How ‘netmask ordering’ feature in Windows AD DNS affects the resultant queries

The netmask ordering feature is used to return addresses for type A DNS queries to prioritize local resources to the client. For example, if the following conditions are true, the results of a query for a name are returned to the client based on Internet protocol (IP) address proximity:

• You have eight type A records for the same DNS name.
• Each of your eight type A records has a separate address.

In the initial release of Microsoft Windows 2000 Server, this proximity is calculated based on the native class of address that is assigned to the client. If the client is assigned a native class A address, the responses that are sent to the client are prioritized by entries that match the client class A network membership. This is also true of native class B and native class C addresses. 

The round robin feature is used to randomize the results of a similar type of query to provide basic load-balancing functionality. In the earlier example, eight type A records with the same name and different IP addresses cause a different answer to be prioritized to the top with each query. Because a new IP address is prioritized to the top with each query, clients are not repeatedly routed to the same server.

This can be helpful if your subnets are perfectly configured in a multi site environment, but unfortunately it is not like that most of the times. It could make that a user located in London is using a domain controller in Hong Kong to authenticate or to resolve names. DNS resolution definitely affects your AD implementation! I've seen  enterprises where users are affected by this Windows 'feature', when they are connected to their corporate network or by VPN.

A "fix" is explained in the following article, very well explained, however, it is not applicable to all the cases, especially when diverse subnets exist in the same location, and that don't match with the subnet assigned to the DNS servers / Domain Controllers. It will work, again, if you design (or reorganize) your company's subnets. A workaround is to create additional A records and Cnames to allow DNS resolution of your clients to closest DNS / AD nodes... Every case is be different, but it can be done!

All clients are in the Chicago site. If the user did a DNS look up from Client01 (172.10.1.100) on the domain name Contoso.com the following DCs were returned in order

DC01-172.10.1.1

DC02-172.10.1.2

DC04-172.30.20.1

DC03-172.20.10.1

DC05-192.168.5.1

If they would run the same query a second time from the same machine the list would tend to look like this.

DC02-172.10.1.2

DC01-172.10.1.1

DC04-172.30.20.1

DC03-172.20.10.1

DC05-192.168.5.1

If they would run it a third time, it would be identical to the first time. The 4^th time would be identical to the 2^nd time. The DCs in their AD site would always be returned as number 1 and 2 in the list. This is what the desired and expected behavior was. However, if Client02 (172.10.8.1) or Client03 (172.10.9.1) did a DNS look up the list would frequently look like those above, but sometimes it would look something like this

DC03-172.20.10.1

DC04-172.30.20.1

DC05-192.168.5.1

DC01-172.10.1.1

DC02-172.10.1.2

The customer first suspected it to be a DHCP vs Static IP issue as that appeared on the surface to be the only real difference between them. The clients were getting different records returned in a round robin fashion but ONLY in their site when using a static address but when it was DHCP it would round robin through all the different records. The devil they say is in the details.

There is a setting on the DNS server on the advanced tab called Netmask Ordering. The purpose of netmask ordering is to try and prioritize local resources for clients. For example if an A record exists in 2 places, 1 on the same subnet as the client and 1 on a different subnet, return the A record on the same subnet client. It assumes since the subnets match, the resource must be closer to the client so return that address.

So what is the problem here? Netmask ordering was enabled on both DC01 and DC02. Why are the DHCP clients behaving differently? Turns out Netmask ordering by DEFAULT matches to Class C addresses (255.255.255.0) I’ve highlighted in red to show the Class C octet for the environment.

DCs

DC01- 172.10.1.1

DC02- 172.10.1.2

DC03-172.20.10.1

DC04-172.30.20.1

DC05-192.168.5.1

Clients

Client01-172.10.1.100

Client02- 172.10.8.1

Client03-172.10.9.1

Since Cilent01 Class C octet matched DC01 and DC02 Class C octet those were always being returned in a round robin fashion. However Client02 and Client03 did not match any Class C octet for any DC so all results were returned in a round robin fashion since none were considered to be close for that client.

For this environment we wanted to actually match on the Class B octet, 172.10.x.x. In order to do this we ran the following DNS command, Dnscmd /Config /LocalNetPriorityNetMask 0x0000FFFF.

DCs

DC01- 172.10.1.1

DC02- 172.10.1.2

DC03-172.20.10.1

DC04-172.30.20.1

DC05-192.168.5.1

Clients

Client01-172.10.1.100

Client02- 172.10.8.1

Client03-172.10.9.1

Now all DHCP clients in the Chicago site behaved like the statically defined client since the Class B octet (255.255.0.0) matched the octet for the DCs. DC01 and DC02 are being returned in a round robin fashion as expected.

For more info around this read http://support.microsoft.com/kb/842197

Ref: http://blogs.technet.com/b/askpfeplat/archive/2013/02/18/how-netmask-ordering-feature-in-dns-affects-the-resultant-queries.aspx

Password Recovery Procedure for the MDS 9000 Series Multilayer Directors and Fabric Switches

Introduction

This document describes the procedure to recover a lost administrator password from the console port of a Cisco MDS 9000 Series Switch.

Prerequisites

Requirements

You must perform the password recovery procedure on the Supervisor Engine module that will become the active Supervisor Engine module after completion of the recovery procedure. In order to ensure that the other Supervisor Engine module does not become the active module, perform one of these two options:

• Physically remove the other Supervisor Engine module from the chassis.
• Change the console prompt of the other Supervisor Engine module to one of these two prompts until you complete the procedure:
  
  • loader>
  • switch (boot)#
  Note: Refer to the Cisco MDS 9000 Family of Multilayer Directors and Fabric Switches configuration guide for more information about these prompts.

Conventions

Refer to Cisco Technical Tips Conventions for more information on document conventions.

Step-by-Step Procedure

Perform these steps in order to recover a lost administrator password from the console port of a MDS 9000 switch:

1. Perform these steps in order to establish a console session to the MDS 9000 switch:
   
   1. Connect one of the supplied RJ-45-to-DB-9 adapters to the PC serial (COM) port.
   2. Connect the other end of the supplied RJ-45-to-DB-9 adapter to the RS-232 management port on the MDS 9000 switch.
      Note: The RS-232 management port is labeled CONSOLE.
      
      
   3. Launch HyperTerminal on the PC.
      Terminal emulation software enables communication between the storage router and your PC during setup and configuration. The terminal emulation software is frequently a PC application such as HyperTerminal or ProComm Plus.
   4. Choose these settings:
      
      • Bits per second: 9600
      • Data bits: 8
      • Parity: None
      • Stop bits: 1
      • Flow control: None
      Note: You can set the Bits per second field to 38400 if this configuration connects to an MDS 9500.
      
2. Reboot the switch in one of these ways:
   
   • Issue the reload command if there is a Telnet session with administrator rights.
     

     switch#reload
     
     The supervisor is going down for reboot NOW!

   • If the command is not available, power reset the switch.
3. When the switch begins its SAN-OS software boot sequence, hold the Ctrl key and press the ] key to generate the Ctrl-] key sequence.
   This key sequence brings up the switch(boot)# prompt.
   

   Ctrl-]
   
   switch(boot)#

   Note: If you use different terminal emulation software, the break key sequence can differ. Refer to Standard Break Key Sequence Combinations During Password Recovery for commonly used break key sequences.
   Note the bin image file name that is displayed on the screen after the "Booting kickstart image" message while the device is booting.
4. Change to configuration mode.
   

   switchboot#configure terminal
   

5. Issue the admin-password command in order to reset the administrator password.
   In this example, the password is set to “password”.
   

   switch(boot-config)#admin-password password
   

6. Exit to the EXEC mode.
   

   switch(boot-config)#exit
   
   switchboot#

7. Issue the load command in order to load the SAN-OS software image. This is the image name that was noted as part of step 3.
   In this example, san-ios.img is the name of the software. Most likely, the format looks like m9500-sf1ek9-mz-2.1.2b.bin.
   

   switch(boot)#load bootflash:san-ios.img
   

8. Save the software configuration.
   

   switch#copy running-config startup-config
   

   Note: The next time that you try to connect to the console port of the MDS 9000 switch, you must enter either the new administrator password or the monitor password that you created.
9. Insert the Supervisor Engine that you previously removed, log in, and verify the changed password.

Install Cisco MDS9124 / MDS9148 additional FC port licenses

Install Cisco MDS9124  / MDS9148 additional FC port licenses

Login to Cisco License portal at www.cisco.com/go/license

****

Use the PAK (Product Authorization Key) number that came with the printed card beside the switch or SFPs.

To obtain the license, you will be required to provide the switch serial number along with the PAK. Use the following procedure to obtain the switch serial number:

Login to the switch command console

Issue the “show license host” command. The serial number is the character string after the “=” sign.

For example:

CISCOSWITCH# show license host
License hostid: VDH=FOX12345ABC

Here, the switch serial number is “FOX12345ABC”

Follow the wizard in Cisco’s web site to obtain the license. It will arrive to your email mailbox, or it can be downloaded directly from this portal.

Login to Cisco device manager app as admin

Go to the menu Admin, Flash Files

****

Click Copy …

****

Select:

Direction: Server - > Switch
Protocol: tftp
Server Address: Type in the IP address of the tftp server where the “.lic” file is
Server file: locate the file in the tftp server, but remove all the path, except for the filename. This is because it needs to be relative to the tftp server root
Switch File: use “bootflash:/FILENAME.lic”, being FILENAME.lic the same name as the original file.

Most of the parameters here will be auto-populated, but need to be verified.

****

Click Apply.

Then Close and refresh the previous window. The file should be listed in the bootflash:

****

Click Close

At this point, there are two ways to install the license in the switch:

Option 1, using the command line

Login to the switch using a ssh session and type the command to activate the license as follows:

CISCO-MDS9124 login: admin

Password:

Cisco Storage Area Networking Operating System (SAN-OS) Software

TAC support: http://www.cisco.com/tac

Copyright (c) 2002-2007, Cisco Systems, Inc. All rights reserved.

The copyrights to certain works contained herein are owned by

other third parties and are used and distributed under license.

Some parts of this software may be covered under the GNU Public

License or the GNU Lesser General Public License. A copy of

each such license is available at

http://www.gnu.org/licenses/gpl.html and

http://www.gnu.org/licenses/lgpl.html

CISCO-MDS9124# install license bootflash:FILENAME.lic

Installing license .......done

CISCO-MDS9124# exit

Option 2, using the device manager:

Go to the Cisco device manager and goto admin, Licenses

****

Click the Install tab and click the arrow at the end of the “URI” box. It will show a drop down list of the license files present in the switch. Select the one that was recently transferred to the switch.

Both boxes, URI and Target Filename will be automatically populated

Click Install

****

After a few seconds the Status should say “success”

****

Verify that the licenses were installed properly:

Go to the Cisco device manager and goto admin, Licenses

****

The additional licenses should show up in the Features tab, Installed Count column

****

And on the main window, also the ports should be activated.

Setting up slewing NTP option in Linux for Oracle Database

Many times while installing/configuring Oracle Cluster, DBA’s  receive the following error message.

Checking NTP daemon command line for slewing option “-x”Check: NTP daemon command line

Node Name                     Slewing Option Set?  ————————————  ————————

vcsnode1                         no

vcsnode2                         no

Result:NTP daemon slewing option check failed on some nodes PRVF-5436 : The NTP daemon running on one or more nodes lacks the slewing option “-x”Result: Clock synchronization check using Network Time Protocol(NTP) failed

To fix this error, slewing needs to be configured.

Follow the below steps to configure slewing in Linux.

• Stop ntpd daemon using the following command.

[root@vcsnode1 ~]# service ntpd stop

Shutting down ntpd:                                        [  OK  ]

[root@vcsnode1 ~]#

• Edit /etc/sysconfig/ntpd file.  Usually the file looks as given below.

[root@vcsnode1 sysconfig]# cat ntpd
# Drop root to id ‘ntp:ntp’ by default.
OPTIONS=”-u ntp:ntp -p /var/run/ntpd.pid”

# Set to ‘yes’ to sync hw clock after successful ntpdate
SYNC_HWCLOCK=no
[root@vcsnode1 sysconfig]#

• Edit the file and add “-x” to  ”OPTIONS=”-u ntp:ntp -p /var/run/ntpd.pid”" line befor e”-u”
• After editing the file, the contents should look like given below

[root@vcsnode1 sysconfig]# cat ntpd
# Drop root to id ‘ntp:ntp’ by default.
OPTIONS=”-x -u ntp:ntp -p /var/run/ntpd.pid”

# Set to ‘yes’ to sync hw clock after successful ntpdate
SYNC_HWCLOCK=no
[root@vcsnode1 sysconfig]#

• Start ntpd daemon using the following command

[root@VCSNode2 ~]# service ntpd start

Starting ntpd:                                             [  OK  ]

[root@VCSNode2 ~]#

• Ask the DBA to install/proceed to configure Oracle Cluster

How to configure Raw Disks in RHEL 5 for Oracle11g udev

The following is to change the owner, group and permissions for raw devices used for Oracle RAC.

Create a file called /etc/udev/rules.d/65-raw-permissions.rules with these contents:

#Set permissions of raw bindings to Oracle Clusterware devices

KERNEL=="raw1", OWNER="root", GROUP="oinstall", MODE="640"

KERNEL=="raw2", OWNER="root", GROUP="oinstall", MODE="640"

KERNEL=="raw3", OWNER="oracle", GROUP="oinstall", MODE="640"

KERNEL=="raw4", OWNER="oracle", GROUP="oinstall", MODE="640"

KERNEL=="raw5", OWNER="oracle", GROUP="oinstall", MODE="640"

Test executing:

udevtest /class/raw/raw1

It should show something like:

udevtest /class/raw/raw1

main: looking at device '/class/raw/raw1' from subsystem 'raw'

udev_rules_get_name: rule applied, 'raw1' becomes 'raw/raw1'

udev_device_event: device '/class/raw/raw1' already in database, validate currently present symlinks

udev_node_add: creating device node '/dev/raw/raw1', major = '162', minor = '1', mode = '0640', uid = '0', gid = '600'

main: run: 'socket:/org/kernel/udev/monitor'

main: run: '/lib/udev/udev_run_devd'

main: run: 'socket:/org/freedesktop/hal/udev_event'

main: run: '/sbin/pam_console_apply /dev/raw/raw1 '

To apply the rules run:

# start_udev

Starting udev:                           [  OK  ]

References:

http://www.oracleflash.com/7/How-to-configure-Raw-Disks-in-RHEL-5.html

http://www.ardentperf.com/2008/02/13/oracle-clusterware-on-rhel5oel5-with-udev-and-multipath/

Procedure to upgrade Linux 6.1 to 6.4 without CD from a local repository

We are doing an upgrade of RHEL 6.1 to 6.4. It is applicable to other versions and distributions like CentOS.

1) Create a local repository to have all the packages of the new version available.

Create a file called /etc/yum.repos.d/server64.repo with the following contents:

[server64x64]

name=Red Hat Enterprise Linux 6.4 x64

baseurl=ftp://ftprepo.domain.local/RHEL/rhel64x64/Server

enabled=1

gpgcheck=1

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

2) Verify what is the current running version and kernel.

# uname -a

Linux SERVER1.domain.local 2.6.32-131.0.15.el6.x86_64 #1 SMP Tue May 10 15:42:40 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux

# cat /etc/redhat-release

Red Hat Enterprise Linux Server release 6.1 (Santiago)

3) List the available packages and specially the kernel version. Limit yum to use the new repository only.

yum --disablerepo="*" --enablerepo="server64x64" list available

yum --disablerepo="*" --enablerepo="server64x64" list kernel

4) Run the update command and wait it for completion.

For interactive mode, when questions have to be answered to proceed with the update, use:

yum --disablerepo="*" --enablerepo="server64x64" update

For automated mode, assuming all questions will be answered as “yes”, use:

yum –y --disablerepo="*" --enablerepo="server64x64" update

Example of what will be presented on the screen:

Transaction Summary

================================================================================

Install      21 Package(s)

Upgrade     278 Package(s)

Total download size: 224 M

Is this ok [y/N]:

Replaced:

  abrt-plugin-logger.x86_64 0:1.1.16-3.el6

  abrt-plugin-mailx.x86_64 0:1.1.16-3.el6

  abrt-plugin-rhtsupport.x86_64 0:1.1.16-3.el6

  abrt-plugin-sosreport.x86_64 0:1.1.16-3.el6

  libjpeg.x86_64 0:6b-46.el6

Complete!

5) Verify the new version of the OS

# uname -a

Linux SERVER1.domain.local 2.6.32-131.0.15.el6.x86_64 #1 SMP Tue May 10 15:42:40 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux

#cat /etc/redhat-release

Red Hat Enterprise Linux Server release 6.4 (Santiago)

6) Reboot to finish the process and to allow the new kernel and configuration be activated.

PS: RHEL 6.4 ships samba version 3.6. It has different configuration parameters in /etc/samba/smb.conf file when doing authentication thru AD.

Below are the required changes:

Before:

;    idmap uid = 10000-20000

;    idmap gid = 10000-20000

;    idmap backend = rid:DOMAIN=10000-20000

After:

    idmap config * : backend = tdb

    idmap config * : range = 20001-30000

    idmap config DOMAIN : backend = rid

    idmap config DOMAIN : range = 10000-20000

    idmap config DOMAIN : base_rid = 0

(Replace DOMAIN with the short name of your domain name)

7) End

VMware Vsphere: Fix hidden NIC devices after P2V conversion of Windows servers

VMware Vsphere: Fix hidden NIC devices after P2V conversion of Windows servers

After a physical conversion a number of “stale devices” will exist in the new virtual machine. These are hardware devices which are no longer required.

Windows 2000 & 2003

To identify which devices are no longer physically installed on your virtual machine, use the Microsoft environment variable devmgr_show_nonpresent_devices. This is explained in the Microsoft article:

http://support.microsoft.com/kb/315539

1. From the command prompt, type:

set devmgr_show_nonpresent_devices = 1

2. Start the search. Type:

start devmgmt.msc

3. From the Device Manager, list the devices.

Select: View > Show hidden devices.

4. Deinstall the listed devices:

Select the device and uninstall it from the Device Manager.

Reboot.

How to configure the right amount of swap space in Linux

http://www.cyberciti.biz/tips/linux-swap-space.html

Linux and other Unix-like operating systems use the term "swap" to describe both the act of moving memory pages between RAM and disk, and the region of a disk the pages are stored on. It is common to use a whole partition of a hard disk for swapping. However, with the 2.6 Linux kernel, swap files are just as fast as swap partitions. Now, many admins (both Windows and Linux/UNIX) follow an old rule of thumb that your swap partition should be twice the size of your main system RAM. Let us say I've 32GB RAM, should I set swap space to 64 GB? Is 64 GB of swap space really required? How big should your Linux / UNIX swap space be?


Old dumb memory managers


I think the '2x swap space' rule came from Old Solaris and Windows admins. Also, earlier memory mangers were very badly designed. There were not very smart. Today, we have very smart and intelligent memory manager for both Linux and UNIX.


Nonsense rule: Twice the size of your main system RAM for Servers

According to OpenBSD FAQ:


Many people follow an old rule of thumb that your swap partition should be twice the size of your main system RAM. This rule is nonsense. On a modern system, that's a LOT of swap, most people prefer that their systems never swap. You don't want your system to ever run out of RAM+swap, but you usually would rather have enough RAM in the system so it doesn't need to swap.


Select right size for your setup

Here is my rule for normal server (Web / Mail etc):

Swap space == Equal RAM size (if RAM < 2GB)

Swap space == 2GB size (if RAM > 2GB)

Many Oracle experts recommend something as follows for heavy duty Oracle server with fast storage such as RAID 10:


Swap space == Equal RAM size (if RAM < 8GB)

Swap space == 0.50 times the size of RAM (if RAM > 8GB)

However, newer servers can have 


Red Hat Recommendation

Red hat recommends setting as follows for RHEL 5:



The reality is the amount of swap space a system needs is not really a function of the amount of RAM it has but rather the memory workload that is running on that system. A Red Hat Enterprise Linux 5 system will run just fine with no swap space at all as long as the sum of anonymous memory and system V shared memory is less than about 3/4 the amount of RAM. In this case the system will simply lock the anonymous and system V shared memory into RAM and use the remaining RAM for caching file system data so when memory is exhausted the kernel only reclaims pagecache memory.



Considering that 1) At installation time when configuring the swap space there is no easy way to predetermine the memory a workload will require, and 2) The more RAM a system has the less swap space it typically needs, a better swap space



Systems with 4GB of ram or less require a minimum of 2GB of swap space

Systems with 4GB to 16GB of ram require a minimum of 4GB of swap space

Systems with 16GB to 64GB of ram require a minimum of 8GB of swap space

Systems with 64GB to 256GB of ram require a minimum of 16GB of swap space

Swap will just keep running servers...

Swap space will just keep operation running for a while on heavy duty servers by swapping process. You can always find out swap space utilization using any one of the following command:

cat /proc/swaps

swapon -s

free -m

top



See how to find out disk I/O and related information under Linux. In the end, you need to add more RAM, adjust software (like controlling Apache workers or using lighttpd web server to save RAM) or use some sort of load balancing.



Also, refer Linux kernel documentation for /proc/sys/vm/swappiness. With this you can fine tune swap space.



A note about Desktop and Laptop

If you are going to suspend to disk, then you need swap space more than actual RAM. For example, my laptop has 1GB RAM and swap is setup to 2GB. This only applies to Laptop or desktop but not to servers.



Kernel hackers need more swap space

If you are a kernel hacker (debugging and fixing kernel issues) and generating core dumps, you need twice the RAM swap space.



Conclusion

If Linux kernel is going to use more than 2GB swap space at a time, all users will feel the heat. Either, you get more RAM (recommend) and move to faster storage to improve disk I/O. There are no rules, each setup and configuration is unique. Adjust values as per your requirements. Select amount of swap that is right for you.

Setting up tftp server on Redhat Linux and allow write access to tftpboot

A TFTP Server is often used by Cisco devices to manage their file transfers. Here is a quick guide on how to setup a TFTP server on Centos/Redhat.

First obtain the RPM. In Centos, use yum to search and install tftp-server.

yum search tftp

yum install tftp-server

After it's installed, the RPM creates a new folder named 'tftpboot' in the root partition. You must change the access rights for it be read and write accessible.

chmod 777 /tftpboot

The tftp-server is controlled by xinetd which is a Linux daemon that handles certain lightweight network applications. Edit the file name 'tftp' located in /etc/xinetd.d/ . The TFTP service is defaulted to off so change the disable option to 'no'

# default: off

# description: The tftp server serves files using the trivial file transfer \

#       protocol.  The tftp protocol is often used to boot diskless \

#       workstations, download configuration files to network-aware printers, \

#       and to start the installation process for some operating systems.

service tftp

{

        socket_type             = dgram

        protocol                = udp

        wait                    = yes

        user                    = root

        server                  = /usr/sbin/in.tftpd

        server_args             = -s -c /tftpboot

        disable                 = no

        per_source              = 11

        cps                     = 100 2

        flags                   = IPv4

}

Make sure the "disable = yes" option is set to "no" to enable the service.

TFTP server also comes default read only. In order to enable write access the -c argument needs to be added to the server_args.

server_args = -s -c /tftpboot

Ensure you restart the xinetd service when making changes to this file.

service xinetd restart

You may verify the server is started by verifying that it's listening on UDP port 69.

netstat -nap |grep :69

The output should look like this:

udp        0      0 0.0.0.0:69                  0.0.0.0:*                               19141/xinetd

If you have a firewall, make sure that UDP port 69 is opened.

----

End of posting.

For more, visit http://tipstricksandmore.blogspot.com

Reliable and unexpensive web hosting and domain names at http://www.netlinecorp.com

How to kill the process running on specific port in Linux

I would like to stop the process which is running on port 8080 in a Linux server, but I don't know the process that owns it.






'lsof -w -n -i tcp:8080'


or


'fuser -n tcp 8080'


or


'netstat -anp | grep :8080[[:blank:]]'






should show you the process ID.






If there is no (init) script to use to shut down the offending service (since TCP/8080 means proxy) to kill you can by PID 'kill -9 pidnumber'.