1,397 reputation
1711
bio website redhardsupra.blogspot.com
location Laurel, MD
age 37
visits member for 5 years, 5 months
seen 8 hours ago

May
18
comment In tail -f, how do I filter out stuff that has certain keywords?
Yes, but they're merely symlinks to each other, not two different programs with some functional overlap. So wouldnt that be more of an 'addendum' (read: comment), not a full fledged answer? I've had downvotes for lesser offences...
May
17
comment different ACK behaviors (slowing down throughput?)
+1 for anyone that provides Dtrace code and output!
May
12
answered What are the benefits of a commercial distribution of Linux over a good sysadmin?
May
8
comment Rebuilding partition tables
Try PartedMagic's live iso, it has a mode where it can 'rescue' partitions by analyzing the disk's contents.
May
5
comment Is there a security concern exposing NTLM authentication over http or should it only be https?
'If you see it it's bad' is true. 'If you don't see it then it's good' is not necessarily true however. With challenge/response protocols you gotta study the protocol of what is being asked and how the response is generated, then seeing if you can obtain all the necessary information. en.wikipedia.org/wiki/NTLM#NTLMv2 has the details of what gets used. Time can be closely estimated, user and domain names can be determined, so the only truly random bit is 8byte random nonce, so that can probably be guessed in not too many tries.
May
5
answered Is there a security concern exposing NTLM authentication over http or should it only be https?
May
4
comment key efficiency 99.97% mysql
So does the high utilization of cache mean that everything that needs to be cached is cached? Or does it mean it's working well for what it's got, but it's maxed out and it needs more?
Apr
28
answered Stuck trying to track down the culprit for high CPU usage on a LAMP server
Apr
22
comment Connecting to MySQL securely - MySQL's SSL vs Stunnel vs SSH Tunneling
What kind of server/network architecture do you have? What kind of a scenario are you trying to prevent? If all your server-to-server communication is on a separate switch/VLAN, then you might not need anti-sniffing protection. As for performance, run openssl speed and pick ciphers that fit your needs for protection vs performance compromise.
Apr
20
answered How to determine which disk failed in a FreeNAS / ZFS setup
Apr
20
comment Nehalem vs Magny-Cours for VMWare/TS server
Take a look at the new Nehalem-EX and the chipsets they require; One system can house 2TB ram, 8 sockets, 10 cores (+HT).
Apr
20
comment Groups & User Conventions for *nix Server
So if a file gets deleted in this setup, how do you attribute who did it? Do you have some sort of version tracking on top of this layout?
Apr
20
answered Linux server distro where default server packages customized the least?
Apr
18
comment Is data always encrypted in IPv6 communications?
Thank you for clearly dismissing a horribly popular myth.
Apr
6
comment Filtering IPv6 ICMPv6 messages
You can't get rid of link-local, funny enough, because you need a starting point for the Neighbor Discovery process. In IPv4 you always have your MAC and you ARP out to get some IP. In IPv6 you always have your link-local and you do {Neighbor,Router} Solicitation to find your neighbors on the segment and a gateway out of your segment.
Apr
5
comment Filtering IPv6 ICMPv6 messages
Neighbor Discovery is basically your ARP replacement. So you're not gonna be able to resolve any hosts on your segment.
Apr
5
comment Network isolation with IPv6
Or if all you need is communication with nodes on your segment, you can just use the automatically generated/activated link-local addresses.
Apr
1
comment Git - Odd Disk Space Usage on GitHub
Have you tried git's garbage collection yet?
Mar
30
comment tcpdump How do I use it to capture all traffic headers
if you're actually utilizing full 100MBit/sec (or do you really mean 100MByte/sec?), the first thing to look at is the drive you're dumping it to. I often do dumps directly to an external drive, and then I keep bumping into USB bandwidth limits (22-30mbyte/sec), so I started using eSATA and that aliviated that problem, but it's still not completely eliminated. If you have loads of traffic, you might need to build a RAID (not RAID5, that's really slow for writes!) to support full speed captures. The reason why payload scrubbing would be nice is it would minimize the write throughput.
Mar
30
comment tcpdump How do I use it to capture all traffic headers
#4 is really hard to do. You never know how many more packet types are encapsulated in the packet. But before you do that you must do TCP and IP reassembly. Libnids is the only library I found that does IP defragmenation and TCP stream reassembly. So first you'd have to recreate all the streams separately, then detect how many encapsulation levels there are, then decide which of them you dont need, and filter these out.