Saturday, September 5, 2026

TT Stunnel Changes: Removing Certificate Pinning

 

The following comes from TT System Admin News & Updates for September 4, 2026

 

As of Q2 2026 TT no longer provides / updates the stunnel.zip file which customers might be using to perform certificate pinning. The final certificate in the stunnel.zip file expires on Oct 17, 2026.  

Only customers who download the stunnel.zip file from https://library.tradingtechnologies.com/tt-fix/general/stunnel.zip are impacted. Affected customers should start migrating to utilize their local machine’s certificate trust store. Digicert and AWS are both established Certificate Authorities and should be available in the trust stores of modern operating systems.

 

What This Means 

  • Clients no longer need to download TTFIX.crt file 
  • Clients configure stunnel to use their OS trust store path for CA validation 
  • We verify the correct authentication chain rather than a single pinned leaf certificate 

Configuration Changes 

 

Previous (pinned certificate)

[orfix-tcp]  

client = yes  

accept = 127.0.0.1:11702  

connect = FullyQualifiedDomainName:port  

CAfile = TTFIX.crt  

verify = 3 

 

New (OS trust store with chain validation) 

[orfix-tcp]  

client = yes  

accept = 127.0.0.1:11702  

connect = FullyQualifiedDomainName:port  

verifyChain = yes  

CAfile = <OS_SPECIFIC_TRUST_STORE_PATH> 

 

Notes and Additional Guidance 

  • The snippet above is a single section of the client configuration.  For the other sections please see our online documentation here 
  • Stunnel versions: verifyChain = yes is broadly compatible. If required, verify = 2 provides comparable chain validation. 
  • For clients that currently connect to TT FIX using stunnel, we ask that they come into the UAT to test their needed configuration changes.   

Wednesday, September 2, 2026

Invest numbers / Disturbance identifiers

 

Those codes are invest numbers / disturbance identifiers used by tropical cyclone warning agencies to track systems before—or sometimes after—they become named tropical depressions or storms.

The format is basically:

NN + basin letter

where NN is a sequential number and the final letter identifies the ocean basin.

ExampleMeaningBasin
05LSystem number 05North Atlantic
12ESystem number 12Eastern North Pacific
01WSystem number 01Western North Pacific

The basin letters are the important part:

  • L = North Atlantic, including the Caribbean Sea and Gulf of Mexico
  • E = Eastern North Pacific
  • C = Central North Pacific
  • W = Western North Pacific
  • A / B = North Indian Ocean
  • S / P = Southern Hemisphere basins, depending on location

An important distinction

You might see something like Invest 95L. That is not the fifth tropical cyclone of the year.

Numbers 90–99 are normally reserved for invests—areas of disturbed weather that forecasters are specifically investigating for possible tropical development. The numbers can later be reused.

 

Thursday, August 27, 2026

ss Command Cheatsheet

ss Command Cheatsheet

ss Command Cheatsheet

A fast and powerful tool for dumping socket statistics in Linux

1. The Essential Flags

Flag Meaning What it does
-tTCPShows TCP sockets
-uUDPShows UDP sockets
-lListeningShows only listening sockets (waiting for connections)
-aAllShows all sockets (both listening and established)
-nNumericSkips DNS/port resolution (makes the command run much faster)
-pProcessShows the process ID (PID) and name owning the socket (requires sudo)
-sSummaryPrints a quick summary of overall network statistics
-4 / -6IPv4 / IPv6Forces ss to only show IPv4 or IPv6 connections

2. The "Daily Driver" Commands

  • Show all listening ports and the processes using them:
    sudo ss -tulpn
  • Show all active/established TCP connections:
    ss -atn
  • Show a high-level summary of all network sockets:
    ss -s

3. Filtering by IP and Port

  • Filter by Local Port (Traffic hitting your server):
    ss -tn 'sport = :443'
  • Filter by Remote Port (Traffic leaving your server to a specific port):
    ss -tn 'dport = :3306'
  • Filter by Source IP (Useful if your server has multiple IP addresses):
    ss -tn 'src 10.0.0.5'
  • Filter by Destination IP (Who the server is talking to):
    ss -tn 'dst 192.168.1.50'
  • Combine filters (Connections from a specific IP to port 80):
    ss -tn 'sport = :80 and dst 192.168.1.50'

4. Filtering by TCP State

  • Show only established (active) connections:
    ss -tn state established
  • Show connections stuck in TIME-WAIT:
    ss -tn state time-wait
  • Show connections currently listening:
    ss -tn state listening
(Other valid states include: syn-sent, syn-recv, fin-wait-1, fin-wait-2, close-wait, last-ack, closing, and closed.)

5. Advanced Troubleshooting Options

  • Show socket memory usage (-m):
    ss -tm
    Useful for checking if a specific connection is hogging buffer memory.
  • Show TCP timer information (-o):
    ss -to
    Shows keepalive timers and retransmission states.
  • Show internal TCP metrics (-i):
    ss -ti
    Shows deep kernel-level data like RTT (Round Trip Time), congestion window size (cwnd), and packet pacing.

Sunday, June 7, 2026

Bypassing HTTP: The Fastest Way to Find Your External IP via Command Line

Ever found yourself needing your public IP address while staring at a headless server terminal?

The standard approach for most developers is to ping an external HTTP service using curl or wget. While that works perfectly fine, there is a faster, more elegant way to do it that bypasses the web protocol entirely.

In this post, we’ll look at the traditional web-based methods, unpack a clever DNS-based trick that drastically speeds things up, and show you how to implement it on both Linux and Windows.

The Traditional Way: HTTP Requests

Most of us have these commands permanently burned into our muscle memory:

# The classic curl method
curl ifconfig.me

# Reliable alternatives
curl icanhazip.com
curl api.ipify.org

If you are on a fresh Linux install without curl, you might fall back on wget:

wget -qO- ifconfig.me

The Downside to HTTP

While reliable, these tools require your machine to perform a full TCP handshake, negotiate SSL/TLS encryption certificates, and download a web request. It’s a lot of overhead just to get a single string of numbers back.

The Power-User Alternative: The DNS Trick

If you want maximum speed, you can bypass HTTP entirely and query DNS (Domain Name System).

Because DNS is built on lightweight UDP packets, it doesn’t require the heavy setup of a web connection. It fires a single packet out, and gets a single packet back.

On Ubuntu/Linux, you can leverage Cloudflare's diagnostic tools using the dig command:

dig +short txt ch whoami.cloudflare @1.1.1.1

How Does This Sorcery Work?

Let’s break down exactly what that command is doing:

  • dig: The Domain Information Groper, Linux's native tool for probing DNS servers.
  • +short: Tells dig to suppress its usual verbose network text and only output the answer.
  • txt: Specifies that we are looking for a text record rather than a standard domain mapping (A record).
  • ch: Stands for Chaosnet. While 99% of the web uses the IN (Internet) class, historical network classes like Chaosnet are still used for local server diagnostics.
  • whoami.cloudflare: Cloudflare specifically programmed their servers so that if you ask for the "whoami" record, it reflects your own public IP right back to you.
  • @1.1.1.1: Forces the query directly to Cloudflare's public DNS resolver, bypassing your local router or ISP.

Bringing the Trick to Windows (.bat)

Windows doesn't include dig out of the box, but it does include nslookup, which can achieve the exact same result.

If you want a portable script you can drop onto any Windows machine, here is the complete translation formatted as a standard Windows Batch (.bat) file:

@echo off
REM Check which is your external IP using native Windows tools.

REM Windows native alternative to curl (if needed):
REM powershell -Command "(Invoke-WebRequest ifconfig.me).Content"

REM Using nslookup (Windows native fastest alternative to dig, no HTTP)
REM -query=txt: Requests the raw text record where Cloudflare stores the IP.
REM -class=chaos: Uses the Chaosnet class for diagnostic routing.
REM whoami.cloudflare: The zone designed to reflect your IP back.
REM 1.1.1.1: Forces the query directly to Cloudflare's DNS server.

nslookup -query=txt -class=chaos whoami.cloudflare 1.1.1.1

Wrap Up

The next time you are scripting an automation workflow or debugging a network from the CLI, swap out your curl requests for a DNS lookup. It's lighter on resources, blazing fast, and works even if standard web traffic (ports 80 or 443) is being throttled or blocked on your network.

Thursday, January 8, 2026