- <title>New laptop - some more clues and ideas based on feedback</title>
- <link>http://people.skolelinux.org/pere/blog/New_laptop___some_more_clues_and_ideas_based_on_feedback.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/New_laptop___some_more_clues_and_ideas_based_on_feedback.html</guid>
- <pubDate>Sun, 5 Jul 2015 21:40:00 +0200</pubDate>
- <description><p>Several people contacted me after my previous blog post about my
-need for a new laptop, and provided very useful feedback. I wish to
-thank every one of these. Several pointed me to the possibility of
-fixing my X230, and I am already in the process of getting Lenovo to
-do so thanks to the on site, next day support contract covering the
-machine. But the battery is almost useless (I expect to replace it
-with a non-official battery) and I do not expect the machine to live
-for many more years, so it is time to plan its replacement. If I did
-not have a support contract, it was suggested to find replacement parts
-using <a href="http://www.francecrans.com/">FrancEcrans</a>, but it
-might present a language barrier as I do not understand French.</p>
-
-<p>One tip I got was to use the
-<a href="https://skinflint.co.uk/?cat=nb">Skinflint</a> web service to
-compare laptop models. It seem to have more models available than
-prisjakt.no. Another tip I got from someone I know have similar
-keyboard preferences was that the HP EliteBook 840 keyboard is not
-very good, and this matches my experience with earlier EliteBook
-keyboards I tested. Because of this, I will not consider it any further.
-
-<p>When I wrote my blog post, I was not aware of Thinkpad X250, the
-newest Thinkpad X model. The keyboard reintroduces mouse buttons
-(which is missing from the X240), and is working fairly well with
-Debian Sid/Unstable according to
-<a href="http://www.corsac.net/X250/">Corsac.net</a>. The reports I
-got on the keyboard quality are not consistent. Some say the keyboard
-is good, others say it is ok, while others say it is not very good.
-Those with experience from X41 and and X60 agree that the X250
-keyboard is not as good as those trusty old laptops, and suggest I
-keep and fix my X230 instead of upgrading, or get a used X230 to
-replace it. I'm also told that the X250 lack leds for caps lock, disk
-activity and battery status, which is very convenient on my X230. I'm
-also told that the CPU fan is running very often, making it a bit
-noisy. In any case, the X250 do not work out of the box with Debian
-Stable/Jessie, one of my requirements.</p>
-
-<p>I have also gotten a few vendor proposals, one was
-<a href="http://pro-star.com">Pro-Star</a>, another was
-<a href="http://shop.gluglug.org.uk/product/libreboot-x200/">Libreboot</a>.
-The latter look very attractive to me.</p>
-
-<p>Again, thank you all for the very useful feedback. It help a lot
-as I keep looking for a replacement.</p>
-
-<p>Update 2015-07-06: I was recommended to check out the
-<a href="">lapstore.de</a> web shop for used laptops. They got several
-different
-<a href="http://www.lapstore.de/f.php/shop/lapstore/f/411/lang/x/kw/Lenovo_ThinkPad_X_Serie/">old
-thinkpad X models</a>, and provide one year warranty.</p>
-</description>
- </item>
-
- <item>
- <title>Time to find a new laptop, as the old one is broken after only two years</title>
- <link>http://people.skolelinux.org/pere/blog/Time_to_find_a_new_laptop__as_the_old_one_is_broken_after_only_two_years.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Time_to_find_a_new_laptop__as_the_old_one_is_broken_after_only_two_years.html</guid>
- <pubDate>Fri, 3 Jul 2015 07:10:00 +0200</pubDate>
- <description><p>My primary work horse laptop is failing, and will need a
-replacement soon. The left 5 cm of the screen on my Thinkpad X230
-started flickering yesterday, and I suspect the cause is a broken
-cable, as changing the angle of the screen some times get rid of the
-flickering.</p>
-
-<p>My requirements have not really changed since I bought it, and is
-still as
-<a href="http://people.skolelinux.org/pere/blog/Thank_you_Thinkpad_X41__for_your_long_and_trustworthy_service.html">I
-described them in 2013</a>. The last time I bought a laptop, I had
-good help from
-<a href="http://www.prisjakt.no/category.php?k=353">prisjakt.no</a>
-where I could select at least a few of the requirements (mouse pin,
-wifi, weight) and go through the rest manually. Three button mouse
-and a good keyboard is not available as an option, and all the three
-laptop models proposed today (Thinkpad X240, HP EliteBook 820 G1 and
-G2) lack three mouse buttons). It is also unclear to me how good the
-keyboard on the HP EliteBooks are. I hope Lenovo have not messed up
-the keyboard, even if the quality and robustness in the X series have
-deteriorated since X41.</p>
-
-<p>I wonder how I can find a sensible laptop when none of the options
-seem sensible to me? Are there better services around to search the
-set of available laptops for features? Please send me an email if you
-have suggestions.</p>
-
-<p>Update 2015-07-23: I got a suggestion to check out the FSF
-<a href="http://www.fsf.org/resources/hw/endorsement/respects-your-freedom">list
-of endorsed hardware</a>, which is useful background information.</p>
+ <title>Where did that package go? &mdash; geolocated IP traceroute</title>
+ <link>http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html</guid>
+ <pubDate>Mon, 9 Jan 2017 12:20:00 +0100</pubDate>
+ <description><p>Did you ever wonder where the web trafic really flow to reach the
+web servers, and who own the network equipment it is flowing through?
+It is possible to get a glimpse of this from using traceroute, but it
+is hard to find all the details. Many years ago, I wrote a system to
+map the Norwegian Internet (trying to figure out if our plans for a
+network game service would get low enough latency, and who we needed
+to talk to about setting up game servers close to the users. Back
+then I used traceroute output from many locations (I asked my friends
+to run a script and send me their traceroute output) to create the
+graph and the map. The output from traceroute typically look like
+this:
+
+<p><pre>
+traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets
+ 1 uio-gw10.uio.no (129.240.202.1) 0.447 ms 0.486 ms 0.621 ms
+ 2 uio-gw8.uio.no (129.240.24.229) 0.467 ms 0.578 ms 0.675 ms
+ 3 oslo-gw1.uninett.no (128.39.65.17) 0.385 ms 0.373 ms 0.358 ms
+ 4 te3-1-2.br1.fn3.as2116.net (193.156.90.3) 1.174 ms 1.172 ms 1.153 ms
+ 5 he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48) 3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.857 ms
+ 6 ae1.ar8.oslosda310.as2116.net (195.0.242.39) 0.662 ms 0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23) 0.622 ms
+ 7 89.191.10.146 (89.191.10.146) 0.931 ms 0.917 ms 0.955 ms
+ 8 * * *
+ 9 * * *
+[...]
+</pre></p>
+
+<p>This show the DNS names and IP addresses of (at least some of the)
+network equipment involved in getting the data traffic from me to the
+www.stortinget.no server, and how long it took in milliseconds for a
+package to reach the equipment and return to me. Three packages are
+sent, and some times the packages do not follow the same path. This
+is shown for hop 5, where three different IP addresses replied to the
+traceroute request.</p>
+
+<p>There are many ways to measure trace routes. Other good traceroute
+implementations I use are traceroute (using ICMP packages) mtr (can do
+both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP
+traceroute and a lot of other capabilities). All of them are easily
+available in <a href="https://www.debian.org/">Debian</a>.</p>
+
+<p>This time around, I wanted to know the geographic location of
+different route points, to visualize how visiting a web page spread
+information about the visit to a lot of servers around the globe. The
+background is that a web site today often will ask the browser to get
+from many servers the parts (for example HTML, JSON, fonts,
+JavaScript, CSS, video) required to display the content. This will
+leak information about the visit to those controlling these servers
+and anyone able to peek at the data traffic passing by (like your ISP,
+the ISPs backbone provider, FRA, GCHQ, NSA and others).</p>
+
+<p>Lets pick an example, the Norwegian parliament web site
+www.stortinget.no. It is read daily by all members of parliament and
+their staff, as well as political journalists, activits and many other
+citizens of Norway. A visit to the www.stortinget.no web site will
+ask your browser to contact 8 other servers: ajax.googleapis.com,
+insights.hotjar.com, script.hotjar.com, static.hotjar.com,
+stats.g.doubleclick.net, www.google-analytics.com,
+www.googletagmanager.com and www.netigate.se. I extracted this by
+asking <a href="http://phantomjs.org/">PhantomJS</a> to visit the
+Stortinget web page and tell me all the URLs PhantomJS downloaded to
+render the page (in HAR format using
+<a href="https://github.com/ariya/phantomjs/blob/master/examples/netsniff.js">their
+netsniff example</a>. I am very grateful to Gorm for showing me how
+to do this). My goal is to visualize network traces to all IP
+addresses behind these DNS names, do show where visitors personal
+information is spread when visiting the page.</p>
+
+<p align="center"><a href="www.stortinget.no-geoip.kml"><img
+src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geoip-small.png" alt="map of combined traces for URLs used by www.stortinget.no using GeoIP"/></a></p>
+
+<p>When I had a look around for options, I could not find any good
+free software tools to do this, and decided I needed my own traceroute
+wrapper outputting KML based on locations looked up using GeoIP. KML
+is easy to work with and easy to generate, and understood by several
+of the GIS tools I have available. I got good help from by NUUG
+colleague Anders Einar with this, and the result can be seen in
+<a href="https://github.com/petterreinholdtsen/kmltraceroute">my
+kmltraceroute git repository</a>. Unfortunately, the quality of the
+free GeoIP databases I could find (and the for-pay databases my
+friends had access to) is not up to the task. The IP addresses of
+central Internet infrastructure would typically be placed near the
+controlling companies main office, and not where the router is really
+located, as you can see from <a href="www.stortinget.no-geoip.kml">the
+KML file I created</a> using the GeoLite City dataset from MaxMind.
+
+<p align="center"><a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg"><img
+src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy-small.png" alt="scapy traceroute graph for URLs used by www.stortinget.no"/></a></p>
+
+<p>I also had a look at the visual traceroute graph created by
+<a href="http://www.secdev.org/projects/scapy/">the scrapy project</a>,
+showing IP network ownership (aka AS owner) for the IP address in
+question.
+<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg">The
+graph display a lot of useful information about the traceroute in SVG
+format</a>, and give a good indication on who control the network
+equipment involved, but it do not include geolocation. This graph
+make it possible to see the information is made available at least for
+UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level
+3 Communications and NetDNA.</p>
+
+<p align="center"><a href="https://geotraceroute.com/index.php?node=4&host=www.stortinget.no"><img
+src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-small.png" alt="example geotraceroute view for www.stortinget.no"/></a></p>
+
+<p>In the process, I came across the
+<a href="https://geotraceroute.com/">web service GeoTraceroute</a> by
+Salim Gasmi. Its methology of combining guesses based on DNS names,
+various location databases and finally use latecy times to rule out
+candidate locations seemed to do a very good job of guessing correct
+geolocation. But it could only do one trace at the time, did not have
+a sensor in Norway and did not make the geolocations easily available
+for postprocessing. So I contacted the developer and asked if he
+would be willing to share the code (he refused until he had time to
+clean it up), but he was interested in providing the geolocations in a
+machine readable format, and willing to set up a sensor in Norway. So
+since yesterday, it is possible to run traces from Norway in this
+service thanks to a sensor node set up by
+<a href="https://www.nuug.no/">the NUUG assosiation</a>, and get the
+trace in KML format for further processing.</p>
+
+<p align="center"><a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.kml"><img
+src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.png" alt="map of combined traces for URLs used by www.stortinget.no using geotraceroute"/></a></p>
+
+<p>Here we can see a lot of trafic passes Sweden on its way to
+Denmark, Germany, Holland and Ireland. Plenty of places where the
+Snowden confirmations verified the traffic is read by various actors
+without your best interest as their top priority.</p>
+
+<p>Combining KML files is trivial using a text editor, so I could loop
+over all the hosts behind the urls imported by www.stortinget.no and
+ask for the KML file from GeoTraceroute, and create a combined KML
+file with all the traces (unfortunately only one of the IP addresses
+behind the DNS name is traced this time. To get them all, one would
+have to request traces using IP number instead of DNS names from
+GeoTraceroute). That might be the next step in this project.</p>
+
+<p>Armed with these tools, I find it a lot easier to figure out where
+the IP traffic moves and who control the boxes involved in moving it.
+And every time the link crosses for example the Swedish border, we can
+be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in
+Britain and NSA in USA and cables around the globe. (Hm, what should
+we tell them? :) Keep that in mind if you ever send anything
+unencrypted over the Internet.</p>
+
+<p>PS: KML files are drawn using
+<a href="http://ivanrublev.me/kml/">the KML viewer from Ivan
+Rublev<a/>, as it was less cluttered than the local Linux application
+Marble. There are heaps of other options too.</p>
+
+<p>As usual, if you use Bitcoin and want to show your support of my
+activities, please send Bitcoin donations to my address
+<b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&label=PetterReinholdtsenBlog">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
projects / homepage.git / blobdiff