Forcing F5 to synchronise time via NTP

Posted on June 15, 2014 · 2 mins reading time

When time looks like this on your F5 box:

And time in the real world looks like this:

Things aren’t going to go so well for your users.

What you want to do is check that your device has [When time looks like this on your F5 box:

And time in the real world looks like this:

Things aren’t going to go so well for your users.

What you want to do is check that your device has](http://en.wikipedia.org/wiki/Network_Time_Protocol) configured (System -> Configuration -> Device -> NTP) and that your handy firewall isn’t blocking the traffic (udp/123 folks!).

If that’s all good, and you can see traffic is flowing (you’ve got your firewall syslog flowing into Splunk,  yeah?) The next trick is to check if NTP is even running.

[Read More]

Absolute power

Posted on May 1, 2014 · 2 mins reading time

I was once on a US military ship, having breakfast in the wardroom (officers lounge) when the Operations Officer (OPS) walks in. This guy was the definition of NOT a morning person; he’s still half asleep, bleary eyed… basically a zombie with a bagel. He sits down across from me to eat his bagel and is just barely conscious. My back is to the outboard side of the ship, and the morning sun is blazing in one of the portholes putting a big bright-ass circle of light right on his barely conscious face. He’s squinting and chewing and basically just remembering how to be alive for today. It’s painful to watch.

[Read More]

What’s listening on my ports in Windows?

Posted on April 8, 2014 · 2 mins reading time

Sometimes it is good to know what is running on your machine - or if something is actually listening when you are trying to connect to that pesky server you thought you had running.

The command you want to run is:

netstat –anop TCP | find “LISTEN”
[Read More]

Ironport MID was too big for scanning by Outbreak Filters

Posted on March 11, 2014 · 1 min reading time

So I was trying to find out why we got this message in the message tracking logs for an email today…

Ironport MID 42780863 was too big (337410/262144) for scanning by Outbreak Filters

Due to size vs. speed concerns there is a limit to the size of items checked against the Outbreak Filters. I believe the default setting’s 128K, but it can be upped to increase efficacy at the cost of processing power.

[Read More]

portDB – a new little project.

Posted on March 9, 2014 · 1 min reading time

So I’ve been maintaining my own little database of ports for my own records of late, just so that when I found something on a network I could go “oh, this is probably what it was. It was just a set of pages added to this blog, but that was fairly unmanageable.

I went looking for an easier way of building something and built portDB. So far it’s fairly simple, as these things should be.

[Read More]

Splunk error in auto-complete box

Posted on February 3, 2014 · 1 min reading time

I started getting this error on a user’s auto-complete box while trying to search in splunk because we’d failed to give them the correct capabilities.

The capabilities I had to apply were:

  • get_metadata
  • get_typeahead
  • rest_properties_get

 

[Read More]