Sinodun Internet Technologies

Using the Fediverse to Add Comments to a Static Website

Fri, 24 Jan 2025 14:06:30 +0000

Since I migrated this website to HUGO I have been searching for an elegant way to allow comments on our blog posts. I looked at most solutions given in the Hugo Documentation. They all seemed overly complex and involved third party services. So I started thinking if it would be possible to use statuses on Mastodon. It turns out I was not alone and this has been done before several times. I went with a system described by Daniel Pecos Martínez.

Happy 15th Birthday Sinodun!

Wed, 15 Jan 2025 11:52:49 +0000

Today in 2010 we incorporated Sinodun Internet Technologies. It has been a fantastic 15 years with many exciting, enjoyable and interesting projects to work on. We would like to thank all of our customers who have supported us, and also all the grant awarding organisations that have funded our work over the years. It has been a pleasure and privilege to be part of the DNS and standards community during this time. We look forward to continuing to work with the community over the years to come!

New Website

Mon, 14 Oct 2024 12:59:28 +0100

Welcome to our new website. As a side project over the last few months we have migrated from Wordpress to a static Hugo website. It is based on the hugo-bootstrap theme. Anecdotal evidence suggests it is much faster. We use no cookies or any kind of tracking and nothing about our users is recorded unless we need to troubleshoot a problem. See our privacy policy. Since this site is now static, we will post links to all new content on

and encourage any discussion there.

Internet Engineering Services

Thu, 01 Aug 2024 13:09:10 +0100

Along with our network of associates we can provide a variety of Research and Development services including

DNS research and development.
DNS Protocol specification and prototyping.
DNS and DNSSEC consulting.
DNS Privacy expertise and advice.
DNS Training.
Upgrade or migration of business critical DNS infrastructure.
HSM expertise.
Software development.
Project management.
Unix systems administration (FreeBSD, GNU/Linux).

DNS Work and Consultancy

Wed, 31 Jul 2024 15:31:02 +0100

We have a range of experience in DNS protocol development, prototyping and deployment, and also in DNS operations (primarily of TLD services). We are members of DNS-OARC.

DNS-STATS

We have worked on the development of DNS-STATS (in collaboration with ICANN), an Open Source suite of tools for DNS traffic capture and visualization.

ICANN use this software, including for the public front-end, for their IMRS statistics dashboard. Data is collected in C-DNS format (a compact DNS specific capture format defined in RFC 8618 using our implementation called the DNS-STATS Compactor. It is then stored in a Clickhouse database and visualized with a custom Grafana front end. An open source version of the DNS-STATs visualizer is available.

Wiki Js and Katex

Wed, 08 Jun 2022 00:00:00 +0100

I have been playing with Wiki.js, I happened to notice that some math was not getting rendered correctly. Wiki.js uses Katex to render Latex (like) math expressions. I wanted to produce an unordered list of equations like this,

$\braket{v_i|v_i} = 1$ because we are dealing with a unit vector
$\braket{v_1|v_2}=\braket{v_2^*|v_1^*}$
$\braket{v_1\vert(a\vert v_2}+b\ket{v_3})=a\braket{v_1\vert v_2}+b\braket{v_1\vert v_3}$

The markdown to do this looks like

* $\braket{v_i|v_i} = 1$ because we are dealing with a unit vector

Working with Materialized View tables in ClickHouse

Tue, 21 Jan 2020 00:00:00 +0000

There must be something about January which makes John prod me into a blog post about something I’ve just teased out. So here we are, it’s 2020, it’s January, and what is fast (OK, not so fast) becoming an annual tradition.

Today’s post is a selection on snippets on Materialized Views. Materialized Views, if you haven’t met them, are tables automatically populated when data is inserted into some other table.

Junos DHCPv6 DNS Search List

Fri, 01 Mar 2019 00:00:00 +0000

I have been looking at the DHCPv6 server in JUNOS 15.1X49-D160.2. It is easy enough to setup Note: Step 5 is wrong, the first two instructions should have dhcpv6 as the last argument e.g.

set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services dhcpv6

It would be nice to configure the DNS Search List option. The option code for this is 24. So I tried this

set access address-assignment pool my-pool family inet6 dhcp-attributes option 24 array string [ "sinodun.com" "ipv4.sinodun.com" ]

but it didn’t work. There appears to be no examples of how to do this correctly so after reading RFC3315 section 8 and RFC1035 section 3.1 I realised it had to be in uncompressed wire format like this

Executable External Dictionaries in Clickhouse

Mon, 28 Jan 2019 00:00:00 +0000

External dictionaries, a dictionary populated by an external source, are a rather useful way to make data external to ClickHouse accessible when working in ClickHouse. One option for the source of the external data is an executable. I found, though, that the documentation doesn’t clearly tell you how to use this, so here I’m trying to rectify this.

There are two basic types of executable external dictionary, which I’ll call whole file and lookup dictionaries. Let’s look at each in turn. Oh, and I’m using ClickHouse version 18.5.1 for these examples.

Using OpenSSL from inside a chroot

Mon, 29 Jan 2018 00:00:00 +0000

A little something we tripped over this week. We’re providing an experimental DNS-over-TLS server that supports TLS v1.3. Right now TLS v1.3 is still an Internet Draft; in other words, it’s not a finished standard, though close to it. The latest version of the draft is draft 23, support for which was merged into the OpenSSL master branch yesterday, January 25th. Yup, we’re living on the bleeding edge.

Support for the final standard TLS v1.3 will be in the next OpenSSL release, v1.1.1.

More on Debian Jessie/Ubuntu Trusty packet capture woes

Tue, 27 Jun 2017 00:00:00 +0100

Back in September I wrote about a problem we’d come across when capturing traffic with pcap_dispatch() or pcap_next_ex() on Ubuntu Trusty or Debian Jessie. When the traffic was slow, we saw packets not being captured.

We’ve since done a bit more digging. The problem, we think, is a bug in the Linux kernel select() system call. With both pcap_dispatch() and pcap_next_ex() we’re using a central loop that is basically:

pcap_dispatch();
select(pcapfd, timeout);

The length of timeout in the select() call shouldn’t matter. But it does. In our test scenario, set it to 1ms and every packet in a ping to an otherwise idle network connection will be captured. Set it to 2s and most or all will be missed.

Compressing pcap files

Thu, 08 Jun 2017 00:00:00 +0100

Here at Sinodun Towers, we’re often dealing with pcap DNS traffic capture files created on a far distant server. These files need to be compressed, both to save space on the server, and also to speed transfer to our machines.

Traditionally we’ve used gzip for quick but basic compression, and xz when space was more important than CPU and we really needed the best compression we could get. At a recent conference, though, an enthusiastic Facebook employee suggested we take a look at zstd. We’d looked at it quite some time ago, but our contact said it has improved considerably recently. So we thought we’d compare the latest zstd (1.2.0) with current gzip (1.8) and xz (5.2.3) and see how they stack up when you’re dealing with pcap DNS traffic captures.

Packet capture woes with libpcap on Ubuntu Trusty and Debian Jessie

Thu, 29 Sep 2016 00:00:00 +0100

Usually when you’re using libpcap to capture network traffic, your chief worry will be whether or not your application will keep up with the flow of traffic.

Today, though, I’ve stubbed my toe on a problem with traffic that’s too slow. It happens with both Ubuntu Trusty and Debian Jessie. If there’s a gap between packets of more than about 50 milliseconds, the first packet to arrive after the gap will be dropped and you’ll never see it. I was capturing DNS queries and responses, and found that with a query rate of under 20 queries per second you start dropping queries. By the time you’re down to 15 queries per second, nearly every query is dropped.

Juniper SRX mucking with DNS

Mon, 25 Mar 2013 00:00:00 +0000

I was getting some strange DNS answers on the servers in a trust zone on my SRX. All the servers are statically NAT’d to external IP’s and run their own caching resolvers but when I tried to query for the servers A RR I kept getting the internal IP address. No name server either internal or external was serving that A RR. Eventually I realised that it was the SRX changing the answer section of the DNS response. I don’t know if it is on by default, or if I switched it on by mistake but it was the DNS Application Layer Gateway (ALG) trying to help by making use of what it knew about the static NATs. Switching DNS ALG off solved the issue. For a detailed description of what the ALG does see the Junos OS Security Configuration Guide.

About Sinodun IT

Mon, 01 Jan 0001 00:00:00 +0000

Sinodun was co-founded in 2010 by John and Sara Dickinson. The company name comes from the Sinodun Hills (also known as Wittenham Clumps), two wooded chalk hills that are a local landmark near our original office in Oxfordshire. The word Sinodun derives from Celtic for Old Fort.

Sinodun IT is an Internet Engineering company. We work with customers around the world to help them create and implement Internet Protocols.

Meet the Team

Sara Dickinson

Director of Software Development

Open Standards

Mon, 01 Jan 0001 00:00:00 +0000

We have contributed to several Internet Drafts and RFCs at the IETF.

RFCs

RFC9250 DNS over Dedicated QUIC Connections
RFC9103 DNS Zone Transfer over TLS
RFC8901 Multi-Signer DNSSEC Models
RFC8932 (BCP232) Recommendations for DNS Privacy Service Operators – Describes operational, policy and security considerations for DNS operators who choose to offer DNS Privacy services
RFC 8618 Compacted-DNS (C-DNS): A Format for DNS Packet Capture – A DNS specific format for efficient capture of DNS traffic.
RFC8490 DNS Stateful Operations – Internet Draft proposing a new mechanism for per-session DNS signalling
RFC8310 Usage Profiles for DNS over TLS and DNS over DTLS – describes how DNS Privacy clients can authenticate DNS Privacy servers
RFC7858 Specification for DNS over TLS (contributing author)
RFC7828 The edns-tcp-keepalive EDNS0 Option – defines an EDNS0 option to enable idle timeout management of DNS-over-TCP sessions.
RFC7766 DNS Transport over TCP – Implementation Requirements – a bis version of RFC5966, (DNS Transport over TCP – Implementation Requirements)
RFC7583 DNSSEC Key Rollover Timing Considerations – a detailed analysis of the timings involved when performing key rollover in DNSSEC.

Internet Drafts

dnsxml – A standard XML representation of DNS data – a syntax for encoding DNS Resource Records in XML
A name server Data Model – Nameserver control protocol (NSCP): a common control protocol for managing name servers.

Privacy Policy

Mon, 01 Jan 0001 00:00:00 +0000

Sinodun Internet Technologies Ltd Privacy Policy

Summary

We do not use cookies and we do not collect any personal data unless troubleshooting issues with the site.

No personal information is collected unless troubleshooting issues with the site (see below).
No information is stored in the browser.
No information is shared with, sent to or sold to third-parties.
No information is shared with advertising companies.
No information is mined and harvested for personal and behavioural trends.
No information is monetized.

Detailed Privacy Policy

This privacy notice tells you what to expect us to do with your personal information.