How to vote in the UK General Election 2017

I’ll cover three issues that are apparent to me in considering who to vote for in General Elections.

  • Voting for a person (leader).
  • Voting for a party (policy).
  • Voting for who you always vote for.

Voting for a person (leader)

If you’re voting for a person, the decision process is very short. You’re taking the easy route. And that’s okay. You’re entitled to whatever choice you like.
You’re making your decision based on their looks. Don’t kid yourself that it’s about their interviewing skills, their ability to hold court on the world stage or some other sentence that was placed into your head. The Internet knows you better than that.

This has one critical flaw. The media. The media is who placed that “knowledgeable sounding insight” into your head about why you’re voting for “that person”.

Unless you’re Jeremy Paxman, you’re not going to get face time with all the leaders of all the parties and have a conversation to form a balanced opinion on your voting choice.
Airtime, photographs chosen, quotes chosen, statistics and anecdotal interviews of the public about their thoughts about a person are all chosen for a reason.
Do not be fooled into thinking the editors of the media choose a story or a piece because it’s “nice”. The media delivered into your home or you palm that’s chosen from the vast swathes of interviews and stories that are generated by the journalists on the ground each day and each hour are very deliberate choices. I’m not saying that they are all malicious choices, or that they are all benign, but just know that each choice is deliberate.

There’s a reason some Billionaires own newspapers. There’s a reason some Billionaires are called “Media Moguls“.
Misdirection, and/or misinformation, is a strategy.

An entirely neutral, independent and unbiased media source is an ideal, not a reality. I’d suggest there’s some outlets that are closer than others, but that’s for you to decide.

I recently had the privilege of reading a real copy of The Mirror from 1912 that reported the sinking of the Titanic. Here’s a summary image. Suffice to say that we know now the report in The Mirror was the complete opposite of the truth. In today’s rhetoric it may be called fake news, or in my language. A Lie.
That’s right. Over a hundred years ago, two years before the first world war, propaganda like eating carrots to see in the night, fake news already existed.

In the context of the worlds tiniest orange comedian, the right leaning Breitbart was launched as a direct competitor to the left leaning HuffingtonPost. Reading the difference between the two outlets version of events of the worlds tiniest orange comedian muscling past the Montenegro Prime Minister was fun. Despite there being a video of the event which you can make your own mind up about who/what/why, both outlets used different accompanying language to colour the outcome in your mind. One favoured and/or sympathised with worlds tiniest orange comedian, the other did not. If a picture speaks a thousand words, a video pretty much says it as it is.

My suggestion to you if you’re using the “voting for a person” method is to save yourself the time and angst of being subjected to the endless (mis)information you’re trying to avoid. Get the mug shot of all the leaders of all the parties and simply pick the one you think looks the nicest/most competent/hot, whatever works for you and stick to it. You’re choosing the leader because you want the easy route, remember. Heck, I’ll even save you the Google time. Leaders Mugshots

I put this voting strategy at the start of this article because if you’re that person, I’ll save you the time so you don’t need to read on!

Voting for a party (policy)

If you’re voting for a party, the decision process is long. You’re taking the hard route. Again, that’s okay. You’re still entitled to whatever choice you like.

The problem is the volume of information and comparable outcomes. This is not an apples for apples decision. So you have to do your best and not beat yourself up about it.

http://whoshouldyouvotefor.com/ presents a succinct journey through the high level common policies or issues that are present in the 2017 UK election and presents you with your voting choice. This could be enough for you, or…

A slightly more heavyweight version of this is https://voteforpolicies.org.uk
Harder to differentiate with multiple policy details to consider at each step, but before going for the full manifesto read, this is more thorough that the previous link, but not as thorough as a full read.

Strategies in politics are 5 years long. That’s the most you can plan for until you go through the election process all over again. Even then, given the ramp up and ramp down from election campaigns and the transfer of power between parties, or even between cabinet reshuffles, I would suggest a party has a maximum of 4 effective years in office.

We’re currently enjoying a Conservative government. Some people think it’s simply about removing them from office. This website is engineered to deliver you the information required to best disrupt Conservative government, it has nothing to do with what you want in life, other than you don’t want Tory rule.

Others think you should vote for who you align to, best. How do you choose that? You read each of the main parties manifestos of course. This is the long journey after all.

I’ve collected them conveniently here for your pleasure.

Conservative
Green Party
Labour
Liberal Democrat
SNP
UKIP

This is the end of the line for the critical voter.

Any television debates, radio interviews, newspaper articles about the former and the like, are then influenced by the media and seem more to do with a memory game “Oh, so and so couldn’t remember the numbers on air for the policy they’re championing”.
Well you know what, I can’t remember everything all the time, either.
The manifesto has all the details in, why concentrate on asking politicians to remember it off the top of their heads and perhaps ask about the philosophy behind the decisions that have already been made. That might actually be interesting.

Voting for who you’ve always voted for.

This is disappointing behaviour. It’s not even as critical as voting for a person.
It’s opting out after performing one critical process.
If you always do what you always did, you’ll always get what you always got.
Things change, you’re choosing not to.

It’s fair to say there are traits, or whats known as a political spectrum. So people will say “I’m Tory” or “I’m Lib Dem” or “I’m Green”. What they really mean is that they exist on a part of the political spectrum and they continue to vote for that same party that they aligned with back when they were once critical about who they were aligned to and either went through the voting for a person and/or vote for a party process. They’ve then released themselves from the trouble of being critical at each election and committed to being aligned to a party.
It’s a little bit like deciding to be a fan of a football club.
Being a supporter of a football club is very tribal thing. You can come under immense social scrutiny and pressure for your decisions. Changing your mind on the club you support is frowned upon and not done often by many people at all. Talk to an Arsenal fan about changing allegiances to become a Chelsea fan and see what happens. I would suggest the same pressures apply here to party aligned voters.

Manifestos are different every election. Which is why voting for who you’ve always voted for is like delegating the decision process out or saying “I did it once, I’m not doing it again”.

Manifestos exist for a reason. They are the 5 (4) year strategies as discussed earlier and you can’t, as a helpless voter, do any better than to hope and believe that the party will deliver the larger portion of the manifesto should they reach government. Using the 80/20 rule you’d like to think as a voter and I’d imagine as a party member too, it would be nice to get 80% of the manifesto done in your 5 (4) years in power. The other 20% was your stretch target. Sadly the voter doesn’t get to choose which of the manifesto targets get done and which don’t.

I hope that rather than voting for who you always voted for, you at least choose the hottest party leader. At least you’re being critical of something.

Advertisements

Capturing iPhone traffic

This walk through will enable you to capture all traffic that ingresses or egresses the device. It will not differentiate between WLAN or Cellular traffic. If you’re on WiFi, no IP traffic should traverse the Cellular network. If you turn Wifi off, you’ll see your data flow over Cellular.

You’ll need :

  • A Mac with a 30pin/Lightning cable
  • An iPhone

Versions tested :

  • Mac OS X 10.11.6
  • iOS 9.3.3

Procedure:-

Install Xcode on Mac OS X – beware, 4GB download.

Install Wireshark on Mac OS X – no need to beware. Not a 4GB download.

Xcode will make the rvictl tool available to you and despite other tutorials using tcpdump, you can actually capture straight into Wireshark from the remote virtual interface that we’ll create.

Attach an iPhone to the Mac with the cable and allow the Mac to be trusted by the iPhone so it appears in iTunes.

Viewing the iPhone summary page in iTunes, the section which includes the Capacity and Phone Number also has the Serial Number. If you click on the words Serial Number, the display rotates through UDID, ECID and Product Type. We want the UDID

Hold Ctrl and click the UDID string which is a stupid long alphanumeric. Choose copy.

Open a terminal window.

In the terminal window, enter rvictl –s with whitespace after the “-s” and hold Ctrl and click the terminal window to then choose “Paste”

The resulting command should look like:

Macbook$ rvictl –s 23cf3b0ce86e059dd87e53b507858abc99c

When finished with the procedure after using either tcpdump or Wireshark, use the -x form.

rvictl

You can then either use tcpdump if you want to simply save the data to a file for review later, or if you’d like the feeling of ‘watching the traffic’ too, fire up Wireshark and capture from the rvi0 interface. Treat Wireshark like you would in any other packet capture situation.

tcpdump syntax to capture to a file called iphone_capture.pcapng would look like this:

tcpdump -n -i rvi0 -w iphone_capture.pcapng

Use Ctrl+C to stop the capture in tcpdump.

When you’re done, simply stop the remote virtual interface as described earlier and disconnect your phone.

Happy capturing!

 

Cisco WLAN Device Disconnects

Problem statement

The issue I’m facing in an 802.1x Cisco Controller based Wireless Network is that 802.1x Wireless Clients are either A. whilst completely static, and sitting at desks, devices are disconnecting and I’m seeing a connectivity drop with DHCP renewal (according to Cisco AnyConnect supplicants) or B. roaming devices are hanging on to AP’s which are nowhere near the closest AP to the client when moving about the building.

Cisco Wireless LAN Controller

In Cisco WLC Release 8.0, Cisco included Optimized Roaming into their Controller code.

Cisco states the following on Optimized Roaming:-

Information About Optimized Roaming

“Optimized roaming resolves the problem of sticky clients that remain associated to access points that are far away and outbound clients that attempt to connect to a Wi-Fi network without having a stable connection. This feature disassociates clients based on the RSSI of the client data packets and data rate. The client is disassociated if the RSSI alarm condition is met and the current data rate of the client is lower than the optimized roaming data rate threshold. You can disable the data rate option so that only RSSI is used for disassociating clients.

Optimized roaming also prevents client association when the client’s RSSI is low. This feature checks the RSSI of the incoming client against the RSSI threshold. This check prevents the clients from connecting to a Wi-Fi network unless the client has a viable connection. In many scenarios, even though clients can hear beacons and connect to a Wi-Fi network, the signal might not be strong enough to support a stable connection.

You can also configure the client coverage reporting interval for a radio by using optimized roaming. The client coverage statistics include data packet RSSIs, Coverage Hole Detection and Mitigation (CHDM) pre-alarm failures, retransmission requests, and current data rates.”

I’m also very interested in getting log events into my SIEM platform to be able to see when disconnect events are happening. I’m currently trying to get clarity from the advanced logging options in the WLC as I’d like quite just those specific events to come through. I’ll update this section when I’m there.

Now, my final configuration will probably not fit your environment, in that we’re dealing with physics here (radio). My environment has it’s own unique physical characteristics. But I hope to share the journey I took to get to the correct balance for my organisation.

To gain an understanding of my particular environment, here’s some detail.

Building

The building in question is 72m x 29m in size. The build is mostly wood, glass and concrete and 70% open plan with two floors and a large atrium space.
The two floors are not discrete in that there’s clear air in two directions from any upper floor seat to the lower floor and vice versa.

Radios

Within the building, there’s 22 internal 3500 series APs which are the focus of our discussion and 8 external 2600 series APs which contribute to the RF characteristics but aren’t a major player for this discussion.
The radio spectrum in question is a 20Mhz wide 5Ghz WLAN based in the UK using all available indoor UK channels:
36,40,44,48,52,56,60,64,100,104,108,112,116,132,136,140

WiFi Nigel does an exceptional job of explaining the constraints of 5Ghz in the UK, here.

Devices

Day to day, there’s anything up to 400 devices across 5 WLANs within the building. The devices we’re focusing on number up to 270 on a single 5Ghz 802.1x enabled WLAN. They are the managed laptop devices.

The devices in my organisation are loaded with Intel® Centrino® Advanced-N 6235 Wi-Fi adapters which have several options for client side ‘Roaming Aggressiveness’.

centrino

A colleague of mine has already changed a couple devices to ‘5’ for Roaming Aggressiveness with no detrimental feedback, so we assume that is safe – for now – on those devices whilst we pay attention to the WLC.

Taking a note of the configuration of both the Laptops and the WLC configuration, I’m starting with the WLC Optimized Roaming configuration and leaving the Laptops on ‘4’ for Roaming Aggressiveness.

The strategy for the changes pan out as follows:-

  1. Enable Optimized Roaming on the WLC without RSSI – 10 sec interval
  2. Review Optimized Roaming change after 2 weeks and consider interval period.
  3. *Repeats* Add/Increase RSSI thresholds

Cisco states “If you configure a low value for the reporting interval, the network can get overloaded with coverage report messages”. I don’t understand how data, sent every 20secs from 30 APs would overload the network which is Gigabit access ports and 10Gig uplinks to the Core.
My with that long suggested timer interval is that if Optimized Roaming only executed disconnects every 1.5mins, that’s a long time for a device to be hanging around on a sub-optimal AP before it re-connects to something useful.

In the interest of only turning one knob at a time, I’m changing the WLC to enable Optimized Roaming allowing RSSI as it’s only metric and ignoring data rates for the time being.

Step 1. Configuring Optimized Roaming without RSSI from the WLC CLI.

*You will need to disable your radios to complete this work!*

config 802.11a disable network
config 802.11b disable network
config advanced 802.11a optimized-roaming enable
config advanced 802.11b optimized-roaming enable
config advanced 802.11a optimized-roaming interval 20
config advanced 802.11b optimized-roaming interval 20
config advanced 802.11a optimized-roaming datarate 0
config advanced 802.11b optimized-roaming datarate 0

config 802.11a enable network
config 802.11b enable network

show advanced 802.11a optimized-roaming
show advanced 802.11a optimized-roaming stats

Unless there’s any immediate negative consequence from enabling these settings, it’s only fair that the configuration is left alone for a reasonable amount of time before moving on with the RSSI modifications.

Two weeks seems like a good start, it enables you to carefully investigate any issues that aren’t global within the environment and confirm if they were real issues or emotional responses to the change.

Step 2. Configure RSSI as a part of Optimized Roaming

*You will need to disable your radios to complete this work!*

config 802.11a disable network
config 802.11b disable network
config advanced 802.11a optimized-roaming datarate 12
config advanced 802.11b optimized-roaming datarate 12
config 802.11a enable network
config 802.11b enable network
show advanced 802.11a optimized-roaming
show advanced 802.11a optimized-roaming stats
 

Step 3. Increase RSSI thresholds in Optimized Roaming

*You will need to disable your radios to complete this work!*

config 802.11a disable network
config 802.11b disable network
config advanced 802.11a optimized-roaming datarate 24
config advanced 802.11b optimized-roaming datarate 24
config 802.11a enable network
config 802.11b enable network
show advanced 802.11a optimized-roaming
show advanced 802.11a optimized-roaming stats
 

Step 4. Increase RSSI thresholds in Optimized Roaming

*You will need to disable your radios to complete this work!*

config 802.11a disable network
config 802.11b disable network
config advanced 802.11a optimized-roaming datarate 36
config advanced 802.11b optimized-roaming datarate 36
config 802.11a enable network
config 802.11b enable network
show advanced 802.11a optimized-roaming
show advanced 802.11a optimized-roaming stats
 

Step 5. Increase RSSI thresholds in Optimized Roaming

*You will need to disable your radios to complete this work!*

config 802.11a disable network
config 802.11b disable network
config advanced 802.11a optimized-roaming datarate 48
config advanced 802.11b optimized-roaming datarate 48
config 802.11a enable network
config 802.11b enable network
show advanced 802.11a optimized-roaming
show advanced 802.11a optimized-roaming stats
 

Step 6. Increase RSSI thresholds in Optimized Roaming

*You will need to disable your radios to complete this work!*

config 802.11a disable network
config 802.11b disable network
config advanced 802.11a optimized-roaming datarate 54
config advanced 802.11b optimized-roaming datarate 54
config 802.11a enable network
config 802.11b enable network
show advanced 802.11a optimized-roaming
show advanced 802.11a optimized-roaming stats

As of 25/11/15 I’m executing Step 1. on the 27/11/15.
I’ll continue to update this post as the process develops.

 

 

 

Quick note on Iperf usage

Iperf commands used for testing a flow. These are unidirectional, as I would advise against using the Server side return flag i.e. when finished flip the commands around and change the IP address.

TCP test – example at 20m (see –b) and the x.x.x.x address should be the servers address:

Client side = iperf -c x.x.x.x –p10000 -i1 -w512k -l512 -t30 –b20m
Server side = iperf -s –p10000 -i1 -w512k

UDP test – example at 20m (see –b) and the x.x.x.x address should be the servers address:

Client side = iperf -c x.x.x.x -u -p10000 -i1 -w512k -l512 -t30 –b20m
Server side = iperf -s -u -p10000 -i1 -w512k

Flags:
-p = the port used for the flow
-c = Assign as client (servers IP address must follow)
-s = Assign as server
-i1 = Print to screen every second
-w512k = Enlarge window size (proven through multiple tests as the best value)
-t30 = Duration of test in seconds
-b20m = 20Mbits bandwidth – can be m = Megabits or K = Kilobits – value can be changed based upon requirement
-u = UDP Mode (without the flag it defaults to TCP)
-l512 = Set the packet length (example is 512, but default is 1470)

You cannot use the vSphere client to edit the settings of virtual machines of version 10 or higher

Image

This was the message that greeted me after upgrading my ESXi Hypervisor with Free license to 5.5.
I’ve applied an Enterprise license to see if there’s a difference to the host license applied and there’s no change to the behaviour.

It seems if you don’t want the hassle of using a CLI to interact with your VM’s on a Hypervisor license, DO NOT UPGRADE THE VIRTUAL HARDWARE OF YOUR VMs to Version 10 hardware. Unless you’re running vCenter of course.

I’m unable to see a way round this to restore the use of the vSphere Client as a tool to modify the settings of the VM, and let’s be clear, all I want to do is change the vSwitch a VM is connected to as my LAB ESXi box is hooked up to four different switches and I move the VM’s around to recreate different scenarios.

I’m gutted. I’ll update if I find anything to help or back myself out of this mess.

Cisco SWITCH Campus VoIP Refresh. Part 3b – QoS Configuration

I can’t believe I’ve had to chop up not just the VoIP refresh section into three parts, but part three into A and B!

It’s surprised me a little and I must have a little more to say on the subject than I thought when I started putting finger to key last night. But, I AM trying to keep this in scope for the SWITCH exam, so we’ll discuss just the req’s for that in this article.

Configuration

First of all, in order to turn on QoS processing on the switch, we need to enable it with the mls qos global command.
This is something that’s easy to overlook as you’ll enter interface commands all day long, without this, they don’t count for anything.

SW3#sh mls qos
QoS is disabled
QoS ip packet dscp rewrite is enabled
SW3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW3(config)#mls qos
SW3(config)#do sh mls qos
QoS is enabled
QoS ip packet dscp rewrite is enabled

Notice the result of the first command stating that QoS is disabled.
Then the show command entered shows the processing being turned on globally.

Under your switchport interfaces, there are many things that could be done, but as mentioned previously, keeping a tight scope to the SWITCH exam.

To demonstrate a few things here, I’m going to show that the interface is in default configuration and then apply four different commands, two of which are setting the VLAN id’s for Access and Voice VLANs.

SW3(config-if)#do sh run int fa 0/1
Building configuration...
Current configuration : 33 bytes
!
interface FastEthernet0/1
end
SW3(config-if)#switchport host
switchport mode will be set to access
spanning-tree portfast will be enabled
channel group will be disabled
SW3(config-if)#switchport access vlan 11
SW3(config-if)#switchport voice vlan 22 
SW3(config-if)#auto qos voip trust
SW3(config-if)#do sh run int fa 0/1
Building configuration...
Current configuration : 235 bytes
!
interface FastEthernet0/1
 switchport access vlan 11
 switchport mode access
 switchport voice vlan 22
 srr-queue bandwidth share 10 10 60 20
 priority-queue out 
 mls qos trust cos
 auto qos voip trust 
 spanning-tree portfast
end

So hopefully you can see, from four commands, I received eight lines of configuration.
That’s because the cheeky switchport host command is a macro which sets a port up for an end device, simlarly the auto qos voip trust command is the Auto-QoS command for non-Cisco IP-Phones to be attached to your access interfaces.

From an real world operational standpoint, Auto QoS is pretty much all you need for your access ports, the only thing that I’ll mention is, try and ensure you’re running the same release of IOS on all your particular switch models as QoS maps may be different between releases.

That’s the automatic portion of configuration covered, to just expand a little on manual configuration for the exam…

To configure an IOS switch to trust the markings on traffic entering an interface, use the following:

Switch(config-if)# mls qos trust {dscp | cos}

To configure the switch to trust the traffic markings only if a Cisco phone is connected, use the following:

Switch(config-if)# mls qos trust device cisco-phone

To set a COS value for frames coming from a PC attached to the phone, use the following:

Switch(config-if)# switchport priority extend cos <cos-value>

To verify the QoS parameters on an interface, use the following:

Switch(config-if)# show mls qos interface <interface>

Here we use the last command mentioned to see how the show command interprets the Auto-QoS settings of the commands we used earlier and a second interface which is default, for comparison (no devices are attached at this point).

SW3#sh mls qos interface fa 0/1 
FastEthernet0/1
trust state: trust cos
trust mode: trust cos
trust enabled flag: ena
COS override: dis
default COS: 0
DSCP Mutation Map: Default DSCP Mutation Map
Trust device: none
qos mode: port-based
SW3#sh mls qos interface fa 0/2
FastEthernet0/2
trust state: not trusted
trust mode: not trusted
trust enabled flag: ena
COS override: dis
default COS: 0
DSCP Mutation Map: Default DSCP Mutation Map
Trust device: none
qos mode: port-based

Cisco SWITCH Campus VoIP Refresh. Part 3a – QoS Theory

QoS, a discussion

Now, funny one this. QoS is really important, right? You’ll hear people say QoS enabled network this, gotta have Quality of Service for VoIP/Video solution that, otherwise it’ll fail.

Read this statement and remember… Quality of Service is meant to combat TEMPORARY network congestion.

As a whole, on a switched campus network with 100Mbps access ports and 1Gbps uplinks everywhere, it’s unlikely, though not impossible that you need QoS. QoS will be there to catch you every time you find a link congested. That’s all!

You could just have QoS misconfigured on your switches – like I did once, thanks to a telco provider I may have mentioned in the past. It meant the campus VoIP solution went in, every one did a dance, we thought that we had a VoIP solution running on a QoS enabled network, which was only a half truth. We had a VoIP solution. The QoS wasn’t configured correctly, but no one knew any different – seemingly the telco’s installation engineers didn’t either – till a few years down the line I viewed the configs to find that they were doing diddly squat in terms of prioritisation.

It didn’t really matter though right? We had enough bandwidth so that the devices on the switches could pass data all day and the interfaces never became congested enough for long enough to cause support calls due to quality, and if there were support calls generated, the call quality could probably be put down to one end being a call to a mobile or another external party.

So that’s all well and good if you’re staying on Campus. Instantly, the moment your voice call traffic is going off Campus, the game changes.

For the SWITCH exam, the remainder of this discussion is a little off-piste, we’re not talking about Routers here which but we may be talking about Multi Layer Switch SVI’s which are default gateways for networks and subsequently may need to consider things like global synchronisation and congestion upstream.

IT Management buy links from an ISP/Telco based on the perceived or measured need for the organisation in chunks of Mbps/Gbps because of prohibitive costing of said links. If all WAN links were the same price per Mb as a campus switchport, everyone would choose big link numbers, but they don’t.

So, importantly, these link sizing decisions are all driven or least heavily influenced by the commoditisation [sic] or lack of, Internet and private link bandwidth.

Because link bandwidth isn’t as cheap as your local switchport bandwidth, It’s very unlikely at this point that you’re going to say, right then, 1Gbps VPLS/MPLS links from all our offices please Mr ISP/Telco!
Notice I said MPLS/VPLS. You could buy xMbps/Gbps Internet links, but your traffic in transit will not be treated with any priority, so all the good work that you do as a result of this article will be for nothing the moment it’s traversing the Internet alongside little Billy’s uTorrent traffic for the latest World of WarCraft ISO rip.

So if you’re putting your inter-handset RTP traffic or SIP trunk traffic on a WAN link, to ensure your QoS model is extended to service that traffic in transit, you need to be on some sort of provider VPN, most likely, VPLS or MPLS.
It’s quite feasible to put your traffic out there on the Internet using a Site-to-Site VPN or an tunnelled Handset/Softphone remote worker to Call Server session, but there’s no guarantees, no SLA’s, if the call quality is dodgy or you have call connection issues, you have to learn to get over it. It totally depends on your requirements and expectations.