Windows Server 2008: It's going to blow your mind.

So at the end of my Vista week of review, I said I was going to cover why Windows Server 2008 is a completely different beast than we're used to looking at. I know I've mentioned it before, but I'll say it again: I'm a Linux guy. Of course, I know Windows too (after all, being an operating system bigot is no way to get hired in today's world), but I'm always going to try and advocate the use of an open platform. That having been said, no one platform can satisfy the needs of everyone all at once. What works for some, won't work for others. If you're going to host web sites, something for e-commerce or some such thing, I'm going to suggest apache on Linux. If you're looking to administer 40-some Windows XP machines, I'm going to recommend Windows Server. Getting down to the meat of things though, Windows Server 2008 really does more than any previous edition of Windows Server has. What exactly? Keep reading.

Imagine, if you will, a server without a GUI. This server runs Linux, has a bunch of network oriented services, and needs to serve an unknown number of clients at any given time. Top it off with the fact that you won't be logging into it very often. Since a GUI won't be running 100% of the time to support unlikely local logins, you've got all those extra resources for clients.

One of the major problems with Windows Server is that you've always had to run a full GUI while handling services at the same time. If you're not going to touch the box that often, what sense does that make? Enter Windows Server 2008 core; it doesn't have a GUI per-say, but it can if you want it to. You can run certain .NET framework applications on Core. For example, a reduced version of notepad, task manager, etc. You're still running a minimal GUI environment, with access to command prompt as your main interface. From here, you can even launch Power Shell on core (which is by far more exciting to use). A Server Core system will offer definite measurable performance gains in any service you run on it. Add to that the security benefit of a slimmed down operating system, providing a smaller attack surface (less software to attack).

Okay, so core may be cool, but we're not done yet. Remember how I was complaining that it makes no sense to restart so often for non-kernel updates on Vista? Well, it's time for me to give some kudos to Microsoft, as promised. Windows Server 2008 has a drastically reduced need for restarts involving updates. Given that I've been working on a W2k8 server for a month or two now, it's a definite improvement. And while we're on the topic of server reliability, Server 2008 makes use of Self-Healing NTFS. Self-healing NTFS will repair file system related issues on the fly, on an online disk. Previously, such repair required a reboot into a safe mode type environment with something like chkdsk. This isn't something you have to set, it's something that happens automagically (Yes, automagically really is a word). If your system detects corruption, it'll lock down the area of corruption to make it inaccessible while repairing issues. Need to add another CPU to your server? So long as you've got the right hardware, you can just slap it in there without having to reboot. Additionally, assuming your hardware supports it, you can hotswap a CPU on the fly without a reboot as well. Of course, you'll still need at least ONE CPU in there.

Virtual machines are big now. If you need to run multiple different operating systems and you've got a fairly beefy box, there's no reason not to use virtual machines. Previously, we had VMware products for server level virtualization. In Server 2008 comes Microsoft's Hyper-V virtualization system. As its name suggests, it's a hypervisor that sits between your VM's and your hardware at the kernel layer. If you've ever heard of Xen, it's pretty similar in concept and design. Hyper-V can even act as a Xen hypervisor. This is great if you've got a Xen enabled operating system and you want to get all the benefits such a configuration can provide. Running Hyper-V on Server 2k8 Core has some pretty impressive results as well.

A common reason to use Windows Server is for Active Directory. Server 2008 still has active directory, of course. In addition to AD though, you can also set up a "Read-Only" domain controller, or RODC. What use could this be? Well, let's assume you're dealing with a large corporation, and you need to set up a DC at a smaller office. Unfortunately, due to budget constraints and lack of security at the site, a normal domain controller might cause problems upstream. That's where a read-only DC comes in; everything from normal AD is there, except for client passwords. Plus, you have the added benefit of knowing you won't have to replicate changes upstream, thereby reducing bandwidth usage.

Finally, let's talk about clustering. Clustering involves taking several machines and making them behave as a group, or one intelligent machine. In Windows Server 2008, you can cluster physical machines with Hyper-V virtual machines to achieve maximum uptime. Imagine for a moment that you're taking down one machine that exists within a cluster, that is currently hosting your virtual machine in charge of your website. Rather than be concerned about migrating this VM somewhere else, you can just bring it down. The cluster will start the VM elsewhere and you will have prevented any downtime. Not only can you cluster Hyper-V, but you can also make use of Network Load Balancing in your cluster. This means that if that one box with your VM is getting hammered, you can offload some traffic onto another node on the same cluster running the same VM (presumably).

If you're interested in learning some more about what W2k8 server offers, check out these whitepapers. It's definitely worth a look, and may help you decide what you want to run next time you set up a server box. Hopefully I've catered to some of our hardcore Linux readers, and even our hardcore W2k3 server readers in the features I mentioned. Rest assured though, there way more features in there than I can fit on this blog. For the next post, I'll continue the ARP exploit I started a couple months back (Sorry for the delay!)

Vista Week: Day 6

At last, the final day of Vista week. Today I'm going to tell you about my experiences with Vista multimedia, then I'll give you my conclusions about the Vista OS.

First on our list is DVD playback. I've heard rumors that if you have Vista Business Edition, you can't watch DVD's without installing some sort of DVD software. Not sure about this one, because I have DVD software installed from the OEM on my laptop. Corel's WinDVD comes in handy when watching DVD's, but on one of my previous laptops, it would crash in Vista. Fortunately, that is not an issue on my current laptop. Early on, I noticed that Vista used to cause periodic black screen occurances during movies. In other words, I would be watching a movie, then for a split second, my entire screen would go black before returning to the movie. Audio would continue to play, and the movie never stopped playback during this issue. I never figured out what this was exactly, but my initial thought was that it had something to do with Vista DRM schemes. Fortunately, I don't seem to have this issue anymore. WinDVD will upscale DVD's to 1080p/60 (assuming your computer supports doing so via graphics card / monitor resolution), making it very useful as a DVD player. Also, WinDVD now plays Blu-Ray discs! Of course, you need a blu-ray drive to make use of this functionality, which I don't have or need.

If you watch multimedia on your machine that you've retrieved from the internet (Don't want to know how), Windows Media Player is useful, but only to a certain degree. If you're watching a video clip of previews of the latest shows out of Japan, for example, fansubbers like to throw these video's in all sorts of weird container formats that you may not be familiar with. We all know about .avi's and .wmv's and whatnot, but have you ever heard of .mkv ? How about .ogg? Not only that, but there are codecs involved with containers or formats. What do you know about the H.264 codec? If you check out high definition movie previews through Apple, you'll probably learn that they compress their high definition previews in H.264. When it comes to codec / format hassles, I like Zoom Player. Zoom Player is available as freeware, and will help you with installing any kind of plugin or codec that is needed to play a given video / audio file. From the common to the mundane, Zoom Player probably knows what you need to play it. There is a paid-for version of the software that allows playback of DVDs.

Since I've already mentioned Winamp 5, I won't go into detail what it does. When it comes to multimedia (specifically music) on Vista though, this program is key. Additionally, if you are an Apple nut, you'll probably want to grab iTunes. Be warned though, iTunes on Vista has been problematic for many users, some of whom claimed that after installing the latest iTunes and plugging in their ipods, Vista would blue screen. More than likely this issue has been fixed, but aware that issues could arise.

Another interesting ability of Vista Ultimate is it's media extender functionality with the Xbox 360. With Ultimate, you are able to stream videos to your 360 from your PC. This can also be done with music, for use in such a case where your home theatre speakers are more powerful than your PC speakers. The set back is that this can be relatively difficult to set up, if you're not aware of what you're doing. Some video formats will not be compatible with the Xbox, but they can be transcoded on the fly through a program called Transcode 360. Even with this program though, some formats like .mkv will perform horribly when streamed. Additionally, firewalls can get in the way, as well as anti-virus software. Finally, sometimes the service will just not want to work. If you really want this feature but don't want Vista Ultimate, Windows XP Media Center edition has this functionality as well.

Overall Ratings:

Multimedia playback - 7/10; Vista certainly has some nice features in multimedia playback, and the ability to use Ultimate as a multimedia box for your Xbox is a great idea, but it gets bogged down by other flaws. Weird playback issues with some platforms (black screens, for example) can ruin the experience.
Extender functionality - 8/10; Awesome idea, but one that is still in its infancy. If more support for different formats is added, it has the potential to be one of the greatest revolutions for digital media usage I've ever seen. Unfortunately, due to the legality of including such formats in their software, I doubt it'll happen. Keep your fingers crossed!


Vista's Final rating:

216/280 or 7.7/10

Am I surprised? Not really, no. Vista's bad reputation was largely due to the fact that companies responsible for writing device hardware drivers aren't staying on top of the game. Of course, these manufacturers place the blame on the operating system vendor. Then again, it is equally Microsoft's fault for having shipped an operating system they were highly aware would have issues. Overall though, I think the operating system is pretty usable. If you bought an OEM machine and it has Vista on it, I don't think you should feel the need to downgrade to Windows XP. It's important to remember that not all OEMs will continue supporting users who clear out the original OS that shipped with the machine. Not only that, but you have no guarantee that your OEM hardware will work on XP (No reason why it shouldn't, but are you willing to take the risk?).

So am I going to switch over to Vista now? No, not at all. I do intend to keep it around though, as it has proven it has its uses. It does have some critically appealing features, some of which that we've only just begun to discover (No thanks to Microsoft's wonderfully useful documentation). Despite all of Vista's new features though, I will continue to remain a Linux advocate, and give credit where credit is due.

For the next blog post, some of you have asked about Windows Server 2008. We'll take a look at what makes Windows Server 2008 one of the biggest changes in Windows operating systems since Microsoft ditched DOS!

Vista Week: Day 5

On day 5, I figure out how to set a looped movie as my background to create an awesome desktop experience. The catch? It only happens on Ultimate (Sort of). Also, I'll begin my run through on some of my favorite games, both on my laptop and my custom home built machine.

So first things first, I'm going to get some gripes out of the way. I've been giving Vista a fairly good review so far, in my opinion. Even though I've been attempting to remain on neutral ground, my Linux side has nagged at me for the lack of certain features that really should have been part of Windows a long time ago.

Things Vista should've had:

1. Support for more filesystems. What's up with this, Microsoft? You mean to tell me that I can't take an EXT3 formatted drive, a filesystem with relatives that were in use nearly 18 years ago, and have it be read in Vista? Not only that, but Vista detects anything not formatted to FAT or NTFS as an unknown partition.
   
2. 64-bit support only. If you go out and buy an OEM machine right now, I can almost guarantee it'll have a 32 bit operating system. The irony? The processor probably supports 64 bit. In fact, all Core 2 Duo's have EMT64, the 64-bit instruction set. The only way we're going to actually get better 64-bit support is by forcing software / hardware companies to accept the fact that 64-bit is here to stay.
3. Better update framework. As I type, Vista took the liberty of installing updates and completely rebooting my machine, without asking. Or rather, if it did ask, then it asked while I was typing, and I accidentally agreed to it. For one, I'm not entirely clear on why a restart is necessary for an update to minor operating system facets. If Linux only really requires a restart when I do a new kernel install (Even this is unnecessary, since I can continue to run the current kernel until I choose to reboot), then why should Windows restart because of an IE7 update?
4. Package Manager. Summary: I want Synaptic for Windows. If I type in "FTP", I want a list of clients and servers, preferably open source. While this isn't likely to happen, it'd be great to have. I'd have to give Microsoft big nod of recognition for this one.
5. Less versions. I suppose I can understand why we've got multiple versions of Windows. But we only need two or three versions. If Microsoft splits Windows 7 into Home Edition, Business Edition, and Ultimate Edition, I would approve. However, having several different versions of the same product with only subtle features missing is ridiculous for buyers and students looking for certifications alike. Surely this isn't what they intend, but I am not going to be an HSHPBUCP (Home Standard/Home Premium/Business/Ultimate Certified Professional). Lose the multiple versions, so that IT people don't have to be aware of all the nuances that make one version different from the other.
   
6. Free user support. A while back, I actually needed Microsoft assistance. When I discovered what they charged for a support call, and what the likely end result would be, I was amazed. Microsoft not only has you pay for their OS, but they have you pay for support too. I think this is a broken business model, especially when my Vista Ultimate box came with a manual smaller than most children's books (I'll give you one guess which had more useful content). It's time for a bigger manual with less pretty pictures and more factual information, with free user call-in support, or at least a limited number of support calls included with purchase.

Now that we're done with that, let's get on with what many of you are probably interested in. For years now, the Windows operating system as been the choice platform for the vast majority of game developers out there. Games themselves have been responsible for some of our more important computer developments and hardware. So how does Vista perform as a gaming platform? Microsoft gave Vista the ability to make use of Direct X 10, the latest in their long line of gaming API's, so one might expect incredible gaming experience on Vista. Unfortunately, many have noted this is not the case, citing huge frames per second differences between XP and Vista. DX10 makes use of emulation for some earlier versions of DX, sometimes completely destroying backwards compatibility for some games.

Fortunately, Red Alert 3 is brand new, and is Vista compatible. Red Alert 3 is a real time strategy game from the Command and Conquer universe. In order to really benchmark Vista's performance, I tried it on my laptop first. The game ran poorly at the lowest settings, but it was still somewhat playable. On my custom PC, the game actually ran perfectly at the highest settings. There was some slightly noticeable difference between Vista's performance on the game and XP's (A few dropped frames once a huge army has been assembled, while zooming in and out).

Next up, Unreal Tournament 2004 and UT3. Unreal is Epic Studio's (Creators of Gears of War, if that is more familiar to you) original claim to fame. It was one of the first games to create an incredibly dense 3D environment using only a software rendering engine. Since UT2k4 and UT3 are the latest incarnations of this game, I tried them out on XP and on Vista, this time sticking to my custom PC. Amazingly, Vista actually performed *better* than XP on Unreal Tournament 2004. Needless to say that I was shocked, especially when Vista was rumored to perform horribly on first person shooters. On Windows XP, Unreal Tournament 2004 would stutter under dynamic lighting conditions due to textures of objects making use of shadowing, dropping from 400 frames per second to 20 frames almost instantly. This would only occur for me on some maps, not all of them. Vista however, performed flawlessly with dynamic lighting conditions and maintained a 350 to 420 frames per second range on all maps. I have to give huge credit to Vista on this one, but I suspect the issue may involve NVidia's graphics card drivers. I find it strange that the issue would be non-existant on Vista, though. Unreal Tournament 3 followed the same lines, but no issues on XP. A few crashing issues were noticed on Vista, but a game patch quickly fixes such issues. Frames per second on both operating systems were around 50 - 60.

Lastly, a DirectX10 game with the incredible reputation of completely grinding expensive gaming rigs to a bitter slowdown: Crysis. On Vista, I get to make use of the DX10 features. Windows XP can still be used to play the game, of course, but it will only be able to make use of DX9 based textures. Crysis on Vista looks incredible, but even on my gaming rig I couldn't turn all settings to their highest level. While I maxed out my graphics settings, physics couldn't be run at their highest, despite having a quad core CPU to play with. FPS for Crysis on Vista was anywhere from 23 to 48, depending on what you were looking at. XP was a little better, no DX10 acceleration bumped the FPS up an average of 10 - 15 frames.

My conclusion for games is that Vista really isn't as bad as it's reputation makes it out to be. The main issue you'll encounter is software that doesn't want to run on anything post-XP. The sad thing is, if getting these games to run on Vista is problematic, I can only imagine what will happen when we go to Windows 7. Windows 7 is supposed to drop all backwards compatibility, expecting such games to run in a virtualized environment.

Last topic for today: Animated backgrounds. I love this idea, despite the fact that it'll take a little bit of resources to loop a background. Still, this is something long missing from the desktop experience: the ability to make your desktop look alive. If you have Windows Vista Ultimate, you can get the DreamScenes software that will loop a .wmv or .mpeg video file on your desktop. DreamScenes utilizes your GPU to handle the processing information, so if you're just cruising on the web or doing non-graphical tasks, you probably won't notice much of a performance difference. What about when you play games though? Because DreamScenes is handled in a similar manner to the Aero theme, it will automatically halt playback on the launching of a graphics accelerated program. You can obtain DreamScenes on Ultimate through Windows Update, under optional updates. For those of you without Ultimate, there are ways to circumvent this and get DreamScenes on other versions of Vista, but I will not mention them here.

Overall Ratings:

Vista DreamScene - 10/10; No joke, this is awesome. Animated Desktop backgrounds made from a looped movie file? Brilliant idea, and it is given a good amount of thought. Yet, not making this available on other Vista operating systems is a real slap in the face.
Vista Gaming Ability - 7.5/10; Some games work perfectly, others die at loading screens. Maybe there are patches available? Who knows, but the three major games I looked into worked. My only issue (and I didn't go into detail about this game) was that Civilization 3 wouldn't load through Steam. Other than that, I got some really great games to work fine.
Features that Vista lacks - 1/10; Some of the things I mentioned may be asking too much, sure. But surely the ability to recognize more filesystem types is a must. I realize that Linux is a small portion of the market share to be catering to, but remember, Linux IS present on 80% of the worlds most powerful super computers. The same is true on the reverse side in the embedded systems market. Whip out that extra mile of filesystem support Microsoft, and I'll salute your ability to cater to customers (Or at least, to me. ;) ). I do give Microsoft an extra point though, for at least attempting to work with Novell to improve Linux / Windows integration in an administrative environment.

The next entry will be the last of Vista Week, covering Vista's ability to handle multimedia files. How does Vista perform with high definition video? What about format support? What video software do I recommend for getting the most out of your multimedia library? Find out on Day 6!

Vista Week: Day 4

One of the first things I do on a Windows box, XP, Vista, or otherwise, is to install Firefox. Internet Explorer was previously one of the biggest security holes in the Windows operating system, and depending on who you ask, it may still hold that title. I personally have no beef with IE7, other than the fact that it is not Firefox. It's use of tabs was the next evolutionary step in browser development (even though other browsers had them first), and the new polished interface takes more of my precious resources, as one would expect a new version of a software to do. Still, it is a great browser to download Firefox through. On that note, I can only hope that IE8 has a built in "Alternate Browser" installer that automatically grabs Firefox for you. Slip-streaming the Firefox-acquisition process would actually probably benefit Microsoft in that they would take less flak for monopolization of software, giving the user a readily available alternative. Microsoft has already played nice and helped the Mozilla dev team get the Firefox browser compatible with Vista, and gave it a birthday cake in celebration (See below).














(No, the cake is not a lie.)

Previously, Microsoft's Windows Update services would have to be accessed either via the operating system's built in utility or through windowsupdate.com. Now, browsing to windowsupdate.com on a Vista box will inform you that you will need to use Vista's built-in update utility. The utility itself is actually rather nice. It gives you all the options you would most likely need, and unlike the XP version of the utility, it usually completes your updates without failure. I've yet to have a problem updating.

I'm going to talk a little more about some useful utilities I use on Vista. If you're a heavy Linux user and you find yourself trapped on a Vista machine, Cygwin is for you. Cygwin is a kind of Linux / Unix emulator with a package management solution built into its installer. You can compile source code to get some programs from Linux and Unix working on top of Cygwin inside of Windows.

For example, lets say you really want nmap (Greatest port scanner of all time) and ssh-server (Greatest remote command line server thing of all time) on your Windows box, through command line. Simple, just grab Cygwin and go through its package management install utility, select nmap and ssh, and you'll get all the basic commands a Linux machine would have. "ls", "man", "mv", "cp", and many more are included. They're not aliases to Windows commands, they are actual open sourced binaries compiled for Cygwin's environment to run specifically on top of Windows. A great deal of open source utilities out there that originally developed on a Unix or Linux platform will even require Cygwin.dll, so having Cygwin installed just makes sense. Just to clarify, Cygwin does not install a new bootloader or mess with any Windows boot settings.

Maybe that's a little too much for you. Maybe what you need is the ability to run any operating system on the fly, depending on what your needs are. The answer for this need, is of course, VMware Workstation. Is it worth around 200 dollars to be able to run any Windows or Linux VM inside of Vista? Oh yeah. But what about VMWare's free alternatives? Though you can run virtual machines inside of VM Player, you can't create them. And don't even think about trying to install VMware Server 2.0 inside of Vista. For the moment, doing so is more of a headache than one would expect. VMware workstation works great inside of Vista, and I have had no problems with it.

On Day 2's comments, one of our readers, Peter, noticed that his install of a Vista took 60 GB. This is when I like to use a utility called WinDirStat. WinDirStat will go through your drive, then give you a graphical readout displaying where the majority of that used up space resides. Then it'll colorize a sectionized window displaying what type of file takes up the most space on your drive. It's great for hunting down those random huge files you downloaded at 2 in the morning, then completely forgot about, leaving them to hog your space. If you're trying to maintain a Vista install on only about 50 GB worth of space (Ouch) like I am, WinDirStat is a must-have application.

Windows Media player may be nice, but it fails in comparison to Winamp 5. It's skinable, can be loaded with 3rd party plugins, and can do video. It has been my experience that there is virtually no audio file Winamp can't play, while trumping WMP's resource usage and layout. Fortunately this little miracle works on Vista, otherwise I can guarantee that I'd go straight back to XP. If you've got an iPod and don't want to use Itunes but still want to sync it with your machine and have playlists set up, Winamp 5 can do that too. Even though it does cost money for the professional version, you won't need the professional version unless you intend to rip CD's with Winamp. Professional does come with some other cool features that I'll probably never use, but some of you may want to look into what it has to offer.

Hey, remember when Office 2007 came out and you felt completely alienated by its new interface? So do I, that's why I think you'll love Sun Microsystem's open source application suite, OpenOffice. OpenOffice retains a graphical interface style more similar to Microsoft Office 2003 than 2007 does. Some options might be termed differently, but it is pretty easy to guess as to what each feature maps to in the Microsoft equivalent of the software. If I remember correctly, OpenOffice will even support .docx files. This is great for those of you out there that have been getting .docx documents but have been unable to open them in Office 2003. OpenOffice is free, and will most likely always be free.

For you gamers out there, with your multiple machines, Steam is great. There has been more than one occassion where I was at a friend's house, and didn't bring a specific PC game they wanted to play. Steam can be a pain, but having the ability to download your copy of Civilization IV on the fly without having to worry about CD keys is an incredible way to get sales. Some of us more classic gamers out there will love some of the older games available through Steam (Such as XCOM) with specific setups to allow them to be played on newer systems. XCOM was, for the most part, a DOS game. Getting it to run under Windows XP was near impossible, and required patching. Not only that, but crashes were to be expected, and the patches wouldn't always work. When you play games as old as XCOM, Steam creates a DOSBOX environment, allowing for the game to run in a more natural way. Steam has updated a lot of it's current titles to run near flawlessly on Vista. Don't get too excited yet though, Steam does have drawbacks despite it's retro gaming abilities. For one, you don't have physical media to back up your games. You can't play your games unless you go through Steam, because Steam authenticates your copy of the game through proprietary servers. If the company that runs Steam ever goes under, you may lose your investment. That having been said, Steam has been around for a long time.

One of our labtechs, Ryan, showed me some interesting bluetooth technology in Vista. I'm not a big bluetooth person; I never was, I probably never will be. My iPhone gives me the ability to plug in headphones with built in microphones, eliminating the need for bluetooth headsets. However, I'm all about cool features. Ryan introduced me to Windows Vista's Telephony Audio Gateway for bluetooth devices, which allows me to connect my iPhone to my laptop and pass conversation audio over the built in laptop speakers. It's probably not something you'd use everyday, but if you needed the abilities of a speaker phone in a conference room, this might be your ticket. Kudos to Microsoft on this one, even though it did take some effort to get my iPhone paired to my laptop.

Overall Ratings

Internet Explorer - 8/10; Great springboard platform for grabbing Firefox. Since Windows Update is now strictly controlled through Vista's update process (locking out windowsupdate.com), Internet Explorer is virtually un-used on my system.
Firefox 3 - 10/10*; There's some issues with my biometrics and Firefox, but I can live with that. Not only is Firefox a great browser to use on Windows, it gives you an added layer of protection when compared to a pre-installed integrated browser like IE7.
Windows Update - 8/10; It's not Synaptic, my favorite Linux package manager. But, it gets the job done. Definitely an improvement over Windows XP's update manager.
Cygwin on Vista - 9/10*; I'm not supposed to be using this, according to my earlier list of rules. However, it is something I would normally use on a Vista box, or any Windows box.
WinDirStat - 10/10*; This utility should replace Explorer. When I want to get rid of garbage data filling up my hard drive, I don't want to spend hours trying to figure out where it is hidden. Sure, I could do a search for *.tmp and *.iso or whatever, but who wouldn't want a cool color coded graph thing to show you where the bloat is?
VMWare - 8/10*; Some have noted that Server doesn't install on Vista. Personally, I'd easily spend the 160 - 190 dollars to get the VMWare workstation license anyway. More and more, the IT world moves toward virtualization to stay green and consolidate servers. This movement has spurred the realization of necessity in virtualization, so we might as well get used to using virtual machines. VMWare player is around for those unable or unwilling to purchase Workstation, but it may take some effort to get it to work on Vista.
Winamp 5 - 9/10*; This is the swiss army knife of music lovers; an unrelenting combination of features coupled with unparalleled modularity. With a huge community of users, you can find visual skins that will blend perfectly with your background and personal tastes. It'll handle videos, organize your music library, sync your ipod, and even give you internet radio access.
OpenOffice 3 - 8/10*; It's like Office 2007, except usable. Maybe the buttons aren't as well designed or polished looking as Microsoft's products, but it's free. Everything here is fully functional. Eventually, I'm going to do some crazy SQL stuff with OpenOffice's excel-like program, Calc. I might just do an article on that. ;)
Steam - 6.5*; It's hard rating this one. For one, I'm rating the Steam experience as a whole, rather than just specific games. Some Steam games won't work on Vista, it'll be up to you to figure out which ones do and don't. I was disappointed to learn that Civ3 didn't work, while CivIV works perfectly. What's up with that?
Bluetooth technology - 8.5/10; I'll probably never use it, but I'm comforted by the fact that burried somewhere in Vista's behemoth hard drive footprint is the possibility to use it.

* I'm rating the experience running the program on Vista, not the program itself.

Next we'll be looking at gaming on Vista, what works and what doesn't. We'll talk about some multimedia stuff, and some cool things to do with Vista Ultimate ("Vista Ultimate DVD Frisbee" is not one of them). Keep reading, and you'll find out how you can make an animated Desktop theme on Ultimate!

Vista Week: Day 3

Once again, I will be on my Sony Vaio laptop today. I mentioned the other day that I had three network cards, two of which were wireless. I'll go into detail as to why that is, but first, lets get some things out of the way.

I like the widgets/gadgets bar. I'm not normally amused by little gadgets that serve no purpose (At least, I'd like to think I'm not) and hog a little resources on the side. However, it is nice to pop open my laptop, boot up Vista, and find out the current predicted weather for the day. Plus, having a calendar right on my desktop is a useful addition. You can even add custom gadgets through Microsoft's dedicated gadget site. If you have a multi-monitor setup, you can move the gadget bar to the other monitor.

My laptop has a fingerprint reader that can identify me based on a swipe of a finger. This integrates *perfectly* with Windows Vista. I can easily set up my laptop such that if it were ever stolen, the contents of the drive would be encrypted and could only be decrypted by my fingerprint, through the operating system itself. The process itself is quite simple; once logged in, I create a profile for my current user. Then, I choose which finger I intend to use to log in, and a program records my fingerprint. Lastly, I can specify multiple fingers on either hand to use for log in.

This feature leads to my next discovery. Vista Business moves between Active Directory domains beautifully. Here at the college, it is more convenient to use single sign-on authentication, rather than having to re-enter my domain user name and password for every resource. If you're a corporate user and you have to move between multiple domains on a weekly basis, you'll find that Vista Business does not have to be reconfigured to join another domain. In my case, I can either swipe one finger across my fingerprint reader and log in locally, or I can swipe a different finger and log on to the domain.

One of the more exciting things Microsoft has been developing lately is a tool known as Power Shell. Power Shell can be downloaded directly through Microsoft. It is available for Windows XP and Vista, as well as the server operating systems. Power shell essentially gives you a more feature rich environment for creating scripts. More than that though, it gives you an almost Linux / unix feel. Commands such as "ls" and "man" are available through Power Shell. In reality though, these commands are simply aliases that Microsoft was nice enough to add for us Linux nuts. These aliases map to what are termed "cmdlets", which are built into Power Shell itself, rather than having to use a command interpreter. Essentially anything that can be done in CMD.exe can be done in Power Shell. Additionally, Power Shell's scripting capabilities are meant to almost completely replace VBScript. From what I've seen, it is much easier to write a script for Power Shell simply because of the level of integration between cmdlets in Power Shell and Windows itself.

If you're just getting into learning command line interfaces, then Power Shell can accelerate your learning. Not sure what that command will do? No problem, throw on a -whatif at the end of command. Assuming the cmdlet supports it (And most of the default ones in Power Shell will), this will cause the cmdlet to run your paremeters hypothetically, as if it were really performing what you had asked it to do.

For example, if you typed

PS C:\Users\JohnDoe> rm -path Music -recurse -force -filter *.mp3 -whatIf

If you are unsure what the command will do, then adding the "-whatIf" tag will assist you. In this case, if a user was attempting to remove old mp3 files after having converted them to a different format, it would be prudent to make sure that this command only removes the files with extension .mp3. So what happens when we press enter?

What if: Performing operation "Remove Directory" on Target "C:\Users\JohnDoe\Music".

Don't panic! Remember that a -whatIf command is only a fake run of the command you just typed. In other words, JohnDoe didn't just blow out his entire music collection with a simple command mistake. This is a great way to learn how to type commands without actually messing up your system.

The reason I have three network cards is rather simple. The Ubiquiti wireless card allows me to attach two external antennas. This is great for situations where I might be in range of a wireless access point, but the actual signal is too low for me to keep a stable connection. Also, it's great for site surveys and wardriving (Not that I do either one). The utilities that come with this card under Vista allow for some pretty interesting configuration options, but I won't go into detail on that. My main issue with wireless is that my internal AGN card rarely connects at 802.11n speeds. This isn't a Vista issue at all, but rather, an issue with the fact that the card is based on draft standards. However, the internal card seems to drop connections with wireless networks rather frequently. After the drop, Vista recognizes the card's existence, but fails to find any wireless networks in range. If this happens, I have to go into Device Manager and disable my card, then re-enable it, just to get it working again.

Is it Vista's fault, or Intel's fault? I'm not going to say either way, because there's no real clue. It could very well be that Intel's wireless drivers haven't matured to a point where all the bugs are ironed out on the Vista side. Wireless networks can be rather finicky about connections in general. My wireless connection seems to be fine while connected through the Ubiquiti card.

Overall Rating:

Gadgets bar - 9/10; I'm not someone who keeps track of what the date is, so it helps to have a calendar right on my desktop. Having a gadget to tell me that it's going to be cold outside is a nice addition. Kudos to Microsoft for dedicating a site for getting new gadgets online.
Biometrics - 10/10; The use of the finger print scanner allowing me to easily log in without typing a password is brilliant. This is a feature that is definitely lacking on Linux.
Domain / Log on tie in - 10/10; I don't know how much this feature gets talked about, but being able to log in to virtually any domain on the fly right from the log in screen is probably one of the most well thought out features included in Vista. I can bring my laptop to work, log in to the domain, then bring it home again without having to be considerate of any domain configurations.
Power Shell - 9/10; It's not really a part of Vista, to be fair. However, the addition of a new shell granting more command-line accessibility is a sign of understanding on Microsoft's part. Not all Windows users want to do things through a GUI, and most automation tasks require some sort of CLI experience. Power Shell is set to replace all the CMD.exe nonsense we've had to deal with, and could easily be the death of batch and VBScripts.
Wireless Network Experience - 7/10; The interface used to set up a wireless network is so simple that a child could do it. The downside? You'll feel like a child while you're doing it. Microsoft set out to hold the user's hand a little more in setting up a network. This has its advantages and disadvantages. Unfortunately, the network connection settings are a little burried, and sometimes your wireless card craps out on you for no reason, requiring Device Manager to disable and re-enable the card. This is more of a driver related issue than a Microsoft issue, but you would think that Intel would have better drivers by now.

Some of you are showing me new tricks in Vista that'll I'll be giving you guys credit here on the blog. Please, drop a comment sharing your Vista knowledge to some of us Vista newbies! I've already learned some interesting bluetooth integration knowledge from one of our labtechs, that I will be sharing with you soon!

Vista Week: Day 2

While I wasn't too thrilled by the install process involved with Vista, the install process isn't nearly as important as the actual experience of using the operating system. At this point, we've already installed all the necessary drivers for normal usage scenarios. Additionally, for Day 2, I am using a different setup than Day 1's install. Keep in mind that Day 1's install dealt with a custom built machine, because today will deal with an OEM installed Windows Vista Business Edition (32-bit) on a Sony Vaio laptop with the following specs:

Intel Core 2 Duo T9300 2.5GHz processor
4GB DDR2 667 MHz RAM
250 GB hard drive (Partition available for Vista is only 50 GB)
Intel PRO 1000 ethernet & Intel 4965AGN & Ubiquiti 300mw ABG SRC
Integrated Intel Graphics mobile GM965 & NVidia 8400M

The reason I list three network cards for my laptop will be made clear in a day or two, but just for clarification, the last two are wireless cards. Additionally, this laptop has two graphics cards, one for use in "stamina" mode to save battery usage, and one for "speed" mode which utilizes the NVidia card for gaming performance (or other graphics intensive tasks). This mode is changed by a switch on the laptop itself.

Starting off Day 2, I notice that Vista's overall feel has of course changed some in comparison to XP. Of course, much of the utilities used in XP have either been removed or relocated. This effectively invalidates much of what we have memorized of our running operating system's layout. However, much of what needs to be done can still be accomplished with relative ease.

My first issue was the complete lack of a default telnet client in Vista. I was experiencing switch issues, and felt it necessary to examine the switch through telnet, but found that not only was the telnet command missing, but HyperTerminal was also absent. The reason for HyperTerminal no longer being present is that Microsoft no longer possessed the permissions or license rights to distribute what was essentially an outside product with Windows. It was a bit surprising to find out that HyperTerminal wasn't a Microsoft software (It's actually owned by Hilgraeve). A telnet client can be installed through Windows Components, but I decided to go a different route.

I installed PuTTY, an open source implementation of Telnet and SSH for Windows platforms. PuTTY has the additional benefit of giving a GUI for those of you who aren't CLI oriented, and provides quite a few more features than HyperTerminal. For example, if you have an ssh server elsewhere, you can use PuTTY to "tunnel" these ports so that you not only encrypt their traffic over ssh, but you also create a type of VPN connection. I won't go into detail over what this implies, but I will later in a separate article. Getting PuTTY to log into the switch was easy, and I managed to accomplish what I intended to. PuTTY can be used for console connections, as well. Setting up a USB to Serial connection with PuTTY is easy; use device manager to figure out which COM port your USB to serial device is creating for you, and specify it as the port in PuTTY's serial connection page.

My next task was one related to PuTTY in that I needed to use a type of SSH connection to transfer files. SCP, or Secure Copy Protocol, allows the transfer of files over a secure connection using SSHv2. To accomplish this, I used WinSCP, a GUI FTP/SFTP/SCP client for Windows. Along with providing more features than I'll ever probably use, it gives a "Midnight Commander" type interface, akin to placing two Windows Explorer windows next to each other. On the left is your localhost's filesystems, and on the right is the remote system's filesystems. Files can be drag and dropped from either side, and every transfer is encrypted. This is ideal for copying sensitive files from your home, or just as a last result method for a system that has seemingly no way to dump files onto (but has ssh access enabled).

Since this is a work laptop, I'm not testing any gaming performance (Not yet, anyway). Despite running in the "stamina" mode, everything remains pretty responsive. There are a few momentary hangups during moments when Vista brings up a User Account Control prompt, but this is expected behavior for any system running Vista. Many users who have used Vista have decided to disable UAC. However, this is a potentially risky and dangerous decision to make out of simple annoyance.

Why? Because one of Vista's interesting new features that you almost never hear about is the use of integrity levels (IL) for file system access. While the details of such a feature are rather complex to be discussed in the context of this blog entry, the security these IL's provide is paramount to securing a Vista machine on the internet. IL's can come into play in such circumstances when using Internet Explorer 7. If for some reason a website or script attempts to do something harmful to a user's system, IE7 will be running under a virtualized environment, termed "Protected Mode", that'll prevent a great deal of modifications to user account settings. I may be annoyed by UAC, but I will not turn it off, given the additional security features it provides. Without UAC, this virtualized environment for IE7 (and pretty much the entire system) is disabled.

In short, I do not recommend disabling UAC, for any circumstance. The minor inconvenience of a few extra clicks is a small price to pay for a more secure operating system. Some of us lack patience though, and if you absolutely feel the need to disable UAC, you may do so. Just realize you'll be leaving a gaping hole in your operating system.

Other than UAC's messages, I find general usage of Vista to be very comparable to XP. I don't find myself using the glossy ALT+TAB Window switching abilities of Aero that often. The ability to preview a window by mousing over it in the taskbar is a nice touch, and far more useful than the "file-behind-a-file" look of ALT+TAB. In reality, Aero is more of what I would like to call a "game layer" on top of an OS. It is not by any means necessary to leave it on, but you can obviously disable some Aero features without disabling it entirely. Some have complained about Vista's new use of the Programs menu, requiring a click to delve into a deeper structure. In my opinion, this feature was an overdue default. I can't begin to count how many times I would attempt to move into one program's folder in XP and end up launching the wrong program. However, if you don't like this style of browsing installed programs, Windows Classic theme is still available to you.

Overall rating:

Functionality of Desktop - 8/10; What can I say? It feels like XP with subtle differences. The desktop works as it should. Points marked off for making UAC annoying.
Available utilities - 7/10; I'm a little torn on this one. On the one hand, not including telnet or hyperterm was a little ridiculous, especially on a Business edition operating system. On the other, it does seem like a decision by Microsoft to at least try to cut some bloat off the OS. Maybe Windows Vista Administrator Edition is the next version due to hit the shelf?
Security related improvements - 9/10; UAC is annoying, yes. But it's also a huge step in securing the largest and most widely used (and exploited) operating system on the market. I have to admit that Microsoft is making a conscious effort to improve upon their product's security.
User Interface Improvements - 8/10; Things are slick looking. Some definite user interface improvements here, things that can no doubt improve productivity. Aero is a little process intensive, but as I said, it can be tailored down to suit your needs.
Performance on given platform - 6.5/10; Given that I have only allowed Vista 50 GB, Vista takes up a large amount of disk space. I mentioned in a previous post that it would be a great feature to give people the ability to decide on what would be installed on a system before the install process to cut back on install time and bloat, but considering that this is an OEM machine, such a choice isn't entirely possible. Resource usage has been upped considerably with Vista. But one must take into account the additional security added into Vista, plus the requirement of making it as backward compatible as possible to support legacy apps. Not only that, but factor in that the average user probably leaves a load of processes running (I'm guilty.) while moving on to do other work. It's called Multi-tasking, and we should all know that such abilities put a strain on resources. I make the argument, however, that Vista could make more effective use of resources than it does at present.

Coming soon, Day 3! I know, I know, I'm a little behind as some of you have told me, but it's great to know that you guys are keeping up with the blog. Leave comments!

Vista Week: Day 1

Today I began with starting my install of Vista 64-bit and 32-bit Ultimate edition on the following platform:

Intel Core 2 Quad Extreme QX6700
4 GB Corsair RAM
Creative X-Fi Fatal1ty sound card
Nvidia 8800GTX 2x SLI configuration
150 GB Western Digital 10,000 RPM raptor drive

The install configuration options were pretty straight forward, and the install began rather quickly. However, the install for Vista 64-bit took 4 hours to complete. I've heard from others that this figure is unusual, so I'm probably just unlucky in regards to install speed. 32-bit ultimate took less time, clocking in at about an hour.

The options generally given haven't changed much since XP, and if you've ever done any XP installs before, you won't be surprised by anything you see here. After getting to the desktop of my new box, I find myself in the stunning resolution of 640 x 480 in both installs. I'm not surprised though; installing video drivers is key to getting most operating systems to realize the full capabilities of any video hardware involved.

To be fair, this is true of Linux as well. While your video card may get to the desired maximum resolution of your screen right off the bat, that doesn't guarantee that you're running the correct drivers to get the full experience your card was designed for. Installing Nvidia's drivers in Vista is quite easy, just know the model of your card and browse to nvidia's website to get the drivers. Alternatively, your video card most likely came with a CD of it's own, containing vista drivers (assuming the card is recent enough).

Unfortunately though, I must also install the drivers for my NIC cards first, before I can update video drivers. My motherboard uses a special Nvidia 680i chipset, and therefore uses some unique hardware choices that Vista may/may not be familiar with. The disc my motherboard came with has Vista compatible drivers though, and after a few restarts, I have completed my install of video, network, and sound card drivers.

For those of you unaware of Vista's new take on audio, let me clue you in. Vista uses a completely different audio stack than previous versions of Windows. This new audio stack, called Universal Audio Architecture (or UAA) completely removes hardware accelerated audio support in favor of a user mode based driver. This effectively means that I do not get the full use of my expensive sound card. Games such as Battlefield 2, that have specifically created environments for use on these cards, will not be able to use the expanded capabilities. This is a major letdown for gamers who spent extra money on great sound cards (I'm also a little hurt that Creative dropped their work on a Linux driver for my sound card because they needed the extra developers to write Vista drivers. Thumbs down guys, thumbs down).

Today's ratings:

Install ease - 9/10; Install is easy, as always.
Install time - 5/10; Four hours is a bit much.
Hardware support at install - 7/10; 640 x 480 Internet Explorer
Hardware support after drivers - 9/10; Everything works, despite no hardware accelerated sound, I still get surround sound out of my speakers.
Boot time - 8/10; Doesn't beat Linux or my Mac, but it's a little faster than XP.

And so ends Day 1, involving strictly install. I'm not completely put off yet, so check back soon for Day 2!

My Week with Windows Vista

Starting on the 6th of Monday, I will restrict myself to using only Windows Vista on my machines, for the period of exactly one week. Has it been done before? Of course. Many reviewers have looked at the Windows Vista operating system in such a manner. However, these reviewers often neglect certain audiences (mostly because their audience consists of home users rather than administrators).

Those of you who know me in person know that I vehemently promote the use of Linux as a desktop and server operating system. While Linux has its issues, I do prefer having the ability to learn from a completely open platform, rather than be restricted to a platform that may someday be non-existent.

Despite my personal preferences for operating systems, Windows is still the most widely used OS in the world. It is for this reason that I will try and test Vista from a (hopefully) neutral point of view. To ensure this, I will establish the basic rules / guidelines for the week in advance.

1. I will not resort to Linux to fix my problems, no matter how tempted.
2. I will not theme Vista or modify Vista in such a way that the OS is no longer visually identifiable as Vista.
3. I will evaluate the Vista experience not just as a general user, but as an administrator, and as a gamer.
   
4. I will also detail hardware platforms and various tricks I'll use to get things working.
5. I won't mention the video of Steve Ballmer dancing like a monkey while screaming "Developers!" to a scared audience. I also won't compare Vista's use of a clock in the bottom right taskbar to Ballmer's promotion of Windows 1.0's full screen clock.
   
6. I do reserve the right to link to aformentioned hilarious videos on the youtubes for reader enjoyment purposes.

And finally, to keep from going completely mad from the experience, I will try to have a sense of humor.

Grey Hat has been delayed, I know; I will finish the ARP poisoning tutorials after the Vista week.

Check back on Monday for Day 1 of the Vista week!

Microsoft dumps Seinfield ads; Attacks Mac commericals

I remember reading the press release heralding the inclusion of Seinfeld as part of Microsoft's new Vista marketing campaign. I also remember the first time seeing the commercial "Shoe Circus", a commercial that was rather unexpectedly long (or at least it felt long). For those of us who saw this initial attempt at humor, we all shared the same feeling of confusion at it's end.

What happened?

Almost two years ago, Vista was released to manufacturers to be included on OEM machines. Ever since the public got their hands on Vista, Microsoft has been fighting Vista's bad reputation for device and software support. One of Microsoft's methods to sell Vista has been to create an ad campaign where users with no Vista experience are led to believe that they are being shown a new operating system, Windows Mojave. The ads detail users giving positive responses to "Mojave". However, these users were not actually using the systems, but observing a salesman demonstrate features. Additionally, no installs were done in the users' presence, nor was any new hardware (printers etc) introduced to the system. These ads generally failed, in my opinion, on these grounds. Not only that, but to add the tagline "We deceive our users" to your company's reputation doesn't sound very wise in a business sense.

While these Mojave experiment ads are still shown, they at least had some intention to market Vista. When "Shoe Circus" aired, Vista wasn't even mentioned. Instead, we were given a scene where Seinfeld and Bill Gates played around in a shoe store inside a crowded mall for a minute and thirty seconds. The only part I found even marginally funny was a mention of wearing shoes into the shower. If it weren't for the short ten second windows logo appearance at the end of the commercial, I wouldn't have even associated it with Microsoft.

Follow up "Shoe Circus" with "New Family", where Gates and Seinfeld invade a family's home and stay for a bit. Once again, the viewer is left confused with no mention of Vista, and only another appearance of the Windows logo. Jerry Holkins (Better known for his character Tycho Brahe on the penny-arcade.com web comic) commented that he believes the commercials are intended to "Get people talking" about Microsoft. At the same time, penny-arcade released a comic parodying the commercials here.

After the heat Microsoft has taken from Apple's hard hitting Mac ads, it's understandable that they would seek to improve their image. Perhaps with their new ad, one that begins with an average user commenting "I'm a PC, and I've become a stereotype.", Microsoft can begin claiming lost ground. Bill gates responded to the Mac ads, stating "And I don't know why [Apple is] acting like it's superior. I don't even get it. What are they trying to say?" (Source Engadget). With Microsoft stock on the steady rise, their new commercials may well signal a massive recovery effort from a potentially reborn company.

VMWare has a Y2K8 bug?

Just a quick news update for those of you who haven't heard, it seems that VMWare's update to ESX 3.5u2 has left all servers running the software inoperable. According to a news article from The Register in the UK, the issues began when clocks rolled over to August 12th this morning. However, to be clear, this issue is not present in any of VMWare's lower end software appliances (Workstation, Server, Player).

While it may not affect the users who use VMWare on their home machine, this does have the potential to scar the trust that larger business ventures have placed in VMWare's software. In the larger networks used today, virtualization is playing a large and almost unimaginable role in consolidating hardware resources. If VMWare intends to be a major player in virtualization, what kind of damage does this bug do to their reputation? How about long term? A company worried about coding incompetence will not likely make the same mistake twice.

On the other hand, the irony is that VMWare is not the only software company who has made coding mistakes. When Microsoft made Service Pack 1's release candidate available for Windows Vista, a good sized number of customers were left with an unbootable machine (TechNet). Yet, despite coding mistakes that Microsoft has made, Microsoft has still managed to keep Windows on the majority of PCs on the market. Why?

The answer: Microsoft lacks a serious threat to its empire. Therefore, accidents are easily overlooked. VMWare on the other hand, is in direct competition with Microsoft's HyperV and other virtualization products. It'll be interesting to see how this bug has hurt VMWare's position in the coming months.

Greyhat Zone: ARP poisoning

Today I'm introducing a new part of the blog: The Greyhat Zone!

The Greyhat Zone will feature security / hack focused articles and tutorials with the purpose of further educating interested students in the security world. As some of you may have guessed, this means covering both sides of the conflict between black hats and white hats. A white hat is an IT professional with the intent of protecting the networks / devices he is in charge of. On the opposite side is the black hat, people who seek to exploit such networks / devices, either for educational purposes or personal gain. Greyhats are a mix of both sides.

This month on the Greyhat Zone: ARP Poisoning (Part 1)!

What Part 1 covers

1. Purpose of ARP
2. Switched networks
3. MAC Spoofing
4. Part 2 Preview
   

1. Purpose of ARP

What is ARP poisoning? For that matter, what is ARP? ARP stands for the Address Resolution Protocol. Your standard IPv4 network uses ARP to find the hardware (MAC) address of another host, using its IP address. Though ARP can be used for different kinds of Network Layer addresses, IPv4 is the most prevalent in use.

Consider this simple scenario: Host A pings Host B.

Host A [IP Address: 172.31.1.1] [MAC Address: 00:00:00:00:00:01]
Host B [IP Address: 172.31.1.2] [MAC Address: 00:00:00:00:00:02]

What happens? Before Host A can even send the ping, Host A must determine the Layer 2 address (MAC address) of Host B. In order to do this, Host A broadcasts an ARP message. Although not verbatim of the message itself, it will essentially ask "Who has 172.31.1.2? Tell 172.16.1.1". It is important to note that this broadcast message is tagged with Host A's MAC address. Since both hosts are on the same local network, Host B will respond with its own broadcast message, "172.31.1.2 is at 00:00:00:00:00:02". Host A then adds the MAC address (temporarily) to its ARP table, mapping it to Host B's IP address. At this point, the actual ping is finally sent. When Host B responds, it will not need to use ARP to acquire the MAC address of Host A, because that information will be included as part of the ICMP (ping) packet sent to it. However, even if no ping was sent after the ARP request, Host B would still most likely contain an entry in its ARP table, thanks to Host A's broadcast. That's a lot of work for one ping!

2. Switched Networks

On a switched network (such as those created by standard Linksys "routers" with multiple ports, or higher end Cisco devices), a switch uses a MAC address table to decide and isolate what port data is to be sent through. If Host A or B's MAC addresses aren't initially in this table, the switch will take any data being sent to their MAC addresses and flood it out all connected ports on the switch. The switch can also learn MAC addresses via traffic coming through a port, making it easier to fill its table. Due to the unique nature of switches, data that is intended for a specific host on the network will not generally be viewable by other hosts (Unless they are the ones who sent the data). If we want to eavesdrop on someone else's connection, and we're behind a switch, we're most likely out of luck. At least, for now.

3. MAC Address Spoofing

Though the MAC address is generally referred to as a physical or hardware address, many may not know that a MAC address is easily faked, or spoofed. In Windows XP, for example, the MAC address is actually stored as a registry entry. In Linux, the MAC address can be changed simply by the use of the ifconfig command. Using a spoofed MAC address in no way alters the device itself, just how it is identified. Generally, a normal reset of a machine will remove any spoofed MAC address information. This is especially true of Windows XP (as the registry entry containing the MAC address is created at boot time, and is refreshed during each start up).

While spoofing a MAC address may initially sound devious, the fact is that in some cases it is entirely necessary for proper network communication. In the past, some cable providers would use the MAC address of the device connected through a cable modem to identify and ensure that only that registered device was using their service. If the user had used a single machine, then switched to a router, the device would then be cut off because the ISP did not recognize the MAC of the router. A similar situation could arise from the replacing of a cable modem with a new one, where the change would require the registration of the new device (A situation experienced by Cable One users). MAC address spoofing is a way around these scenario's.

Preview for Part 2:

Remember when I said we would most likely be unable to eavesdrop on another host's connection if we were behind a switch? Well, guess what ARP poisoning allows us to do! That's right, we can overlook what security the common switch provides to its users through isolation. I'll explain what ARP poisoning is, how it works, and what we can use it for (legit and non-legit). I'll also show how to counter this technique.

Greyhat Zone: Invisible files in NTFS? Alternate Data Streams explained

Navigation Menu

1. Introduction
2. Demonstration 1
3. ADS uses
4. Demonstration 2
5. ADS in-depth
6. Demonstration 3

For those who use Windows, NTFS is a common knowledge subject. It is a revolutionary file system that supports file security, compression and encryption, among other things. Yet there is a little known "feature" in NTFS that has profound uses (or abuses). It has the ability to almost completely hide data from the user, and possibly some virus scanners and backup utilities. No, I'm not talking about the "Hidden files" attribute, which is easily defeated. In contrast to that attribute, this method is so secretive in nature that unless you were performing computer forensics, you would most likely never notice its existence.

I'm talking about Alternate Data Streams (or ADS). To keep your interest, lets try a simple demonstration.

Windows XP (And Vista):

1. Start >> Run... (If you don't have Run on your Vista button menu, you can enable it by following this tutorial)
   
2. Type in: notepad "%HOMEPATH%\Desktop\test.txt:ADS"
3. When asked if you want to create a new file, click Yes
4. In the notepad, type "This is a test of NTFS's Alternate Data Stream feature"
5. Save the file, don't change file type or file name information, and then close notepad.
6. As you may have guessed, we have now created a file named "test.txt" on your Desktop. Try opening it now. The text is gone!
7. Right click the file, and check its properties. The file should have zero file size!
8. Double click the test.txt on your desktop again so that you may edit it, and add in some text (This is will be used later)
   

Now I know what you're thinking, "Tim, all you did was make me lose a line of text, I've lost entire hard drives worth of data. That's nothing special!" Hold on, the text isn't lost. Let me explain a little more about what ADS is, and how it works.

For quite some time, Apple's HFS and several other file systems, such as ZFS, have supported what is known as a filesystem fork. A filesystem fork was (and still is) generally used to store metadata about the files they were attached to. In NTFS, ADS is used much the same way, with some rather interesting effects.

For example. Lets say you download an executable file from a website in Internet Explorer. If you're running Windows XP SP2, Internet Explorer will add zone information data into an alternate stream of the executable. This results in Windows being able to mysteriously identify which executables have been downloaded from the internet, as opposed to plopped onto the hard drive from a CD or other media. In short, if you've ever seen this:

Then you've experienced a use of ADS. Windows XP and Vista both use Zone Information stored in alternate data streams to determine if the executable was downloaded from a "Trusted Site" or publisher, and if it can't verify the source as trusted, it pops up this message. Also, you'll see an option to "Unblock" this executable if you bring up the file's properties, along with an explanation stating that the file is from an outside source. Clicking Unblock will delete the zone data in the alternate stream of the file, preventing the warning seen above.



















So how do you access an ADS? Lets go back to that test file again.

Windows XP (And Vista):

1. Start >> Run...
2. The previously run command should be in the box already. If not, type notepad "%HOMEPATH%\Desktop\test.txt:ADS"
3. If done correctly, this'll open up the test.txt:ADS file, and prove that the line of text we typed earlier still exists!

Strangely enough, although the properties of a file with an ADS will not show the size of the ADS, it will update the original file's "Modified: " field whenever the ADS is modified. Also, the amount of "Used Space" on your drive will change to reflect the presence of ADS (After all, even if it's invisible in the file properties, it still must use some disk space). NTFS permissions that are set on the test.txt file will also apply to the ADS, so removing all permissions on test.txt will deny access to both.

So how is the ADS attached to the main file? Well, according to Microsoft (in this article), whenever a file is created, a default unnamed stream is made to store all the data being entered into a file while it is open. Besides this default unnamed stream, additional alternate ones can be created (ADS). Each stream ends with an End of File (EOF) marker, after which the next stream begins.

While it may be apparent that this is a security issue in itself, even more devious is the fact that ADS can be used to store executables in an alternate data stream of, for example, a text file. Doing this from command line (really the only way) would look something like:

C:\> type test.exe > test.txt:secret.exe

Followed by this command to run it:

C:\> start .\test.txt:secret.exe

This could easily be used to hide all kinds of nasty malware on a machine. For the most part though, the risk is relatively low, so long as you can trust those who use your machine (or machines). Since ADS is an NTFS ability (And not likely to be transferable even between other filesystems that support ADS), an ADS will be lost in transfer to another remote location, unless the software making the transfer is aware of ADS data. Additionally, if you're concerned that ADS may be a problem on your computer, SysInternals has a very useful program called Streams that can be used to find alternate data streams. Alternatively, Windows Vista has an updated dir command that can show the presence of an ADS file, by specifying the /R switch.

Intel: The Next Generation

We've all had some experience with Intel's amazing Core 2 micro-architecture in one way or another, whether it's the latest Intel Centrino processors used in our brand new laptops, or our Intel Core 2 Quad Extreme gaming box (You know, the one that would make an environmentalist cry if you told them the amount of power you were consuming per hour?) But in the coming year, Intel will blow Core 2 out of the water with their new architecture, code named Nehalem.

When the Core 2 Duo was first introduced in July of 2006, Intel was quick to produce the claim that it provided a 40% gain in performance over the Pentium D line of processors, while using 40% less power. However, even with the clear advantages of Core 2's architecture, AMD threatened with a supposedly more powerful processor: Phenom. As many of AMD's fans will tell you, Phenom is the first "true" quad-core CPU, as it uses the same wafer for all four cores. This differs from Intel in that Core 2 Quads use more than one wafer to house its multiple cores. Additionally, AMD themselves released a video criticizing Intel's use of a Front Side Bus in its processors, a technology that has been used long past its expiration date. Contrary to the differences in technology used, Core 2 processors still vastly out perform virtually any processor AMD has on the market today.

To solidify their lead, Intel is pushing out the successor to Core 2 in the second half of this year, around the same time that AMD is positioned to release their newest Phenom processors. Unfortunately for AMD, Nehalem is most likely to be vastly superior to any Phenom processor, and here's why:

• Nehalem will abandon the FSB. In it's place will be QuickPath, Intel's version of AMD's HyperTransport system
• 2 to 8 cores (Possibly more; source: Wikipedia article)
• DDR3 RAM (Although AMD's Phenom will have this too)
• HyperThreading returns! That's right, your OctoCore CPU will have 16 threads logically. I wonder how that'll look in Task Manager?
• AMD's monolithic argument is no more; all cores will now be manufactured on the same wafer.
• 45 nm manufacturing process

AnandTech recently reviewed an early version of Nehalem, and had this to say:

"We've been told to expect a 20 - 30% overall advantage over Penryn and it looks like Intel is on track to delivering just that in Q4. At 2.66GHz, Nehalem is already faster than the fastest 3.2GHz Penryns on the market today. At 3.2GHz, I'd feel comfortable calling it baby Skulltrail in all but the most heavily threaded benchmarks. This thing is fast and this is on a very early platform, keep in mind that Nehalem doesn't launch until Q4 of this year."

It's clear that Intel has learned from AMD, and is now giving them a run for their money. Though the future of AMD is now unsure, and Intel's has most likely been cemented, there is only one inevitability to speak of: I'm buying my first HyperThreaded OctoCore Nehalem processor the moment it's available.

Yavapai College CNT Blog!

Hello students! Welcome to Yavapai College's Computer Networking Technology blog. Many of you already know me, but for those who don't, I'm Tim Snowberger. I work as the lab assistant for Yavapai College's CNT140 - 170 CCNA courses, and as the web / system admin for the yccnt.org website.

I'm going to be updating this blog as often as I possibly can with very valuable tips and tricks for the network technology environment, as well as keeping you up to date with the latest in technology (Believe me, I've got some good stuff you're going to want to read!) I will also throw in some tutorials here and there on various things. Through the magic of blogging, you'll have a chance to ask questions or praise your favorite content so that we may provide more like it.

Don't be afraid to participate!