This week, we:

• got 11,732 messages from 232 different IP addresses.
• handled 18,216 sessions from 1,165 different IP addresses.
• received 189,951 connections from at least 55,941 different IPaddresses.
• hit a highwater of 7 connections being checked at once.

This is all down from last week , and I haveno explanation for why the messages received count is down so much; itis normally quite

In no particular order:

• point to point GRE tunnels have to be symmetric, where each end is amirror image of the other. Otherwise the destination kernel willreject the inbound GRE packets, which makes sense from a securityperspective once you think about it.

• GRE tunnels require a local IP address before you can point routes atthem; I suspect that this is generic behavior and is so that the kernelknows what default origin IP address to put on packets going out throughthem.
• because GRE tunnels are network devices,

I normally expect IP tunnels to be opaque , that is to act as if theywere physical links: the packet is sent down one end and pops out theother end unchanged, just as if it went over a connection betweentwo routers, and the tunnel itself is indifferent to the details ofthe packets it is transporting. (The technical ISO way of describingthis is that I expect IP tunnels to act entirely as layer 2 entities.)

However, one of the peculiarities of GRE is that itis a translucent

I just got IPSec doing exactly what I need it to do. Unfortunately itturns out not to do me any good.

The problem is with tunnel mode IPSec, which has a cascade of issues.First, IPSec tunnels don't create actual network devices. This soundsharmless, except that you need a network device to establish routesand thus say things like 'network foo/24 is reachable over this IPSectunnel'.

IPSec deals with this with black magic involving Security PolicyDescriptors. If you add an

One of the tricky bits of organizing a sufficiently large group ofmachines is avoiding circular dependencies in the machine startup order,so that you can actually bring your systems up after things like acomplete machine room power outage.

(In our case it was planned; the electricians wanted the master breakersoff before they played around in our breaker panel to give us more usablecircuits.)

Startup order dependencies come in a variety of flavours. The simpleone is a startup script that depends on another machine being up, forexample

The Computer Science department has been using its primary machine roomfor at least 25 years, and it's a proper machine room, complete with araised floor. (People with the right sort of experience are now wincing.)

The problem is best illustrated by an anecdote: we just recently tookout some hybrid 208V plus 120V power circuits that we believe were putin to power old Vaxes (which would make them obsolete for going on 20years). We didn'

WanderingThoughts has been pretty free of successful comment spamattempts for a while, so I think it's about time to write up all ofthe various things I'm currently doing to stop comment spammers.

(I'm not worried about comment spammers reading this and working past myprecautions, because I'm confidant that comment spammers don't botherreading the blogs they spam.)

First off, I get a big leg up by being neither popular nor using commonsoftware. This basically reduces the comment spammers

There's a widespread view that a good way of deprecating something isto have the new version of your project emit warning messages when itruns across code using whatever you're getting rid of. The theory goesthat this is pretty harmless; the people using the to be removed featurewill get notified about the situation but can fix their code at relativeleisure, because things still work.

As a working Unix system administrator, allow me to disagree violently.To sysadmins, a program's output or its lack

Almost all Python objects implement their namespace as a Pythondictionary, which they expose as their __dict__ member. You can dointeresting things by playing around with this dictionary directly,for example adding bulk name/value mappings to an object by just doingsomething like obj.__dict__.update(pairs ).

I don't like doing this, because I consider __dict__ to be animplementation detail, or at least fairly magical, and thus I feel thatI