Breaking down an IPv6 address

Let's take a long hard look at an IPv6 address. Amazon supply IPv6 addresses with their EC2 cloud computers. When you fire up an EC2 virtual machine, you get an IPv6 address like this.

fe80::2000:aff:fea7:f7c

There's a lot of meaning packed into that strange-looking identifier. A few companies have tackled IPv6 but to most it's just plain confusing. Why is it so confusing? And how can you decipher what it means?

Connect to your AWS EC2 instance, find your network interface and its IPv6 address, and let's do some serious IPv6 breakdown.

The name of your EC2 network interface is eth0

Every physical computer has sockets with cables plugged into them and so does your virtual EC2 machine. Each network socket has a stack of names and addresses (MAC, IPv4, and IPv6) and a stack of networking software to do the talking. These are collectively referred to as "the interface".

Use the ip addr command to display lots of information about your EC2 network interfaces.

 [ec2-user@ip-10-167-15-124 ~]$ ip addr    1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00     inet 127.0.0.1/8 scope host lo     inet6 ::1/128 scope host     valid_lft forever preferred_lft forever    2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000     link/ether 22:00:0a:a7:0f:7c brd ff:ff:ff:ff:ff:ff     inet 10.167.15.124/26 brd 10.167.15.127 scope global eth0     inet6 fe80::2000:aff:fea7:f7c/64 scope link     valid_lft forever preferred_lft forever    [ec2-user@ip-10-167-15-124 ~]$   

That's a dozen lines packed with details, written in a shorthand that makes it hard to read. At this low level, you have to take more care describing your work to others. As with all common collective terms like "server" and "cloud", "interface" is an easy way to describe the big picture but not so great for details. IPv6 is one of those details.

Information overload is confusing

In the land of film and TV, the sound engineer has to listen to a constant barrage of noise and learn to pick out the details that are important. It's the same for the system administrator – the CLI (Command Line Interface) fills up with data and you learn to see the good stuff and filter out the rest.

All that information displayed by the ip addr command is organized into two numbered sections, for the two network interfaces, lo and eth0:

• The lo name is short for loopback, a name left over from the days of soldered wires. The lo interface is only meant for use within this EC2 machine, not to talk to the outside world.
• The eth0 name is short for Ethernet interface number 0 - Ethernet is the dominant networking technology (after winning the 1980s protocol wars) and 0 is from IT's traditional way of counting (no, there is no good reason to start from 0 instead of 1). The eth0 interface is what customers use – including you and your SSH client - so that's what we care about.

We can ignore the lo section and stare at the eth0 section until details start to emerge.

My IPv6 address is fe80::2000:aff:fea7:f7c

The IPv6 address is on this line.

inet6 fe80::2000:aff:fea7:f7c/64 scope link

You can filter out the words on either side of the big address. The word at the start of the line - inet6 - is a label. Like all text in the world of Linux, it is abbreviated to save on typing and display space. The words scope link tell network administrators that this is a normal address for sending and receiving information (there are a few variations on this theme to meet obscure needs).  

The /64 bit stuck on the end of that string fe80::2000:aff:fea7:f7c/64 is a leftover from IPv4 days. It's called CIDR (Classless Inter-Domain Routing) - it's a network administrator thing. CIDR is used to split an address in half – the first part is used as an address for the network and the second part as an address for the computer.

This /64 isn't required. IPv6 isn't like IPv4. That fe80 field at the start means the same thing to a network administrator.

Hexadecimal is confusing

The IPv6 address show by that ip addr command is fe80::2000:aff:fea7:f7c. That's a translation, not the original address. An IPv6 address that a computer sees is not fe80::2000:aff:fea7:f7c – it is 128 zeros and ones in a great big long row.

Binary data is no good for people so an IPv6 address is translated into hexadecimal, split into 8 fields, and colons are placed between these eight fields. It's a system that only a scientist can love.

Each field is a collection of four hexadecimal digits, like that fe80 at the start. Now I've mentioned three different number systems, which is enough to put off most people.

• binary digits are 0 and 1. The computer uses these.
• The decimal digits that everyone knows are 1, 2, 3, 4, 5, 6, 7, 8 and 9.
• There are sixteen hexadecimal digits - 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, a, b, c, d, e and f.

The IPv6 rules are confusing

If an IPv6 address is 8 sets of hexadecimal digits, what's going on with fe80::2000:aff:fea7:f7c?  That's six sets, not eight. And no way are there four digits in each part.

This address does not follow the pattern of 8 sets of 4 hexadecimal digits. If you count the fields around the colons, you get six. A couple of fields seem to be missing entirely, and those six fields vary in size.

• The first field is fe80 - that's OK, it's four hexadecimal digits.
• The second field doesn't have any digits at all.
• The fourth one – aff – only has three digits.

What's happened is your operating system started out with an IPv6 address that is 8 fields of four digits, like this.

fe80:0000:0000:0000:2000:0aff:fea7:0f7c

Then it applied a couple of IPv6 address shortening rules.

Rule #1: You can replace a big string of zeros with the symbol "::".

The OS uses this rule to turn fe80:0000:0000:0000:2000:0aff:fea7:0f7c into:

fe80::2000:0aff:fea7:0f7c

Your SSH server listens to all interfaces. In IPv6 speak, the address for all interfaces is all zeros, like this: 0000:0000:0000:0000:0000:0000:0000:0000. The OS uses this rule to change this really long address into the really short:

::

Using your sysadmin skills, enter the command netstat –an, which displays lots of network interface information (this command is safe – it makes no changes). See if you can spot that symbol in the list it displays.

Rule #2: You can remove the leading zeros in a field.

The OS uses this rule to turn fe80::2000:0aff:fea7:0f7c into:

fe80::2000:aff:fea7:f7c

Practice, practice, practice

An IPv6 address is built in this way to make the Internet work. The Internet is full of machines that need to figure out how to communicate automatically, without human intervention. It's hard for us poor humans to make the shift from IPv4 to IPv6, but it will make the Internet a better place.

Like everything in life, IPv6 takes practice. The more you work on IPv6, the more you will see through the cloud of confusion to the clever engineering.

Windows Server 2012

Most Windows system administrators have a list of steps that they take when deploying a brand new Windows server onto the network. It's pretty obvious that Microsoft has done their homework on this fact, too. With Windows Server 2012, many common "first run" tasks are pretty easy to find. That said, if you're new to Windows or just need a bump in the right direction, this article will show you the way. Figure A gives you a look at the main Server Manager window in Windows Server 2012. The numbers you see next to some of the items correspond to the numbered list in this article.

Figure A

An overview of the Server Manager window (click on images for full-size).

1. Rename the server

Given that the installer provides the server with a generic name, most administrators immediately rename the server to match the organization's naming convention. This is the first option on the Server Manager window, in fact.

To change your server name, click the existing name of the server. When the System Properties page appears, click the Change button. Provide a new computer name in the appropriate box and click the OK button. Note that changing the server name will require you to restart the machine.

Figure B

Change the server name and domain membership

2. Join a domain

If you look back at Figure B in item 1, you'll see information regarding domain membership at the bottom of the window. In the domain box, provide your domain name. This process is identical to what it used to look like in older versions of Windows.

3. Disable Windows firewall

Some organizations use host-based firewalls and some don't. If you're in the group that prefers to disable host-based firewalls, that's step three of the initial server preparation. In Figure A, you will notice that my system currently has the Windows firewall enabled for domain connections. To make a change to the Windows firewall configuration, click the Domain: On label. You will get a screen like the one shown in Figure C.

Figure C

Current Windows firewall status

At the left-hand side of the window, click the Turn Windows Firewall on or off link to make changes.  Select the radio button next to Turn off Windows Firewall for each network as shown in Figure D.

Figure D

Disable the firewall for each network

4. Enable Remote Desktop for remote management

There are a lot of ways to manage a Windows Server, but many administrators will install a full GUI and connect remotely to the console. It's quick and it's easy. Item four on our list is configuring this option.

First, click the Disabled link next to the Remote Desktop entry in Server Manager. When the Server Manager Remote page opens, select the radio button next to Allow remote connections to this computer.

Next, you need to add users that are allowed to connect remotely to the server. By default, the currently logged in user is granted this right once you enable Remote Desktop. To add additional users, click the Add button (Figure E).

Figure E

Enable and configure Remote Desktop

5. Configure the server's IP settings

In Figure A, you'll note that this server currently has an IP address provided by DHCP. Click that entry to provide this server with a static IP address. When you do so, a list of network adapters appears (Figure F). I have only a single network adapter in my server.

Figure F

This system has just one network adapter.

Double-click the listed adapter to open its information page (Figure G).

Figure G

The information page for the network adapter

From here, click the Properties button to open the properties page and, from there, double-click Internet Protocol version 4. Provide IP address information for the server. Note that the server I'm using is a temporary domain controller.

Figure H

Configure the adapter

6. Configure Windows Update

Keeping your server protected is of paramount importance. To get started, click Not Configured next to Windows Update. When the screen shown in Figure I appears, click the Turn On Automatic Updates button. Windows will immediately begin looking for any updates that have yet to be applied to your system. The result is shown in Figure J where you can see that Windows Update is now enabled and there are updates pending installation.

Figure I

Windows Update is not currently enabled

Figure J

Windows Update is enabled as there are updates waiting.

You can control the time at which updates are applied. Bear in mind that some updates require a system restart. To change Windows Update settings, click the Change Settings option at the left side of the screen. This will bring up the Change Settings window, shown in Figure K.

Figure K

The Change Settings window

From this screen, click the link entitled Updates will be automatically installed during maintenance window to open the Automatic Maintenance settings window, shown in Figure L. In this window, change the time at which automatic maintenance should take place. Note that maintenance includes processes that include updates, security scans, and other system diagnostics.

Figure L

Configure the system's maintenance window

7. Disable Internet Explorer Enhanced Security Configuration

By default, Internet Explorer in Windows Server is configured with Enhanced Security enabled. Although the purpose is sound -- administrators shouldn't be browsing the web from servers -- when the need to do so does arise, this configuration is beyond frustrating. Many administrators simply disable this security setting in order to get their work done.

In Windows Server 2012, this setting is front and center. Click the On link next to IE Enhanced Security Configuration to open the window you see in Figure M. You'll note that there are two settings: One for administrative accounts and a second for users. If you're going to disable this feature on a regular server (i.e. a server that isn't going to host Terminal Services/Remote Desktop Services), I recommend that you disable this setting for administrators, but leave it enabled for general users.

Figure M

Configure IE security settings

8. Configure time zone settings

There are a whole lot of time zones. This one is pretty easy. Click the current time zone setting to open the Date and Time configuration window shown in Figure N. From there, click the Change Time Zone button and in the resulting window, choose the appropriate time zone.

Figure N

Windows Date and Time configuration

9. Install antimalware software

Although I have yet to do this for my lab server, for production, antimalware server is a must in most environments. I've had fantastic success with Microsoft Forefront Endpoint Protection. Every organization uses different tools, though.

10. Make sure the server is "enlightened"

Most new servers these days are of the virtual variety. As such, they need tools installed which provide the server operating system with drivers that match the virtual environment and enable some of the capabilities of virtualization. If you're running Windows Server 2012, the Hyper-V Tools are baked into the operating system. However, if you're running a different version of Windows Server or are using VMware, make sure to install either the Hyper-V or VMware Tools.

Figure O

Install VM tools

Implementing NIC teaming

One of the challenges involved in operating VDI is ensuring that the servers hosting your virtual desktops have adequate network bandwidth available to handle the VDI workload.

This has always been especially problematic in Microsoft VDI environments, where there has historically been no native software-level support for network interface card (NIC) teaming. Teaming allows a pool of virtual machines to be connected to a common virtual switch, which is in turn bound to a NIC team rather than to a single NIC. This makes it possible for the virtual switch to support far more virtual desktops.

Prior to Windows Server 2012, virtual switches connected virtual desktops to physical NICs. That meant it was possible to overwhelm a NIC unless an administrator was careful not to connect too many virtual desktops to a virtual switch. This isn't to say that it was impossible to build a NIC team. It just wasn't natively supported. If you wanted to create a NIC team, you had to implement it at the hardware level by using NICs that were specifically designed for teaming.

Windows Server 2012 finally added native support for NIC teaming using commodity hardware, and Microsoft took things a step further with even more promising improvements in Windows Server 2012 R2.

NIC teaming in Windows Server 2012

The teaming feature in Windows Server 2012 worked well for VDI unless a user generated abnormally large traffic flows. Windows would load balance the various traffic streams across the NICs within the team, thereby allowing the traffic to be handled efficiently. However, this load balancing model broke down when a few large network flows were introduced.

The problem was that the NIC team didn't do much to load balance large traffic flows. A single NIC in the team could become saturated (and overwhelmed) even if there were other NICs in the team with sufficient unused capacity to handle the flow.

Windows Server 2012 R2 addresses this problem by introducing a new dynamic load balancing mode that allows large traffic flows to be broken into a series of smaller, more manageable flows.

Further enhancements in Windows Server 2012 R2

Rather than assigning a traffic flow to a single NIC, there is a new dynamic mode that allows a single traffic flow to be broken into a series of smaller flows, which Microsoft refers to as flow-lets. These flow-lets can then be load balanced across the NICs in the team, improving network performance.



To create a NIC team in Windows Server 2012 R2, begin by opening the Server Manager, clicking on Local Server, and then clicking on the Disabled link located next to NIC Teaming. When you do, Windows will open the NIC Teaming dialog box. Now, choose the New Team option from the Tasks drop down list in the dialog box's Teams section



At this point Windows will display the New Team dialog box. You must enter a name for the NIC team that you are creating. You also have to select the network adapters that you want to include in the NIC team. You can see what this dialog box looks like in Figure 2, although the server in this example did not have any available physical NICs that could be included in the team.



Although you could create the NIC team by clicking OK, it is a good idea to click the Additional Properties option. This section allows you to select the teaming mode and the load balancing mode, as well as provide a standby adapter, which acts as a replacement for a failed NIC (Figure 3).

In this example, the teaming mode is set to Switch Independent. This is the most flexible NIC teaming mode because it does not require your network switch to be aware of the NIC team.

You will also notice that the Load Balancing Mode is set to Dynamic. This is the new load balancing mode that allows traffic streams to be broken into substreams for better load balancing.