Sunday of my Life

PPP or the Point-to-Point Protocol, is an open-source (I think) protocol for multi-protocol transport on point-to-point serial links. It was designed as an answer to Cisco’s proprietary HDLC protocol, and to address limitations in this protocol, as well as providing a broad, open base protocol that can be extended and updated, to keep pace with emerging protocol technologies. PPP, being an open-source protocol, is available on almost every manufacturer’s platform, unlike HDLC which is only available on Cisco equipment. This makes PPP a more widely spread protocol because, although CIsco is a market leader in internetworking technology, they are far from the only company on the market.

PPP has many features that set it above HDLC as the data-link serial protocol of choice for the growing internet. It is more correctly known as a protocol suite, like TCP, because it contains a number of sub-protocols that provide its greater functionality. This moduler suite design makes PPP almost infinitely extensible, particularly in its unique encapsulation support for different network-layer protocols. PPP also supports two methods of connection authentication in its modular design. Amongst its sub-protocols, the most well-known and notable are LCP (Link Control Protocol), NCP (Network Control Protocol), PAP (Password Authentication Protocol) and CHAP (Challenge Handshake Authentication Protocol). Below is a description of these protocols:

• LCP: LCP, or the Link Control Protocol, is PPP’s signalling protocol. It provides facilities for call negotiation, setup, maintenance, testing and tear-down. LCP frames may contain data on various configuration parameters, including authentication routines to be used, or status messages, or call-termination signals.
• NCP: NCP, or Network Control Protocol, is almost a protocol suite in its own right. It is the open, modular basis on which PPP’s extensibility rests. For every supported network-layer protocol, there is a corresponding NCP that defines methods of transmission, encapsulation and decapsulation. Since each protocl has its own NCP, it means that new NCPs can be written and andded to the protocol without having to rewrite PPP’s whole structure.
• PAP: PAP, or Password Authentication Protocol, is the older of PPP’s two authentication routines. It takes place at call establishment, immedieately after LCP finishes negotiating the link. The reciever challenges the caller for their credentials, and the caller’s password is then transmitted back in a PPP frame, as clear text. This lack of encryption and predictable sequence makes PAP susceptable ot such attacks as playback¹ and man-in-the-middle². This method of authentication is called a two-way handshake, since the process involves one packet exchange from either end.
• CHAP: CHAP, or Challenge Handshake Authentication (or, sometimes, Acknowledge) Protocol, is the newer and more secure of PPP’s two authentication protocols. At the commencement of the authentication phase of connection, and periodically throughout the duration of the call, the reciever sends a challenge frame to the caller. This frame contains a randomly generated string of characters. Using this string and the password both ends calculate a hash, usually using the MD5 algorithm. The caller then sends this value to the reciever, which will trigger one of two events. Either the reciever will send back an acknowledgement and validation frame if the values match, or it will terminate the session if they do not. Since the challenge string is unique and random, the hash generated will be unique and random, making it impossible to guess the password from a number of intercepted hashes since MD5 is a non-reversible hash. The fact that authentication is repeated periodically — this period being controlled by the caller, and negotiated with LCP a tthe commencement of the call — the damage caused by an intercepted and mis-routed call is mitigated, limiting the time an intruder has to transfer damaging data over the link.

PPP’s method of framing data, preparing it for transmission across the serial link, is quite similar to HDLC, making the two protocols in some ways compatible, although HDLC’s use of a proprietary type field prevents true compatibility. PPP, unlike HDLC, also supports seamlessly both synchronous³ and asynchronous⁴ serial transmissions. As with any transmission protocol PPP’s encapsulation follows a set number of fixed-length fields in a set order, allowing each frame to be decapsulated at the recieving end and interpreted clearly. Below is the framing sequence for PPP, sorted by order of transmission:

1. Start Flag: This 1 byte field indicates the beginning of the PPP frame. It always consists of the binary value 01111110.
2. Address: This 1 byte field always contains the standard broadcast address of 11111111. PPP does not assign addresses to hosts because it is designed purely for point-to-point links, where there will only ever be two hosts.
3. Control: This 1 byte field consists of the binary sequence 00000011, a standardised control number which represents the transmission of unsequenced user data, providing a connectionless transmission not unlike the Logical Link Control protocol.
4. Protocol: The 2-byte protocol field indicates which protocol’s frame is encapsulated in the data field of the PPP frame, thus telling PPP which NCP it will have to use. Different values in this field can indicate such protocols as IP, IPX, and AppleTalk.
5. Data: The data field of the PPP frame can vary between 0 and 1500 bytes in length, containing a full, complete frame of the protocol indicated in the protocol field. Since this frame is variable in length, its end is indicated by the End Flag field immediately proceeding it. This consists of the same value as the Start Flag.
6. FCS: The FCS, or Frame Check Sum, is a 2-byte field consisting of a binary hash of the frame contents preceeding it. It is used as an error-detection mechanism. If the frame on the other end does not sum down t othe same vlaue, then an error has entered the frame data and it is dropped.

In summary, PPP is a serial point-to-point link transmission and control protocol suite that supports by synchronous and asynchornous links, multiple network-layer protocol encapsulations, strong, attack-resistant authentication routines and is a non-proprietary, open-source protocol that can be implemented across many varied hardware platforms, allowing inter-manufacturer communication. It is quickly replacing HDLC as the protocol of choice for point-to-point serial WAN links.

1: Playback Attack: A playback attack is an intrusion or subversion method which involves the attacker intercepting the transmission, accertaining which frame contains the encrypted password and storing that, to be ‘played back’ at the target machine at a later date, attempting to imitate a legitimate user.

2: Man-in-the-middle Attack: A Man-in-the-middle Attack involves that attacker, instead of intruding the system thsemvles, intercepting and holding the communication packets between two end-points and modifying them, in an attempt to get the systems to divulge sensitive data to what they believe to be a legitimate destination.

3: Synchronous Transmission: In data communications a synchronous link involves two end-points using a single set clocking rate to transmit their data at. They constantly monitor the connection for clocking points, modifying the clock rate according to these, allowing constant fine-tuning, so both ends stay in synch. The most prevailent example of this is a 56K dialup modem, which transmits data at the clock rate of 56,000 cycles per second. This constant synchronised clocking allows the use of TDM (Time-Division Multiplexing) to allow multiple connections to share the one communications link. TDM works by allowing each connection to transmit for a set number of cycles before it moves to the next. This sequence is repeated over and over, with the reciever being aware of it. Packets are reassembled at the reciving end using this TDM sequence as a guide.

4: Asynchronous Transmission: Unlike a synchronous link, asynchronous communication does not make use of clocking rates. It instead monitors the connection itself, transmitting data as fast as it can. Connection negotiation can place an upper limit on this transmission type if, for example, a recieving host can only recieve data at a lower rate than the transmitter can send it. This method of transmission relies upon set packet preambles and trailers to define where a packet begins and ends, since packets can be of a variable length depending upon the size of the data field. The link protocol may elimiate this need by maknig use of fixed-length frames, splitting up later packets to make them fit. One of the most common asynchronous protocols which also uses this method of delivery is ATM (Asynchoronous Transfer Mode), which uses fixed-length ‘cells’ of 53 bytes.

You heard me, folks. I have officially just completed my CNAP (Cisco Networking Academy Program) Semester 4 Final and compulsary voluntary feedback exams. I scored 88.9% on the final, and with this score (considering the pass is 70%), I am more than happy. Didn’t help — being the paranoid soul that I am — to have a group of people standing behind me laughing as I do the exam. Or the V.35 Serial Cable hitting me in the back of the head. But I got through it regardless of any machinations on their part, real or imaginary. Remember folks: Just because you think they’re out to get you is no reason to assume they aren’t.

I am writing code. The code I write, I comment, especially when I’m writing it late at night, since I have a terrible memory lately. But you can tell the comments I write late at night compared to, say, the comments I write during the day, when I’m half-way lucid. It is a matter of:

function auth_quit()//an authorised, normal quit.

compared to:

break;//thus spaketh $_DIETY: "When thou dost find a break, then break the case thou shalt".

I think you’ll agree, my late-night comments can be infinitely more interesting.

I don’t really have much to say on the issue of Sony’s Digital Right’s Management hoopla that hasn’t already been said, so I will simply link to two articles:

http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html

http://www.theregister.co.uk/2005/11/01/sony_rootkit_drm/

And done…

LAMP (acr., n.) Linux, Apache, MySQL, PHP

A complete Webserver running Apache HTTPD server, with PHP Hypertext Preprocessor and MySQL Database server, running on a Linux Serverbase.

It is a wonderful thing, and the backbone of the internet. Without webservers the Internet as we know it could not exist. These are the remote computers that store our websites and serve them out to whomever may ask for them. With the advent of the Open Source Revolution a webserver became a thing that anyone with the know-how and desire could setup his-or-herself without much in the way of monetary outlay. I, being the networking geek I am, have recently done this myself, as have many other people like me. This post isn’t going to be a tutorial on compiling your own webserver, although one of them may be forthcoming down the track, if I feel like it. I, instead, ran into some problems whilst making my server, and in all my hours of Googling I didn’t find anyone else who’d had this problem. Thus, this post:

This isn’t so much about Apache HTTPD, which compiled the first time perfectly for me. It’s more about MySQL and PHP, which didn’t. I couldn’t even get them to the ‘make’ stage, for it turned out that I had a problem with some packages installed on my Fedora Core 4 server. Problem being: they weren’t installed. Shock horror! Agog and aghast! Yada, yada… anyway. In order to compile properly both PHP version 5 and MySQL 4.1 require the GNU gcc-c++ compiler modules. Installing these is fairly simple, considering that FC4 comes with yum preinstalled and configured for you. Simply do this:

<root@myserver># yum install gcc-c++

Simple, no?

No.

See, gcc-c++ has a package dependancy that yum will not, no matter how much you try, be able to resolve. It requires libstdc++-4.0.1-4.fc4. That’s the long and the short of it. yum cannot install this. Why, may you ask? If you do:

<root@myserver># sudo yum list libstdc++*

There it is in that lovely list. Yet yum claims to not be able to install it. If, then, you do:

<root@myserver># rpm -qa | grep libstdc++

You will find in that list, libstdc++ already installed by default. So what’s the problem here? Well… gcc-c++ requires 4.0.1-4, and you have 4.0.1-8. It’s too recent. yum cannot count this as a valid dependancy resolving package, for the revision number is incorrect. Enter PBone’s RPM Finder. Searching their entire FTP archive for (and I quote) “libstdc*4.0.1-4.fc4″ will, after 4 or 5 pages of RPMs, finally turn up the correct, neeed version of libstdc++ for the i386 platform. Huzzah! In order to install this, since it’s older than your currently installed version, requires the use of an extra switch in the rpm command, in order to tell RPM that, yes, you do in fact wish to downgrade the package:

<root@myserver># rpm -Uvh --oldpackage <url of package>

Okay… once RPM retrieves and installs that package, go back and do the yum install command from earlier, and all should be fine ‘n’ dandy this time around. Happy compiling!

Okay, time for my semi-annual Geekily Useless post, as my dog lies beside me at this 11:55 PM in his basket, snoring, coughing in his sleep and yipping as he dreams.

Yesterday I yanked my computer to pieces. This was fun and served to fill an hour or so when I otherwise could have been doing homework. Bad Adrian. Bad. Sue me, I was taking a break. I’ve been working almost non-stop for the past three-and-a-bit weeks. One week to go, just one. Then I’m free for a month. Time to start studying ahead on Semester 3 CCNA.

Anyway, the torn-apart computer. Having my baby in pieces before me, I decided to finally replace the video card and put it all in the lovely new LanBoy case kindly given to me on the occassion of my 21st birthday by Drewboy. This is a very nice case all up, I must say. Light, compact, stylish; and with a handy-dandy carrying strap for taking it around to all those places one may take a computer (Lan Parties, friends’ houses, the gym, the dentist, you name it). Upon starting it up (after the usual, and expected, re-assembly woes) I noticed something. My already noisy computer has managed to get even louder; a fact much complained about by my father, who can usually find something to complain about in almost every situation, even though he had a point in this case.

Tonight I replaced one of the fans in it, which turns out to have had some verily broken bearings. Eep to that, I say. Everything is much quieter now. Where it used to be my computer would boot-up with a rising-tone whine, now it barely purrs. Aaah… the sweet sound of silence. How I’ve missed you. Finally, I have a computer that I know — once I finally move out of here — I can safely leave on all night and not be kept awake by it. Not that computer sounds have ever managed to keep me awake; it never hurts to be sure.

I can successfully install, configure and otherwise Make Good an Apache HTTPD Webserver on Linux. Who’da thunk?

The Grand List Of Console Role Playing Game Clichés

This list is long, but good. So many of these hold true in so many different games, almost makes you feel like they’re all connected in some quasi-mystical way, like there’s this one clichéd world out there that is placed under threat of imminent take-over/destruction time after time after time. Almost makes you feel sorry for the little buggers. Memorable list items include:

20. Just Nod Your Head And Smile
And no matter how big that big-ass sword is, you won’t stand out in a crowd. Nobody ever crosses the street to avoid you or seems to be especially shocked or alarmed when a heavily armed gang bursts into their house during dinner, rummages through their posessions, and demands to know if they’ve seen a black-caped man. People can get used to anything, apparently.

13. The Higher The Hair, The Closer To God (Cloud Rule)
The more outrageous his hairstyle, the more important a male character is to the story.

86. Wait! That Was A Load-Bearing Boss!
Defeating a dungeon’s boss creature will frequently cause the dungeon to collapse, which is nonsensical but does make for thrilling escape scenes.

and

90. Guy in the Street Rule
No matter how fast you travel, rumors of world events always travel faster. When you get to anywhere, the people on the street are already talking about where you’ve been. The stories of your past experiences will spread even if no witnesses were around to see them.
91. Wherever You Go, There They Are
Wherever the characters go, the villains can always find them. Chances are they’re asking the guy in the street (see above). But don’t worry — despite being able to find the characters with ease anytime they want to, the bad guys never get rid of them by simply blowing up the tent or hotel they’re spending the night in. (Just think of it: the screen dims, the peaceful going-to-sleep-now music plays, then BOOM! Game Over!)

Enjoy!

Dorothea has recently been putting up on Caveat Lector a series of posts on fighting referer spam and bandwith hogs that endlessly trawl your site with bots (ignoring the stringent rules you, or she in this case, laid down in the robots.txt file, of course). Find linkyness below:

Killing Referer Spam

Latest Bad Referer

Brandimensions

Raft Of New Blockees

More To Ban

Hell, if this interests you, then I’d suggest subscribing to her Spam Specific RSS Feed with your news aggregator. There will be much goodness to come in this section, I can feel it. It’s already got some invaluable stuff in there that I am using to protect Sunday from these bastard sons of a bastard’s barstard’s barstard. (Guessed I don’t like spammers of any kind yet?)

Sign up, read. Play, fiddle, learn (as one of my friends says). You’ll be glad you did, trust me.

At Drewboy’s place today, tutoring in the noble art of subnetting. I am a geek, this is well established fact by now, so in the best traditional or nerds and geeks everywhere, I’m going to explain something to y’all whether you want to know it or not.

And God said unto Nigel and Tania ‘Go forth and multiply by binary bit powers’

The very basis of subnetting, as in almost anything to do with IP addressing, if Binary. Base 2 numbering at its finest. Converting between Base 10 (decimal, or everyday numbers as most know them) is surprisingly easy. Any Base 10 whole number can be converted to Binary using a simple sequence of divisions by 2.

Example
Since we’re working in whole numbers your divisions will either have a remainder of 1 or 0, this is what you use to define your Binary bit string.
210 in Binary
210 / 2 = 105 rem. 1
105 / 2 = 52 rem. 1
52 / 2 = 26 rem. 0
26 / 2 = 13 rem. 1
13 / 2 = 6 rem. 0
6 / 2 = 3 rem. 0
3 / 2 = 1 rem. 1
1 / 2 = 0 rem. 0

Can you see it? You divide by 2 as many times as you can, taking only whole divisions into account, until you divide by 2 and turn up a division answer of 0. There you stop. The remainders are your Binary number. So 210 in Binary is 11010010. Let’s try another one, a larger number this time

2365 in Binary
2365 / 2 = 1182 rem. 1
1182 / 2 = 591 rem. 0
591 / 2 = 295 rem. 1
295 / 2 = 147 rem. 1
147 / 2 = 73 rem. 1
73 / 2 = 46 rem. 1
46 / 2 = 23 rem. 0
23 / 2 = 11 rem. 1
11 / 2 = 5 rem. 1
5 / 2 = 2 rem. 1
2 / 2 = 1 rem. 0
1 / 2 = 0 rem. 1

so 2365 in Binary is 101111011101

Marvelous, eh?

Onwards into subnetting…

‘Why would you want to subnet?’, people may ask, ‘if a Class A private IP address provides for over 65 million useable IP addresses, why woud you bother?’. Well, true, it does, but the reasons for subnetting go far beyond this. Subnetting detracts from the number of available hosts, but allows you to have more than one network that acts totally independant of the others. It allows you to segment your network without any hardware, isolating sensitive equipment on its own network so that no one without proper authorisation can go through the routers to get to it.

OK then, so how do we go about subnetting? Well, first some basic principals of IP addresses need to be understood. IP addresses consist of four groups of decimal numbers seperated by dots. None of the numbers is below 0 or above 255. In Binary they consist of eight Binary numbers each. For this reason they are called octets. There are three classes of IP address, Class A, Class B and Class C (there are also Class D and E, but neither of these is subnettable). The first octet is what tells us what class we are in. If it is between 1 and 127 we’re in Class A, between 128 and 191 and we’re in Class B and between 192 and 223 we’re in Class C. Each of these classes has a default subnet mask, called the subnetless mask. For Class A it’s 255.0.0.0, for Class B it’s 255.255.0.0, and for Class C it’s 255.255.255.0. These masks form the basis of our subnetted masks. Anything set to 255 is totally given over to networks, anything set to 0 is available for us to subnet.

When we’re subnetting we borrow a certain number of bits from the host portion of the subnet mask and use them as part of the network portion. If we were working with the Class C IP address 192.168.0.0 we could borrow 4 bits from the hosts and create 16 extra networks. However the basis rule of subnetting, 2ⁿ - 2 ensures that only 14 of these new networks is useable (2⁴ - 2 = 14). So we’ve borrowed four bits, and our default subnet mask in Binary which was 11111111.1111111.1111111.00000000 has changed to reflect this. It now reads 11111111.11111111.11111111.11110000

So now we have 4 ones where once we had 4 zeros, what does this mean to us? To us it means that we split our allowable bits where ones meet zeros. That last octet is, to us, 1111|0000.

The next step is to determine your new subnet mask. You’ve just added another four bits to it, so obviously you can’t have the same one as the default. In a Binary IP Octet there are 8 place values according to 2⁰, 2¹, 2² and so on up to 7. 0 to 7, eight bits. In order from left to right (Binary works from right to left, but we read from left to right, so we’ll stick with that for now) these place values then become 128, 64, 32, 16, 8, 4, 2 and 1. So if we have ones under 128, 64, 32 and 16 then we have to add all of those up and detemrine the decimal number from them. So 128 + 64 + 32 + 16 = 240. So our new Subnet Mask is 255.255.255.240

Armed with this subnet mask we can then move on and work out some subnet addresses. All networks start at 0 when you’re working with the subnetless masks, and such is the case here. The first network starts at 0, but then where does our next network start? This,like the mask, is simple to work out. 0 through 255, the lower and upper limits of the IP Octet range, give us our answer. Between them is 256 numbers. If we subtract our new subnet mask, 240, from 256 we get the incrimental value of our subnets, 16. So 0 is our first network, 16 our next, 32 the third, 48 the fourth and so on until we reach 255. The 0, 16 and so on is our Network Number, the IP that defines the network we’re on, and so cannot be used to support a host. The same is true for the number before them, 15, 31, 47 and so on. These are the broadcast addresses for each of the networks. Messages sent to this IP are picked up by all hosts on the network. Since these two addresses are unusable this is where we get the -2 part of the Subnet rule 2ⁿ - 2. This rule leaves us with 14 useable hosts on each subnetwork.

Say our requirements call for the host range for the 2^nd subnetwork and the 10th host on the 3^rd, how would we get these? Easy too, the same way we got everything else. The host range is simply the first and last useable hosts on the specified network. So the second subnetwork, as previously stated, starts at 16, but we cannot use this, so our first useable host is 192.168.0.17. The last useable host is just as simple: if the next network is 32, then the broadcast of this one is 31 so the last useable host must be 30, or 192.168.0.30. So our host range for the second subnetwork is 192.168.0.17 - 30. The 10^th host of the third subnetwork? If 32 is the third subnetwork address, then 33 must be the first useable host, so 10 on top fo that is 192.168.0.43, the 10^th useable host.

It’s all simple once you know how. I doubt I’ve made the best explanation of it here, but I hope you can take something from this and learn it. Practice, practice, practice… that’s the key. Never stop practicing it and you’ll always have it there.