Seems that some firewalls with Content Filters are brain-dead. I found another firewall that provides the same anti-compression “service” for its customers. [here]
Thanks to Alexy Titov for the link.
Month: March 2005
Symantec Firewall — Problems with Accept-Encoding Headers
Here is a little tidbit that we discovered while trying to debug an issue at work. One of my colleagues found that the Symantec/Norton Personal Firewall/Internet Security mangles the “Accept-Encoding” header sent out by any application — browser, streaming media, etc.
More can be found here.
This is a serious problem, and has a negative effect on Web performance in general, as one of the key methods for improving bandwidth consumption and user performance is Server-Side Compression of as much content as possible.
What the client wants to send: Accept-Encoding: gzip,deflate\r\n What is sent: ---------------: ---- -------\r\n
What is the problem? Is this because Symantec can’t parse compressed content on the fly?
Bots from hell, and a plea for a free-to-use public “DROP” Port
There is some idiot out there running a bot/attack protocol using a referring URL that always ends with ‘.eu.tt’.
Turns out that there was more than one IP involved. IPTABLES took care of them.
/sbin/iptables -A INPUT -s 200.123.9.119 -j DROP /sbin/iptables -A INPUT -s 195.54.87.222 -j DROP /sbin/iptables -A INPUT -s 194.47.95.115 -j DROP /sbin/iptables -A INPUT -s 198.234.202.130 -j DROP /sbin/iptables -A INPUT -s 198.234.202.131 -j DROP
Please use DROP. This stalls the buggers, as they get stuck in an endless trap of trying to open a TCP connection with your server.
Does anyone know of a server that has an open DROP rule for Port 80? This would be a useful online tool for folks who can re-direct annoying traffic through server configs, but who can’t control the firewall or IPTABLES.
Simple set-up. Get a domain, register it. Get a DNS record to say that www.foobar.com is the machine’s IP Address. Then use IPTABLES to DROP all Port 80 inbound traffic. Publish the URL. Watch the fun!
What’s the fun? Well, when you publish the address and explain that anyone can use targetted re-directions to send unwanted traffic to this place of lost TCP connections, and annoying bots get stuck.
It’s a simple IPTABLES rule. For my machine, it would be:
/sbin/iptables -A INPUT -p tcp -i eth0 -s 0/0 --dport 80 -j DROP
Which, in IPTABLES speak, means “Any [-s 0/0] inbound traffic on network interface eth0 [-i eth0], headed for TCP port 80 [–dport 80], should be quietly dropped [-j DROP]“.
Please do not try this on a production server! All of your HTTP traffic will disappear! However, you could re-write it slightly, and still preserve port 80 for standard HTTP, like, statistics on the distinct IPs stuck in your flypaper.
Change ‘http://www.foobar.com/’ to ‘http://www.foobar.com:9080/’ and adjust the IPTABLES rule accordingly.
/sbin/iptables -A INPUT -p tcp -i eth0 -s 0/0 --dport 9080 -j DROP
Ok, my rant is done. Have fun, and use these tools wisely.
Kahvi: Source for free groovy Techno
When I need techno, I head on over to the Kahvi Collective. They have a really great collection (ever-growing too) of home-brew techno to help you concentrate.
I find this music best for sessions where I really have to concentrate. A backbeat to optimal thought, if you would.
Cold, Wind, and SNOW
Made it home before the weather got hideous. And it is hideous out there.
Looks like I might work from home tomorrow.
The Twisted Anarchy of ARIN Data
I made the attempt. No one can fault me for that. However, I was defeated by the twisted, anarchic madness that is the ARIN database.
A step back: I was considering refining the GrabIP database to more accurately reflect the true countries where IPs are used.
APNIC, LACNIC and AFRINIC are all sanely managed. Countries and IP blocks are accurately mapped. RIPE gets a little messier, but there is no real problem with it. Just have to watch out for the blocks tagged as EU instead of their host countries.
ARIN is complete madness. As the only IP registrar on the block for a long time, there are a number of archaic nooks and crannies to watch for. Like this gem: 65.165.84.11.
OrgName: Sprint OrgID: SPRN Address: 12502 Sunrise Valley Drive City: Reston StateProv: VA PostalCode: 20196 Country: US NetRange: 65.160.0.0 - 65.174.255.255 CIDR: 65.160.0.0/13, 65.168.0.0/14, 65.172.0.0/15, 65.174.0.0/16
Nothing too earth-shattering here…but wait, there’s more information!
OrgName: COMMUNICATION ENTERPRISES LTD OrgID: CEL-30 Address: KM # BLVD DEL NORTE City: SAN PEDRO SULA StateProv: SAN PEDRO SULA PostalCode: 00000 Country: HN NetRange: 65.165.80.0 - 65.165.87.255 CIDR: 65.165.80.0/21
A whole chunk in the middle is assigned to a company in Honduras? Oh great, so now I have to write exceptions to weed out the child CIDR blocks that are in completely different countries.
Needless to say, this attempt to refine the data lost its appeal quickly.
Just using the high-level data in the GrabIP database, it is clear that there is still a great deal of overlap in the ARIN data.
code country NUMBLOCK US UNITED STATES 30935 CA CANADA 4903 PR PUERTO RICO 29 GB UNITED KINGDOM 24 DE GERMANY 22 JM JAMAICA 18 BM BERMUDA 17 FR FRANCE 13 JP JAPAN 12 BB BARBADOS 9 CH SWITZERLAND 6 HK HONG KONG 5 NL NETHERLANDS 5 SE SWEDEN 4 IT ITALY 4 NO NORWAY 4 BS BAHAMAS 4 BE BELGIUM 4 VI VIRGIN ISLANDS, U.S. 3 ES SPAIN 3 AG ANTIGUA AND BARBUDA 3 AU AUSTRALIA 3 CZ CZECH REPUBLIC 2 SG SINGAPORE 2 DO DOMINICAN REPUBLIC 2 FI FINLAND 2 LU LUXEMBOURG 2 IE IRELAND 2 MX MEXICO 1 AT AUSTRIA 1 LC SAINT LUCIA 1 TR TURKEY 1 PL POLAND 1 LB LEBANON 1 GD GRENADA 1 HU HUNGARY 1 IL ISRAEL 1
However, when I originally started this project 2 years ago, some of the blocks for Iceland were listed as ARIN. Now, all of Iceland’s blocks are in the RIPE database.
Hopefully in the next year, the registries can get the counrty assignment mess sorted out.
A sidenote: Right now, ARIN is still the biggest fish in the sea.
arin 36051 ripencc 14588 apnic 10445 lacnic 1457 afrinic 437
Maybe I should post the Weekly Breakdown of IP Blocks by registry and country.
Another psyche damaging day
We went through the detritus of my life downstairs today.
Well, as dramatic as that may sound, this involved going through nearly a dozen boxes of books and magazines that are down there. The vast majority of the contents can be directly associated to me, and not Samantha.
Books from University 15 years ago. Papers I had written. Books bought, then never read. Technical books, once relevant, now dated.
400 pounds of books to be sold at 10 cents a pop (6 for $1) when we have a garage sale. If you need novels, books on Canadian and Medieval History, novels, Jungian Psychology, novels, and metaphysical reading material, we will keep you posted on the date.
It’s just hard to go through this stuff without connecting each of the items to a time and a place. Most were impulse buys, but connected to some point in my life where they were relevant and even important to me.
Now, like so much in my life, they have to fade into the background. I have moved on. I had forgotten the person who bought these books until today, and it is like having the dust kicked up in a house: disturbing to the senses.
I will be happy to see them go.
Tapping the Maples
We tapped the three Sugar Maples we have in our front yard this afternoon, and have already extracted about 2 gallons of sap from the trees. Now, it takes about 40 gallons of sap to make 1 gallon of syrup, so don’t expect to be getting truckloads of the stuff anytime soon.
On the biggest tree, I hit the carotid artery; we have extracted nearly 2 gallons from that one tap. It should be even faster once the temperature starts to rise more.
‘Experiential Talenteering’
Want to know more? Look here.
It is interesting to read this author’s posts on a regular basis. This blog should be a mandatory read for all hiring managers and HR personnel. He has nailed the problem with companies: it’s not the quality of the candidates, it’s the quality of the hiring process.
The Office
I just watched the first episode of The Office. It was funny…and extremely painful to watch. Having been to the UK, there are offices that work that way.
It was so…realistic that you had to cringe and recoil at the complete atrocity of this show.
Brilliant. Spot on Brilliant.