Okay, I’ve had all weekend to play with the phone, and here we go, I’ll go app by app, experience by experience.
At first I was caught in the wave of people whose activation wasn’t going through. From the time I submitted my activation on iTunes, to the time it went through was about 19 hours. 19 EXCRUCIATING hours. Let me tell you, sitting here wanting to play with my phone, and it not working is a pain the butt. But eventually, it started working, synced up, and everything is hunky dory now. Turns out there was a ‘hold’ on my activation by AT&T. Whatever the hell that means. But after a couple tech-support calls, it works now, and I am a happy camper.
Unlocking/Locking -- works by touching the top button, works great.
Home screen -- Exactly how it looks in all the commercials, exactly like the picture I have above, it functions as it should.
Text messaging (SMS) -- Works just fine, formats the chat like iChat, like you have seen. The Keyboard, which I will probably discuss several times this entry, is a bit interesting. As Apple says, “you start typing with one finger to get used to how it operates”, but actually, it’s getting used to you. It’s learning the names and proper nouns and things like that you will be typing. After a couple days of use, you can type with your thumbs. I am at this stage, I can type pretty fast, but I am not up to the speed that I was on while on my blackberry. Apple says you have to learn to trust the auto-correcting feature, and once you do, you work faster. I can see this. Maybe i’ll make another blog entry in a couple days reporting on how fast I am.
Calendar -- It works nicely, has the bubble look for calendar entries much like iCal. The only thing that is lacking in iCal is “Todo’s”. It’s not in a separate application or anything, but it’s kinda helpful to have those. I WANT MY TODO’S APPLE!!
Photos -- It’s a photo browsing app, you can flick from picture to picture from left to right, right to left, use the pinch to enlarge and decrease. Works great, no complaints here. I used the Photos feature to make a picture of my daughter sitting up on the floor my wallpaper. I like the feature of being able to email a photo right from the application, it kind of “minimizes” the photo, then puts it in an email for you to send. It’s kind of hard to describe, but I remember watching the effect on one of the Apple videos.
Camera -- It actually takes some descent photos. Considering it’s 2 megapixel camera, you have to kind of forgive it for any shaking or bad lighting. However, considering the camera on my last phone was a 1.3 megapixel, i can see that. Here’s a picture I took with my camera yesterday.
Youtube -- Not a ‘useful’ feature, but definitely cool to pass the time with if you are bored.
Stocks widget -- I have all my stocks on there, it syncs quickly via Edge or Wifi.
Google Maps -- NICE. The integration with Google Maps is beautiful, Jobs said it was the best Google Maps client ever, and I tend to agree. It’s better then Google’s own implementation, and a hella lot better then the one I had on my blackberry.
Weather -- This is a handy feature, I can have several of them open at the same time, and i can flick left and right to be able to access the weather in whatever areas I set. I set them by hitting the edit button, too easy. Updates quickly via Edge or Wifi.
Clock -- The clock allows me to track the time in several time zones (it syncs via the cell tower), and has Cupertino built in as the default. Also has an Alarm, Stopwatch, and a countdown timer on it as well. The countdown timer has the most satisfying interface, which resembles a DaVinci cryptex
you flick your finger up and down to adjust the time.
Calculator -- It’s a simple +, -, *, /, calculator. Nothing special and nothing scientific.
Notes -- Simple Note pad, the font is sort of informal and rather ‘note-ish’. Kind of satisfying, the only problem is, when it syncs with iTunes it does NOT sync with ‘Stickies’ (The note application), so Notes are not synced anywhere I can see on OSX. One can surmise then that the notes will be synced with the Notes in OSX Leopard’s Mail.app application.
Settings --This was a section that I was curious about, so I’ll try and cover it in some detail:
1) Airplane Mode, simple slide left or right to turn off all wireless features. Nice.
2) Wi-fi -- You can turn wi-fi on or off, select the access point, and turn the “Ask to join networks” on or off. Now, from what i can tell, iPhone won’t just join some random access point. You have to tell it to do so, but once you do, it will remember that access point for future use. Nice. That way you can just walk into Panera, it grabs and IP and is ready for use.
3) Usage -- All kinds of metrics, usage, standby time, call time, lifetime call time, edge network data sent/received.
4) Sounds -- Vibrate on or off in silent mode, vibrate on or off in ring mode, ring volume, ringtone, and tones for voicemail, text message, mail, sent mail, calendar alerts, lock sounds, and keyboard clicking (which i turned off because it’s rather annoying when typing).
5) Brightness -- You can set it, or let it auto-adjust (on by default).
6) Wallpapers -- You can select from a built in wallpaper, or you can select your own.
7) General --
a) About -- what network you are on, how many songs, videos, photos, total capacity, available capacity, version (1.0), serial number, model number, wifi mac address, bluetooth mac address, imei and iccid numbers, and modem firmware. Finally a legal scroll page which includes the GPL license, and the licenses for bsd along with a shit-ton of other legal stuff from Google, Apple, and your mother.
b) Date and Time -- 24 hour time, set automatically, time zone support, and the ability to select a time zone (by city/state).
c) Auto-Lock -- 1, 2, 3, 4, 5, or never minutes.
d) Passcode lock -- (that you would have to type in after you lock/unlock the phone)
e) Network -- VPN and Wi-Fi. VPN supports L2TP and PPTP, as well as proxies.
f) Bluetooth -- ON or OFF, and what devices you are paired to. Apparently supports handsets only.
g) Keyboard -- Auto-Caps, or Enable Caps Lock
h) Reset -- Resets the device (also done by Holding down the Home button and the Sleep/Wake button)
8) Mail -- Allows you to do a bunch of things with mail, setup the accounts, auto-checks, how many recent messages to show, minimum font size and the like.
9) Phone -- Call Forwarding and Call Waiting are found here, as well as the ability to block your phone number.
10) Safari -- Cookies, Cache, etc..
11) iPod -- AudioBook speed, EQ, volume limit
12) Photos -- Repeat, shuffle, and other stuff for slideshows
Phone -- Favorites work well, Recents, Contacts, Keypad, and Visual Voicemail all work excellent like they do in the commercials. The Rubber-banding effect in contacts (well in ANYTHING) really, is nice. It’s like the iPhone is allowing you to scroll off the end, and prove to you yes, there really is nothing there, then brings you back to reality.
Call Quality -- Excellent, the speakerphone isn’t very loud, and I haven’t tested the hold or the conferencing features yet, but generally works great.
Bluetooth headset -- I haven’t tried it with a regular headset yet, but it works great with my car.
Mail -- Again, has a button to sync. (I use IMAP) Works great. Sometimes swiping your finger across an email to delete it is a bit awkward, (doesn’t work everytime, but I think it’s my fault). The Keyboard, as I said before, takes a bit to get used to, but once it’s learning your typing style, it works great. I can now type at full speed wit my thumbs on it. I’ve read some stuff recently about the in-ability to push email to the iPhone. Not true. Yahoo can push email to an iPhone, and I am sure Gmail, and .mac will get it. Blackberry enterprise can’t push but that’s RIM’s fault. ;)
Safari -- Now, I have heard alot of bitching about how slow the Edge network is. In my experience, it’s actually not that bad. It’s not as fast as the wifi, don’t get me wrong, but it’s not as slow as dialup either. I can deal with it. It’s actually faster IMO then my blackberry. My blackberry was painfully slow at webpages. It DOES support Javascript and RSS feeds. Unlike what these tools are saying out there in the press.
iPod -- Enuff said. a visual ipod. It kicks ass.
Things I wish the iPhone had --
Todo’s, already said it.
Removeable battery, even though by the time this one dies it’ll be time to buy a new phone, still though, i wish I could get a new battery, or an extra one for it.
A separate IM application -- I overcame this by setting AOLIM to forward my messages to my mobile when I am not near IM client. Works through SMS, and works just fine. Still though, I would like to have a separate iChat application.
Other than that, I love this thing. It ROCKS. If you are one of the non-believers or one of the people that thinks it’s all hype, then fine, don’t buy one. No skin off my back, I know it kicks serious booty. But I do suggest that you if you are reading an article that just says that the iPhone sucks, check their facts. Email me at the link below and I’ll debunk or approve, I don’t mind. Go to an AT&T store or an Apple store and play with it. You’ll be convinced.
But for those of you are that are looking to reduce the amount of devices and cables they have to carry, and are looking for something to really make their life more organized and simpler, then there you go. Get it.
Monday, July 2
Tuesday, June 12
WWDC
Well, as you can probably guess, alot of people have written me asking what I think about the stuff that Mr. Jobs presented this morning at the WWDC (World Wide Developer Conference) in San Francisco, CA.
In case you are sleeping in a cave, he announced a few things: A new desktop, new Finder, Safari on Windows, Dashboard, Time Machine, Spaces, blah blah, and some other stuff.. Let me talk about a few of these
New Desktop: Thank God. Unified them, transparent menu bar, reflective Dock. Stacks? Um, okay. I’ll use it, it’ll be nice, but didn’t someone else have that?
New Finder: THANK GOD. The present Finder sucks, so I am glad they did this. However, it occurred to me that some of the stuff like searches that are for ‘Today’ and ‘Yesterday’ can already be done with Smart Folders in Tiger. Seriously, give it a shot. I’ll wait.. Well, maybe I won’t. The things I did like alot were the features to be able to instantly search via Spotlight and ‘browse’ via Finder the other computers on my lan (which you can do now, it’s just alot better in Leopard), and the ‘Back to my Mac’ feature. The ability to connect to your home PC no matter where you are. NICE. I will be using THAT one alot. Cover Flow? mmm.. okay. We’ll see.
Quicklook: Nice. The ability to look at files w/out having to open their app. Nice.
iChat: Nothing new here except the picture superimposing. Kinda nice. I already use iChat alot, so these features will be nice. I use iChat to communicate w/ my wife and baby while I am on the road. Makes up for me being gone (a little bit).
Safari on Windows: More on this later, but this is kinda cool.
Dashboard: Steve, we saw this last year. Boring.
Time Machine: Nice feature, except, again... we saw this last year. Boring.
Spaces: Multiple Desktops? Um, how long have Linux/other *nix’s had this? A long time? yes. How did Mac make it better? They made it prettier. That’s all. Boring.
All the other stuff: Boring. I’ll talk about what I think about Safari on Windows in a sec.
Things that WEREN’T Covered, and probably should have:
Mail -- Yes, we saw a bunch of this last year, Stationary (whoop de do, Outlook has had stationary for years, and it’s irritating, Apple just made it easier to use and prettier) However, Mail supports Notes and ToDo’s now (this we knew last year) it also integrates RSS feeds (nice), and it auto-recognizes Addresses, phone numbers, and email addresses in the text of an email and allows you to auto-create an Address Book entry for that person (nice). It also recognizes dates and auto-creates (with the help of a drop down) events in iCal. Nice. Watch the video linked to see. Leopard++
iCal -- Another one of my daily apps, iCal got better. Inline editing (instead of in the side PAIN -- pane), unified interface, nice. Like it. Leopard++
Parental Controls -- Nice. Alot better. I don’t know how this lines up against Vista, but this will be a welcome addition. Leopard++
Boot Camp -- Ehh.. Kind of expected native Windows apps running parallel w/ OSX ones. Not having to reboot to use Windows Apps. I tried to predict this, apparently the Leopard developers don’t read my blog.
Photo Booth -- Ehh. I don’t use it. I don’t care.
DVD Player -- Good. The other one was ‘just okay’
Overall -- okay. I’ll buy it for 129.00.
Now, why do I think Jobs introduced Safari for Windows. Lets look at the situation here. Let’s say Windows people are afraid to switch to a mac because they don’t know how to operated the interface. Okay. Safari and iTunes are the Mac apps on Windows. Both are different in their own special way, each having a nice interface.
The new Finder in Leopard is just like iTunes. Compare em, go ahead. Safari is exactly the same on both platforms.
IMHO -- I think Apple is making a play here for switchers. Don’t be afraid to switch to OSX, have you used iTunes before? Then you know OSX. Done. Everything in OSX will look like an app you are already familiar with.. okay? No more excuses. Oh, you have an app that doesn’t run on OSX? Boot camp, thanks.
I think this is targeted at the potential switcher audience. Good luck.
I’ll still buy Leopard, and I’ll still buy the iPhone. I like them both. But I am buying Leopard for the Back to my mac, intra-network computer access in Finder, Time Machine, Mail, and the new iChat. That’s it.
What did you guys think?
In case you are sleeping in a cave, he announced a few things: A new desktop, new Finder, Safari on Windows, Dashboard, Time Machine, Spaces, blah blah, and some other stuff.. Let me talk about a few of these
New Desktop: Thank God. Unified them, transparent menu bar, reflective Dock. Stacks? Um, okay. I’ll use it, it’ll be nice, but didn’t someone else have that?
New Finder: THANK GOD. The present Finder sucks, so I am glad they did this. However, it occurred to me that some of the stuff like searches that are for ‘Today’ and ‘Yesterday’ can already be done with Smart Folders in Tiger. Seriously, give it a shot. I’ll wait.. Well, maybe I won’t. The things I did like alot were the features to be able to instantly search via Spotlight and ‘browse’ via Finder the other computers on my lan (which you can do now, it’s just alot better in Leopard), and the ‘Back to my Mac’ feature. The ability to connect to your home PC no matter where you are. NICE. I will be using THAT one alot. Cover Flow? mmm.. okay. We’ll see.
Quicklook: Nice. The ability to look at files w/out having to open their app. Nice.
iChat: Nothing new here except the picture superimposing. Kinda nice. I already use iChat alot, so these features will be nice. I use iChat to communicate w/ my wife and baby while I am on the road. Makes up for me being gone (a little bit).
Safari on Windows: More on this later, but this is kinda cool.
Dashboard:
Time Machine: Nice feature, except, again... we saw this last year. Boring.
Spaces: Multiple Desktops? Um, how long have Linux/other *nix’s had this? A long time? yes. How did Mac make it better? They made it prettier. That’s all. Boring.
All the other stuff: Boring. I’ll talk about what I think about Safari on Windows in a sec.
Things that WEREN’T Covered, and probably should have:
Mail -- Yes, we saw a bunch of this last year, Stationary (whoop de do, Outlook has had stationary for years, and it’s irritating, Apple just made it easier to use and prettier) However, Mail supports Notes and ToDo’s now (this we knew last year) it also integrates RSS feeds (nice), and it auto-recognizes Addresses, phone numbers, and email addresses in the text of an email and allows you to auto-create an Address Book entry for that person (nice). It also recognizes dates and auto-creates (with the help of a drop down) events in iCal. Nice. Watch the video linked to see. Leopard++
iCal -- Another one of my daily apps, iCal got better. Inline editing (instead of in the side PAIN -- pane), unified interface, nice. Like it. Leopard++
Parental Controls -- Nice. Alot better. I don’t know how this lines up against Vista, but this will be a welcome addition. Leopard++
Boot Camp -- Ehh.. Kind of expected native Windows apps running parallel w/ OSX ones. Not having to reboot to use Windows Apps. I tried to predict this, apparently the Leopard developers don’t read my blog.
Photo Booth -- Ehh. I don’t use it. I don’t care.
DVD Player -- Good. The other one was ‘just okay’
Overall -- okay. I’ll buy it for 129.00.
Now, why do I think Jobs introduced Safari for Windows. Lets look at the situation here. Let’s say Windows people are afraid to switch to a mac because they don’t know how to operated the interface. Okay. Safari and iTunes are the Mac apps on Windows. Both are different in their own special way, each having a nice interface.
The new Finder in Leopard is just like iTunes. Compare em, go ahead. Safari is exactly the same on both platforms.
IMHO -- I think Apple is making a play here for switchers. Don’t be afraid to switch to OSX, have you used iTunes before? Then you know OSX. Done. Everything in OSX will look like an app you are already familiar with.. okay? No more excuses. Oh, you have an app that doesn’t run on OSX? Boot camp, thanks.
I think this is targeted at the potential switcher audience. Good luck.
I’ll still buy Leopard, and I’ll still buy the iPhone. I like them both. But I am buying Leopard for the Back to my mac, intra-network computer access in Finder, Time Machine, Mail, and the new iChat. That’s it.
What did you guys think?
WWDC
Well, as you can probably guess, alot of people have written me asking what I think about the stuff that Mr. Jobs presented this morning at the WWDC (World Wide Developer Conference) in San Francisco, CA.
In case you are sleeping in a cave, he announced a few things: A new desktop, new Finder, Safari on Windows, Dashboard, Time Machine, Spaces, blah blah, and some other stuff.. Let me talk about a few of these
New Desktop: Thank God. Unified them, transparent menu bar, reflective Dock. Stacks? Um, okay. I’ll use it, it’ll be nice, but didn’t someone else have that?
New Finder: THANK GOD. The present Finder sucks, so I am glad they did this. However, it occurred to me that some of the stuff like searches that are for ‘Today’ and ‘Yesterday’ can already be done with Smart Folders in Tiger. Seriously, give it a shot. I’ll wait.. Well, maybe I won’t. The things I did like alot were the features to be able to instantly search via Spotlight and ‘browse’ via Finder the other computers on my lan (which you can do now, it’s just alot better in Leopard), and the ‘Back to my Mac’ feature. The ability to connect to your home PC no matter where you are. NICE. I will be using THAT one alot. Cover Flow? mmm.. okay. We’ll see.
Quicklook: Nice. The ability to look at files w/out having to open their app. Nice.
iChat: Nothing new here except the picture superimposing. Kinda nice. I already use iChat alot, so these features will be nice. I use iChat to communicate w/ my wife and baby while I am on the road. Makes up for me being gone (a little bit).
Safari on Windows: More on this later, but this is kinda cool.
Dashboard: Steve, we saw this last year. Boring.
Time Machine: Nice feature, except, again... we saw this last year. Boring.
Spaces: Multiple Desktops? Um, how long have Linux/other *nix’s had this? A long time? yes. How did Mac make it better? They made it prettier. That’s all. Boring.
All the other stuff: Boring. I’ll talk about what I think about Safari on Windows in a sec.
Things that WEREN’T Covered, and probably should have:
Mail -- Yes, we saw a bunch of this last year, Stationary (whoop de do, Outlook has had stationary for years, and it’s irritating, Apple just made it easier to use and prettier) However, Mail supports Notes and ToDo’s now (this we knew last year) it also integrates RSS feeds (nice), and it auto-recognizes Addresses, phone numbers, and email addresses in the text of an email and allows you to auto-create an Address Book entry for that person (nice). It also recognizes dates and auto-creates (with the help of a drop down) events in iCal. Nice. Watch the video linked to see. Leopard++
iCal -- Another one of my daily apps, iCal got better. Inline editing (instead of in the side PAIN -- pane), unified interface, nice. Like it. Leopard++
Parental Controls -- Nice. Alot better. I don’t know how this lines up against Vista, but this will be a welcome addition. Leopard++
Boot Camp -- Ehh.. Kind of expected native Windows apps running parallel w/ OSX ones. Not having to reboot to use Windows Apps. I tried to predict this, apparently the Leopard developers don’t read my blog.
Photo Booth -- Ehh. I don’t use it. I don’t care.
DVD Player -- Good. The other one was ‘just okay’
Overall -- okay. I’ll buy it for 129.00.
Now, why do I think Jobs introduced Safari for Windows. Lets look at the situation here. Let’s say Windows people are afraid to switch to a mac because they don’t know how to operated the interface. Okay. Safari and iTunes are the Mac apps on Windows. Both are different in their own special way, each having a nice interface.
The new Finder in Leopard is just like iTunes. Compare em, go ahead. Safari is exactly the same on both platforms.
IMHO -- I think Apple is making a play here for switchers. Don’t be afraid to switch to OSX, have you used iTunes before? Then you know OSX. Done. Everything in OSX will look like an app you are already familiar with.. okay? No more excuses. Oh, you have an app that doesn’t run on OSX? Boot camp, thanks.
I think this is targeted at the potential switcher audience. Good luck.
I’ll still buy Leopard, and I’ll still buy the iPhone. I like them both. But I am buying Leopard for the Back to my mac, intra-network computer access in Finder, Time Machine, Mail, and the new iChat. That’s it.
What did you guys think?
In case you are sleeping in a cave, he announced a few things: A new desktop, new Finder, Safari on Windows, Dashboard, Time Machine, Spaces, blah blah, and some other stuff.. Let me talk about a few of these
New Desktop: Thank God. Unified them, transparent menu bar, reflective Dock. Stacks? Um, okay. I’ll use it, it’ll be nice, but didn’t someone else have that?
New Finder: THANK GOD. The present Finder sucks, so I am glad they did this. However, it occurred to me that some of the stuff like searches that are for ‘Today’ and ‘Yesterday’ can already be done with Smart Folders in Tiger. Seriously, give it a shot. I’ll wait.. Well, maybe I won’t. The things I did like alot were the features to be able to instantly search via Spotlight and ‘browse’ via Finder the other computers on my lan (which you can do now, it’s just alot better in Leopard), and the ‘Back to my Mac’ feature. The ability to connect to your home PC no matter where you are. NICE. I will be using THAT one alot. Cover Flow? mmm.. okay. We’ll see.
Quicklook: Nice. The ability to look at files w/out having to open their app. Nice.
iChat: Nothing new here except the picture superimposing. Kinda nice. I already use iChat alot, so these features will be nice. I use iChat to communicate w/ my wife and baby while I am on the road. Makes up for me being gone (a little bit).
Safari on Windows: More on this later, but this is kinda cool.
Dashboard:
Time Machine: Nice feature, except, again... we saw this last year. Boring.
Spaces: Multiple Desktops? Um, how long have Linux/other *nix’s had this? A long time? yes. How did Mac make it better? They made it prettier. That’s all. Boring.
All the other stuff: Boring. I’ll talk about what I think about Safari on Windows in a sec.
Things that WEREN’T Covered, and probably should have:
Mail -- Yes, we saw a bunch of this last year, Stationary (whoop de do, Outlook has had stationary for years, and it’s irritating, Apple just made it easier to use and prettier) However, Mail supports Notes and ToDo’s now (this we knew last year) it also integrates RSS feeds (nice), and it auto-recognizes Addresses, phone numbers, and email addresses in the text of an email and allows you to auto-create an Address Book entry for that person (nice). It also recognizes dates and auto-creates (with the help of a drop down) events in iCal. Nice. Watch the video linked to see. Leopard++
iCal -- Another one of my daily apps, iCal got better. Inline editing (instead of in the side PAIN -- pane), unified interface, nice. Like it. Leopard++
Parental Controls -- Nice. Alot better. I don’t know how this lines up against Vista, but this will be a welcome addition. Leopard++
Boot Camp -- Ehh.. Kind of expected native Windows apps running parallel w/ OSX ones. Not having to reboot to use Windows Apps. I tried to predict this, apparently the Leopard developers don’t read my blog.
Photo Booth -- Ehh. I don’t use it. I don’t care.
DVD Player -- Good. The other one was ‘just okay’
Overall -- okay. I’ll buy it for 129.00.
Now, why do I think Jobs introduced Safari for Windows. Lets look at the situation here. Let’s say Windows people are afraid to switch to a mac because they don’t know how to operated the interface. Okay. Safari and iTunes are the Mac apps on Windows. Both are different in their own special way, each having a nice interface.
The new Finder in Leopard is just like iTunes. Compare em, go ahead. Safari is exactly the same on both platforms.
IMHO -- I think Apple is making a play here for switchers. Don’t be afraid to switch to OSX, have you used iTunes before? Then you know OSX. Done. Everything in OSX will look like an app you are already familiar with.. okay? No more excuses. Oh, you have an app that doesn’t run on OSX? Boot camp, thanks.
I think this is targeted at the potential switcher audience. Good luck.
I’ll still buy Leopard, and I’ll still buy the iPhone. I like them both. But I am buying Leopard for the Back to my mac, intra-network computer access in Finder, Time Machine, Mail, and the new iChat. That’s it.
What did you guys think?
Tuesday, May 29
iPhone day
Yes, I did get the iPhone. It’s a funny funny story, and I’ll write it all down along with my review of the phone after it activates.
Since everyone is activating their iPhone right now, it’s taking a long time (according to the nice AT&T lady I am on the phone with)
The phone is alot nicer then I thought, nice screen, and since I actually used an iPhone at the store, the keyboard is alot better than I thought.
I just got off the phone with the AT&T rep, she said it may take up until 7 pm tomorrow to activate all the iPhones. Hopefully mine isn’t that deep in the queue.
More later, stay tuned.
Added Story -- Okay..
So, I got off of work at the customer I was at and was going to head up to the Apple Soho store. From where I was at, (World Trade Center) I had to walk up and catch the R/W Subway lines at City Hall. About 2.5 blocks. Not a bad walk.
On the way there, I passed an AT&T store. Having researched all the AT&T locations listed on their site, knowing that AT&T said the closest site was on Wall St, I figured this one was ‘unmapped’. The line had about 35 people in it. Not too bad. So I jumped in.
We kept having to move the line, since the people were waiting in line were blocking the ghetto ass stores that were around the location (on Broadway), and their managers kept coming out and hollering at the AT&T manager (PEOPLE GET OVER IT, IT’S ONE DAY!), even calling the cops at one point.
So we kept having to move, which meant that we were being crammed in tighter and tighter spaces with more and more people. It wasn’t awful, just crowded.
2.5 hours.
6pm rolled around, the started letting people in about 15 at a time. The first group went in, (the first lady in line sold her place/phone for 1500 bucks. Not too bad I guess, and another guy sold his place in line for 300.) About 10 people left to go in, (in front of me, there were about 100 people behind me), and they announced they were out of the 8Gig model. So, I was at this point kind of disappointed and figured I would buy a 4 Gig for Ebay or something.
5 ppl left, they ran out. So, they told us we could order one. Since we had heard that the wait outside the SoHo store was around the block, I ordered an 8 Gig phone, and went back to my hotel.
I got back to the hotel, head hung low, and feet sore from standing, i jumped online, only to be greeted by everyone’s pictures of their damn iPhones.
So I got frustrated, and got up and jumped on the subway and went to the SoHo store like I had originally intended to.
Got there. No line. Said to the ‘bouncer’ out front, ‘You guys have any phones?’ Plenty he said.
Went inside, and they had thousands. Literally tens of thousands of phones behind the counter. I should have taken a picture but my camera was dead.
If anyone has a picture of the inside of the Soho store on Friday, please email it to me.
So, I got my phone, and updated my “Apple Store Visits” page. Read here for iPhone review.
Since everyone is activating their iPhone right now, it’s taking a long time (according to the nice AT&T lady I am on the phone with)
The phone is alot nicer then I thought, nice screen, and since I actually used an iPhone at the store, the keyboard is alot better than I thought.
I just got off the phone with the AT&T rep, she said it may take up until 7 pm tomorrow to activate all the iPhones. Hopefully mine isn’t that deep in the queue.
More later, stay tuned.
Added Story -- Okay..
So, I got off of work at the customer I was at and was going to head up to the Apple Soho store. From where I was at, (World Trade Center) I had to walk up and catch the R/W Subway lines at City Hall. About 2.5 blocks. Not a bad walk.
On the way there, I passed an AT&T store. Having researched all the AT&T locations listed on their site, knowing that AT&T said the closest site was on Wall St, I figured this one was ‘unmapped’. The line had about 35 people in it. Not too bad. So I jumped in.
We kept having to move the line, since the people were waiting in line were blocking the ghetto ass stores that were around the location (on Broadway), and their managers kept coming out and hollering at the AT&T manager (PEOPLE GET OVER IT, IT’S ONE DAY!), even calling the cops at one point.
So we kept having to move, which meant that we were being crammed in tighter and tighter spaces with more and more people. It wasn’t awful, just crowded.
2.5 hours.
6pm rolled around, the started letting people in about 15 at a time. The first group went in, (the first lady in line sold her place/phone for 1500 bucks. Not too bad I guess, and another guy sold his place in line for 300.) About 10 people left to go in, (in front of me, there were about 100 people behind me), and they announced they were out of the 8Gig model. So, I was at this point kind of disappointed and figured I would buy a 4 Gig for Ebay or something.
5 ppl left, they ran out. So, they told us we could order one. Since we had heard that the wait outside the SoHo store was around the block, I ordered an 8 Gig phone, and went back to my hotel.
I got back to the hotel, head hung low, and feet sore from standing, i jumped online, only to be greeted by everyone’s pictures of their damn iPhones.
So I got frustrated, and got up and jumped on the subway and went to the SoHo store like I had originally intended to.
Got there. No line. Said to the ‘bouncer’ out front, ‘You guys have any phones?’ Plenty he said.
Went inside, and they had thousands. Literally tens of thousands of phones behind the counter. I should have taken a picture but my camera was dead.
If anyone has a picture of the inside of the Soho store on Friday, please email it to me.
So, I got my phone, and updated my “Apple Store Visits” page. Read here for iPhone review.
iPhone day
Yes, I did get the iPhone. It’s a funny funny story, and I’ll write it all down along with my review of the phone after it activates.
Since everyone is activating their iPhone right now, it’s taking a long time (according to the nice AT&T lady I am on the phone with)
The phone is alot nicer then I thought, nice screen, and since I actually used an iPhone at the store, the keyboard is alot better than I thought.
I just got off the phone with the AT&T rep, she said it may take up until 7 pm tomorrow to activate all the iPhones. Hopefully mine isn’t that deep in the queue.
More later, stay tuned.
Added Story -- Okay..
So, I got off of work at the customer I was at and was going to head up to the Apple Soho store. From where I was at, (World Trade Center) I had to walk up and catch the R/W Subway lines at City Hall. About 2.5 blocks. Not a bad walk.
On the way there, I passed an AT&T store. Having researched all the AT&T locations listed on their site, knowing that AT&T said the closest site was on Wall St, I figured this one was ‘unmapped’. The line had about 35 people in it. Not too bad. So I jumped in.
We kept having to move the line, since the people were waiting in line were blocking the ghetto ass stores that were around the location (on Broadway), and their managers kept coming out and hollering at the AT&T manager (PEOPLE GET OVER IT, IT’S ONE DAY!), even calling the cops at one point.
So we kept having to move, which meant that we were being crammed in tighter and tighter spaces with more and more people. It wasn’t awful, just crowded.
2.5 hours.
6pm rolled around, the started letting people in about 15 at a time. The first group went in, (the first lady in line sold her place/phone for 1500 bucks. Not too bad I guess, and another guy sold his place in line for 300.) About 10 people left to go in, (in front of me, there were about 100 people behind me), and they announced they were out of the 8Gig model. So, I was at this point kind of disappointed and figured I would buy a 4 Gig for Ebay or something.
5 ppl left, they ran out. So, they told us we could order one. Since we had heard that the wait outside the SoHo store was around the block, I ordered an 8 Gig phone, and went back to my hotel.
I got back to the hotel, head hung low, and feet sore from standing, i jumped online, only to be greeted by everyone’s pictures of their damn iPhones.
So I got frustrated, and got up and jumped on the subway and went to the SoHo store like I had originally intended to.
Got there. No line. Said to the ‘bouncer’ out front, ‘You guys have any phones?’ Plenty he said.
Went inside, and they had thousands. Literally tens of thousands of phones behind the counter. I should have taken a picture but my camera was dead.
If anyone has a picture of the inside of the Soho store on Friday, please email it to me.
So, I got my phone, and updated my “Apple Store Visits” page. Read here for iPhone review.
Since everyone is activating their iPhone right now, it’s taking a long time (according to the nice AT&T lady I am on the phone with)
The phone is alot nicer then I thought, nice screen, and since I actually used an iPhone at the store, the keyboard is alot better than I thought.
I just got off the phone with the AT&T rep, she said it may take up until 7 pm tomorrow to activate all the iPhones. Hopefully mine isn’t that deep in the queue.
More later, stay tuned.
Added Story -- Okay..
So, I got off of work at the customer I was at and was going to head up to the Apple Soho store. From where I was at, (World Trade Center) I had to walk up and catch the R/W Subway lines at City Hall. About 2.5 blocks. Not a bad walk.
On the way there, I passed an AT&T store. Having researched all the AT&T locations listed on their site, knowing that AT&T said the closest site was on Wall St, I figured this one was ‘unmapped’. The line had about 35 people in it. Not too bad. So I jumped in.
We kept having to move the line, since the people were waiting in line were blocking the ghetto ass stores that were around the location (on Broadway), and their managers kept coming out and hollering at the AT&T manager (PEOPLE GET OVER IT, IT’S ONE DAY!), even calling the cops at one point.
So we kept having to move, which meant that we were being crammed in tighter and tighter spaces with more and more people. It wasn’t awful, just crowded.
2.5 hours.
6pm rolled around, the started letting people in about 15 at a time. The first group went in, (the first lady in line sold her place/phone for 1500 bucks. Not too bad I guess, and another guy sold his place in line for 300.) About 10 people left to go in, (in front of me, there were about 100 people behind me), and they announced they were out of the 8Gig model. So, I was at this point kind of disappointed and figured I would buy a 4 Gig for Ebay or something.
5 ppl left, they ran out. So, they told us we could order one. Since we had heard that the wait outside the SoHo store was around the block, I ordered an 8 Gig phone, and went back to my hotel.
I got back to the hotel, head hung low, and feet sore from standing, i jumped online, only to be greeted by everyone’s pictures of their damn iPhones.
So I got frustrated, and got up and jumped on the subway and went to the SoHo store like I had originally intended to.
Got there. No line. Said to the ‘bouncer’ out front, ‘You guys have any phones?’ Plenty he said.
Went inside, and they had thousands. Literally tens of thousands of phones behind the counter. I should have taken a picture but my camera was dead.
If anyone has a picture of the inside of the Soho store on Friday, please email it to me.
So, I got my phone, and updated my “Apple Store Visits” page. Read here for iPhone review.
Friday, May 18
Icons are so 1995
Something else I noticed today, I was interested in how the new Finder desktop looks, in ref: the menu bar, the dock, Stacks...etc.. and I noticed something else
There are no icons on the Desktop.
Now, Steve said that one of the reasons that our desktops are so cluttered is because, when we download something, it falls on our Desktop. (True). So they created a Stack to manage all the downloads.
Which, if you strip all the other stuff off the Desktop, (Your Hard-drive icon, your CD/DVD icon (if you have something in the drive), your iDisk icon (if you have one), your other hard-drives, mounted shares...etc.. can all be found in the new Finder, which, can be launched from the most left button on the Dock.
Personally I like this. I don’t use my Desktop icons anyway, I actually shut them off and use my menu bar (at the top) and the Dock (at the bottom) like you are supposed to.
Which it looks like Apple is going to have you do in Leopard. Nice.
There are no icons on the Desktop.
Now, Steve said that one of the reasons that our desktops are so cluttered is because, when we download something, it falls on our Desktop. (True). So they created a Stack to manage all the downloads.
Which, if you strip all the other stuff off the Desktop, (Your Hard-drive icon, your CD/DVD icon (if you have something in the drive), your iDisk icon (if you have one), your other hard-drives, mounted shares...etc.. can all be found in the new Finder, which, can be launched from the most left button on the Dock.
Personally I like this. I don’t use my Desktop icons anyway, I actually shut them off and use my menu bar (at the top) and the Dock (at the bottom) like you are supposed to.
Which it looks like Apple is going to have you do in Leopard. Nice.
Icons are so 1995
Something else I noticed today, I was interested in how the new Finder desktop looks, in ref: the menu bar, the dock, Stacks...etc.. and I noticed something else
There are no icons on the Desktop.
Now, Steve said that one of the reasons that our desktops are so cluttered is because, when we download something, it falls on our Desktop. (True). So they created a Stack to manage all the downloads.
Which, if you strip all the other stuff off the Desktop, (Your Hard-drive icon, your CD/DVD icon (if you have something in the drive), your iDisk icon (if you have one), your other hard-drives, mounted shares...etc.. can all be found in the new Finder, which, can be launched from the most left button on the Dock.
Personally I like this. I don’t use my Desktop icons anyway, I actually shut them off and use my menu bar (at the top) and the Dock (at the bottom) like you are supposed to.
Which it looks like Apple is going to have you do in Leopard. Nice.
There are no icons on the Desktop.
Now, Steve said that one of the reasons that our desktops are so cluttered is because, when we download something, it falls on our Desktop. (True). So they created a Stack to manage all the downloads.
Which, if you strip all the other stuff off the Desktop, (Your Hard-drive icon, your CD/DVD icon (if you have something in the drive), your iDisk icon (if you have one), your other hard-drives, mounted shares...etc.. can all be found in the new Finder, which, can be launched from the most left button on the Dock.
Personally I like this. I don’t use my Desktop icons anyway, I actually shut them off and use my menu bar (at the top) and the Dock (at the bottom) like you are supposed to.
Which it looks like Apple is going to have you do in Leopard. Nice.
Tuesday, May 8
The Snort Book
Finally got my copies of my book today from the publisher. (Only took them a month!) There are alot of comments I could make about the book, positive and negative, but overall, it’s a great resource. In particular the preprocessors chapter (i know, I wrote it) has some good tuning steps and hints that you won’t find elsewhere.
Some chapters are better than others. Some chapters have errors in them (even mine! I mean, really, who begins a TCP conversation with a FIN, ACK? I swear, it was correct in the proof copy!)
I make mention of Stream5 in my chapter at one point, saying that we ‘took a peek at it’, even though I didn’t discuss it at all. At the time of writing Stream5 wasn’t out yet, so I couldn’t really put much in there about it since it was still in beta. I originally had some stuff in there about UDP session tracking being in Stream5, but I took it out. Hence why I “refer” back to it later.
I edited/rewrote another chapter in the book (which shall remain unknown for now), but none of my edits got in the book. When I asked the publisher why, turns out the publisher for this particular book quit in the middle of the book’s publish, so alot of edits didn’t get in there. Hm.. That sucks. Maybe they’ll do an edition two to add in that stuff.
I really like the book overall, I really liked the writing experience, however next time, if asked to write a book, or if I write my own book... i’d like more control over it. Our editors, did a GREAT job with the task that was set before them. I wrote my chapter on my laptop on flights and in hotels. I always got interesting looks when people would look over in a plane and see me just goin to TOWN on the keyboard. (You know how some people just work on excel spreadsheets and what not, it’s always interesting to see people going nuts on their keyboard.)
Go buy the book. You’ll learn alot. I promise. If you read the book, alot of the most common questions are answered. If that doesn’t work, then pop into #snort on irc.freenode.net and ask your question, or pop onto the snort-users mailing list. Chances are, your question not only has been asked already, but we’ll get you the answer right away. See you online!
Addendum --
It was pointed out in a blog comment here that my title was neither “Director” nor did I “develop” an IDS at my last job. (As listed in my bio.) Both true. I’ll admit it. The commenter even went so far as to call me a LIAR. (Yes all in caps). Let me correct/clarify. As I most definitely didn’t mean to ‘lie’.
There was no such thing as “Director” in my last job. My title was “Section Manager”. Originally the title given me at my was “Section Lead”, however, in the politics that ensued after I was ‘promoted’ to the position, it was pointed out to me that “Lead” was reserved for Government employees. I was a contractor. When I sent my bio to a couple of people for proofread, I also sent it to the publisher because of a deadline we had to meet. When the people I sent it to for proofread pointed out “Director”, I said, ‘ah yes’ and emailed the publisher with the correction. Why did I write it in there? In my present job, the equivalent title of the position would have been Director. No one knows what ‘Section Manager’ is. It’s not a real title. ‘Manager’ is a real title, ‘Section Manager’ is one of those made up Government titles. What were my responsibilities? I attended a weekly ‘managers’ meeting, and compiled a weekly report of what the guys did who ‘worked’ for me did. First of all, the guys that worked for me were on a different contract, so I couldn’t tell them what to do anyway. You didn’t get into our section unless you didn’t need to be managed. (You had to be self-sustainable) So, the title really meant nothing. Second of all, no one had one boss. Working on one project, a friend named Jamey was the lead on, Working for the section, I was the lead on, but then my contract lead (Joe) was my boss and wrote my reviews, except he didn’t give me my jobs, another person named Harry did that, his title was “Lead Contractor”, and he was everyones boss, but everyone reported to him directly. Then on top of all that, our Government rep at the office was our boss as well and she was over everyone. After I left, it just got worse with one more layer of boss in the middle there somewhere. As I said, the title didn’t mean much.
That’s what causes people to get other jobs. Some of the best employees I know have left that place because of all the politics.
As to the second point -- Developing an IDS. I did NOT develop an IDS. I DID develop a IDS system of tools that worked together (yes, of course, with some assistance from a couple of friends, mainly on the db side), for passive os fingerprinting, full traffic capture, and then yes, the IDS. Which was Snort. I developed how the tools worked together, and automated all the pieces and parts to keep them all up and running on the multiple sensors I had. When I was asked to help develop the system that is currently in place on a much much larger scale at a sister office, I did. That system is still in place today exactly how I designed it (at the sister office).
The system I developed at my home office has been dismantled and pieced apart and not all the pieces on it are running anymore, mainly because no one knew how it all worked after I left. Why? I am not sure. It was all documented. For the best comparison that I can make to the system I made is sguil. Except without the tcl/tk frontend.
Did I write ‘Director’? Yes. I sure did. To make myself look better and over-inflated and to lie? No, that was not the intention. The intention was to convert my ‘made up’ title into a commercial equivalent. When it was pointed out to me, I did make the correction, and the correction wasn’t published. (add that to the list of things that didn’t get corrected)
Now, the thing that concerns me is, only a few people knew the exact nature of my title while at the RCERT, and out of those people, only a couple would be rude enough to try and bust me out publicly. On my own blog nonetheless. All of those people, both the people I think it is, and the rest of the people at the RCERT have my email address and could have wrote me an email telling me the deal. Everyone has my email address. Hell, it’s on the front page of this blog.
I didn’t appreciate it, even though you were correct, it was rude.
Some chapters are better than others. Some chapters have errors in them (even mine! I mean, really, who begins a TCP conversation with a FIN, ACK? I swear, it was correct in the proof copy!)
I make mention of Stream5 in my chapter at one point, saying that we ‘took a peek at it’, even though I didn’t discuss it at all. At the time of writing Stream5 wasn’t out yet, so I couldn’t really put much in there about it since it was still in beta. I originally had some stuff in there about UDP session tracking being in Stream5, but I took it out. Hence why I “refer” back to it later.
I edited/rewrote another chapter in the book (which shall remain unknown for now), but none of my edits got in the book. When I asked the publisher why, turns out the publisher for this particular book quit in the middle of the book’s publish, so alot of edits didn’t get in there. Hm.. That sucks. Maybe they’ll do an edition two to add in that stuff.
I really like the book overall, I really liked the writing experience, however next time, if asked to write a book, or if I write my own book... i’d like more control over it. Our editors, did a GREAT job with the task that was set before them. I wrote my chapter on my laptop on flights and in hotels. I always got interesting looks when people would look over in a plane and see me just goin to TOWN on the keyboard. (You know how some people just work on excel spreadsheets and what not, it’s always interesting to see people going nuts on their keyboard.)
Go buy the book. You’ll learn alot. I promise. If you read the book, alot of the most common questions are answered. If that doesn’t work, then pop into #snort on irc.freenode.net and ask your question, or pop onto the snort-users mailing list. Chances are, your question not only has been asked already, but we’ll get you the answer right away. See you online!
Addendum --
It was pointed out in a blog comment here that my title was neither “Director” nor did I “develop” an IDS at my last job. (As listed in my bio.) Both true. I’ll admit it. The commenter even went so far as to call me a LIAR. (Yes all in caps). Let me correct/clarify. As I most definitely didn’t mean to ‘lie’.
There was no such thing as “Director” in my last job. My title was “Section Manager”. Originally the title given me at my was “Section Lead”, however, in the politics that ensued after I was ‘promoted’ to the position, it was pointed out to me that “Lead” was reserved for Government employees. I was a contractor. When I sent my bio to a couple of people for proofread, I also sent it to the publisher because of a deadline we had to meet. When the people I sent it to for proofread pointed out “Director”, I said, ‘ah yes’ and emailed the publisher with the correction. Why did I write it in there? In my present job, the equivalent title of the position would have been Director. No one knows what ‘Section Manager’ is. It’s not a real title. ‘Manager’ is a real title, ‘Section Manager’ is one of those made up Government titles. What were my responsibilities? I attended a weekly ‘managers’ meeting, and compiled a weekly report of what the guys did who ‘worked’ for me did. First of all, the guys that worked for me were on a different contract, so I couldn’t tell them what to do anyway. You didn’t get into our section unless you didn’t need to be managed. (You had to be self-sustainable) So, the title really meant nothing. Second of all, no one had one boss. Working on one project, a friend named Jamey was the lead on, Working for the section, I was the lead on, but then my contract lead (Joe) was my boss and wrote my reviews, except he didn’t give me my jobs, another person named Harry did that, his title was “Lead Contractor”, and he was everyones boss, but everyone reported to him directly. Then on top of all that, our Government rep at the office was our boss as well and she was over everyone. After I left, it just got worse with one more layer of boss in the middle there somewhere. As I said, the title didn’t mean much.
That’s what causes people to get other jobs. Some of the best employees I know have left that place because of all the politics.
As to the second point -- Developing an IDS. I did NOT develop an IDS. I DID develop a IDS system of tools that worked together (yes, of course, with some assistance from a couple of friends, mainly on the db side), for passive os fingerprinting, full traffic capture, and then yes, the IDS. Which was Snort. I developed how the tools worked together, and automated all the pieces and parts to keep them all up and running on the multiple sensors I had. When I was asked to help develop the system that is currently in place on a much much larger scale at a sister office, I did. That system is still in place today exactly how I designed it (at the sister office).
The system I developed at my home office has been dismantled and pieced apart and not all the pieces on it are running anymore, mainly because no one knew how it all worked after I left. Why? I am not sure. It was all documented. For the best comparison that I can make to the system I made is sguil. Except without the tcl/tk frontend.
Did I write ‘Director’? Yes. I sure did. To make myself look better and over-inflated and to lie? No, that was not the intention. The intention was to convert my ‘made up’ title into a commercial equivalent. When it was pointed out to me, I did make the correction, and the correction wasn’t published. (add that to the list of things that didn’t get corrected)
Now, the thing that concerns me is, only a few people knew the exact nature of my title while at the RCERT, and out of those people, only a couple would be rude enough to try and bust me out publicly. On my own blog nonetheless.
I didn’t appreciate it, even though you were correct, it was rude.
Unresponsive Finder
Okay. A long time ago (If you read my old blog), you’ll know that my powerbook froze up, accessing files in Finder was unresponsive, and searching with Spotlight was impossible. (Spinning beachball from hell). Well I figured out how to fix it then, and yesterday, my PowerMac Dual G5 started the same exact thing, and I was able to reproduce the fix, so here it is for your problem solving pleasure:
As I stated, Finder and Spotlight become unresponsive. I have no idea what causes this, but I noticed it yesterday when I’d try to open a file, or attach a file to an email, I’d click on the file in Finder’s ‘column’ view, and it would literally take about 20 minutes to get the details of the file in the next column. (Spinning beachball, machine and Finder completely frozen)
Open Terminal, type:
$sudo mdutil -s /
mdutil is the utility that manages your Spotlight store for each drive. You can use mdutil to even index network shares. (which is quite handy) For more information on mdutil, either read the man page, or type:
$sudo mdutil -h
Anyway -- I got sidetracked there. If mdutil -s / takes a long time to run and gives you some crap about not being able to lookup the index status of the “/” drive, then you are experiencing the same problem I was. For some reason OSX’s Spotlight index gets fubar’ed, and when that happens, no more information store (Finder) for you! So let’s fix it. Back in your terminal type:
$sudo mdutil -i off / (This turns off indexing for your drive)
$sudo mdutil -E / (This erases the information store for your drive)
If either one of these two error out, you will have to do it manually, skip the next step then read further down.
Now reboot. When your computer comes back up, open a Terminal window and type:
$sudo mdutil -i on /
$top -o cpu
This will bring up top and sort it by cpu usage. If you see ‘mds’ and ‘mdimport’ being in the top 3 or 4 or so, that’s good. OSX is rebuilding your Spotlight cache. Let it do this, and hopefully everything will return to normal. Now, if at any point your command errors out (“Can’t find index status, Can’t erase index” or similar, go to this:)
Now, if all that stuff didn’t work, so let’s fix it manually.
Step 1: Open System Preferences -> Sharing. At the top you will see the hostname of your computer. (Yes, this is the HOSTNAME.) Change this. To anything you want, for some reason Finder is tied to the hostname of your computer and if you change the hostname it magically fixes this problem.
Step 2: Back in your Terminal Window, descend to “/”. ($cd /)
Step 3: Erase your Spotlight cache. (Sounds dangerous doesn’t it? Don’t worry it’ll be rebuilt)
$sudo rm -rf /.Spotlight-V100/ (NOTICE THE DOT, it’s a hidden directory, you’d have to add a -a to your ‘ls’ to see it)
Now reboot. When your computer comes back up, your Spotlight cache will be rebuilt (may take awhile, it took about 3 hours on my Powermac (But it has 3 harddrives in it), then everything should be good to go.
Remember, changing that hostname is the magic step. Don’t forget it.
If this helps you, please leave a comment and let me know. If you have an suggestions to add to this, please leave a comment and let me know.
As I stated, Finder and Spotlight become unresponsive. I have no idea what causes this, but I noticed it yesterday when I’d try to open a file, or attach a file to an email, I’d click on the file in Finder’s ‘column’ view, and it would literally take about 20 minutes to get the details of the file in the next column. (Spinning beachball, machine and Finder completely frozen)
Open Terminal, type:
$sudo mdutil -s /
mdutil is the utility that manages your Spotlight store for each drive. You can use mdutil to even index network shares. (which is quite handy) For more information on mdutil, either read the man page, or type:
$sudo mdutil -h
Anyway -- I got sidetracked there. If mdutil -s / takes a long time to run and gives you some crap about not being able to lookup the index status of the “/” drive, then you are experiencing the same problem I was. For some reason OSX’s Spotlight index gets fubar’ed, and when that happens, no more information store (Finder) for you! So let’s fix it. Back in your terminal type:
$sudo mdutil -i off / (This turns off indexing for your drive)
$sudo mdutil -E / (This erases the information store for your drive)
If either one of these two error out, you will have to do it manually, skip the next step then read further down.
Now reboot. When your computer comes back up, open a Terminal window and type:
$sudo mdutil -i on /
$top -o cpu
This will bring up top and sort it by cpu usage. If you see ‘mds’ and ‘mdimport’ being in the top 3 or 4 or so, that’s good. OSX is rebuilding your Spotlight cache. Let it do this, and hopefully everything will return to normal. Now, if at any point your command errors out (“Can’t find index status, Can’t erase index” or similar, go to this:)
Now, if all that stuff didn’t work, so let’s fix it manually.
Step 1: Open System Preferences -> Sharing. At the top you will see the hostname of your computer. (Yes, this is the HOSTNAME.) Change this. To anything you want, for some reason Finder is tied to the hostname of your computer and if you change the hostname it magically fixes this problem.
Step 2: Back in your Terminal Window, descend to “/”. ($cd /)
Step 3: Erase your Spotlight cache. (Sounds dangerous doesn’t it? Don’t worry it’ll be rebuilt)
$sudo rm -rf /.Spotlight-V100/ (NOTICE THE DOT, it’s a hidden directory, you’d have to add a -a to your ‘ls’ to see it)
Now reboot. When your computer comes back up, your Spotlight cache will be rebuilt (may take awhile, it took about 3 hours on my Powermac (But it has 3 harddrives in it), then everything should be good to go.
Remember, changing that hostname is the magic step. Don’t forget it.
If this helps you, please leave a comment and let me know. If you have an suggestions to add to this, please leave a comment and let me know.
Unresponsive Finder
Okay. A long time ago (If you read my old blog), you’ll know that my powerbook froze up, accessing files in Finder was unresponsive, and searching with Spotlight was impossible. (Spinning beachball from hell). Well I figured out how to fix it then, and yesterday, my PowerMac Dual G5 started the same exact thing, and I was able to reproduce the fix, so here it is for your problem solving pleasure:
As I stated, Finder and Spotlight become unresponsive. I have no idea what causes this, but I noticed it yesterday when I’d try to open a file, or attach a file to an email, I’d click on the file in Finder’s ‘column’ view, and it would literally take about 20 minutes to get the details of the file in the next column. (Spinning beachball, machine and Finder completely frozen)
Open Terminal, type:
$sudo mdutil -s /
mdutil is the utility that manages your Spotlight store for each drive. You can use mdutil to even index network shares. (which is quite handy) For more information on mdutil, either read the man page, or type:
$sudo mdutil -h
Anyway -- I got sidetracked there. If mdutil -s / takes a long time to run and gives you some crap about not being able to lookup the index status of the “/” drive, then you are experiencing the same problem I was. For some reason OSX’s Spotlight index gets fubar’ed, and when that happens, no more information store (Finder) for you! So let’s fix it. Back in your terminal type:
$sudo mdutil -i off / (This turns off indexing for your drive)
$sudo mdutil -E / (This erases the information store for your drive)
If either one of these two error out, you will have to do it manually, skip the next step then read further down.
Now reboot. When your computer comes back up, open a Terminal window and type:
$sudo mdutil -i on /
$top -o cpu
This will bring up top and sort it by cpu usage. If you see ‘mds’ and ‘mdimport’ being in the top 3 or 4 or so, that’s good. OSX is rebuilding your Spotlight cache. Let it do this, and hopefully everything will return to normal. Now, if at any point your command errors out (“Can’t find index status, Can’t erase index” or similar, go to this:)
Now, if all that stuff didn’t work, so let’s fix it manually.
Step 1: Open System Preferences -> Sharing. At the top you will see the hostname of your computer. (Yes, this is the HOSTNAME.) Change this. To anything you want, for some reason Finder is tied to the hostname of your computer and if you change the hostname it magically fixes this problem.
Step 2: Back in your Terminal Window, descend to “/”. ($cd /)
Step 3: Erase your Spotlight cache. (Sounds dangerous doesn’t it? Don’t worry it’ll be rebuilt)
$sudo rm -rf /.Spotlight-V100/ (NOTICE THE DOT, it’s a hidden directory, you’d have to add a -a to your ‘ls’ to see it)
Now reboot. When your computer comes back up, your Spotlight cache will be rebuilt (may take awhile, it took about 3 hours on my Powermac (But it has 3 harddrives in it), then everything should be good to go.
Remember, changing that hostname is the magic step. Don’t forget it.
If this helps you, please leave a comment and let me know. If you have an suggestions to add to this, please leave a comment and let me know.
As I stated, Finder and Spotlight become unresponsive. I have no idea what causes this, but I noticed it yesterday when I’d try to open a file, or attach a file to an email, I’d click on the file in Finder’s ‘column’ view, and it would literally take about 20 minutes to get the details of the file in the next column. (Spinning beachball, machine and Finder completely frozen)
Open Terminal, type:
$sudo mdutil -s /
mdutil is the utility that manages your Spotlight store for each drive. You can use mdutil to even index network shares. (which is quite handy) For more information on mdutil, either read the man page, or type:
$sudo mdutil -h
Anyway -- I got sidetracked there. If mdutil -s / takes a long time to run and gives you some crap about not being able to lookup the index status of the “/” drive, then you are experiencing the same problem I was. For some reason OSX’s Spotlight index gets fubar’ed, and when that happens, no more information store (Finder) for you! So let’s fix it. Back in your terminal type:
$sudo mdutil -i off / (This turns off indexing for your drive)
$sudo mdutil -E / (This erases the information store for your drive)
If either one of these two error out, you will have to do it manually, skip the next step then read further down.
Now reboot. When your computer comes back up, open a Terminal window and type:
$sudo mdutil -i on /
$top -o cpu
This will bring up top and sort it by cpu usage. If you see ‘mds’ and ‘mdimport’ being in the top 3 or 4 or so, that’s good. OSX is rebuilding your Spotlight cache. Let it do this, and hopefully everything will return to normal. Now, if at any point your command errors out (“Can’t find index status, Can’t erase index” or similar, go to this:)
Now, if all that stuff didn’t work, so let’s fix it manually.
Step 1: Open System Preferences -> Sharing. At the top you will see the hostname of your computer. (Yes, this is the HOSTNAME.) Change this. To anything you want, for some reason Finder is tied to the hostname of your computer and if you change the hostname it magically fixes this problem.
Step 2: Back in your Terminal Window, descend to “/”. ($cd /)
Step 3: Erase your Spotlight cache. (Sounds dangerous doesn’t it? Don’t worry it’ll be rebuilt)
$sudo rm -rf /.Spotlight-V100/ (NOTICE THE DOT, it’s a hidden directory, you’d have to add a -a to your ‘ls’ to see it)
Now reboot. When your computer comes back up, your Spotlight cache will be rebuilt (may take awhile, it took about 3 hours on my Powermac (But it has 3 harddrives in it), then everything should be good to go.
Remember, changing that hostname is the magic step. Don’t forget it.
If this helps you, please leave a comment and let me know. If you have an suggestions to add to this, please leave a comment and let me know.
Thursday, April 19
Helping Users with Snort
Recently Paul Melson (PaulM) made some posting to the Snort-users group about a problem he was having with Snort. A couple of us helped him fix it, and now he’s off and running. Paul posted this to his blog:
“Finally, a big thank you to Jason, Joel, and Adam at Sourcefire for being so helpful with this issue. Yes, I'm a paying Sourcefire customer, but they probably didn't know that and it didn't matter to them. That's awesome.”
No Paul, we didn’t know. No Paul, we didn’t care. Yes Paul, we were glad to help. You see, it’s not just about making money. We make money. We’re a vendor. It’s about keeping the customer happy. Whether you are just a Snort user, or an actual customer. If you keep people happy, they like you. Sometimes a question is so stupid you want to beat your head against the wall (that’s in any profession), but it doesn’t mean we don’t want to help. If you have questions about Snort, write in! We’ll help!
“Finally, a big thank you to Jason, Joel, and Adam at Sourcefire for being so helpful with this issue. Yes, I'm a paying Sourcefire customer, but they probably didn't know that and it didn't matter to them. That's awesome.”
No Paul, we didn’t know. No Paul, we didn’t care. Yes Paul, we were glad to help. You see, it’s not just about making money. We make money. We’re a vendor. It’s about keeping the customer happy. Whether you are just a Snort user, or an actual customer. If you keep people happy, they like you. Sometimes a question is so stupid you want to beat your head against the wall (that’s in any profession), but it doesn’t mean we don’t want to help. If you have questions about Snort, write in! We’ll help!
Saturday, March 3
I was Slashdotted, or, my name was.
Is this a step up or a step down in the world of geekdom?
http://it.slashdot.org/article.pl?sid=07/03/02/1553253&from=rss
Funny part is. I didn’t say that. Arrigo did.
http://it.slashdot.org/article.pl?sid=07/03/02/1553253&from=rss
Funny part is. I didn’t say that. Arrigo did.
I was Slashdotted, or, my name was.
Is this a step up or a step down in the world of geekdom?
http://it.slashdot.org/article.pl?sid=07/03/02/1553253&from=rss
Funny part is. I didn’t say that. Arrigo did.
http://it.slashdot.org/article.pl?sid=07/03/02/1553253&from=rss
Funny part is. I didn’t say that. Arrigo did.
Friday, March 2
Vista
Now, I have heard that Vista isn’t all it’s cracked up to be.
No surprise. I did play with it at CompUSA for a few minutes. It’s still Windows. All the GUI stuff you do Bill, can only make it better. But it’s still STINKOWS!!!
This ad from Apple says it best IMO:
apple-getamac-security_480x376.mov
Yeah it’s a bit exaggerated, but dude, annoying.
OSX does require you to put in a password, but to change SYSTEM stuff, and and things like that. That’s what I hear Vista is trying to be like, but I’ve heard it’s much more annoying. Anyone that has both want to weigh in on it?
Classic
Solaris Worm
Okay, so Sun made a whoopsie and committed some code to Login that apparently introduced a vulnerability that existed waaaay back in 1994. (Awesome)
Well it wasn’t long before someone coupled together a shell script and the exploit, packaged it up, and send it flying across the internet.
Now.
1) If you got infected, IMO, it’s your own dumb fault. If you are running Solaris (or ANYTHING) with a publicly facing open port 23 (telnet), you are nuts. Mmmkay?
2) If you didn’t patch or shutoff the vulnerable service when the vulnerability came out. You are just nuts..
Jose Nazario over at Arbor sent this into the Internet Storm Center: this article That outlines it.
If you look at the port graph over at the ISC: Check it out You can see the amount of port 23 scans have shot up.
The thing I want you to pay attention to, is the number of targets shot up to around 50K, but the sources were very very low. An isolated subnet in France. Hmmm..
Anyway, Sun made a “Worm removal script” here that you can use, but lets take a look at it.
The worm creates files in /var/adm and /var/spool/lp called “.profile” -- okay, makes sense.
/var/spool/lp/admins/.lp <-- okay.
/var/adm/sa/.adm <-- okay..
Heres the processes the worm spawns, and how to kill them:
/bin/pkill -9 -u lp 'lpshut|lpsystem|lpadmin|lpmove|lpusers|lpfilter|lpstat|lpd|lpsched|lpc'
/bin/pkill -9 -u adm 'devfsadmd|svcadm|cfgadm|kadmind|zoneadmd|sadm|sysadm|dladm|bootadm|routeadm|uadmin|acctadm|cryptoadm|inetadm|logadm|nlsadmin|sacadm|syseventadmd|ttyadmd|consadmd|metadevadm'
Have fun. While you are at it. get rid of Solaris.
Vista
Now, I have heard that Vista isn’t all it’s cracked up to be.
No surprise. I did play with it at CompUSA for a few minutes. It’s still Windows. All the GUI stuff you do Bill, can only make it better. But it’s still STINKOWS!!!
This ad from Apple says it best IMO:
apple-getamac-security_480x376.mov
Yeah it’s a bit exaggerated, but dude, annoying.
OSX does require you to put in a password, but to change SYSTEM stuff, and and things like that. That’s what I hear Vista is trying to be like, but I’ve heard it’s much more annoying. Anyone that has both want to weigh in on it?
Classic
Solaris Worm
Okay, so Sun made a whoopsie and committed some code to Login that apparently introduced a vulnerability that existed waaaay back in 1994. (Awesome)
Well it wasn’t long before someone coupled together a shell script and the exploit, packaged it up, and send it flying across the internet.
Now.
1) If you got infected, IMO, it’s your own dumb fault. If you are running Solaris (or ANYTHING) with a publicly facing open port 23 (telnet), you are nuts. Mmmkay?
2) If you didn’t patch or shutoff the vulnerable service when the vulnerability came out. You are just nuts..
Jose Nazario over at Arbor sent this into the Internet Storm Center: this article That outlines it.
If you look at the port graph over at the ISC: Check it out You can see the amount of port 23 scans have shot up.
The thing I want you to pay attention to, is the number of targets shot up to around 50K, but the sources were very very low. An isolated subnet in France. Hmmm..
Anyway, Sun made a “Worm removal script” here that you can use, but lets take a look at it.
The worm creates files in /var/adm and /var/spool/lp called “.profile” -- okay, makes sense.
/var/spool/lp/admins/.lp <-- okay.
/var/adm/sa/.adm <-- okay..
Heres the processes the worm spawns, and how to kill them:
/bin/pkill -9 -u lp 'lpshut|lpsystem|lpadmin|lpmove|lpusers|lpfilter|lpstat|lpd|lpsched|lpc'
/bin/pkill -9 -u adm 'devfsadmd|svcadm|cfgadm|kadmind|zoneadmd|sadm|sysadm|dladm|bootadm|routeadm|uadmin|acctadm|cryptoadm|inetadm|logadm|nlsadmin|sacadm|syseventadmd|ttyadmd|consadmd|metadevadm'
Have fun. While you are at it. get rid of Solaris.
Saturday, February 3
OSX, Vista, and Bill Gates
So, here I am, rocking my baby to sleep, and I read some thing that Bill Gates said about Vista vs. Mac security, and how people are breaking into OSX every day....
Here’s what the guy said.
"Nowadays, security guys break the Mac every single day. Every single day, they come out with a total exploit, your machine can be taken over totally. I dare anybody to do that once a month on the Windows machine."
Alrighty.. Surely he was referring to the Month of Apple Bugs, which, granted, had some hacks in it. Now, as any Mac zealot would (me), I said, wtf BILL! You have thrown the Gauntlet. Then I thought about it.
Was it irresponsible for him to say that? To say, bring it on? Endanger my customers, I dare you? Um.. Yup. But is Vista really that much more secure than OSX? Time will tell. Wait until the attacks and the vuln researchers get their fingers on it and autopsy the thing.
Then I read this blog. Which, on Slashdot I would have marked “Insightful”. This page is great. He explains, why, right now, Vista IS more secure than OSX. (yes, I said it). Too bad it took MSFT 5 years and billions of dollars to get it there. As a security professional, which one will I stick with? OSX.
OSX, Vista, and Bill Gates
So, here I am, rocking my baby to sleep, and I read some thing that Bill Gates said about Vista vs. Mac security, and how people are breaking into OSX every day....
Here’s what the guy said.
"Nowadays, security guys break the Mac every single day. Every single day, they come out with a total exploit, your machine can be taken over totally. I dare anybody to do that once a month on the Windows machine."
Alrighty.. Surely he was referring to the Month of Apple Bugs, which, granted, had some hacks in it. Now, as any Mac zealot would (me), I said, wtf BILL! You have thrown the Gauntlet. Then I thought about it.
Was it irresponsible for him to say that? To say, bring it on? Endanger my customers, I dare you? Um.. Yup. But is Vista really that much more secure than OSX? Time will tell. Wait until the attacks and the vuln researchers get their fingers on it and autopsy the thing.
Then I read this blog. Which, on Slashdot I would have marked “Insightful”. This page is great. He explains, why, right now, Vista IS more secure than OSX. (yes, I said it). Too bad it took MSFT 5 years and billions of dollars to get it there. As a security professional, which one will I stick with? OSX.
Thursday, December 28
The Snort Top 10
I work with SNORT®..... constantly. It's my job to do so. I've been using Snort for many years, I teach classes on how to configure it, I teach classes on how to write Snort rules. I've been using Snort and setting up Sourcefire and Snort devices on hundreds of different networks for years on end now.
I am frequently asked questions, many of the questions are the same things over and over again, and I always see the same mistakes being made when setting it up. So, i've compiled a list of the top ten mistakes and commonly misconfigured or overlooked things when configuring everyone's favorite IDS.
None of these override the necessity to read the Snort manual, however. The manual supersedes all Snort books, because as great as these books are, they can't keep up with the fast-paced updates at which Snort is updated. So here goes...
1. The Snort.conf file.
Almost all your options are set in this file. This file should be read line by line, from top to bottom, taking the time to fully understand what each one of the configuration options are. 90% of all the questions I get can be answered by just reviewing the documentation in the snort.conf file.
2. Variables.
At the very top of the Snort.conf file there are variables to be set. The very least of which is "HOME_NET". HOME_NET should ALWAYS be configured. Depending on the placement of your IDS, your HOME_NET is loosely interpreted as "whatever the Snort box is protecting". For instance, on my network, it's 192.168.1.0/24. The whole network is controlled by my router, and no other IP addresses should be on the network unless it has this range. If I *had* other IP's pop on my network, I would definitely not want them treated as mine! Common settings for HOME_NET may be your whole internal network range, such as any RFC 1918 addresses. Depending upon the placement of your sensor (such as at your border) you many want to have your public IP address space in your HOME_NET as well. Remember that only CIDR notation is accepted within the variable notation. 192.168.1.1:254 won't work, neither will 192.168.1.1-254. Only 192.168.1.0/24 will. Another big thing to note is your setting for EXTERNAL_NET. By default, EXTERNAL_NET is set to "any". "Any" includes your HOME_NET. In order to make Snort treat traffic that is NOT in your HOME_NET as EXTERNAL, you can set your EXTERNAL_NET to "!$HOME_NET". Which setting applies to you is dependent upon the placement of your sensor.
3. Frag3 preprocessor.
Snort is able to avoid many different types of evasions. One of the big ones that people think they can slip by on any IDS is through IP fragmentation, or using malicious overlapping and underlapping fragments in order to slip the payload past your IDS's, but have it reassembled correctly on the target.
Okay.. I realized I may have just thrown a big ball at you... Let's back up.
IP fragmentation is when Packet A on Network A is too big to go onto Network B. So the router on the Network A side splits Packet A into Packet A.1, A.2, A.3, and so on, so it's able to fit onto Network B. However, these smaller packets aren't put back together until they reach the final destination IP. Still with me so far right? Cool...
The problem with that is, different operating systems put fragmented packets back together in different orders depending on the type of operating system. (and you thought they were all the same!) Well, the problem with IDS's is, they have absolutely not idea what the Operating Systems are that they are protecting. Frag3 allows you to tell it. Now, without writing a book about the subject, you need to go into the docs/ directory that is enclosed with your Snort tarball and read the README on frag3. (As well as the accompanying section in the Snort manual.)
However, in order to FULLY understand what I am talking about, go read the whitepaper written by Judy Novak. (You have to register to download it) She's one of the authors of the SANS 503 IDS course, one of the designers behind frag3, and currently a Vulnerability Research Team (VRT) employee at Sourcefire.
4. HTTP Inspection preprocessor.
The most misunderstood preprocessor there is. This preprocessor analyzes, normalizes, and alerts on http traffic. The thing to remember is, it's SERVER based. It's meant to analyze traffic coming inbound to your http SERVERS. It basically has two settings, the "global default" setting, which you should set to the majority of your web servers. For instance, are most of your web servers IIS, on port 80? Then you need to set that to the global setting. If only some of your web servers are not IIS, or only some of them are not on port 80, then those need to be specified INDIVIDUALLY, by IP! Does that mean you will have to create a separate line for each of your "non-standard" web servers? Yes! That's the way it's SUPPOSED to work!
5. Portscan preprocessor.
Also very mis-understood piece of code. You need to read the README for the "sfportscan" preprocessor in the docs/ directory. There is no better explanation on how to configure this preprocessor.
6. The rest of the preprocessors, to include the new "dynamic" preprocessors.
All of the preprocessors have configuration lines. Each need to be configured to the networks you are protecting with Snort. Review the documentation for each of them extensively. All the documentation is well written, and is written with the user in mind.
7. Rules.
The Rules in Snort are key. At the bottom of the Snort.conf you will see a bunch of "include" lines. "include $RULE_PATH/web-iis.rules" for example. This line will call the rules file web-iis.rules and load it in at runtime. Alot of people ask "what is the best ruleset to run?" Well, by far the first and foremost ruleset to run the VRT ruleset available after registration here. However, does this mean that you need to run every rule in that ruleset? NO! Take a look at the categories.. pop3.rules, imap.rules, oracle.rules, web-coldfusion.rules, pop2.rules, mysql.rules.. etc... Do you run these services on your network? Do you run pop3? Do you run pop2? Do you run imap? No? Then turn the rule category off! There is no sense in running rules that have no application to your network! All you are doing is potentially creating more work for yourself through false positives, as well as making the Snort engine work harder then it needs to.
"But I hear there are other rulesets besides the VRT set!" YES! There are. There are basically two. The BleedingThreats set available at www.bleedingthreats.com and the Community ruleset. Each of these rulesets is contributed to regularly by YOU the Snort community and each have their own pros and cons. Should you run all three rulesets? Sure! However, you need to go through each rule file, and turn on/off what you are not interested in or what does not apply to your network. For example, do you have Vertias on your network? No? Then go into exploit.rules and shut off the Veritas rules.
8. Output.
Snort can output to syslog, to pcap format (default), to a database, or lastly, to Unified. The "official" recommendation is to unified. The unified file format is the fastest output format coming out of the backend of Snort. Especially when you are trying to output to database! When Snort has to output to a database directly, it has to perform an INSERT into the db... doing so is CPU intensive. Do you want your IDS to be an IDS? Or a database insertion tool? So use Unified! Well, the problem with unified is, you need something that reads unified file format and outputs it into the db, or tcpdump file format you want....
9. Barnyard (or FLoP)
Barnyard reads the unified file format and inserts what it finds into a db, or outputs into tcpdump file format. FLoP is another tool that also reads Snort's output (albeit in a different method) and does what you want with it. Both are excellent tools and both need to be checked out and use the one that's appropriate to you.
10. Rule updates.
However you choose to update your rules is up to you, I recommend Oinkmaster. Nice perl proggie to keep your rules up to date. Just don't forget to register on Snort.org and get your oinkmaster code if you wish to download the VRT registered user set.
Notice that I didn't put a recommendation for any type of Snort log reviewing tool. BASE, Sguil, Placid, etc.. all have their merits and you will want to check out the one that is most appropriate to your situation. However, I do have one recommendation that I will make here... and it's turning into more of a "RULE" now. Do NOT use ACID. Don't get me wrong, ACID was great for it's day, however, with over 200+ bug fixes, feature implementations, and the fact that ACID hasn't been updated in.. going on 4 years now... go with BASE if all you are looking for is an Alert browser. BASE works with your existing ACID db, and is very easy to upgrade to.
So there you go. I hope this helps a bit to get you started down the correct path of tuning Snort. Don't forget to hit the mailing list archives, post to the mailing lists with any questions, look for your local Snort User Group, visit the Snort Forums, or even write into us here at the ISC (several of us use Snort constantly, not just me).. or drop into irc.freenode.net into #snort and say hello! Thanks!
Stay tuned for another article on Snort in the future.. If you have suggestions about what I should write about as far as Snort goes, feel free to write in!
/** Joel Esler **/
Sourcefire and Snort are registered trademarks of Sourcefire.
I am frequently asked questions, many of the questions are the same things over and over again, and I always see the same mistakes being made when setting it up. So, i've compiled a list of the top ten mistakes and commonly misconfigured or overlooked things when configuring everyone's favorite IDS.
None of these override the necessity to read the Snort manual, however. The manual supersedes all Snort books, because as great as these books are, they can't keep up with the fast-paced updates at which Snort is updated. So here goes...
1. The Snort.conf file.
Almost all your options are set in this file. This file should be read line by line, from top to bottom, taking the time to fully understand what each one of the configuration options are. 90% of all the questions I get can be answered by just reviewing the documentation in the snort.conf file.
2. Variables.
At the very top of the Snort.conf file there are variables to be set. The very least of which is "HOME_NET". HOME_NET should ALWAYS be configured. Depending on the placement of your IDS, your HOME_NET is loosely interpreted as "whatever the Snort box is protecting". For instance, on my network, it's 192.168.1.0/24. The whole network is controlled by my router, and no other IP addresses should be on the network unless it has this range. If I *had* other IP's pop on my network, I would definitely not want them treated as mine! Common settings for HOME_NET may be your whole internal network range, such as any RFC 1918 addresses. Depending upon the placement of your sensor (such as at your border) you many want to have your public IP address space in your HOME_NET as well. Remember that only CIDR notation is accepted within the variable notation. 192.168.1.1:254 won't work, neither will 192.168.1.1-254. Only 192.168.1.0/24 will. Another big thing to note is your setting for EXTERNAL_NET. By default, EXTERNAL_NET is set to "any". "Any" includes your HOME_NET. In order to make Snort treat traffic that is NOT in your HOME_NET as EXTERNAL, you can set your EXTERNAL_NET to "!$HOME_NET". Which setting applies to you is dependent upon the placement of your sensor.
3. Frag3 preprocessor.
Snort is able to avoid many different types of evasions. One of the big ones that people think they can slip by on any IDS is through IP fragmentation, or using malicious overlapping and underlapping fragments in order to slip the payload past your IDS's, but have it reassembled correctly on the target.
Okay.. I realized I may have just thrown a big ball at you... Let's back up.
IP fragmentation is when Packet A on Network A is too big to go onto Network B. So the router on the Network A side splits Packet A into Packet A.1, A.2, A.3, and so on, so it's able to fit onto Network B. However, these smaller packets aren't put back together until they reach the final destination IP. Still with me so far right? Cool...
The problem with that is, different operating systems put fragmented packets back together in different orders depending on the type of operating system. (and you thought they were all the same!) Well, the problem with IDS's is, they have absolutely not idea what the Operating Systems are that they are protecting. Frag3 allows you to tell it. Now, without writing a book about the subject, you need to go into the docs/ directory that is enclosed with your Snort tarball and read the README on frag3. (As well as the accompanying section in the Snort manual.)
However, in order to FULLY understand what I am talking about, go read the whitepaper written by Judy Novak. (You have to register to download it) She's one of the authors of the SANS 503 IDS course, one of the designers behind frag3, and currently a Vulnerability Research Team (VRT) employee at Sourcefire.
4. HTTP Inspection preprocessor.
The most misunderstood preprocessor there is. This preprocessor analyzes, normalizes, and alerts on http traffic. The thing to remember is, it's SERVER based. It's meant to analyze traffic coming inbound to your http SERVERS. It basically has two settings, the "global default" setting, which you should set to the majority of your web servers. For instance, are most of your web servers IIS, on port 80? Then you need to set that to the global setting. If only some of your web servers are not IIS, or only some of them are not on port 80, then those need to be specified INDIVIDUALLY, by IP! Does that mean you will have to create a separate line for each of your "non-standard" web servers? Yes! That's the way it's SUPPOSED to work!
5. Portscan preprocessor.
Also very mis-understood piece of code. You need to read the README for the "sfportscan" preprocessor in the docs/ directory. There is no better explanation on how to configure this preprocessor.
6. The rest of the preprocessors, to include the new "dynamic" preprocessors.
All of the preprocessors have configuration lines. Each need to be configured to the networks you are protecting with Snort. Review the documentation for each of them extensively. All the documentation is well written, and is written with the user in mind.
7. Rules.
The Rules in Snort are key. At the bottom of the Snort.conf you will see a bunch of "include" lines. "include $RULE_PATH/web-iis.rules" for example. This line will call the rules file web-iis.rules and load it in at runtime. Alot of people ask "what is the best ruleset to run?" Well, by far the first and foremost ruleset to run the VRT ruleset available after registration here. However, does this mean that you need to run every rule in that ruleset? NO! Take a look at the categories.. pop3.rules, imap.rules, oracle.rules, web-coldfusion.rules, pop2.rules, mysql.rules.. etc... Do you run these services on your network? Do you run pop3? Do you run pop2? Do you run imap? No? Then turn the rule category off! There is no sense in running rules that have no application to your network! All you are doing is potentially creating more work for yourself through false positives, as well as making the Snort engine work harder then it needs to.
"But I hear there are other rulesets besides the VRT set!" YES! There are. There are basically two. The BleedingThreats set available at www.bleedingthreats.com and the Community ruleset. Each of these rulesets is contributed to regularly by YOU the Snort community and each have their own pros and cons. Should you run all three rulesets? Sure! However, you need to go through each rule file, and turn on/off what you are not interested in or what does not apply to your network. For example, do you have Vertias on your network? No? Then go into exploit.rules and shut off the Veritas rules.
8. Output.
Snort can output to syslog, to pcap format (default), to a database, or lastly, to Unified. The "official" recommendation is to unified. The unified file format is the fastest output format coming out of the backend of Snort. Especially when you are trying to output to database! When Snort has to output to a database directly, it has to perform an INSERT into the db... doing so is CPU intensive. Do you want your IDS to be an IDS? Or a database insertion tool? So use Unified! Well, the problem with unified is, you need something that reads unified file format and outputs it into the db, or tcpdump file format you want....
9. Barnyard (or FLoP)
Barnyard reads the unified file format and inserts what it finds into a db, or outputs into tcpdump file format. FLoP is another tool that also reads Snort's output (albeit in a different method) and does what you want with it. Both are excellent tools and both need to be checked out and use the one that's appropriate to you.
10. Rule updates.
However you choose to update your rules is up to you, I recommend Oinkmaster. Nice perl proggie to keep your rules up to date. Just don't forget to register on Snort.org and get your oinkmaster code if you wish to download the VRT registered user set.
Notice that I didn't put a recommendation for any type of Snort log reviewing tool. BASE, Sguil, Placid, etc.. all have their merits and you will want to check out the one that is most appropriate to your situation. However, I do have one recommendation that I will make here... and it's turning into more of a "RULE" now. Do NOT use ACID. Don't get me wrong, ACID was great for it's day, however, with over 200+ bug fixes, feature implementations, and the fact that ACID hasn't been updated in.. going on 4 years now... go with BASE if all you are looking for is an Alert browser. BASE works with your existing ACID db, and is very easy to upgrade to.
So there you go. I hope this helps a bit to get you started down the correct path of tuning Snort. Don't forget to hit the mailing list archives, post to the mailing lists with any questions, look for your local Snort User Group, visit the Snort Forums, or even write into us here at the ISC (several of us use Snort constantly, not just me).. or drop into irc.freenode.net into #snort and say hello! Thanks!
Stay tuned for another article on Snort in the future.. If you have suggestions about what I should write about as far as Snort goes, feel free to write in!
/** Joel Esler **/
Sourcefire and Snort are registered trademarks of Sourcefire.
Subscribe to:
Posts (Atom)
-
Without going off the deep-end here and discussing every single Snort rule keyword, I just wanted to touch on a few modifiers that people so... -
For those of you that haven't heard of DropBox, it's essentially a synced drive that is stored on DropBox's servers (in the clou... -
Recently I needed the ability to grab a domain name (specifically the hostname) out of a URL using Shortcuts. I wanted to integrate this f...
