FTTC Install - What's involved

 

 

Firstly, what is FTTC, Fibre To The Cabinet is a service that BT is rolling out throughout the UK to provide stable, fast broadband to home users without requiring additional equipment to the customer premises (* ignoring BT VDSL modems). The service to the client premises is still delivered over the standard copper pairs used for PSTN provision, in the same way ADSL and ADSL2+ are, and it uses the same basic technology of frequency shift to 'shift' the data bits into a higher frequency range. The separation of this at customer premises takes place within the BT master socket, which is replaced during the installation of FTTC by a BT engineer. At the other end of your line things change quite dramatically.

In ADSL/ADSL2+ the BT copper pairs go from your master socket to a junction box in the street (the street cab), this then can pass through other street cabs/junction boxes (as mine did) and then eventually ends back in a BT exchange on a Main Distribution Frame (MDF). From here your line goes into an ADSL line card which is part of the DSLAM and provides the mo-dem part (modulation, de-modulation). This then turns into a 'regular' ethernet-like connection and will be fed back to BT Wholesale via their fibre connections to the exchange.

In FTTC the street cabinet is upgraded and takes a fibre connection from the exchange. The street cabinet then has the fibre-to-copper hardware inside it and this then uses the copper pairs to your premises to transmit the broadband. This reduces the distance the copper pairs are transmitting the data signal, and therefore provides much higher quality and therefore potential speeds. It is this key change that provides the improvements to the broadband provision, stabilises the connection and generally offers a higher quality service. The downside is that BT have to 'blow' fibre to the street cabinets, and upgrade the cabinets to support the active (i.e. powered) equipment to do the work (which was previously in the exchange).

The actual install to the end-user is pretty painless (your mileage may vary!). In my instance my current ADSL2+ service dropped around 20-30 minutes into the engineer visit window that had been scheduled (BT engineer had phoned confirming his attendance at the alloted time), and shortly afterwards he turned up to change the faceplate and do his work. The install was pretty quick. Removal of the existing BT master socket. Installation of the new socket. Connection of test equipment the BT engineer could then verify the signal quality and the potential speed of the circuit. Then installation of the BT supplied VDSL modem, and finally checking that I could authenticate over PPPOE.

 

The new installed BT master socket with integrated VDSL socket:

 Top socket is the VDSL socket, and the one parallel to the screws is for your PSTN phone (Which I don't use)

This is a snap of the tester the BT engineer uses, it shows the line sync and status on there and gives you your first indication of what your speeds should be like, etc.

 

This is the BT Openreach modem that the BT engineer supplies and for now is required to be installed. This isn't a router or anything smart, its a very simple modem, the LAN1 port presents a PPPOE connection for you to handle authentication, etc, to your ISP. All other ports are blocked off and not in use on the device.

Note this is the newer BT VDSL modem that is now being supplied in most installations. Earlier models were common to overheating, and had also had their firmware cracked open so the average user could log into them and view line stats, tinker about, etc. BT therefore started to replace their shipped/installed modem (generally cited as due to the overheating fault). Also note that most installs BT will attach this modem to a wall to help with cooling/circulation. You generally should NOT run it sitting on a carpet like you see in my pic! But as you can see its not powered on in the pic. The unit does get warm pretty quickly so beware of this!

An attempt at a close-up of the sockets:

My phone didn't do a very good job of this picture. Basically the ports are: DSL in, LAN1, LAN2 (blocked off), RESET, BBU (blocked off).

 

You would then plug your router in supplied by your ISP into the LAN1 port and wait for it to auth up.

Since I like to tinker, I went a little further and have removed the BT modem and installed my own, this allows me to view line stats, and generally have a closer view of what is going on over the VDSL connection. I'm using the vigor 2750n which I've found to be a very capable little router. Setup is a little more in-depth than defaults so here are the settings you'll need if you're doing the same.

Firstly, firmware update. I'm running 1.5.2_Beta so you need that or newer (Older ones don't always sync up correctly and will sit with their DSL light flashing constantly).

Then go through the Quick Start Wizard, this steps you through the usual stuff. When it comes to WAN, DO NOT CHOOSE DHCP (This is a little confusing), you want to choose PPPOE, as it will then give you the chance to put in your login and password provided from your ISP.

You then need to login to the web interface again, choose WAN and Multi-VLAN. In here you need to enable Multi-VLAN setup and in the WAN VLAN ID box put in 101. This is a BT wholesale FTTC setting, so I can only comment on this install. You might need something different if you are with a LLU or other provider.

Save it all up and you're good to go. By default the Vigor will do NAT, DHCP and all the other usual stuff. In my case I get a /30 allocated and run a server behind my connection so I want to remove NAT and do routing. This is pretty straight forward on this router too, just go into LAN and General Setup, and in the "For IP Routing" enable that and enter in your public IP address allocated by your ISP along with your subnet mask. Disable DHCP (not needed) and save that. This will then setup your router to route! One thing to bear in mind though, the router will still answer on 192.168.1.1 on the LAN and will still do NAT for this range, you can tweak this and lock this down further in the setup but most Vigor docs recommend against this for some reason.

I hope this has helped you setup FTTC or at least given a bit more info. If you've got any questions feel free to comment/drop me an email.

 

Breakinguard - How old is it now!

  As some of you may know, a long time ago I had a need to block persistant password attackers from various servers I managed (Working for a relatively large domain hosting company at the time), and because iptables didn't exist, ipchains wasn't everywhere I wondered what to do. I was learning Perl primarily through automating jobs at my job, and so I decided to write a little script that would 'watch' certain logfiles for attempts at gaining entry via repeated password or dictionary attacks. If the attack tried several attempts within a certain time-period, and from the same source IP, then flag it up, alert and then block using one of a few techniques. Not fool-proof, not perfect but it did the job.

Perl had a handy module called File::Tail that does exactly the same (sort of) as doing a tail -f /var/log/blah in the linux shell, so just run that in a script, watch for certain patterns and act accordingly. At the time the blocking action was either add an ipchains block rule, or add a route entry pushing the offender to the loopback interface. OK so this wasn't going to stop them DOS'ing us, etc, but it kinda did the job, and at the time internet connections weren't huge, if I remember rightly we had a 4Mb line or something like that, that was for a large domain hosting company, none of this 50Mb to the home, fibre or gigabit connections! So it did the job nicely.

Well, I started to install it on more and more servers that I looked after, or helped to look after, people asked about the script and slowly I started to pass it around, just by email at first. So I then decided to package it up and distribute it. My first bit of 'freeware'/GPL software was born! The software existed quite some time before it, but the official publication date was 5/5/2005 as that was when the package was created, however the release date that you'll see most other places was 27/7/2005 as that was the date that I released it on sourceforge.net

The original code is still up there, but don't look! It's horrible perl code, badly written, but it does the job!

Just looking on sourceforge.net at the site http://breakinguard.sourceforge.net/ you'll also see very poor HTML design (something I can still never shake off, my design eye is terrible!) The release up there now is dated 08/01/2008 version 0.11 and hasn't changed a great deal since the original to be honest, a few filters and a few nicer tweaks and thats about it! I belive it is still used in some places, but to be honest its had its day.

Now, a lot of people would use simple iptables, as you can do the same natively such as:

</p>
<p>iptables -A INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set</p>
<p>iptables -A INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP</p>
<p>

Which does the same thing really, so I think my software is dead or dying! If you do still use it, do pop a comment on or a mention as I'd appreciate it. Unfortunately I doubt I'll be doing any further updates to it, but will keep it live just for historic reasons rather than anything else!

 

Central Heating twiddles

 So recently I've been noticing that the heating in the house is on what seems like a lot of time, the radiators aren't always as hot as I'd expect and generally the house is a bit chilly. Now this is during the coldest time of year where I live in the UK, so temperatures outside are dropping to 1 or 2oC overnight and during the mornings not getting far beyond that. With everyone in the house out during the day I'm unsure what it goes to during this time, but on evenings/overnight is when we notice it. So I started to watch how the heating was setup and then started tinkering!

We use a gas-fired central boiler (not combi), that has timed on/off schedules for heating and hot water. The hot water/heating switch is done by changing the valve setting from the pump circulation (i.e. when hot water is set to on it will divert some/all of the heating hot water circulation into the hot water tank). So my first observation is that when heating and hot water are on at the same time then surely this will halve the efficiency of doing one or the other jobs quickly.

Radiators in each of the rooms, the majority have TRV (Thermostatic Radiator Valve)'s fitted on them, and have a 0-6 scale for setting the desired temperature. Most of these are set to maximum all the time. Only two radiators do not have TRV's, these are both in the living room/dining room (It's one large area, no partition walls, etc). This is also where the temperature room thermostat is located.

There is a single room thermostat in the dining room, this is a digital/electronic temperature sensor running off two AAA batteries (annoying when they run out), that switches the heating circulation on and off depending on the ambient temperature.

The other little niggle is that the house is quite open-plan. The downstairs is a large living room/dining room, open to the staircase, and obviously up to the upstairs landing. Therefore the majority of heat (in my limited knowledge) will escape straight upstairs to the top of the stairs! Not ideal.

So, my first steps were to change the heating programmer, to get different on/off times for the heating and hot water cycles, and to prioritise heating by only switching hot water on after I've giving the heating a chance to warm the place up. So I opted for 3 on/off sequences during the day. First one for when we get up on a morning, on 5am-8am heating only. Then for when we get home, 3am-9pm. Then one to keep the chill off at 10pm-11pm. I went for hot water going on once daily from 4pm-8pm. So that seems to keep the heating happily running and not letting the house get too cold, as I think that was an initial problem, the house dipping way too cold, so taking the heating too long to warm back up.

The room thermostat was then set to 20.5oC as that seemed a reasonable temperature that is warm but not boiling. This I think might not be helping things, as I think this might need to be higher, but more on that later.

I then attacked the radiators and the TRV's, as I know I had one of these fail in the kitchen and jam closed, so that TRV was removed, so that radiator is just on full all the time. A few of the radiators needed bleeding, so did that for a few days to make sure we didn't have any problems with air in the system. I then turned ALL TRV's down so they weren't sitting on maximum. This was because a few websites I had read stated that running a TRV at maximum is bad for the valve and heating system (can't find the quote to cite now, if you know please comment/post back!). Then went round each of the rooms and changed the TRV depending on if the room should be hot/warm/cold, the majority of bedrooms I set on 5 (one off maximum), bathrooms a little below that and thought I'd leave it at that.

Unfortunately the heating still wasn't really doing what I wanted, the children were complaining of a cold bedroom during the night/morning, our master bedroom got red-hot at night and early mornings, and the rest of the house was warm! So that didn't quite work it seems. My next discovery were the next generation of programmable TRV's. These you can set times/dates and temperatures and the unit will vary that individual radiator based on this. I thought this would be ideal for the master bedroom, as during the day/early evening it was pointlessly heating the room. So I purchased a programmable TRV from a heating/electronics firm in the UK (I'm not going to name them here, as I found their service SHOCKING, it took 2 devices and me piecing the working parts from the two together to get a single working TRV. Not impressed!).

I ordered "Radio energy-saver regulator" which is a german-manufactured device that simply plugs into your standard TRV fitting, so no draining the system, etc, just unscrew the old TRV top off and this on. You program it either via its LCD screen, or you can also use the USB computer programmer, which I chose. You then set what time-periods to use, temperatures and set it going. This has made a huge difference to the master bedroom, although some further tweaks to the schedule are needed as at the moment its like living in the antarctic! But that could also be due to the overall heating turning off too soon. Obviously the TRV will only heat the radiator up when three conditions are now met. The main heating timer is on, the downstairs thermostat is set to heat and the programmable TRV decides that its schedule and room temperature say it needs to heat. Unfortunately it has no control over the first two conditions, so therefore if the sequences aren't matched, then this fails, and I suspect this is where I'm going wrong at the moment. I'm setting the TRV schedule to warm the room before we retire to the bedroom, but at this time the rest of the house is warm enough, so the thermostat on the heating has cut out, so although our TRV wants to heat the room, it can't as the heating isn't firing. So more tweaking is needed here!

 

And thats about where I'm up to. I need to do some more tweaking with programs and temperatures to get things right, but I'm happy that I have much more control and I believe I can see where the problems are on the system now!

Self-Fit Rear Parking Sensors on the Grand Voyager

When I bought the Chrysler about 11 months ago, I shortly after bought a rear parking sensor kit with colour-matched sensors, thinking that I'd need it in such a big car. Well, its actually not a bad car to drive and park, but I'm still pretty bad at judging distances, so I had a good few hours spare this afternoon, the kids out, etc, so thought I'd give it a go and document what I did along with photos.
The first stage that I had to do was work out how everything would fit together, where it would position best and follow the instructions for positioning the sensors. The kit itself was straight forward, it had 4 sensors with removable connectors, then several lengths of labelled cable (labelled A, B, C, D), a control box and small display. This is the control box and display that came with mine:

So, the thing that I thought would be best, would be to get all of the sensors and somehow attach them to the bumper, see if my calculations looked correct before I drilled my precious bumper (That bit REALLY scared me, as if that went wrong, its time to buy a new bumper!). So I tried a few different ways of temporarily fastening them, all failing because the back of the sensor had the cable fitted directly to it, no flushed mount cables or anything like that,  so trying to attach it to a flat surface didn't really work. So, I then realised, the box that they came in had a plastic packaging tray, that if I cut up would work perfectly! Who said I didn't have good ideas sometimes ;-) So I fasioned that up and attached them with simple double-sided tape:

As you can see, the sensor dangling, and my make-shift mounting bracket. Looks classy!
So, I fitted them all on like that to see what positions, etc looked ok, and it didn't look too bad:

  

So after that quick test, I powered it up using an old 12v battery I had lying about (Old burglar alarm batteries are good for this, I used a battery I'd removed from an APC UPS recently. When you do this though, check the voltage with your multi-meter first as they don't label what voltage they run at. Make sure its 12v!).
So a quick power-on showed the sensors all working, and the distance was showing up with 0.5 which I assumed was correct as I was reversed up against my garage. One thing I did notice however is that the sensors slightly pointed downwards, which may be a problem, so something to watch for otherwise I'd guess it would generate erroneous results.
I then thought that the testing had worked fine, so time to go for broke, and work out how to remove the bumper. As this is a big American car, generally its put together pretty easily, and I'm glad to say the bumper was quite simple to remove. Firstly you open the boot, then inside the wheel-arch you'll find 3 screws, this poses a problem, the screws are around 2inches away from the rear tyre, so no screwdriver I had would fit. But improvisation, this is where a small screwdriver attachment (the ones you put on drills to electric drivers) and a spanner, grab the attachment in the jaws and you can manage to slowly remove the screws. Once all three are out, move round to the inside of the boot, and you'll see a single screw diagnoally down from the light cluster. Move to the opposite side and repeat this process. That's all the main screws undone, now for the REALLY tricky ones, underneath there are 4 push-clips. I took a picture of these as they are probably the most challenging part of the operation!
 

The way I managed to remove these, was firstly to use a flat-headed screwdriver to start to prise the clip out (push between the black clip and the silver bumper). Then as it starts to give, use the screwdriver to lever it, then finally finish by pulling it very hard with your hands. It's about the force you think you'd need to break/snap it! But it eventually pops out. The clip is just made of a load of ridges, so it just grabs all the time, I couldn't see a simpler way of removing them, and mine survived so hopefully thats all there is to it! Once those four were out, the bumper could be removed by returning to one of the wheel arches, and gently prising the bumper away from the bodywork (you'll notice the ridge), once that's removed go to the other side and remove that, then pick up the whole bumper and it will come away easily.

 
Here I've removed the bumper, and you can see the slightly odd site I found behind it, this is a polystyrene cover over the metal girder that is the main bumper, not what I'd expected but this looked like it might prove a problem. The problem was that the polystyrene would be right in the way of the sensors. Since I couldn't think of a solution I bashed on, and thought that I'd be able to solve this later.
I then used the drill-bit that was supplied to drill the holes where I'd measured. This worked fine, so I then fitted the sensors in, and they looked pretty neat!
 

So once this was all fitted, where to run the cables. I assumed that there must be a way of feeding the cables for a tow-bar into the inside cabin of the car, so looking around underneath I spotted a rubber plug right in the middle of the car. To find where this went, inside the car I took off the plastic cover that runs along the back (this has the load to this line note on it), this is held on with pop-clips again so just gentle prising let this come up easily. WORD OF CAUTION - Somehow when I did this originally there are two plastic clips at either side that fit the plastic cover onto the rest of the body panels, one of these were snapped/squashed when I removed the cover, I assume this was when I removed it, so be careful when you remove that cover, the sides need to be taken apart carefully!
Once off you could see the rubber bung under the carpet in the boot, so remove the bung and feed the cables in using a small hole to secure it all. It was easier to drop the spare tyre at this point so it was easier to work underneath the car. Feed the cables in, and I decided to hide the small control box inside the jack storage.
Next problem, wiring harness for the reverse lights (This unit is easier to wire straight into the reverse lights, so that it turns on when the car was in reverse), now myself and several others owners had talked about towing and where the tow-cables went, etc. It seems this is a bit of a mystery on these cars, as they all have slightly different wiring methods, where the wiring bundles are, etc. Now whilst taking panels apart, I took apart the plastic trim on the left hand side of the car and found the main wiring loom, and also a large plastic box with most of cables feeding into. Since I couldn't prise the plastic trim any further (I'd removed both screws and popped several clips, but I suspect because of the electric/motor power boot open/close that I wouldn't be able to fully remove the plastic panel without taking apart more mechanics of the car). I gave up trying to look into the electronics box, maybe something to do at a future date as I'm now curious what this is and what it does. So I went for plan B, basically testing which cables carried voltage when the reverse lights were on, and just splice into those. Easily done with the multi-meter, and wired in. Interestingly I also did a web search on wiring tow-bar wiring for these cars, and most of them do a similar job, they simply provide a connector socket and plug, you unplug the lights cluster from the rear lights, plug the cable into the tow-bar loom, and then plug back into the lights (so a man-in-the-middle type wiring). Power to the lights worked fine, and the unit came on no problem at all.
Re-attaching the bumper was simple, just hold the bumper back in place, clip around on the left and right inside the wheel-arch then re-attach the screws. Simple!

 

The whole job took around 3 hours with breaks, so not a particularly tricky one, and hopefully a few tips here will help out if you need to remove the bumper or do anything at the back of your Grand Voyager

More info on Twitter hacks - Twitter itself vulnerable?

 Well, as some of you have been following I've been puzzling and wondering how/why I've had 'hacks' from twitter, and whats going on over there as I suspect the hacks are a little deeper than just my account.

Over the weekend I noticed one of my friends had got hacked and a similar message to mine appeared in their timeline. Out of interest, their twitter name starts with D, so I'm still suspecting this 'hack' is working its way through the alphabet, will be intersting to watch that.

Anyway, this persons timeline showed on mine and my partners list as she had mentioned it to me originally, so I let the person know to change their password and check it out. After 15 minutes they managed to get online and check, and the post had gone, all by itself. It still showed on my cached timeline, but as soon as I refreshed it disappeared.

Now to me there is only one explanation why/how it could have appeared and disappeared by itself. That its twitter itself that has an exploit/vulnerability that somebody somewhere is exploiting, and twitter know about it, cannot patch/fix it (for whatever reason) and have a clean-up routine that goes around 'fixing' the problem by deleting the posts. Now this is ALL assumption and guess-work, but to me its the most plausible reason at present.

So I'm still watching my timelines, watching to see if that application gets automatically added to my approved application lists again and see what happens. If you get/see anything similar in your timeline, or anyone you follow please do get in touch with me, as I'd like to collate/compile the findings.

 

TVHeadend Priority of DVB hardware

 As I continue to use the TVHeadend and XBMC setup I'm starting to find the odd little problem crop up. Most of these are pretty minor and can fix them as I go along (Pause live TV still a major missing element to this, and not one that looks like it'll be sorted soon unfortunately). One such minor issue I found was when setting up hardware adapters that can provide the same channels.

I have two DVB-S cards (Satellite, from my original quad-LNB) and one DVB-T (Terrestrial from the aerial installed in my loft). Now for whatever reason the DVB-S signal/channels show up as much better quality than the DVB-T (Not knowing the technologies, this may be expected due to available bandwidth on the MUXES, or whatever). So if I tune to BBC1 on my DVB-T its worse quality than on the DVB-S. The problem is that the DVB-T card seems to give out a signal quality of 100% all of the time, and the DVB-S can vary depending on weather conditions, etc. So TVHeadend was wanting to use the DVB-T card, and hence we got worse quality pictures.

I noticed in the TVHeadend issue tracker a request to be able to prioritise tuners, which sounds ideal. Basically in a nutshell somebody has modified the code so that you can force in a priority, to add "distance" (Using cisco/network terminology) to the adapter, and so make it less preferable for tuning. Martin Mrvka kindly produced the patch for his code modification so I could download and test it, and so far it looks good.

I've added a distance of 50 to my DVB-T card, and left everything else on defaults. So far it looks to have worked, however I've not fully tested it, so will do so over the next couple of days and see how it goes. Anyone else interested in this can get the patch from: https://www.lonelycoder.com/redmine/issues/343

Don't forget to post back and let him/me know how the patch works, see if it does the job for you too!

MORE Twitter Spam (More Replies from Twitter)

 So, I got another reply from Twitter in relation to my complaint that they're not really reading my replies, and I have actually got somebody who seems to understand what I'm after, but not quite in the context of "There is something wrong, please investigate". Here's the reply I've got:

"

@Kessel about 18 hours ago

Dear Twitter User:

 

If you are requesting your own Twitter account information, please fax us a signed request providing consent to disclosure for specific information (e.g., IP logs), including the username (e.g., @Safety and http://twitter.com/safety) and email address on the account, along with a scanned copy of your valid, government-issued photo ID to 1-415-222-9958.

 

We will send a request-for-consent email to the email address of record for the account, to which you will have to respond affirmatively. Receipt of an appropriate request and an affirmative response to the request-for-consent email will authorize us to release your information.

 

Regards, "

 

 

Hm, So now what do I do, shall I jump through their hoops and see what happens, as I'm really getting curious now what information they'll give to me, and if it will actually give an insight into whats going on!

 

 

MORE Twitter Spam (The Reply)

 OK, so I've got the reply from twitter, and to be honest, its rubbish. They've not read my email, not responded to what I asked or anything. So here it is in full, please feel free to comment on this as I'm not impressed and going to re-open the ticket and chase this further with them:

Twitter Support: update on "My account was hacked by Twitter Mobile Web"

----------------------------------------------
tiger, Jul-25 12:00 pm (PDT):

Hello,

If you think your account may have been compromised, please take these two steps immediately:

1. Change your password. After you log in, you can change your password at http://twitter.com/settings/password. 
Be sure to pick a strong, unique password you haven't used before. If you're having trouble logging in, request 
a new password at http://twitter.com/account/resend_password.

2. Check your connections. Check the Applications tab at http://twitter.com/settings/applications and revoke the 
access privileges of any third party applications that you do not recognize.

This help page has more information for hacked or compromised accounts:

http://support.twitter.com/entries/31796

Please let us know if you continue to experience problems. 

Thanks!
 

Hmm, so not really answering anything of my original message. So back to twitter support I go....

Windows7 Frustrations

 So,

Over the weekend I needed to install a new machine for the community radio station that I help out with. Their current playout system is a WindowsXP Dell machine, thats probably getting on for 7 or 8 years old I'd guess, and has practically been running 24x7 since installed. Originally at one location, and I then relocated it to their new broadcast building about 3 years ago when they got their full-time FM license. Well its about time the machine got replaced as it has everything the station needs to keep running, so I'm a little nervous that it'll fail at some point.

So a new Dell Vostro was ordered. Dual-Core Intel, 2Gb RAM, nice little machine.

So I got to installing it on Sunday, stripped down the pre-installed Windows7 system, removed all the rubbish backup applications, Dell assistance software, all the trialware and junk. Removed desktop wallpapers, screensavers, power management, etc. Basically because this is a radio station playout system you want it minimal as it just has to do one job, but without question! So all that was stripped out.

Then I got to installing the second sound card. I had an old Creative Labs Sound Blaster Live! 5.1 digital surround card, from my old desktop from about 4 years ago. So slapped that in (You need multiple inputs and outputs for playout systems so that the various faders, etc, all have separate sound channels). Booted up, and Windows7 couldn't recognise the hardware. So then starting to trawl the web, CLabs website showed the hardware was discontinued, but you could try their beta Windows7 driver. So downloaded all 40Mb of that (!), installed, and half way through got a windows driver signing error, and windows then decided to remove each of the .sys files the installer had created. No surprise, on reboot the card was partially detected, but "Had a problem", windows couldn't fix.

OK, so I gave up with that, removed the card and will just pick up another cheap PCI card, that had newer drivers, etc. No big problem (Although I'd spent quite a bit of time to now).

Next steps, was the re-create the fiddly filesystem that the playout software "SoundBox" needed. It uses windows shares for all its locations, so I created the relevant audio folders, then the 10 or so storage folders, set each one to have shared permissions with read and write access for network users (Yes I know the security is abysmal but unfortunately SoundBox works like that, so you're stuck with a wide-open system). Did that, so then started to trawl through my archives for the SoundBox installation CD. That took about 30 mins, I didn't realise I had data spread out over so many NAS and storage systems. REally do need to sort that out one day! Found the ISO and related patches and stuff, copied them over to the new machine all ready.

Ran the setup.exe, and immediately Windows7 threw a "This version is not compatible with Windows 7". Arrrgh! So next, try running it through the compatibility troubleshooter (annoying! I knew if I set compatibility to WindowsXP it should work, but it doesn't let you do that anymore, you have to use the stupid wizard!). So ran the troubleshooter, which surprise surprise set it to windowsxp for compatibility, then let me try again. This time it failed saying that the installer couldn't run on a 64-bit machine. Tried a few times with and without admin permissions (just in case!) and no go.

So basically, I'm stuck. The software supplier won't have updated the software, as its pretty much out of existance, no updates and to replace the software now would require hundreds of man-hours in training, not to mention the multi-thousands it costs to buy most radio playout software.

I'm thinking of removing Windows7 and installing WindowsXP now, even though its old, unsupported and the hardware probably won't get on with it very well, this seems my only option for the system. How annoying..... and yes, I seriously am considering re-writing the software to run under Ubuntu now!

 

MORE Twitter Spam

 Well it went and happened again. "I" posted another random spammy comment that mentioned how to make a quick $ by sending people to a dodgy website. Unsurprisingly I didn't send this, and was rather annoyed that its happened again. After the original spam attack I'd changed passwords, revoked access to the twitter mobile application and thought all was fine.

However, its exactly the same attack vector thats been used. Late on Saturday night the app was authorised again: "Mobile Web by Twitter was authorised "Sat Jul 23 2011 20:56:18" GMT. "

Well that wasn't me. And then on Sunday night around 22:30 the spam appeared in my timeline again "check out this article! I made $350 today!"

So this time, I removed the application permissions (again), removed the post from my timeline and have opened a trouble ticket with Twitter to see what happens. Oh and I changed my password to a random series of letters, numbers and extended characters. So we'll see what happens next.

I'm now thinking this IS NOT a password crack thats going on and there is something more deep seated wrong with twitter. The alarm bells are that twitter mobile application is created by twitter themselves, so I suspect an implicit trust is somewhere setup between twitter and their mobile web application, and thats why it automagically gets authorised when a post is made from it. Why or how the actual exploit takes place I'm still really in the dark.

My message to twitter was: (bits taken out for security):

Description of problem: Hi, 

Several times now posts that I have not made are being posted to my timeline. They are all along the lines of "check out this article! I made $350 today!" and a link. 
Each time I've logged in and found it was posted by "Mobile Web", and looking, shortly before it had been authorise to post on my account. I obviously haven't permitted twitter mobile web application permissions, and did not make the post. 
I have changed by password several times now and it still keeps happening. Please can you investigate. If possible can you retrieve the IP address that was permitting the application, and/or making the posting. I can supply screenshots of the hacked timeline and also the application screen that showed Mobile Web by Twitter was authorised "Sat Jul 23 2011 20:56:18" GMT. The post to my timeline was made On Sunday Jul 24 2011 22:24 GMT "

 

So I'm hoping they can get the IP address, as I know the IP addresses I would post messages from, its one of about 4 or 5 so pretty easy to spot if its come from an address outside those. So we'll see what reply I get. I'll post back when I get further, but I'm mega-annoyed now as not very professional looking at all.

 

 

 

 

 

IPv6

 Well, this week I attended the IPv6 course provided by RIPE for LIRs. I hadn't really done any advanced reading or anything in particular before the course, so wasn't sure what to expect.

First a bit of background, at work we have IPv6 enabled on a lot of the network, and slowly progressing to get it tested and ready for deployment. On world IPv6 day we tried to prepare people within the organisation, but didn't really get very far, and I still believe that a lot of people in the company don't believe or think IPv6 is real, or something to be considered. I have to admit, I was a little like this, but know that I need to get up to speed pretty quickly on it!

So along I went to the RIPE course, and wow was I shocked. It was really hard work, and you have to almost totally change your point of view. I've dealt with RIPE and handling IPv4 address-space for around 8 or 9 years now, from my previous jobs where I setup an LIR, came up with address plans, administered the RIPE db. Basically the whole course was based around forgetting what you did with IPv4 and to change your way of thinking.

The main change, is when it comes to address preservation. Whilst you still only dish out what blocks you think are justified, etc, you don't worry as much about the number of IPs or subnets given out, and are encouraged to give out slightly more if you can see a requirement.

For example, the smallest allocation you give out is a /64. That equates to 18,446,744,073,709,551,616 (18 quintillion) addresses. So even for your router link or point-to-point connections, you assign those a /64. Thats probably the bit that I found most tricky to get my head around. Whereby you would normally assign a /30 in IPv4 as you only need the two usable IP addresses, in IPv6 you would assign the /64 and simply use 0000:0000:0000:0001 and 0000:0000:0000:0002 as the addresses (I haven't shortened those or anything, before the pedants point it out!). So apart from that big difference, you then get onto other things.

Such as, how many IP addresses would you give to home DSL users? Would you give them a /64 which you'd argue would be enough for them to never run out of. BUT look at it a different way. What if they wanted further networks BEHIND their link /64. So for example, they had a kitchen network, that their new IP-based fridge resides within, and that fridge has temperature sensors, proximity or other things. You'd probably put that into its own subnet, and then route that over your DSL /64 link network. So, perhaps you would give home users something like a /56 (which is what RIPE suggested), that lets them have 256 /64 networks at home, which again should be hugely over-planned, but would be sensible based around future needs (Think, home alarm systems on one subnet, smart water meters/electricity/gas, home automation, IP-based TV, etc)

The next struggle, is the actual addresses themselves. We're very used to the 4-quad addresses with IPv4, and generally a lot of people can remember these (well I certainly can, I can give out addresses for the company such as DNS, monitoring, core routers, etc, from memory). Well that isn't going to happen with IPv6, you might remember bits of the address but probably not all

Then, you get onto how are you going to implement IPv6 in your network. There are various 6 to 4 techniques, or methods of providing IPv6 space (6in4, 6to4, 6RD, NAT64, DS-Lite) these are all ways of implementing but without running natively. Ideally running dual-stacked is how you want to go, and thats how we're implementing at present, with the odd combination of 6to4 via Toredo when you're in an IPv4 only environment and want to tunnel and get to your IPv6 network. The other key thoughts are how to implement to your customers, as you don't really want to NAT64 or do evil tunneling to your customers, so really you want to work towards dual-stack on your customer connections and then allow the CPE to do IPv6 natively, that makes it clean, but then how do those clients get to somewhere thats only IPv4? You have to run some DNS tricks or otherwise allow them to get to the rest of the IPv4 world. Not simple!

There are lots more foibles and things to add to this, so this is just a starting point. I'll continue to add more as more comes along and as I test out and try out what I've learnt. Along with how to write IPv6 addresses, as there are various shortcuts. But for now all i need to remember is the Onyx IPv6 allocation of 2001:4dc0::/32 double colons indicate suppressing 0's in IPv6 space, so you can shortly the addresses! Neat.

 

Dropbox and Encryption

 This is a subject thats had quite a bit of attention recently. Mainly due to Dropbox changing their terms and conditions of use. Now I'm not a lawyer or understand legal-speak, but what it appears to boil down to is that Dropbox can now open/read/own your documents should they choose to (OK this might be stretching it, but lets look at worst case scenario)

 

So we want to maintain using Dropbox to keep in sync between all your machines, but encrypt the data.

My normal encryption of choice is Truecrypt, as I use that on all my portable devices. However this is great on local machines, it doesn't really scale very well as it creates a single encrypted 'volume' on the target, so in this case would create a huge 1-2Gb file on my Dropbox. So when I changed something, the entire file would appear 'changed' to Dropbox and it would start re-syncing the whole thing. No problem on most of my connections/machines, apart from my rubbish home DSL connection which can barely manage 2Mb download at times, and if you shove too much data over it the PPP session fails and you start the PPP ping-pong at the exchange (Thats a whole different story. Who'd have thought somebody working for an ISP would have broadband problems....)

Anyway, so what I have is my dropbox on my work laptop, my home server and a windows VM desktop. Handy keeping all 3 in sync. My home Ubuntu server keeps a local copy, and does a daily rsync to a local HDD NAS, so I've always got a backup at home. My works laptop is an Ubuntu desktop, and my VM desktop is on Windows 7, so all 3 have to be compatible with the final solution, and as seamless as possible.

 

In comes Encfs, which looks ideal, loads of tutorials for Ubuntu, mac, etc, so looks good, its built on top of FuseFS which integrates with PAM authentication nicely, and there is a handy tutorial for setting up at pragmattica.wordpress.com/2009/05/10/encrypting-your-dropbox-seamlessly-and-automatically/ So that looks fine for my Ubuntu systems.

However the windows machine is still a problem. Looking around Boxcryptor looks like it solves it, as its a windows solution built around EncFS www.boxcryptor.com/support.html and it supports generally.

 

However after setting up my encrypted volume, etc, I found a few problems between the two versions. Firstly my Ubuntu desktop is running an older version of EncFS (version 1.6), which apparently Boxcryptor is incompatible with, so immediately my windows machine fails to connect with the encrypted dropbox with an incompatibility error. Hmph, so looks like I need to get on and do the upgrade of my laptop (I've been holding off on the latest version release).

Will carry this out and see how it goes, so for now I've got encryption all sorted, my linux machines are happy, just not windows. Ah well, a minor price to pay temporarily. I can always get the data from my NAS when I need it I guess.

 

Oh and if you haven't got a dropbox, then sign up via my referrer url at db.tt/0dLLilw Each referrer you send, you get some additional free space, which is nice!

Twitter spam

 Right then, over the past couple of days some of you may have noticed 'me' spamming your twitter timeline with things like "Check out this article! I made $150 today! http://t.co/" and a url on the end there. Well as you can imagine, this wasn't me. And I was INCREDIBLY angry at this, as I'm usually very careful about security, what I login to, what permissions things get, etc.

Now the first time it happened, in my anger I just deleted the post, THEN started looking at how/why/where, etc. Well this isn't the best way to do things as any security analyst will tell you, as you've just destroyed the evidence and also any trace that you can use to find out where/how it got there.

 

Well today at 13:23:33 it happened again, so this time, quickly jumped onto the twitter website, looked at my timeline and clicked the entry, to try and find out what/how I supposedly posted the article. Well interestingly it said "twitter mobile web". Hmm, thats an application by twitter themselves, like a cut-down web version of their service, based at mobile.twitter.com Thats not good news then! Well first thing I did, went to my twitter profile, went to Applications and revoked access to that.

So hopefully that has stopped the timeline spam, but thats got me curious, whats been using my web API to send these messages. Since twitter probably won't give me access to the logfiles, then chances of tracking it down are slim, but I'm still going to do a little background digging.

One is not amused!

 

XBMC hardware

 A quick rundown of hardware I'm using for my XBMC and TV Headend installation:

 

XBMC:

Dell

Intel Core2 1.86Ghz

2Gb RAM

 

TV Headend:

Generic PC

 

XBMC

 The problem: I pay Sky a fortune a month (ok, not as much as some people do, but still), and feel that after I've had several Sky+ boxes fail and Sky really don't care, that there must be a better option.

In the house, we rarely watch sky1/2/3, Sky movies or all the other junk thats on there. We mainly watch the 4 terestrial channels (ignoring 5, who watches that anyway?), Dave and occasionally the other "UK" group of channels (gold, etc). So looking at this and since I already have a Sky minidish, I thought why not go with XBMC and some sort of free-sat backend decoder. Well doing a bit of research and thanks to Andy Newton at work, I was pointed in the direction of TV Headend. Ordering a single cheap satellite decoder PCI card for one of my servers and to get things moving along.

Installed the PCI card, installed a basic Ubuntu server and then TV Headend, and it was quite easy to get working. A few of the settings in TV Headend are complicated at first, until you know the magic sequence to do things in, so here we go:

1. Install TV Headend and go to the web gui
2. Choose Configuration tab, and TV Adapters
3. In the drop-down choose your card (if none are listed, then linux hasn't found the card, or its not V4L2 compatible)
4. Tick Idle scanning and Monitor signal quality
5. Then click Add DVB by network, from the list that pops up Astra 28E, which is the standard Sky transponder/satellite
6. That will have populated the Muxes for you, you now need to wait as it scans them and checks for signal and identification. (You can see this happening, on the GENERAL tab, you'll see Services, Muxes and awaiting initial scan. The initial scan number should keep going down as it detect them. Go to the Multiplexes tab and you'll see signal quality and the list that its found. Generally you should see a good percentage (over 40%) and the network field filled in. Give it 10-15 minutes and see how its got on. I had to delete a few that had errors and just never got values filled in.
7. When Tv Headend is ready, and its identified all the muxes you can press the MAP services to channels button (if its not available, then there are still muxes awaiting initial scan, let it scan, or delete the faulty muxes)
8. Leave TV Headend to map the services to channels - NOTE this generally disrupts watching TV if you're already watching on a different card, etc
9. When done, click on the services tab and you'll see its done its work. Ignore invalid/empty entries, those will be tidied up later
10. Now go to XMLTV and configure that (along with the command-line setup)
11. Finally check under Channels and it should be looking good
12. After XMLTV and TV Headend have sync'd up, go to EPG and you should see data. Then move onto the front-end config

 

That should get TV Headend running. Repeat for each of your decoders. I use a combination of DVB-S (Satellite) and DVB-T (Terestrial) receivers, that way I get the maximum number of channels (some channels are only available on Terestrial) and have the ability to record/playback/watch simultaneously too.

I'll post on next steps to get XBMC and your front-end up and running next time.