damianzaremba.co.uk Report : Visit Site

Technical data of the damianzaremba.co.uk

Geo IP provides you such as latitude, longitude and ISP (Internet Service Provider) etc. informations. Our GeoIP service found where is host damianzaremba.co.uk. Currently, hosted in Singapore and its service provider is CloudFlare Inc. .

HTTP Header Analysis

HTTP Header information is a part of HTTP protocol that a user's browser sends to called cloudflare containing the details of what the browser wants and will accept back from the web server.

DNS

HtmlToText

toggle navigation damian zaremba blog about cv archive projects decoding ipfix options using go 28 dec 2017 comments network how-to go the ipfix (ip flow information export) protocol provides an extensible standard for transmitting network flow data. a key difference compared to the likes of sflow , is the template-based nature of data. while very similar to netflow version 9, ipfix enables variable length fields and vendor extensions. this makes the protocol suitable for different types of performance data, as desired by any vendor. a recent project required some processing of ipfix flow data, which this post will focus on. tl;dr the full implementation can be found on github parsing options a number of ipfix decoder implementations exist in go, most are included in flow decoder implementations, rather than standalone libraries. the best stand-alone library i could fix is github.com/calmh/ipfix , but this doesn't support decoding options . to better understand the scope of implementation and overall structure of ipfix, a stand-alone decoder was implemented. data structure to begin implementing our own decoder, we first need to understand the format of packets used in ipfix. we can use both the iana field assignments and rfc to construct our base expectations. at a high level, there is 1 common header then 3 different payload types data template options template data set we are interested in the options template and data set (where we have a matching template id, more on this later). decoding the header as described in the rfc , we can expect 5 fields. followed by the message header we have a set identifier, which describes the message contents; for our purposes, we will use this as part of the header. header := ipfixheader{ version: binary.bigendian.uint16(payload[0:2]), messagelength: binary.bigendian.uint16(payload[2:4]), exporttime: binary.bigendian.uint32(payload[4:8]), sequencenumber: binary.bigendian.uint32(payload[8:12]), domainid: binary.bigendian.uint32(payload[12:16]), setid: binary.bigendian.uint16(payload[16:20]), } we are interested in any setid that is 3 (options template) or >= 256 (data set). decoding the template before any data can be decoded, we must have a matching template. without the template, there is no way to know how the fields are mapped inside the data set. each template payload (setid 2 or 3) has a header containing the id and field counts. template := optionstemplate{ templateid: binary.bigendian.uint16(payload[0:2]), fieldcount: binary.bigendian.uint16(payload[2:4]), scopefieldcount: binary.bigendian.uint16(payload[4:6]), } once again, using the rfc , we can determine the payload is a sequence of field separators. the number of separators corresponds to the values in the header we just decoded. the ordering of these fields is critical for us to maintain. note: unlike a data template, the options template has a set of scope fields. decode the fields both scope fields and fields have the same structure, thus can be decoded using the same logic. func decodesingletemplatefield(payload []byte) (templatefield, int) { tf := templatefield{ elementid: binary.bigendian.uint16(payload[0:2]), length: binary.bigendian.uint16(payload[2:4]), } if tf.elementid > 0x8000 { tf.elementid = tf.elementid & 0x7fff tf.enterprisenumber = binary.bigendian.uint32(payload[0:4]) return tf, 8 } return tf, 4 } it's then simply a case of decoding each field in sequence and storing them for later // get all scope entries for i := template.scopefieldcount; i > 0; i-- { tf, cut := decodesingletemplatefield(byteslice) template.scopefield = append(template.scopefield, tf) if len(byteslice) < cut { break } byteslice = byteslice[cut:] } // get all field entries for i := template.fieldcount - template.scopefieldcount; i > 0; i-- { tf, cut := decodesingletemplatefield(byteslice) template.field = append(template.field, tf) if len(byteslice) < cut { break } byteslice = byteslice[cut:] } cache the template now we have the template decoded, it is important to store it. the fields described in the template need to be used when decoding the data set, which we will look at next. a simple way to store this is using the lru cache implementation from hashicorp, github.com/hashicorp/golang-lru . all future lookups will be via the id, so using this as the key make sense. templatecache, err := lru.new(10240) if err != nil { log.fatalf("failed to setup options template cache: %v", err) } templatecache.add(template.id, template) decoding the data set any set id over 255 represents a data set, the set id refers to the template we need to use when decoding the data set. first, we need to ensure we have a matching template for this payload. cacheentry, ok := templatecache.get(header.setid) if !ok { return nil, true } template := cacheentry.(optionstemplate) once we have the template, it's a case of decoding each option in sequence. again, both scope fields and fields can be decoded using the same logic. field decoding the option decoding logic has 3 main tasks: read the correct length of bytes off the payload lookup the associated name of the field from the identifier cast the byte array into the correct data type for the identifier the iana field assignments accurately describe the field data we need to complete these tasks. func decodesingleoption(byteslice []byte, field templatefield, options options) { // check we have enough data if len(byteslice) < int(field.length) { return } // handle each enterprise switch field.enterprisenumber { case 0: // handle elements for enterprise 0 switch field.elementid { case 34: // samplinginterval options["samplinginterval"] = binary.bigendian.uint32(byteslice[:int(field.length)]) case 36: // flowactivetimeout options["flowactivetimeout"] = binary.bigendian.uint16(byteslice[:int(field.length)]) case 37: // flowidletimeout options["flowidletimeout"] = binary.bigendian.uint16(byteslice[:int(field.length)]) case 41: // exportedmessagetotalcount options["exportedmessagetotalcount"] = binary.bigendian.uint64(byteslice[:int(field.length)]) case 42: // exportedflowrecordtotalcount options["exportedflowrecordtotalcount"] = binary.bigendian.uint64(byteslice[:int(field.length)]) case 130: // exporteripv4address options["exporteripv4address"] = net.ip(byteslice[:int(field.length)]) case 131: // exporteripv6address options["exporteripv6address"] = net.ip(byteslice[:int(field.length)]) case 144: // exportingprocessid options["exportingprocessid"] = binary.bigendian.uint32(byteslice[:int(field.length)]) case 160: // systeminittimemilliseconds options["exportingprocessid"] = int64(binary.bigendian.uint64(byteslice[:int(field.length)])) case 214: // exportprotocolversion options["exportprotocolversion"] = uint8(byteslice[0]) case 215: // exporttransportprotocol options["exporttransportprotocol"] = uint8(byteslice[0]) } } } the order of fields in the data set is identical to the order in the template, so once again it's just a case of looping over them. // read all scope field separators for i := 0; i < len(template.scopefield); i++ { decodesingleoption(byteslice, template.scopefield[i], options) if len(byteslice) < int(template.scopefield[i].length) { break } byteslice = byteslice[int(template.scopefield[i].length):] } // read all field separators for i := 0; i < len(template.field); i++ { decodesingleoption(byteslice, template.field[i], options) if len(byteslice) < int(template.field[i].length) { break } byteslice = byteslice[int(template.field[i].length):] } result we now have a subset of the iana fields supported in our decoder. given a correct template and data payload, the result is a map of received options. map[ exportedmessagetotalcount: 250 exportedflowrecordtotalcount: 10 samplinginterval: 10 flowidletimeout: 15 exportingprocessid: 72 exporteripv4address: 192.168.0.1 exporteripv6address: :: flowactivetimeout: 60 exportprotocolversion: 10 exporttransportprotocol: 17 ] summary ipfix is a highly flexible pro

URL analysis for damianzaremba.co.uk

http://damianzaremba.co.uk/2017/12/decoding-ipfix-options-using-go/#disqus_thread
http://damianzaremba.co.uk/tag/go
http://damianzaremba.co.uk/2017/12/cluebot-wikimedia-labs-setup/#disqus_thread
http://damianzaremba.co.uk/2017/12/a-look-at-low-cost-tap-aggregation/
http://damianzaremba.co.uk/2/
http://damianzaremba.co.uk/tag/how-to
http://damianzaremba.co.uk/2017/12/decoding-ipfix-options-using-go/
http://damianzaremba.co.uk/2017/12/cluebot-wikimedia-labs-setup/
http://damianzaremba.co.uk/tag/general
http://damianzaremba.co.uk/projects/
http://damianzaremba.co.uk/cv/
http://damianzaremba.co.uk/tag/security
http://damianzaremba.co.uk/tag/foss
http://damianzaremba.co.uk/2017/12/decoding-arista-ethertype-headers-with-gopacket/#disqus_thread
http://damianzaremba.co.uk/github.com/hashicorp/golang-lru

Whois Information

Whois is a protocol that is access to registering information. You can reach when the website was registered, when it will be expire, what is contact details of the site with the following informations. In a nutshell, it includes these informations;

Domain name:
damianzaremba.co.uk

Data validation:
Nominet was able to match the registrant's name and address against a 3rd party data source on 24-Aug-2016

Registrar:
GoDaddy.com, LLP. [Tag = GODADDY]
URL: http://uk.godaddy.com

Relevant dates:
Registered on: 12-Jun-2009
Expiry date: 12-Jun-2019
Last updated: 22-May-2018

Registration status:
Registered until expiry date.

Name servers:
ian.ns.cloudflare.com
pam.ns.cloudflare.com

WHOIS lookup made at 06:52:41 13-Oct-2018

--
This WHOIS information is provided for free by Nominet UK the central registry
for .uk domain names. This information and the .uk WHOIS are:

Copyright Nominet UK 1996 - 2018.

You may not access the .uk WHOIS or use any data from it except as permitted
by the terms of use available in full at https://www.nominet.uk/whoisterms,
which includes restrictions on: (A) use of the data for advertising, or its
repackaging, recompilation, redistribution or reuse (B) obscuring, removing
or hiding any or all of this notice and (C) exceeding query rate or volume
limits. The data is provided on an 'as-is' basis and may lag behind the
register. Access may be withdrawn or restricted at any time.

  REFERRER http://www.nominet.org.uk

  REGISTRAR Nominet UK

SERVERS

  SERVER co.uk.whois-servers.net

  ARGS damianzaremba.co.uk

  PORT 43

  TYPE domain

DOMAIN

SPONSOR
GoDaddy.com, LLP. [Tag = GODADDY]
URL: http://uk.godaddy.com
Relevant dates:

  CREATED 12-Jun-2009

  CHANGED 22-May-2018

STATUS
Registered until expiry date.

NSERVER

  IAN.NS.CLOUDFLARE.COM 173.245.59.118

  PAM.NS.CLOUDFLARE.COM 173.245.58.138

  NAME damianzaremba.co.uk

DISCLAIMER
This WHOIS information is provided for free by Nominet UK the central registry
for .uk domain names. This information and the .uk WHOIS are:
Copyright Nominet UK 1996 - 2018.
You may not access the .uk WHOIS or use any data from it except as permitted
by the terms of use available in full at https://www.nominet.uk/whoisterms,
which includes restrictions on: (A) use of the data for advertising, or its
repackaging, recompilation, redistribution or reuse (B) obscuring, removing
or hiding any or all of this notice and (C) exceeding query rate or volume
limits. The data is provided on an 'as-is' basis and may lag behind the
register. Access may be withdrawn or restricted at any time.

  REGISTERED no

Mistakes

The following list shows you to spelling mistakes possible of the internet users for the website searched .