Skip to content

Instantly share code, notes, and snippets.

View parseword's full-sized avatar

Shaun Cummiskey parseword

View GitHub Profile

Public DNS Service Comparisons - www.facebook.com

This document is a companion to the article 1.1.1.1: Fast, but not so accurate (yet).

"A" response records for Facebook, and network connectivity and latency to the answers, from Comcast in Memphis, TN. Tests conducted 2018-04-04.

Querying the A record for www.facebook.com, 1.1.1.1 gives a tied-for-best answer, a low latency server in Dallas also returned by Comcast, Google, and Level3.

@parseword
parseword / librenms-1.40-error.md
Created June 5, 2018 00:57
RuntimeException: The only supported ciphers are AES-128-CBC and AES-256-CBC with the correct key lengths

If you get errors like this when upgrading LibreNMS to 1.40, see the article Resolving LibreNMS error "RuntimeException: The only supported ciphers are AES-128-CBC and AES-256-CBC with the correct key lengths" for a solution.

[root@beast42 /path/to/librenms]# tail -100 logs/librenms.log
[2018-06-04 18:16:17] production.ERROR: RuntimeException: The only supported ciphers are AES-128-CBC and AES-256-CBC with the correct key lengths. in /path/to/librenms/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php:43
Stack trace:
#0 /path/to/librenms/vendor/laravel/framework/src/Illuminate/Encryption/EncryptionServiceProvider.php(27): Illuminate\Encryption\Encrypter->__construct('', 'AES-256-CBC')
#1 /path/to/librenms/vendor/laravel/framework/src/Illuminate/Container/Container.php(726): Illuminate\Encryption\EncryptionServiceProvid
@parseword
parseword / 108.75.16.72-packets.md
Created April 26, 2018 18:40
Unidentified traffic from 108.75.16.72

tcpdump associated with the article Unusual HTTP POST traffic

There were a total of 69 requests, starting with one that used "\xaf" as the HTTP verb:

108.75.16.72 - - [26/Apr/2018:09:44:10 -0500] "\xaf" 400 226 - "-" "-"
108.75.16.72 - - [26/Apr/2018:09:44:10 -0500] "POST / HTTP/1.1" 200 45 - "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
108.75.16.72 - - [26/Apr/2018:09:46:10 -0500] "POST / HTTP/1.1" 200 45 - "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
108.75.16.72 - - [26/Apr/2018:09:48:10 -0500] "POST / HTTP/1.1" 200 45 - "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
108.75.16.72 - - [26/Apr/2018:09:50:11 -0500] "POST / HTTP/1.1" 200 45 - "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
@parseword
parseword / 75.108.75.42-packets.md
Created April 17, 2018 03:40
Unidentified traffic from 75.108.75.42

tcpdump associated with the article Unusual HTTP POST traffic from 75.108.75.42

There were a total of 48 requests:

75.108.75.42 - - [15/Apr/2018:19:07:03 -0500] "POST / HTTP/1.1" 200 45 - "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
75.108.75.42 - - [15/Apr/2018:19:09:03 -0500] "POST / HTTP/1.1" 200 45 - "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
75.108.75.42 - - [15/Apr/2018:19:11:03 -0500] "POST / HTTP/1.1" 200 45 - "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
75.108.75.42 - - [15/Apr/2018:19:13:03 -0500] "POST / HTTP/1.1" 200 45 - "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
75.108.75.42 - - [15/Apr/2018:19:15:04 -0500] "POST / HTTP/1.1" 200 45 - "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"

Public DNS Service Comparisons - slack.com

This document is a companion to the article 1.1.1.1: Fast, but not so accurate (yet).

"A" response records for Slack, and network connectivity and latency to the answers, from Comcast in Memphis, TN. Tests conducted 2018-04-04.

Note: Traceroutes into Amazon-operated networks, including CloudFront, have a tendency to be obfuscated due to network topology and ICMP policy.

Public DNS Service Comparisons - google.com

This document is a companion to the article 1.1.1.1: Fast, but not so accurate (yet).

"A" response records for Google, and network connectivity and latency to the answers, from Comcast in Memphis, TN. Tests conducted 2018-04-04.

Querying the A record for google.com, 1.1.1.1 gives the poorest answer, a server more than twice as distant as those returned by other resolvers. The most optimal results were returned by Comcast and Level3.

Public DNS Service Comparisons - youtube.com

This document is a companion to the article 1.1.1.1: Fast, but not so accurate (yet).

"A" response records for YouTube, and network connectivity and latency to the answers, from Comcast in Memphis, TN. Tests conducted 2018-04-04.

Querying the A record for youtube.com, 1.1.1.1 gives the poorest answer: inexplicably, a server in Bogota, Colombia, South America. The most optimal results were returned by Comcast and Level3, which both gave the

Public DNS Service Comparisons - www.amazon.com

This document is a companion to the article 1.1.1.1: Fast, but not so accurate (yet).

"A" response records for Amazon, and network connectivity and latency to the answers, from Comcast in Memphis, TN. Tests conducted 2018-04-04.

Note: Traceroutes into Amazon-operated networks, including CloudFront, have a tendency to be obfuscated due to network topology and ICMP policy.

Public DNS Service Comparisons

Network connectivity and latency only, from Comcast in Memphis, TN. 2018-04-02.

Cloudflare's 1.1.1.1

7 hops, ping average 13.1 ms

[parse@word ~]$ mtr -c 100 1.1.1.1
//bind9 logging stanza with dynamic severity that can be controlled via rndc
//
//To debug something, issue "rndc trace 99" and run your troublesome query.
//This will generate extremely verbose logs, so as soon as you capture the event,
//run "rndc notrace" to return to standard non-verbose logging. Then copy and
//examine the log files at your leisure.
logging {
channel default_debug {
file "/var/log/named/named.run";