ereOn's questions

We are investigating performance issues in one of our software deployment between our application servers (Windows) and our Redis instances (Linux).

On a 10 Gbits/s link single TCP connections can apparently only reach 10 Mbits/s. Opening several TCP connections allows us to reach a higher bandwitch. UDP does not seem to be affected by these limitations and reaches the full speed of the link. This kind-of make us suspect that some network device (firewall, proxy ?) inside the network causes these throughput differences.

We made those measurements using iperf (same version) on both the Windows servers and the Linux one.

Our networking team however, completely discards those result based on the fact that "iperf is not officially supported on Windows and so the results can't be trusted". At the same time, they deny to provide an alternative tool to do those measurements and claim that "the network is fine".

So my question is: can iperf be reliably used to measure TCP and UDP performance between Windows and Linux servers ? If no, which tool would you recommend ?

For my IT security class summer project, we have to work on different ways to circumvent security measures setup on a school/company network and to explain how these hacks can be detected and avoided.

One of the topics is (please excuse my poor translation):

Albert is connected with his laptop to the school network. He only has access to the world wide web through the school filtering proxy. This proxy is configured to only allow HTTP (TCP 80) and HTTPS (443) requests and some websites (say www.forbidden-forum.com) are filtered out. ICMP echo request/replies are allowed.

What tricks could Albert use to access www.forbidden-forum.com from the school network ? How as a network & system administrator would you detect/prevent those tricks ?

Now I don't ask for answers to that exercise here (that would defeat the whole point of me joining this course and would teach me nothing).

So far I thought of the following tricks:

• Using an ICMP tunnel. Can be detected easily by monitoring an abnormally high amount of ICMP frames.
• Share the internet connection from a cellphone. Hard to detect, especially if the admin have no administrative rights over the students computers.
• Using a VPN over the 443 TCP port. May be detected by monitoring an abnormally high amount of 443 traffic to a particular host (the VPN server), but difficult because it might be legitimate traffic. The admin could try to connect to the same host using a web browser and could however detect it is not a proper web server.
• Have an external web server that acts as a remote browser that redirects everything to www.forbidden-forum.com.

My question is actually about this last point. I think it is possible to have a software that does that but it would have to:

• connect to www.forbidden-forum.com on demand
• replace all URLs in the response document/javascript code to remap to itself such that Albert's computer never actually tries to reach www.forbidden-forum.com directly.
• be able to translate the replaced URLs to their original counterparts.

I would actually love to be able to demonstrate this PoC during the project presentation on the school guest network (which has similar restrictions) but I'd really like to avoid having to "develop" something on my own.

My developer skills are actually not that good and I wonder: is there a software that does something like that ? Perhaps an apache module or configuration ?

My company works on a project were we ship an appliance (a CentOS VM) that runs several services.

Currently this appliance is regenerated every time "manually" but I'd like to improve the process and make it less error prone by automating most of it.

Is it possible to automate the creation of a Virtual Machine (possibly, using VMWare) ? If so, to what extent can this automation go and what tools would I have to use to do that ?

I have a program that, at some point, create/destroys tun/tap virtual adapters.

Obviously, for these specific operations this program requires root privileges.

According to the program specifications, root privileges are dropped as soon as they are no longer needed (I assume after the tap adapter was created).

However, I'd like to secure this even more and to run it as non-root in the first place.

Is there a way of allowing a specific user to just create and destroy tun/tap adapters and leave out all other specific permissions to their default ?

I recently setup a cron on one of my servers to monitor the connection status. Basically a ping is issued every minute and the result is appended with the date to a data file.

I am currently able to fetch the data file trough apache and to generate a graph with gnuplot locally. But I wonder if there is an easy way to do this directly in apache.

I'd like to call some page in apache, which would trigger a gnuplot generation then render the generated file directly.

Do you know any tool/set of tools to help me do that ?

Thank you.

Is it possible (well the real wording should be "Is it correct") to have several IP adresses that belongs to the same subnet, on the same host ?

Here is an example:

#Host 1
eth0   -> 10.0.0.1/24
eth1   -> 10.0.0.2/24
eth1:1 -> 10.0.0.3/24

I have the intuition that this can't work due to routing issues but I'm unable to explain why I think so.

So is this pattern correct ? If yes, is it common ? What can be the problems regarding such a configuration ?