Fun hardware - first results

Testing the Fusion-io ioXtreme 80GB (/dev/fioa) vs Intel X25-M gen 2 160G (/dev/sda). The non-directio dd went cpu-limited for some reason, needs looking into.

792 MB/s read speed at 12% cpu use in the directio case looks a bit promising :)

# dd if=/dev/fioa2 of=/dev/null bs=1M
26723+1 records in
26723+1 records out
28021615104 bytes (28 GB) copied, 201.797 s, 139 MB/s
# dd if=/dev/fioa2 of=/dev/null bs=1M iflag=direct
19792+0 records in
19791+0 records out
20752367616 bytes (21 GB) copied, 26.2142 s, 792 MB/s

# dd if=/dev/sda4 of=/dev/null bs=1M
5157+0 records in
5156+0 records out
5406457856 bytes (5.4 GB) copied, 25.136 s, 215 MB/s
# dd if=/dev/sda4 of=/dev/null bs=1M iflag=direct
6040+0 records in
6039+0 records out
6332350464 bytes (6.3 GB) copied, 26.1701 s, 242 MB/s

Stay tuned, more to come...

Fedora kernel on Ubuntu Lucid 10.04

I had need of a Fedora Core 12 kernel lately. Testing the fun hardware of the previous post.

Turns out that running that kernel with Ubuntu 10.04 userspace is pretty easy. Alien + some dkms invocations are enough.

fakeroot alien kernel-2.6.31.5-127.fc12.x86_64.rpm
fakeroot alien kernel-devel-2.6.31.5-127.fc12.x86_64.rpm

dpkg -i kernel_2.6.31.5-128_amd64.deb
dpkg -i kernel-devel_2.6.31.5-128_amd64.deb

update-initramfs -c -k 2.6.31.5-127.fc12.x86_64

dkms build -m nvidia-current -v 195.36.15 -k 2.6.31.5-127.fc12.x86_64
dkms install -m nvidia-current -v 195.36.15 -k 2.6.31.5-127.fc12.x86_64

update-initramfs -u -k 2.6.31.5-127.fc12.x86_64

update-grub

et voila:

knan@sarevok:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 10.04 LTS
Release: 10.04
Codename: lucid
knan@sarevok:~$ uname -a
Linux sarevok 2.6.31.5-127.fc12.x86_64 #1 SMP Sat Nov 7 21:11:14 EST 2009 x86_64 GNU/Linux

Tease

Now, if only I had the rest of the New! Shiny! computer handy, this would be a very fun weekend... as is, I'll just have to tease and promise benchmarks & impressions in a few weeks' time.

Buona sera!

htrosbif gets better

Alpha 4 is out now.

More signatures, more tests, and even bugs fixed. Imagine.

Git repo: git clone http://anduin.net/~knan/htrosbif.git/

Perl trick-of-the-day - $USER-local modules

Ever been frustrated by CPAN and scared to upgrade modules as root? Been burned by a perl rpm/deb upgrade overwriting your carefully upgraded modules?

Jon Allen brings us the light in a nice, short revelation. And a perl module. Of course.

Install/upgrade local perl modules in a user homedir, with basically no extra effort. Brilliant.

introducing htrosbif

htrosbif - Active HTTP server fingerprinting and recon tool

What does it do?

knan@viconia:~/ak-git/htrosbif.git$ ./htrosbif http://localhost:8525/
Match (1200/1200): pound-2.4.5.sig => jetty-4.2.19.sig
Match (1193/1200): pound-2.4.5.sig => jetty-4.2.24.sig
Match (1076/1200): pound-2.4.5.sig => jetty-4.0.6.sig
Match (1042/1200): pound-2.4.5.sig => jetty-4.1.4.sig
Match (1039/1200): pound-2.4.5.sig => apache-1.2.6-php3-used.sig
Match (1033/1200): pound-2.4.5.sig => jetty-3.1.8.sig
Match (1010/1200): pound-2.4.5.sig => jetty-3.0.6.sig
Match (1000/1200): pound-2.4.5.sig => tomcat-4.1.40-oldconnector.sig
Match (1000/1200): pound-2.4.5.sig => tomcat-5.0.30.sig
Match (1000/1200): pound-2.4.5.sig => apache-2.2.13-php-5.3.0-used.sig

Does a bit of Recon by Fire, if you will. Prods the web server in all sorts of old, new, basic, fancy, spec-compliant and spec-breaking ways. Tries to characterise both the well-spoken educated responses and the seriously deviant babble it receives in return. Signatures contain no user data, only header names and http-level quirks. A few dozen sacrifical test installs of servers ancient (cern, 1993) and new have survived its tentacles.

As a (very) useful side effect, might detect reverse proxies, http load balancers, intrusion prevention systems and web application firewalls.

Cool! Download?

Sure. http://anduin.net/~knan/htrosbif/htrosbif-alpha-3.tar.gz

$ git clone http://anduin.net/~knan/htrosbif.git/

License?

GPL v3.

Alpha, huh?

Yup. Signature format(s) are still in flux, and sections of the code are just stubs. But it basically works. Sending me signatures isn't very useful yet. Sending me patches, ideas and comments, however... are extremely welcome @ knan-rosbif at anduin.net.

Why?

Because I wanted to see what could be inferred from behaviour alone.

HTTP load balancers like Pound and HAProxy usually are invisible, ghostly presences, subtly directing traffic and shaping conversations - these touches are detectable, if you think to look.

Replacing a Server: header is trivial effort, mimicking protocol handling quirks much less so.

Bad karma

The 9.10 upgrade losing track of /boot and swap (What, uuid? never seen those uuids anywhere, honest! Wanna buy some slightly used /dev/sda* references? Fell off a truck!) and thus failing to boot was a bit painful.

A bunch of games suddenly growing scratchy/stuttery sound problems not evident in jaunty was more painful. Much debugging ensued.

Wondercure: apt-get remove --purge pulseaudio

... if only all social disorders were as easy to correct.