Blog: Networking

I had a problem using selfssl.exe (part of the IIS 6 resource kit) to generate more than one self-signed certificate on a specific server. The issue came up after I created a second self-signed certificate with a different CN. The certificate was installed on a separate site (same IP different port) than the first one I generated. The behavior was very strange. As soon as I generated the second certificate, the site with the first certificate would not load at all. If the certificate was removed, it worked fine. So, I regenerated the first certificate with selfssl.exe and the second stopped working. After some searching, I found that some others have had this problem as well: http://blogs.msdn.com/david.wang/archive/2005/04/20/SelfSSL-Bug-with-websites.aspx. These certs have always worked fine, but I think it may be best to limit use to one self-signed certificate per server. [more]Oh, and the blogs post mentions a new version…it doesn’t work either. The only way to get it to work is with ssldiag, but it is not a trivial process.


 

One of the issues in Vista is the is no direct way to get to Network Connections by default. You can create a shortcut with a target that points to “C:\Windows\System32\ncpa.cpl” and it will take you straight to the Network Connections. You can also run “ncpa.cpl” to get there as well.


 

I had a customer that had a “virus detected” warning pop-up on the server every morning.  She tried to do LiveUpdate (as the warning suggested), but it would fail (the AV is way out-of-date).  She was sure there was a problem with the definitions.  I checked the server, and all the definitions on the server and clients were current.  I got to looking, and it appears the alerts were coming from viruses in the server’s quarantine.  Apparently a virus had been detected and cleaned, but when the backup job would try to access the quarantine, it would see the virus and pop-up the warning message.  I cleared the quarantine and the pop-ups stopped.


 

In a News Press Release yesterday, Microsoft Corp. announced the release to manufacturing (RTM) of Windows 7 and Windows Server 2008 R2.  Windows 7 should be generally available to customers around the world in mid to late October, and Windows Server 2008 R2 should be generally available on or before October.  To learn more, visit http://www.microsoft.com/Presspass/press/2009/jul09/07-22Windows7RTMPR.mspx


 

We use Platespin to do scheduled P2V migrations to provide DR for some of the physical servers at a customer site. I have been troubleshooting some issues with the scheduled protection jobs over the last week or so. The jobs had been running fine for the last couple of months. I have the jobs scheduled to do full synchronizations once per month (first of the month) and all but 2 failed this month. The problem was really strange because I could kick off the full sync and it would run fine for a long time and then all the sudden it would just stall out with a “recoverable error”. I tried all my usual steps to recover from this error…nothing worked.  I used to see this all the time after the new Barracuda was installed. For that issue, I would just add a setting to the ofxcontroller.config file on the source side to bypass the proxy. So, I started searching for another config file that might need to be changed. After tracking the traffic with wireshark, I finally decided there was no interference by the proxy. I submitted a support ticket with Platespin and the tech that working my case asked me whether I was using the “WAN optimizations”. WAN optimizations? That must be a config setting I had never seen. He explained that the problem I was having was that I was running into the 24-hour job termination window. [more]

Any Platespin job MUST complete in 24-hours or it will fail with this “Recoverable Error” message. Actually, the error is not recoverable at all…you have to abort the job and start over. PlateSpin uses WinPE for the target side pre-execution environment when doing the migration/protection jobs. WinPE requires a license if launched for more than 24-hours…platespin doesn’t have the license so the target VM will REBOOT ITSELF after 24 hrs. Hence, the recoverable error that isn’t recoverable. So, back to the WAN optimizations. To help the job finish in time, there are config values you can change in the product’s productinternal.config (for v8.0 or powerconvert.config for PowerConvert Server 7.0) configuration file, located on your Portability Suite Server host, in the following directory:   \Program Files\PlateSpin Portability Suite Server\Web\

Setting Default For WANs
fileTransferThreadCount 2 4 to 6
fileTransferMinCompressionLimit 0 (disabled) 65536 (64KB which is the max)
fileTransferCompressionThreadsCount 2 n/a (the 2 is ignored if compression is disabled)
fileTransferSendReceiveBufferSize 0(8192 bytes) 5242880 (5 MB is max, use formula(LINK_SPEED(Mbps)/8)*DELAY(sec)) *1024*1024 to figure out what your setting should be)

After implementing these settings, full sync jobs were completing in 25% of the time they had been taking. It’s a huge improvement.

You might also want to check out a previous post on Moving a PlateSpin Image Between Image Servers to Setup a DR Sync that discusses using local image servers at both ends to seed a server image across a WAN.


 

About a year ago Microsoft released the BitLocker Drive Preparation tool to help with the disk partition changes to support BitLocker.  Information on using this tools is located at http://support.microsoft.com/kb/933246.  However it hasn’t been updated to work with Vista SP2.  If you try to install it on SP2 you get an error indicating it doesn’t apply to the installed OS.  Until Microsoft updates the tool, you’ll need to install it before installing Vista SP2.


 

If you're running DHCP on a Windows 2003 domain controller that is also running DNS, you may see Event 1056 (see link) errors in the System log.  This is because DHCP does not have separate credentials (a domain-user 'service' acct is recommended) for DNS dynamic registration.  The danger here is that DNS records could be overwritten.  This is not a default config, but Microsoft recommends you use separate 'DNScredentials' or not run DNS and DHCP on the same domain controller. [more] See the link below to enter the credentials into the DHCP mgmt console.

http://support.microsoft.com/kb/282001


 

If you google ‘netscan’, it will usually be the first or second hit (http://www.softperfect.com/products/networkscanner/).  In the past I've mostly used LANguard and LANspy as my subnet-scanning utils, but lately I've been using SoftPerfect more.  It is free, lightweight (around 700k), and is a stand-alone EXE, so no install needed.  It’s easy to quickly download to a client’s server in a pinch.  It will auto-detect the local subnet and has lots of useful scanning options.  You can see IP, MAC, OS-version, logged-on user, domain, SNMP, open ports, shares, etc.  Two of it’s slicker features are right-clicking a 'found' system to remotely shutdown/reboot (can send a broadcast message first) and right-clicking a file-share to explore the share and/or map a drive to it.  You can pick current or custom credentials to scan under.  It is multi-threaded and scans pretty fast.  Lastly, you can tell by the changelog that it gets updated often (already updated for Win7/Server08r2).


 

I was working on a Symantec Mail Security appliance the other day that was passing a bunch of spam through. The problem should have been easy to fix; the license had expired. All that was necessary was to upload the new license file. I emailed it to myself and opened OWA from a server on the customer network to download the file. When I tried to install it, I kept getting an invalid license error. I called Symantec tech support and they regenerated the license and emailed it to me thinking the license was corrupt. That one worked fine. Hmmm…curious, I tried opening the license file I had downloaded from OWA. No surprise why it wouldn’t work, it was an empty text file. I did some testing emailing that file (unzipped) back and forth from account to account. It wasn’t a spam/AV filter problem. Turns out the problem was that I downloaded the file via OWA having sent it unzipped. With Exchange 2007 SP1 prior to update rollup 6, if a file that contains XML data is attached to a message, the XML content in files is removed when you open or save the attachment by using OWA. The license file was XML content…the one from Symantec support worked because it was zipped. http://support.microsoft.com/kb/950675


 

I was testing a new VMware security application (Tripwire ConfigCheck).  I downloaded it to a virtual machine and followed the instructions to run the application (a cmd file), but it didn’t run – I edited the cmd file & added a pause to see if I could tell where it stopped & it appeared to be before calling a .jar file – I did not have Java installed, so I installed Java & tried again – still failed – I read the instructions & found it supports JRE 1.5 or higher, but just in case, I installed the older version (1.5) to see if it would work – still didn’t work – finally, I opened up a command prompt & ran the cmd file from there & received an error that stated your display settings must be at 1024 X 768 for the application to run – my virtual system resolution was too low ...