posted 2010-08-11 23:23:55, link to this article

After seeing Samy Kamkars talk at DEFCON 18, I really wanted to play with Google's geolocation API.
Some results already:

hessch@turing:~$ bin/mac_geoloc 00:11:92:a1:b2:40

{
    "location"    :    {
        "latitude"    :    36.1344023,  
        "longitude"    :    -115.1620542,
        "address"    :    {     
            "country"    :    "United States",  
            "country_code"    :    "US",
            "region"    :    "Nevada",  
            "county"    :    "Clark",   
            "city"        :    "Las Vegas",     
            "street"    :    "Las Vegas Blvd S",
            "street_number"    :    "2955",     
            "postal_code"    :    "89109"       
        },      
        "accuracy"    :    150.0}       
}

Which is the location one of the hotspot access-points in the Riviera hotel, according to Google. Yay! :)

posted 2010-08-11 19:36:02, link to this article

I was playing with some network related stuff this evening and needed to rewrite MAC addresses to the canonical form. That is, something like this 00-02-DE-AD-BE-EF.
Why, you ask? Well every piece of software seems to have their own ideas on how to represent these magical 48 bit integers.
For instance, you'll often see something like 01:02:03:C0:FF:EE, which might also be written in shorthand as 1:2:3:c0:ff:ee or as a (pretty Cisco specific) perversion like 0102.03c0:ffee.
Indeed, a lot of variation...which makes parsing, a bit hellish.

Well I had written a pretty elegant parser in Perl before, that thing groks almost anything that you can throw at it.
But today I wanted to implement this in hesschlib, hesschlib is my private library of practical Bash functions. One of the rules of hesschlib is that things should be done in Bash whenever possible.
So I kludged up a small Bash function that does a pretty good job in rewriting most forms of MAC addresses that came to mind to the canonical form. Here it is:

# canonicalize MAC addresses (does grok most forms)
function maccanon {
    canon=''; for octet in ${1//[\.:-]/ }; do 
        [ ${#octet} -eq 4 ] && octet="${octet:0:2} ${octet:2:2}" ; 
        [ ${#octet} -eq 1 ] && octet="0${octet}"; canon=${canon}${canon:+ }${octet}; 
    done; echo ${canon// /-}; 
}

Which is a one-liner in hesschlib, of course, but broken up a bit here to make it more legible.
And finally, here's an example of maccanon in action:

    hessch@turing:~$ for mac in 00:02:DE:AD:BE:EF 1:2:3:c0:ff:ee 0102.03c0:ffee
    > do
    > maccanon ${mac}
    > done

    00-02-DE-AD-BE-EF
    01-02-03-c0-ff-ee
    01-02-03-c0-ff-ee

posted 2010-08-07 01:14:19, link to this article
Read full article

In a distant past I created this vendor lookoup page for MAC addresses, that according to my Google Analytics is still being used from all over the world. Wow.
Most of the information in this tool was pretty outdated, because I had imported the IEEE oui.txt file in a SQLite database by hand and was too lazy to do that again.
Well, today I found some old Perl code back that I started on to automate this process. I never managed to get that to work in the past, somehow it worked after only a few edits today.
I quickly added some SQLite Perl DBI stuff, and suddenly the database for mac2vendor is up to date again.

I have published my code to download, parse and import the IEEE OUI file here or follow the read link for the full article.

From now on this script will run as a cronjob from time to time to keep mac2vendor more up to date.

posted 2010-04-25 13:01:16, link to this article

A few years ago, I worked at a company whose webservers were hosted at a dedicated web-hosting company.
The question rose whether their website could be reached at foo.bar as well as at www.foo.bar.
Well, no problem you'd say, nothing that a simple A or CNAME record in DNS couldn't fix.
Not so, foo.bar had an A record assigned already for a host in the company's DMZ that used to do a *lot* of stuff.

You can imagine adding a webserver to foo.bar, just to serve 301 moved permanently status codes seemed like a bit of overkill to me.
And apart from that, I was too lazy to have another $many_lines_of_code to keep up to date for such a trivial task.

Thanks to the wonders of HTTP the solution was almost as simple as the problem.
I whipped up a small text file containing a static HTTP 301, and used the almighty inetd and cat to glue this to a socket.
It worked like a charm. It was also great to see sites like Netcraft list the webserver of foo.bar as cat/0.9. :-)

I thought of this today, when I was playing a bit with my Nintendo DS running DSLinux.
I could find various MP3 decoders, but nothing to do streaming. So I kludged together the other side of the hack that I explained above:

        #!/bin/sh
        (nc mp3.streampower.be 80 <<_GETREQ
        GET /stubru-low.mp3 HTTP/1.0

        _GETREQ
        ) | sed -n '/^$/,$p' |\
                madplay -

Et voila. Streaming audio. (In this case the Belgian music station Studio Brussel.)
Thank you, sir Tim.

posted 2010-04-18 16:40:26, link to this article

My local Media Markt (a large German chain of electronics stores) had some cheap NAT routers for sale. Out of curiosity I bought one.
This router (the Sitecom WL-340) runs Linux and the internal console port is nicely labeled and that alone made me buy two more as you can never have too much hardware to play with. ;)

When poking around in these boxes I found that they have a nice hidden web page to run commands on these boxes.
You can access this page as /system_command.htm on your routers webinterface.

I thought it might be useful to access this command shell from scripts, so that you can use stock WL-340s for various "unintended" purposes. ;)
With the help of the amazing Firebug extension for Firefox I managed to use the remote command facility of these routers from the shell.
Like so:

hessch@kirchhoff:~$ curl -s -o- -u admin -d command='cat /proc/cpuinfo' \
	-d next_file=system_command.htm -d todo=system_command \
	http://192.168.11.128:8080/setup.cgi | \
		sed -n '/outlog_Display/,/\/textarea/{/textarea/d;p}'
Enter host password for user 'admin':
system type		: Ralink SoC
processor		: 0
cpu model		: MIPS 24K V4.12
BogoMIPS		: 212.99
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 32
extra interrupt vector	: yes
hardware watchpoint	: yes
ASEs implemented	: mips16 dsp
VCED exceptions		: not available
VCEI exceptions		: not available

Now, this only needs a small wrapper shell script and it's ready for (ab)use.
I'll probably post some more hacks based on these boxes later on.

posted 2010-04-15 20:20:33, link to this article

My ISP, XS4All started a pilot with native IPv6 over DSL, which I eagerly joined.

I have been playing with 6to4 tunnels for a few years, but the old Cisco routers that I used lacked performance and reliability was also an issue.
Well both issues were actually solved a year ago when I terminated my Hurricane Electric IPv6 tunnel in a Apple Airport Express. But alas, the Express added a new problem: it routes IPv6 to the wireless network only!

Well, all these issues seem to be solved now. IPv6 is now present on both my wired and wireless networks and my Juniper firewall doesn't seem to break a sweat.
And as a test isquared.nl should now be reachable via IPv6 at the address http://www.isquared.nl/
If this test is successful this website will be available via IPv6 without the dubdubdub pretty soon too.

As an bonus, I've added a small "Your IP address is" row to the navigation bar on the left, to see whether your source address is IPv6 or IPv4. And you might find it useful to test your anonymizing proxy, etc... ;-)

posted 2009-04-18 09:18:18, link to this article

Some years ago, before I was lazy enough to just grab a module from CPAN, I wrote this handy Perl function to convert a dotted quad IP address to an integer.

sub dotquadToInt($) {
        my ($e, $m, $r) = (24,,);
        my @octet = split(/\./, $_[0]);
        foreach $m (@octet) {
               $r += $m*2**$e;
               $e -= 8;
        };
        return $r;
}

I think the above is pretty, because it is easy to adapt to different bases etc. But it is also needlessly complex, a more elegant way to achieve the same is something like this:

sub dotquadToInt($) {
        my @octet = split(/\./, $_[0]);
        return $octet[0]*2**24 + $octet[1]*2**16 + $octet[2]*2**8 + $octet[3];
}

Maybe these functions are of use to someone, though I would recommend everybody to use the excellent Net::IP Perl module instead!

posted 2009-04-18 08:38:53, link to this article

Dreft is a quick and dirty tool that I wrote some time ago to do a bunch of reverse DNS lookups for a CIDR block.

Its a pretty simple script, the most interesting part is the ugly workaround to create an in-addr.arpa address from a Net::IP object, somehow I couldn't convince Net::IP to do this for me when iterating addresses.

Usage is pretty straightforward too:

hessch@blokje:~$ dreft 4.2.2.0/29    
4.2.2.1 -> vnsc-pri.sys.gtei.net.
4.2.2.2 -> vnsc-bak.sys.gtei.net.
4.2.2.3 -> vnsc-lc.sys.gtei.net.
4.2.2.4 -> vnsc-pri-dsl.genuity.net.
4.2.2.5 -> vnsc-bak-dsl.genuity.net.
4.2.2.6 -> vnsc-lc-dsl.genuity.net.

Below you'll find the complete script, or as a handy downloadable link here.

#!/usr/bin/perl -w

# dreft - reverse dns enumerator
# Hessel Schut, hessel@isquared.nl, 2008-06-24

use strict;

use Net::DNS;
use Net::IP;

my $ip = new Net::IP ($ARGV[0])  or die (Net::IP::Error());
my $res = Net::DNS::Resolver->new;

do {
        # $ip->reverse_ip doesn't work when iterating IP addresses
        # horrible kludge to in-addr.arpafy the current IP:
        my $ptr = join('.', reverse(split /\./, $ip->ip()));
        $ptr .= ".in-addr.arpa";

        my $rr = $res->query($ptr, qw(PTR));

        if ($rr) {
                print $ip->ip()." -> ".(($rr->answer)[0]->rdatastr)."\n";
        };
} while (++$ip);

posted 2009-04-13 09:28:03, link to this article

Ever noticed how the Unix sort command can't make anything of IP addresses when you use just a numeric sort, like this:

hessch@galileo:~$ sort -n ip.txt
1.2.3.4
5.6.7.8
10.200.219.5
10.20.30.40
10.3.5.6
89.2.177.21
193.18.4.1

As you notice, for instance 10.20.30.40 is listed below 10.200.219.5, which is wrong, of course. The trick is to define every octect in the dotted quad notation as a key for sort like this:

hessch@galileo:~$ sort -t. -n -k1,1 -k2,2 -k3,3 -k4,4 ip.txt
1.2.3.4
5.6.7.8
10.3.5.6
10.20.30.40
10.200.219.5
89.2.177.21
193.18.4.1

There you have it, using sort -t. -n -k1,1 -k2,2 -k3,3 -k4,4 all addresses are sorted properly.

posted 2008-11-23 01:59:42, link to this article
Read full article

I have made an online version of my MAC address vendor lookup script. Of course there are many of these already, but well, choice is good, right? You can query my vendor lookup tool here: http://isquared.nl/doapp.html?appid=mac2vendor

posted 2008-11-01 22:19:12, link to this article
Read full article

There are a couple of webpages where you can lookup the manufacturer of a piece of network equipment based on the OUI part of its MAC-address. That's neat, but not really if the device that you're trying to identify is, for instance, the rogue DHCP-server that knocked you off the Internet. And apart from that, I rather do as much as I can from within the shell instead of mousing to some website. That is why I've written a small shell-script that does the work for you.