Bryan's questions

I have a server running CoreOS, and my main network interface that gets configured via DHCP gains a carrier and is routable, but never leaves the configuring state. This causes systemd-networkd-wait-online.service to fail. Looking at the journal files for systemd-networkd.service, I see where the interface gets a carrier, but I see no error messages that would help me figure out why it's stuck in the configuring state. Any suggestions on how to debug this?

Below are some relevant details:

core@server ~ $ networkctl
IDX LINK             TYPE               OPERATIONAL SETUP     
  1 lo               loopback           carrier     configured
  2 enp0s25          ether              routable    configuring
  3 docker0          ether              no-carrier  configured

3 links listed.

core@server ~ $ networkctl status enp0s25
● 2: enp0s25
       Link File: /usr/lib64/systemd/network/99-default.link
    Network File: /usr/lib64/systemd/network/zz-default.network
            Type: ether
           State: routable (configuring)
            Path: pci-0000:00:19.0
          Driver: e1000e
          Vendor: Intel Corporation
           Model: Ethernet Connection (3) I218-V
      HW Address: b8:ae:ed:76:f9:cd (Elitegroup Computer Systems Co., Ltd.)
         Address: 10.20.1.10
                  fe80::baae:edff:fe76:f9cd
         Gateway: 10.20.1.1 (ADI Engineering, Inc.)
             DNS: 8.8.8.8
                  8.8.4.4
  Search Domains: localdomain

core@server ~ $ journalctl -r -u systemd-networkd
-- Logs begin at Sat 2016-08-06 23:23:32 UTC, end at Sat 2016-10-08 17:29:00 UTC. --
Oct 08 17:03:41 nm-nuc systemd-networkd[1209]: enp0s25: DHCPv4 address 10.20.1.10/24 via 10.20.1.1
Oct 08 17:03:41 nm-nuc systemd-networkd[1209]: enp0s25: Gained carrier
Oct 08 17:03:41 nm-nuc systemd-networkd[1209]: docker0: Could not set bridge vlan: Operation not permitted
Oct 08 17:03:41 nm-nuc systemd-networkd[1209]: docker0: Failed to assign VLANs to bridge port: Operation not permitted
Oct 08 17:03:41 nm-nuc systemd-networkd[1209]: docker0: Could not append VLANs: Operation not permitted
Oct 08 17:03:41 nm-nuc systemd-networkd[1209]: docker0: IPv6 enabled for interface: Success
Oct 08 17:03:38 nm-nuc systemd[1]: Started Network Service.
Oct 08 17:03:38 nm-nuc systemd-networkd[1209]: lo: Configured
Oct 08 17:03:38 nm-nuc systemd-networkd[1209]: enp0s25: IPv6 enabled for interface: Success
Oct 08 17:03:38 nm-nuc systemd-networkd[1209]: Enumeration completed
Oct 08 17:03:38 nm-nuc systemd[1]: Starting Network Service...
Oct 08 17:03:36 localhost systemd[1]: Stopped Network Service.
Oct 08 17:03:36 localhost systemd-networkd[350]: lo: Lost carrier
Oct 08 17:03:36 localhost systemd[1]: Stopping Network Service...
Oct 08 17:03:35 localhost systemd-networkd[350]: lo: Configured
Oct 08 17:03:35 localhost systemd-networkd[350]: eth0: IPv6 enabled for interface: Success
Oct 08 17:03:35 localhost systemd[1]: Started Network Service.
Oct 08 17:03:35 localhost systemd-networkd[350]: Enumeration completed
Oct 08 17:03:35 localhost systemd[1]: Starting Network Service...

I'm wanting to stress test an application I've written that takes in mirrored network traffic using Bro and processes it. I'd like to generate the traffic and present it to Bro in a way that's as similar as possible as what a mirrored switch port would do in production. I'm assuming mirrored packets are encapsulated in an Ethernet packet and sent out the configured egress port, but I don't know the specifics at all.

Can someone explain to me or point me to some documentation that describes the technical specifics of how mirrored packets are encapsulated and sent to the receiving party? My ultimate goal is to write a custom traffic generator to facilitate this unless something already exists. I don't have any captured traffic to replay, so I'm fine with having to craft the actual packets to be mirrored. I just need to figure out how to accurately simulate the mirroring of the packets.

I'm using the following to try and install a Rubygem with Puppet.

package { 'reaper':
  ensure           => 'installed',
  provider         => 'gem',
  source           => 'http://192.168.1.101:9292/',
  install_options  => ['--no-ri', '--no-rdoc']
}

When I run puppet agent --test I get the following error.

Error: Execution of '/usr/bin/gem install --source http://192.168.1.101:9292/ reaper' returned 1: ERROR:  While executing gem ... (NameError)
    uninitialized constant Gem::RemoteFetcher::OpenSSL

Error: /Package[reaper]/ensure: change from absent to present failed: Execution of '/usr/bin/gem install --source http://192.168.1.101:9292/ reaper' returned 1: ERROR:  While executing gem ... (NameError)
    uninitialized constant Gem::RemoteFetcher::OpenSSL

However, when I run gem install --source http://192.168.1.101:9292/ reaper as root from the command line the gem installs just fine.

Anyone have an idea of what's going on? Does the Puppet agent get executed with some different environment variables that could be causing this error?

===== EDIT =====

Here's some additional information about the environment:

#output from `grep libssl /proc/{irb pid}/maps`
b70e0000-b7131000 r-xp 00000000 08:01 393357     /lib/i386-linux-gnu/libssl.so.1.0.0
b7131000-b7133000 r--p 00050000 08:01 393357     /lib/i386-linux-gnu/libssl.so.1.0.0
b7133000-b7137000 rw-p 00052000 08:01 393357     /lib/i386-linux-gnu/libssl.so.1.0.0

Ruby and RubyGems (installed via aptitude install rubygems):

# ruby -v
ruby 1.8.7 (2011-06-30 patchlevel 352) [i686-linux]

# gem env
RubyGems Environment:
  - RUBYGEMS VERSION: 1.8.15
  - RUBY VERSION: 1.8.7 (2011-06-30 patchlevel 352) [i686-linux]
  - INSTALLATION DIRECTORY: /var/lib/gems/1.8
  - RUBY EXECUTABLE: /usr/bin/ruby1.8
  - EXECUTABLE DIRECTORY: /usr/local/bin
  - RUBYGEMS PLATFORMS:
    - ruby
    - x86-linux
  - GEM PATHS:
     - /var/lib/gems/1.8
     - /root/.gem/ruby/1.8
  - GEM CONFIGURATION:
     - :update_sources => true
     - :verbose => true
     - :benchmark => false
     - :backtrace => false
     - :bulk_threshold => 1000
  - REMOTE SOURCES:
     - http://rubygems.org/

SSL (installed automatically):

# aptitude search ~i | grep ssl
i A libssl-dev                      - SSL development libraries, header files an
i A libssl-doc                      - SSL development documentation documentatio
i   libssl1.0.0                     - SSL shared libraries                      
i A openssl                         - Secure Socket Layer (SSL) binary and relat

# aptitude show libssl1.0.0
Package: libssl1.0.0                     
State: installed
Automatically installed: no
Multi-Arch: same
Version: 1.0.1-4ubuntu5.9
Priority: required
Section: libs
Maintainer: Ubuntu Developers <[email protected]>
Architecture: i386
Uncompressed Size: 2,748 k
Depends: libc6 (>= 2.7), zlib1g (>= 1:1.1.4), debconf (>= 0.5) | debconf-2.0
PreDepends: multiarch-support
Breaks: openssh-client (< 1:5.9p1-4), openssh-server (< 1:5.9p1-4)
Description: SSL shared libraries

===== EDIT #2 =====

I'm wondering why I'm even encountering an OpenSSL error... the source I'm using is http, not https. Thoughts?!

I been given a Dell T5500 Workstation that used to be maintained by a gentleman that no longer works at the company I work for. The workstation has a BIOS admin password as well as a BIOS boot password that are not the same. I know the boot password because I used the machine prior to him leaving but failed to get the admin password from him.

I need to install a new OS on the workstation, but I'm not given the option to boot from CD before or after the BIOS boot password prompt. I assume this is because the option was either disabled in the BIOS or because it's not presented when theres a BIOS boot or admin password present. I figure my only way around this is to flash a new BIOS on the workstation which is probably a good idea since I currently have no way to make changes to the existing BIOS.

What's the process for flashing the BIOS on a workstation such as this? Is a floppy drive needed (this machine doesn't have one)? Is it even possible if I don't have access to the current BIOS settings?

I've got three different applications running on the same Windows Server 2008 R2 machine that communicate with eachother over TCP/IP. All three applications use the actual IP address of the server (vs using the loopback interface), which is 192.168.106.1.

When I run Wireshark on the server, I do not see any of the traffic going between the three applications. I added a route to the server to forward traffic destined for 192.168.106.1 to my LAN's gateway, in which case I now see SYN packets for the traffic. However, I don't see anything come back.

Bottom line is... has anyone had success capturing local traffic on a Windows Server 2008 R2 machine?

I'm using an Ettercap filter to detect a query response coming back from a particular service on a remote machine. When I see a response from the service, I'm searching through the data in the packet to see if an offset is a specific value, and if so I'm changing the value at another offset.

Trouble is, when I try this on a new virtual machine I built my Ettercap filter's no longer getting any data in the DATA.data variable available to it.

if(ip.proto == TCP && tcp.src == 17867) {
  msg("Response seen!\n");

  if(DATA.data + 2 == "\0x01") {
    msg("Flag detected!\n");

    DATA.data + 5 = 0x09;
  }
}

The filter's getting applied to the traffic because "Response seen!" messages get printed out by Ettercap. However, "Flag detected!" messages do not. I think DATA.data is indeed empty because if I change my second "if" statement to check for DATA.data == "" then the "Flag detected!" message gets printed.

Any ideas why this may be happening?!

Also, if this is the wrong site to be asking questions like this, please let me know. I wasn't sure if it fit better here or somewhere like superuser or serverfault.

By the way, this is a cross-post from StackOverflow... I should have posted on this forum instead I think. :)