June, 2008

Jun 25 2008   3:09PM GMT

Researching Network TAPs - Implementation Day (part 5)

Posted by: Troy Tate
Networking, tools, reporting, DataCenter, DataManagement, WAN, Data security, troubleshooting, Performance, howto, network analysis, Metrics, wireshark, packet capture, research, diagnostics

Hopefully you have been reading about my adventures with implementing a network tap to end network blindness. If not, take a look back at previous entries found here.

When I last left you on this topic, there was a problem plugging in the tap between the router and the LAN switch. I was informed by technical support that the devices needed to be configured with auto-detect network settings. Those settings have now been made and the network tap is now installed and functioning well!

One interesting thing I discovered about the Datacom Systems Singlestream 102 device  is that it will permit network injection through the tap port. What this means is that you can have a host running ntop and listening on the tap, for example, that you can get to without having to install a second nic and publishing on that nic. This is a great thing! It simplifies the configuration of the monitoring host.

So, it looks like my monitoring need has been met and now the real challenge of discovery and ongoing traffic management. Such is life in the network management world.

I will pass on any updates about this network tap as any new information arises from my implementation.

Thanks for your time. Let’s be good network citizens together & practice safe networking!

Jun 18 2008   7:25PM GMT

Did you see this? - 10 Cool Powershell scripts virtual lab

Posted by: Troy Tate
administration, Networking, Security, tools, Microsoft Windows, Development, reporting, DataCenter, DataManagement, Exchange, Microsoft, troubleshooting, Powershell, howto, policy enforcement

Microsoft has some great virtual labs which can give an administrator some quick education over a lunch hour or a short period of time. One of these virtual labs is the 10 Cool Powershell Scripts lab. If you have not started with Powershell, then this may help you get moving in the same direction that Microsoft is moving… back to the command line!

Enjoy & keep your skills fresh.

Jun 18 2008   7:20PM GMT

Did you see this? - Microsoft Assessment & Planning Toolkit 3.1 Beta

Posted by: Troy Tate
administration, Networking, tools, Microsoft Windows, Monitoring, reporting, DataCenter, LAN, beta, Microsoft, troubleshooting, Performance, Metrics, diagnostics

The Microsoft Assessment and Planning (MAP) Toolkit is an integrated platform with tools and guidance that make it easier for you to assess your current IT infrastructure and determine the right Microsoft technologies for your IT needs. It offers easy inventory, powerful assessment and actionable recommendations for Windows Server 2008, Windows Server Hyper-V, Virtual Server 2005 R2, Microsoft Application Virtualization (formerly SoftGrid), System Center Virtual Machine Manager, Windows Vista, 2007 Microsoft Office, and SQL Server. The popular Windows Vista Hardware Assessment readiness tool has now been replaced by the MAP toolkit platform.

Jun 18 2008   7:15PM GMT

Did you see this? - Sysinternals LIVE!!

Posted by: Troy Tate
administration, Networking, forensics, Security, tools, Microsoft Windows, Database, Monitoring, Development, web, reporting, CIO, DataCenter, DataManagement, WWW, WAN, LAN, Data security, Policy, Microsoft, website, troubleshooting, Performance, howto, network analysis, awareness, diagnostics, Sysinternals

If you’re a fan of the Sysinternals tools, check out the beta of Sysinternals Live, a service that makes it easy for you to execute Sysinternals tools directly from the web without hunting for and manually downloading them. Simply enter a tool’s Sysinternals live path into Windows Explorer, or at the command prompt as \\live.sysinternals.com\tools\<toolname> or view the entire Sysinternals Live tools directory in a browser.

If you have not used these tools yet, then you are definitely missing a critical item for being successful in your IT position. Check them out… it may save your reputation some time!

Jun 18 2008   5:26PM GMT

Did you see this? - Infosecurity Magazine RSS feed

Posted by: Troy Tate
Networking, forensics, Security, tools, Monitoring, web, reporting, DataCenter, WWW, IT education, CA, antivirus, digital signatures, Data security, RSS, malware, SSL, Policy, website, anti-virus, honeypot, botnet, Metrics, research, policy enforcement, awareness

Infosecurity Magazine has a very good RSS feed to keep yourself up to date on events/issues and technologies. Check it out!

Jun 17 2008   2:33PM GMT

Did you see this? - can MY browser do this?

Posted by: Troy Tate
Networking, tools, Microsoft Windows, Linux, Browsers, web, reporting, Mobile, DataCenter, WWW, website, Performance, Metrics, diagnostics

Here’s a great website for testing your browser functionality and understanding the different features of each application.

Thanks for your time. Let’s be good network citizens together & practice safe networking!

Jun 17 2008   2:28PM GMT

Certificates - who do YOU trust?

Posted by: Troy Tate
Security, Verisign, certificate authority, digital signatures, Exchange 2007, Outlook Web Access, OWA, Network Admission Control, Thawte

We are currently going through design and implementation of an Exchange 2007 environment in my organization. Our current e-mail architecture is varied and does not have any version of mail services newer than 6 years old. So, we are learning a lot about Exchange and how it can fit our environment of over 2,200 users globally.

Part of our requirements includes providing access to downlevel clients (Windows 2000 and below) as well as access to remote users. This will be easily accomplished through Outlook Web Access (OWA). As you know, OWA login is usually done on a page with an https or secure sockets layer (SSL) address. The SSL encryption is provided by a certificate hosted on that server. The certificate can be self-signed by the server, signed by an authorized certificate authority (CA) in the organization or by a trusted third-party provider like Verisign or Thawte.

If the certificate is self-signed by the server or by an organizational CA, then somehow the clients need to know about the trusted root or they need to accept the warning that the browser gives when they login to the website. You want the users to understand what trust means or take the question out all together. I vote for the latter. Remove doubt that the certificate is from a trusted source.

For the external OWA connections, we are purchasing certificates from a recognized third-party. I have gone through several iterations of getting certificates though since this is my first time getting these for an Exchange environment. There is a particular “flavor” of certificate known as a subject alternative name (SAN) or unified communications certificate. A great article on this can be found here. (Take note of the root website here. It is one of the best and most readable Exchange resources you will find since it comes from the Microsoft Exchange product team.)

So, I am now in the process of getting these SAN certificates and will be implementing them this week so the errors will go away when users login to these portals since they know and trust the root certificate authority.

The next challenge is to address this same issue on internal private OWA servers. We will be implementing a two-tier enterprise CA architecture using an offline root and a single enterprise CA. We will be publishing this through Active Directory so the clients recognize this as an internal trusted root. We are then positioned to use this CA for other uses: digital signatures, S/MIME, 802.1x, device authentication and other uses.

As you can tell, this has been a lot of education and work for my company. We have had some help in these efforts since this is entirely new to us and we have to implement it successfully the first time. I will let you know how things go.

Thanks for your time. Let’s be good network citizens together & practice safe networking!

Jun 17 2008   2:05PM GMT

Did you see this? - Online e-book library

Posted by: Troy Tate
administration, Networking, Storage, Security, SAP, Oracle, Microsoft Windows, Linux, Database, Virtualization, Development, SQL Server, web, CIO, Mobile, DataCenter, DataManagement, IT education, WAN, LAN, Exchange, website, Performance, howto, network analysis, Metrics, research, awareness

Check out this digital online library for IT professionals. Bet you can’t read just one!

Thanks for your time. Let’s be good network citizens together & practice safe networking!

Jun 6 2008   7:19PM GMT

Did you see this? - Is it Up/Down or is it just me?

Posted by: Troy Tate
Networking, tools, Monitoring, web, reporting, DataCenter, WWW, website, troubleshooting, Performance, network analysis

This is a great website to test if a public website is responding. http://downforeveryoneorjustme.com/ I am not sure what mechanism it really uses to test if a site is responding, if it is a ping test or if testing actually does an html GET. Anyways, this site may be a worthwhile addition to your network troubleshooting toolkit bookmarks.

Thanks for your time. Let’s be good network citizens together & practice safe networking!

Jun 4 2008   7:26PM GMT

Researching Network TAPs - Strike 1 (part 4)

Posted by: Troy Tate
Networking, tools, Monitoring, reporting, DataCenter, DataManagement, LAN, Performance, Network TAPs, howto, network analysis, Metrics, packet capture

Yesterday, I received my Datacom Systems Singlestream 102 network tap. I installed it during lunch and wouldn’t you know, something started not working right on the network! Hmmmmm… maybe I should have tested this before putting it on the live network…. well… lesson learned.

You ask “What stopped working?” Let me tell you my friend… everything stopped working! Well, actually, to the users it seemed that way. It was as if I had a bad cable between the LAN and the router. Users were reporting slow performance due to packet retransmissions  and the LAN switch and the router were taking errors on the internal ethernet ports. Not a good situation!

So, strike 1 on the SS102. I called Datacom technical support and found out they were closed after 5:30 PM EST. It was now 8:15 PM EST. I left a message with details of what I was seeing on the network.

The next day, around 9:00 AM I tried calling Datacom technical support but received a message that all office staff were in a mandatory company meeting. A short time after this, I received a return call from a very good support engineer. We discussed my application and how I went through troubleshooting the situation. His current suggestion is rather than set the router & LAN switch ports to 100/full to set them to autosensing and ensure that portfast is enabled (this is a Cisco LAN switch). So, that is where I am now. I need to make a network maintenance window to make this change and try once again installing the Singlestream 102.

Stay tuned. More to come.

Thanks for your time. Let’s be good network citizens together & practice safe networking!