Recently in Training Category

illustrating the weakness of MAC authentication...

PickupLine Official Website

PickupLine is a network exploration tool that, among other things, is capable of bypassing authentication on authenticated wireless networks.

Monday, August 27
09:00 - 12:00
1412 ACE™ Uncovered: How ACE Analysis Really Works - Atrium Ballroom B (Reagan)
---
8:36 AM 8/27/2007
just had a great continenal breakfast, the coffee was superb.
I am sitting now in the atrium ballroom waiting for session 1412 to begin.

I have been working for more than a year on ACE analysis, and this will be my

second OPNETWORK conference

There was a reception last night in the Willard Hotel, wonderful ambience, and

the light finger foods, and spinach stuffed ravioli was really really good.
9:04 AM 8/27/2007
technical assistants introduction.

think of it as the science behind ace.

not point and click, how to, this is the theory of how the numbers are

calculated.

explaining to app dev that he broke a underforming app. you must be able to

support your conclusions.

not blind acceptance of the math, but understanding what the math behind the

answers is.

pdf copy of the slides on the desktop.

going over two main analysis components.

the summary of delays.
where it has spent it's time

quick predict
where it will spend it's time

talk about the various source of delays...
finish with how simulation works.

components of delay:
where should i spend my energy on troubleshooting?
summary delay chart pinpoints the areas that need analysis.

review of network delays
network hops...
complexity can be simplified... analogy of resistors and circuits.
there is an equivalent network between the client and server. it's not crucial to

model the actual, reducing complexity to simplify analysis.

bandwidth is the easiest to understand. we all agree, basically bandwidth delay

is the time it takes to clock a certain number bits per second on to the wire.
varies with the size of the packet!

the longer the packet, the longer it takes to clock on to the circuit.

from start of the packet to the end... 2000 bit packet, on a 2000 bit/second

circuit equals 1 second from start to end of packet to hit the wire.

latency delay:
length of time that it takes the rising edge of the bit to transit the circuit.
thousand mile cable, with an electric cable, propgation delay, longer to reach

california, than bethesda.

opnet defines latency ONE WAY... ping would return round-trip latency...!!!!
remember to divide in half if using ping

the bottleneck link controls how much the bandwidth plays in the equation...
usually the slowest links are entry and exit of the circuit... t1 is three times

slower than a t3 because of throttling delay.

throwing more bandwidth at a problem, only solves one of the components of the

problem.

roads, bandwidth = how many lanes the road has...
latency is the distance of that road, one lane road to new york, four hours, four

lane road still takes four hours, but if i want to send a fleet of trucks, the

four lane road allows me to send more data.

***warehouse analogy... could be created here***

application turns
application will experience the latency of the circuit, for each application

turn.
latency delay = circuit latency * (turns +1)

CONGESTION DELAY
is queing delay on devices, not the wire, you can not store data on the wire.
this is variable based on congestion.

you have to calulate the congestion delay for every single packet.

calculating network delays
clocking data on to the wire, and latency delay. BUT then we see additional delay

due to congestion delays.

clocking the data off the wire will take the same amount of time... but it does

not matter as much...

40% of mistakes because they did not specify bandwidth on import. you MUST answer

to the extent that you can.
you can not change them once they are imported... import configuration, toggle it

to previous, and then tweak the numbers when you select bandwidth and latency.

packet trains
bundles of packets, an application may send a block of data, 10 k forinstance,

and tcp chops it up into chunks

calulating delay for packet trains
so we will treat packet trains like 1 big packet
we see how bundles act like small packets, but can experience the same congestion

delays.

turns + 1 = application turns
you always experience latency once

pie chart
is telling you the benefit you will get for fixing this thing... bandwidth,

latency, congestion.

calculating delays, advanced
take the mental image if you started increasing bandwidth, to infinity , the

whole thing would compress , squeezing out bandwidth, what do you have left...

lab excercise.
response time = 26.03
bandwidth delay = (3.199,760*8)/1544000 = 16.58
percentage of bandwidth = 16.58/26.03 = 63.7

user think time is a new feature of it guru 14.
you can specify anything greater than X time factor is user think time... telling

the user to wait five seconds between screen refreshes.

you must perform the sanity check to defend your results in ACE

key concept.
every packet has a time value when you look at it in wireshark
ace knows TWO time values for each packet, when it was received and when it left.

Trace merge:

based on lining up clocks this is trivial, packet left, packet received.

single side adjust
if you specify the latency too high, you would get packet crosses.

sending a packet train... 10 packets... the ack's come back...........big gap in

the ack's
either the packet was delayed, or that ack was delayed.

acknowledgements may delayed...
there are rules that govern how ack's get delayed.

key concept: if we graph the delays... packet size, packet delay... small packets

have small delays... large packets have large delays.
*
/congestion
/____
/bandwidth ^
/______
/latency ^
/ -------
never zero latency

tcp guarantees that a packet will cross the network, it also protects the

network.
prevents single users from hogging the network

what does protocol delay look like
it is delay added by the network layer, that is overhead on the packet train.

tcp protocol delay causesd by:
tcp windowing
slow start
notice the inflight data graph is ramping up...
http 1.0 would be susceptible to this issue

frozen window

nagle's window
sending one packet at a time is inefficient
bundling to prevent inefficiency in the network
can be a problem in mainframe communications

retranmission
tcp covers how long it takes to recover from packet loss

out of sequence packets

lab 2

summary of labs, conclusion
was a congestion problem
the trace file showed the effect of protocol congestion which was slowing down

the packets

how to explain parrallel effects
reading the paper while eating breakfast
another example, dessert in the oven, making steaks... things that happen at the

same time

two types of applications:

transactional
e.g. database queries
sequential
or
parallel
multiple calls with dependencies

asynchronous
voice calls...

so parallel effects are something you have to do TWO things to make them go away.

analysis vs experimentation

simulation, is recreating variables and tuning them for determining different

effects

use QuickPredict for experiments

barchart
sweep
multi-user quick predict

I am in Washington DC For the OPNETWORK 2007 conference.

Registration Desk and Internet Café open on Sunday:
Please check in at the registration desk located, in the Amphitheater Foyer of The Ronald Reagan Building, to obtain your conference badge, personal agenda, and welcome bag.

Registration opens Sunday, Aug 26th between the hours of 2 pm and 9 pm.
and at 7 am on Monday morning.

I am reviewing this under safari, so far the text seems relevant.

Network Warrior
by Gary A. Donahue
Publisher: O'Reilly
Pub Date: June 01, 2007
Print ISBN-10: 0-596-10151-1
Print ISBN-13: 978-0-59-610151-0
Pages: 598

This is my agenda for this year's conference, hope to see some of you there!

OPNETWORK 2007
MY SESSION AGENDA
Kenneth Hunt
Monday, August 27
09:00 - 12:00 1412 ACE™ Uncovered: How ACE Analysis Really Works
12:00 - 13:00 2011 Keynote
13:00 - 14:00 2000 Lunch
14:00 - 16:00 1453 Implementing a Performance Engineering Process Within Your Organization
17:00 - 18:00 1440 Live Demo — Active Application Performance Monitoring with SLA Commander™ and ACE™
18:00 - 22:00 2001 Dinner / Reception and Entertainment
Tuesday, August 28
09:00 - 12:00 1418 Modeling Applications with the Standard Application Models
12:00 - 13:00 2012 Keynote
13:00 - 14:00 2000 Lunch
14:00 - 18:00 1415 Application Capture and Import Strategies with ACE™ — Advanced
18:00 - 19:00 1721 Birds of a Feather: Network Documentation
18:00 - 22:00 2001 Dinner / Reception and Entertainment
Wednesday, August 29
09:00 - 12:00 1423 Case Studies: Application, Server, and Enterprise Analysis I
12:00 - 13:00 2013 Keynote
13:00 - 14:00 2000 Lunch
14:00 - 16:00 1427 Capacity and Performance Planning for Mainframes — Introduction
16:00 - 18:00 1456 Importing Performance Data for Effective Capacity Management with IT Guru® Systems Planner
18:00 - 19:00 1717 Birds of a Feather: NETWARS
18:00 - 22:00 2002 Partner Pavilion / Dinner
Thursday, August 30
09:00 - 12:00 1465 Server Consolidation and Virtualization Planning with IT Guru® Systems Planner
12:00 - 13:00 2014 Keynote
13:00 - 14:00 2000 Lunch
16:00 - 18:00 1459 Capacity and Performance Planning for Mainframes — Advanced
18:00 - 22:00 2001 Dinner / Reception and Entertainment
Friday, August 31
09:00 - 12:00 1413 Troubleshooting and Predicting Web Application Performance with ACE™
12:00 - 13:00 2000 Lunch

Anatomy of the Linux networking stack

One of the greatest features of the Linuxｮ operating system is its networking stack. It was initially a derivative of the BSD stack and is well organized with a clean set of interfaces. Its interfaces range from the protocol agnostics, such as the common sockets layer interface or the device layer, to the specific interfaces of the individual networking protocols. This article explores the structure of the Linux networking stack from the perspective of its layers and also examines some of its major structures.

Last year was great, some of the best technical training I've ever seen. I was in these sessions:

• 1102 Introduction to Using Sentinel for Network Security Audits
• 1302 Traffic Modeling Techniques
• 1307 Planning and Analyzing ATM and Frame Relay Networks
• 1358 Habits of Highly Effective SP Guru
• IT Guru
• and Modeler Users
• 1402 Planning Application Deployments with ACE
• 1412 Troubleshooting and Predicting Application Performance with ACE--Advanced
• 1413 Troubleshooting and Predicting HTTP Performance with ACE
• 1415 Application Capture and Import Strategies with ACE--Advanced
• 1435 Habits of Highly Effective ACE Users
• 1442 Application Capture and Import Strategies with ACE--Introduction
• 1443 Creating Custom ACE Visualizations and Advanced Analyses with Python

Looking to jump into some refresher sessions this year, and retake all the advanced courses!

OPNETWORK 2007

OPNETWORK is OPNET's annual technology conference, focusing on intelligent analysis of networks, applications, and systems.

OPNETWORK is the largest event of its kind, attracting thought leaders from industry, government, and academic communities from all over the world, to advance best practices for:

• Application Performance Management
• Network Operations
• Capacity Planning and Design
• Network R&D

OPNETWORK 2007 will be held in Washington D.C. from August 27 - 31, at the Ronald Reagan Building.

Attendees will include OPNET users, technical and business leaders, and engineering practitioners representing corporate and government enterprises, defense agencies and contractors, network service providers, and network equipment manufacturers.

Enhanced Interior Gateway Routing Protocol - Wikipedia, the free encyclopedia

Enhanced Interior Gateway Routing Protocol is a Cisco proprietary routing protocol loosely based on their original IGRP. EIGRP is an advanced distance-vector routing protocol, with optimizations to minimize both the routing instability incurred after topology changes, as well as the use of bandwidth and processing power in the router.

Here's a nice explanation of the SSL handshake, note if you are using Wireshark to examine a network transaction that you must have the entire handshake from the first packet the client sends to the web server.

Description of the Secure Sockets Layer (SSL) Handshake

The Secure Sockets Layer (SSL) protocol uses a combination of public-key and symmetric-key encryption. Symmetric-key encryption is much faster than public-key encryption; however, public-key encryption provides better authentication techniques. An SSL session always begins with an exchange of messages called the SSL handshake. The handshake allows the server to authenticate itself to the client by using public-key techniques, and then allows the client and the server to cooperate in the creation of symmetric keys used for rapid encryption, decryption, and tamper detection during the session that follows. Optionally, the handshake also allows the client to authenticate itself to the server.

Packet Construction Set

0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identification |Flags| Fragment Offset |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Example Internet Datagram Header

PCS is a set of Python modules and objects that make building network protocol code easier for the protocol developer. The core of the system is the pcs module itself which provides the necessary functionality to create classes that implement packets.

Configuring Visual Uptime CSU/DSU

I have configured and installed quite a few of these interfaces. They're not hard to work with, and here are a few pointers for setting up your T1 interface. Keep in mind some changes are immediate and others require a reboot.




1. COMMUNITY—-
   

   >private



2. Admin> site name
   
   SITE NAME [] : CIRCUIT-NUMBER-HERE DLCI NUMBER
   

   Admin> site location
   
   SITE LOCATION [] : CITY, State ZIP+4

   
   

   Admin> site contact
   

   SITE CONTACT [] : Name and Number
   

3. IP—-
   
   >from old—-
   
   copy ip, subnet and router!


4. LINK—-
   
   >frame unless for frame circuits—-
   
   for point to point HDLC, check,check,check!!!


5. INBAND—-
   

   >none—-
   
   >initial



6. SLA—-
   
   >on


7. T1—-
   
   >from old


8. for example:


9. login: admin—-
   

   Password: ******



10. MyTown ATT DLCI 123> ip—-
    
    LAN interface address [192.168.1.238]:—-
    
    LAN interface subnet mask [255.255.255.240]:—-
    
    SLIP interface address [NONE]:—-
    
    SLIP interface subnet mask [255.255.0.0]:—-
    
    Primary router address [192.168.1.229]: DON’T HIT ENTER UNTIL YOU VERIFY THIS
11. MyTown ATT DLCI 123> t1—-
    
    Network Coding (AMI, B8ZS) [B8ZS] :—-
    
    Network Framing (ESF, D4) [ESF] :—-
    
    Network Line Build Out (0,-7.5,-15,-22.5) [0 dB] :—-
    
    Network FDL Protocol (ANSI, AT&T, Both, None) [AT&T TR54016] :—-
    
    Network Timing (Loop, Internal, DSX1) [Loop] :—-
    
    Data Channel Rate [64K] :—-
    

    note!!!! this is port size not the pvc!!!—-
    
    Data Channels [1-4 (256K)] :—-
    
    DSX1 Coding (AMI, B8ZS) [B8ZS] :—-
    
    DSX1 Framing (ESF, D4) [ESF] :—-
    
    DSX1 Channels [NONE] :—-
    
    DSX1 Line Build Out (133,266,399,533,655) Less Than [133 feet] :



12. MyTown ATT DLCI 123>


13. REBOOT


MySite 123 CarrierName> show

APPFILTER

App Filters are DISABLED.

Application FLOWS and SERVERS will be
collected for all hosts in all subnets.

Local Subnets
==================

COMMUNITY

Read-Write Community : private
Public read-only : Yes
Read-Only Community : public

EVENT

Elapsed Time Event Description
------------ -----------------
0d-05:29:06 Frame relay link is UP
0d-05:29:16 Frame relay link is ROUTER DOWN
0d-05:29:28 Frame relay link is LMISOLATE ACTIVE.ROUTER DOWN
0d-19:32:00 Frame relay link is NETWORK DOWN
0d-19:32:18 Frame relay link is LMISOLATE ACTIVE.ROUTER DOWN
0d-19:32:23 Signal change: T1 OK
0d-19:32:23 Reboot

FRAME

Link Statistics
Near Octets: 345136 Far Octets: 31694
Near Frames: 22181 Far Frames: 1981
Near Frame Errors: 2 Far Frame Errors: 0
Near Aborted Frames: 0 Far Aborted Frames: 0
Near Short Frames: 0 Far Short Frames: 0
Near Long Frames: 0 Far Long Frames: 0
Current Utilization: 0.00 Current Utilization: 0.00
Maximum Utilization: 0.01 Maximum Utilization: 0.01
Current Frames/sec: 0 Current Frames/sec: 0
Maximum Frames/sec: 1 Maximum Frames/sec: 1
Drop Events: 0
Link State: Up
Port Unavailable Secs: 50552
Frame Relay LMI is working correctly.
0 frame relay circuits were reported.

ID
Visual UpTime Select Multiprotocol T1 CSU DROP & INSERT ASE

Software version: M 2.0.023 - Feb 07 2006
Serial Number: 0049-0000000
Installed memory: 64M

Protected by U.S. patents: 5,867,483; 5,521,907; 6,058,102;
6,147,998; and 6,564,214.

This product may also be protected by other U.S. or foreign patents.

Copyright (c) 2006 Fluke Corporation(R).
All Rights Reserved.

LAN interface IP Address: 192.168.1.21
LAN interface Subnet Mask: 255.255.255.0
INBAND interface IP Address: NONE
INBAND interface Subnet Mask: 255.255.255.255
Default Router IP Address: 192.168.1.1

Running for 0 days 19 hours 33 minutes 4 seconds

INBAND
In-band communication: NONE
LMIsolate: INITIAL
Router timeout: 30

IP
Management IP address: 192.168.1.21
Management IP subnet mask: 255.255.255.0
SLIP interface address: NONE
SLIP interface subnet mask: 255.255.0.0
Primary router address: 192.168.1.1

IP Statistics
In Receives: 64519 Out Requests: 1061
In Delivers: 64517 Out Discards: 0
In Header Errors: 0 Out No Routes: 0
In Address Errors: 0 Reassemble Requests: 10
In Unknown Protocols: 0 Reassemble Oks: 5
In Discards: 0 Reassemble Fails: 0
Datagrams Fragmented: 5 Forwarded Datagrams: 0
Fragments Created: 10
Fragment Fails: 0

LINK

Link interface type: Frame

LOOP
T1 Network Loopback: None
Data Port Loopback: None

PASSWD

SECURITY
The security table is empty

Host address security is DISABLED

SERIAL
Console/SLIP speed : 19200

SITE
NAME: MySite 123 CarrierName
LOCATION:
CONTACT:

SLA
Inter-ASE messaging: ON
Message octets: 200

SLIP
Connection Type : Dial

STATUS
This ASE has been running for 0d-19:33:04.
T1 network side interface: OK.
V.35 data side interface: OK.
Frame Relay LMI is working correctly.

T1
Network Coding : B8ZS
Network Framing : ESF
Network Line Build Out : 0 dB
Network FDL Protocol : AT&T TR54016
Network Timing : Loop
Data Channel Rate : 64K
Data Channels : 1-24 (1536K)
DSX1 Coding : B8ZS
DSX1 Framing : ESF
DSX1 Channels : NONE
DSX1 Line Build Out : 133 feet

Network DSX1
------- ----
Signal OK Disabled
Excess Zeros OK Disabled
Frame Sync OK Disabled
Yellow Alarm Rx No No
Yellow Alarm Tx No No
Blue Alarm Rx No No
Blue Alarm Tx N/A No
Looped Back No No
B8ZS Detected No No
BPVs 0 0
CRC Errors 0 0
SESs 0 0
ESs 0 0
ESBs 0 0
Unavail Secs 0 0
Frame Slips 0 0

V35
Transmit Clock Source : SCT
Polarity: Normal
RLSD : Normal
Rate : 1536 Kbps
Activity: SD: Yes RD: Yes SCLK: Yes RCLK: Yes
Signals: RTS: Yes CTS: Yes DSR: Yes RLSD: Yes
DTR: Yes LL: No