Mysql Slice a resultset

Slicing a mysql result is easy with

select from_unixtime(unix_timestamp(timestamp) -unix_timestamp(timestamp) % $slicecount) as slice, count(*) from event group
by slice

This will return the mysql statement sliced on the given number of slices.

Networking Monitoring Tools

A list of useful networking monitoring tools. This is not a Top 10 or Top 5 or Top whatever, the usefulness of these applications depends on your environment and what exactly you want to monitor for.

1. ntop

ntop is a network traffic probe that shows the network usage, similar to what the popular top Unix command does. ntop is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform and on Win32 as well. It’s great to use, comes with a list of plugins and has a nice web-interface. It’s an easy an inexpensive way to catch misconfigured or compromised hosts on your network.

2. snort

tcpdump is probably the best known monitoring tool, it dumps all the network traffic and comes with extended filtering capabilities.

4. atop

atop is an advanced interactive monitor for Linux-systems to view the load on system-level and process-level but it can also display the network traffic. Start it with atop -N > file.

5. bmon

bmon is a bandwidth monitor for network connections. With it you can watch a certain network card or a many of them. Bmon presents the results in ascii or ncurses.

6. nfsen / nfdump

nfsen is an open source netflow monitor. Results are presented via a webinterface and it comes with tcpdump-like filters. Invaluable tool for network analysis.

Install PHP5 on OpenBSD 4.2

PHP needs expat; this is included in the base set xbase42. If you didn’t install it at install-time you can get it with

cd /
ftp http://ftp.belnet.be/mirror/ftp.openbsd.org/4.2/i386/xbase42.tgz
tar xzvpf xbase42.tgz

Magpierss with UTF8

MagpieRSS is an RSS parser in PHP. If you’re parsing UTF-8 streams and the output looks crippled then you might want to try this (add this to your file that calls the Magpie-code ) :

define(‘MAGPIE_OUTPUT_ENCODING’, ‘UTF-8’);
define(‘MAGPIE_INPUT_ENCODING’, ‘UTF-8’);
define(‘MAGPIE_DETECT_ENCODING’, false);

Adjust X11 resolution on the fly

Modern X11 drivers support resolution changing on the fly (as in, you don’t need to restart your X11 server). You can check if your driver supports this when you see this

(==) RandR enabled
(II) Initializing built-in extension RANDR

Changing the resolution is very easy:

xrandr –size 1024×768

Entering xrandr without any options shows all the available resolutions.

Snort 3.0 Architecture Serie

If you care at all about Snort you must read Snort 3.0 Architecture Series by Marty Roesch.