The first thing you're going to need is obviously a Raspberry Pi. I picked up the CanaKit Complete Starter Kit from Amazon. While you're at it, Edimax EW-7811 Wireless N USB adapter. That way you can connect to your wireless network and not have to use a network cable.  You're also going to need the screen. The screen I used is also the same screen that Stig used in his, and it comes from eBay. The drivers and everything that come with the zip file you'll be downloading soon work on that screen. I do not know if they work with any other screen, so I HIGHLY suggest you spend the $29.99 and get that particular screen. Once you have all your parts, you're ready to go!

Step 1: Setting up your Raspberry Pi

I'm not a Linux expert by any means of the imagination, but I've done some tinkering with it in the past. I got my Raspberry Pi because I wanted a small Linux box to mess with and this thing is perfect. The Edimax has drivers built in to the latest OS on the Raspberry Pi, so you shouldn't have any problems with that. Connect to it and get it connected to your home network. Once you have that setup, you're going to need some files before we move forward...

Step 2: Setting up the ticker

DOWNLOAD THIS FILE FIRST. That zip file contains all the files you'll need to make this work. Put them in a directory called lcdscreen. Since I was using the 'pi' login on my pi, the full directory was /home/pi/lcdscreen/. If you decide to use a different directory, you'll have to edit the ticker.sh file later on.

The working part of this thing is the file 'ticker.py'. It's Stig's code that's been edited down to display only the Mt. Gox info. If you want to make any changes to what's displayed, that's the file you'll need to edit. The file 'ticker.sh' is the script that's run to make the screen refresh every 60 seconds. If you want to change the refresh rate (say, to every 5 minutes), you just nano ticker.sh and change the sleep number to however many seconds you want it to wait to refresh. 2 minutes = 120 seconds, 5 minutes = 300 seconds, and so on.

If you use the files as they sit, your finished product will look like this:

Mt. Gox Ticker

Once you have the files in the lcdscreen directory, you run the following command:

pi@raspberrypi ~/lcdscreen $ nohup ./ticker.sh &

This will allow you to run the ticker.sh script in the background. Ticker.sh calls ticker.py to get the info. Keep in mind that you have to be connected to the internet because it connects to Mt. Gox in order to pull the pricing info.

Step 3: Profit?

That's all there is to setting this thing up. **Note:** You may need to copy the provided `99-lcdsysinfo.rules` file into`/etc/udev/rules.d/` in order to grant pylcdsysinfo permission to claim the device without running as root. If you're still having issues, leave a comment below and I'll do what I can to help you out.

EDIT: I have added Litecoin as well. You can download the python file that shows both Litecoin and Bitcoin here. If you would like to have both the Bitcoin screen and the Litecoin screen go through the rotation, add it to the ticker.sh file. You can do this with however many things you want to add to the rotation. Change the "sleep 60" to the number of seconds you want to take between screens. It would look like this:

#!/bin/bash
while true
do
 /home/pi/lcdscreen/ticker.py
 sleep 60
 /home/pi/lcdscreen/litecoin.py
 sleep 60
done

If you feel like it, feel free to leave a donation: 14Tkp7U4UArLaKTB6g95xvgHoQNUtWvcy7

Stig's donations for the original code: 1CG67w37G5mte1bSiveKvXqk27buPn67KR

Litecoin Donations: LKiWx5V8NWJgAZFSMAuD6EhFSsrmeYquGQ

First off, I'm on iPhone 5 number 2. My first one had some issues with the anodizing on the case having some scuffs and scratches out the box. I brought it back on Monday and luckily they had one in stock to trade out for me.  Since then, I've have 3 days to play around with the new one, plus 2 days with the old one. So far, this is what I've seen (in addition to the first post).

• The battery life isn't as good as the 4S. I've got a femtocell that sits in my living room, a mere 15 feet from me, so you can't tell me that it's the battery life issues due to poor cell signal that other people have seen.
• Passbook, although I praised it in my last post, doesn't work worth a shit. Granted, I've only tried to use it at a few places, but none of them have worked. That may be an issue with Passsource.com, the site that I used to create the passbook cards, but either way, it still doesn't work well.
• The headphone jack being moved to the bottom kinda sucks because I use a dash mount for my phone. Nearly all dash mounts are going to cover the bottom headphone jack.
• iMessages is the greatest thing since sliced bread. I love the fact that I can send texts from my MacBook Pro or iPad and everything shows up on the phone too. If I send from my MBP, all the information shows up on the phone and the iPad, so I can continue a conversation regardless of what's in my hand. I've wanted this feature forever, and it is easily the one I use most (This is an iOS 6 Feature).
• The panoramic pictures can get a bit wonky if you don't have a steady hand.
• Apple Maps sucks. I've used the turn-by-turn directions a few times and every single time, the route was different than the TomTom that was next to it. I find this weird because TomTom provided the data for it. One time, it tried to send me somewhere that wasn't even close to my actual destination.
• The cable. Yes, I know I said I was a fan of the new doc connector, but it has come out that Apple has installed a verification chip in the new cables, so you won't be able to buy cheep cables anymore. This sucks because I've already sold 100 of them on eBay and I've had to process 10 returns already. Those will charge, but won't move any data. Also, the USB side of the cable (on the OEM ones) has a tendency to get in the USB port. They are VERY tight and could take some force to remove.
• There's a bit of chromatic aberration in the camera that causes pictures to have a purple tint to them. This is actually quite normal in small cameras and isn't extremely noticeable until you load it into Photoshop and look at the color levels.

That's pretty much all my complaints about it. Also, if you're looking into getting one, you'll find the prices that different places are paying for trade-ins below. Amazon is by far the best bet for guaranteed money. That's who I'm using!

iPhone 3GS
8GB (Black)	$85.00	$38.00	$105.00	$66.00	$51.00
8GB (White)	$85.00	$38.00	$105.00	$66.00	$51.00
16GB (Black)	$110.00	$49.00	$110.00	$70.00	$71.00
16GB (White)	$110.00	$49.00	$110.00	$70.00	$71.00
32GB (Black)	$125.00	$55.00	$115.00	$73.00	$78.00
32GB (White)	$125.00	$55.00	$115.00	$73.00	$78.00
iPhone 4
8GB (Black, AT&T)	$195.00	$140.00	$200.00	$142.00	$149.00
8GB (Black, Sprint)	$195.00	$121.00	$170.00	$129.00	$130.00
8GB (Black, Verizon)	$200.00	$121.00	$170.00	$133.00	$130.00
8GB (White, AT&T)	$200.00	$140.00	$200.00	$125.00	$149.00
8GB (White, Sprint)	$195.00	$121.00	$170.00	$99.00	$130.00
8GB (White, Verizon)	$205.00	$121.00	$170.00	$120.00	$130.00
16GB (Black, AT&T)	$230.00	$170.00	$170.76	$161.00	$175.00
16GB (Black, Verizon)	$230.00	$126.00	$190.00	$146.05	$155.00
16GB (White, AT&T)	$250.00	$170.00	$170.76	$141.00	$175.00
16GB (White, Verizon)	$250.00	$126.00	$190.00	$140.00	$155.00
32GB (Black, AT&T)	$250.00	$175.00	$200.00	$166.75	$235.00
32GB (Black, Verizon)	$250.00	$128.00	$200.00	$192.50	$165.00
32GB (White, AT&T)	$260.00	$175.00	$200.00	$179.00	$235.00
32GB (White, Verizon)	$270.00	$128.00	$200.00	$179.00	$165.00
iPhone 4S
16GB (Black, AT&T)	$370.00	$273.00	$300.00	$278.00	$290.00
16GB (Black, Sprint)	$365.00	$235.00	$274.40	$268.00	$250.00
16GB (Black, Verizon)	$370.00	$235.00	$274.40	$268.00	$250.00
16GB (White, AT&T)	$375.00	$273.00	$300.00	$278.00	$290.00
16GB (White, Sprint)	$365.00	$235.00	$274.40	$268.00	$250.00
16GB (White, Verizon)	$400.00	$235.00	$274.40	$268.00	$250.00
32GB (Black, AT&T)	$395.00	$275.00	$308.70	$278.00	$295.00
32GB (Black, Sprint)	$425.00	$250.00	$294.00	$278.00	$275.00
32GB (Black, Verizon)	$405.00	$250.00	$294.00	$278.00	$275.00
32GB (White, AT&T)	$420.00	$275.00	$308.70	$278.00	$295.00
32GB (White, Sprint)	$430.00	$250.00	$294.00	$278.00	$275.00
32GB (White, Verizon)	$450.00	$250.00	$294.00	$278.00	$275.00
64GB (Black, AT&T)	$460.00	$325.00	$400.00	$350.00	$400.00
64GB (Black, Sprint)	$460.00	$270.00	$325.00	$312.00	$310.00
64GB (Black, Verizon)	$450.00	$270.00	$325.00	$312.00	$310.00
64GB (White, AT&T)	$470.00	$325.00	$400.00	$350.00	$400.00
64GB (White, Sprint)	$450.00	$270.00	$325.00	$312.00	$310.00
64GB (White, Verizon)	$470.00	$270.00	$325.00	$312.00	$310.00

Today I got the new iPhone 5. I've been using the 4S for a little less than a year, and the 4S was the first iPhone that I had that actually made calls (the other ones were all programming platforms). I guess that's the price you pay when you're on Sprint.  Before the 4S was an HTC EVO 4G and prior to that, a Treo Pro along with a Blackberry back before that.  So I've had experience with iOS, Android, Windows Mobile, and Blackberry OS.

I decided to get the phone because I had an upgrade credit and I figured that despite the change in dock connector, I might as well get it over with now because Apple is going to be moving to Lightning on everything going forward. I'm going to have to do it sooner or later, might as well be sooner. I ordered my wife's 16GB on the first day of pre-orders and it arrived Friday afternoon. After toying with it for all of 30 seconds, I decided I needed to get one myself. After calling all over the place yesterday (launch day) and not finding a 64GB Black Sprint phone (quite a few places had white left), the Apple Store informed me they were getting a shipment in this morning. I showed up at 10am when they opened. Since I had already toyed with the phone yesterday, I had an idea of what it could do. My 4S was running iOS 6 already, so I had seen quite a few of the features available already.

tl;dr

I like the fact that it's longer. You really start to notice it after a while and you miss it when you're using apps that haven't been updated yet and are running in letterbox with the black bars on top and bottom. You don't really notice the bars because the black is good enough that it blends in.

Although I bitched and moaned about them changing the doc connecter and not making it any faster (USB 3 anyone?), I kinda like it. I thought it was going to be bigger... maybe the size of a standard USB in width, but it's only about half that. The reversible design is awesome too. The price of spare USB cables sucks.

It's weird to have an extra row of apps on the screen. You're so used to seeing 4 rows plus the bottom that 5 seems alien.

Speed: It's not faster. You may think it's faster, it may feel faster, but I had the 5 and 4S side-by-side and ran some tests. Opening apps, playing music, surfing the net... It's not any faster. Granted, if you're on LTE, your surfing will be faster than 3G, but the apps open at the same speed. That being said, it feels faster for some reason. I'm going to go with placebo effect.

It's lighter. You notice it. I put mine in an Otterbox before I left the mall, seeing as I dropped the phone before I ever made it out of the Apple store, but I hated it so it's out.

Roundest corners yet!

We're going to have to see what battery life is like. I've been dicking with it all day and the battery is at 50% still. Not bad.

That's about it. The new apps and features are pretty cool. I like Passbook because I hate carrying all those cards with me. You can create your own Passbook cards by going to Passsource.com and using their templates. I've got tons of them already, but the CVS card didn't work. They know about it and are looking for a fix.

All in all, it's your typical new Apple phone. Small, incremental changes from the last one, same outrageous price. If you get one, everyone's going to tell you how much better the Samsung Galaxy S3 is and how Android kicks Apple's ass, but they would have said that no matter what Apple did. I really wish they would have implemented NFC and went to Micro USB, but other than that, I'm happy with it.

In order to implement the traffic shaping, I need to know what the traffic looks like.  For me to shape it, I need to know what it looks like, so I'm going to setup an analyzer.  I have a specific media server that is separate from my lab rack. It's plugged into a little Cisco gigabit switch that has an LACP Lag bundle going back to my core EX3200-48T. To setup an analyzer is very simple...in fact, it's only 3 commands.

set ethernet-switching options analyzer plex–monitor input ingress interface ae0.0 set ethernet-switching options analyzer plex–monitor input egress interface ae0.0 set ethernet-switching options analyzer plex–monitor output interface xe-0/0/45.0

That's it. Now, let me explain what I did there.

To configure an analyzer called "plex-monitor" and specify the input (source) interfaces and the output interface, I need to configure the interface connected to my media server as input interfaces for the port-mirror analyzer. I want to see both ingress and egress traffic, so I tell it to do both.

[edit ethernet-switching-options]
user@switch# set analyzer plex-monitor input ingress interface ae0.0
user@switch# set analyzer plex-monitor input egress interface ae0.0

Now, I configure the output analyzer interface for the analyzer. This will be the destination interface for the mirrored packets:

That's it. Now, all the traffic going to that lag bundle (the server is the only thing plugged into that switch) will be mirrored to port ge-0/0/45. I can plug my Wireshark box into that port, get a good capture of the traffic, and set my traffic shaping accordingly.  Can you guess what my next post is going to be about?

PayPal Fee Calculator
Etsy Fee Calculator
Square Fee Calculator 

I had the client open a TAC case and TAC wanted to fight with the client, telling them that the high CPU shouldn't have any effect on the switch performance (really!).  I suggested that the client upgrade the switches to the latest version of IOS and once that was done, all the voice quality issues disappeared.  Total CPU utilization dropped to below 20%, calls cleared up, everything was beautiful.

Last week, I got an email from one of our project managers asking if I could look into an issue that another client was having.  If I hadn't known that this was a different client, I would have thought that she had cut and pasted the exact problems that the first client was having.  When I found out that they were using 2960's, I immediately thought of this and sent the client a copy of thev bug report and told him to open a TAC case.  This is the email I received from him:

I tested the CPU Utilization on all of our Cisco 2960Ss and they ranged between 68-99%.  I have a test switch on the bench with nothing connected and it was running at 75%.  I updated it with the new code and it dropped to the 20-35 % range.  I am going to update some additional switches before I call Cisco.  The first question they will probably ask is are you running the latest code.

He's right... Cisco will be wanting to know that.  I know that once the new IOS is on the switch, it'll solve his problems.  I just wanted to put this out there so you guys don't have to do all the searching that I did when/if you run across the same issues on your end.

Step 1: Create a new object group for your Xbox 360.

asa5505(config)# object network xbox

Step 2: Add the static IP of the Xbox to the network group.

asa5505(config-network-object)# host 10.11.12.13

Step 3: Forward the ports via the NAT command.

asa5505(config-network-object)# nat (inside,outside) static interface service tcp 3074 3074
asa5505(config-network-object)# nat (inside,outside) static interface service udp 3074 3074
asa5505(config-network-object)# nat (inside,outside) static interface service udp 88 88

Step 4: Exit back to the root and add the access lists

asa5505(config)# access-list outside_access_in extended permit tcp any object xbox eq 3074
asa5505(config)# access-list outside_access_in extended permit udp any object xbox eq 3074
asa5505(config)# access-list outside_access_in extended permit udp any object xbox eq 88

That's it!  If need to know exactly what's going on here, please check my previous post on port forwarding.  If you do your work through the ASDM, just use my post on port forwarding via the ASDM and make the necessary changes to ports, IP addresses and names.  Now you just need to go to your Xbox 360 and retest the connection.  You'll see that no longer does it say that you are using restricted NAT!  Also, if you're having issues with voice over Xbox Live, this should solve those problems.

EDIT 7/12/2011

After further review, I realize that I'm an idiot.  You can't add more than one NAT statement to a network object.  Create 3 seperate objects (I called them xbox1, xbox2 and xbox3) and add one NAT statement per object.  Once you do that, adjust the ACL accordingly.

Juniper has been a real pain in my ass lately.  I absolutely love their hardware.  It's some of the fastest gear I've ever worked on and I've never seen the kind of speed to the desktop on Cisco as I have seen on Juniper.  It's just that I've spent so much of my career working on one thing that being thrown into something else is not fun.  I thought it would be at first; learning something new would give me a challenge and be interesting.  Well, it's hasn't been such a great honeymoon phase.  The environment I'm working has some issues, and that's about all I'm going to say about it.  I'll be going to Herndon, VA for a week to get the training I need to try to solve some of these issues, not to mention another week to attend a data center design class, and I hope that this training will bring me to the level that I can help these people.

I really wish I could speak my mind here and tell you guys about the problems I'm seeing and maybe get some ideas from my readers on how to fix some of this stuff, but I can't.  I can't let out any info on the network and I won't talk good or bad about any particular hardware in public.  Maybe one day I'll be able to put up a big post with a Visio to see if any of you guys can solve a problem.  Hell, I just may create something and give away a prize to the first person to get the correct answer.  If anyone has an idea, be sure to let me know!

I got off my ass tonight and decided to update the ASA (yes, my licensing is correct!).  I haven't had a chance to play with it a while lot (you can see it's only been up for 3 and a half hours), but it seems pretty cool.  I sat down and read the release notes for 8.3(2) and there's a few things you should know.  First off, you're going to need more memory.  Well, if you look at mine, you can see I've maxed out what the thing will accept, so I'm perfectly safe; but chances are, you're not.  Cisco has a nice table to let you know what your memory needs are.  In fact, if you head over to this web page, you check out the release notes for both 8.3(1) and 8.3(2).  You'll see the new features as well as caveats fixed with these versions.  Now that I have informed all you guys about the upgrade, I'm going to start playing with it for a little bit before the sun comes up and kills me.  Dammit!  It's already 1am!

Digging around the BIOS I saw that the SATA controller was using AHCI mode.  I cloned my current drive to another 1TB drive I had (yeah, I have 3 -1TB drives, a 500GB, and a 1.5 TB), rebooting into the BIOS and changed it to RAID.  After a reboot, I hit ctrl-I and entered the RAID utility.  I built the RAID and rebooted.  Well, to put it nicely, I got a BSOD. I tried various things for the next 3 hours, including using Windows 7's extended partition utility, doing a complete restore to factory on the extended partition, and everything.  After I did the restore, I saw that the HDD performance hadn't changed.

Well, I haven't messed with RAID before on a desktop, so this was a learning experience.  After some Google searches, I put the computer back in AHCI mode and booted to the clone.  This worked just fine.  I went to Gateway's website and downloaded the RAID drivers.

I noticed that the driver was named iaStorV.sys, so I did a search for it and found it already installed in the Windows\System32\Drivers folder.  I did a registry search for it and found it in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStorV.  This made me happy!

Some more Googling later and I figured out that if I changed the REG_DWORD from 3 to 0 that it would enable things to work.  I rebooted the computer, went back into the BIOS and changed the SATA controller to use RAID, pointed it to boot from the clone, and it booted right up! No BSOD, no hiccups, no nothing!

This should work going from IDE mode as well.  I tried to clone the clone to the RAID, but Acronis didn't like that too much, so I'm doing a full backup of the clone (I needed to do it anyway) and I'm going to try to restore it with the Acronis Resuce media.  It's already midnight, and this is one of those things that I'm not going to be able to put down until I'm done with it.  Oh well, I guess it's time to get back to work!  Good luck getting your stuff working!

By having a rooted phone, I can't get the Froyo update over the air, but I can still put it on my phone, and you can too.  Here's how to do it.

Step 0: I'm adding this late, but if you don't want to have to search for your apps again, check out AppBrain.  Install it before the upgrade, sync your phone up with the website, create a new list on the website and copy all your apps to that as a backup.  After you are done with the upgrade, install AppBrain first and sync it back up.  All your apps will be there waiting for you.

Step 1: You need to have a phone rooted with Unrevoked3.  That's the way I know how to go about it, so go root your phone with Unrevoked3 and come back.

Step 2: Download the rooted Froyo image from here. (Thanks netarchy!!!)

Step 3: Copy the .zip file to the root of your SD card on the phone.

Step 4: Power down the phone and reboot into the boot loader. To do this, make sure the power is off and hold the volume down button while holding down the power button.

Step 5: Once in the boot loader, use the volume rocker to navigate to RECOVERY. Select it by pressing the power button. This will bring you to Clockwork.

Step 6: From ClockworkMod Recovery, select " wipe data/factory reset".  Confirm it and do the reset.

Step 7: Select "install zip from sdcard", then "choose zip from sdcard".

Step 8: Navigate to and select "HTC-OTA-3.26.651.6-Final-Froyo-Rooted-Odexed-netarchy-signed.zip". Confirm the install.

Step 9: Once the install is done, navigate back to the top level of Clockwork and select "reboot system now".

And you're done!  You should now reboot into Froyo. You can verify this by going to Settings -> About Phone -> Software information.  You should see "Android Version 2.2" at the very top!

Once you have updated Froyo, you need to apply a couple of radio updates.  You do this the same way you installed the Froyo zip file.  After each install, reboot the phone and let it do a full reboot.  After it's rebooted, power down and boot into the boot loader to apply the other one.  Follow the instructions above (you don't have to wipe data for the radio updates) and you'll be just fine.  Here are those two files:

Radio update: 2.15.00.07.28
Wimax Update 26023

Enjoy the speed of Froyo and have fun with your newly rooted phone! For the full thread on xda, click here.

-Greg

Update: I've seen a HUGE spike in traffic in the last hour (that's to be expected) and I can see that a lot of you guys are doing the upgrade (I love Woopra).  Leave some comments below and let me know if everything ran OK for you.

In this lesson I'm using ASDM version 6.3(1) and ASA version 8.3(1).  Since we added a  web server in the last post, let's make this one an FTP server.  The FTP server's IP is the same as the web server, 10.9.8.7/24 and we're running over the standard FTP port, 21.

First off, we want to start up the ASDM and connect to the ASA.  Once there, click on the button at the top of the screen, then the button near the bottom left, and finally select near the top left.  You'll now be at a screen that looks something like this:

Click for larger version

Now we need to create a new object, so click on "Add" under Addresses, then "Network Object".
Now we need to fill out our new window.  Once you fill out the name, IP address and description, you need to drop down the NAT box and fill it out.  Click the "Add Automatic Address Translation Rules" box, leave the type as "static" and set the translated address as the outside interface.
We now need to go to the Advanced menu from the Add Network Object window and setup the port forwarding.  The source will be inside, destination is outside.  Protocol in this instance is TCP and our port is 21, both real and mapped.
Click "OK" twice and your object will be created as well as the port forward.  Now we just need to add the access rule.  On the left side of the screen, just above the NAT Rules is your Access Rules. From there we want to click "Add" and "Access Rule".
We need to create the rule on the outside interface, coming from any IP to the FTPServer using FTP as the service.
Once you click OK, your rule is added.  You don't have to add a description like I did in the image above this one, I just did that for the hell of it.  When you click "Apply" at the bottom of the screen, the ASDM will issue the commands to the ASA.  I have preview turned on, so I can always see what commands are being sent to the device before they are actually sent.  If you followed all the steps above and you have preview turned on, you'll see the following:
And you'll notice that those are the exact 4 commands that I gave in the last post about doing it from the CLI!  Now you can forward any port you want from either the CLI or the ASDM!

On a side note, I know a lot of guys hate the ASDM.  When I was writing this post and going through all of this I was kinda upset when I saw that I had 10 pictures for 4 lines of code.  The good thing about the ASDM is that you have everything right there at your disposal and you really don't need to know the vernacular of IOS.  The drawback is that it will take you longer to get things done at first, but once you get used to it, it can be just as fast.

I recently added an ASA 5505 to my home network at the edge.  Obviously, when I did, all of my port forwards went to hell because the ASA is now blocking everything.  I run a web server on one of my servers here and I like to be able to access it because I keep a lot of tech manuals and other stuff on there.  Well, I went about trying to set up port forwarding the old way and learned real quick that this pops up when I do:

ERROR: This syntax of nat command has been deprecated.
Please refer to "help nat" command for more details.

Yeah, that sucks.  On the new version of the ASA OS, global has gone the way of the dodo.  I did a bunch of searches on Google to figure it out and everything I ran across was very hard to decipher.  That's why I'm writing this.  You can setup a port forward in 4 quick and easy steps.  Just change the things that are underlined to fit your network and you'll be just fine.

In this example, we want to be able to access a web server behind the firewall.  We'll assume you are using the standard HTTP port, the web server's internal IP address is 10.9.8.7/24, and that you at least know what you're doing enough to be configuring an ASA in the first place.  I'll give you the steps, then I'll explain.

Step 1: Create a new object group for you web server.

asa5505(config)# object network Webserver

Step 2: Add the IP of the web server to the network group.

asa5505(config-network-object)# host 10.9.8.7

Step 3: Forward the port via the NAT command.

asa5505(config-network-object)# nat (inside,outside) static interface service tcp www www

Step 4: Exit back to the root and add the access list

 asa5505(config)# access-list outside_access_in permit tcp any object Webserver eq www

That's it!  Now, let's explain what's going on here.  Cisco has started moving more and more towards use of object groups in their configs.  It makes things easier, especially when you have a situation where you have 20 web servers behind the firewall and you want to add 1 more in.  Rather than having to rewrite a whole bunch of ACL's, you just add the IP of the new web server into the object group and everything is done for you.  After you create the object group (in this instance a network object, you can also create service objects), you add the IP of the specific object (or objects) that you want to point to.  So here our web server is 10.9.8.7.  If you want to send port 80 to more than 1 IP on your internal network, just add more IP's to that object group.

Now is the fun part.  While we're in the object group, we need to NAT port 80 only to that specific object group, hence you're still at "asa5505(config-network-object)#" prompt.  Now type "end" to get back to the regular config terminal and we need to open that port in the ACL.  Yes, www = 80.  You can type either one and you get the same result.  If I have to go through and explain NAT, how it works and why I enter in that specific command to forward the port, then there's a possibility that I'd need to send you an invoice for my time because we would be here for a while.

This works for ANY port forward.  If you want to RDP into a machine, simply replace port 80 (all those www's you see up there) with 3389.  There is one caveat.  You can only do one port forward per object group.  So let's say that our web server is also an FTP server and you want port 21 to forward as well as port 80.  You're going to have to create a whole new object group (object network FTPServer), put the same IP in the group (host 10.9.8.7), do the nat command again (nat (inside,outside) static interface service tcp ftp ftp), exit back to the root of config, and add the access list (access-list outside_access_in  permit tcp any object FTPServer eq ftp).

This should get you up and running with you port forwards in no time flat.  It is a bit of a pain in the ass to have to create a new object group for every port you want to forward, and maybe there's someone out there that's reading this right now thinking "dude, you don't have to create more than one group!  You can just do...".  Well, you need to enlighten the world with this knowledge and post it in the comments section.  And if you're too scared to do so, shoot me an email to greg(at)gregledet(dot)net.

I'd also like to thank Stefan Fouant for an excellent class today on JUNOS Switching.  I learned a lot in his class and you can learn a lot from his website.  Check it out and tell him Greg sent ya!

So far the phone is amazing. Yes, I will admit that there is a bit of a battery life issue, but with a screen this size and the fact that you're going to spend every extra second playing with the damn thing, you're going to burn through some battery.  You can get 2 spare batteries and a charger on eBay for about $11, so it's no big deal to carry an extra in your pocket.

Android and HTC Sense are amazing.  With the 1Ghz Snapdragon processor, everything runs like a bat out of hell.  In fact, I can't say anything bad about the software on this phone.  It's very intuitive to use and you pick things up very quickly.  It took me all of 3 days to figure everything out, but I'm an experienced user.  When it only took my wife the same time to figure the phone out, I knew it wasn't just me.  The phone is that easy to use.

My wife told me "I've never been excited about a cell phone before, but I am out this".  I feel the same way.  Going from the Treo Pro to this is like going from a Yugo to a Ferrari.  It's that good.  The camera puts out some excellent pictures and now that Qik is up and running, the video calls are really good.  I've also tested video calling on Fring with my friend Jef and it seems to work great too.  Everything on this phone is snappy and beautiful.  From what I've seen about the specs on the new iPhone 4, the EVO 4G should kick it's ass in everything except resolution.

If you're on the fence about getting an EVO, I'd say go for it.  You won't be disappointed.

Click here to select which camera you want to watch.

Click here to watch all 12 cameras on the same page.

1. Boot to the LiveCD Desktop (Ubuntu 9.10 or later).
2. Open a terminal by selecting Applications, Accessories, Terminal from the menu bar.
3. Determine the partition with the Ubuntu installation. The fdisk option "-l" is a lowercase "L".

   1. sudo fdisk -l

      If the user isn't sure of the partition, look for one of the appropriate size or formatting.Running sudo blkid may provide more information to help locate the proper partition, especially if the partitions are labeled. The device/drive is designated by sdX, with X being the device designation. sda is the first device, sdb is the second, etc. For most users the MBR will be installed to sda, the first drive on their system. The partition is designated by the Y. The first partition is 1, the second is 2. Note the devices and partitions are counted differently.

4. Mount the partition containing the Ubuntu installation.

   sudo mount /dev/sd''xY'' /mnt

   Example: sudo mount /dev/sda1 Note: If the user has a separate /boot partition, this must be mounted to /mnt/boot

5. Run the grub-install command as described below. This will reinstall the GRUB 2 files on the mounted partition to the proper location and to the MBR of the designated device.

   sudo grub-install --root-directory=/mnt/ /dev/sdX

   Example: sudo grub-install --root-directory=/mnt/ /dev/sda

6. Reboot
7. Refresh the GRUB 2 menu with sudo update-grub

That doesn't look that difficult, does it?  Yeah, well, it was a pain in the ass to get to that point.  If you notice, I highlighted the example for #5.  If you do what I did and try to sudo grub-install --root-directory=/mnt/ /dev/sda1, then you're going to end up getting something that looks like this:

grub-setup: warn: Attempting to install GRUB to a partition instead of the MBR. This is a BAD idea.
grub-setup: warn: Embedding is not possible. GRUB can only be installed in this setup by using blocklists. However, blocklists are UNRELIABLE and its use is discouraged.

You don't want this.  You're going to try to force it and you're going to fuck something up.  Make damn sure you do it right.  Let's look at my particular situation.

My setup looks like this:

/dev/sda1 is NTFS
/dev/sda2 is ext4
/dev/sda3 is swap

I would have to enter the following commands:

sudo mount /dev/sda2 /mnt
sudo grub-install --root-directory=/mnt/ /dev/sda

After knocking that out, it should tell you that it's been successful and all you now need to do is reboot!  It took me 5 different times to get this damn thing back.  I ended up bombing out the Windows MBR by installing GRUB on it, which made me have to do a fixboot/fixmbr from the windows recovery console and start all over again.  Once I was back to square 1, following the commands above got me done in 5 minutes.

I hope this helps you!

-Greg

1. First off, you should already have a copy of Firefox installed on your computer.  If you are only using IE, you have problems that I can't solve in a simple blog post.  Go get Firefox and get it installed.  If you have it installed already, go to step 2.

2. We need to download a Firefox Add-on called FoxyProxy.  You can find it at http://foxyproxy.mozdev.org/ or you can skip straight to it by clicking here.  Add FoxyProxy to Firefox.  You'll need to restart Firefox after you install it.

3.  You'll notice at the bottom right corner of Firefox that FoxyProxy is Disabled.  It'll look like this: Go ahead and click on that or you can go to Tools -> FoxyProxy Standard and it will open the next window (click for bigger version):

4. Now we need to add some proxies.  I like to use xroxy.com to find my proxies.  One reason I like it is because you can setup the proxies with a single click.  I'll show you how to do both. We need to find a proxy to use that will get us past the isoHunt lite and to the main site.  To do this you can use proxies all over the globe.  For this how-to, I'll use a proxy in Canada. I suggest that you try out various proxies until you find one that works best for you.  I've used proxies in Canada, the UK, and many other countries, it just so happens, that Canada seems to be the fastest for me.

5.  At xroxy.com you need to click on "By Country" or click the picture below:

6. Click "Canada" in the list on that page to bring up the list of all Canadian proxies.  Once there, there's 2 ways of setting up a proxy in FoxyProxy, manually or automatically.  For the auto setup, just click the FoxyProxy icon next to the proxy: .

7.  To setup a proxy manually, there's many different how-to's out there that can be found in the help section of FoxyProxy's website. There's one with screenshots for an older version of FoxyProxy, and there's one written by FoxyProxy on how to configure the software.

8.  Once you have the proxy setup, you need to tell the software how to use it.  For the sake of simplicity, you can simply right click on the "FoxyProxy:Disabled" and tell it "Use proxy 'XROXY Proxy' for all URLs".  You can also setup patterns for that proxy to use.

9. To setup patterns, double click the XROXY Proxy from the main screen in FoxyProxy.  Click on the URL Patterns tab and Add New Pattern.  When the screen comes up, enter the following:

Type the URL EXACTLY like I did with the /* behind it to use as a wildcard.  If you don't do this, only the main page of isoHunt will go through the proxy and all the search pages will kick back the Lite version.  Click OK and you'll have setup the pattern.  Now you can tell FoxyProxy to "Use proxies based on their pre-defined patterns and priorities".  Once you do that, all traffic going to isoHunt will pass through the proxy and all other traffic will go straight to the internet without going through a proxy.

Once you're back to the main isoHunt site, you're good to go.  I highly suggest using µTorrent as your client and I would definitely download PeerBlock to use block unwanted traffic.  Once you have PeerBlock installed, you can get your lists from iBlockList.com to stop all those evil people that you don't want accessing your network. If you want to surf anonymously, you can download Tor, but that will really slow you down.  Onion routers like Tor will bounce your traffic all over the world before it finally makes it out to the cloud.

That should be all you need to know to get back to the main site of isoHunt.  We really shouldn't have to take such measures simply to view a website.  We need to support net neutrality and tell our lawmakers that we will NOT be censored, and if they do, we will simply find a way around them.

P.S. For all those Canadians living in the US and would like to watch shows like Canada's Worst Driver but can't, you can use this same method.  Make sure you use a Canadian proxy.

Verizon: press *
Sprint: press 1
T-Mobile or AT&T: press #

Of course, you need to know what carrier the person you are calling is using.  The way I figure out is simply trial and error until I hit the right one.  I timed Mary's once (he's on Verizon) and if I would have left a message, I would have been into the 3rd minute of the call and eating up my shared minutes.  After his long ass greeting, Verizon gives all the options (including giving a fax options!) of crap you can do.  I'm not sitting through that crap.  Now as soon as I hear that voice mail pick up, I slam a * into the phone and I'm done.

What I would like to see is people to put this info at the beginning of the greeting. Something like "Hi, this is Greg. Please press * to skip this greeting".  That would go a long way and I'm willing to bet more people would be willing to leave voice mail for you if you did.

Click on the business card for the full vCard.

For those of you that don't know what I'm talking about, this is what a Business card vCard looks like in Outlook if I were to email it to you.  It's a .vcf file and contains all kinds of rich information on the back end.  There's a link under the picture for you to download a full vCard for the president.  There's also tons of other formats out there to store your contacts; everything from simple text files all the way to QR codes.  If you have an app on your phone that does 3D barcodes, snap a pic of that one and you'll get the same info that's in the vCard.

Now, back to what I was originally talking about.  Seeing as I want all that rich information in my contacts and I want to import them into Google, I need to use a vCard.  I don't want to have to upload 239 individual files, so this is what I'm going to do.

1. Go to your contacts in Outlook and highlight them all (ctrl-A). Right click and "Send Full Contact" then "In Internet Format (vCard)".  Depending on how many contacts you have, you may have to split them up into groups.  I did...
2. An email should pop up with a bunch of attachments.  Send that email to yourself.
3. From the email you just sent to yourself, highlight all the attachments, right-click, save as. Save them somewhere easy to access.
4. Open up a command line. (Windows Key + R, then type "cmd" and press OK)
5. Navigate to the folder where you saved the contacts.  I saved them in C:\contacts, so we'll use that.
6. The command to type from the directory you have saved your contacts is:
   copy   /B   *.vcf   all_contacts.vcf
7. This will create a file in that directory called "all_contacts.vcf".  In that file will be the vCards of all of your contacts.
8. Now you just go to Google.com/contacts, click "Import" on the right side of the page, and upload that file!

It's pretty easy when you think about it.  I don't know of any way to do this from the GUI, so you're going to have to use the command line.  Once you have everything uploaded to Google Contacts, you should be set.  All you pictures and information should have been transferred and now you have a full backup of your contacts list should your computer crash!  I also use the same contacts list on my Windows Mobile phone, so I have multiple backups of my contacts list.  I'll never have to run around trying to rebuild it after losing my phone again!!!

-Greg

Now that you're doing that, check this out.  I like my contacts to be listed as "FirstName LastName" or what Microsoft calls the "FullName" file as format.  Google likes to make it's default "LastName, FirstName" and that's where I ran into this problem.  I synced my phone with my computer and in the process got all my contacts and calendar on the phone up to date.  I setup Google Mobile Sync on my phone, which acts exactly like an Exchange Server, and told it to sync Mail, Contacts and Calendar (Tasks doesn't work). I then synced my phone to my new Google account.

Everything looked all hunky-dory, until the next time my phone synced with Google.  While my contacts were on the Google server, it changed my "file as" format!!!  My contacts went in like "Greg Ledet" and came back out "Ledet, Greg".  Needless to say, this pissed me off and I was not going to sleep until I could find a fix.  As you can see, it's 4:24 in the morning right now, so I haven't slept!

I found this post and this post on Google's support site and neither one of those actually gives a proper answer.  It doesn't look like Google plans on fixing this anytime soon, so here's a work around to fix the the format and the way I'm making sure my stuff is up to date.

As it sits, the phone and computer are both using "Lastname, Firstname" and I want those two back to "Firstname Lastname" (FullName).  To do that, open up Outlook and go to your Contacts.  We're going to write some quick VBA code and make a macro to take care of this problem for us.  Follow the steps!

1. Press Alt+F11 to open the VBA editor. You may have to enable macros (Tools ->Trust Center->Macro Security->Warnings for all macros->OK).
2. On the left side, you'll see "Project 1" in the top box. Expand the plus next to "Microsoft Office Outlook Objects" and clink on "ThisOutlookSession".
3. Paste the following code in the "ThisOutlookSession" code box.

Public Sub ChangeFileAs()
 Dim objOL As Outlook.Application
 Dim objNS As Outlook.NameSpace
 Dim objContact As Outlook.ContactItem
 Dim objItems As Outlook.Items
 Dim objContactsFolder As Outlook.MAPIFolder
 Dim obj As Object
 Dim strFirstName As String
 Dim strLastName As String
 Dim strFileAs As String

 On Error Resume Next

 Set objOL = CreateObject("Outlook.Application")
 Set objNS = objOL.GetNamespace("MAPI")
 Set objContactsFolder = objNS.GetDefaultFolder(olFolderContacts)
 Set objItems = objContactsFolder.Items

 For Each obj In objItems
 'Test for contact and not distribution list
 If obj.Class = olContact Then
 Set objContact = obj

 With objContact
 ' Uncomment the  strFileAs line for the desired format 

 'Lastname, Firstname (Company) format               
 ' strFileAs = .FullNameAndCompany 

 'Firstname Lastname format
 ' strFileAs = .FullName

 'Lastname, Firstname format
 ' strFileAs = .LastNameAndFirstName

 'Company name only
 ' strFileAs = .CompanyName

 'Companyname (Lastname, Firstname)
 ' strFileAs = .CompanyAndFullName

 .FileAs = strFileAs

 .Save
 End With
 End If

 Err.Clear
 Next

 Set objOL = Nothing
 Set objNS = Nothing
 Set obj = Nothing
 Set objContact = Nothing
 Set objItems = Nothing
 Set objContactsFolder = Nothing
End Sub

4. Uncomment the strFileAs line that uses the format you desire before running it. In my case, I want to use the Full Name (FirstName LastName), so I would remove the red apostrophe ' that is in front of the blue strFileAs = .FullName. If you want to use a different format, just remove the apostrophe in front of the format you want to use.
5. Save the project, click "Run" on the menu bar, and click "Run Sub/UserForm" (or you can just hit F5)
6. That's it!

Your contacts are now in the "Greg Ledet" order on your computer, but they are still "Ledet, Greg" on your phone and Google.  This is what I've done to things fixed.

1. On your Windows Mobile phone, open up ActiveSync.
2. Go to "Menu" then "Options" while in ActiveSync
3. Under "Microsoft Exchange" make sure that "Contacts" is unchecked.
4. Under your computer name (in my case, "Greg Laptop"), make sure that "Contacts" is checked.
5. Connect the phone to the computer via sync cable, bluetooth, dock, etc. and Sync!

This should get the contacts on both your computer and your phone in the "FirstName LastName" format.  If it's not, you may have to delete the contacts off your phone before you sync with the computer.

As far as Google's contacts go, there is no way I can find to make the contacts there use the proper formatting.  Google's contacts will always use the "LastName, FirstName" format, which is why in the last few steps you removed contacts from syncing from Google (Google=Microsoft Exchange in this case).  They way I'm getting my contacts to Google is to just reverse where contacts are synced.  I sync with "Microsoft Exchange" and not with "Greg Laptop".  Once I sync them up, I put it back to only sync from the computer.  It would be a lot easier if Google would just fix this crap already, but it's not getting done.

If you can't follow these instructions, I suggest you do some more Google searches and brush up on your reading comprehension. I couldn't make this any clearer from the original.  And the best part about this looooong how-to?  It's all about Microsoft and I had to finish it in Linux because Windows kept crashing.

A web hosting client of mine got his site hacked in the past couple of days.  About a year ago, I installed phpBB3 for him and setup his domain on my server.  After that, I acted as admin on the forums and stuff like that.  Well, phpBB3 got neglected and hadn't been updated in a while.  It was running version 3.0.6 while the latest version was 3.0.7-PL1.  4 versions have been released since the last update.  When the site got exploited, he looked at me like it was my fault.  In fact, he told me something along the lines of "I paid you to build a site that was secure and you didn't do that".  Well, I did build him a secure site a year ago, but in the past year, there has been enough holes found in phpBB3 to kill a horse.

I'm sure that any freelancer or businessman out there has had to deal with clients that don't understand what it is exactly you do.  This happens a lot to me due to the range of things that I do.  But in this instance, the client was under the illusion that I was going to maintain the website and keep it up to date for him.  The original invoice that I sent for the site was simply 8 hours of work to get everything installed and setup properly and for a year of hosting.  Since that first invoice, I have fixed little errors here and there for him without invoicing him because it's little things that only take a few minutes to take care of.  Plus, the guy is a real good friend of mine and has been my friend since before we started doing business together.  I do freebies for a lot of my customers from time to time.  Maybe I messed up by doing these repairs and not charging him for them and by doing that I lead him to believe that I was doing it all for free.

I logged into the site this morning to notice that it had been defaced.  Some hacker managed to get in and screw around with the AdminCP.  Language packs were messed with, 300+ accounts were created and a bunch of spam had been posted.  I went ahead and fixed everything that happened and went through the process of upgrading phpBB3 to the latest version.  It took me about 2½ hours to get it all cleaned up and upgraded.  Once I was done, I submitted a service ticket for the work.  Here's another place I screwed up.  I should have asked him if he wanted me fix it first because we don't have a service agreement between the two companies.

Well, the site got upgraded to the latest version of phpBB3 and it was working fine.... for about 3 hours.  That's when our little hacker managed to get back in and lock me out completely.  My best guess is that there's a zero-day exploit on phpBB 3.0.7-PL1 that will also work on all previous versions.  In that instance, there's not a whole lot I can do about it other than block the proxies that he's used to get to the site with or just shut the site down.  Well, I shut it down.

Here's where the main problem starts.  The customer assumed that it was my responsibility to update the software for him.  I don't go to HP and bitch at them because there's holes in Windows.  Once I install the software, it's up to the client to keep that software up to date.  All of my other web clients know this and they keep their CMS software up to date.  If we would have set up a service contract in which I said I would maintain the security of his site, then it's no problem.  It's my responsibility to fix the security issues that come up, but there's no agreement there.

Also, the client wants 100% security. We all know that 100% security does not exist and never will exist.  He didn't like the fact that I used open-source software for the site because people can read the source code.  Well, the open-source stuff is free, so that's why it was used.  But even closed-source software has security holes in it.

To wrap up this rant, I wish people could understand that the only secure computer is one that's powered down and unplugged from the internet.  A friend once told me that if you installed a fresh copy of Windows XP (no service packs) on a computer and plugged it directly into the internet, it would be rooted within 12 seconds.  12 seconds! There is no security, only the illusion of it.

-Greg

QWERT would be a partnership of freelance web designers and programmers.  Every freelancer has a project that he's never gotten too because it's just too big for them to do alone or they just don't have the time to complete the entire project alone.  A bunch of talented people come together to work on each others projects.  I would pick 2 or 3 people that I know are VERY talented individuals that have money making ideas that just haven't been worked on yet.  Once the 4 of us are together, we start looking for more people.  To become a member of QWERT, you need to have a project that all other members agree on unanimously.  You also have to have talents that are provable through your portfolio and all other members have to agree on that unanimously.  The projects should be picked by the complexity of each part of it.  You want to make sure that throughout the projects the work would be spread around evenly based on each person's specialty.  You'd have one heavy programming project and one heavy flash.  One heavy database and one heavy graphics.  You get the idea... spread the work around so no one "department" is consistently working more than anyone else.

One we build a team of 10 or so people.  Once the team is built, we vote on which projects we want to work on or we chose them at random.  I don't know on that one 100% yet.  Once we finish a project, we move on to the next and so on.  During the voting process, we would try to bring projects up for vote in such a way as to give the specialty of the last project a "break" on the next one.  You don't want to do two heavy database jobs back to back.  Every person has to work on every project.  There are NO exceptions.  That's the only way this plan works.

Every member of QWERT will be an equal "owner" of the company.  All profit of the company is split equally between everyone.  There 's no managers.  The person who's project we are working on will act as project manager for that project.  They will still do their specialty, but they run the project.  An outside management company will run the financial aspects and be the registered agent.  No member of QWERT will have access to any of the company credit or anything like that, but all financial decisions will be made by the democratic process.  The Agent will only act on our behalf and under the direction of QWERT.  The Agent would be the ones paying the members their share out of the company fund after all expenses are paid.  And no, a new laptop for you to work on is not a company expense.  Pay for it yourself.

There's no sales department, we only work on our own projects.  Once we run out of the original projects, we start coming up with new ones.  This would not be a full time job, but something that people who have some free time and want some side work would do.  Our meetings would be held over something like GoToMeeting and we'd use collaboration software to make sure everyone's on the same page.

Well, that's the basics.  There's more holes than a brick of Swiss cheese, and there's a lot more thought that needs to go into it, but I want to get opinions on the basic idea.  Do you think this is something that could work?  If you were in a position to do some side work and you fit what QWERT needs, would you consider doing it?  What would you change or add?  Please, PLEASE leave a comment with your opinion, no matter how harsh you think it is or how dumb.  I want ALL opinions here.  Let's use the hive mind of the internet and create an entirely new kind of company and an entirely new way of doing business.

The WRT54G-TM (TM stands for T-Mobile) is also called the T-Mobile "Hotspot@Home" service. It allows calls to be made via T-Mobile's GSM network or via WiFi Unlicensed Mobile Access (UMA), using the same telephone and phone number (a special dual-mode phone designed for the service is required e.g. Blackberry Pearl 8120). Additionally, once a call is in progress, one may transition from WiFi to GSM (and vice versa) seamlessly, as WiFi signal comes and goes, such as when entering or exiting a home or business. A special router is not needed to use the service, but the T-Mobile branded routers are supposed to enhance the telephone's battery life. This is the only known tweak to the TM version of the firmware.  Obviously, none of this will be worth anything seeing as you're about to flash it with DD-WRT.

The hardware appears to be like WRT54GL however has 32MB ram and 8MB flash.  Yeah, this thing is a monster.  Until not that long ago the only way to upgrade this router was through a JTAG cable and header, but luckily we don't have to worry about that anymore.  Let's get to it.

First off, download the software you're going to need. Here's a rar file with everything you're going to need. In the archive are 3 files:

CFE_Updater-WRT54G-TM.bin
dd-wrt.v24-13064_mega_generic.bin
tftp2.exe

The upgrade is pretty straight forward, but it has a little twist.  The default LAN IP Address of the Linksys WRT54G-TM is 192.168.0.1.  The default IP for everything else is going to be 192.168.1.1.  A way around this is to simply setup 2 static IP addresses on your computer.  I setup 192.168.1.9 and 192.168.0.9, but you can put whatever you want as long as they fall within the /24 subnet of 192.168.1.0 and 192.168.0.0.

1.) As always DO A HARD RESET BEFORE YOU FLASH FIRMWARE. This does not mean hitting the reset button and saying you are done. This means doing the 30-30-30 reset. To do a 30-30-30 reset you must push the reset button with your router powered on. Hold it for 30 seconds with the router powered on. STILL holding it, pull the power cord for 30 seconds. Still holding it, plug the router back in and continue to hold the reset button for 30 more seconds. You will have held the button for a full 90 seconds without releasing it. You will not get a password renewal page as you have stock Linksys firmware on the router still.

2.) Open a command prompt window and type ping -t 192.168.1.1 and hit enter. Leave this window open. We're going to come back to this later, but you need to keep this open.

3.) Log into the WRT54G-TM's web interface @ http://192.168.0.1 and go to the Administration Tab - Firmware Upgrade. Upload the CFE_Updater-WRT54G-TM.bin to the router.

!!!ATTENTION!!! You MUST wait at least 5 minutes after clicking the Upgrade button to allow the CFE_Updater to replace the stock CFE on the router and for it to erase the rest of the flash, otherwise you will brick your router.

A few seconds after clicking the Upgrade button the Linksys web interface will report that the upload has been successful and the power light will begin flashing on the router. Do NOT assume that the CFE replacement/flash erasing/reboot process has finished as the power light will continue to flash after it has rebooted. So there is no way to tell when it is ready for you to TFTP the DD-WRT firmware to it except when you begin to see the ping respond.

So once it is finished replacing the stock CFE and erasing the rest of the flash, the router will reboot. When the router is ready for the TFTP upload of the DD-WRT firmware, you will see the ping -t 192.168.1.1 begin to respond in the command prompt window that you opened before.

4.) Open up the TFTP utility and set it up like this:

The file there is the path to the dd-wrt.v24-13064_mega_generic.bin in the archive

Now click the Upgrade button. Once the firmware is sent to the router, it will reboot. The power light will change from flashing to solid when it is ready to be configured.  The default IP will be 192.168.1.1.

If you do not see a progress bar as the tftp utility transmits the file, you may need to power cycle your router. Wait until the tftp utility has finished its attempts, then power cycle (possibly waiting a few seconds) and wait until you can ping 192.168.1.1 before clicking Upgrade again.

A few notes:

• Tornado has made it so that the router will retain it's MAC Address that is on the label on the bottom of the router with the new CFE replacement.
• Tornado is in the process of making a revert bin for those who may choose to revert back to the stock Linksys firmware (god only know why)

Many thanks goes out to Tornado, Eko, and Brainslayer for their work on this! Also, thanks to Luniz2k1 that wrote the original how-to that my lazy ass ripped off to make this one.

If you don't know how to install homebrew apps on your phone, see this link for more info.

Some of you may be a little leery about installing something like this.  If you want to view the source code before you install it, just ask.  It's just HTML with some java thrown in.  The mobile web version can be found here.  Plus, Apple didn't have any problems!

-Greg

While accepted by Apple for use on their iPhone and iPod Touch, the PayPal Fee Calculator was written to work on any mobile device. The company has stated that they are currently working on other applications, but would not give any details about what they are working on. “There’s a couple of things that are in the pipeline. I didn’t want to get started on anything else until I saw what the reception to this first app was going to be” said Mr. Ledet. “It didn’t take long to put this one together, so the next app should be coming out soon”.

The PayPal Fee Calculator can be found today on the front page of Apple’s webapp store at www.apple.com/webapps.

PayPal Fee Calculator on Apple.com: http://www.apple.com/webapps/calculate/paypalfeecalculator.html
Direct link to PayPal Fee Calculator: www.gregledet.net/ppfcm.html
Apple Inc.: www.apple.com
Gregory Ledet Designs: www.gregledet.net
Le’ Day Consulting: www.ledayconsulting.com
Non-mobile version of the app: http://www.gregledet.net/?page_id=385

Tolstoy version:

A few weeks back I received an iPhone 2G as a gift. My wife and I had originally bought it for my father-in-law when the iPhone first came out. He lives in Toronto and had the phone jailbroken so he could use it on Rogers' cell network up in Canada. Somehow or another the phone's firmware got updated which killed the jailbreak on the phone and he could no longer use it on the Rogers network. Well, not being a very technical guy, he thought he broke the phone. He went out and got himself a brand new iPhone 3G S and gave the 2G to me.

He knew that I would figure out a way to get it working again and he was right. After I figured out what happened to the phone to begin with, I simply upgraded to the 3.0 firmware and jailbroke the phone. Well, I don't have AT&T. In fact, I'm a Sprint customer, so I can't use it as my cell phone. Once I hacktivated the phone, I went ahead and started using it as another iPod Touch. My 2nd Gen iPod Touch is only 8GB and this one is 16, so I loaded it up with music and put it in the car (my car's radio has an iPod cable). Well, I really like the iPhone and was trying to figure out a way that I can use this thing to make calls. There's tons of VoIP apps out there, but none of them gave me the clarity I was looking for. I even tried using the Skype app and while I sounded great to the person I was calling, they sounded like crap to me. Enter Vonage Mobile.

I've been seeing commercials for Vonage Mobile for a few weeks now. It talks about how low it's international rates are and I got to wondering how it would work for domestic calls. The info in the app store said nothing of domestic calls, so I downloaded it anyway to give it a shot.

Setup was simple. When asked for my iPhone's phone number, I entered my Google Voice number. It called that number to verify and it simply went to my Treo Pro. Once everything was up and running, I made some test calls to my wife and best friend. The sound quality was amazing on both ends and best of all, domestic calls are FREE! Granted, I can't use this thing as a "real" cell phone because Vonage only works over WiFi, but when I want to call someone that I don't want to have my cell number I can use the iPhone so they get my Google Voice number. It'll also come in handy when I'm charging my Treo Pro or something. I'll figure out a way to use it pretty often.

One thing that is cool about this is if you have the cheapest plan that AT&T offers for your iPhone, you can use Vonage to make your phone calls while you're at home or around a hotspot and NOT eat up your minutes! I don't think that Vonage is advertising that you can make free domestic calls from their app, so I just thought I'd pass the info along!

Also, if setting up QoS after you do this, the ports are 5060-5062.

I know that I've been moving further and further away from the main purpose of this blog, and that's Cisco networking and security. I'm putting this here so I can remember how to do this stuff later and have a place to look! The MyBook World Edition is a great device that you can do tons of stuff with. It runs Linux, so just about anything you can do with Linux, you can do with this device.

First off, you need to enable SSH on your NAS. There's a few different ways of doing it. Martin Hinner was the original hack. I've used this method before and it works just fine. There's also a slightly cleaner way of doing it found here. I have both scripts on my server should something happen to either one of those.

Martin Hinner Original Hack

http:///auth/firmware_upgrade.pl?fwserver=gregledet.net/mybook/firmware.php

Slightly Cleaner Hack from Mybook-Linux

http:///auth/firmware_upgrade.pl?fwserver=gregledet.net/mybook/enablessh.php

For both of those, simply plug the link into your browser, add the IP of your MyBook, and it will tell you that there's new firmware available. Click the button that tells you Download and Install. It's not going to take the 30 minutes that it'll say on your screen, it should take around 5 or 10. With the Hinner hack, you may get an error message saying that the firmware update failed. This happens with firmware 2.00.15 and higher. Don't fret, the script did run. You'll be fine. Continue on with the instructions.

• *NOTE* If you have an SSH client, great. If now, download PuTTY. I use it and it works perfectly fine. Login with the username "root" and the password "root".
• *NOTE* If you don't know how to use vi, or if you are uncomfortable using it, you can get a program like WinSCP that will allow you to secure FTP into the device. Then you can download the files to your computer and use the editor of your choice to edit the file (notepad works fine) and upload the new file back to the device.

If you use the Martin Hinner hack, after you install the "firmware", you need to make SSH permanent by editing the /etc/inittab and adding the following under the "# Startup the system" part of the file.

::sysinit:/usr/sbin/sshd

The other way should turn it on permanently by itself. After you add that line for the Hinner hack, or once the "firmware" is installed and you can SSH into the device, you need to reboot.

[root@MyBookWorld ~]# reboot

Now you have SSH permanently installed on your MyBook World Edition!

One error that I ran into was not being able to get mplayer CE to connect via samba to the network share on the MyBook. To fix this I had to enable Microsoft Directory Service on the device. First, you need to add the following lines to the /etc/services file.

microsoft-ds    445/tcp                         #Microsoft Directory Service
microsoft-ds    445/udp

Add this after "snpp 444/udp # Simple Network Paging Protocol" and before "saft 487/tcp # Simple Asynchronous File Transfer". Do your best to make it fit in the file. By that, I mean use the tab key.

After this, you need to edit the /etc/inet.d file and add:

microsoft-ds stream tcp nowait root /usr/local/samba/sbin/smbd smbd -s/etc/smb.conf -l/var/log -d0

I would just add it on the second line or at the bottom. I don't think it matters.

One more file to edit. This time you need to add the following to the /etc/smb.conf file under "[global]" after "max log size = 1"

smb ports = 445

A quick reboot and you're done! This will have you connected to your Wii to stream movies with no problem.

There are tons of sites out there that have great information on hacking your MyBook World Edition. With the following 2 sites, you should be able to do whatever you want with it.

Martin Hinner's site on Hacking the MyBook World Edition
MyBook World Hacking at wikidot.com

Those sites should answer any questions you have about anything having to do with Hacking the MyBook World Edition!

I missed the fun stuff that DD-WRT gives me. After doing some research on putting DD-WRT on the WRT310N, I decided that it wasn't very likely that I would brick the thing, so I got to work on it.  First thing you are going to need is the firmware files.  You can download everything you need here.  In that zip file you're going to find multiple version of the firmware. I'll get to those in a second. Now, let's do this step by step.

1.)  DO A HARD RESET BEFORE YOU FLASH FIRMWARE. This does not mean hitting the reset button and saying you are done. This means doing the 30-30-30 reset. To do a 30-30-30 reset you must push the reset button with your router powered on. Hold it for 30 seconds with the router powered on. STILL holding it, pull the power cord for 30 seconds. Still holding it, plug the router back in and continue to hold the reset button for 30 more seconds. You will have held the button for a full 90 seconds without releasing it. You will not get a password renewal page as you have stock Linksys firmware on the router still.

2.)  Plug a cable into the lan port of the router and your computer, and disable any wireless to the computer. You may have to set a static IP on your computer (I did). Set the IP on your computer to 192.168.1.2, subnet of 255.255.255.0, and the default gateway of 192.168.1.1.

3.)  Go to 192.168.1.1 in your web browser. The stock Linksys username is "admin" and the stock password is "admin".

4.)  Go to the "Administration" tab and click on "Firmware Upgrade".

5.)  Browse to the dd-wrt.v24_mini_wrt310n.bin file that is part of the .zip file I linked to at the top of this post. YOU NEED TO INSTALL THE MINI FIRST! You CANNOT install the standard yet.

6.)  Click on the upgrade button and WAIT for the upgrade successful message.  Give it some time and don't be so impatient.  I have received too many emails and comments from people that get impatient and start messing with stuff before the flash is complete.

7.)  Power cycle your router. (very important) WAIT until you can relogin at 192.168.1.1.  This should take around 20 seconds.  If it takes longer, it takes longer.  Once again, don't get impatient.

8.)  Once the Web GUI for DD-WRT comes up, you will be asked to change your username and password.  Do this immediately.

You can now upgrade to any generic dd-wrt build except Mega and Micro, or you can just leave the mini on there. The Wiki says that you need to do a hard reset before and after flashing to new firmware, but I didn't have any problems without doing a hard reset between the mini and the standard.  NEVER re-use a configuration file from a previous build or another router. Reconfigure from scratch.

Now, about the files in the .zip file.  I have included a multitude of firmware packages that will run on this router.  I have the standard, usb, VoIP, and VPN.  All of these have different functions.  I originally put the standard version on and ran into some issues because the Port Forwarding has a bug in it.  You can't add ports to forward!  Once I put the VPN version on, it solved the Port Forwarding issue.  So, if you have to do a lot of Port Forwarding on your router, I suggest using the VPN version that is included in that .zip file.

I hope this guide helps you out.  I haven't had any problems with it yet, and if I do run into issues, I'll be sure to post them here.  Let me know how your upgrade went in the comments below!

-Greg

***EDIT***

I have run into 1 issue so far.  I started messing around with the router trying to set up different things on it.  When I really started banging on it and resetting it, I was having trouble getting an IP address over the WAN link.  Granted, all this took was rebooting the router and the cable modem, but I felt like I should let you guys know.

ip local pool WebVPNPool 10.10.7.100-10.10.7.200 mask 255.255.255.0

webvpn
enable outside
svc image disk0:/anyconnect-win-2.3.0254-k9.pkg 1
svc image disk0:/anyconnect-macosx-i386-2.3.0254-k9.pkg 2
svc enable
tunnel-group-list enable

group-policy WebVPNPolicy internal
group-policy WebVPNPolicy attributes
dns-server value YOUR.DNS.IP.HERE
vpn-tunnel-protocol svc
group-lock value WebVPNAccessProfile
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Split_Tunnel_List
default-domain value yourdomain.local
address-pools value WebVPNPool
webvpn
svc ask none default svc
hidden-shares none
file-entry disable
file-browsing disable
url-entry disable

tunnel-group WebVPNAccessProfile type remote-access
tunnel-group WebVPNAccessProfile general-attributes
default-group-policy WebVPNPolicy
tunnel-group WebVPNAccessProfile webvpn-attributes
group-alias WebVPN enable

Pretty simple, huh.  Have fun with it!

-Greg

I didn't have a printer setup in my last installation because I didn't use Linux for any kind of printing.  I want to get into using Linux for more and more things, so I figured it was about time to setup my printer.  I have an HP PSC 1510 All-In-One that is upstairs in my office and it's plugged into a Netgear WGPS606 Wireless print server.  I have no cables running into the office (stupid apartment!), so everything up there is coming off this print server/wireless bridge. A little bit if digging and I finally figured out how to setup this print server in Ubuntu.  Follow the directions below and it works like a charm.  I know this had nothing to do with Cisco networking, but neither did my article on Creating a transparent signature stamp in Adobe Acrobat.

Before you get started, make sure you have the latest firmware on your print server. You can find it here. The latest firmware is 1025 as of today.

1. Go to http://localhost:631
2. Click "Administration" in the header.
3. Authenticate with user: root, password: root's password if you are asked to.
4. Click "Add Printer" in the Printers section.
5. Fill in at least "Name" and click "Continue"
6. In the Device Dropdown box, select "LPD/LPR Host or Printer" and click "Continue"
7. In the Device URI box put "lpd://<your_wgps606_ip>/L1" or "lpd://<your_wgps606_ip>/L2".  L1 is for the first printer, L2 is for the second.  In my case the full URI is lpd://192.168.1.5/L1.
8. Select your printer's make and click "Continue"
9. Select your printer's model and click "Continue"

That's all it takes! Shoot a test page to the printer to make sure that everything is working and you should be done! If you have more than one printer plugged into the print server, simply run through the process again and put the other port number in the URI box in #7.

-Greg

I was completely honest with the people in the first interview.  If I didn't know a question, I told them I didn't know the answer and how I would find the answer.  In the second interview though, I drew a complete blank mind.  I didn't remember simple trunking protocols, something that I should remember from my CCNA.  I stumbled over many questions that they asked and most of the stuff was simple things that any CCNA should know, but my mind was clouded.  I choked up, I got even more nervous, and I found out this morning that they passed on me.  I was told that I wasn't strong enough to work there.

I haven't heard back from the firewall job yet and I'm hoping that something comes of it.  I have been in Ohio for a year and 3 days now and I have worked for a total of 3 weeks.  I guess I'm really going to have to hit the books hard and get some of this basic knowledge back to the front of my mind!

Check it out.  I promise, you won't be disappointed.

Now, I have a confession to make.  I bricked my WRT54G2.  I wasn't paying attention and tried to upgrade to a newer version of the firmware when actually it was an older version.  I'm the guy that wrote the how-to on upgrading this router and I screwed it up.  Awesome!  You should be fine as long as you follow the directions in my previous post on this.  Currently I'm running a WRT54G v6 and a WRT310N at the house.  The 54G is running in G only mode, the 310N is running in N only mode.  The reason I'm doing this is because when you run a dual band router in mixed mode, it's going to suck.  I was only connecting to the 310N with my N adapter at 65 Mbps.  Once I added the WRT54G in AP mode and G only and moved the 310N to N only mode, that jumped to over 130 Mbps.

If there are any more questions about this, please don't hesitate to post them.  I'll be more than happy to answer your questions.

-Greg

Dear Technical Recruiter,

I would first like to thank you for contacting me about the position that you are trying to fill.  I appreciate that you either found my resume on one of the web's many job sites or that I was already in your database.  Before we get into your email, I would like to cover a few bases with you that I think may help you not only in this search, but in future searches as well.

First off, if we have a previous rapport, it is perfectly fine to contact me with few personal details in your email.  Evidently we have spoken before and you are just passing along information for my consumption.  If we have never been in contact before, I feel that a short introduction is in order.  At least tell me who you are and who you represent.  And no, your email signature is not good enough.  It's not hard to throw in a "Hi Greg!  I'm Joe Schmoe with ABC IT Services!"  It's much better than "I saw your resume online. Look at this job." followed by a signature.  I'm a person... trying being personable.

Secondly, as a technical recruiter, it may help that you have some technical knowledge.  I'm not saying that you have to know everything.  All I'm saying is that some knowledge may be helpful.  It really makes you look like an idiot in some of the job postings when you have no idea what you are talking about.

On that subject, let's talk about industry certifications.  Learn them.  They are your lifeline to the "real" world.  You need to know what each certification is, where it stands in the hierarchy of that technology, and what kind of knowledge it takes to obtain each cert.  Send me one more "entry-level" position that requires a CCIE and I will reply with a very rapidly spreading virus attached to my resume.  Trust me when I say your virus scanner will not pick it up either. And don't think I'm joking with you.  I will do it.  In the world of Cisco, it goes CCENT -> CCNA -> CCNA - Speciality -> CCxP (where x = speciality) -> CCIE - Speciality.  The "A" in CCNA means Associate, the "P" in CCNP means Professional, and the "E" in CCIE means EXPERT.  May I suggest a quick trip to Cisco's website to brush up on those certs.  It takes all of 5 minutes and makes you look a lot less like a complete idiot.  Microsoft has a page like this to. So does Citrix.  I could continue to link to all the sites, but I'm not going to do your job for you.

Thirdly, let's learn a little English.  Now this is a VERY small percentage of you, but when I get an email that reads "I saw you resume online I like bring your attention to following contract position" I am going to assume that if you can't master the languange of the country you reside in, you can't master your job and therefore I'm not going to want you as the guy that holds my future in his hands.  How can I trust that you will accurately convey my experience and qualifications to the client if you can't accurately convey the job requirements to me?

Now, about the position that you have contacted me about.  Before you start banging out that e-mail to me, do yourself a favor and brush up on those certs we spoke about earlier.  If the job REQUIRES a CCNP and the client is not willing to accept a CCNA in place, don't bother wasting my time or your time.  Also, I have to ask if the client is even sure what he needs.  Is your contact with the client an HR person with no idea what he's talking about when it comes to this position or is he the IT Department head who knows what he wants and needs?  If he's the HR guy, chances are he is about as informed as a house fern when it comes to technology.  He wants to seem smart and impressive so he's going to say he wants that CCIE for his entry to mid level position.  Someone needs to tell him about an old quote...  "Tis better to keep your mouth closed and be thought a fool than open it and remove all doubt".  Let the big boys handle the big jobs.  You are looking for someone to manage your most important asset after your employees; your network.  I understand you want the best person for the job, but please be reasonable in your requests.  Someone that has undertaken the time and expense to obtain a CCIE is not going to even think about accepting your $60k per year job when he can be making $150k elsewhere.

Think/Read before you write/speak/type/forward.  If the client sends you an email with the requirements for a position and in that email one of the requirements is "10 years experience with Microsoft Windows Server 2003" and it's only 2009, contact the client before forwarding me that email.  You will come off like an idiot when I read that and not only will I forward it to all of my friends to show them how big of an idiot you are, I will most likely reply to you to tell you how much of an idiot you are.  If you think that it is a reasonable request for someone to have 10 years experience with Server 2003, quit your job and kill yourself so you do not contaminate the gene pool any further.

Let me give you an example of an unsolicited email that I would like to see.  In this example, you have already looked at my resume and have a position that I may be a fit for.

Greg,

My name is Cheesy McHeadhunter with TekNetSolutions Consulting Technology Management.  I came across your resume on I-Need-A-Job-So-I-Can-Buy-Beer.com and have a position that you may be a fit for.  While the requirements for the job state that a CCNP is required, I believe that the client is/would be willing to accept a CCNA and someone with your experience, so please don't let that deter you from getting back with me.  I believe that your resume fits what the client really needs and I'm ready to talk with you about this position.  You can reach me at 212-382-5968 or my email.  I hope to hear from you soon!

-Cheesy

(signature with contact info)

(job info)

How hard is that?  You don't look like an idiot, you haven't offended me by treating me like just another set of alphanumeric characters in your "to" line, and it's personable and informative.  Wow.  You just got my attention!  It's SO EASY!  You have just become the guy I want working for me.  I now feel comfortable with you bidding me to prospective clients and I will almost certainly pass your information along to my friends that are in the market for technical positions.  You will now have a whole contact list full of qualified and talented individuals that you can easily place, you'll make better money, and you won't become the laughing stock of the talent pool.

I didn't write this letter to offend you.  I wrote this to help you.  I hope you take this to heart and do what you can in the future to at least TRY to change the perception that we, the talent pool, have of recruiters.  To be honest, we hate dealing with you, but we know it's just a fact of life that we have to.  We know you hate dealing with us too.  You think of us as pretentious geeks, and that's OK.  We are.  Let's just try to make the best of it and make it as painless as possible for the both of us.

Sincerely,

Greg Ledet

First, you'll notice that when you plug your phone in using the USB cable, it turns off the phone completely and accesses the SD card in the phone.  A simple way around this is to just remove the card.  Easy, right?  Now you're going to need to change a setting in the phone.  You're going to type ##DEBUGMENU# on your keypad (##332846368# for those of you that can't spell).  You'll need your MSL next.  You can normally get this by asking the person at your local Sprint store very nicely.  It'll be a 6 digit number that you'll type in and it'll bring you to a menu.  Go to "Toggle NAI" and Toggle modem off.  Yes, I said turn it off.  Trust me, this is the only way it's going to work.  Once you've got all of that done, create a new Dial-up Networking Connection using your Samsung modem.  Leave the Username and Password blank and use #777 as your dialup number.  That's it!  Pretty simple, eh?

I'm still working out some bugs with this.  The connection doesn't stay up very long, but it will auto-redial, so it doesn't go down for long.  I'm getting about 1.5 Megabit down and 256k up, so it's not blindingly fast, but it works.  Hell, as I write this, I'm sitting in at the bar drinking a beer.  And yes, I'm using my new Samsung Instinct as a modem to do it.

BEWARE!  According to Sprint, even though you have an unlimited data plan, you still have to pay for a PAM plan.  I'm not doing this currently as I'm only testing out the functionality.  I suggest that if you want to use your Instinct as a modem, you buy a plan with Sprint.

After talking with the recruiter yesterday, the account manager met with the customer and brought my resume with him.  After looking over my resume and looking at my experience, they decided to bid me at $*EDIT*/hour, which was in the area we originally discussed.  I can only assume that my tirade to the recruiter about making less than the guy that puts the tail-lights on your Mustang worked.  And it's true.  According to the link I put in the post yesterday, A line worker for Ford is currently making $60 per hour including benefits.  That comes out to right at $125,000 per year with benefits.  I remember working a job in which I was making in the $64k per year range and according to H.R. at that company, my total compensation package was around $88k.  If someone is making $125k, I can only imagine what their take home pay is.  My guess is somewhere in the $85k to $90k per year range.

Again, we need to stand together on this.  I'm not proposing a union type of thing, but what I am proposing is that we stand our ground and make sure that we are getting paid what we are worth.  The average cost to get a CCNA is a little over $3000.  Same for a CCDA.  To get a CCIE, you're looking at well over $25,000 after you pay for the parts to build a lab at home, the books you're going to need, and flunking the lab portion of the test 3 or 4 times at $1250 per, plus the cost to fly to the lab location, pay for your hotel, etc.

As network engineers, we are the keepers of the network infrastructure.  We are the ones that keep our networks running and business flowing.  The stress level of our profession is extreme and we need to constantly keep up with new technologies, new hardware and software (moving to an ASA from a PIX and the IOS that comes with it), and whenever something screws up, we're normally the first to be blamed.  That's why I used to wear a t-shirt to work that said "It's not the network" (which you can buy on the t-shirt link at the top of the page).  Not to mention, we're usually the first line of security on our networks, and that in and of itself carries a huge responsibility.

We need to be paid for all of the crap we have to eat on a daily basis.  We need to be paid for all of the training that we had to go through to get to our current position.  And we sure as hell need to make recruiters realize that, damnit, I've busted my ass for years to reach a senior position and I'm not going to start back at the bottom.  We need to stand up, take a play out of Howard Beale's playbook, and say "I'm mad as hell and I'm not going to take this anymore!"

(Edit) I've decided to edit out what I was bid at on the off chance that I get the job and one of my coworkers looks me up.

I received a phone call this morning from that same recruiter.  He was getting ready to have lunch with the client today and wanted to discuss with me my asking rate.  He told me that he wanted to be competitive and asked if I'd be willing to come down on that rate a little.  I tried to explain to him that I would be willing to come down slightly, but at the same time, I have a resume and a salary history to think about.  Not only that, but I don't feel that I should have to lowball my salary, especially with my experience, to get a 3 month contract.  That's when he hit me with a bit of a bomb.  He told me that he has spoken with other network engineers that would be willing to do the job for $25 per hour.

What the hell is wrong with people?  This is a SENIOR position, not entry level.  Why would someone be willing to belittle themselves and the industry by offering to do a job for so little?  I had to explain to him that I was applying for a senior level position and not an entry level job.  I'm not some kid fresh out of school with a brand new CCNA and no experience.  Then he hit me with a real bombshell.  An entry level engineer with a college degree and a CCNA only makes $15 per hour.  That's $31,200 per year!  I can't even pay my bills with $15 per hour and wouldn't be living comfortable at all with $25 per hour.

I know the economy is in the crapper folks, but as a group we need to stick together and tell these companies that our job demands a serious salary.  If you go into an interview and tell someone that you're willing to work for 2/3 what everyone else makes, you need to reevaluate your position.  Companies need network engineers.  That need will not be going away anytime soon.  If you are a senior level engineer, you need to stand up and tell them "I've worked very long to reach a level of salary that I feel I deserve and I'm not going to fall back to the kind of money that a highschool kid makes!"

I don't know about all of you, but I've busted my ass with hours of study, thousands of dollars in books, labs, tests, etc., and I've dealt with more stress than I can imagine.  Yet, a UAW worker for Ford makes $55 per hour, including benefits.  I promise you that a line worker for an auto company hasn't had to go through all the bullshit that I have to get certifications and make sure that he keeps up with the absolute latest in technology.  An UNskilled laborer demands more money than a network engineer.  WTF is wrong with that picture?

I told the recruiter to use his best judgement in shopping me to the client.  I feel that my resume and experience speaks for itself.  I also told him, and I was very blunt in this, that he better not screw me.  If he thinks I'm going to be offended by his offer, don't bother calling me.  The last recruiter I dealt with here did that and it really pissed me off.  I told him I wanted $80k per year, he came back with $50k per year.  I got it up to $65k, took the job, then got laid off 3 weeks later because they didn't have enough work.  I'm not going to let that crap happen again.

Fellow engineers, don't take this crap from recruiters.  I know times are hard and bills have to be paid, but if you hold out just a little longer, the companies are going to come full circle.  They will realize that you need to be paid for what you do and what you know.  Don't lowball yourself!  It's not very becoming of you as a person and it will only hurt everyone else in the field that's out there looking for work.

Hope this helps!

Router (config)# login block-for <seconds> attempts <attempts> within <seconds>

What this is used for is to block people from running a brute-force or dictionary attack on your password.  Normally, the IOS will allow you an unlimited number of attempts to get in, but with this command you can block all logins for a specified number of seconds.  Let's say that you replace the options with (in order) 180, 5, 30.  That means that if someone fails to login after 5 attempts in 30 seconds, the router will block all logins for 180 seconds.  Keep in mind that if an intruder figures out that you're running this, he can perform a kind of DoS attack on you because he'll just keep trying and without plugging in the next command, not even you will be able to login to your own device!

Router (config)# login quite-mode access-class <acl>

Quiet-mode is what the router goes into when it's blocking logins from the previous command.  If you put together an access-list, say "access-list 10 permit 192.168.1.0", then only IP addresses from that access-list will be allowed to login while the router is in quiet-mode.  Think of it as your back door in when someone is screwing with you.

Router (config)# login on-failure log <every #>

This will log a syslog message every blank-number of attempts on failures.  Set this to every 2 or 3 failures, because even though you're the administrator of the box, you're going to fat-finger a password or just mistype it every now and again.  If you have good security, you might want to log every successful login, and you do that with...

Router (config)# login on-success log 1

This will create a syslog message every time someone successfully logs in.

Router (config)# security password min-length <number>

I think this is pretty self explanatory.  It's always a good practice to require a minimum length password on your devices.

Router (config-line)# exec-timeout <min> <sec>

You'll notice that this command is issued under a VTY or Console line, and you've probably seen it before.  The default for this command is 5 minutes, and I can't stand getting kicked out of a router after only 5 minutes.  I may be looking something up in Google or something and next thing you know, I've got to log back in.  I normally set this to 15 minutes. You can also do a "no exec-timeout" and that will disable it completely, but you should only do this in a lab environment.

Router (config)# service password-encryption

This will encrypt every clear text password that you have on your router.  So if you have a console password or something like that, it'll be encrypted.

Hope these help you button things down!

-Greg

-Greg

You'll need the following files:

Linksys TFTP utility
VxWorks Prep
VxWorks Killer
DD-WRT Firware

I've put them all here for your convenience.

Here is another How-to with a little more information that is based off this one.

Get and install Linksys tftp.exe, set your PC to static IP, 192.168.1.10.

1. Reset the router to defaults on the Linksys Admin page, and let it reboot or manually reboot it after its finished.

2. Set your computer to a static IP of 192.168.1.10/24 and plug Ethernet cable into one of the LAN ports on the router.

3. Close all your browser windows. Start the tftp utility, set server to 192.168.1.1.  Password is "admin" and browse to the VxWorksPrep-G2V1.bin file. Click Upgrade. Wait a minute for it to reboot on its own, if it doesn't, then power cycle the router manually.

4.  In the tftp utility, browse to the VxWorksKiller-G2V1.bin file and click Upgrade. Wait 2 minutes for it to reboot on its own, if it doesn't, then power cycle the router manually.

5. Tftp the DD-WRT firmware to the router, use "dd-wrt.v24-10709_NEWD_micro.bin"; after successful tftp, wait 3 min for the router to finish writing new nvram defaults, etc... It should reboot on it's own at least two times, so give it the 3 min and then open a browser to http://192.168.1.1 (If it not reboots on its own, wait another 1 min, and then power cycle it).

6. When if finishes booting up...do a hard reset on the unit...let it boot again, and configure.

That's it! Now you have a lot more control over your WRT54G2 v1!

I am in the process of setting up TACACS+ across our network. Could you please explain the “default group” part of the TACACS commands. I setup a group in ACS called network admins which is mapped to an active directory group. I want to permit only the users in this group to be able to login to our network infastructure. Would I replace the “default group” part of the command with my network admin group name. Any tips you could give, would be great. Thanks…..Great website!!!

Well Joe, let's see if we can't get you an answer.  Configuring AAA on Cisco devices is always a pain in my ass, and I feel your pain in setting it up across your network, but it will be for the best.

You are a little mistaken in the command structure for AAA, so I'll try to break it down.  After you have enabled AAA globally, you neeed to define the authentication method lists and apply them.  There are 5 authentication methods: local, group TACACS+, group RADIUS, line, or enable authentication.  So the "login default group tacacs+ local" actually breaks down to "login, default, group tacacs+, local". Let me break down the command "aaa authentication login default group tacacs+ local".

aaa authentication login
default: Used to create a default that is automatically applied to all lines and interfaces to specify the method or sequence of methods used for authentication.

group group name: Used to specify the use of a AAA server. The group radius and group tacacs+ methods refer to previously defined RADIUS or TACACS+ servers. The group-name string is used to specify a predefined group of RADIUS or TACACS+ servers for authentication.

local: The local username and password database is used.

To put that simply, you're telling the device that the default way to login is to use TACACS+ first, and if the TACACS+ server isn't available, to use the local database.  This goes the same for all of the other commands.  There is no "default group", but rather you're telling the device that the "default" action is to use "group tacacs+".

I hope that clears it up for you!

Oh, and I almost forgot.  If you only want to allow your admins access to your devices, you do that through the Cisco Secure ACS administration tool (the web admin page), not on the devices themselves.

One last tidbit... TACACS+ uses TCP port 49.

And don't forget, if you have any questions that you want answered, don't hesitate to shoot an email to Greg@GregLedet.net or leave a comment on the post you have questions about!  This goes for everyone!

So I got my hands on the Cisco uBR924 you see in the rack.  It uses H.323, but I couldn't find a reliable H.323 provider to give me a number.  And I'm lazy.  I'm sure I'll get around to using the H.323 in the modem sooner or later, but I wanted to try this product out anyway.  I ended up ordering a MagicJack.

Well, MagicJack doesn't support Server 2003.  But the only box that I have that stays on 24/7 is my server.  And my server runs... you guessed it... Server 2003.  My install went a little like this.

1. Plug the MagicJack into a USB port and let the drivers install.
2. Once the install runs, go to "My Computer" and run the Autorun on the MagicJack drive
3. Let MagicJack install (it downloads its software)
4. Get the message "No audio devices found no output/input devices are found".
5. Curse loudly at computer and say something along the lines of "Oh, you are GOING to work..."

Because I'm an idiot and didn't realize what I was doing, it was flat NOT going to work.  The reason being is the only sound driver running was the Microsoft RDP Sound Driver.  My server is headless, therefore I needed to be RDP'd into the box.  I'm going to go ahead and make a long story short...

I plugged a keyboard into the box and logged in locally.  I tried to "mstsc /v:server /console", but it still had the RDP driver.  I haven't looked into it, but there may be someway to use the local drivers during that console session.  Once I was logged in locally, I shadowed the local session from an RDP session.  I turned on the Telephony Service, installed the sound drivers (they weren't installed), and started the Windows Audio service.  Once that was done I restarted the MagicJack software and BAM!  It worked.

***EDIT***

I just found out why the "/console" wasn't working when I was RDPing into the box.  It seems that Microsoft changed /console to /admin in Vista for you to login to session 0.  Here's the correct way to do it.  In XP SP2, you want to run "

In Windows XP SP3, Windows Vista or Windows 7, run %systemroot%\system32\mstsc.exe /admin

If you are using Windows XP < SP3 the command is:%systemroot%\system32\mstsc.exe /console

Once you get the client up, you want to make sure that under the "Local Resources" tab you have the audio options set to "Leave at remote computer".  This should fix that damn "No audio devices found no output/input devices are found" problem without having to plug a monitor and all into your server.

From what I've seen so far using WireShark, this is a simple SIP device that runs the G.711 Codec.  Pretty straight forward.  I'll mess with it some more and get back to you guys.

Front of Mini-Lab

Back of Mini-Lab

The 4500M actually has 2 NP-6E's in it (6 Ethernet Ports each).  It's a work in progress, and I'll defidently be adding on to it, but this is just what I could get my hands on at the present time.  Hell, I may even open it op to some of you guys that are working on their CCNA's and stuff to give you a little rack time.  Just to break it down, here's what you're looking at:

Cisco uBR924 Cable Modem / Router.  Actually supports H.323 voice too
2 x Cisco Catalyst 2924XL-EN switches.  Need to move packets somehow!
Cisco 2620 Router.  With WIC-1DSU-T1.
Cisco 3620 Router.  With 2E-2W and WIC-1DSU-T1
Cisco 4500M Router.  With 2 NP-6E's.  We used these when I was working for an ISP.  Real monsters back in the day

Like I said, it's a work in progress.  I hope to really build this rack up and make it quite the monster.  I'm looking into getting a 2821 to do VoIP with along with a 3560-12 PoE and a couple 7690's.  It should be sweet!

Router(config)# clock timezone EST -5
Router(config)# clock summer-time EDT recurring 2 Sunday March 02:00 1 Sunday November  02:00 60

Now, let's explain.  What you are doing here is starting by telling your device that you want to set your normal time-zone as Eastern Standard Time with an offset from UTC as -5 Hours.  Then you're going to configure "summer-time" or daylight savings time.  "EDT" is the word used for Eastern Daylight Time.  I'm setting it as "recurring" as we have it every year.  Then I'm telling it to start on the 2nd Sunday of March at 2:00 AM and to end on the 1st Sunday of November at 2:00 AM with a 60 Minute offset.  The US Navy says that these are the proper dates (click here for proof).

While we're at it, let's make sure that our clock is correct.  Here's 2 NTP servers I like to add to my configs:

Router(config)# ntp server 149.20.54.20
Router(config)# ntp server 64.73.32.135

The DNS names for these servers are 0.north-america.pool.ntp.org and 1.north-america.pool.ntp.org.  You can be pretty sure that they are going to be correct.

[google -7024262304430693648]

-Greg

Yeah... I'm in love...

-Greg