Google sense "something" about this online store :)

 Does Google smell something "fishy" with this online notebook store? Could you tell? :D

Contributing to laptop mode tools

As confirmed by laptop mode tools' changelog, my patch is finally merged into their core code. I simply contribute few line to show statistics regarding write and read frequency of every programs recorded during lm-profiler's runtime.

So, how the code looks like?

—- lm-profiler.old2009-06-03 21:12:52.000000000 +0700

+++ lm-profiler2009-06-26 21:08:54.000000000 +0700

@ -209,6 +209,11 @

done
printf ’\r \r’
stop_profiling

+

+echo “Write frequency : ”; cat $WORKDIR/write_accesses_* | sed -e ’s/^{[ \t]*//;s/[ \t]*$//’ -e ’/}$/ d’ | sort | uniq -c | sort -n

+echo “Read frequency : ”; cat $WORKDIR/read_accesses_* | sed -e ’s/^{[ \t]*//;s/[ \t]*$//’ -e ’/}$/ d’ | sort | uniq -c | sort -n

+echo;

+
NETPROFILE=`profilenet`
echo “Profiling run completed.”

Looks awful? I admit it. In short, it grabs files created by lm-profiler during its run time, trims out the blanks and then sort them, while at the same time showing their frequencies ascendingly.

NB: Actually it's for my own reminder, but to share with you all. To easily convert text to HTML (and dealing with all those escape characters etc), you could use http://www.textism.com/tools/textile/index.php. Simply paste your text there and click the button, voila..you get the HTML-ized text!

regards,

Mulyadi

Why so serious? :D

Got this quote from kernelnewbies mailing list....hehehehheheheh :D

"What happens when you read some doc and either it doesn't answer your question or is demonstrably wrong? In Linux, you say "Linux sucks" and go read the code. In Windows/Oracle/etc you say "Windows sucks" and start banging your head  against the wall."

-Denis Vlasenko on lkml

PS: s/banging your head*wall/take it for granted/g is better I guess :D I believe many Linux users also bang his/her head when learning Linux for the first time. :))

Moral: just don't bang your head too hard, it hurts, you know? :D

how to catch white space(s) using grep?

My definition: White space characters are anything that appears as "blank" a.k.a nothing in screen. They include tab, space, carriage return and so on.

As you know, grep provides a way to catch certain characters class or range. Specifically for white spaces, you can use [[:space:]] or [[:blank:]]. Notice the double [[ and ]] !!!

So, suppose you have text file named test.txt that contains:

     hehe /var/www/
hehe /var/www2/
ttt hehe /var/www3/
     heho /var/www/

Executing:

$ grep ^hehe test.txt

will yield:

hehe /var/www2/

but this:

$ grep -E '^[[:blank:]]*hehe' test.txt

yields:

       hehe /var/www/
hehe /var/www2/

In human words, '[[:blank:]]*' will catch zero or more appearance of space or tab before the word "hehe". If you want to catch at least single appearance of any of them, use "+" instead. Oh and let me remind you again, use -E so that "+" doesn't lose its special meaning.

Note: initially, i thought i simply use [:space:] or [:blank:] and end up in something-is-wrong-but-I-dont-know-what land. Turns out, I didn't read the man page carefully (poor me). Since they are built-in classes, I still need to enclose them with another "[" and "]". Valuable experience.....

regards,

Mulyadi.

Misunderstanding of rate limit concept in iptables

One day, I decided to learn more about iptables. This time, I found "limit" feature quite interesting to try. An excerpt from iptables manual page:

"limit

This module matches at a limited rate using a token bucket filter. A
rule using this extension will match until this limit is reached
(unless the ‘!’ flag is used). It can be used in combination with the
LOG target to give limited logging, for example."

OK, can't wait to get my hand dirty on it. I fired up my VM (Virtual Machine) guest and type this in guest's console:
# iptables -A INPUT -i eth0 -m limit -m icmp --icmp-type echo-request --limit 1/min -j RETURN

To avoid confusion, I assume the default policy of INPUT chain is ACCEPT. Further, there is no other rule in INPUT chain other than what I typed above.

What is the above rule supposed to do? My understanding, at that point, that it will rate limit the ICMP echo request packets up to 1 packet per minute. Thus, only 1 packet during 1 minute interval will be processed. Further packets will be queued in memory awaiting to be processed. My intention to try this feature is simply to find idea to prevent DDoS, but my "assumption of queueing" made me think that this is not really safe. If there 1 million packets waiting to be processed, eventually your machine's memory will be exhausted, no?

But OK, let's put aside that fearness. I flood ping my VM guest (ping -f, if you don't know how to do it. You have to be root to do this). But guess what? 100% of all ICMP packets are responded really fast!!! What's wrong?

Then I did various test. Replace RETURN target with DROP, not using -i, not specificly rate limiting echo-request, etc. Nothing works! tcpdump still showed me that there were lots of echo request - echo reply packets flowing back and forth between my host and my VM guest.

I almost concluded that "limit" was not working as I thought. Perhaps this is a job of iproute tools, something like we do to rate limit packets using CBQ, HTB etc.

But then I smell something fishy:

# iptables -L -n -v | head

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target     prot opt in     out     source               destination   
0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
     limit: avg 1/min burst 5 icmp type 8

Notice the "pkts" field? It's a counter that denotes how many packets are entering certain rule. Also notice there is global counter displayed in INPUT chain (inside the bracket).

So, what's special with them? When I repeat my flood ping test, I saw both the limit rule and the global INPUT counter increased! Thus, something is wrong in my assumption. If indeed the packets were successfully rate limited, at least ACCEPT counter won't be increased as fast as rate limit counter grew.

The answer? Back on manual page. Looks like my English skill was really tested this time. "A rule using this extension will match until this limit is reached". Uhuh...I see...

Confused? Let me explain it as simple as I can:
Assume you use 1 packet per second as limit. During the first minute interval, if a packet arrives, it will hit INPUT chain and checked against rate limit rule. Does it match? Of course! It is still not beyond our limit, right? How about the 2nd, 3rd, 4th and the 5th? They will match too. Why? Because by default, there is burst limit. It will allow several initial packets to get a match, but not all. The default is 5.

What about the rest? For sure, they won't match our limit rule. Again, why? because the limit has been reached (as stated by manual page), thus the limit rule is passed and netfilter will check the next rule. And since there is no more rule in our scenario and the default is to accept in INPUT chain, then all ICMP request packets are accepted and replied!

Solution? Simple. Since the excessive packets will pass our limit rule, then we need to block them right at the next rule e.g:
# iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j DROP

Voila! We successfully rate limit the ICMP! Woohoo! Case closed.... phewwww

Lesson taken: do not underestimate manual page. Read it very very carefully and make sure you understand every word in it. Misunderstanding of the meaning even a single word could lead to significant difference between successful or stressful trial-and-error implementation. You've been warned...

regards,

Mulyadi

A little patch that made into main Linux kernel git repository

Commit-ID: 1ad0560e8cdb6d5b381220dc2da187691b5ce124

Gitweb:     http://git.kernel.org/tip/1ad0560e8cdb6d5b381220dc2da187691b5ce124
Author:     Mulyadi Santosa <mulyadi.santosa@gmail.com>

AuthorDate: Sat, 26 Sep 2009 02:01:41 +0700
Committer: Ingo Molnar <mingo@elte.hu>
CommitDate: Thu, 1 Oct 2009 10:12:03 +0200

perf tools: Run generate-cmdlist.sh properly

Right now generate-cmdlist.sh is not executable, so we
should call it as an argument ".".

This fixes cases where due to different umask defaults
the generate-cmdlist.sh script is not executable in
a kernel tree checkout.

Signed-off-by: Mulyadi Santosa <mulyadi.santosa@gmail.com>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Mike Galbraith <efault@gmx.de>

Cc: Paul Mackerras <paulus@samba.org>

Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
LKML-Reference: <f284c33d0909251201w422e9687x8cd3a784e85adf7d@mail.gmail.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

---

tools/perf/Makefile | 2 +-

1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index b5f1953..5881943 100644

--- a/tools/perf/Makefile

+++ b/tools/perf/Makefile

@@ -728,7 +728,7 @@ $(BUILT_INS): perf$X
common-cmds.h: util/generate-cmdlist.sh command-list.txt

common-cmds.h: $(wildcard Documentation/perf-*.txt)

-       $(QUIET_GEN)util/generate-cmdlist.sh > $@+ && mv $@+ $@
+       $(QUIET_GEN). util/generate-cmdlist.sh > $@+ && mv $@+ $@

$(patsubst %.sh,%,$(SCRIPT_SH)) : % : %.sh

$(QUIET_GEN)$(RM) $@ $@+ && \

Langkah pertamaku di cyberspace.....

pagi ini buka web detik.com, ternyata ada pengumuman lomba nge-blog. So, kenapa tidak saya coba? Itung-itung berbagi pengalaman dengan sesama netters. 

Pertama kali ngenet sekitar tahun 1996. Waktu itu yang namanya internet bagai barang mewah bagi masyarakat biasa seperti saya. Jumlah ISP (Internet service provider) juga masih bisa dihitung dengan jari, itupun terpusat di Jakarta atau Surabaya. Kecepatan koneksi? Hehehehe, seingat saya waktu itu modem kebanyakan masih 9600 atau 14400 bps :D Bayangkan saja seberapa lambatnya jika koneksi seperti itu sekarang digunakan untuk ngebrowse web dengan content canggih semacam flash dan berisi beberapa banner plus teknologi AJAX. Bisa-bisa kelenger :)

Jadi kesan pertama waktu itu, berinternet itu menyenangkan tapi juga butuh kesabaran. Ya sabar karena koneksinya sendiri lambat, juga kalau line teleponnya putus. Whahahha, ini yang kadang bikin dongkol. Enak-enak download, telepon masuk, putuslah sudah koneksi. Waktu itu program semacam GetRight belum saya ketahui, jadi ya udah....ulang lagi.

Oh iya lupa, sebenernya saya ini sedikit "teracuni" kakak sepupu saya. Seingat saya dulu punya bisnis BBS (Bulletin Board System) di awal tahun 1990-an. Jangan tanya saya apa itu BBS, yang saya tahu, waktu itu saya diperkenalkan ama semacam layar chatting. Saya sendiri waktu itu coba-coba chat dengan kenalan kakak sepupu. Dari situ saya mikir "wah, hebat juga BBS. mungkin suatu saat gak cuma tulisan, tapi juga suara dan video bisa lewat koneksi semacam ini".  Sekarang kita lihat ini sudah jadi kenyataan. VoIP sudah mulai merakyat, video conference berbasis Internet juga banyak dipakai baik oleh perusahaan, pemerintah dan personal.

Begitu lihat layar browser, apa yang dicari? Untungnya search engine seperti Yahoo sudah exist, jadi yang dicari website soal game. Loh? Maklum pecandu game (bahkan sampai sekarang). Nyari move list karakter Mortal Kombat contohnya :)) Ya gimana lagi, waktu itu informasi semacam ini adanya di majalah game luar negeri, tapi gak kebeli. Jadi yang rada murah, ngenet dompleng fasilitas kampus. Tapi yang namanya fasilitas umum, antre nya luar biasa, hehehheheh. Jangan heran kalau kadang yang keluar cuma title halaman terus time out. Jadi ya retry lagi retry lagi.

Kalau soal chat, so pasti dicoba. Seingat saya waktu itu yang populer duluan IRC, baru Yahoo messenger. Apa hayo yang terkenal di IRC? Yup, channel #bawel di DALnet!!! :) Byeuhhhh, tuh channel bener-bener isinya orang yang kayaknya calon MC. Ada aja yang "diomelin". Belum lagi iklan dan quiz yang hilir mudik. Yang mojok? Jangan tanya :)))) Pasti ada, tapi soal ketemunya beda lawan jenis atau ternyata kena yang aspal (asli tapi palsu) ya mana tahu, wong namanya juga dunia maya

OK guys, that's my personal share today. Wanna share yours?