<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
<channel>
<title>IP Packet</title>
<link>http://www.ippacket.org/blog/</link>
<description></description>
<language>en</language>
<copyright>Copyright 2005</copyright>
<lastBuildDate>Sun, 02 Oct 2005 10:20:04 +0330</lastBuildDate>
<generator>http://www.movabletype.org/?v=3.17</generator>
<docs>http://blogs.law.harvard.edu/tech/rss</docs> 

<item>
<title>NSSA (ABR+ASBR)</title>
<description><![CDATA[<p><b>S</b>ometime you face to a router in OSPF which is an ASBR NSSA and it's an ABR as well so in this situation you've two external LSAs on that router, one is LSA type 7 which is advertised to NSSA area and other is LSA type 5 which is advertised to other not stub area.<br />
now in some case you don't need to advertise LSA 7 in NSSA area and you need the router acts as ABR router for NSSA area so to prevent advertising LSA 7 to NSSA area at Cisco routers you can use the following command under ospf process :<br />
area area_id nssa no-redistribution<br />
<img alt="nssa-ospf.gif" src="http://www.ippacket.org/blog/archives/images/nssa-ospf.gif" width="469" height="284" /><br />
at the above scenario you can see a router which is an ASBR NSSA router and an ABR router so to prevent IGRP advertisements (external routes) to NSSA area you should do by the below commands :<br />
router ospf 100<br />
area 1 nssa no-redistribution</p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/10/nssa_abrasbr_1.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/10/nssa_abrasbr_1.html</guid>
<category>Networking</category>
<pubDate>Sun, 02 Oct 2005 10:20:04 +0330</pubDate>
</item>
<item>
<title>Active directory demotion</title>
<description><![CDATA[<p><b>A</b> trick when you're going to uninstall active directory on win2000 and the demotion failed! through dcpromot or dcpromot /forceremove commands<br />
At regedt32 modify the following key from lanmanNT to serverNT :<br />
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\control\ProductOptions\ProductType<br />
when you done it, restart your server then delete NTDS directory after that you should change server from member domain to member of workgroup.<br />
after this alteration you must restart server , now your active directory is demoted and you can install a fresh DC or forget it ;-)</p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/07/active_director.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/07/active_director.html</guid>
<category>Networking</category>
<pubDate>Mon, 18 Jul 2005 13:10:11 +0330</pubDate>
</item>
<item>
<title>Robot, QRIO</title>
<description><![CDATA[<p><img alt="qrio_01.jpg" src="http://www.ippacket.org/blog/images/qrio_01.jpg" width="79" height="113" border="0" /></p>

<p><b>W</b>hat's Robot? in fact we don't have a specific definition for robot  but we can define robot with some specification.usually it's a mechanical machine but these days we can see some software robots so it can be non mechanical, it's reprogrammable and it can intelligence. for instance in industry it move material,part,tools through variable programmed.<br />
Have you ever thought about future and robots? in fact how they would can change our social life in future? how can AI (Artificial Intelligence) help them for thinking like human?<br />
I would like to see those days when we live with intelligence robots.<br />
As you know Sony is a big company and they work on a wonderful project that named QRIO (quest and curious).Sony's goal is personal entertainment so they produced QRIO , it embodies advance technologies in motion control, communication , artificial intelligence.<br />
Major technology includes stable dynamic walking, dancing and running, full arm movement allowing throwing a ball, voice/face recognition, stereoscopic vision, obstacle avoidance, visual mapping, wireless network and ....<br />
you can find more information about QRIO at sony web site <a href=http://www.sony.net/SonyInfo/QRIO/>http://www.sony.net/SonyInfo/QRIO/</a></p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/04/robot_qrio.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/04/robot_qrio.html</guid>
<category>Artificial Intelligence</category>
<pubDate>Tue, 19 Apr 2005 12:02:45 +0330</pubDate>
</item>
<item>
<title>NAT Traversal</title>
<description><![CDATA[<p><img alt="natt.jpg" src="http://www.ippacket.org/blog/images/natt.jpg" width="127" height="94" border="0" /><br />
Probably you heard IPSEC ESP doesn't work through PAT connection because when the PAT wants to modify ESP layer 4 header it faces to problem. why? because it's encrypted and PAT can't change source port. don't worry the RFC 3948 written by four major companies (F-Secure Corporation, Microsoft, Cisco and Nortel) at jan.2005, can help us but what's your VPN vendor? because all vendor haven't implemented yet.<br />
How does it work? <br />
In fact this protocol defines methods for encapsulate and decapsulate ESP packet inside the UDP for traversing through network address translators.</p>

<p><img alt="nattp.jpg" src="http://www.ippacket.org/blog/images/nattp.jpg" width="384" height="61" border="0" /></p>

<p>It's so good for any network which are using PAT and they want to have IPSEC ESP from any hosts of its network.really this protocol help to limitation IP V4 (special thanks to the IETF (Internet Engineering Task Force) for fix this problem in working ESP through PAT)</p>

<p>See detail of this protocol from the following URL :<br />
UDP Encapsulation of IPsec ESP Packets RFC<br />
<a href=http://www.faqs.org/rfcs/rfc3948.html>http://www.faqs.org/rfcs/rfc3948.html</a></p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/04/nat_traversal.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/04/nat_traversal.html</guid>
<category>Networking</category>
<pubDate>Mon, 04 Apr 2005 17:39:50 +0330</pubDate>
</item>
<item>
<title>QoS , P2P and NBAR</title>
<description><![CDATA[<p>Data classification is one of more important things in QoS but how we can classified  data flow through cisco devices (with proper IOS)?and in this days what's important to prioritize?<br />
Data classification depends on each network data flow, for example when you're using voice,video,citrix application and so on , you should plan a strategy for your classification data.</p>

<p>Generally data network is classified to following :<br />
- Voice<br />
- Mission critical (application like citrix)<br />
- Transactional (E-commerce)<br />
- Best-effort (web,email and ...)<br />
- Less-Than-Best-effort (P2P)<br />
*Note : Cisco recommend that your classification doesn't exceeded from 4 or 5 categorize.</p>

<p>These days Peer 2 Peer file sharing applications are a issue for any network which is connected to internet, because it has many data traffic for instance video,mp3 and other larg files so it cause bad situation when the newtrok has congestion.what do you think when you haven't QoS and all of data flow has same priority? yes ofcourse your voice and other low latency data are experienced loss data.<br />
Cisco content networking architecture help you to classified data in later 4-7, it called Network Based Application Recognition (NBAR) so it  can regognition some P2P application like Kazza however it depends on PDLM (packet description language module) which is loaded in your cisco device.<br />
You should download the latest PDLM from Cisco web site to up to date application signatures.</p>

<p>In another aspects NBAR can recognize the HTTP GET packets contain the URL through hostname, mime type as well as it has protocol discovery analyzes application traffic pattern in real time and discovery which traffic is running on the network.it uses SNMP to provide that information.</p>

<p>Regarding to this article see the following commands  :<br />
ip nbar pdlm pdlm-file<br />
class-map [match-all | match-any] class-name<br />
policy-map policy-name<br />
class class-name<br />
service-policy output<br />
service-policy input<br />
match protocol protocol-name (like kazza)<br />
match protocol fasttrack file-transfer "regular-expression"<br />
ip nbar protocol-discovery<br />
snmp-sever enable traps cndp</p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/03/qos_p2p_and_nba.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/03/qos_p2p_and_nba.html</guid>
<category>Networking</category>
<pubDate>Tue, 29 Mar 2005 20:48:02 +0330</pubDate>
</item>
<item>
<title>Artificial Intelligence</title>
<description><![CDATA[<p><img alt="ai.jpg" src="http://www.ippacket.org/blog/images/ai.jpg" width="108" height="91" border="0" /></p>

<p><b>I</b>n the early 1950s Herbert Simon, Allen Newell and Cliff Shaw conducted experiments in writing programs to imitate human thought processes. The experiments resulted in a program called Logic Theorist, which consisted of rules of already proved axioms. When a new logical expression was given to it, it would search through all possible operations to discover a proof of the new expression, using heuristics. <br />
This was a major step in the development of AI. The Logic Theorist was capable of quickly solving thirty-eight out of fifty-two problems with proofs that Whitehead and Russel had devised. At the same time, Shanon came out with a paper on the possibility of computers playing chess. Though the works of Simon et al and Shanon demonstrated the concept of intelligent computer programs, the year 1956 is considered to be the start of the topic Artificial Intelligence. This is because the first AI conference, organised by John McCarthy, Marvin Minsky, Nathaniel Rochester and Claude Shanon at Dartmouth College in New Hampshire, was in 1956. This conference was the first organised effort in the field of machine intelligence. It was at that conference that John McCarthy, the developer of LISP programming language, proposed the term Artificial Intelligence. The Dartmouth conference paved the way for examining the use of computers to process symbols, the need for new languages and the role of computers for theorem proving instead of focusing on hardware that simulated intelligence. </p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/03/artificial_inte.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/03/artificial_inte.html</guid>
<category>Artificial Intelligence</category>
<pubDate>Sat, 19 Mar 2005 15:25:53 +0330</pubDate>
</item>
<item>
<title>Diffie Hellman</title>
<description><![CDATA[<p><img alt="sharedkey.jpg" src="http://www.ippacket.org/blog/images/sharedkey.jpg" width="78" height="51" border="0" /></p>

<p>Diffe Hellman is a method for exchange securely shared key between two nodes over untrusted netwrok like internet, it's not encryption method,it's key aggrement protocol that was developed by Diffie and Hellman in 1976.<br />
in fact it generates key between two nodes,it uses a mathematical algorithm with simple concept, let's take a look the following example :</p>

<p>- Node A and Node B agree on two numbers : p and g<br />
p is a larg prime number and q is called the base or generator<br />
- Node A picks a secret number a<br />
- Node B picks a secret number b<br />
- Node A choose public number x = g^a mod p<br />
- Node B choose public number y = g^b mod p<br />
- now Node A knows y and Node B knows x<br />
* in this step they create key as follow :<br />
  - Node A k(a) = y^a mod p<br />
  - Node B k(b) = x^b mod p<br />
In fact k(a) = k(b) = k (laws of algebra) in this section Node A and Node B know K as shared key.</p>

<p>unfortunately this method hasn't authentication so a man-in-the-middle can attack and decrypt  any messages from Node A and Node B.<br />
The authenticated Diffie-Hellman key agreement protocol was developed by Diffie, van Oorschot, and Wiener in 1992  to defeat the man-in-the-middle attack. it uses digital signature for authentication each origin.</p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/03/diffie_hellman.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/03/diffie_hellman.html</guid>
<category>Security</category>
<pubDate>Sat, 12 Mar 2005 17:26:35 +0330</pubDate>
</item>
<item>
<title>MAC and HMAC</title>
<description><![CDATA[<p>MAC (Message Authentication Code) and HMAC (Keyed-Hashing for Message Authentication Code) are mechanism for providing integrity when the data transfer over untrusted enviroment like internet, they are work base on shared secret key.<br />
When we use MAC mechanism based on cryptographic hash functions so it called HMAC. there are different cryptographic hash functions like SHA-1,MD5,RIPEMD-160,PANAMA,SHA256 and etc.<br />
Let's take a look to HMAC mathematical algorithm :</p>

<p>HMAC(Message) = Hash[(Key XOR OPAD) || Hash(Key XOR IPAD) || Message]<br />
|| means concatenation operation<br />
OPAD (outer padding) = 36hex, repeated as needed<br />
IPAD (inner padding) = 5Chex, repeated as needed</p>

<p>for instance :<br />
message : welcome to ippacket site<br />
secret key : mehrdad<br />
HMAC digest by MD5 = 76960728e94b2693149728b076c614cf<br />
HMAC digest by SHA-1 = 95ab25cb679c193fe141cb92e55126876a5285ea<br />
HMAC digest by RIPEMD160 = fd9bab4a7f4b69d895fbb38f2fb09972c7137c43</p>

<p>MAC is simple than HMAC , it uses encryption like DES.</p>

<p>* HMAC RFC is RFC 2104 you can read it from <a href=http://www.faqs.org/rfcs/rfc2104.html> FAQ.ORG </a></p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/03/mac_and_hmac.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/03/mac_and_hmac.html</guid>
<category>Security</category>
<pubDate>Mon, 07 Mar 2005 16:42:59 +0330</pubDate>
</item>
<item>
<title>RSA Encryption and Digital Signature</title>
<description><![CDATA[<p>It offers encryption and authentication (digital signature), developed in 1977 by Ron <b>R</b>ivest, Adi <b>S</b>hamir and <b>A</b>dleman and it works asymetric and generate public and private key by itself.thus encryption and authentication take place without any sharing of private keys: each person uses only another’s public key or their own private key.<br />
<br><br />
<img alt="rsa.jpg" src="http://www.ippacket.org/blog/images/rsa.jpg" width="149" height="108" border="0" /><br />
<br><br />
For generate public and private keys it takes two larg prime numbers p and q , they should not equal and with a size of at least 1024 bits.<br />
Let's take a look to its algorithm :<br />
n define as follow :<br />
n = p · q<br />
phi define as follow : <br />
&#966; = (p – 1) · (q – 1)<br />
e is a number greater than 1 and less than &#966; as follow :<br />
1< e < &#966;<br />
d define as follow :<br />
(d.e)/&#966;=1</p>

<p>d is private key and n,e are public key so it's difficult to obtain the private key d from the public key (n, e). <br />
for example when our plaintext = 707<br />
The encrypted data is c = m^e (mod n) :<br />
ciphertext = 707^425(mod 3431) = 2142<br />
then the plaintext is easily retrieved using m = c^d(mod n) <br />
plaintext = 2142^1769(mod 3431) = 707</p>

<p><a href="http://www.ippacket.org/blog/images/RSA-2003.html" onclick="window.open('http://www.ippacket.org/blog/images/RSA-2003.html','popup','width=3072,height=2048,scrollbars=yes,resizable=yes,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false">RSA group 2003 Picture</a></p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/03/rsa_encryption.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/03/rsa_encryption.html</guid>
<category>Security</category>
<pubDate>Sun, 06 Mar 2005 10:20:29 +0330</pubDate>
</item>
<item>
<title>A trick for using DIP at NetScreen firewall</title>
<description><![CDATA[<p>When a host initiates several sessions that match a policy with network address translation (NAT) enabled and is assigned an address from a dynamic IP (DIP) pool, the NetScreen device assigns a different source IP address for each session. Such random address assignment can be problematic for services that create multiple sessions that require the same source IP address for each session.<br />
I analyzed it with ethereal and i known it use round roubin algorithm for assigment source ip address for example when You ping a host,source address for request ICMP are dffrent and it use round roubin algorithm.<br />
This behaviur cause problem for some service (some web base email,AOL instance messenger and so on)<br />
for using same ip address from DIP pool to a host for multiple concurrent session you should set the following command<br />
<b>set dip sticky</b><br />
P.S : you can't set this feature from web base</p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/03/a_trick_for_usi.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/03/a_trick_for_usi.html</guid>
<category>Security</category>
<pubDate>Thu, 03 Mar 2005 01:10:24 +0330</pubDate>
</item>
<item>
<title>DES</title>
<description><![CDATA[<p>DES is one of encription algorithms , it's an acronym for Data Encription Standard<br />
Oginally DES was developed by IBM in early 1970 as lucifer.<br />
it's symetric and its key length is 64bits (8bits are used for parety),meaning that<br />
there are 72,057,594,037,927,936 possible keys (56bits).<br />
at that time (~1970) it was good algorithm for encription and decription but it's cracked<br />
When computers became powerful.</p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/03/des.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/03/des.html</guid>
<category>Security</category>
<pubDate>Wed, 02 Mar 2005 22:38:19 +0330</pubDate>
</item>
<item>
<title>Complexity Kills Innovation</title>
<description><![CDATA[<p><img alt="complex.jpg" src="http://www.ippacket.org/blog/images/complex.jpg" width="105" height="110" border="0" /></p>

<p><b>I</b> believe that any complexity in anythings can kill innovation.<br />
These days we hear about windows OS vulnerability, worm and virus that are intruded to this OS and do wrong functions so this complexity cause complex solutions for solve them.<br />
We can see this situation in some complex network so trubleshooting in these networks are difficult. what's your idea about this complexity? <br />
you can see the following link about this subject :<br />
http://www.securityfocus.com/columnists/300  </p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/03/complexity_kill.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/03/complexity_kill.html</guid>
<category>Security</category>
<pubDate>Wed, 02 Mar 2005 12:10:58 +0330</pubDate>
</item>
<item>
<title>Triton Studio and Yamaha</title>
<description><![CDATA[<p><img alt="triton.jpg" src="http://www.ippacket.org/blog/images/triton.jpg" width="119" height="60" border="0" /></p>

<p>Tow days ago , i had to open my synthesizer box for check it out for a reason<br />
It has three layers electronic board ,clavier section and other hardware like CDROM,Floppy drive ,HD and port controller.<br />
It was intresting that  some electronic boards which are used in clavier section were labaled with YAMAHA! it seems these two companies work together in some parts.<br />
Anyway if you need any hardware for triton studio you can buy them from www.korgparts.com or contact to 800-590-0014 or 802-464-0014</p>]]></description>
<link>http://www.ippacket.org/blog/archives/2005/03/triton_studio_a.html</link>
<guid>http://www.ippacket.org/blog/archives/2005/03/triton_studio_a.html</guid>
<category>Synthesizer</category>
<pubDate>Tue, 01 Mar 2005 22:16:04 +0330</pubDate>
</item>
<item>
<title>Juniper OS :: JUNOS and JUNOSe</title>
<description><![CDATA[<p><IMG height=50 alt=junos_293_thumb.gif src="http://www.ippacket.org/blog/images/junos_293_thumb.gif" width=95 border=0> I'm intersted in oprating system it means their managements for instance process management,memory management and so on also on deadlock detection/avoidance,file system,scheduling strategies and .... I think freeBSD has the best managements and works properly although other OS like SUN Solaris is powerful but FreeBSD is categurised in non-commercial operating system and it comes with full source code. in fact i wanna talk about JUNOS that based on the FreeBSD , first of all please don't pronounce JUN-OS ,you should pronounce just in one syllable.Juniper appliances have JUNOS as operating system which based on the FreeBSD they've modified the freeBSD,extracted some modules and imported specially modified modules and some engines on it. the JUNOS has some parts contain : JKernel (The operating system package) JRoute (The routing engine software) JPFE (The PFE software) JDocs (Updated online reference documentation) Jcrypto (Security software (U.S. domestic only)) Jbase (Additions to JUNOS) Totally they called Jbundle. </p>]]></description>
<link>http://www.ippacket.org/blog/archives/2004/08/juniper_os_juno.html</link>
<guid>http://www.ippacket.org/blog/archives/2004/08/juniper_os_juno.html</guid>
<category>Networking</category>
<pubDate>Tue, 31 Aug 2004 22:29:37 +0330</pubDate>
</item>
<item>
<title>Virtual Private LAN service </title>
<description><![CDATA[<p><b>A</b>s you know Ethernet is simple,flexible and scaleable bandwith also it has been revolition in MetroEthernet.Virtual Private LAN service (VPLS) allows service providers to deliver VPN service base on ethernet and it's one of the most inovation of providing Ethernet/MPLS VPN.<br />
it uses Martini encapsulation standard and empowers service providers Ethernet networks with scalability and availability. Without VPLS, the scalability of Ethernet networks is limited to the number of unique identifiers or VLAN IDs used to provide services, and the availability of Ethernet networks is limited by the poor resiliency characteristics of mechanisms such as Spanning Tree Protocol.Some limitation such as QinQ solves and VPLS networks can support over a million unique identifiers.<br />
VPLS is based on an Internet Engineering Task Force (IETF) draft called Lasserre-V. Kompella, written by Marc Lasserre of Riverstone Networks Inc. and Vach Kompella of TiMetra Networks, now owned by Alcatel. VPLS is expected to be a fully ratified standard by the end of this year, but several service providers are already deploying the service because they feel it’s stable enough for commercial use, says Newell.</p>]]></description>
<link>http://www.ippacket.org/blog/archives/2004/08/virtual_private.html</link>
<guid>http://www.ippacket.org/blog/archives/2004/08/virtual_private.html</guid>
<category>Networking</category>
<pubDate>Wed, 18 Aug 2004 12:11:33 +0330</pubDate>
</item>


</channel>
</rss>
