tag:blogger.com,1999:blog-10574427335194041762012-02-14T00:12:10.726+05:30OpenSourcedeepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.comBlogger441100tag:blogger.com,1999:blog-1057442733519404176.post-61735438756746061822008-09-08T13:06:00.000+05:302008-09-08T13:08:00.123+05:30

* Q: What should happen upon receipt of a RST packet containing data? * A: The host should accept it. It was suggested that a RST could contain ASCII text explaining the error, but no standard was ever established. * Credit: Kris Katterjohn * Q: What is the longest acceptable delay for an ACK? * A: 0.5 seconds. * Credit: Kris Katterjohn * Q: An ICMP error message must

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-3889060594736078662008-05-05T18:56:00.001+05:302008-05-05T18:58:49.614+05:30

In this edition of the Snort Report, I address some of the questions frequently asked by service providers who are users or potential users of Snort. I say "potential users" because some people hear about Snort and wonder if it can solve a particular problem. Here I hope to provide realistic expectations for service providers using Snort.1. Can I use Snort to protect a network from

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-58547237304468514642008-05-05T18:47:00.002+05:302008-05-05T18:50:21.468+05:30

Mail service for Panix, an ISP in New York, was shut down by a SYN flood starting on 6 September 1996. A week later the story was covered by the RISKS Digest, the Wall Street Journal, the Washington Post, and many other newspapers.SYN flooding had been considered by security experts before. It was generally considered insoluble. See, for example, ``Practical UNIX and Internet Security,'' by

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com4tag:blogger.com,1999:blog-1057442733519404176.post-56428086192570170742008-05-02T12:36:00.003+05:302008-05-02T12:39:46.854+05:30

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-12778663035146410642008-04-30T17:01:00.005+05:302008-04-30T17:26:15.257+05:30

This preprocessor measures Snort’s real-time and theoretical maximum performance. Whenever this preprocessor isturned on, it should have an output mode enabled, either “console” which prints statistics to the console window or“file” with a file name, where statistics get printed to the specified file name. By default, Snort’s real-time statisticsare processed. This includes:• Time Stamp• Drop

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-76930301336154341152008-04-22T18:28:00.003+05:302008-04-22T18:36:12.985+05:30

Getting Started: The format of a pcap applicationThe first thing to understand is the general layout of a pcap sniffer. The flow of code is as follows: 1. We begin by determining which interface we want to sniff on. In Linux this may be something like eth0, in BSD it may be xl1, etc. We can either define this device in a string, or we can ask pcap to provide us with the name of an interface

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-72089891462391675172008-04-17T14:38:00.000+05:302008-04-17T14:39:51.871+05:30

A very useful Linux feature is named pipes which enable different processes to communicate.One of the fundamental features that makes Linux and other Unices useful is the “pipe”. Pipes allow separate processes to communicate without having been designed explicitly to work together. This allows tools quite narrow in their function to be combined in complex ways.A simple example of using a pipe is

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-35510168698227310662008-04-17T14:14:00.000+05:302008-04-17T14:19:36.125+05:30

Signals are used to notify a process or thread of a particular event. Many computer science researchers compare signals with hardware interrupts, which occur when a hardware subsystem, such as a disk I/O (input/output) interface, generates an interrupt to a processor when the I/O completes. This event in turn causes the processor to enter an interrupt handler, so subsequent processing can be done

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-27478711115294895152008-04-15T15:13:00.000+05:302008-04-15T15:17:53.698+05:30

SIGNALSSignals offer another way to transition between Kernel and User Space. While system calls are synchronous calls originating from User Space, signals are asynchronous messages coming from Kernel space. Signals are always delivered by the Kernel but they can be initiated by: * other processes on the system (using the kill command/system call) * the process itself. This includes

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-43579755883203967072008-03-20T19:32:00.000+05:302008-03-20T19:41:05.109+05:30

Sysklogd provides two system utilities which provide support for system logging and kernel message trapping. Support of both internet and unix domain sockets enables this utility package to support both local and remote logging.System logging is provided by a version of syslogd(8) derived from the stock BSD sources. Support for kernel logging is provided by the klogd(8) utility which allows

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-92085418158687217092008-03-20T19:10:00.000+05:302008-03-20T19:11:34.302+05:30

By combining the functions of a control-plane processor and a network processor, the Octeon processor can take on data traffic at rates of up to 10 Gbits/s. Developed by Cavium Networks, this processor performs content, security, compression/decompression, and TCP/IP offload functions thanks to an architecture that blends as many as 16 MIPS64 64-bit processor cores, two serial-packet-interface

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-2843132364068691232008-03-19T18:55:00.000+05:302008-03-19T19:02:19.354+05:30

The acronym PCI stands for Peripheral Component Interconnect, which aptly describes what it does. PCI was designed to satisfy the requirement for a standard interface for connecting peripherals to a PC, capable of sustaining the high data transfer rates needed by modern graphics controllers, storage media, network interface cards and other devices.Earlier bus designs were all lacking in one

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-31601066369504338802008-03-19T16:35:00.001+05:302008-03-19T16:35:59.784+05:30

ReadThatWords.com is an online tool that can instantly convert Web Pages, Office documents and PDF files into MP3 files.While there are other free tools that can convert text to MP3, ReadThatWords offers two distinct advantages:mp3-voice 1. It can turn almost anything into MP3 including PowerPoint slides, Word Docs, PDF, HTML web pages and even RSS feeds.2. You have an array of different voices

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-25560697334944416312008-03-19T16:23:00.000+05:302008-03-19T16:30:32.528+05:30

What you should do to a new Linux PC before connecting it to the Internet. Always keep the software on your computer up to date with the latest security patches should you be running Linux, Windows, BSD or WhoKnowsWhat. Your distribution will release regular security patches that should be applied and are available off the Internet. As with Windows, this should always be your first Internet

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-77976892813684671262008-03-06T17:56:00.000+05:302008-03-06T17:58:36.692+05:30

Gcov is a test coverage program. Use it in concert with GCC to analyze your programs to help create more efficient, faster running code and to discover untested parts of your program. You can use gcov as a profil- ing tool to help discover where your optimization efforts will best affect your code. You can also use gcov along with the other profiling tool, gprof,

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com1tag:blogger.com,1999:blog-1057442733519404176.post-45801070924623463862008-02-25T16:01:00.000+05:302008-02-25T16:02:37.090+05:30

Snort Preprocessors Development KickstartLast updated: November 29th 2005Authors: Andrés Felipe Arboleda Torres, Charles Edward Bedón CortázarWhat is a Snort Preprocessor?Preprocessors are plugable components of Snort, introduced since version 1.5. They're "located" just after the module of protocol analysis and before detection engine and do not depend of rules. They are called whenever a packet

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-91740606471223474092008-02-19T18:29:00.000+05:302008-02-19T18:30:43.551+05:30

It's important for value-added resellers and consultants to understand how Snort detects security events. Stream5 is a critical aspect of the inspection and detection equation. A powerful Snort preprocessor, Stream5 addresses several aspects of network-centric traffic inspection. Sourcefire calls Stream5 a "target-based" system, meaning it can perform differently depending on the directives

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com1tag:blogger.com,1999:blog-1057442733519404176.post-79778527462368117932007-09-21T15:09:00.000+05:302007-09-21T15:13:05.898+05:30

INTRODUCTIONSCTP is a reliable transport protocol operating over IP. SCTP is more akin to TCP than UDP, however it yields additional features to TCP while still supporting much of the same functionality. So SCTP is connection oriented and implements the same congestion/flow control. Detection of data corruption, loss of data and duplication of data is achieved by using checksums and sequence

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com1tag:blogger.com,1999:blog-1057442733519404176.post-28115000956399773862007-09-06T15:25:00.000+05:302007-09-06T15:29:26.091+05:30

What is strict aliasing?Strict aliasing is an assumption, made by the C (or C++) compiler, that dereferencing pointers to objects of different types will never refer to the same memory location (i.e. alias eachother.)ExamplesPointers to different built in types do not alias: 0int16_t* foo; 1int32_t* bar;The compiler will assume that *foo and *bar never refer to the same location. Pointers to

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-77923250175513229602007-08-30T15:41:00.000+05:302007-08-30T15:55:04.886+05:30

Optimisers:* Global constant and copy propagation.* Global common subexpression elimination.EGCS has two implementations of global common subexpression elimination. The first is based on the classic algorithm found in most compiler texts and is generally referred to as GCSE or classic GCSE.The second implementation is commonly known as partial redundancy elimination (PRE). PRE is a more powerful

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-3256458226373613052007-08-16T16:40:00.000+05:302007-08-16T16:49:04.413+05:30

The sk_buff structure ('skb') is actually only used for storing themetadata corresponding to a packet. The packet's data is not storedinside the sk_buff structure itself, but in a separate buffer that ispointed to by skb->head. The skb->end member points one byte past theend of this data buffer.An important design requirement for sk_buffs is being able to add dataat the end as well as at the

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-1533143458400201242007-08-16T14:39:00.000+05:302007-08-16T14:41:55.202+05:30

Table of Contents 1. Existing Optimizations 2. Packet Copies 3. ICMP Ping/Pong : Function Calls 4. Transmit Interrupts and Flow Control 5. NIC driver callbacks and ifconfig 6. Protocol Structures in the Kernel 7. skb_clone() vs. skb_copy() 8. NICs and Descriptor Rings 9. How much networking work does the ksoftirqd do? 10. Packet Requeues in Qdiscs 11. Links 12. Specific

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-23176042609948975812007-08-10T16:19:00.000+05:302007-08-10T16:20:24.369+05:30

The use of volatile is poorly understood by many programmers. This is not surprising, as most C texts dismiss it in a sentence or two.Have you experienced any of the following in your C/C++ embedded code? * Code that works fine-until you turn optimization on * Code that works fine-as long as interrupts are disabled * Flaky hardware drivers * Tasks that work fine in isolation-yet crash

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com3tag:blogger.com,1999:blog-1057442733519404176.post-22139212067809912322007-07-25T15:25:00.000+05:302007-07-25T15:27:39.601+05:30

On the 2.6.x kernels there are four main frontend programs: config, menuconfig, and xconfig.config is the least user-friendly option as it merely presents a series of questions that must be answered sequentially. Alas, if an error is made you must begin the process from the top. Pressing Enter will accept the default entry which is in upper case.oldconfig will read the defaults from an existing .

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-63406537380949439102007-07-24T21:21:00.000+05:302007-07-24T21:25:08.389+05:30

Although this is very old article, gives u lot of knowledge about the device drivers.Some of the things mentioned here changed by this day. By Alessandro Rubini on Fri, 1996-03-01 02:00. SysAdmin This is the first in a series of four articles co-authored by Alessandro Rubini and Georg Zezchwitz which present a practical approach to writing Linux device drivers as kernel loadable modules. This

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com2tag:blogger.com,1999:blog-1057442733519404176.post-10078125243554073292007-07-21T09:40:00.000+05:302007-07-21T09:46:54.558+05:30

Hardware Interrupts (Hard IRQs)Timer ticks, network cards and keyboard are examples of real hardware which produce interrupts at any time. The kernel runs interrupt handlers, which services the hardware. The kernel guarantees that this handler is never re-entered: if another interrupt arrives, it is queued (or dropped). Because it disables interrupts, this handler has to be fast: frequently it

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-46153886793202183952007-07-11T18:00:00.000+05:302007-07-11T18:02:27.438+05:30

Here's what the O options mean in GCC, why some optimizations aren't optimal after all and how you can make specialized optimization choices for your application.In this article, we explore the optimization levels provided by the GCC compiler toolchain, including the specific optimizations provided in each. We also identify optimizations that require explicit specifications, including some with

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-11833274085572772912007-06-12T09:59:00.000+05:302007-06-12T10:00:41.750+05:30

Summary Internet computers, mostly servers, sometimes send packets too large for part of a given path. Not handling this correctly can make the server unusable for some people. Correct handling of oversize packets is by one of two means, as chosen by the sending computer (the server): * Permitting Packet fragmentation - used mostly by older systems * Path MTU discovery -

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-67443344769399162872007-06-06T11:03:00.000+05:302007-06-06T11:09:36.930+05:30

When a process requests the kernel to do something which is currently impossible but that may become possible later, the process is put to sleep and is woken up when the request is more likely to be satisfied. One of the kernel mechanisms used for this is called a 'wait queue'.Linux implementation allows wake-on semantics using TASK_EXCLUSIVE flag. With waitqueues, you can either use a well-known

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-8234933641546059282007-06-05T20:18:00.001+05:302007-06-05T20:19:02.326+05:30

Sometimes, while accessing a shared data structure, one must perform operations that can block, for example copy data to userspace. The locking primitive available for such scenarios under Linux is called a semaphore. There are two types of semaphores: basic and read-write semaphores. Depending on the initial value of the semaphore, they can be used for either mutual exclusion (initial value of 1

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com1tag:blogger.com,1999:blog-1057442733519404176.post-88923740734753833042007-06-04T09:00:00.000+05:302007-06-04T09:01:43.024+05:30

Since the early days of Linux support (early 90s, this century), developers were faced with the classical problem of accessing shared data between different types of context (user process vs interrupt) and different instances of the same context from multiple cpus.SMP support was added to Linux 1.3.42 on 15 Nov 1995 (the original patch was made to 1.3.37 in October the same year).If the critical

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-74332041207763017702007-05-25T15:43:00.000+05:302007-05-25T15:44:38.367+05:30

Before we go on to examine implementation of wait queues, we must acquaint ourselves with the Linux standard doubly-linked list implementation. Wait queues (as well as everything else in Linux) make heavy use of them and they are called in jargon "list.h implementation" because the most relevant file is include/linux/list.h.The fundamental data structure here is struct list_head:struct list_head

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-39021403609080714862007-05-16T14:55:00.000+05:302007-05-16T14:58:27.754+05:30

Interrupts Exceptions and TrapsNormally, processes are asleep, waiting on some event. When that event happens, these processes are called into action. Remember, it is the responsibility of the sched process to free memory when a process runs short of it. So, it is not until memory is needed that sched starts up.How does sched know that memory is needed? When a process makes reference to a place

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-61839122057002550582007-05-16T03:00:00.000+05:302007-05-15T14:29:58.024+05:30

Notes: For most application developers, the majority of the changes made to the Linux kernel between the 2.4 and 2.6 kernel families have little direct impact. Most kernel changes only manifest themselves through increased system performance and capacity. Kernel and system changes that affect how applications spawn and manage other processes and threads are a significant exception to this

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com3tag:blogger.com,1999:blog-1057442733519404176.post-11100399002989495842007-05-14T17:29:00.001+05:302007-05-14T17:34:52.366+05:30

PurposeThis examples shows how to create and stop a kernel thread.The driver is implemented as a loadable module. In the init_module() routine five kernel threads are created. This kernel threads sleep one second, wake up, print a message and fall asleep again. On unload of the module (cleanup_module), the kernel threads are killed.The example has been tested with Linux kernel 2.4.2 on Intel (uni

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com16tag:blogger.com,1999:blog-1057442733519404176.post-31588255935621774362007-05-11T14:09:00.002+05:302007-05-11T14:34:42.460+05:30

Does the idea of writing a Linux device driver sound difficult? Ifyou have some basic programming experience, the task issimpler than you think. Get started with this quick primer ondevice driver programming.What do I need to know about writing drivers?Basic knowledge of kernel compilation, a good deal of programmingexperience in C under Linux and lastly, the right techniques of datastructures,

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-41390214977700339282007-05-09T11:34:00.000+05:302007-05-09T11:42:08.418+05:30

Unfortunately for kernel developers, allocating memory in the kernel is not as simple as allocating memory in user space. A number of factors contribute to the complication, among them: The kernel is limited to about 1GB of virtual and physical memory. The kernel's memory is not pageable. The kernel usually wants physically contiguous memory. Often, the kernel must allocate the

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com1tag:blogger.com,1999:blog-1057442733519404176.post-91379753190616901772007-05-08T09:22:00.000+05:302007-05-08T09:26:18.973+05:30

Notes: Understanding this requires a minimal understanding of the linux kernel. Sometimes I may use the names of functions that are commonly known. If you don't know what they are, a quick Google or grep through the include directory should find them for you. All of the cache related functions I mention can be found in the file /usr/src/linux/mm/slab.c. Some of the numbers

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-37742892409194558962007-05-01T11:42:00.000+05:302007-05-01T16:27:15.440+05:30

1. Introduction IP version 6 (IPv6) is a new version of the Internet Protocol, designed as the successor to IP version 4 (IPv4) [RFC-791]. The changes from IPv4 to IPv6 fall primarily into the following categories: o Expanded Addressing Capabilities IPv6 increases the IP address size from 32 bits to 128 bits, to support more levels of addressing hierarchy, a much greater

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-87286356732665084172007-04-30T12:17:00.000+05:302007-04-30T12:25:27.562+05:30

IPsec (IP security) is a suite of protocols for securing Internet Protocol (IP) communications by authenticating and/or encrypting each IP packet in a data stream. IPsec also includes protocols for cryptographic key establishment.Summary IPsec protocols operate at the network layer, layer 3 of the OSI model. Other Internet security protocols in widespread use, such as SSL and TLS, operate from

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-70386969699982003292007-04-26T12:38:00.000+05:302007-04-26T12:39:15.941+05:30

These are Linux sites maintained by people with lots of free time. Linux Documentation ProjectThe canonical set of Linux online and printed documentation.Linux OnlineLinux information.linux.org.ukLinux information from Great Britain (very good!)Linux InternationalAn organization for promoting the use of Linux.The linux-kernel mailing list FAQAnswers to

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com0tag:blogger.com,1999:blog-1057442733519404176.post-53678593895297097662007-04-25T15:38:00.000+05:302007-04-25T15:41:19.377+05:30

The most common debugging technique is monitoring, which in applications programming is done by calling printf at suitable points. When you are debugging kernel code, you can accomplish the same goal with printk. 4.2.1. printk We use the printk function with the simplifying assumption that it works like printf. Now it's time to introduce some of the differences. One of the differences

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com1tag:blogger.com,1999:blog-1057442733519404176.post-28113842078111183532007-04-24T10:11:00.000+05:302007-04-24T10:17:24.052+05:30

1. Introduction Traditionally, a Unix process is divided into segments. The standard segments are code segment, data segment, BSS (block started by symbol), and stack segment. The code segment contains the binary code of the program which is running as the process (a "process" is a program in execution). The data segment contains the initialized global variables and data structures. The BSS

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com1tag:blogger.com,1999:blog-1057442733519404176.post-48488629976423047992007-04-03T17:55:00.001+05:302007-04-03T17:55:37.656+05:30

Compiling a linux 2.4 kernel. The currently running kernel is 2.4.20-8 and re-compiling it makes 2.4.20-8custom. The steps are:Step 1: make xconfigStep 2: make dep (because it was instructed)Step 3: make bzImage (bzImage is same as vmlinuz, it's renamed to vmlinuz)Step 4: make modulesStep 5: make modules_install (This creates directory /lib/modules/2.4.20-

deepuhttp://www.blogger.com/profile/01535457403268861087noreply@blogger.com26