11 phases

The BSD Packet Filter: A New Architecture for User-level Packet Capture

http://www.tcpdump.org/papers/bpf-usenix93.pdf

Sniff Your own Networks with Tcpdump

http://www.safepatrolsolutions.com/papers/Tcpdump.pdf

Haym Solomon, an american patriot

http://en.wikipedia.org/wiki/Haym_Solomon

arping utility in Linux

The arping utility is part of the iputils-arping package in Debian like systems.

It is very useful for finding out if an IP number is already taken in a local network.

The syntax should be:

~$ arping -D -I eth0 -c 3 172.17.12.228
ARPING 172.17.12.228 from 0.0.0.0 eth0
Sent 3 probes (3 broadcast(s))
Received 0 response(s)

No IP in this case.

~$ arping -D -I eth0 -c 3 172.17.12.222

ARPING 172.17.12.222 from 0.0.0.0 eth0

Unicast reply from 172.17.12.222 [00:21:70:6A:EA:48]  0.754ms

Sent 1 probes (1 broadcast(s))

Received 1 response(s)

One IP found.

-D Duplicate  address  detection  mode  (DAD).  See RFC2131, 4.4.1. Returns 0, if DAD succeeded i.e. no replies are received.

Sniffing Tutorial part 2 - Dumping Network Traffic to Disk - NETRESEC Blog

http://www.netresec.com/?page=Blog&month=2011-03&post=Sniffing-Tutorial-part-2---Dumping-Network-Traffic-to-Disk

City of Miami neighborhoods map

http://en.wikipedia.org/wiki/File:Miami_neighborhoodsmap.png

SQLite Tutorial

http://souptonuts.sourceforge.net/readme_sqlite_tutorial.html

How does NTP work?

http://www.ntp.org/ntpfaq/NTP-s-algo.htm

Hurricane Tracker at The Weather Channel

http://www.weather.com/weather/hurricanecentral/tracker

Guide to IP Layer Network Administration with Linux

http://linux-ip.net/html/

Network interfaces in Fedora 14

http://docs.fedoraproject.org/en-US/Fedora/14/html/Deployment_Guide/ch-Network_Interfaces.html

IP Command Reference

http://linux-ip.net/gl/ip-cref/

Sed - An Introduction and Tutorial by Bruce Barnett

http://www.grymoire.com/Unix/Sed.html

Wallpapers

http://interfacelift.com/wallpaper/artist/11731/giovanni_di_gregorio/index2.html

MySQL C# tutorial

http://zetcode.com/db/mysqlcsharptutorial/

Tom's Hardware

http://www.tomshardware.com/

The Joel Test

The Joel Test

1. Do you use source control?
2. Can you make a build in one step?
3. Do you make daily builds?
4. Do you have a bug database?
5. Do you fix bugs before writing new code?
6. Do you have an up-to-date schedule?
7. Do you have a spec?
8. Do programmers have quiet working conditions?
9. Do you use the best tools money can buy?
10. Do you have testers?
11. Do new candidates write code during their interview?
12. Do you do hallway usability testing?

http://www.joelonsoftware.com/articles/fog0000000043.html

InnoDB ibdata1 never shrinks after data is removed

http://bugs.mysql.com/bug.php?id=1341

Mariel Passengers Database

http://www.miamiherald.com/cgi-bin/mariel/index

Berkeley Packet Filter (BPF) syntax

http://biot.com/capstats/bpf.html

Ip Link

http://linux-ip.net/html/tools-ip-link.html

Add a digital signature to a file or macro project

http://office.microsoft.com/en-us/excel-help/add-a-digital-signature-to-a-file-or-macro-project-HP005249557.aspx?CTT=3

Casio watches manuals

http://world.casio.com/wat/download/en/manual/

Host tuning for different OSes

http://fasterdata.es.net/host-tuning/

Configuring static network routes in Fedora 14

http://docs.fedoraproject.org/en-US/Fedora/14/html/Deployment_Guide/s1-networkscripts-static-routes.html

A tutorial about Log4j. Using appenders. Includes examples.

http://www.mobilefish.com/developer/log4j/log4j_quickguide_appenders.html

Solaris host unable to join multicast groups

An IGMPv2 Membership Request packet is described in RFC 3376.

IGMP messages are encapsulated in IPv4 datagrams, with an IP protocol number of 2. Every IGMP message described in this document is sent with an IP Time-to-Live of 1, IP Precedence of Internetwork Control (e.g., Type of Service 0xc0), and carries an IP Router Alert option in its IP header

The Router Alert option is described in RFC 2113.

The option type field is sub-divided into a one bit copied flag, a two bit class field, and a five bit option number.  These taken together form an eight bit value for the option type field.

Copy Class Number Value Name                            Reference
---- ----- ------ ----- ------------------------------- ------------
1    0     20     148   RTRALT - Router Alert           [RFC2113]

In binary: 1 00 10100

In Solaris 10 an IGMP multicast join packet has the IP options section with an hexadecimal  value of:

00 04 00 00

It should be:

94 04 00 00

In Solaris 10, IGMP V2 membership report packets have a) a RFC non-compliant IP options header and b) the IP options header is unnecessary.

When a multicast router sends an IGMP V2 query (normally having IP option 148 (router alert) set), a Solaris 10 box replies with IGMP V2 reports for all multicast groups the box want to receive.

The IGMP packets generated by Solaris 10 contain an IP option header which is in two respects wrong:

a) as there is no "meaningful" option present (only the option "end of option list", abbreviated EOL or EOOL), there should be no IP option header present in the packet

b) If the option header is still present (because of other IP options), the last four bytes should carry the value "00 01 01 01" instead of value "00 04 00 00" , as the option number 00 means "end of options list", is a one-byte value and should be padded with 01 (NOP).

The bug is fixed in Sun's IDR hotfix 123621-01 (requires kernel patch 118833-18). Afterwards, a Solaris 10 box sends IGMP messages with the correct "router alert" IP option set, thats 94 04 00 00.

References:

RFC2236: http://tools.ietf.org/html/rfc2236
RFC2113: http://tools.ietf.org/rfc/rfc2113.txt
IANA IP Options Numbers: http://www.iana.org/assignments/ip-parameters
https://forums.oracle.com/forums/thread.jspa?threadID=1948503&tstart=345