologies. The primary goal of QoS is to provide priority including dedicated bandwidth, controlled jitter and latency (required by some real-time and interactive traffic), and improved loss characteristics. Also important is making sure that providing priority for one or more flows does not make other flows fail. QoS technologies provide the elemental building blocks that will be used for future business applications in campus, WAN, and service provider networks. This chapter outlines the features and benefits of the QoS provided by the Cisco IOS QoS.

Now that we all know what QoS is, lets see how it can be implemented on a Cisco 3560 Catalyst layer 3 switch.

Will start by classifying the type of traffic or application we need to implement QoS on.

Router#enable
Router#config terminal
Router(config)#class-map match-any junk-internet-traffic
Router(config-cmap)#match protocol kazza2
Router(config-cmap)#match protocol Gnutella
Router(config-cmap)#match protocol fasttrack
Router(config-cmap)#exit

Router(config)#class-map match-any important
Router(config-cmap)#match protocol ipsec
Router(config-cmap)#match protocol smtp
Router(config-cmap)#exit

After classifying we now need to Mark the above applications/traffic.

Router#enable
Router#config terminal
Router(config)#policy-map marking
Router(config-pmap)#class junk-internet-traffic
Router(config-pmap-c)#set precedence 0
Router(config-pmap-c)#exit
Router(config-pmap)#class important
Router(config-pmap-c)#set precedence 5
Router(config-pmap-c)#exit

After Marking the traffic we can now apply the policy to the interface.

Router#enable
Router#config terminal
Router(config)#int fa0/0
Router(config-if)#service-policy input marking


With the above, we have achieved to implement QoS with one Policy called Marking which contains a number of different classes of traffic i.e. important and junk-internet-traffic.

Google vs Locally based Search Engines

A very good friend of mine one time wanted to buy some item from the local stores in Dar-es-salaam. But in his quest to purchase the item, he spent almost 1 if not 2 days wondering around different shops and stores seeking for the same item...but with no luck.

If there is something he could not take anymore, was fatigue. Immediately he called me and asked me one simple question!!!. Noah, how long do you think it would take someone to find the an item they are looking for, in case some sort of a search engine similar to Google with information (database) about the local market and economy was available?, Well i though for a minute and then told him, it would take them a minute if not 2, and they would have the answer. He then laughed and said that is the point....1 or 2 minutes and you have what you're looking for.!!!!

The point here is, as much as Google can help us in Africa to find information globally and somewhat locally, it is not that efficient enough as very less information is availed to Google regarding our Africa's local economy. And for that matter, projects such us TAFUTA (www.tafuta.co.tz)and BONGOZA (www.bongoza.co.tz) are becoming more significant and important in East Africa.

It would also be much wiser if Google localized its information database based on local economies/countries for instance for Tanzania, www.google.co.tz would useful for searching withing Tanzania and www.google.com would be reserved for global purposes.

This of course would enable the searching of anything locally more easier...than walking street by street looking for some item which probably is just next door.

./noah

BIND 9 exploit is out. please check your DNS

This exploit targets a flaw in DNS implementations which allows the insertion of malicious DNS records into the cache of the target DNS server. Without wasting time....i had to Dig deep and find quickest solution possible to fix my own name servers.

Even though ISC and most of the security experts advised that administrators should patch their name servers with the current patches and softwares, it was not easy to take the normal path especially for those who are used to yum...ing and apt-get..ing.

Below are some few steps for those running Bind on Centos or Fedora systems.

Now....i could not wait until Dan Kaminsky come August 6th at 11:15AM Pacific time goes public again to talk at the Black Hat Briefings regarding this vulnerability in BIND.And give the fact that some folks have already leaked the ways-hows of utilizing the flaw to exploit those vulnerable systems, i had to start thinking earlier on how to fix my own name servers. Believe me they were also vulnerable as i was running the old version of BIND 9.

Now my finding as simple as it may look, only applies to those folks running BIND 9 on Centos 4 or 5 and Fedora core systems ... I tested on all this boxes in my office.

Lets start..

Prerequisites
===========
- Your firewall (iptables NAT/PAT or PIX) must have port 53 open.
- You most be running BIND 9 on Centos 4 or 5 or any Fedora core systems.
- Bind must be running in chrooted mode though not a prerequisite but a best practice.
- In your /etc/named/named.conf OR /etc/named.conf files....you must disable recursion and add an acl to only allow your networks to do recursive requests.

i.e.. acl "mynetworks" {
127/8; 172.16.0.0/12; 10.0.0.0/8; 192.168.0.0/16

i.e..view "internal" {
match-clients { mynetwork; };
allow-query { mynetwork; };
allow-recursion { mynetwork; };
match-recursive-only yes;

i.e ..view "external" {
match-clients { any; };
allow-query { any; };
allow-recursion { none; };
match-recursive-only no;

AND TO FIX the BIND VULNERABILITY
-----------------------------------------------------------------------------------

Checking if your system is vulnerable...run the command below replacing youdomain.co.tz with your organizations tld or cctl.

So do the following

[superuser@ns1 ~]# dig +short @ns1.youdomain.co.tz porttest.dns-oarc.net TXT
z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"192.168.1.3 is POOR: 26 queries in 20.0 seconds from 1 ports with std dev 0.00"

Poor indicates your name server or system is vulnarable...

Solution
-----------

[superuser@ns1 /]# yum update bind bind-chroot -y


[superuser@ns1 /]#vi /etc/named.conf ## Vi into your named.conf file and do the following. After save and reload BIND

options {
directory "/var/named";
allow-transfer { 192.168.1.4; };
query-source address * port 53; ## REMOVE OR COMMENT this line so as to allow randow port selection. Do this by appending a # this line
dnssec-enable yes; ## Add this line to your named to conf to enable DNS-SEC and go a head and setup DNS-sec. Remember it is not an ultimate solution


[superuser@ns1 /]#/etc/init.d/named reload

Then Check again to test
----------------------------

[superuser@ns1 /]# dig +short @ns1.youdomain.co.tz porttest.dns-oarc.net TXT Just to confirm...:-)

z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"192.168.1.3 is GOOD: 26 queries in 19.6 seconds from 26 ports with std dev 16515.27"
===========================================================================================================================================================

Good indicates that Your name server, at x.x.x.x, appears to be safe, but make sure the ports listed aren't following an obvious pattern. i.e the ports with standard deviation..16515.27..if your test clocks 10000.00 the your DNS server is more safer and your clients or users should not worry.

Do the same on all your DNS server in your organization. Suggestions and comments are welcome.

Good Luck.

./noah

This Squirrel Mail thing......!!!!!

While Exploring Round cube and Horde which are also open source based web-mail clients....i had forgotten of the fact that their existed another web-mail client for nuts. The Old Mighty Squirrel mail. Squirrel impressed me with its multiple features which included some sort of Spam filtering, user administration, fonts and colors, and most importantly the fact that a user has an option of changing their passwords. The change password plug in kills it all. Round cube lacks that. So i am working on customizing Squirrel Mail so i can see how it goes.

Big ups to the Squirrel Mail Team.

Project Black Box by Sun-MicroSystems.

**********************The Container Itself****************************

Of recently i've been working on a project and while continuing with the same, i came across this PROJECT BLACK BOX by Sun Micro systems . http://www.sun.com/emrkt/blackbox/index.jsp.

In simple terms according to sun Project Blackbox is a prototype of the world's first virtualized datacenter--built into a shipping container and optimized to deliver extreme energy, space, and performance efficiencies.

This added some light to me. I was so amazed with the this great thinking. I mean a whole complete Data Center in One Hell of a Container. Can you imagine!!!!!! This is awesome guys. The whole idea revolves around overcoming such disaster like the 9/11 incident in New York and also minimizing costs which a normal fully functioning Data and NOC center would take. This has enabled me get more ideas for my project in regards to resource optimization.


Inside you can see a Rack with a cluster of Sun Servers cabled Properly.