User login

Blogs

29

Jun

2011

Got my AMP package for Ubiquiti AirOS to the point where it will check
for updates on startup before running (with a small random offset), checks
for updates to AMP configs and checks for updates to the firmware image at
random but known times of day. Should there be an update it will apply it
and restart anything that needs to be.

Looking at having certain tests wait for the link to be idle before
running themselves seems to be best accomplished by using chained tests -
the first one can check the traffic on the link and delay as required,
before either aborting or allowing the chain to continue. Started to write
up a simple version of this test and it looks like it should do the trick.

28

Jun

2011

Presented my talk to the Waikato branch of the NZCS on Thursday. Went really well and people were really interested. In fact, they were so interested that they let me talk for an hour and a half! A big thanks to Brad who came along and was a very helpful technical assistant!

27

Jun

2011

I collected some more useful publications for my lit review and started looking at ways to produce an overview of the network map.

27

Jun

2011

Spent the entire week implementing various analyses to run over our various trace sets. Aside from a couple, everything on my list is now implemented and it is just a matter of getting them to run over all the traces and turn the output into interesting graphs.

Converted my old object extraction tool into a library with a usable external API and reimplemented the tool using that API. The library was then used to implement an HTTP and SMTP object analysis for the above study.

Made Waikato V available on the WITS FTP site - we've had a couple of requests for more recent traces and there was enough space on mojo to fit Waikato V.

21

Jun

2011

Got AMP running happily on the Ubiquiti AirRouter and reporting results to
another machine. There were a few byte ordering issues with the AirRouter
being MIPS and the collector running on an x86 machine, but most of the
work here had already been planned for so I wasn't required to make
wholesale changes to get it running. Still had to spend a bit of time
tracing through the code checking what values were being used where and
making sure all communications were appropriately byte swapped.

Some changes in between libcurl versions were throwing off results
generated by the http2 test which had to be tracked down and fixed to get
it running on the device.

Investigated in greater depth the init system used for the AirRouter and
how to get AMP running on startup. Looks to be a few options on how this
can be done, but I think I've figured out the nicest approach to get it
doing what I want.

20

Jun

2011

Finished up my report on comparing libprotoident to other traffic classifiers. Anyone interested in reading it can find it here: http://www.wand.net.nz/~salcock/drafts/lpi_report.pdf

Overall, we do pretty well - we easily outperform the OSS DPI tools in just about every category and are not really that far off the commercial PACE engine. Remember, we're also only working with 4 bytes of payload too, whereas they have the whole packet!

Started working on a system for processing all our traces and extracting various stats about the traffic, flows, hosts etc. By the time you read this, you should have seen the email I sent to the WAND list describing what I'm looking at so far. I've implemented most of the things on my list so far, but the amount of output generated could be a bit of a problem. Started working on making my output a bit more efficient, i.e. instead of reporting the duration of every flow, doing some binning and reporting the number of flows that fall into each bin.

20

Jun

2011

I had a look at ways of visualising bandwidth in an effective way on a network map. I am experimenting more with an idea that incorporates width, height and colour of edge sections. Where width codes the bandwidth utilisation percentage, height codes the actual throughput and the colour codes some categorical severity measure.

See: http://joeloughton.com/blog/wp-content/uploads/2011/06/bandwidth2.png

Coding the height of a line in a map that has zooming capabilities does not work well. I have tried scaling the line height in proportion to the current zoom level which seems to be working well.

20

Jun

2011

My practice presentation for NZCS at the Friday night WAND meeting attracted a full room of people and received rave reviews on Twitter, with 20+ tweets (sorry no screenshots). I also received some great feedback and was stoked to see that Angela and a few other non-WANDees accepted Tony's invitation of attending the talk.

14

Jun

2011

Spent most of the week getting better acquainted with the build process
for both packages and for firmware images. I got an AMP package building
fine within the environment last week but getting it running properly also
needs the supporting configuration files to be installed in the right
place with the correct file permissions. The filesystem layout is a bit
different to normal and (in most cases) is read only so I have to make my
changes at build time. Took me a while to discover that the final script
run before building the image clobbers all my permissions changes - had to
put in a few exceptions, which meant making changes outside of my
packages, which I would prefer not to have to do.

Also spent some time dealing with getting the ntpclient working properly
in my image. The slightly newer version I'm using accepts different
arguments to the version the Ubiquiti config generation binary blob
expects. Also noticed that this clobbers or adds to various configuration
files that are provided by the base packages. Chasing this also made
explicit to me the separation between firmware and configuration as stored
on the device itself, and the different ways that each may be updated.

13

Jun

2011

I spent the week finishing of my exports visualisation assignment and presenting it to the class.

You can take a look here:
http://joeloughton.com/blog/testing/exports/?s=view1