Friday, August 10, 2018

Ran into this one recently on EL7 (CentOS and friends)

IPv6 duplication address detection leaves link local addresses in dadfailed state after a VM cloning operation.

$ ip -6 addr
1: lo: mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens160: mtu 1500 state UP qlen 1000
    inet6 fe80::4729:d09e:8f22:56c3/64 scope link tentative dadfailed
       valid_lft forever preferred_lft forever
    inet6 fe80::1435:486f:84ad:93ba/64 scope link tentative dadfailed
       valid_lft forever preferred_lft forever
    inet6 fe80::25b4:c63e:38cb:4bcc/64 scope link tentative dadfailed
       valid_lft forever preferred_lft forever

Which led me to take a look at the interface config file

$ cat /etc/sysconfig/network-scripts/ifcfg-Wired_connection_1 | grep IPv6

IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes

The default gen_mode is stable-privacy, which led me to take a look at the RFC for address generation.  In particular, the section on the algorithm.

1. Compute a random (but stable) identifier with the expression:
RID = F(Prefix, Net_Iface, Network_ID, DAD_Counter, secret_key)
Where:
 secret_key:
A secret key that is not known by the attacker. The secret
key SHOULD be of at least 128 bits. It MUST be initialized to
a pseudo-random number (see [RFC4086] for randomness
requirements for security) when the operating system is
installed or when the IPv6 protocol stack is "bootstrapped"
for the first time. An implementation MAY provide the means
for the system administrator to display and change the secret
key.
The systems in question are using NetworkManager, which led to me to here

$ sudo ls -l /var/lib/NetworkManager/

NetworkManager-intern.conf
NetworkManager.state
no-auto-default.state
secret_key
timestamps

There can be a lot of cruft (left over state from cloning) in this directory but the secret_key is what we are looking for.

The easy solution and most correct solution is to simply nuke the Ethernet connection in NetworkManager and recreate it.

In this case, the original sysconfig/ifcfg-interface file didn't have a HWADDRESS configured so a new NetworkManager connection wasn't automatically regenerated when a new vNIC showed up after a clone.

And so we have our root cause...

The lesson: Don't remove HWADDRESS from your ifcfg-interface files.

Saturday, December 20, 2014

Vermont

I took a trip to Vermont recently.  I ate some good food, met some good folks and just generally had a very nice time.

I really wanted to see that part of the country.

Thursday, March 15, 2012

Alternatives

I'm fascinated by the idea of a having a new way to get where I'm going.

It might be a forest trail in an urban park near my house rather than walking the dog on a sidewalk 300 meters and a world away.

Or it might be riding a bike on a trail through my city and seeing an entirely different point of view from that which you get looking out of a car on traveling the streets. Same city, different experience entirely.

Or it even be going out of my way and taking a tourist train from the next city over instead of calling for a ride from the airport :-)

These alternatives are just that - different ways to experience the same places but in a way that feels more connected, more thoughtful and slowed-down.

We humans desire connectedness and in fact we go crazy when we are isolated.

Friday, December 2, 2011

Once in a while

I take a break and let life wash over me . Today is going to be a day for that.

Took the girls to school today. It's amazing how the simplest things can be so enjoyable.

Thursday, August 5, 2010

Google Wave

So sad to see Google throw in the towel on Google Wave.

In retrospect the obvious is pretty clear - the way to get mass wave adoption was to build a really solid bridge between SMTP, IM, and Twitter/ostatus worlds.

Yes, I know people did build those all of those connections and more but the wave team was a fairly small team and they didn't focus on making any of those Google production ready which would have led to people coming to depend on them as a primary inbox type of application.

I still think the concept of a live, read/write, communicating web world is where we are headed.  Wave was definitely ahead of its time.

Sunday, July 4, 2010

Long trip

The trip home was longer than normal. I was able to use public transport the whole way.

On the way home I walked past St. Bernard's church - it was the first day of the combined parish. The bells started ringing and the sky was pure blue on a warm summer day. Perfection!

Tuesday, June 22, 2010

School days

We're meeting with the principal and teacher in a bit...

Saturday, June 5, 2010

iPad

Review -- I think this is a great way to surf at very low power.

Also - reading is immersive enough that I have gone through a couple of books on the thing.

Monday, May 3, 2010

Salt Fork 2010



Tuesday, March 2, 2010

Tap dancing in my PJs

My daughter insisted that I post this.  Not sure why but it's kind of amusing to me.


My daughter insisted that I post this.  Not sure why but I think it's kind of amusing to me.

Wednesday, August 19, 2009

HP PSC 1200 Airport Extreme Leopard

I'm posting because I hope this might save somebody else some time.

Problem - a bunch of USB printers don't work out of the box with the Airport Express base station.

In my case it was an HP PSC 1200. I just bought an Airport Express and thought this thing would be plug and play particularly since I had it printing via Linux CUPS shared via Avahi (bonjour)

Anyway - it was recognized immediately but it wouldn't auto select the driver and the list of manual driver choices didn't include a driver.

The built-in Leopard driver supports direct USB printing. I'm guessing my previous setup was using the Linux CUPS driver but I don't know for sure because so much Mac stuff Just Works :-)

Anyway - the easy fix for HP printers is to run the open source HPIJS driver. See this page

Install ghostscript, then foomatic-rip, and then the HPIJS driver package in that order.

Once that is done, make sure you close out and restart System Preferences and then when you go back into System Preferences the driver should auto detect.

Enjoy!

Saturday, July 4, 2009

Beach day

We went to the beach yesterday with my daughter and her cousin.

The best part was just hanging out with Emi.

Thursday, April 2, 2009

Wednesday, December 3, 2008

And now a word from Paul Vixie

I've had these words up on my wall at work for a little while.  I thought I'd like to stick 'em here also.  It's an interesting comment and I've been thinking about this for some time since I first read it.

This is from the NANOG list on November 2nd, 2008.

the human, as a species in the animal kingdom, is known to be the kind of animal who fouls its own nest and overruns its habitat. the idea of a tipping point, whether it be for CO2 in the atmosphere or polar ice shelves or explosively deaggregated IPv4 routing tables, does not occur in the minds of individual decision makers. instead it's left to us "chicken little" types, and the only way the individual decision makers ever make their decisions on the basis of tipping points is if some kind of "governance" makes them do so.
--
Paul Vixie

Tuesday, September 30, 2008

Google docs publishing to blog - the title is missing

Last time I tried this - the title wouldn't publish.  Let's see what happens this time....

Thursday, September 4, 2008

Webtop applications

Wordpress via webtop shortcut in gears mode running on chrome = decent application experience.

I think Google is pushing the state of the art in the right direction.

Thursday, August 14, 2008

Homestay

We have a new houseguest recently.  A very nice person.

When I was younger, I took advantage of the kindness of five families as a student in a foreign country.

The last few years, I've started to repay that debt by paying it forward.

It's  wonderful world.

Saturday, July 26, 2008

Better late than never IETF

I'm a supporter of the move to the next iteration of the Internet Protocol.  But a little truth in advertising is needed.

The problem with IPv6 is that it can't be rapidly deployed.  IPv4 and IPv6 can't directly communicate due to binary incompatibility on the wire.

The currently recommend migration strategy was for everybody to run both v4 and v6 in dual stack mode. Once major portions of the Internet adopted both then IPv4 could be phased out over time.  Anybody with half a brain can see this is just stupid.  Nobody is going to waste time on v6 if there is no v6 content worth connecting to.  Nobody is going to publish content on v6 until there are people trying to access that content.  Chicken, meet egg, meet chicken.

People will eventually  do this dual stack deployment but only with the barrel of a loaded gun in the form of IPv4 scarcity staring them in the face.  Even so-called geeks have shown a serious lack of interest in IPv6.  Once they do the dual stack deployment they are going to realize that they can't turn off IPv4 for years to come and that is pretty depressing.

Without the geeks leading the way, the natural hesitation of the technology followers means the whole transition will fester until the pain gets pretty great.  I still see this as a strong possibility.  I've never seen so many geeks fail to lead on a critical technology issue like this.

The IETF, having finally realized that having no serious transition plan was a one way ticket to a busted Internet, have started looking at NAT options for enabling IPv6 only devices to communicate with IPv4 devices.

IETF had previously come up with several transition mechanisms including at least one (NAT-PT with DNS application layer translation that were workable) but had decided to obsolete them!!!  To be fair this is a fairly nasty technique but we have to keep the goal front and center - migrate quickly to IPv6 with minimal effort and disruption and turn off IPv4.

Ironically - it wasn't until IETF starting dogfooding IPv6 that serious discussions about what it would take to get to single stack IPv6 end result started happening in earnest.  I don't want to discount the years of discussion that went into IPv6 development but it's obvious now that people weren't being realistic.

D.J. Bernstein was discussing the fundamental binary incompatibility and content issue years ago but he didn't make a serious dent.  He would have preferred binary compatibility which would have probably meant a bunch of applications had to be changed but that work had to be done anyway but it would almost certainly have meant that we would be well into adoption by now.

I tested the "obsolete" NAT-PT option with DNS proxy translation option a couple of months ago and it certainly worked for basic web surfing and email type access but getting it compiled and operational was challenging.  We need to make this or the new translation method easy and slap it into consumer routers and Linux/BSD distros and commercial firewalls or proxies so that it can be rapidly deployed.  This will probably involve a bunch of stateful translators being written just like what we have for IPv4 NATs.

I strongly supported the idea of a non-wire-compatible IPng in order to enable improvements to IP.  At the same time, I strongly disagreed with the idea that there shouldn't have been a preferred translation mechanism ready made to be bolted on during the transition and then discarded like barbershop hair trimmings when IPv4 access was no longer needed.

Realistically, IPv4 is so strongly embedded in the Net now that it is going to take 10-15 years to purge most of it.  We can be sure pockets of IPv4 will be running on intranets long past that point like DECnet or IPX still runs today but it should be largely gone from the major backbones.

It will take at least a year and a half for IETF to pick one approach that works best.  The IPv4 crunch will start to hit probably around the same time as people scramble to get the last addresses and prices for IPv4 space start to go up.

If you haven't taken time to enable IPv6 in your network please start playing with it now.  It's not that big a deal to get it working in dual-stack mode.  Once you put a globally routable address on your internal devices you start to get back to the Internet as it was in the old days - every node was directly reachable.  And that end-to-end is a good thing.

Yes we need IPv6 NAT to get the transition done.  And we may need it for a few other things like proxy servers and what not.  But in the end NAT needs to be rarely used.  And we need to close the book on IPv4.

Electric Cars

We use mineral oils, as found in natural deposits, for various purposes.  Cooking, lubrication, manufacturing, and fuel are some of the most important.

Oil as a fuel is probably the most important use, but luckily, it may be the easiest to eliminate.

When used as an energy source oil is really nothing more than a convenient battery.  A battery that came charged but a battery nonetheless.

This is not a new idea, but rather, one that I think is lost on a good number of people.

We have never completed a transition away from oil and natural gas for home heating.

It will be a few decades before that transition is done.  We should try to accelerate this effort.

The same is true of oil as a transportation fuel.  We can see the beginnings of an effort to go to electric hybrids or straight electric cars.  This effort should be accelerated.  Time is of the essence.