Loading...

Browsing category archives: Technical

IPv6 Depletion Song

From The RIPE 55 Secret Working Group Report

a long long time ago
i can still remember
when my laptop could connect elsewhere

and i tell you all there was a day
the network card i threw away
had a purpose – and worked for you and me….

But 18 years completely wasted
with each address we’ve aggregated
the tables overflowing
the traffic just stopped flowing….

And now we’re bearing all the scars
and all my traceroutes showing stars…
the packets would travel faster in cars…
the day….the routers died

Chorus (ALL!!!!!)

So bye bye, folks at RIPE 55
Be persuaded to upgrade it or your network will die
IPv6 just makes me let out a sigh
But I spose we’d better give it a try
I suppose we’d better give it a try

Now did you write an RFC
That dictated how we all should be
Did we listen like we should that day

Now were you back at RIPE fifty-four
Where we heard the same things months before
And the people knew they’d have to change their ways….

And we – knew that all the ISPs
Could be – future proof for centuries

But that was then not now
Spent too much time playing WoW

ooh there was time we sat on IRC
Making jokes on how this day would be
Now there’s no more use for TCP
The day the routers died…

Chorus (chime in now)

So bye bye, folks at RIPE 55
Be persuaded to upgrade it or your network will die
IPv6 just makes me let out a sigh
But I spose we’d better give it a try
I suppose we’d better give it a try

I remember those old days I mourn
Sitting in my room, downloading porn
Yeah that’s how it used to be….

When the packets flowed from A to B
via routers that could talk IP
There was data..that could be exchanged between you and me….

Oh but – I could see you all ignore
The fact – we’d fill up IPv4

But we all lost the nerve
And we got what we deserved!

And while…we threw our network kit away
And wished we’d heard the things they say
Put all our lives in disarray

The day…the routers died…

Chorus (those silent will be shot)

So bye bye, folks at RIPE 55
Be persuaded to upgrade it or your network will die
IPv6 just makes me let out a sigh
But I spose we’d better give it a try
I suppose we’d better give it a try

Saw a man with whom I used to peer
Asked him to rescue my career
He just sighed and turned away..

I went down to the net cafe
that I used to visit everyday
But the man there said I might as well just leave…

And now we’ve all lost our purpose..
my cisco shares completely worthless…

No future meetings for me
At the Hotel Krasnapolsky

and the men that make us push and push
Like Geoff Huston and Randy Bush
Should’ve listened to what they told us….
The day…the routers….died

Chorus (time to lose your voice)

So bye bye, folks at RIPE 55
Be persuaded to upgrade it or your network will die
IPv6 just makes me let out a sigh
But I spose we’d better give it a try
I suppose we’d better give it a try

 

Words and performance by Gary Feldman

XN–BLAFOO

 
Yesterday the following data appeared in the root zone… 
 

XN–0ZWM56D.

XN–11B5BS3A9AJ6G.

XN–80AKHBYKNJ4F.

XN–9T4B11YI5A.

XN–DEBA0AD.

XN–G6W251D.

XN–HGBK6AJ7F53BBA.

XN–HLCJ6AYA9ESC7A.

XN–JXALPDLP.

XN–KGBECHTV.

XN–ZCKZAH.

 

in Amsterdam Zweegers was found death in a bath tub and the statistics on child death did not significantly change.

 

  

NAT too Smart

EDITED July 12 2007

The text below is an update from the original post (June 18, 2007), that original post turned out to contain a few errors.

We have an asterisk server installed back at work and for the teleconferencing purposes I got myself a  SNOM300 SIP phone. I configured the phone to do all its NAT magic using STUN and  tested that with my  linux based homebrewed NAT box.

That worked, but the setup did not migrate to a NATted network behind my new Speedtouch 780.

Turns out that in order to use SIP behind a Speedtouch 780, that has a SIP aware application level gateway that does all kind of weird tricks to your packets.

Having configured your SNOM to find its way through a NAT using Stun and the ALG in the Speedtouch does not work well, and generates weird timing issues that manifest themselves as ‘Authorization error” in the Sytem Information panel of the SNOM phone.

The degug output on asterisk (connect using asterisk -rc and use “sip set debug”) shows something of an explanation when following the SIP dialogue.

After the first registration attempt the server sends back a 401 Unauthorized message with all the parameters needed for proper authorization, including a so called ‘nonce’

<— Transmitting (NAT) to <public-ip>:52899 —>
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP
(…skip…)
CSeq: 1 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Supported: replaces
WWW-Authenticate: Digest algorithm=MD5, realm=”asterisk”, nonce=”3d58a314”
Content-Length: 0

The response to that reply is a new request from the client, without any authentication info. And the reponse from the server is again a 401 reply, with a new nonce…

<— Transmitting (NAT) to <public-ip>:52896 —>
SIP/2.0 401 Unauthorized
(… skip …) CSeq: 2 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Supported: replaces
WWW-Authenticate: Digest algorithm=MD5, realm=”asterisk”, nonce=”1aa0547a”
Content-Length: 0

Only at the 3rd try the client registers with the authentication code… but it uses the nonce that was returned for the first request

<— SIP read from <public-ip>:52899 —>
REGISTER sip:nlnetlabs.nl SIP/2.0
(…skip…)
CSeq: 3 REGISTER
Max-Forwards: 70
Contact: ;q=1.0;flow-id=1;+sip.instance=””;audio;mobility=”fixed”;duplex=”full”;description=”snom300″;actor=”principal”;events=”dialog”;methods=”INVITE,ACK,CANCEL,BYE,REFER,OPTIONS,NOTIFY,SUBSCRIBE,PRACK,MESSAGE,INFO”(…skip…(…
(…skip…)
Authorization: Digest username=”username”,realm=”asterisk”,nonce=”3d58a314“,uri=”sip:nlnetlabs.nl”,response=”somehexcode”,algorithm=md5Expires: 3600
Content-Length: 0

At that moment the Asterisk debug output will show some critical information

<————>[Jul 11 12:01:48] NOTICE[89797]: chan_sip.c:8167 check_auth: Correct auth, but based on stale nonce received from ‘”username” ‘

What is probably relevant is that you see this happen when you turn on “Stun” and that the frequency of the registration attempts is correlated to the Stun interval you configure in the NAT settings for a the identity on your SNOM phone. Also the port on which the dialogue happen jumps for each Cseq.

After seeing this I’ve tried a number of permutations of settings, on the snom phone I tried all sorts of timing parameters and in the asterisk configuration I turned the NAT settings on and off. All with variable results.

Turns out that one can turn off the SIP ALG in the speedtouch 780, which solves the problem. You have to use the command line interface of your speedtouch. The CLI reference guide is available on-line.

The magic words are:

{Administrator}[connection]=>appconfig application=SIP SIP_ALG=disabled

NB: I have not been able to find a way to tell if the SIP_ALG is enabled or disabled using appinfo or any other command in the CLI, but I have not really been looking hard.

As soon as the SIP application level gateway has been disabled you are in business as long as:

  • You configured NAT=yes for this particular user in your Asterisk’s sip.conf
  • You have configured a stun server in the NAT settings (under the identity settings) on your SNOM phone.

In other words. Do not rely on the intelligence of the ALG in the speedtouch modem, use ‘classic’ nat traversal. The meta problem here seems to be that all components in the chain try to apply their own hacks to traverse through the NAT and they do not really work nice together.

One of these days I have to figure out if I can make the SNOM, the SpeedTouch, and the Asterisk server run over IPv6 (I hear evil laughter somewhere, because AFAIK at least two of these components will not work on IPv6 natively yet).  Life would be good if the ADSL modem would be able terminate a V6 tunnel,   do IPv6 route advertisements or DHCP6 and would not be using silly NAT tricks.

The benefit of this particular setup is that the RTP traffic from the phone will terminate at the Asterisk server, that will therefore act as a natural IPv6/IPv4 application gateway.

Keywords: NAT, Speedtouch 780, SNOM300, SIP, Asterisk

Wonder goo

We recently bought a house and we are now in the proces of painting it. Some walls need a little more than just a bit of paint. They need patching and fixing and, and that is really bad, removal of texture. I bought myself a grinder to perform the first step. The second step is where ARDEX commes in.

ARDEX is a plaster/synthetic material  that you apply to your walls or ceilings. I am completely unexperienced in plastering but this stuff works like a charm.

Its hard to get though. I had to call 5 hardware stores to find an ‘obscure’ specialized store that carried it.

I didn’t know I could be so enthousiastic about a bag of powder.

ID/Loc Scotch Bof

The secret-wg’s contribution to the Scotch BOF:

There is this mess that is almost a soap
About addresses, routing, called ROAP
Heat your box, if you dare
or your wire, I don’t care
Drink a Scotch and there will always be hope

(for the universal deployment …. &c &c)

See www.secret-wg.org/Secret-Archive/ for more geeky limericks.

KORG MS20

Korg MS 20

I almost forgot about it… my Korg MS20

The poor machine and has been sitting in the attick of my parents for years.

If I recall well one of the oscilators is broken. Given that this is a electronic instrument that should be easy to fix with a soldering iron, a transistor, condensor, resistor, and/or some knowledge of electronics.

With the latter I am less comfortable. Fortunatelly the Internet provided me with a copy of the Service Manual and the repair job can be done by handy friends.

I remember fabricating a “drum-pad” by covering two layers of duplex wood with aluminium foil and seperating them a tiny bit so that hitting them with a drum stick would control the input. That with the white noise generator would produce that funky “clap” noise.

I should undust the machine and compare how it compares with Korg’s Legacy Cell software.

Further googling made me aware that this little machine has quite some cult status. It has been valued at about $1000. I am not sure if I want to sell this memorabilia of my teenage years.

 

Agenda quote

Inspired by a comment made at the IETF dnsop meeting:

It is less efficient to swing a big clue-bat than to shoot a round of clue bullets.

Terrorist Movie Plot Contest

On April 1 Bruce Schneier announced a contest that should get some attention. He will try to hook you up with a movie producer but I wonder if participation will also enter you on the DHS "no-fly" list.

For a while now, I have been writing about our penchant for "movie-plot threats": terrorist fears based on very specific attack scenarios. Terrorists with crop dusters, terrorists exploding baby carriages in subways, terrorists filling school buses with explosives — these are all movie-plot threats. They’re good for scaring people, but it’s just silly to build national security policy around them.

But if we’re going to worry about unlikely attacks, why can’t they be exciting and innovative ones? If Americans are going to be scared, shouldn’t they be scared of things that are really scary? "Blowing up the Super Bowl" is a movie plot to be sure, but it’s not a very good movie. Let’s kick this up a notch.

It is in this spirit I announce the (possibly First) Movie-Plot Threat Contest. Entrants are invited to submit the most unlikely, yet still plausible, terrorist attack scenarios they can come up with.

Your goal: cause terror. Make the American people notice. Inflict lasting damage on the U.S. economy. Change the political landscape, or the culture. The more grandiose the goal, the better.

Assume an attacker profile on the order of 9/11: 20 to 30 unskilled people, and about $500,000 with which to buy skills, equipment, etc.

Post your movie plots here on this blog.

Judging will be by me, swayed by popular acclaim in the blog comments section. The prize will be an autographed copy of Beyond Fear. And if I can swing it, a phone call with a real live movie producer.

Entries close at the end of the month — April 30 — so Crypto-Gram readers can also play.

This is not an April Fool’s joke, although it’s in the spirit of the season. The purpose of this contest is absurd humor, but I hope it also makes a point. Terrorism is a real threat, but we’re not any safer through security measures that require us to correctly guess what the terrorists are going to do next.

Good luck.

Time Waisting…

I run a dual boot PC back home. Today I was mucking around with grub and accidentally typed "grub-install /dev/hda1". Kids, never try adding a partition number to the device name. It screwed up my NTFS partition.

I probably could have restored the partition using what seems to be an excelent procedure but I decided to install windows XP from scratch. That is probably the best way to get rid of that rootkit Sony gave me a couple of months ago.

Besides I felt comfortable doing this because I had just back-upped all my important data (documents, application settigs, etc) a few days ago. Its just great that one can write backupscripts with rsync and tar and run them in cygwin. Now it is just a matter of getting some registry settings back. Still an evening worth of work *sigh*.