The DMZ

Scott Pack

23:01

@AviD hey man, dude says he wants to do a full packet capture so that's what we'll build for. If dude wants more then we'll have to revisit the spec.

AviD

hehehe

Scott Pack

@AviD To be fair, just doing a full packet capture doesn't really add a whole lot on top of whatever else your monitoring system is doing anyway.

AviD

I see, you're an enterprise developer. Java, probably.

Scott Pack

YOU TAKE THAT BACK!!!11!!ONE!!ELEVEN!!

AviD

►

Simon

23:02

Let's kick @AviD's ass.

Scott Pack

Unless your link is typically saturated at 2+Gbps then you're not going to be seeing a whole lot of extra load.

And even in that case it was IO bound writing to the disk.

@TildalWave I had a porter at lunch that was pretty not bad.

kalina

@Simon fine, i shall not use poison, I shall use fire

Scott Pack

@TildalWave Very light and fluffy. Very refreshing.

Karthik Rangarajan

@ScottPack as I said, the purpose is to really monitor for funny stuff happening on the inside...so Snort may be a better idea.

Simon

@kalina You're not a good nurse.

Scott Pack

23:03

@KarthikRangarajan You're going to want to do both.

kalina

I am a great nurse

I help people

sometimes I make ill people better

Scott Pack

@KarthikRangarajan The IDS to detect things and then the full packet capture to do post-detection forensics and analysis.

kalina

sometimes I kill bad people

both result in helping people

Simon

"bad people"

AviD

@ScottPack @kalina I think he meant this for you.

Karthik Rangarajan

23:04

@ScottPack as for the feed, we already have a machine running ntop that's seeing all the traffic.

we're just not capturing all the traffic.

if that makes any sense.

kalina

packetmon: gotta catch 'em all

Scott Pack

@KarthikRangarajan So will you be adding the extra functions to this box or splitting out the traffic to another system?

TildalWave

@ScottPack well mine is good but the world is getting funnier, strange .... so I didn't find that fav to retweet so I just tweeted from scratch from meta, that should do it :)

Scott Pack

@kalina Your face is terrible.

Karthik Rangarajan

@ScottPack adding extra functions to this box at this time.

kalina

23:05

@ScottPack my face is adorable

Scott Pack

@KarthikRangarajan Ah, ok, killer.

@KarthikRangarajan Is ntop going against the raw interface or are you doing something wild like PFRING?

kalina

diskpart solves all traffic related problems

Karthik Rangarajan

@ScottPack raw interface.

Scott Pack

@KarthikRangarajan The easy thing to do would be to throw daemonlogger at it

@KarthikRangarajan Daemonlogger is developed by Roesch at Sourcefire and simulates a ringbuffer packet capture.

Karthik Rangarajan

@ScottPack ah okay, reading about it now.

kalina

23:08

@ScottPack here is a picture of my adorable face:

Simon

in b4

Scott Pack

So, for example, it'll run as a service and will save all packets to a file, when that file hits 1GB it will start writing a new file. Whenever it rotates files it will check to see if the partition is 90% utilized or higher and delete the oldest file.

kalina

Simon

in after

Karthik Rangarajan

@ScottPack that is perfect!

Scott Pack

23:09

@KarthikRangarajan It requires very little processing or memory, it's very nearly a straight IO shunt.

kalina

@ScottPack has become immune to me

this is a sad day for everypony

Scott Pack

This 50Mbps link, is that a peak or continuous.

@kalina You've never met my daughter. I've come to equate adorableness with sneakiness.

Simon

@kalina He's busy having a grown-up discussion, give him some time.

Karthik Rangarajan

@ScottPack peak. Continuous is probably much lesser.

Scott Pack

cool.

kalina

23:10

@Simon what would you have done if I had posted a picture of my actual adorable face?

AviD

@ScottPack oh definitely. That sneaky grin is always the cutest.

kalina

@ScottPack adorable and sneaky are very similar

Simon

@kalina I would have looked at it and moved on.

kalina

@Simon I don't believe you

Simon

oki

kalina

23:11

you would have saved it at the very least

for "later"

Scott Pack

@KarthikRangarajan I would recommend saving the daemonlogger stuff to it's own partition, whether a new one on the existing storage or a new disk is up to you'uns.

AviD

@kalina he probably already prepared the handcream.

Simon

Jesus. I don't save pictures.

Scott Pack

@kalina Giggity.

Simon

Unless they are nice wallpapers.

AviD

23:11

@Simon @kalina he prints them.

kalina

@Simon so basically, it needs to be at least 1920x1080 with no other people present and a nice backdrop like a sunny sky or a night club, is what you're saying

Simon

And I store them in my room of creepiness.

Scott Pack

@KarthikRangarajan Snort, however, is a different matter. It's pretty hard on the memory.

@KarthikRangarajan It does quite a lot of in-memory flow reassembly which also results in needing big buffers.

Karthik Rangarajan

@ScottPack Yeah, the machine is pretty well equipped. It'll be interesting to see whether Snort makes it go to the limit.

Scott Pack

@KarthikRangarajan Probably not.

Karthik Rangarajan

23:13

@ScottPack but if nothing else, I'll start with Daemonlogger, and see what I can start doing with that data.

Scott Pack

@KarthikRangarajan I've been meaning to post my puppet manifests for this stuff to zer githubs.

Karthik Rangarajan

@ScottPack please do! and thanks for the help, I am still clueless on a lot of networking stuff, have never actually done this stuff hands on before.

Scott Pack

At one time I had intended to concoct ratio of bogomips to bps that I could use as a ballpark for sizing.

Simon

@kalina Here's my current wallpaper you donut:

kalina

you know, I was going to take an actual picture of me and put rainbow dash's head on it

but

Simon

23:16

Yes, shame on me for being too lazy to dual boot Ubuntu.

kalina

I can't be fucked working out how to use GIMP

AviD

@kalina did you just call @Simon a gimp?

Simon

GIMP fucking sucks. It took me 2 hours to do something very simple with it last time.

kalina

@AviD no

AviD

That's offensive. I think that's offensive. Is that offensive?

kalina

23:17

@Simon yes

Scott Pack

@KarthikRangarajan I'm also trying to think of what information's been published, and as such already released, that I can give for hardware comparisons. In the past I have successfully managed a fleet of RHEL 5 systems running snort and daemonlogger. The vahst majority of them were using 2.4GHz NetBurst era P4s with 2GB of RAM.

kalina

I just wanted to take a picture of rainbow dash's head, make it smaller, keep the transparency, paste it into the picture of me, cover my head, save the image, upload it to imgur, paste it in chat

but nooooooooooooooooo

so deal with it

Scott Pack

@KarthikRangarajan I'd have to go pull up traffic graphs to see what the profiles were, but I'd say 50Mbps peak would be about the 50th percentile mark.

kalina

@Simon you only have one monitor?

Scott Pack

@AviD Not really, no. Certainly not for you.

kalina

23:18

what monitor has a resolution of 1366x768?

what is this, the 90s?

Scott Pack

Do you even remember the 90s?

kalina

no

Simon

@kalina See an icon in the bottom right.

kalina

I just remember things were bleak

@Simon don't pull the "it's a laptop" excuse

Scott Pack

Desktop computing peaked at the Amiga 1000. It's been all downhill from there.

Simon

23:19

@kalina Yeah, you're right. 21" laptops are teh shit.

kalina

my 7" tablet has a higher resolution than your laptop

my 4.5" phone has a higher resolution than your laptop

Simon

Do you lie often?

kalina

nope

I have a Nexus 7 (1920x1200) and a HTC One (1920x1080)

Scott Pack

@kalina's face has a higher resolution than @Simon's laptop.

Simon

@ScottPack lololol

kalina

23:20

my face certainly is higher resolution

Simon

@kalina I have a N7 too, wanna fight about it?

Rory Alsop

@ScottPack kalina's face...Simon's lap...oh dear me

kalina

Scott Pack

Hell, even my last generation phone has a higher resolution than @Simon's laptop.

Simon

.../masseffect/...

Scott Pack

23:21

@RoryAlsop That's what she said.

kalina

@ScottPack I didn't actually say that

although earlier I nearly said somethin- nevermind

Scott Pack

@kalina It's already been stated that you did.

kalina

@ScottPack the person who stated that should die in a fire

Simon

I'm fairly sure that my resolution is very common for 15.6" laptops. Noobs.

kalina

a huge, fireball of a fire

@Simon and 11" macbooks

Rory Alsop

23:22

@kalina In similar news, I learned to do Fireballs in Skyrim this afternoon :-)

kalina

@RoryAlsop chain lightening is where it's at

MURDER THE WHOLE TOWN

Simon

@kalina Expensive as nobs.

kalina

@Simon sounds like your sort of device

Rory Alsop

@kalina sounds good - will learn faster

Scott Pack

@Simon My 13" laptop is 1280x800.

Simon

23:24

@ScottPack You have a fucking Macbook Pro, it doesn't count.

I like how in any other situation, you would have said "Macbook" but you used the term "laptop" now TO MAKE ME LOOK BAD.

BAD PEOPLE, BAD BAD BAD.

Scott Pack

@Simon Oh shit, look at that. I'm using almost 10GB of ram. Ruh roh, only 6 more to go.

Simon

@ScottPack pr0n?

Scott Pack

@Simon In my defense I only refer to it as a MBP when the actual model matter. Normally I'm not that pretentious.

@Simon Firefox and a W7 VM

Karthik Rangarajan

The worst is when people refer to Macbook Air as MBA.

Simon

@ScottPack Wow, how much RAM did you allocate to the VM?

Karthik Rangarajan

23:27

Someone on Facebook said "I just bought an MBA! WooHoo!"

And I almost commented saying that illegal degrees is not something you brag about.

Scott Pack

@Simon 2GB

TildalWave

@Simon Yuck what's that low resolution crap you're on? Your whole desktop looks like a thumbnail on mine :P

Simon

@ScottPack What the hell?

Scott Pack

@KarthikRangarajan It's not necessarily illegal, it just maybe shouldn't be accredited.

Simon

YOU DAMN FANCY PEOPLE WITH HUGE SCREENS.

Karthik Rangarajan

23:28

Does an Apple 27" monitor count as a huge screen?

Scott Pack

@Simon According to Activity Monitor about 5 of it is going to Firefox.

Rory Alsop

Currently I think I'm on 4950x1080

:-)

TildalWave

@Simon three screens actually, and I'm thinking of adding another one

Simon

@KarthikRangarajan It counts in the "I don't get laid too often" category.

Rory Alsop

need bigger screenage

Scott Pack

23:28

@KarthikRangarajan Depends on which orientation you're inserting it.

@RoryAlsop 3 display?

Simon

@ScottPack You must have a shit ton of tabs opened.

Karthik Rangarajan

@ScottPack Hah! Well, I have a 30 inch that's vertical...

kalina

Karthik Rangarajan

@Simon I would have taken offense at that if it weren't true.

kalina

^ current desktop

but I only have space to set up 2 of my 3 monitors here

Scott Pack

23:29

@Simon 3 windows, one of which has 3 tab groups. So probably well over a hundred right now.

Rory Alsop

@ScottPack yarr

sometimes I use the 3rd one in portrait mode, but not tonight

as it would confuse my arithmetic

TildalWave

@ScottPack sounds familiar

Rory Alsop

And I get all my wallpapers from NASA's APOD

Simon

@ScottPack It sounds a little bit excessive.

Scott Pack

@RoryAlsop I was a 3 display user for quite a long time. Eventually I had to go back to 2. The 3rd was making me less productive.

Karthik Rangarajan

23:30

Also, OS/X cheats with memory. There have been times when my VMs are hanging, but there's about 6G of memory sitting in "Inactive"

kalina

@ScottPack three is great

Scott Pack

@Simon I tend not to use bookmarks and they're lots of different session types.

Karthik Rangarajan

And no, purge doesn't work, it just results in my VMs dying

Scott Pack

@kalina TWSS

kalina

primarily for setting it up for gaming

using eyefinity or similar

TildalWave

23:30

@RoryAlsop Oy you NASA guy, you saw I made them mention Astro.SE?

Scott Pack

@KarthikRangarajan No doubt.

kalina

if you have two, your cross hairs are in the middle between the two screens

so three is great

Scott Pack

@KarthikRangarajan Oh, was all that brain dump useful, eh?

Karthik Rangarajan

I have three screens, though one is my laptop screen which I almost never look at.

@ScottPack Yes, very useful. Thanks! Now I only have to convince my DevOps dudes that I really need all that space ;)

AviD

@ScottPack I bet Firefox takes up more memory.

Scott Pack

23:32

I don't do computer gaming, except the occasional SNES emulator or Portal. So the crosshair issue doesn't come into it for me.

Karthik Rangarajan

@AviD From my (very unscientific) measurements, all browsers consume the same amount.

Rory Alsop

@TildalWave linky?

@ScottPack just turn it off when that happens, or close the reddit/r/wtf tab :-)

kalina

@AviD Chrome frequently uses up 1.5gb of RAM on my machine

Scott Pack

@AviD Considering Firefox is using about 5 and I only have 2 allocated to the VM....

TildalWave

@RoryAlsop sdoisgo.blogspot.com/2013/12/…

Scott Pack

23:32

@RoryAlsop I don't use reddit

Rory Alsop

@ScottPack ahem...me neither

(Blimming other Rory's fault)

Scott Pack

@KarthikRangarajan Chrome uses quite a lot more than Firefox at scale.

Rory Alsop

@TildalWave good work, that man!

Karthik Rangarajan

@ScottPack I have this habit of closing tabs if the number of tabs is greater than a certain number.

Scott Pack

@RoryAlsop Or, rather, I only use /r/gonewild in a private browsing session in Safari on demand.

kalina

23:33

anybody with less than 16gb of RAM deserves to have memory problems

Rory Alsop

@ScottPack damnit - I'm going to have to google that now...

TildalWave

@RoryAlsop Yes, I thought so too. And funny enough, they stopped serving AIA 4500 images because of that filter defect about 3 weeks after too, so how was I supposed to know LOL

Karthik Rangarajan

@RoryAlsop I've wasted far too many hours on that site, do not go there.

AviD

okay, there is way too much chatter in here, for me to try to do any kind of work whilst keeping up.

Rory Alsop

@Tildal - I suppose you could delete your comment on that Astro post now :-)

Scott Pack

23:35

@KarthikRangarajan I do enough repeated tasks that I just have different session setup for each one and switch around as necessary. So one tab group has all the work things I use on a regular basis, as well as whatever's open for my current project.

Rory Alsop

@AviD pffft - it must be almost after whisky/port time, sir?

TildalWave

@RoryAlsop good call :)

Rory Alsop

@TildalWave I was going to flag it as obsolete :-)

Scott Pack

@KarthikRangarajan Another one has all the StackExchange sites that I'm interested in. Another has my personal email, feedly, etc.

TildalWave

@RoryAlsop can you please flag the other one as obsolete? I can't because I replied to it

Rory Alsop

23:35

(but failed)

@TildalWave can do

TildalWave

cheers

Karthik Rangarajan

@ScottPack On Chrome, I have two user sessions. One personal (for SE, Facebook, etc.) and another one for work.

Rory Alsop

@Tildal - no I can't for some reason. I'm only a 1k user there, maybe that's it

Scott Pack

@KarthikRangarajan Oh, the extra space you need will mostly depend on how much you want to keep.

AviD

@RoryAlsop dinner time, actually - a bit late for me. though you know I keep working all hours....

TildalWave

23:36

@RoryAlsop hmmm, OK I'll ask mods then

AviD

"working"....

Scott Pack

@KarthikRangarajan So look at your daily average throughput multiply that by how long you want to keep it, and see how many giggers you'll need.

Karthik Rangarajan

@ScottPack yeah, that was the plan.

Rory Alsop

@ScottPack Thankyou for this Christmas Present/ time waster

Scott Pack

@RoryAlsop I do so aim to pleasure.

Rory Alsop

23:38

hahahaha

Scott Pack

@KarthikRangarajan Are you the one who actually does the analysis?

Karthik Rangarajan

@ScottPack I am going to be, yes.

kalina

are you back to talking about boring geeky stuff again?

Karthik Rangarajan

@kalina unfortunately yes he is.

Scott Pack

@KarthikRangarajan Ok, then come up with some kind of retention schedule that seems reasonable for your response plan.

@kalina Boring? You're one to talk.

kalina

23:39

I can talk, yes

Simon

@ScottPack Dayum.

@kalina According to your icons, you really are a huge nerd.

kalina

@Simon I am not a nerd

Simon

Don't pull the geek card.

kalina

I just have a wild and varied taste in games

TildalWave

@kalina one of them being @Simon?

kalina

23:41

he is not a game

he's more of a spreadsheet

Karthik Rangarajan

hahahah

TildalWave

"game" can have different meanings

kalina

BOOOOOORINNNNNNNNNGGGGGGGGGGGGGGG

Karthik Rangarajan

@TildalWave I was going for the kind that is hunted.

TildalWave

me too

Simon

23:42

#yolo

kalina

don't yolo

Rory Alsop

@Simon that's very close to banning material young man...

kalina

@Rory he even hash tagged

you should just ban him

Simon

@kalina How many videos/pictures of my last 2 weeks nightlife do I have to post to be labeled as non-boring?

@RoryAlsop #yolofreedom

kalina

@Simon two weeks out of fifty two is hardly something to be proud of

Simon

23:44

@kalina True. How about I type every single DJ/producer that I've seen since October?

kalina

sure, let me give you a second to google

TildalWave

@Simon you'll never be labeled as non-boring, the best you can look forward to is not being labeled as boring for some time

Simon

@kalina Sigh.

kalina

VICTORIOUS \o/

Simon

I should have enough pictures to back up my statement though.

kalina

23:45

I am only interested in pictures of your p- nevermind

TildalWave

"non-boring" isn't necessarily "interesting" too

Simon

wat le fuck.

kalina

I don't understand

Simon

This is the perfect way to solve any hangover:

kalina

are you about to link a picture of sex into chat?

ewww what is that?

Simon

23:49

That's called meat.

kalina

eww.

Mars One just narrowed its pool of potential Martian colonists from 200,000 to 1,058 http://vrge.co/JpEWPs

Tweeted by verge on December 30, 2013 at 5:00 PM

Rory Alsop

@kalina Single-entendre's aren't needed here. Doubles work just fine - see our room topics :-)

kalina

you don't even know what I was going to say

don't judge me

TildalWave

oh, this reminds me, I "know" one of those that made it to the 2nd round

Gillian Finnerty

@GillianFinnerty, Sheffield

21 y/o AstroPhys student @UoSPHY. Publicity/Safety Officer @Suscsnow & @Sheffield_Astro Committee, sponsored snowboarder. Mars One candidate through to Round 2!

3.8k tweets, 857 followers, following 2k users

Rory Alsop

@kalina very true. My apologies :-P

kalina

23:51

you know what they should do?

Simon

@TildalWave I'm sure she'll get very serious relationships from now on.

TildalWave

she said she got marriage proposals and even offered money

Rory Alsop

@TildalWave snowboarding on Mars - cool!

kalina

send all of Earth's criminals to Mars, make them build a dome to live in, and then send the army to wipe them out so we can reuse the dome for colonising

Simon

@TildalWave Oh fuck that...

Rory Alsop

23:52

oop - time to go...only 24 hours till Hogmanay!

TildalWave

@TildalWave haha deleted it sorry! but yeh it was mental, blocked him in the end

Tweeted by GillianFinnerty on December 30, 2013 at 8:28 PM in reply to TildalWave

Rory Alsop

@kalina is that latter bit what was forgotten with Australia?

Simon

@RoryAlsop babai

kalina

@RoryAlsop I think so

I duno though, Australia turned out better than America

TildalWave

@RoryAlsop skiing those sand dunes should be pretty cool too

had to wiki that

Hogmanay

Hogmanay (Scots: , , Scottish English: ) is the Scots word for the last day of the year and is synonymous with the celebration of the New Year (Gregorian calendar) in the Scottish manner. However, it is normally only the start of a celebration that lasts through the night until the morning of New Year's Day (1 January) or, in some cases, 2 January—a Scottish Bank Holiday. Etymology The etymology of the word is obscure. The three main theories derive it either from a French, Norse or a Goidelic (Insular Celtic) root. The word is first recorded in 1604 in the Elgin Records as hagmonay (d...

Simon

23:56

I wonder if there's something useful I could do out of this mucus production.

Do people buy mucus? Because I could totally put some in a bottle.

TildalWave

mucus of what?

Simon

Of my nose?

TildalWave

@Simon ncbuy.com/news/20041231/0-artist-selling-his-snot-ball.html

Scott Pack

Oh look, dinner time.

Have a lovely evening gentlewomen and gentletrolls.

TildalWave

@ScottPack you too, bon appétit

Transcript for