Comments

Post a Comment

Popular posts from this blog

Siem architecture

What is SIEM?   Security Information and Event Management solutions are a combination of the formerly disparate product categories of SIM (security information management) and SEM   (security event management). SIEM technology provides real-time analysis of security alerts generated by network hardware and applications. The objective: To help companies respond to attacks faster and organize mountains of log data. Security Information and Event Management (SIEM) technologies take part in a crucial role in addressing the compliance, efficiency, and security needs of an enterprise. The central part of SIEM technologies is the ability to collect security data from all the critical assets on a network and present that data as actionable information via a single interface. SIEM solutions come as software, appliances, or managed services. Increasingly, SIEM solutions are being used to log security data and generate reports for compliance purposes.     SIEM S...
Read more

BAD_ADDRESS FLOOD IN WINDOWS DHCP SERVER

Image
How a single misbehaving client can take down your network Well, not really your entire network but definitely DHCP. I came across a linux client that had issues with assigning an IP address using dhclient. The dhclient process would throw a null pointer exception during the phase in which it attempts to validate the assigned IP address. From here, dhclient sends a DHCPDECLINE message to the server. The DHCPDECLINE message tells the server that something is either wrong with the DHCP parameters or that the client discovered that the IP was in use (through gratuitous ARP or in this case, a failed attempt at sending a gratuitous ARP). cat /var/log/messages  : RFC 1541 states: “If the server receives a DHCPDECLINE message, the client has discovered through some other means that the suggested network address is already in use. The server MUST mark the network address as “not allocated” and SHOULD notify the local system administrator of a possible configuration pr...
Read more

ESXI REMOVE ALL SNAPSHOTS HANGS AT 99%

Image
Check and make sure that the process is actually stuck and not just taking a very long time. To do this, follow these steps: 1. Make sure SSH service is running on the ESXi host Navigate to configuration -> security profile -> services -> Click on Properties Choose the ‘SSH’ service, ‘Options’, and click ‘Start’ Once SSH is enabled, connect to the ESXi host using your favorite ssh client. 2. Run ->   vim - cmd  vmsvc / getallvms Find the vmid of the virtual machine, in this case its 20. 3. Now run ->   vim - cmd  vmsvc / get . tasklist   20 <-   this is the # of the vm from above 4. Find the removeallsnapshots task # then run: vim - cmd  vimsvc / task _ info   185720854  <- this # will be different for you If you see:   “The object has already been deleted or has not been completely created”  or similar, your snapshot removal is probably frozen, but in order to be sure, let’s loo...
Read more