1,330 reputation
169
bio website redhardsupra.blogspot.com
location Laurel, MD
age 36
visits member for 4 years, 11 months
seen 2 days ago

Apr
18
comment Is data always encrypted in IPv6 communications?
Thank you for clearly dismissing a horribly popular myth.
Apr
6
comment Filtering IPv6 ICMPv6 messages
You can't get rid of link-local, funny enough, because you need a starting point for the Neighbor Discovery process. In IPv4 you always have your MAC and you ARP out to get some IP. In IPv6 you always have your link-local and you do {Neighbor,Router} Solicitation to find your neighbors on the segment and a gateway out of your segment.
Apr
5
comment Filtering IPv6 ICMPv6 messages
Neighbor Discovery is basically your ARP replacement. So you're not gonna be able to resolve any hosts on your segment.
Apr
5
comment Network isolation with IPv6
Or if all you need is communication with nodes on your segment, you can just use the automatically generated/activated link-local addresses.
Apr
1
comment Git - Odd Disk Space Usage on GitHub
Have you tried git's garbage collection yet?
Mar
30
comment tcpdump How do I use it to capture all traffic headers
if you're actually utilizing full 100MBit/sec (or do you really mean 100MByte/sec?), the first thing to look at is the drive you're dumping it to. I often do dumps directly to an external drive, and then I keep bumping into USB bandwidth limits (22-30mbyte/sec), so I started using eSATA and that aliviated that problem, but it's still not completely eliminated. If you have loads of traffic, you might need to build a RAID (not RAID5, that's really slow for writes!) to support full speed captures. The reason why payload scrubbing would be nice is it would minimize the write throughput.
Mar
30
comment tcpdump How do I use it to capture all traffic headers
#4 is really hard to do. You never know how many more packet types are encapsulated in the packet. But before you do that you must do TCP and IP reassembly. Libnids is the only library I found that does IP defragmenation and TCP stream reassembly. So first you'd have to recreate all the streams separately, then detect how many encapsulation levels there are, then decide which of them you dont need, and filter these out.
Mar
30
comment Good filesystem for 20TB hardware-controlled RAID5 array?
If the size limit stems from block size and number of blocks, why not up the size of blocks? Unless your data set largely consists of <4k files, this should not be a problem.
Mar
16
comment Mac's Apache virtual hosts playing up
Do you have NameVirtualHost *:80 somewhere in your config?
Mar
9
comment wa (Waiting for I/O) from top command is big
THIS document is fantastic in explaining spotting bottlenecks using the tools mentioned above. Officially it's about NIC tuning, but the techniques and tools presented really have a much broader application than just that.
Mar
4
comment Secure LAMP server for production use
Apache Hardening on a sister site.
Mar
4
comment What are the mandatory Linux kernel modules to run inside of ESXi
@Zoredache got it exactly right. I want a cruft-free, lean mean syscall machine ;)
Feb
28
comment Can ESXi pass video card to VM to do CUDA?
I configured the video cards to do passthrough, however I still do not see them inside of the VM, or cannot add them to the VM in VM guest settings as a video card or as a PCI device (they're grayed out). Are there any other tricks I should be aware of?
Feb
28
comment HTTP response time profiling
Upvote for statistics inside of awk ;)
Feb
25
comment Can ESXi pass video card to VM to do CUDA?
BIOS is updated, all the VT-x/VT-d are enabled. How do you pass-through a video card in ESXi? I thought that's what vmware-tools do.
Feb
23
comment *nix OS that is easy to update to latest software
There's servers and then there's servers. Are you running a hospital on it, or your own web/mail? I have a file server on arch with 230+ days of uptime on a 7yr old computer, so it's obviously stable, as long as hardware underneath it is healthy.
Feb
20
comment Can enabling a RAID controller's writeback cache harm overall performance?
Would you mind putting together your data in some sort of structured table? This is some very interesting observations you're making, I'd like to see if there's a pattern.
Feb
14
comment Can't dd /dev/kmem in Ubuntu Jaunty
For completeness' sake, the same thing is done on RHEL 5.5
Feb
8
comment Why would I need a firewall if my server is well configured?
I first upvoted for PoLP, then downvoted for laziness. Firewalls are not tools to allow their owners to be sloppy. You should bother tightening your attack surface because if the attacker goes through the firewall (afterall you gotta have something open), they can just turn off iptables. Apply your laziness where it belongs: make the system as slop-free as possible, so you don't have to fix it for a long time.
Jan
22
comment What is “Cloud Computing”?
'The Cloud' is such a joke that I'm not sure it is possible to talk about it seriously.