You Can't Hide!

You may be familiar with the standard old traceroute that relies on ICMP echo request and echo reply packets to identify the path to a target and verify the target reachability. If so... how many times have you not reached the target because they filter ICMP echo replies?

An example of this would be when you try to traceroute to http://www.microsoft.com/. You'll see right after you hit the msn.net domain routers you are left in the dust. It really isn't that unusual to block ICMP echo requests at servers - no one should be pinging them anyway, right?

Using TCP Traceroute
Using NetScanTools Pro, I typically use TCP traceroutes. In the Traceroute tool, click the Setup button and choose TCP (WinPcap). You can define the starting hop, timeout in miliseconds, and retries at this point, but I go directly down to the TCP Trace Specific area.

Here's how the TCP Traceroute works - NetScanTools sends out a series of TCP SYN (handshake) packets to the target. It increments the Time-to-Live (TTL) value in the IP header (just as an ICMP traceroute does) to locate routers along the path who respond with ICMP Time to Live Exceeded in Transit messages. When the hop count is high enough to allow the TCP SYN to make it to the target, that target MUST respond - hey those are the rules of TCP. The target must respond with either a TCP SYN/ACK (indicating the target port is open) or a RST (reset, indicating the target port is closed). In this case, we don't really care if the target port is open or closed - we're just trying to get the roundtrip time using traceroute.

Firewalled/Blocked Targets
Now we know the specs for TCP say the target must respond... but what if it doesn't? What could have happened. Well... either your TCP SYN packet never made it there or the TCP SYN/ACK or RST never made it back. Make sure you run your TCP traceroute a few times to ensure sporadic packet loss isn't to blame. Most likely it is likely a firewall or some other blocking device that in your way. You couldn't find the roundtrip time, but you did find a protected host.

FYI - NetScanTools Pro 2-for-1 Price
As you may know, NetScanTools is on my 'must have' list of tools for IT professionals. The new version (updated today) is available at www.netscantools.com. There is also a 2-for-1 sale online through June 15, 2009.

Learn More
In the upcoming "Trace Back to a Suspect Host" course (June 4) I'll demonstrate each form of traceroute along with numerous other invasive/non-invasive techniques for testing connectivity, paths, identities and relationships of targets. Register online at www.chappellseminars.com/sem-traceback.html.

Laura

Analyzing Video Spews

[Follow me at www.twitter.com/laurachappell]

Have you analyzed your application traffic today?

As we prepare for the online seminar this week (see http://tinyurl.com/pputte), I played around a bit with adding video feeds to the training. GoToWebinar (our hosting solution at this time) does not support video feeds as iLinc and others do, but we found a workaround by having the LifeCam video window up in the background and showing th entire desktop.

[Personally I am not to keen on feeding video... there are many eves when I work until 3am, get up with the kids at 6am and the thought of putting on being seen in my comfy "Big Dogs" sweatshirt makes me cringe. I can't wait until virtual avatars can be synced with a voice!]

To set up this analysis I simply created a new online seminar, joined as a speaker on one computer and joined as an attendee on a second computer. I launched Wireshark on my speaker computer and started up the seminar. I joined the seminar as an attendee on the second computer.

Here's what I found about the datastream -

- When just showing the entrance slide the traffic rate averaged less than 500,000 bits/second.
- When I moved through a slide deck or showed Wiershark screens, the IO jumped infrequencly up to 2,000,000 bits/second.
- When I launched the video and showed no movement (camera pointed at the wall), the stream reached an almost steady 2,500,000 bits/second. Showing my kids jumping on the trampoline had no effect on the video stream rate - it's always sending out the current image regardless of the level of change to the video image.

I tweeted the full-size image of this over at www.twitter.com/laurachappell - you can look at it at http://twitpic.com/5ust4.

Next I'll look at iLinc's traffic with and without video enabled...

Laura

Potential Lives Where...?

[Follow me at www.twitter.com/laurachappell]

I captured this image at TechEd last week.


Walking into the TechEd Live taping session I noticed the video crew was a bit more high-tech than in past years - this year they would capture the video directly to disk and reduce the video-to-production time down to less than 48 hours! Nicely done!

When I approached the video console area, I noticed the vidiots (an endearing term for those AV geeks whom I respect tremendously now...) were running on MACs. Microsoft had likely asked them to cover the MAC logo on their computer, but failed to realize the Apple logo is backlit. This made for a very interesting image when the Microsoft slogan "Potential Lives Here --->" pointed directly to the Apple logo.

One of the many interesting moments at TechEd North America - don't even get me started on the beach ball geekfest party!

Laura

Twitter Spitter

The dreaded email crossed my desk just minutes ago...

My friend Wil M. asked... "Are you on Twitter yet? You need to be! :-)"

Don't even try to placate me with your old-fashioned emoticon that blatantly acknowledges that I am comfy in my old habits! I know what you want me to do - spit out my life in little twit-turds?

Who wants to read that? (Hmmm... well I am going to spend a bit of time programming my new dual-trunking scanner this morning... and then I'm analyzing the impact of adding video to an online seminar to determine minimum throughput requirements if we add video streaming to the online seminars... hmmm... that's kinda geeky, isn't it?)

Will this be a big time-suck or a productive way to keep folks up-to-date on what's happening in the lab and upcoming events? Should I keep to techie topics or give you a glimpse into my somewhat twisted life of work, motherhood, amateur race car driver, balloon-shaper, hot tubber, sock collector, people watcher and closet nun-o-phile?

You tell me... should I kill the "Bluebird of Blabbering" or feed it pellets for a bit and see if the cage cleaning process is too much... (hmm... I wonder if it would be easier to cook than turkey...)

Laura

What a Waste of an Ear!

[Warning! Make sure you haven’t eaten recently before reading this blog entry.]

“The Body is Obsolete” is the claim made by freak-show “artist” Stelarc, the Australian entertainer who works primarily in Japan, Europe and the US (What? The Aussies probably can’t drink enough to keep this guy in business in the homeland?) Don’t get your bits in a bunch because I call him an entertainer – his own website offers glimpses into his “performances.” This guy is a definitely a Trekkie gone extreme.

Stelarc’s latest venture includes grafting an ear onto his forearm with plans of implanting a microphone and Bluetooth transmitter into the ear so he can ‘hear’ what his arm-ear is hearing. Why? How far away from your biological ears is your forearm, buddy? Why not implant something really useful like… an iPod? Or maybe a breathalizer? Or a real muscle so you can carry your bags of money to the bank?

Stelarc’s selection of body part and usage indicates that his is… as we say… an “AOL user.” He could have done some really cool stuff if he knew a bit more about mobile technology and constant need for speed and information. Here are some cyber-bio ideas that I hope to jot off and send to him (under the email addressing of Nurse Chappell, of course):

WiFi Interference Arm: Implant a Wi-Spy adapter in your arm (complete with antenna). Wire internally to your ‘funny bone’ so you can immediately detect strong WiFi signals or even interference (ouch!) nearby.

Storage Stomach: Since many folks are already getting their stomach’s stapled and all, there my be a bit of extra use to few drives in there – connector would be routed through your belly button so you can jack-in through that nifty belt that connects to your production machine. Hey - maybe we can use skinny people for extra off-line storage for others who have run out of room... hmmm...no wait! Instead of breast implants, we could have 'bits implants' - now that's thinking! Sexy storage!

Voice Recognition Nose: Mumble your thoughts and this nose picks up (now it’s doing the picking!) your ramblings and translates it into text format to store on the drive in your stomach or later offloading. (A hypo-allergenic version would be most desirable.)

I bet you can come up with all sorts of cyber-bio combos that would be waaaay more handy than an ear/mic in your forearm! Why isn’t this guy taking some classes in technology so he can create something we really WANT to see?

Just my 2 bits.

Laura

Free AirPcap Adapters at Sharkfest!

Two things have been foremost on my plate this week - Sharkfest registration opened and the Chappell University beta program launched. I'll blog about Chappell University next - first, I want to make sure you know how to get a free AirPcap adapter to capture wireless traffic with Wireshark!

Did you catch last year's Sharkfest Developer and Users Conference? Set in a laid back campus and swarming with Wireshark developers and fantatics, Sharkfest '08 gave us all a chance to mingle, discuss Wireshark tips and tricks, banter about ideas for enhancements and toast to the 10th anniversary and growth of a simple packet capture tool called Ethereal into the industry-leading analyzer Wireshark!



Sharkfest '09 will be held at Stanford University in Palo Alto, California on June 15-18th and CACE Technologies is giving every registered attendee a FREE AIRPCAP CLASSIC ADAPTER! This is a great deal considering the conference is less than $200/day and the initial session offering is filled with basic through advanced analysis techniques for wired and wireless networking.



Check out www.cacetech.com/sharkfest.09 for details on the event and register today to get your free AirPcap adapter!

See you at Sharkfest!

Laura

BrainShare... End of an Era or Time to Change?

Just moments ago I heard the final decision - BrainShare 2009 is cancelled. A wave of sadness passed through me... I thought back to the early days at the University of Utah, the Port 'o Call, speaking in the keynote room (just once), Meet the Experts partying, the concerts, the many friends I'd meet just one a year in Salt Lake City, Utah.  

Novell's cancellation of BrainShare 2009 definitely marks the end of an era for me - I've presented at every BrainShare since 1998 - since before my kids were born and my hair went grey and I lived in a packet-driven world of analysis. Back in 1998 I was a young whippersnapper skulking around Novell's hallways looking for the secrets behind this networking geek lab. Ray Norda was shuffling his way down the hallway keeping an eye on things and LANalyzer was still a hardware solution owned by Excelan Corporation (which Novell would soon purchase). I was the only girl hanging around the technical support guys (for professional reasons) and truly enamored with the SuperSet guys. 

Novell's announcement (and Apple pulling out of MacWorld in 2010) are indicative of our need to accept and move to a virtual world in more facets of our lives. 

If you got my most recent newsletter, you saw our survey regarding virtual conferences. Times have changed, folks... no training budgets, no travel budgets and likely absolutely no conference budgets in 2009. 

Can virtual conferences replace physical ones? Can we replace the human interaction and still walk away (albeit only a couple of feet) to feel satisfied that we've learned a lot in our time 'away' from the office? Can we replace the human networking aspect with something just as satisfying personally and professionally? Time will tell. 

Yes... it's the end of an era... or maybe the beginning of something new and exciting... regardless, I want to thank Novell for putting on one hell of a classy show each year - one that I looked forward to participating in swore I would be at until the day they said 'don't come.' 

Laura