Line Rate

I've been playing with the Microsoft Windows 8.1 Preview (aka Windows Blue) and had problems installing VMware's vSphere Client.  After clicking "I agree", the install window disappeared, providing no helpful information as to why it failed.  I hate the vSphere web client, and would much rather use the thick client to manage my home lab ESXi 5.1 environment. 

The cause of issue is that the .NET framework v3.5 is not installed in Windows 8 by default, and is a required component for the vSphere client.  I assume that the redistributable is packaged with the vSphere client installer, but it doesn't work in Windows 8.1. 

The .NET Framework v3.5 is easy to install, just issue the following command from an elevated/administrator command prompt:

Dism /online /enable-feature /featurename:NetFx3 /All /Source:F:\sources\sxs /LimitAccess

(replace F:\ with the DVD drive where your Windows 8.1 is located.  If your DVD drive is as slow as mine, just copy the ISO to your hard drive, mount it with daemon-tools, and use that location instead.)

After that, the vSphere client happily installed and I'm off to play with Windows 8.1 now.  

I'm labbing-up VMware's DPM (Dynamic Power Management) technology this week.  This is a self-funded home lab, and I'm too cheap to use enterprise-grade hardware.  That means technologies like IPMI/iLO are out of the question.  The good news is that both of my lab hosts support Wake-on-LAN (WOL). 

I went into the BIOS of each of the ESXi hosts and enabled Wake-On-LAN.  I placed both of them into a cluster and enabled DPM.  I then attempted to place one of the hosts into standby mode.  The vCenter client complained with the following message:

vCenter has determined that it cannot resume host lab1.example.com from standby; therefore, the enter standby task was stopped.  Confirm that IPMI/iLO is correctly configured for host lab1.example.com.  Or, configure vCenter to use Wake-On-LAN, ensuring there are at least two or more hosts in the cluster, and try the task again. 

That last line really bugs me because there is no WOL-specific configuration options in vCenter.  After a little digging around (RTFM) I read that vCenter must be able to send the WOL "magic packet" to a physical NIC where vMotion is enabled.  I had not yet enabled vMotion on these two lab hosts!


After enabling vMotion on my hosts, I was able to successfully place them into standby mode.  Even more importantly was the fact that vCenter could wake them back up again. 


I observed one other quirky behavior with DPM.  When attempting to manually power-on the sleeping host, vCenter's "please wait" message reads:

 Waiting for host to power off before trying to power it on

This comes AFTER I get confirmation that the "Host is in Standby Mode".  It could be that vCenter still isn't sure if the machine is fully powered-off just yet, so it's waiting an arbitrary amount of time before sending the WOL packets to my host.  I'll have to play with it a little more and see if vCenter gives the same misleading "please wait" message when powering-on a host that has been sleeping for a while.

Back in the good 'ole days of '08, I noticed an interesting phenomena on my Qwest 1.5Mbps DSL line:  as the link approached saturation, the latency spiked through the roof.  I'm sure you can imagine what this meant to VoIP calls (very important) as well as online games (not quite as important, but still up there).

Ideally, I wouldn't "fill the pipe" when I was on a VoIP call, but that was an unrealistic resolution to the problem - especially when my daughters found out they could stream My Little Pony episodes online.

The Internet wasn't much help either.  Everything I read said that you can only prioritize your outbound traffic, not your inbound - or that you would need coordination on both sides of the link in order to achieve true QoS.  Not very helpful.

All I needed was a solution that would a.) detect I was on a VoIP call, b.) temporarily rate-limit all other traffic, c.) detect I was off the VoIP call, and d.) remove the temporary rate-limit.

Sounds easy enough, right?  It wasn't too bad.  I ended up making a Snort signature for the VoIP traffic and had a script watching the Snort logs.  When a VoIP call was detected, the script made a telnet connection to my WAN router and applied a heavy-handed rate-limit on all non-VoIP traffic.  When the call was done the rate-limit was removed.  I called the concept AATQoS - Application-Aware Triggered Quality of Service.

You can read all of the gory details here:  http://user.xmission.com/~hidden/aatqos/

That, however, is not the purpose of the post.  The purpose of this post is to show how to achieve the exact same results using an EEM script, completely self-contained within the Cisco router.  First off, many thanks to Ivan Pepelnjak at ipspace.net for helping me along the way!  We ran into a couple of bumps but ended up getting it working like a charm:

http://blog.ioshints.info/2008/12/this-is-qos-who-cares-about-real-time.html
http://blog.ioshints.info/2010/01/update-workaround-for-sluggish-cb-qos.html

Here are the relevant portions of the config that worked great for me and my little Cisco 1801 DSL Router:

class-map match-all acgroup112
 match access-group 112

policy-map police
 class acgroup112

access-list 112 remark ALL_TCP_TRAFFIC
access-list 112 permit tcp any any

event manager environment match_pattern .([0-9]+).*matches
event manager environment nok_msg it works
event manager environment exp_name custom1
event manager environment ip_address 166.70.124.1
event manager environment rw_community private
event manager environment match_cmd show policy-map int dialer0
event manager environment _ios_cmd_1 show policy-map int dialer0 | in 105
event manager environment countdown_entry 1
event manager directory user policy "flash:/"

event manager applet PoliceDisable
 event counter name call_in_progress entry-val 0 entry-op eq exit-val 1 exit-op eq maxrun 31536000
 action 100 syslog msg "---=== Disabling Police ===---"
 action 110 cli command "enable"
 action 120 cli command "conf t"
 action 130 cli command "policy-map police"
 action 140 cli command "class acgroup112"
 action 150 cli command "no police"
 action 160 syslog msg "---=== Police Disabled ===---"

event manager applet PoliceEnable
 event counter name call_in_progress entry-val 1 entry-op eq exit-val 0 exit-op eq maxrun 31536000
 action 100 syslog msg "---===Enabling Police===---"
 action 110 cli command "enable"
 action 120 cli command "conf t"
 action 130 cli command "policy-map police"
 action 140 cli command "class acgroup112"
 action 150 cli command "police 400000 conform tr ex dr"
 action 160 syslog msg "---===PoliceEnabled===---"

event manager applet AATQoS
 event timer watchdog time 1
 action 100 cli command "enable"
 action 110 cli command "show policy-map int dialer0"
 action 200 info type snmp oid cbQosCMPrePolicyByte.368.13007857 get-type exact community public
 action 210 set value1 "$_info_snmp_value"
 action 220 wait 1
 action 230 info type snmp oid cbQosCMPrePolicyByte.368.13007857 get-type exact community public
 action 240 set value2 "$_info_snmp_value"
 action 250 subtract $value2 $value1
 action 260 set difference "$_result"
 action 280 if $_result gt 100
 action 290  counter name "call_in_progress" op set value 1
 action 300 end
 action 310 if $_result lt 100
 action 320  counter name "call_in_progress" op set value 0
 action 330 end

I love Windows 7 Media Center.  I like having high-def recorded TV via cablecard, my encoded DVD Library, Music, Pictures, etc. all in one place, on one screen, without having to futz with multiple inputs on a receiver or the TV.   

I use handbrake to convert my DVDs and it's the perfect tool for the job.  It's free, it's quick, and its awesome. 

I recently started using an Xbox 360 as a Windows 7 Media Center Extender and it works pretty well.
One thing that has bugged me for quite some time is the (lack of) codec support on the 360.  When running in Media Center Extender mode, it doesn't seem to support much and there are a lot of files in my library that won't play.   

Last night I took a DVD and ran it through a handful of handbrake encoding presets to figure out which one(s) work.

So far, the Apple TV2 built-in preset does a bang-up job.  Since my TVs are only running 720p right now, I'm happy with that.  When I embrace 1080p and blu-ray, I'll probably revisit the topic to see what other options are out there for the 360s and the higher resolution.

Hope this helps someone else out there who runs into the same problem.  That's why we blog, right? 

I've been using the Facebook iPad application for the last few weeks and love it! I was caught off-guard when Facebook updated their app to v3.5, which removed all iPad support completely. Here's a quick tutorial on how to get it back!

1.) jailbreak your iPad (pretty sure you've already done this if you were using the iPad application)
2.) delete your existing facebook application from iTunes & your iPad
3.) sync iTunes & iPad (just in case)
4.) get the "Installous" application (google it)
5.) download an older copy of the facebook.ipa file (google it, look for version 3.4.4)
6.) copy the facebook.ipa file to /private/var/mobile/Documents/Installous/Downloads/ on your iPad (use scp/ssh, or iphone explorer)
7.) open Installous, go to Downloads, and install the facebook.ipa
8.) install "Face Forward" from Cydia. Respring after installation.

There you go. Now go waste your time on Facebook!

"There are two kinds of people in this world..." I hear this from my father-in-law on a weekly basis. It's usually followed by some quip like "the quick and the hungry".

Twinax cabling (aka direct-attach SFP+) is a cost-effective way to interconnect switches, servers, and storage at 10GbE. Current implementations are limited between 5M and 10M. The economics are quite compelling when compared with discrete SFP+ optics. Well, there are 2 kinds of 10GbE twinax cables in this world: active and passive. (My father-in-law is beaming right now). Unfortunately, not all NICs or switches support both standards.

I was helping a client to migrate their VMware ESX 4.x servers to redundant 10GbE interfaces. They had Dell servers with OEM Intel NICs. They had done some initial testing with Dell's 24-port 10GbE switch, but ended up selecting Brocade's VDX6720 Ethernet Fabric network for redundancy and growth prospects. Once we had everything cabled and powered-up, there were connectivity issues. No link-up and the VMware host gave us purple-screens on shutdown.

A little poking in the /var/log/vmkernel logfile showed this:

"vmnic8: ixgbe_sfp_config_module_task: failed to load because an unsupported SFP+ module type was detected."

Well, come to find out that Intel's 10 Gigabit AF DA Dual Port Server Adapter isn't compatible with the active twinax cables that came with the Brocade VDX switches. The VDX switches don't support the passive cable that came with the Intel 85298-based 10GbE NICs.

This customer also had a handful of the newer Intel Ethernet Server Adapter X520 Series sporting the newer Intel 85299 ASIC. We still had problems getting things working. A little more digging shows that active twinax support for the x520 series was a semi-recent addition and according to Intel, requires driver version 15.3 or later. We spun up a copy of vSphere 5.0 hoping that it included a newer version of ixgbe. It sure does and we now have 10GbE over active twinax between the Brocade VDX6720s and the Intel x520 NICs.

Moral of the story: get your active/passive cables straight. Make sure your NIC & switch support the same standard. Make sure your drivers are recent enough (at least for the x520) to support the correct types of cable.

I love iFolder, Novell's file synchronization solution. It keeps a handful of folders synchronized across multiple machines including my desktop and 2 laptops.

There hasn't been much development on the open-source side of things and some recent Microsoft updates combined with having iFolder installed have lead to nuisance application crashes. Usually it's after I save a file and exit a program (like notepad) and the offending module is "iFolderShell.dll".

There are some discussions on the issues over @ Novell's forums. It looks like 3.8.4.1 and 3.9 beta clients may have solved this problem - but those clients are only available to Novell's "paying" customers.

There is one way to fix the problem: disabling iFolder shell integration. The only effect that I've seen so far is that I don't see the iFolder icon on the folders that I'm currently synchronizing with iFolder - but other than that things are staying synchronized. Save the following paragraph into a .reg file and double-click it. Hopefully this solves your client crashes like it did for me. Include the REGEDIT4 line below:

REGEDIT4
[-HKEY_CLASSES_ROOT\*\shellex\PropertySheetHandlers\iFolder]
[-HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\iFolder]
[-HKEY_CLASSES_ROOT\Folder\shellex\PropertySheetHandlers\iFolder]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\iFolder0]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\iFolder1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"-{AA81D831-3B41-497c-B508-E9D02F8DF421}"
"-{AA81D830-3B41-497c-B508-E9D02F8DF421}"

Or you can download the .reg file here: ifolder-shell-disable.reg