Cybersecurity Awareness Month, 2010

The cyber threat has become one of the most serious economic and national security challenges we face. America’s competitiveness and economic prosperity in the 21st century will depend on effective cybersecurity. Every Internet user has a role to play in securing cyberspace and ensuring the safety of ourselves, our families, and our communities online.

http://www.dhs.gov/files/programs/gc_1158611596104.shtm

Browser Acid Tests

Since I've been working at a hotspot ISP I've taken an interest in browser compatibility. We require the completion of a registration page before users can use our service. If users are unable to complete the registration because of a browser compatibility issue, it's a loss of service for the user and a loss of revenue for our company.

This has led to understanding browsers at a deeper level and their rendering of HTML/CSS standards. Strict enforcement of browser standards can be tested via the AcidTest website.

However, strict enforcement of standards does not mean a better browsing experience. With well over 50% market share, most websites are designed to work with Internet Explorer first and foremost.

You can access the testing site directly at: http://acid3.acidtests.org/

Firefox 3.6.3 gets a respectable 94%:

Chrome 4.1 gets 100%:

Opera 10 also gets 100%:

I.E. 7 produces a completely unusable rendering:

When is a graph not a graph...

I continued to be surprised at the number of times a group of people can look at the same graph and come to, not only different but, directly opposing conclusions.

Our department was recently contacted because one office was experiencing "slower than usual" transport speeds. Since my client heavily depends on transferring files betweeen offices and between client, a report of slow transfer speeds gets shoved to the top of stack.

I asked what speeds they usually experience, and what they are experiencing now. The response consisted of simply this graph:

So...do you see the problem? Me neither. There's not even a label on the Y axis as to what this graph represents. It's certainly not megabits/sec, or even megabytes/sec. Possibly bytes/sec. So I called backed to ask and found out it's the number of files transferred per hour.

Now that we have that settled. It actually appears that we have recently transferred more files per hour than in the recent past. So another call is placed to clarify the perceived slowness. "It takes longer." "You're transferring twice as many files." "It shouldn't take this long." "How long should it take?". "It should be faster."

At this point I needed to prove (at least to myself) that there was definitively no network issue or--if there was--to uncover it.

At first glance, a chart of bandwidth utilization didn't reveal anything telling. There were no errors, no buffer allocation problems, latency was well within tolerance. However, one noticable artifact is that the bandwidth seem to be stair stepped. Many lines peaked at 0.5 mbps, with several more around 1.5 mbps, a few lines at 3.5 mpbs, and none more than 4 mbps. Since this was a dedicated T3 circuit, I would have expected more random spikes.

Since access to the far end was limited, we could only test in one direction. It was now time to dig into the application and how, exactly, were files being transferred. We found out (1) files are being transferred via FTP, (2) a script kicks off every other hour to send all files in a given directory, (3) a third script is kicked off on demand.

This is now beginning to make sense. With limited visibility on the far end, we decided to push a 1 gig file (hope they have space). Bandwidth raised to 2 mbps and platuaed. While that was running, a second transfer was started. Bandwidth raised to 4 mbps. We continued adding multiple threads, up to 10 consecutive 1 gig files were being pushed. The circuit climbed to an almost predicatble rate of 20 mbps.

With this evidence we were able to contact the server own on the far end. Indeed, his server was limiting the per session throughput to 2 mbps.

But this really wasn't a lesson in technical troubleshooting. This was a lesson in investigative work. A nameless graph and seemingly contradicts the end-user reports. Armed with limited capabilities, we were able to diagnose the problem and, better yet, propose a new solution.

On to the next...

Whats Up Gold 12.4 - Changing Interface Stats Graph

Seems to be a regular request to change the reporting screens from "percent utilization" to an absolute rate; mbps or even just bits per second. The official way to do this (per Ipswitch) is to create new active monitors. But here's an easier way (note, this is a hack, not supported by Ipswitch).

The one down side is you have to pick a single rate in which to report all circuits, that is, the graph can be changed to report "bits per second", or "megabits per second", but there's no easy way to have it change intelligently based on the circuit.  What that means is, your sub-rate T1 lines and 10-gigabit switchports must all be reported in the same rate. 

The instructions below will change the graphs to "mbps" which should be good enough for most situtations.

Browse deep into the WUG installation directory to:
[sourcecode language="php" gutter="false"]c:\Program Files\Ipswitch\WhatsUp\HTML\NmConsole\Reports\Full\Device\Performance\RptInterfaceUtilization[/sourcecode]
Make of copy of the file "_RptInterfaceUtilization.inc" and save this original file--just in case.

Open up _RptInterfaceUtilization in your favorite text editor.

Look in the top section, around line 10 for the line:
[sourcecode language="php" gutter="false"]oAspForm.DeclareTranslation("sPercentUtilization", "Percent Utilization");[/sourcecode]
This is what gets printed on the vertical axis. Change the second parameter to read:
[sourcecode language="php" gutter="false"]oAspForm.DeclareTranslation("sPercentUtilization", "Mbits per second");[/sourcecode]
This is just a text field so it be whatever you want. Just keep it realitively short.

Now, scroll down to somewhere around line 35 for this section:
[sourcecode language="php" gutter="false"]" ((nIfInOctets_Avg  * 8.0) / (1.0 * NULLIF(nIfSpeedIn,  0))) * 100.0  AS nIfInOctetsUtilization, " +
" ((nIfOutOctets_Avg * 8.0) / (1.0 * NULLIF(nIfSpeedOut, 0))) * 100.0  AS nIfOutOctetsUtilization, " +
" ((nIfInOctets_Max  * 8.0) / (1.0 * NULLIF(nIfSpeedIn,  0))) * 100.0  AS nIfInOctetsUtilizationMax, " +
" ((nIfOutOctets_Max * 8.0) / (1.0 * NULLIF(nIfSpeedOut, 0))) * 100.0  AS nIfOutOctetsUtilizationMax  " +[/sourcecode]
These lines take the sampled interface rate and divide it by the maximum interface speed to get the percentage. We need to alter this formula to just give us the absolute rate in Mbps.  Since SNMP reports octets we still need to multiple by 8 to get bits and then divide by 1 million to get megabits. Change these lines to:
[sourcecode language="php" gutter="false"]" ((nIfInOctets_Avg  * 8.0)/1000000)  AS nIfInOctetsUtilization, " +
" ((nIfOutOctets_Avg * 8.0)/1000000)  AS nIfOutOctetsUtilization, " +
" ((nIfInOctets_Max  * 8.0)/1000000)  AS nIfInOctetsUtilizationMax, " +
" ((nIfOutOctets_Max * 8.0)/1000000)  AS nIfOutOctetsUtilizationMax  " +[/sourcecode]
Be careful that the parens match, as to do the quotes. Double check your work and save this file. Make sure it gets saved with the exact same file name and it only has an extension of ".inc"

Fire up your interface utilization reports and send them to the management team.

I should add that an WUG upgrade might possibly overwrite these changes.

Cisco QoS Primer

A great list of documents from Cisco about Quality of Service; how to use it, configure it, and manage it.

http://www.cisco.com/en/US/tech/tk543/tk759/tech_white_papers_list.html

National Cybersecurity Awareness Month

Full Story: http://www.dhs.gov/files/programs/gc_1158611596104.shtm

October marks the sixth annual National Cybersecurity Awareness Month sponsored by the Department of Homeland Security. The theme for National Cybersecurity Awareness Month 2009 is “Our Shared Responsibility” to reinforce the message that all computer users, not just industry and government, have a responsibility to practice good “cyber hygiene” and to protect themselves and their families at home, at work and at school.

Americans can follow a few simple steps to keep themselves safe online. By doing so, you will not only keep your personal assets and information secure but you will also help to improve the overall security of cyberspace.