Previous working directory in Windows Command Prompt

Using bash in *nix has a handy feature: If you are in one directory and you switch to another one, you can use  cd -  to go back to the previous directory. My everyday computer is Windows 11 and I was longing to have that ability. I went back to an old tool called DOSKEY that was originally released in 1991 with MS-DOS 5. It's still around 33 years later (as of this writing).

One of doskey’s features is macros. They are roughly equivalent to aliases in *nix. Here's how I made something close to   cd -  work:

1. Edit your registry to set a program to auto-run whenver you open a cmd.exe shell. Do this by adding a new String value to HKLM\SOFTWARE\Microsoft\Command Processor called Autorun. Put your program in as the Value data. In my example, I use "C:\Batch\cmd.cmd"
   
   
   
   
2. I have a line in that file:
   doskey /macrofile=c:\batch\doskey.macros
3. In the doskey.macros file, I have the following contents:
   cd = set OLDPWD=%CD% & cd $*
cd- = set OLDPWD=%CD% & cd %OLDPWD%

It's not exactly equivalent to  cd - , but pretty close... just leave out the space between cd and -. Note that if you change directories without using cd and a space, for example by using the chdir command or by using  cd..  (with no space), it will break the   cd-  hack.

Which port for DHCP?

For a long time, I never remembered which UDP port was for the DHCP server and which was for the client. I finally came up with a trick... you have to have a server in place before you can have any clients, right? Therefore, the first port, 67, is the port the server listens on. The second port, 68, is the source port the client uses.

TCP, UDP, and the Crossover

I often see only-tcp or only-udp allowed in firewalls for certain protocols that work best with both. We have to continue to keep our eyes on the industry to see where things are going so we can be most efficient. Below are some examples, listed with the primary/traditional protocol, then the reason why the other one should also be allowed. In many cases, things will work without allowing the "secondary" protocol, but their efficiency may be hampered.

• https (tcp/443) - Since its inception, https has been a tcp protocol. However, in recent years, and especially with the advent of HTTP/3, allowing only tcp is not good enough. Even before HTTP/3, DTLS has made a tcp-only stance not good enough in regards to https.
• dns (udp/53) - The intro to RFC 7766 says it perfectly: Most DNS transactions take place over UDP. TCP is always used for full zone transfers (using AXFR) and is often used for messages whose sizes exceed the DNS protocol's original 512-byte limit. The growing deployment of DNS Security (DNSSEC) and IPv6 has increased response sizes and therefore the use of TCP. I have seen situations where AWS responds with data longer than 512 bytes, and it's not uncommon to find TXT records (e.g., for SPF) to exceed that length as well.
• rdp (tcp/3389) - Microsoft's Remote Desktop Protocol works better if both tcp and udp are allowed. It has supported udp since version 8.0 and it creates a smoother experience.
• ldap (tcp/389) - Microsoft is now starting to use ldap over udp in certain scenarios.

There are surely a lot more, and the list will surely grow, but I just thought I'd comment on a few...

The Case of the Roaming Windows Domain-Joined Laptop

The title is inspired by Mark Russinovich's great series “The Case of the Unexplained.” He is a technical wizard, and I am definitely not even in the same ballpark. But, inspiration is inspiration, so here we go.

I have a work laptop that is joined to our Active Directory domain. When I would bring it home it would take about 90 seconds to unlock. I finally took a packet capture via tcpdump on my home router running OpenWRT in order to see what the heck it was doing for that long.

I knew it would be trying to query DNS and I also knew that it would not find what it was looking for, since it queries, via SRV records, various services in the _mscdc zone of your domain. For example: _ldap._tcp.dc._mscdc.mydomain.me. Sure enough, those responses quickly answered with a “no such name.” So that's not causing the slowdown (well, very slightly, but nothing really worth mentioning).

Because DNS wasn't working, it started try alternate methods of locating a domain controller. It started sending NetBIOS Name Service broadcasts on UDP port 137. It also started sending multicast queries to 224.0.0.252 on UDP port 5355, which is Link-Local Multicast Name Resolution. I wondered if I disabled both of those methods if it would increase my unlock speed. It did! If I'm on the LAN (or VPN'ed in), DNS works just fine, so I don't need these fallback methods. Perhaps there's more I could have done, but I was satisfied with my results. The method behind those results I explain in the next paragraph...

Disabling NetBIOS over TCP/IP Manually and via DHCP

To disable NetBIOS over TCP/IP manually, go into the TCP/IP settings in Windows 7/8/10. Go to Advanced, WINS, Disable NetBIOS over TCP/IP.

For DHCP, you can search the Internet for how to disable this via various DHCP server software. Since I run OpenWRT at home, I'll focus on that. DHCP option 43 is the “vendor specific” attribute. As for the other parts of it, I won't go into that at this point. OpenWRT runs dnsmasq for IPv4 DHCP. The syntax for setting NetBIOS via option 43 for dnsmasq can be found here. To adapt that to OpenWRT, just add the following line to /etc/config/dhcp under the config dhcp 'lan' context:

config dhcp 'lan'
  list 'dhcp_option' '43.01:04:00:00:00:02'

Disabling Link-Local Multicast Name Resolution

There is no DHCP option for disabling Link-Local Multicast Name Resolution, so it has to be done on the device itself via registry entry at:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient

Create a DWORD value called EnableMulticast with a value of 0.

Hopefully your domain computer “logs in” and unlocks faster via cached credentials, even when you're out of communication with a domain controller.

The Verbization of Protocols, or "PuTTY" is Not a Verb

Warning, this entry is filed under "rant."

PuTTY is a wonderful terminal emulator. I use the Windows version all the time for launching ssh sessions. I also use it for serial console connectivity, telnet (if I have to), and testing raw remote tcp sockets.

Sometimes I hear people, particularly Windows admins, refer to "puttying in" to a system running ssh services. Sorry, no, "putty" is not a verb. Let's look at the wonderfully flexible English language a bit...

We convert nouns to verbs all the time. We even convert companies or products into verbs sometimes. For example, when I lived in India, people never referred to "making copies," they always referred to "Xeroxing." But in IT, we convert protocols, not company or product names, into verbs. Here are some examples:

• Telnet: "I telnet'ed into that router but couldn't find anything wrong with the configuration."
• rdp: "Just rdp [or remote] to that server and restart the Splunk agent."
• ftp: "You just have to ftp into that server to see that the file is over 500 megs."
• ssh: "I ssh'd [pronounced ess-ess-ayched] into that server to see what was spiking the CPU."
  Not this: "I puttyed (puttied?) into that server to demonstrate that I don't know the difference between a program that uses a protocol and a protocol itself."

Sometimes just a "verbicized" noun isn't good enough... it doesn't stand alone well as a verb. Some examples:

• smtp:
• Bad: "SMTP into the server to see if it's an open relay."
• Good: "Open an SMTP session to that mail server and see if it's an open relay."
• snmp:
• Bad: "SNMP to that host to see its uptime." (we could get into a debate over connection-oriented [tcp] versus connectionless [udp] on this one)
• Good: "Run an SNMP query against that host to see its uptime."
• cifs:
• Bad: "cifs into that Windows server from Linux using smbclient."
• Good: "Initiate a cifs transfer to a Windows share from Linux via smbclient."
• Citrix:
• Bad: "Citrix into that server."
• Good: "Establish a Citrix/ICA/XenApp session to see if the firewall rules are correct."
• etc., etc.

So let's just remember: never turn a piece of software into a verb. Protocols, fine, but unless a particular program is the only thing that can use a protocol (which is never true for very long), let's make the protocol the verb. That means there is no "puttying into"--only "ssh'ing into."

/End rant.

windump and pcap for Windows and interface name enumeration

Tonight I took the plunge: I moved from winpcap and windump from Riverbed (formerly from CACE and before that from Politecnico di Torino) to npcap. There are lots of great reasons discussed on the npcap page, not to mention that winpcap hasn't had an update since 2013.

Even though I installed it with winpcap compatibility, I still got an error when running windump. That was fixed by installing WinDump for Npcap (see the Releases section for pre-compiled binaries).

It has always bothered me that enumerating interfaces using windump -D was more luck and trial-and-error than actually being able to see which interface you want to dump. So I wrote a little batch file called listif.cmd that will give me a nice list so I can run windump -i # to dump my packets. Besides windump itself, it doesn't require anything that doesn't come with Windows.

@echo off

setlocal ENABLEDELAYEDEXPANSION

set LIST=%temp%\getmac-list.txt

echo Getting available adapter list...
getmac /fo csv /v > %LIST%

echo Resolving available adapter list...
for /f "tokens=1,3 delims=.{}" %%a in ('windump -D') do (
 for /f "tokens=1,2 delims=," %%m in ('findstr "%%b" %LIST% 2^>nul') do (
  set CONN_NAME=%%m
  set ADAPTER_NAME=%%n
  echo  %%a. !CONN_NAME:"=! (!ADAPTER_NAME:"=!^)
 )
)

First Hop Redundancy Protocol ARP Problem

Let me start by saying that this article is Cisco-specific, though it applies to IOS, IOS-XE, and NX-OS. I’ve not used IOS-XR, so I don’t know about that one.

When using an FHRP, like HSRP or VRRP, you can’t “force” a router to cause another device to update its ARP table simply by pinging it, as you can with an actual interface IP address. This could create a situation where you want to convert a single router into two redundant routers, but you don’t have access to clear the ARP table on the other devices in the network.

Sometimes it’s not even necessary to worry about MAC changes. For example, imagine I have an ASA with an address of 10.91.50.1 pointing to 10.91.50.254 for its next-hop router. I have one router with interface Gi0/0 configured as 10.91.50.254 with a MAC address of f40f.1bbf.01b0. Let’s say I change the interface address to 10.91.50.252 and make 10.91.50.254 the VRRP address, which yields a MAC address of 0000.5e00.015b. The ASA will continue to think that 10.91.50.254 has a MAC address of f40f.1bbf.01b0, that is until its ARP cache times that entry out. And this is perfectly okay! The router will continue forwarding those packets on. When the ARP cache times out and the ASA does an ARP request for 10.91.50.254, it will learn the new VRRP MAC address of 0000.5e00.015b and all will be well.

But what if you want to test failover before you have a chance to let the ASA time-out its ARP table? Or what if you don’t have access to the ASA to see what it has in its ARP table (is it pointed to the burned-in MAC or the VRRP MAC)?

In that case, maybe we can “force” an update on the ASA (or whatever else) without having access to it. Let’s try (from the router):

router# ping 10.91.50.1 source 10.91.50.254
% Invalid source address- IP address not on any of our up interfaces

Unfortunately, it doesn’t let us. However, if you do an extended ping, it does let you:

router# ping

Protocol [ip]:

Target IP address: 10.91.50.1

Repeat count [5]:

Datagram size [100]:

Timeout in seconds [2]:

Extended commands [n]: y

Ingress ping [n]:

Source address or interface: 10.91.50.254

Type of service [0]:

Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0x0000ABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:

Sweep range of sizes [n]:

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.91.50.1, timeout is 2 seconds:

Packet sent with a source address of 10.91.50.254

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

Boom, ARP table updated on remote device. I would say that the fact you can’t ping it while specifying an FHRP source interface from the command-line but you can ping specifying an FHRP source from extended ping is an oversight on behalf of the Cisco engineers. Oh well, it is what it is.

By the way, this works on IOS for both HSRP and VRRP addresses. On my Nexus 7010, version 6.2(16), you can even specify the source IP address from the command-line, instead of having to go through the extended ping interaction. For example: ping 10.200.5.218 source 10.91.50.254.

Workaround for “Windows AD domain is the same as my company’s primary DNS domain name,” Part 2

Previously I wrote about a Workaround for “Windows AD domain is the same as my company’s primary DNS domain name.” It involved installing a tiny web server on each domain controller. Today I'm going to write about an alternative way...

Let’s say my organization is “sojourners.me” and I use that for my internal Active Directory domain name (yes, not recommended) as well as the public face of my organization. It’s bad because people inside the network don’t resolve “sojourners.me” to the public webserver--they resolve it to the internal domain controllers (which is required for DFS to function properly).

Here’s a workaround... proxy autoconfiguration magic.

function FindProxyForURL(url, host) {
  if (shExpMatch(host, "sojourners.me"))
    return "PROXY proxy.sojourners.me:3128; DIRECT";
  else
    return "DIRECT";
}

If you’re interested in more info on FindProxyForURL, there are good references here and here.

You may say, “We don’t use a proxy server at my company. Our users don’t have proxy settings in their browsers.” For Windows AD-joined machines, a proxy autoconfiguration script can be easily rolled out via Group Policy Object. You can use your favorite search engine to search for “proxy auto configuration script gpo” or words to that effect. In the past, doing this on Firefox was more of a pain, but in the last few years they made the default proxy option to use the system proxy settings. As an alternative to GPO, you can play with DHCP and/or WPAD settings or get creative.

What should that auto configuration script point at? Using Squid, Apache proxy module, NetsScaler (like we have), or another proxy server of your choice, you can easily run a proxy service that won’t have to do much. In fact, with the script above, the only proxy requests it will have to handle are the ones to send it to the public web server, which should then send a HTTP 301 or 302  redirect to “www.sojourners.me.”

Keep Six months worth of data

I often have things that back themselves up often, or syslogs that roll over daily. Sometimes I want to keep six months worth of data. Here are two scripts to accomplish that.. one for Windows and one for bash:

In bash, I define my glob (wildcard list of files) that I want to only save 180 days worth of stuff. In this case, the FortiAuthenticator backup files, which the device pushes to the backup server via sftp every day. You could customize it for anything though, just by changing the “glob” environment variable.

#!/bin/bash

files_to_save=180
glob=FortiAuthenticator*

num_of_files=`ls -1 $glob | wc -l`

if [ $num_of_files -le $files_to_save ]; then
 exit
else
 count=$(($num_of_files-$files_to_save))
 for i in `ls -1t $glob | tail -$count`; do
  rm -f $i
 done
fi

It's a little trickier in Windows, because you don't have the tail command that UNIX derivatives supply, so you have to be creative with the best command available for batch files: the for command. I usually cheat and use the GNU UNIX tools (like head, tail, grep, awk, sed, etc), but I can’t count on having those on somebody else’s computer. Someday I’ll sit down and learn PowerShell, but until then, I have to lean on my batch-file crutch...

@echo off

set files_to_save=180
for /f "tokens=1,2 delims=:" %%a in ('dir/a-d/b/o-d ^| findstr /n ".*"') do if %%a GTR %files_to_save% del "%%b"
 

In a DNS Bind

Recently a friend, who also works in IT, asked me, “What DNS server do you guys run?” I had to think for a second, because I wondered where to begin. It’s not a quick, easy answer.

Note that I use the term “domain” and “zone” more-or-less interchangeably in this post.

Internal

We run Windows Server 2012r2 DNS on our domain controllers, as many organizations with Active Directory infrastructure do: DNS is critical to its operation. We also make extensive use of dynamic DNS with DHCP integration. We don’t use external caching servers or anything like that for our internal network. Every workstation and IoT device is pointed at two of our domain controllers. You can get away with that when you work at a company with less than 5,000 devices. We did a Cisco Umbrella (formerly OpenDNS) pilot recently, but besides their on-premises server that augments the DNS a bit, it’s more-or-less Microsoft AD DNS as the star player.

“Semi-Private”

We have business partners that have trust relationships with our Active Directory. However, we don’t give them direct access to our internal Active Directory servers. They configure their DNS to perform “Conditional Forwarders” to us. What they actually hit are two Unbound DNS servers running on Windows Server 2012r2. Unbound is very flexible caching name server software. We use it because we want them to see “parts” of our internal network, but also “parts”of our public DNS... basically we use Unbound to override parts of our public space with private resolution, then whatever we don’t override gets sent on to our public DNS servers. We also do extensive NAT’ing, so we need to override the internal IP addresses as well.

Public

We used to use the free GoDaddy DNS service that came with domain ownership purchased through them. However, after the DDOS attacks on Dyn on October 16, 2016, we decided that we should diversify DNS providers. In addition, we had just purchased a new /24 IPv4 range as well as wanting to take control of the reverse lookups for the two /27 subnets we lease from one of our ISPs. We upgraded to GoDaddy’s Premium DNS and employed DNS Made Easy as our second provider. While they are providing secondary services for our main three zones, they are providing primary services for the PTR records for our two /27 subnets, our /24, as well as our IPv6 subnet’s ip6.arpa zone.

Notify Me!

We quickly discovered that there were some problems with this arrangement... namely in the way that our providers handle NOTIFY messages. In case you’re not aware, NOTIFY messages are an important component of keeping DNS servers in sync. If I change a record on my primary DNS server and NOTIFY is not functioning properly, it will take up to the refresh interval specified in the zone’s SOA record to replicate to the secondary. Actually, without NOTIFY, it’s the responsibility of the secondary server to “reach out” to the primary when it’s refresh interval is reached. If NOTIFY is working properly, the primary server reaches out to its secondaries to tap them on the shoulder and say, “Hey, I have some new information, ask me what it is,” at which point the secondary will issue an IXFR or AXFR transfer request.

Problems

The problem we found is that GoDaddy will only send NOTIFY messages to DNS servers defined as NS records for a particular domain. However, DNS Made Easy will not listen for notify messages on its authoritative servers--they have their own set of servers that listen for NOTIFY messages. GoDaddy offers no way to add those servers to an “also-notify” list. I sent trouble tickets to both companies, and (eventually) they both agreed that it was a problem. They also both said that this was a low priority thing as nobody else besides me seemed to care, and basically said they’ll get to it some day (insha’Allah, as our Arab friends would say).

BIND to the Rescue

ISC’s BIND software is insanely flexible. We ended up setting up a virtual private server with Linode whose $5/month role was primarily to act as a broker between two grumpy DNS providers who didn’t want to share nicely. It’s like the referee at the beginning of the boxing match that forces the boxers to shake hands. The BIND set up is pretty simple: in our options section, we have defined a max-refresh-time 120 that tells it to check the serial number on the primary server every two minutes. Then in our relevant configurations, we have also-notify { dnsmadeeasy-slaves; }; with the dnsmadeeasy-slaves defined in the masters section. In addition, we have notify-explicit; which ensures that the BIND server notifies the secondary (slave) servers upon discovery of a change. GoDaddy has a place to define an access-list that allows the BIND server to initiate a zone transfer. The BIND server also allows the DNS Made Easy servers to transfer the zones from BIND.

Final Answer

To answer my friend’s original question (which at this point he probably wished he hadn’t asked), I guess we’re running five different interfaces (Windows, Unbound, GoDaddy, DNS Made Easy, and BIND). I’m not sure which DNS software the providers are running, since the cute little BIND trick has been overridden (try nslookup -type=txt -class=chaos version.bind. 208.80.126.2). It’s amazing how much more complicated something can turn out to be beyond what you had originally intended.

The Point

Besides simply explaining what our crazy DNS set up is, my point is that if you know the technology well enough, you can leverage the right tool to get the job done. If you have to learn a new configuration file format, that’s not a big deal if you have an idea of what’s supposed to happen. One of the things I also tell my colleagues is that the software is supposed to serve you, you are not supposed to serve the software.

Time zones, abbreviations, and becoming grumpy with age

I'm 40 years old now, and I can feel my list of annoyances growing as I age. If I'm not careful, by the time I'm 80, I'll be one of those people Meg Ryan's character described in French Kiss.

The way people abbreviate time zones is often wrong. I live in the Central Time zone in the United States. Depending on the time of year, you abbreviate it in one of two ways.

• CST: Central Standard Time
• CDT: Central Daylight Time

In the United States, we have Daylight savings time between early/mid March and early November (see chart), and Standard time the rest of the year. Can you tell what's wrong with this sentence?

The meeting will be held at 14:00 CST on July 8.

Answer: There is no CST on July 8, there is only CDT. Perhaps I have an unfair advantage over the general public, because as a computer network engineer, I have to manage devices where you specify CDT verses CST as far as how you name the time zones.

Anyway, the dirty secret is that the very things that drive me nuts about other people, I sometimes do myself! Once in a while, I fall victim to not catching my own grammer or spellling mistakes [intentionally ironic]. I guess when Jesus said...

“Do not judge, or you too will be judged. For in the same way you judge others, you will be judged, and with the measure you use, it will be measured to you” (Matthew 7:1-2).

... he wasn't just teaching a good truth, he was (and is) trying to protect us from opening up judgement on ourselves (i.e., looking stupid)!

Batch down-sampling lots of MP3 files

I had to convert about 1,100 mp3 files from 44.1 kHz to 22.05 kHz so I could get them from a total of 6 gigabytes to 3 gigabytes. I just thought I would share my process.

First I had to decide what software to use. There are two that came to mind: FFmpeg and LAME. I primarily use Windows 10, but I also administer several Linux systems. I try to pick whichever one will be most efficient. For tasks I do on my own computer, I sometimes do it “natively” in Windows, and sometimes I use the Windows Subsystem for Linux, which is a full-blown Debian installation.

This time, however, I just did it in Windows. Here is the batch file I wrote to do it. I will include comments afterward. The thing to know is that the folders with the audio all have the format NN-LLL (N=number; L=letter).

1. @echo off
2. 
   
3. for /d %%I in (??-???) do (
4.  for %%J in (%%I\*.mp3) do (
5.   if not exist _22kHz\%%~nxJ (
6.    ffmpeg -i %%J -ac 1 -ab 64000 -ar 22050 _22kHz\%%~nxJ
7.   )
8.  )
9. )

I put it in a numbered list so I can refer to the line numbers.

Line 3 says to get a list of all directories that have the format XX-XXX and put them in a variable called ‘I.’ I often pick ‘I’ because that's what the examples at the end of “for /?” in command prompt use, so it's a no-brainer. The ‘/d’ is necessary because the ‘for’ command will ignore directories by default.

Line 4 looks in the directory stored in variable ‘I’ and gets a list of all the mp3 files and stores them (with pathname) in the variable ‘J.’

Line 5 indicates that my output folder is called ‘_22kHz.’ I had manually created this folder (an important step!). So it says that if the file doesn't already exist in that folder, go ahead and run line 6. The ~nx is important because it basically strips the full path name of the file and gives you just the file name, so we can accurately check for it.

Line 6 is the actual FFmpeg command to convert to 64k bit rate at 22.05 kHz sampling. It reads the file in the ‘J’ variable and outputs it to the new ‘_22kHz’ folder.

Workaround for “Windows AD domain is the same as my company’s primary DNS domain name”

I have seen many companies over the years who have their internal domain set as the same domain that their corporation uses publicly. For example, if my company is Example, Inc, my primary web and e-mail presence might be example.com. When my Windows NT 3.5 domain was set up in 1997, we called it EXAMPLE, as it seemed logical. When Windows 2000 came out and we upgraded to Active Directory, it became logical to create example.com as the AD DNS Name. The recommendation is to NOT do that, but for many it was done before the recommendations were widely published (or they didn't think to look), and they simply have to live with it.

Years ago, most non-technical users (in my estimation) believed there was something magical about the “www” portion of a web address. For example, “www.example.com” was any given company’s web site. However, more and more people are dropping the “www” and just going to “example.com”. It’s the responsibility of the IT people (DNS and web administrators) to make sure the DNS A record for @ (domain root) points to the web server address, and the web admin must make sure the site answers for www.example.com and example.com and presents the same content to both (or redirects one to the other).

Here comes the problem in the first paragraph. For one thing, it requires split DNS: there is a public “version” of all the example.com records, and a private version. Within an Active Directory infrastructure, the private version of example.com (with no host name specified) should resolve to the IP address of all the domain controllers. For example, if I have three domain controllers, nslookup example.com should return 10.1.1.5, 10.1.2.5, and 10.1.3.5, assuming those are the addresses of my DCs. Most likely, the domain controllers are also not hosting the public web site (and they sure shouldn’t be!). This means that if I’m inside the network, pointing to internal DNS servers and I type example.com into my web browser, I won’t get anywhere.

The simplest solution I found in that case is to redirect the request to www.example.com, which can point to the public address of the public web server--what people expect to hit when they type in example.com internally. To do this, we could install IIS on every domain controller and set up a HTTP 301 or 302 redirection to www.example.com. But installing IIS on every domain controller adds overhead, etc, to the box, as well as lots of new DLLs and other things to introduce security problems (anyone remember Code Red?).

Another solution is to use ncat and NSSM (the Non-Sucking Service Manager). ncat can sit in memory with the help of NSSM and simply redirect http queries to the box to www.example.com. All that is needed is two exe files and one batch file to be copied to each server. Here’s how it could be done.

redir.cmd
@echo off
echo HTTP/1.1 302 Found >%temp%\redir.txt
echo Location: http://www.example.com/ >>%temp%\redir.txt
c:\redir\ncat -l 80 < %temp%\redir.txt


Put all three files (ncat.exe, nssm.exe, redir.cmd) in c:\redir. Then install the service using nssm with the following command (run as administrator):

nssm install "Web Redirector" c:\redir\redir.cmd

You could even deploy it to all your DCs remotely. You could do it your way, or using something like this:

deploywebredir.cmd
@echo off

setlocal ENABLEDELAYEDEXPANSION
set DCLIST=\\

for /f "delims=. " %%a in ('nltest /dclist:%USERDNSDOMAIN% ^|findstr /c:"[DS]"') do (
 md \\%%a\c$\redir
 for %%b in (ncat.exe nssm.exe redir.cmd) do copy /y %%b \\%%a\c$\redir
 set DCLIST=!DCLIST!%%a,
)

set DCLIST=%DCLIST:~0,-1%

psexec %DCLIST% -e c:\redir\nssm install "Web Redirector" c:\redir\redir.cmd


If you’re not familiar with psexec or nltest, you should get up to speed! Just search for them in your favorite search engine.

If you want to make this more secure, define a user with no particular privileges (besides Log on as a Service) and set the service to run as that user. Even if someone buffer overruns ncat.exe, they will only have basic user access.

Kindle URI Format

As many people, I am an avid user of Amazon Kindle. My family of three has two Kindles (2.0 and Paperwhite), my wife and I each have the app on our smart phones, and we each have Kindle for Windows on our laptops.

I was writing a document in Word and I wanted to be able to refer to particular sections of a Kindle book. I had a heck of a time figuring out the URI format, but I eventually put enough pieces together to give me what I wanted.

Here it is:

     kindle://book?action=open&asin=B003G4W49C&location=1178

There are more options than this, but this gets you to a particular location... it is made up of three components:

1. action = open ... open the book
2. asin = book identifier; you can find this in any number of ways. The easiest I've found is this:
1. Go to your Kindle Content directory. Mine is C:\Users\Matt\Documents\My Kindle Content
2. Then run findstr /m "Ender's Game" *.azw where in this case you would replace "Ender's Game" with your book's title.
3. location = xxxxx ... whatever location you want to go to

Just thought I'd share...

Regular Expression for Book/Chapter of the Bible

What perl-compatible regular expression (PCRE) could match books/chapters of the bible?
How about this one:

/(^[123]?(\s+)?[a-zA-Z\s]+)(\s+)?([0-9]+)/

---

Everything between the first set of parenthesis is the book name. The parenthesis are done so we can pass the variables separately on to an array. This is a common task in working with PCRE, but for simply matching a pattern, may or may not be necessary. Though the second set, putting the \s+ in parenthesis, is for grouping as opposed to passing.

^[123]?

First we have to see if it is one of the books that starts with (^) a 1, 2, or 3 (e.g., 1 Chronicles, 3 John). The question-mark means that it's optional, because most books of the bible don't have those.

(\s+)?

Next we have to check if there is a space between that and the book name, because when somebody is searching for a book of the bible, they may get lazy (like me) and not put in a space. Again, it's optional as to whether or not it's there, so we use a question-mark.

[a-zA-Z\s]+

Next we have to check for all variations of capital or small letters, and we need to allow spaces as well for books like "Song of Solomon" (actually that's the only one with a space in it). Instead of the question-mark we have the plus, because at least one of these is required. You could also use [\p{L}\s]+ in PCRE, where \p{L}, or it's long form, \p{Letter} indicates a letter from any language.

The second set of parenthesis is the chapter...

(\s+)?

Again, the space (or more than one space for that matter) is optional between the book name and the chapter.

([0-9]+)

A chapter. At least one chapter is required (the + symbol).

Pretty easy, and honestly I put this blog entry in for myself to quickly refer to in case I have documented all my code badly (which I have!).

Humility and Resisting the Devil

First blog entry in over a year...

I was reading Luke 4:12, where the devil departed from tempting Jesus "until an opportune time." This is important to remember... that the devil is always looking for an opportune time. Because you have resisted him once (James 4:7), that doesn't mean he won't be back in the near future, as he is always on the prowl looking for someone to devour (1 Peter 5:8).

Interesting that both James 4:6-7 and 1 Peter 5:6-8 talk about humility just before they talk about resisting the devil... reminds me too of what I once heard someone say in a talk: The devil demanded to sift the apostles as wheat (Luke 22:31), which happened immediately after the argument about who was to be the greatest. And the "you" used in that verse is the plural one, probably meaning those involved in the conversation. The devil seized the opportunity where they were trying to be great in order to demand to have his way with them. And Jesus doesn't say, "I have prayed for you so he can't have you," because he knew the devil had a right to demand what what he was demanding. Instead Jesus said, "I have prayed for you [singular] that your [singular] faith may not fail. And when you have turned again, strengthen your brothers" (ESV). Jesus prayed specifically for Peter, the rock, that he would make it through this trial, then lead his brothers through it as well. And the greatest trial of their lives was just about to begin 14 verses later.

Here's my point (sometimes in my rambling I forget to get back there): If we are being severely tempted by the devil, let's resist him, but not forgot to ensure or confess that there be no seed of pride in us.

P.S., If you want more of my thoughts on Luke 22:31, read on.

It's interesting that the devil demanded (Greek: exētēsato) to sift Peter & the apostles as wheat. He had a right to do that. According to most modern translations, Jesus says that he prayed for Peter's recovery, yet the word used in Greek is "edeēthēn," which is not the word used for prayer anywhere else. Its only other usage is in Luke 9:40 where the man begged the disciples to cast the demon out of his son, but they were unable to. This tells me that the devil had a right to demand Peter and the apostles' sifting, and Jesus did not necessarily have a right to have his petition answered, at least not in the same way.

So it is a mercy for God to restore us after we have failed, not his duty.

Bible Search Algorithm part 1

I was searching for a bible search algorithm a while ago, and I couldn't find one publicly posted, so I wrote my own. Those familiar with the bible know that it is expressed in this format:

• Book Chapter:Verse
• e.g., John 3:16

But of course one can also show multiple references together using a combination of dashes, semi-colons, and commas.

• John 4; James 1:2-8
  (Entire chapter 4 of John, James 1 verses 2 through 8)
• John 7:40-8:11
  (John chapter 7 verse 40 through chapter 8 verse 11)
• Ge 12:1-8; 15:1-6
  (Genesis chapter 12 verse 1 through 8, chapter 15 verse 1 through 6)

So I was considering how I could parse this down. I wrote to a few sites who do search results according to these generally agreed-upon principles, but I got no reply. So I wrote my own and thought I would share it. It's written in PHP but could certainly be adapted to anything. It does not use OOP and could probably be improved upon, but I am not a programmer by nature, so I figured I would just post what I have.

There are a few functions that work together to do the job. I will post the first one here with an explanation. This function normalizes the input into something that the other functions can use.

This function is designed to be called with the raw input. Here is what it would show for the various inputs above:

• Array
  (
      [0] => John 4
      [1] => James 1:2-8
  )

• Array
  (
      [0] => John 7:40-8:11
  )

• Array
  (
      [0] => Ge 12:1-8
      [1] => Ge  15:1-6
  )

In the next post I'll talk about the next step in processing the data, which is breaking out the ranges into a top-most range and a bottom-most range using the hyphens as guidelines.

In subsequent posts, I'll outline the procedure for converting the abbreviation into the full book name (e.g., Ge → Genesis) and actually pulling data from the database, which may look different for different people depending on the database in use, etc.

Reading and remembering

As I was reading scripture today, I came upon Matthew 8, particularly the section that describes what one has to be willing to surrender to follow Jesus. I have read this dozens of times, but I had to "cheat" using Bible Gateway to remember where it was in scripture.

Something that I know already, but want to try more today, is sharing something you read and remember with other people. That is the best way to learn anything, not just where something is in scripture. I'm learning a new language right now, and it's well-known that the way to retain what you learn in a day is to repeat it and interact with it among lots of people.

May I be better at walking that out...

Application Performance II

I thought I would just tell a few quick stories about my encounters with application efficiency and how the network was blamed. In the spirit of humility, I'll offer where I feel I did poorly and where I did well, and what lessons I learned.

City Police Database
The biggest, most obvious example of this was when I was doing some consulting work for a city government, which shall of course remain nameless. They had gotten a new application (and when I say new, I mean it--it had not been seriously proven in any other installations). I was asked to make the application high-availability. The application was not ready to be installed yet, but I was to do the up-front work. The parameters were thus:

• We don't want to buy any new network equipment
• The redundancy must go across multiple sites, which are connected by DS3 links several hops away.
  

So I devised a method I thought was pretty good to fit these parameters. It used pre-existing Cisco 3845 routers: one at the "main site" and one at the "backup site." The 3 servers that made up the program (two application servers and one database server) went on a new VLAN that was routed by the 3845. The VLAN at the main site had one particular IP subnet and the VLAN at the backup site had another subnet. But each server had a loopback interface, and those interfaces were the ones that DNS pointed to. The 3845 at the main site used Cisco's IP SLA with tracking, tracking the application's TCP port on it's physical address. If the application went down, it stopped advertising the loopback /32 via EIGRP. The backup site would then start advertising, because it had a route to that /32 address but with an administrative distance of 200, which is lower than EIGRP's external administrative distance of 170.

All that is background, which is actually not related to my point. All of this redundancy stuff should probably not have been put in, at least without a careful up-front study of the application itself. That's another lesson: do your homework first, and save a lot of headache. If you have built a Cadillac simply to transport monkeys, you've probably wasted your time and efforts (and the customer's money). My personality type is ISTP, which if you know psychology, tells you why I went ahead and did all this.

It turns out that the application was horribly written in many ways--it didn't run as a service, it ran as a user-level program, so we had to set the servers to auto-login, etc. But the biggest problem was, and the point of this section, the performance. It had never been load-tested, nor had it been run over anything less than a gigabit network. So when it was slow, it was of course the fault of the network, and more specifically, the network engineer who obviously didn't know what he was doing.

Here's what we determined after I did a careful analysis of the application (without seeing any code or finding this out from the programmers who didn't speak English very well). The client component of the application, which sat on the user's workstation, was doing SQL queries in the background. Instead of doing a query like:

• select COMPONENT from TABLE where SOMETHING > 100;

it was doing something like:

• select * from TABLE;

then once it downloaded the huge amount of data, it would "post-filter" that. Yes, definitely a network problem when every query resulted in the downloading of over 100 megs of data, which would then be weeded out by the client software just to show 10 records.

It was really difficult maintaining humility in this, and I must confess that though I did maintain humility while investigating, I blew a gasket once I discovered the problem.

Pharmaceutical Database
There was a particular pharmaceutical company I consulted for who wanted a fast link between their main site and another site where many users were as well as off-site backups sat. They already had a DS3 between the sites, but they wanted to put in an additional 100 Mbps connection, which they did. I then configured all the routers, etc, to route things primarily down the 100 Mbps connection and secondarily down the DS3.

Everything was fine and we verified the routing was going the correct way, etc. But then the database backups started going much slower than they had before. After investigating, I discovered that the DS3 ran more-or-less directly from their office in West Bend, WI, to the office in Waukesha, WI. However, the 100 Mbps connection ran from West Bend, WI, up to the CO in St Paul, MN, then down to Waukesha, WI.

Obviously, the latency over the 100 Mbps connection was significantly more (25-30 milliseconds) than the latency over the DS3 since the distance was so much further. This can be understood here. So this was a network problem, if you will. However, again, the way the database was synchronizing, it was doing thousands of little queries, rather than a bulk transfer.

Here were some possible solutions, in no particular order.

1. Modify all the computers to use a higher TCP window size using the Window scale option. Without window scaling, you have to consider latency when determining the maximum speed of a TCP session. It goes like this:
   
   Window Size (bytes)
   ------------------- * 8 bits/byte = bps
   Latency (sec)
   
   So 65535 / .025 * 8 = ~21 Mbps. So we could not get more than 21 Mbps from this connection.
   
2. Make the syncing go over the DS3.
3. Ask the programmers re-write the way the database synchronizes.
4. Make the carrier reroute the 100 Mbps connection.
   

First we enabled TCP window scaling option for the two servers that needed to synchronize across this connection. That didn't seem to help. Then we dug into just how the application was working and discovered the little queries that made the syncing work, which would be unaffected by window sizing. So we tried option 3, because it was what we determined to be the best. The programmers laughed and said it was a networking problem and it was our fault because it used to work better. We probably should have pushed them harder and gotten management involved more, but we didn't. We tried option 4 but that was impossible because the carrier was based in MN and would have charged roughly a bazillion dollars to run fiber directly between the two sites, and this carrier was originally chosen precisely because they did a good price/sales job on the management.

Ultimately we made the syncing go over the DS3 using offset lists in EIGRP for /32 routes for those two servers. That also meant that there would be asynchronous routing when anything communicated across the WAN with one of those two servers (besides the server-to-server communication of course). No one cared, as long as it "worked better" and redundancy was there.

Two lessons from these experiences:

• Do your homework! Don't rush ahead without asking a lot of good questions. Some things may seem obvious based on your past experience, but don't assume.
• If you determine something to be the best option and it gets laughed off by the people you're suggesting it to, go to management ready to explain all the ins-and-outs of the problem as you understand it.
• Whatever your personality type, attempt to show restraint in running ahead with solutions. Brain-storm, but remember that brainstorming is not meant to be implemented on a whim. Sleep on it and run it by colleagues and other smart people.
  

Remember, work as a team to get it resolved. If you blame someone else, try to put yourself in their shoes and always speak with humility and remind people you are on the same team--you just want to find the best solution. This kind of thinking is often contagious, and usually management will appreciate it. Of course, this isn't always true, and you can't control other people, but if you keep your cool, things will go better, at least for you.

Application Performance and the Jesus Way

Application Efficiency, Part I
The website Ethereal Mind, which I often read, had a recent post in response to another post by Matthew Norwood entitled Programming Bad Performance. It touched on something every network engineer feels when application performance is slow somewhere on the network. It's a topic I have dealt with a lot in my professional career so I uncharacteristically weighed-in with a comment, which I present below in a modified form...

It seems that the onus, or bur­den of proof, is often on the net­work engin­eer to fig­ure out just what the prob­lem is, since the net­work is this mys­ter­i­ous entity that most people don’t know much about. I have found two types of server admins in my exper­i­ence:

• The ones that assume it’s their prob­lem and never think about the net­work, but then it proves to be a net­work prob­lem (often when attempt­ing to estab­lish com­mu­nic­a­tion between a ser­vice net­work and an internal net­work).
• The ones that assume (along with all the users, usu­ally) that it is a net­work prob­lem and very quickly start point­ing fin­gers.

I have found that over the years I have learned a lot more about effi­cient data­base pro­gram­ming, ana­lyz­ing server cpu, memory, and disk util­iz­a­tion, etc, than I ever wanted to, as a means to simply find what the real prob­lem is. Greg at Etherealmind points out that prov­ing it’s not the net­work, or at least cast­ing plaus­ible reason to believe it’s not, will get you home on time. I agree with that, but in a world of people say­ing, “It’s not my prob­lem” and wash­ing their hands of it, I want to put forth a little more effort to get to the bot­tom of things.

Something else that I have learned is that humil­ity is really import­ant. If you start act­ing cocky and the prob­lem turns out to be yours, you really look like, and are, a jerk. Taking more of a “Let’s fig­ure this out together” atti­tude is much more likely to lead to suc­cess and team unity in the end. The real art is being able to foster and main­tain that atti­tude when other people seem to be out for blood.

The Jesus Connection
I'll make this my first post that crosses my two categories of blogging. Wanting to live life in a way that Jesus would do it, the previous paragraph helps see one or two ways of doing that. The bible often speaks of humility... three places that jump out to me:

• Do nothing out of selfish ambition or vain conceit. Rather, in humility value others above yourselves, not looking to your own interests but each of you to the interests of the others (Philippians 2:3-4).
• For those who exalt themselves will be humbled, and those who humble themselves will be exalted (Matthew 23:12).
• When pride comes, then comes disgrace, but with humility comes wisdom (Proverbs 11:2)

Unity is also key to solving problems. It's amazing how humility and unity go together as well (I think that's pretty obvious). If everyone is cocky, it does not help team unity--it just creates divides. Be completely humble and gentle; be patient, bearing with one another in love. Make every effort to keep the unity of the Spirit through the bond of peace. There is one body and one Spirit, just as you were called to one hope (Ephesians 4:2-4).

Three of my favorite topics: humility, unity, and hope!