Mauritian living in the USA | Founding member of cyberstorm.mu | Creator of tunnelix.com | Devops Engineer | Hacker at IETF Hackathon | VCA & VCP | Love and Believe in OpenSource
For sure, I cannot miss out to share this blog post which is about the IETF 105 hackathon which took place in Montreal, Canada. It was carried out at The Kiosk, Coromandel at the quarters of cyberstorm.mu. If you have been following cyberstorm.mu team during the IETF hackathon, you would have noticed that we had a pool and several amenities. This time, due to some constraints, we have decided to shift to our brand new office at The Kiosk, Coromandel.
It was two days hackathon. Some decided to work remotely whilst others came at the office to discuss and proceed ahead with robust analysis and more codes. We also had new participants who agreed to attend the hackathon. Some visited us for a while whilst others came to visit us just out of curiosity.
The team also came to know that it could be my last days in Mauritius as I decided to move to the United States and also resigned from my current position as DevOps Engineer at Orange Business Services. Thanks to Nathan Sunil Mangar who provided us with several goodies. Some days back the SANS Internet Storm Center sent me some stickers which I shared with the team.
The team was working on TLS 1.3, SSH, SCE, DSCP-LE PHB, and the IETF Mobile App. On the next day, Loganaden Velvindron presented the work remotely from Mauritius. I was glad to be able to work on the Check-SMTP software by ZeroSpam which is a company in Canada. More and more applications are now TLS 1.3 compatible. The SSH RC4 deprecation is now becoming a reality. You can view the presentation here:
Thanks to the TheKiosk who sponsored us the location and a brand new office. The team is looking forward to work further in the next IETF hackathon. Also, cyberstorm.mu is now giving support to several IETF hubs in Africa and bringing more free security patches to the world. More picture here:
This year the Africa Internet Summit was held in Kampala, Uganda. I could not be physically present as I had to fly urgently to Johannesburg for both personal and business reasons. For those, who are not aware of the Africa Internet Summit AIS’19, it is an event initiated by the ISOC and Afrinic organizations to discuss policy and tech happening in the big Africa continent. There were also few presentations about networking and tech by ISOC, ICANN, Dot Africa TLD, etc. Jeremy Daniel (Cyberstorm.mu) and Loganaden Velvindron (AfriNIC) were present there to lead the hackathon on NTP, and well as a presentation by Loganaden Velvindron who spoken on, QUIC (Quick UDP Internet Connections) which is a new encrypted-by-default Internet transport protocol, that provides a number of improvements designed to accelerate HTTP traffic as well as make it more secure, with the intended goal of eventually replacing TCP and TLS on the web.
As I could not be physically present, I registered myself to attend remotely. The streaming was amazing and worked pretty fine for me with really little major networking issues. The hackathon was lead by the cyberstorm.mu team. I remember last year during the Africa Internet Summit 2018, I was there leading for the NTP hackathon.
Champions: Loganaden Velvindron (AFRINIC) & Jeremie Daniel (University of Mauritius and cyberstorm.mu)
NTS measures are to enable NTP entities to cryptographically identify their communication partner, to ensure authenticity and integrity of exchanged time synchronization packets, and to provide replay protection.
There were also one of the most interesting parts that are policy discussion in the Africa region. The online streaming was very good with little connectivity problems noted. I’m glad about the NTP hackathon which was led by the cyberstorm.mu team. There were also other tracks such as IPwave, IPv6, DNS, etc. More information is also available on the official AIS wiki page. There is also another French article on ict.io as well as an English article from the Internet Society which covers the AIS hackathon.
Traveling abroad demands a lot of planning and preparation including budgeting. In this blog post, I will share some of my experience and tips whilst traveling abroad especially for holidays or business purposes from Mauritius. Mauritius is an island nation in the Indian Ocean. The strategic location in the Indian Ocean makes it very easy to travel to Europe, Africa, and Asia continents. But it all depends on the number of airlines available. I have been traveling to the United States, South Africa, Tunisia, Reunion island and several other countries. You can check out this link – My Travel which I usually update each time I travel abroad. The first thing before I started planning anything is to know the number of days you want to stay out of Mauritius.
Photo credits: vectorstock.com
VISA Requirements
Mauritians are exempted from VISA from many countries. Though there is an exemption, you need to carefully check the number of days you are exempted. Otherwise, if you are staying for more than the allocated number of days, you might need to ask for an extension of the visa once you have reached a particular country. The process which you need to go through when extending the visa can be very time-consuming. This is why planning is important where you can easily apply for the visa before leaving Mauritius territory.
For countries where VISA is needed you need to apply the same before leaving. However, some countries issue a visa upon arrival. But common, no one wants to waste time to apply for a visa upon arrival of a particular country unless you do not have any choice. For instance, it is better to apply for a visa in Mauritius itself before going to Bangkok, Thailand.
Some of the countries where Mauritians can travel freely without a visa are Senegal, Botswana, South Africa, etc.
An interesting source of information is at Visalist.io/mauritius/visa-policies website which provides clear information by country. However, this should not be a definite decision to check if it is a visa free country. Any country can alter its visa requirement and it is important to verify the information on the official website of the embassy.
Health-related issues and vaccinations
So, now that you are aware of the visa requirements, it is now to question yourself about the vaccines you have received. It is always important to keep records and document all vaccines received. Some months back, the Ministry of health in Mauritius was giving free MMR ( Measles Mump Rubella ) vaccines in Mauritius. They came to the office where I was working and everyone was receiving the MMR booster. Many was not documenting it which I believe is not good. Always keep a vaccination card handy and document it.
There are several recommendations by the ministry of health about the vaccines that one should be given when traveling to other countries. For example, I had to get the Yellow vaccines and malaria prevention pills when traveling to Senegal.
One of the interesting online resources for health-related issues that I would recommend is the CDC – Centers for Disease Control and Prevention website. One vaccination center in Mauritius is situated at Mutual aid building in Port Louis. There is another private vaccination center in Mauritius too such as Darnee Medical Clinic located at Forest-side Curepipe. Make sure that the vaccinations are available and also if one particular vaccine needs to be administered in two or more shots at different days, make sure that the vaccination is not out of stock. Otherwise, you might end up repeating the whole process again.
Sometimes, border control officers will not allow a passenger to enter its territory if you don’t have the vaccination cards with you. A few months back at the airport of South Africa, I noticed a passenger who was not in possession of the vaccination card. Usually, there is no vaccination required. But it happens that the passenger had traveled during the past weeks to a country where yellow fever vaccine was needed. They wanted to check if the passenger was properly vaccinated. This might, therefore, raise an issue. Always carry your vaccination cards with you when traveling abroad.
Booking a ticket
When it comes to reservation of tickets, I have never been to any agency for ticket booking which can be very expensive and time-consuming. The best to check on the official website of the airline company first. Now, you might question yourself, say you want to go to Bangkok and which airline will you choose. Here is the catch: The ATOL website might be very useful. On the ‘Airline section‘, you will have a list of all airlines that travel to Mauritius. Once, you have spotted the airline company you can compare prices. Another interesting place to purchase ticket more easily is on lastminute.com which makes it fast to choose between the cheapest price to direct flight.
Once a ticket has been booked, make sure you download the mobile app of the airline company so that online checking can be very easy and fast at the same time. Also, if there is any change in the airline time scheduled, it will be updated on the app itself. Choosing your seat to become much faster and you will have a clear map of the plane seats. You might want to consider whether the plane is an Airbus or Boeing at your convenience.
Some people try to delete their cookies and cache from there browser when booking online. Airline companies feed themselves from cookies on your web browser to understand the date you want to travel and might consequently increase the price. You might consider deleting cookies each time you search for a ticket price. Also try to sign out and change the location using proxies as a ticket might be a different price from a different browsing destination.
Some Airline companies provide special meals which might be interesting in case you are allergic or vegetarian. On British Airways, a veggie meal is composed of eggs and other vegetables. Some Vegetarians do not want eggs which you might consider.
Travel and Health Insurance
Some countries insist that people visiting their country are medically insured such as Reunion island and Germany. Always verify this information before traveling abroad. Alternately, there are some credit cards issued by banks that provide free health and travel insurance. You might want to verify with your provider and gather the document to show at the customs when reaching abroad. Some travel agency such as lastminute.com can provide free travel insurance in case your luggage has been damaged or lost during transit.
Choosing a Hotel
If you are a solo traveler, a 5-star hotel can be very expensive. You might probably look for the cheapest place such as Agoda, AirBnB or booking.com. It is always a plus to read the reviews on Trip Advisor or on booking.com itself as you never know what is awaiting you ahead. Several times, I booked with booking.com and most of the time it went well as expected. If you want a 10% discount with booking.com, click on the picture below and register yourself.
Make sure you check for the basic amenities, including showers, heaters, air conditioning, towels, Internet and/or Wifi access etc.. Sometimes, prices can be very cheap and the pictures shown can be very deceptive. It is always important to read reviews. Also for Mauritians who might want to stay in a cold place, make sure there is a heater. You can always contact the hotel directly via booking.com to clarify anything before paying.
Weather Forecast and Risks related issues
Always check the temperature at day and night before traveling. Weather.com provides good information about that. If you are traveling to China, you might want to check the level of Air pollution. Aqicn.com is a good source of information as air density is also important before booking a hotel. Some mobile app also provides air density information. Another tip and risk related issues can be checked on the US embassy website of that particular country you are visiting. In case, there is no embassy make sure to check local media of that country to be informed of any eventual attacks.
Losing network can be an issue when traveling abroad. I would recommend using maps.me mobile app and download offline maps in case there is an emergency. Also always share your location with a trusted contact.
My handbag checklist items when traveling:
Battery bank
Laptops and chargers
A bag containing all basic electronic items such as universal chargers, cables, Pendrives, etc..
Face wipes
Toiletries
Hand sanitizer
Tripod
One spare clothing in case my check-in luggage gets lost
Earpods / Earpiece
Passport / Printed travel documents and other documents if needed.
Electronic backups of all documents on my mobile phone.
Sunglasses
Some Tips:
Online booking will surely cost you cheaper and the online agency will surely take a certain commission for the transaction. Always print your receipt and be careful that the hotel does not double charge you on arrival.
Scammers are everywhere whether online or onsite, usually in front of hotels, where some fake tourist guide trying to scam tourist.
Make sure you always consume boiled or bottle water to reduce the risks of getting contaminated. A hand sanitizer becomes very important as the level of bacteria is very high in airports, planes, and hotels.
An Airplane pillow might also be helpful especially if you are traveling in economy.
Always establish a friendly approach with the security personnel, reception staffs, etc.
Always pack smartly your luggage.
Here is an interesting link on my-anasa.com as a travel guide for dummies.
Always inform your bank and Network and Internet service provider that you are outside the country so that you can use your bank debit cards and roaming service without any hassle.
Shuttle arrangement when reaching the country. Uber can be very useful in some countries.
I hope you find this blog post interesting and helpful. I will try my best to update it as soon as I come across interesting tips in the future.
Some days back, I was having a conversation with a friend about the recent CVEs that impact the firmware of several physical machines. HP usually will release several vulnerability alerts and it is very important to patch your firmware. You might also notice that the mitigation happens at CPU levels such as AMD or Intel. In this blog post, I will focus on one of the very basic ways to update your firmware. Prior before upgrading, its important to make a checklist. My HP Proliant Gen9 is actually an ESXi on VMware infrastructure. You can view the step by step actions below and pause the video at any time. I have blurred some information for security purpose such as the name of servers, IPs, Logins, etc..
A basic checklist can be considered as follows:
Monitoring consideration.
How many and size of the VMs on production.
The consistency of the Firmware provided by HP.
Logins and Passwords for the HP ILO, vCenter, Virtual Machines running, etc..
Java or Dot Net framework for accessing the ILO.
Where is the storage node of the virtual machines?
Load on the cluster or the ESX itself.
The expected amount of time during migration.
The output of the update (Correction of bugs, New feature, etc..).
1. Prior before upgrading the firmware, you need to make a survey about the oversized VMs. Consider performing a manual migration before activating the maintenance mode. Then, enter maintenance mode, all the virtual machines in the cluster should migrate to other physical machines in the cluster. We assume that the datastore of each machine is not on the physical machine itself which is not recommended.
2. Once all virtual machines migrated to other ESXi hosts, connect to the HP ILO onboard administrator interface. Consider checking the health status of other ESXi hosts on your chassis.
3. Also consider, verifying the system information of your ESXi host (HP physical machine).
4. On the ‘information’ tab, click on ‘system information’, you will notice the field ‘Integrated remote console’. You can choose any framework whether Java or .Net to open the console.
5. Once connected, you should be able to see the following screen.
ESXI Console
6. From vCenter, upload the image file which constitutes of the patch for the new firmware.
7. On vCenter, right click on the physical machine, then ‘reboot’. Consider checking the grey bar that is now blinking on the left just below the ‘<F2> tag ‘at the bottom on the ESXi console.
ESXi-Console-blinking
8. By the time, you should also notice that you have been logout on vCenter.
9. Normally, after a few minutes, the server will reboot showing the HP Enterprise logo followed by other system information, then you will notice a screen that with four key options below: F9 (System Utilities), F10 (Intelligent Provisioning), F11 (Boot Menu), and F12 (Network Boot). Hit the F9 button to enter ‘System Utilities’.
10. Choose the ‘one-time boot menu’ option. Then go to the USB virtual disk that you have mounted at step 6 and hit ‘Enter’.
11. By now you should notice the installation of the firmware in progress. This might take a considerate amount of time. Monitor the installation.
12. After extracting the iso file, it will go through three steps: Inventory, Review, and Deployment.
13. You can also monitor for the ‘blink’ message on the HP Onboard Administrator interface which means that the upgrade has not completed yet.
14. Once, the UID state is off, you can remove the server from maintenance. On vCenter, right click on the server, and click on ‘Exit maintenance mode’.
15. Several machines will now join the ESXi host which has been added back to the cluster through an election process.
If you are interested more on the election process and how High Availability works, please check the article ‘VMware vSphere High Availability‘ which I published several months back.
All steps from 1 to 15 have been described in the video below. If you like the article please click on the like button and share.
The Internet is growing. In case you are not on IPv6, for sure one day, you might need to migrate from IPv4 to IPv6. Now what kind of methodology you would apply whether a dual stack or a direct changeover depends upon a rigid observation and analysis of the network infrastructure. But, it should no more be taken as a complexity. Since a few years, many companies, government bodies, ISPs, and others are moving towards IPv6. Some are adopting dual stack. IPv6 can be said to be version 2 of the Internet. In this blog post, I will make my best to shed some basics and simple way to understand the features and benefits when using IPv6. I will also contrast it with IPv4. For research purpose, I have perused several books and blogs over the Internet and, same are referenced below. One of the challenges in Africa is to enable the smooth transition to IPv6. Whilst others are doing dual stack, others have successfully migrated the whole network infrastructure to IPv6. IPv4 has been created in the early ’80s. The Internet growth which is so huge and it will definitely need to move ahead with modern technology IPv6 running at its core. I had always admired one of the modern futurist physicist, Dr. Michio Kaku who said that “In the future, the Internet might become a brain“.
So why do we really need IPv6?
Besides, from the growth of the Internet and the scarcity of IPv4 addresses, we all knew that in IPv4, the network has been divided into two parts which are the Private IPs and the Public IPs allocation. And, those two segments which are Interconnected required NAT configuration. This breaks the contiguous of the Internet. Another reason is that there is no security in IPv4 at its core. Of course, there are other strategies to secure an IPv4 network. When it comes to data prioritization, it cannot be done at the core of IPv4 which means that there is not much of Quality of Service (QoS). In IPv4, we can configure or assigned an IP to a device or simply use an address configuration mechanism such as DHCP. But, the moment DHCP is down, we land into a problem. Here is the catch, this means that there is no way to make a device to be assigned a globally unique address. So, that’s why we need IPv6. Well, wait… What happened to IPv5 ? and what about IPv1, IPv2, and IPv3?
What happened to IPv1, IPv2, IPv3, and IPv5?
Have a look at the diagram below which makes it pretty easy to understand:
Photo Credits: tutorialspoint.com
So, IPv0, IPv1, IPv2, and IPv3 were used in the development testing phase. Ipv5 was used while doing the Stream experimentation of the Internet.
Features of IPv6
There is no backward compatibility when using IPv6, but, the basic functions remain the same, and the features have been changed completely. Since IPv4 is a 32-bit address and IPv6 is a 128-bit address, just imagine how much bigger it is. When compared to an IPv4 address bit, IPv6 has four times more bits. We can say that there are more than 1500 IP addresses per square meter on earth.
Photo credits: transition.fcc.gov
Another feature of the IPv6 is about the header which is twice the size of IPv4.
Photo Credits: radioworld.com
In IPv6, there is also end-to-end connectivity which means that NAT is not required for the continuity of the Internet. Every host can reach another host over the Internet.
Photo Credits: concurrency.com
Other features are “auto-configuration” which can be either stateful or stateless. Stateless is a mechanism that does not require any intermediate support in the form of DHCP for IP assignment whereas Stateful serves IP addresses from a pool. Also to take into consideration is “faster routing”. In IPv6, the routing information is stored in the first part of the header which makes routing decisions faster by the router. Another feature is IPSec (IP Security). It creates an end-to-end tunnel between the source and the target though it is optional. “No Broadcast” is another feature within IPv6. Using an IPv4 network, you will notice during the IP Address configuration, the clients need to broadcast to the DHCP. In IPv6, the client doesn’t need to broadcast and instead will multicast to communicate with machines over the network. It is important to understand the difference between ‘broadcast’ (one-to-all) and ‘multicast'(one-to-many). In broadcast, clients will send messages to all hosts on the network, whereas in multicast, messages are sent to a group of stations. This allows the building of distribution networks where group management is required. IPv6 does not limits itself to multicast but also bring the ‘unicast’ (one-to-one) feature. This is used especially between routers which need to communicate to a specific router. However, if you have several routers nearby and you can choose any routers for communication, let’s say for a CDN purpose, we can use the anycast method to process efficiency packet routing.
Photo Credits: techiemaster.wordpress.com
Reading IPv6 addressing
Now, that you have grasped the basic concepts of IPv6 and why we need it, let’s see how to read IPv6. An IPv6 address is made up of 128-bits divided into 16-bits blocks. Each block is then converted into 4-digits hexadecimal numbers separated by colon symbol. For example, this is an IPv6 address in binary:
Since we have three series of zeros, it can be escaped between the two colons symbols. Leading zeros in the third block will result in 30. In case, you had one block of zeros, use one zero in the hexadecimal IP address. When converted to hexadecimal it is:
2606:4700:30::6812:2860
Let’s get into more details. There are two rules when reading an IPv6 address.
Rule1: Leading zeros should be discarded. As we can see in the 3rd block of the IPv6 address above i.e; 0000000000110000 when converted it is written as 30, because it can be read as 110000. Here is a video on how to convert Binary to Hexadecimal.
Rule2: If two or more blocks contain consecutive zeros, omit them all and replace by double colons signs. Example the three blocks of zeros in purple above have been replaced as “::“, However, if there is a single block of zero, use 0 in the IPv6 address.
Assignment of IPv6 address
Similar to IPv4, we need to understand how to identify the number of networks and hosts in IPv6. Let’s take an example from a generic unicast address which uses 64-bits as network ID and 64-bits as hosts ID. Please note from the picture below the 64-bits in the network has been shared in three distinctive fields in the IPv6 packet structure.
Photo Credits: www.networkworld.com
At this stage, it should be clear how a generic unicast address has been designed. Now, another important point is the IPv6 address scope. A scope is a region where an IPv6 address can be defined as a unique identifier of a network interface. As we can see below, there are three scopes, Global Unicast Address, Unique Local, and Link Local.
Photo Credits: steves-internet-guide.com
The Global Unicast Addressis routed and is reachable across the Internet. Also. the prefix for global routing prefix in IPv6 has been assigned by the Internet Assigned Number Authority – IANA, so that by only looking at the prefix of an IPv6 address, you can determine if its global or not. In the picture below, you can see the first 3 bits within the global prefix. Remember, that this is unique globally.
Photo Credits: cisco.com
Then, comes the Site level aggregator – SLA which is the subnet ID assigned to the customer by the service provider. This follows by the LAN id that is used by the customer and is free to manipulate. This address is globally unique.
Let’s take a look at a Unique Local Unicast Address. It looks like private IP addresses and is used for local communication intersite usually in a LAN and for VPN purpose. It is not routable on the Internet.
Photo Credits: cisco.com
The last one is the link local unicast address. This is used for communication between two IPv6 devices on the same link. By default, it is automatically assigned by the device as soon as IPv6 is enabled, and it is not routable. These types of IP addresses are identified by the first 10-bits of the address, i.e; FE80.
Photo Credits: cisco.com
In this blog post, I took an example from only Unicast addresses. Remember, there are also Multicast and Anycast address ranges. Let’s now create some servers and perform some IPv6 configurations.
Goodbye IPv4 and, say Hello to IPv6
I created a CentOS7 machine on my VirtualBox. As you can see, the interface card enp0s8 have the IP Address 192.168.100.9 as well as fe80::9ef3:b9d3:8b87:4940. Remember, the fe80 is the Link Local Address.
You can also see the connection using the following command:
To create a connection using nmcli use the following command and check back the connection. You will notice that the connection has been created without any device attached to it.
I am now modifying ipv6-tunnelix and attached it to enp0s9. I will also assign it to an IPv6 address. (For learning and testing purpose, this IPv6 address has not been assigned to me, it’s that of Facebook’s public IPv6)
As you can see, the address has been assigned. But remember, same as you can assign a public IPv4 address on a virtual machine, you will need to route it for connectivity. In this example, I took an example of Facebook public IP Address.
Are your blog’s IPv6 ready?
In 2016, during migration on Cloudflare, tunnelix.com became dual stack i.e; both compatible for IPv4 and IPv6. You can test any website for IPv6 support at this link.
Getting certified on IPv6 is really interesting as it can demonstrate comprehensibility. You can participate in free IPv6 training and get certified from Hurricane Electric. It is important to read the IPv6 primer.
There is also a service from Hurricane Electric, called Tunnel Broker which can facilitate you for creating a tunnel from your IPv4 static IP address to free IPv6 tunnels. In future blog posts on IPv6, I will get into more details about it. If you like the article, please comment, and share.
