Outing PeerTAB

Sometime back when it was still cold (probably in April, I around the time we had that last really wet snowfall of the year, perhaps even when I shot this video of my kids beating up our snowman -- it is amazing how many "snowman beating" videos are in Youtube) I got this wacky idea while stuck in traffic.

So the question I had, was why haven't we seen any global (or even Enterprise-wide) log/traffic/alert sharing tools which use P2P technologies? Why haven't we seen a decentralized Dshield? The answer, several months later, was PeerTAB.

Obviously there is no code yet, but there are a reasonably refined set of requirements. Just to be clear, this is not another log analysis tool, or a SIM. It is basically a [hopefully] thin layer on top of JXTA that would allow stuff like Snort logs, netflow-data (lets say from flow-tools), mod-security logs, or whatever to be contributed and searched across a global (or localized) P2P network. I had some initial success in using JRuby and JXTA but there is a lot more to do, so stay tuned.

And if you have any interest in learning about P2P Networking APIs and have some minimal of level of Java/Ruby competence and want to get involved in the project, let me know, let me know.

New Click Router Release!

While there are loads of crude packet generators like hping, sendip, nemesis (and back in the day I used to used a set of tools called spak in a TCP/IP Security course I wrote back in 1998) that you could use to reproduce various L2/L3 attack or send the arbitrary frame. But if you need to have tight control of the packet rate and packet size (like smartbits/avalanche) to do performance testing of forwarding devices, the free/Open Source tools are pretty primitive. The built in Linux packet generator allows a mean spew of frames (I measured around 300kpps on my T-61!) but it is either a firehose or a trickle since the delay mechanism was just not effective to set the consistent packet rate.

The Click Modular Router however, does not suffer form these limitations and I used it extensively this Spring when I was comparing interrupt utilization across OpenBSD and FreeBSD PF implementations. But unfortunately it only ran on older kernels (and believe me I tried) so today's release is good news.

I have been meaning to release a UbuntuTrinux-Click release that has an easy to deploy version of Click. Maybe this will help me get on to that task.

Johan Petersson explains the mysterious linux-gate.so.1

Apart from the image above, I won't even try to introduce the topic, but check out What is linux-gate.so.1. Oh, and if you felt the slightest twinge that this could be dangerous, check out the milw0rm paper on exploiting with it.

And, No, I'm not writing Linux exploits, but porting some of the shell functions from mkinitramfs to a fancy new Ruby UbuntuTrinux image builder.

ubuntutrinux-core-0.1 release candidate is out!

In the past hour or so I've squashed enough bugs and completed enough documentation, I'm please to say that a release candidate for the first (0.1) formal release of UbuntuTrinux is now available. I've hit most of the milestones for 0.1 and some in 0.2. Not to shabby.

Among the changes:

• A complete list of included tools is up. Let me know if I missed anything small. We are a 14.2 megs. 15 meg is the new max.
• bash is now the default shell (not sure why but it keeps ls from segfaulting on long file listings, must have been a busybox ash thing) and less finally works
  
• I think Nmap 4.20 is new this build. It may have been in the last one. Socat is new because I didn't have any port redirection tools apart from what is in iptables.
  
• Added the latest build of snort. I got it working, but there are no signature files or configuration files present.
• New dropbear keys are generated on each boot

Now on to the testing, final documentation, and release announcement on Freshmeat.

Trinux, Java, P2P, and 114MB

trinux# PATH=$JAVA:/java/bin 
trinux# java -version
java version "1.5.0_11"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_11-b03)
Java HotSpot(TM) Client VM (build 1.5.0_11-b03, mixed mode, sharing)

So 114MB appears to be the minimum RAM footprint for J2SE5, at least with everything else I have running in the Trinux build. Since 64MB is the default max for the initrams I had to create another ramdisk for the JRE.

trinux# mount
rootfs on / type rootfs (rw)
none on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw)
/dev/ram0 on /java type ramfs (rw)

BTW, if ramfs is in /proc/filesystems you can create ramdisks with

mount -t ramfs /dev/ram0 /mount

I can't remember if I managed to run any Java apps (I remember looking at Kaffe) running under Trinux, but tonight I managed to get the Java Modbus/TCP Simulator I wrote for the the Digital Bond Scada Honeynet. I didn't actually see if it works, but netstat shows the socket open, so I guess it works.

trinux# pwd
/java
trinux# du . | sort -rn | head
80684   .
79132   ./lib
28080   ./lib/i386
16592   ./lib/i386/client
7268    ./lib/i386/server
1764    ./lib/zi
1156    ./bin
1120    ./lib/ext
544     ./lib/oblique-fonts
516     ./lib/zi/America

35 of the 80 megs are the runtime (rt.jar) which theoretically could be stripped, but not sure it is worth the effort.

Why the sudden issue in Java on UbuntuTrinux?

We'll I've been looking at some of the P2P APIs out there such as JXTA, P2PS, and Pastry.

If anyone knows of any C P2P APIs (and I no I'm not talking about filesharing stuff, I'm looking for APIs that handle routing, registration, rendezvous, and all that stuff) that are comparable, let me know. The only thing remotely I interesting I dug up is pitsaw but I haven't got it running, although it did build, which is more than I can say for the C JXTA implementation.

We're Two Weeks out from UbuntuTrinux 0.1 (or how I defeated Unix98 ptys)

So the big new feature in the latest (050607) ubuntutrinux snapshot release is a working SSH2 server (courtesy of Dropbear.) Like Busybox, it has added a lot of features since I last built it back in 2003. There is now a small SSH client (ssh is symlinked to dbclient) and it includes some version of scp from OpenSSH. So scp (at least to Trinux boxes) works as well.

As the title suggests, we're getting close to an initial (0.1) release. I'm this close to finalizing the feature list. If you followed the link you see that goal for the 0.2 release is finishing the .yaml configuration file and 0.3 an IOS-like shell using the Ruby Cmd module. But back to Dropbear...

For others that might be want to include it (or get the Busybox telnetd server working) in a small distro, the key (but not terribly difficult) technical hurdle to overcome is to ensure the kernel had Unix98 pseudoterminal support and that the device files are present. I had the former, but not the latter.

Basically you need kernel support, the "multiplexer device" (/dev/ptmx), and a /dev/pts directory as you can see below:

trinux# ls -al /dev/ptmx
crw-rw-rw-    1 root     root       5,   2 May  7 12:02 /dev/ptmx
trinux# ls -al /dev/pt
/dev/ptmx  /dev/pts/
trinux# ls -al /dev/pts
drwxr-xr-x    2 root     root            0 May  7 12:01 .
drwxr-xr-x    3 root     root            0 May  7 12:01 ..
crw--w--w-    1 root     root     136,   0 May  7 12:02 0
trinux# cat /proc/config.gz | gunzip | grep PTY
CONFIG_UNIX98_PTYS=y
CONFIG_LEGACY_PTYS=y
CONFIG_LEGACY_PTY_COUNT=256

The device files with the major number of 136 are created dynamically for each pair. The Linux Text Terminal Howto has good info on this. The kernel config file in /proc is nice, huh. I wonder if the BSDs have something like that. I doubt it.

And the dropbear logs show that I have a little more work to do but it works:

May  7 12:01:50 trinux authpriv.warn dropbear[1099]: Failed reading '/etc/dropbear/dropbear_rsa_host_key', disabling RSA
May  7 12:01:50 trinux authpriv.info dropbear[1100]: Running in background
May  7 12:02:08 trinux authpriv.info dropbear[1105]: Child connection from 10.0.2.2:51769
May  7 12:02:14 trinux authpriv.notice dropbear[1105]: password auth succeeded for 'root' from 10.0.2.2:51769
May  7 12:02:14 trinux authpriv.err dropbear[1106]: open /dev/tty failed - could not set controlling tty: No such file or directory
May  7 12:02:14 trinux authpriv.warn dropbear[1106]: lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
May  7 12:02:14 trinux authpriv.warn dropbear[1106]: lastlog_openseek: /var/log/lastlog is not a file or directory!

Painless Non-Enterprise Netflow

Tonight I released another ubuntutrinux-core snaphot that include fprobe and a few tools from flow-tools. I'll spare the introduction to Netflow except to comment why this might useful for Linux/Trinux (its obvious for routers!) as opposed to other network monitoring tools.

In terms of data your are getting about what you would get with a port logger such as ippl or other port listeners that log connections from hosts

root@gx620:/tmp# flow-cat biglast | flow-print | head
srcIP dstIP prot srcPort dstPort octets packets
24.136.0.111 239.255.255.250 2 0 0 32 1
24.136.0.189 239.255.255.250 2 0 0 32 1
82.211.81.145 24.136.x.y 17 123 123 76 1
24.136.2.30 239.255.255.250 2 0 0 32 1
24.136.2.67 224.0.0.251 2 0 0 32 1
24.136.2.67 239.255.255.253 2 0 0 32 1
10.48.120.1 224.0.0.1 2 0 0 28 1
24.136.0.163 239.255.67.250 2 0 0 32 1
24.136.19.48 224.0.0.253 2 0 0 32 1

Notice this is mostly multicast cruft on RCN with the exception of NTP traffic to the Ubuntu time source. But big deal. Some of you may remember (back in the day!) a NSWC tool called SHADOW (where Northcutt and Irwin made their claim to fame) that was basically a collection of Perl scripts that managed tcpdump file capture and viewing through a web interface.

Well flow-tools allows you to a lot of the same stuff with much less overhead and all from the command-line

$ flow-cat biglast | flow-stat -f5 -S 1 | head -25

# Args: flow-stat -f5 -S 1
#
#
# port flows octets packets
#
80 2464 12632818 162315
53 1099 214515 3053
1026 414 250208 710
32768 405 131967 766
1027 314 155033 314
123 186 14136 186
443 177 333745 3020
7 175 19075 175
5222 141 36842 370
3408 120 15892 220

Basically you "flow-cat" the saved file to a number of different tools, flow-stat being the most useful for me. Not terribly surprising HTTP is at the top nor the 1026 to my firewall. Damn cable.

$ flow-cat biglast | flow-stat

#
# Fields: Total
# Symbols: Disabled
# Sorting: None
# Name: Overall Summary
#
# Args: flow-stat
#
Total Flows : 13168
Total Octets : 380416991
Total Packets : 517136
Total Time (1/1000 secs) (flows): 222894382
Duration of data (realtime) : 34320
Duration of data (1/1000 secs) : 364934
Average flow time (1/1000 secs) : 16926.9733
Average packet size (octets) : 735.6227
Average flow size (octets) : 28889.5043
Average packets per flow : 39.2722
Average flows / second (flow) : 36.1758
Average flows / second (real) : 0.3837
Average Kbits / second (flow) : 8360.8132
Average Kbits / second (real) : 88.6753

After concatenating all this data into a single file, it only took about about 800k for about 10 hours of traffic.

And how did I kick all this off?

First I ran fprobe on Trinux and made sure it was working by testing it out with EHNT
which is the quickest way (it took me a while to wander through the flow-tools manpages, and the ubuntu startup script (in /etc/init.d) for capturing flows didn't work. I'm using pcap to get this but there is a version of fprobe that can generate flow from iptables.

#fprobe -u nobody collector-ip:collector port

BTW, netflow uses UDP. You can sniff to make sure the flow updates are being sent. And then on the server (you'll want to be more restrictive on the local and remote ports, the 0's)

#flow-capture -w /raid/flows/ 0/0/4444 -S20

which creates the directory hierarchy like:

root@gx620:/raid/flows/2007# ls -alR | less

.:
total 0
drwxr-xr-x 3 root root 72 2007-04-29 12:04 .
drwxr-xr-x 3 root root 72 2007-04-29 12:04 ..
drwxr-xr-x 3 root root 80 2007-04-29 12:04 2007-04

./2007-04:
total 2
drwxr-xr-x 3 root root 80 2007-04-29 12:04 .
drwxr-xr-x 3 root root 72 2007-04-29 12:04 ..
drwxr-xr-x 2 root root 2208 2007-04-29 22:15 2007-04-29

./2007-04/2007-04-29:
total 326
drwxr-xr-x 2 root root 2208 2007-04-29 22:15 .
drwxr-xr-x 3 root root 80 2007-04-29 12:04 ..
-rw-r--r-- 1 root root 1145 2007-04-29 12:15 ft-v05.2007-04-29.121249-0500
-rw-r--r-- 1 root root 4500 2007-04-29 12:30 ft-v05.2007-04-29.121904-0500
-rw-r--r-- 1 root root 2153 2007-04-29 12:45 ft-v05.2007-04-29.123001-0500


Of course there are tons more options (the -S20 just says write a status report to syslog every 20 minutes like:

Apr 29 22:20:00 localhost flow-capture[27718]: STAT: now=1177903200 startup=1177867131 src_ip=192.168.100.1 dst_ip=192.168.169.162 d_ver=5 pkts=2918 flows=13828 lost=1 reset=0 filter_drops=0

Saturday Mornings with YAML

ubuntutrinux is progressing nicely to the point that I was able to replace my OpenBSD Internet-facing facing pf box. Sure iptables sucks for real firewalls, but I burned Trinux on a CD with a static set of rules on a Old Celeron-based Optiplex GX100 with no hard drive. Good enough. BTW, I added frobe to be able to export netflow data. With device file creation mostly complete, I'm moving to the initialization scripts and to a new YAML configuration scheme copy the spirit (if not the letter) of pfsense.

Right now I'm playing with something like:

network:
  hostname: franzfw
  interfaces:
    eth0:
      address: dhcp
    eth2:
      address: 192.168.100.1
      netmask: 255.255.255.0
  routes:
    -'192.168.169.0/24': 192.168.100.2
  forwarding: true

And when I run a little "check" script you see:

franz-g4:~/dev/playin/ruby mdfranz$ ruby ycheck.rb config.yaml
yf is a:Hash
{"network"=>
{"routes"=>{"-'192.168.169.0/24'"=>"192.168.100.2"},
"forwarding"=>true,
"interfaces"=>
{"eth0"=>{"address"=>"dhcp"},
 "eth2"=>{"netmask"=>"255.255.255.0", "address"=>"192.168.100.1"}},
"hostname"=>"franzfw"}}
With the following keys:
-network
Hostname:franzfw
interfaces is a:Hash
Configuring:eth0
Configuring:eth2

With the script that created this...

require 'yaml'
require 'pp'
yf = YAML.load_file(ARGV[0])
print "yf is a:"
print yf.class
print "\n"
pp yf
print "With the following keys:\n"
yf.keys.each { |k| puts "-" + k }
puts  "Hostname:" + yf['network']['hostname']
interfaces = yf['network']['interfaces']
print "interfaces is a:"
print interfaces.class
print "\n"
print interfaces.keys.each { |i| puts "Configuring:" + i }

Don't have time to get into the details (see the YAML Cookbook for more info) but there were a couple of areas I got hung up on:

• Using tabs instead of whitespaces. Ruby YAML doesn't like tabs, but if your vimrc is setup for Python you should be good to go.
  
• Getting hashes instead of arrays (and vice versa). Play around with ident's and -'s until you get what you need
  

XML parsing (or creating XML configuration files) isn't something I do on a daily basis (thank God!) but I've done enough to know that this is a lot easier to read and parse.

Since ruby is so small (less than 2MB compressed) it will be included as part of the core and probably everything outside /init may use it.

Where my Linux device files went and how sysfs helped me find them

I shouldn't have been, but the other I was surprised to see (unlike back in the day) the /dev directory isn't completely populated with every device know to man. They are gone, replaced by something called udev which creates the files depending which hardware is available. So unlike in the old Trinux, I can't simply copy into the target filesystem. There are no hd[abcd] devices on my development box. Although there is a script (/usr/share/initramfs-tools/hooks/udev) that is used by the initial ramdisk do to this, but it looked like overkill, particularly once I start digging into /etc/udev/rules.d. Sure I could have got it working, but how long would it take? What other tools would it depend on? That may or may not be in Busybox. All I wanted to do was create basic ide and scsi devices and the /dev/cciss/ devices used by the Compaq RAID adapters in the DL380s we have at work.

What I needed was the major and minor numbers for all devices are available in the system. Once I figured that out I could use mknod to create them myself. Quick and dirty, like everything else Trinux. Of course the downside is /sbin/udevd is a daemon that is running and I assume helps. I will have to manually run the scripts that created the devices as new kernel modules are installed and new classes of devices. Of course, with ubuntutrinux I'm building as large as kernels as possible with almost everything in it as possible.

So how do I find out what devices are there and learn the major/minor numbers?

That is where sysfs comes in, allowing you to get detailed information about hardware devices. A funny side note. I wouldn't recommend browsing this hierarchy with the busybox ls because I was getting segfaults.

So let's look at the SCSI (actually SATA) devices present on my Dell server and where they show up with sysfs.

mdfranz@gx620:/sys$ ls -al /dev/sd*
brw-rw---- 1 root disk 8,  0 2007-04-25 16:20 /dev/sda
brw-rw---- 1 root disk 8,  1 2007-04-25 16:20 /dev/sda1
brw-rw---- 1 root disk 8,  2 2007-04-25 16:20 /dev/sda2
brw-rw---- 1 root disk 8,  3 2007-04-25 16:20 /dev/sda3
brw-rw---- 1 root disk 8, 16 2007-04-25 16:20 /dev/sdb
brw-rw---- 1 root disk 8, 17 2007-04-25 16:20 /dev/sdb1
brw-rw---- 1 root disk 8, 18 2007-04-25 16:20 /dev/sdb2
mdfranz@gx620:/sys$ find /sys -name "sd*"
/sys/module/sd_mod
/sys/block/sdb
/sys/block/sdb/sdb2
/sys/block/sdb/sdb1
/sys/block/sda
/sys/block/sda/sda3
/sys/block/sda/sda2
/sys/block/sda/sda1
/sys/bus/scsi/drivers/sd
mdfranz@gx620:/sys$ cd /sys/block/sdb/
mdfranz@gx620:/sys/block/sdb$ cat dev
8:16

10 Days of Trinux, 9 Years Later

It's actually been longer since I lamented the lack of well maintained ramdisk distros but the project activity log say 10 days so I'll go with that.

It was certainly tempting to throw in the towel and say Trinux peaked in 2000 and be done with it (which it actually did, and what I thought when I let the trinux.org domain expire a few months back) I think there are some good reasons to re-introduce (and continue to maintain) a minimal ramdisk Linux distribution in 2007 -- 9 years after first started serving up it off of www.txdirect.net/~mdfranz and a SATLUG page. And I'm not including the fact that there are still some folks left on trinux-talk from the old days and that maintaining a distro is fun. So here is a heavily annotated (but limited to a single sentence) rationale for what I'm up to with ubuntutrinux.

While Firmware Linux is a well-designed project and actually works (unlike the bloated buildroot) there is a need for a small (meaning under a 10 MB core) non-uclibc distribution or distribution toolchain (i.e distribution creator) that allows releases to be packaged quickly (like under 10 minutes, not counting kernel compilation) using the latest Linux 2.6 kernels that allow easily deployment applications compiled on a standard desktop/server Linux (like Ubuntu) for a variety of boot media: CD-ROM, USB, PXE, or a Linux /boot partition.

Although the documentation is incomplete and I haven't been doing predictable numbered releases yet, it does this now and almost everything is up on snapshots directory.

During the first go around I made the mistake of supporting some boot media more than others. For me a single floppy plus network package loading was the only way to go. ISO were impractical and inflexible.

It should be a no suprise if you read the italicized text above, but with ubuntutrinux, the key design principles are:

• Simplicity, speed, and ease of use
• Maximum deployment
• Interoperability

The rest is implementation.

Booting ubuntutrinux (or other initrafms fare) within Qemu

Getting re-acquainted with embedded linux (and building ramdisk distros) over the past week or so has been sort of painful (I'm still struggling with the transition from initrd to initramfs) but over the weekend I manged to "release" a kernel and filesystem built on busybox 1.4.2 and Linux 2.6.20 as well some scripts (stripped down versions of the mkinitrd stuff in ubuntu) I used to create them.

But I'm still not happpy. Rob Landley's site and various documentation he has written has proved to be quite useful but still haven't solved the main problem of getting a initramfs to behave like the initrd+linuxrc's did with Trinux but I have ditched VMWare for QEMU. I do builds on my Dell Optiplex Pentium D then copy them over to my PowerBook where they run (even on a PPC!)


franz-g4:~/ubuntutrinux-test-0 mdfranz$ qemu -nographic -kernel bzImage -initrd initramfs -append "console=ttyS0" /dev/zero


And then you get within a Terminal...

starting qemu...
(qemu) [ 0.000000] Linux version 2.6.20.2 (root@gx620) (gcc version 4.0.3 (Ubuntu 4.0.3-1ubuntu5)) #1 SMP PREEMPT Sat Apr 7 07:56:09 CDT 2007
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] sanitize start
[ 0.000000] sanitize end
[ 0.000000] copy_e820_map() start: 0000000000000000 size: 000000000009fc00 end: 000000000009fc00 type: 1
[ 0.000000] copy_e820_map() type is E820_RAM
[ 0.000000] copy_e820_map() start: 000000000009fc00 size: 0000000000000400 end: 00000000000a0000 type: 2
[ 0.000000] copy_e820_map() start: 00000000000e8000 size: 0000000000018000 end: 0000000000100000 type: 2
[ 0.000000] copy_e820_map() start: 0000000000100000 size: 0000000007f00000 end: 0000000008000000 type: 1
[ 0.000000] copy_e820_map() type is E820_RAM
[ 0.000000] copy_e820_map() start: 00000000fffc0000 size: 0000000000040000 end: 0000000100000000 type: 2
[ 0.000000] BIOS-e820: 0000000000000000 - 000000000009fc00 (usable)
[ 0.000000] BIOS-e820: 000000000009fc00 - 00000000000a0000 (reserved)
[ 0.000000] BIOS-e820: 00000000000e8000 - 0000000000100000 (reserved)
[ 0.000000] BIOS-e820: 0000000000100000 - 0000000008000000 (usable)
[ 0.000000] BIOS-e820: 00000000fffc0000 - 0000000100000000 (reserved)
[ 0.000000] 0MB HIGHMEM available.
[ 0.000000] 128MB LOWMEM available.
[ 0.000000] Zone PFN ranges:
[ 0.000000] DMA 0 -> 4096
[ 0.000000] Normal 4096 -> 32768
[ 0.000000] HighMem 32768 -> 32768
[ 0.000000] early_node_map[1] active PFN ranges
[ 0.000000] 0: 0 -> 32768
[ 0.000000] DMI not present or invalid.
[ 0.000000] ACPI: Disabling ACPI support
[ 0.000000] Allocating PCI resources starting at 10000000 (gap: 08000000:f7fc0000)
[ 0.000000] Detected 18.432 MHz processor.
[ 2.901454] Built 1 zonelists. Total pages: 32512
[ 2.901788] Kernel command line: console=ttyS0
[ 2.911864] Found and enabled local APIC!
[ 2.912649] Enabling fast FPU save and restore... done.
[ 2.913650] Enabling unmasked SIMD FPU exception support... done.
[ 2.916144] Initializing CPU#0
[ 2.919308] PID hash table entries: 512 (order: 9, 2048 bytes)
[ 2.927577] Console: colour VGA+ 80x25
[ 3.149985] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 3.156115] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 3.302374] Memory: 121064k/131072k available (2010k kernel code, 9508k reserved, 653k data, 312k init, 0k highmem)
[ 3.341009] virtual kernel memory layout:
[ 3.341098] fixmap : 0xfff4f000 - 0xfffff000 ( 704 kB)
[ 3.341176] pkmap : 0xff800000 - 0xffc00000 (4096 kB)
[ 3.341253] vmalloc : 0xc8800000 - 0xff7fe000 ( 879 MB)
[ 3.341330] lowmem : 0xc0000000 - 0xc8000000 ( 128 MB)
[ 3.341405] .init : 0xc039f000 - 0xc03ed000 ( 312 kB)
[ 3.341482] .data : 0xc02f69d3 - 0xc0399f70 ( 653 kB)
[ 3.341557] .text : 0xc0100000 - 0xc02f69d3 (2010 kB)
[ 3.431756] Checking if this processor honours the WP bit even in supervisor mode... Ok.
[ 3.659081] Calibrating delay using timer specific routine.. 93.63 BogoMIPS (lpj=187261)
[ 3.691223] Security Framework v1.0.0 initialized
[ 3.716745] SELinux: Disabled at boot.
[ 3.720889] Mount-cache hash table entries: 512
[ 3.756947] CPU: L1 I cache: 8K
[ 3.771871] CPU: L2 cache: 128K
[ 3.784194] Compat vDSO mapped to ffffe000.
[ 3.802657] Checking 'hlt' instruction... OK.
[ 3.920842] SMP alternatives: switching to UP code
[ 3.931291] Freeing SMP alternatives: 10k freed
[ 3.943582] CPU0: Intel Pentium II (Klamath) stepping 03
[ 3.964529] SMP motherboard not detected.
[ 4.230102] Brought up 1 CPUs
[ 4.267331] NET: Registered protocol family 16
[ 4.314839] EISA bus registered
[ 4.322200] PCI: PCI BIOS revision 2.10 entry at 0xf9fa0, last bus=0
[ 4.325915] PCI: Using configuration type 1
[ 4.328017] Setting up standard PCI resources
[ 4.427408] ACPI: Interpreter disabled.
[ 4.441367] Linux Plug and Play Support v0.97 (c) Adam Belay
[ 4.483253] pnp: PnP ACPI: disabled
[ 4.498100] PnPBIOS: Scanning system for PnP BIOS support...
[ 4.541351] PnPBIOS: PnP BIOS support was not detected.
[ 4.587718] PCI: Probing PCI hardware
[ 4.609690] * Found PM-Timer Bug on the chipset. Due to workarounds for a bug,
[ 4.610142] * this clock source is slow. Consider trying other clock sources
[ 4.645056] PCI quirk: region b000-b03f claimed by PIIX4 ACPI
[ 4.685876] PCI: Using IRQ router PIIX/ICH [8086/7000] at 0000:00:01.0
[ 4.710713] PCI: BIOS reporting unknown device 01:00
[ 4.733156] PCI: BIOS reporting unknown device 01:00
[ 4.749968] PCI: BIOS reporting unknown device 01:00
[ 4.784264] PCI: BIOS reporting unknown device 01:00
[ 4.795444] PCI: BIOS reporting unknown device 01:00
[ 4.815190] PCI: BIOS reporting unknown device 01:00
[ 4.843408] NET: Registered protocol family 8
[ 4.845769] NET: Registered protocol family 20
[ 4.895700] PCI: Ignore bogus resource 6 [0:0] of 0000:00:02.0
[ 4.918304] NET: Registered protocol family 2
[ 5.044717] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 5.075773] TCP established hash table entries: 4096 (order: 3, 49152 bytes)
[ 5.123529] TCP bind hash table entries: 2048 (order: 2, 24576 bytes)
[ 5.146642] TCP: Hash tables configured (established 4096 bind 2048)
[ 5.180315] TCP reno registered
[ 5.249366] checking if image is initramfs... it is
[ 24.071603] Freeing initrd memory: 4956k freed
[ 24.134872] audit: initializing netlink socket (disabled)
[ 24.160085] audit(1176777411.196:1): initialized
[ 24.215895] VFS: Disk quotas dquot_6.5.1
[ 24.234002] Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
[ 24.280635] io scheduler noop registered
[ 24.295858] io scheduler anticipatory registered (default)
[ 24.299539] io scheduler deadline registered
[ 24.302895] io scheduler cfq registered
[ 24.306052] Limiting direct PCI/PCI transfers.
[ 24.308877] PCI: PIIX3: Enabling Passive Release on 0000:00:01.0
[ 24.312882] Activating ISA DMA hang workarounds.
[ 24.347502] isapnp: Scanning for PnP cards...
[ 25.303982] isapnp: No Plug & Play device found
[ 27.407116] Real Time Clock Driver v1.12ac
[ 27.430981] Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing enabled
[ 27.472354] serial8250: ttyS0 at I/O 0x3f8 (irq = 4) is a 16450
[ 27.575725] RAMDISK driver initialized: 16 RAM disks of 65536K size 1024 blocksize
[ 27.634910] Uniform Multi-Platform E-IDE driver Revision: 7.00alpha2
[ 27.668313] ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
[ 27.694047] PNP: No PS/2 controller found. Probing ports directly.
[ 27.715008] serio: i8042 KBD port at 0x60,0x64 irq 1
[ 27.741112] serio: i8042 AUX port at 0x60,0x64 irq 12
[ 27.769258] mice: PS/2 mouse device common for all mice
[ 27.802423] input: AT Translated Set 2 keyboard as /class/input/input0
[ 27.865277] EISA: Probing bus 0 at eisa.0
[ 27.902510] EISA: Detected 0 cards.
[ 27.922112] TCP cubic registered
[ 27.954340] NET: Registered protocol family 1
[ 27.979541] Testing NMI watchdog ... CPU#0: NMI appears to be stuck (0->0)!
[ 28.141213] Using IPI No-Shortcut mode
[ 28.188656] Time: tsc clocksource has been installed.
[ 28.275904] Freeing unused kernel memory: 312k freed
Starting init!
mknod: /dev/console: File exists
mknod: /dev/null: File exists
bash: no job control in this shell
bash-3.1#

I just wish there were a way to "stay in" this filesystem (I think it is rootfs) and get job control, run the simple busybox init and spawn shells without mounting another root, but I'm guessing I'll have to create another ramdisk filesystem and switch_root into it.

label default
    kernel bzimage
    append initrd=initrd.gz root=/dev/ram0 rw

Then linuxrc got executed and then after exiting it, Busybox init kicked in.

Trinux Sourceforge Statistics Shock

Although the trajectory is downward, I was shocked to monthly Trinux download statistics within the 1.5-3K/month range and even more frightening hit counts still in the 50-60k/month range. Who are these people? And what happened in March/April 2002?

Google-Code & ubuntutrinux

I hosted my first project (a little something called ubuntutrinux) on Google Code and was amazed how pleasant the experience was compared to Sourceforge. Not that Sourceforge is terrible, but Google's setup is just so easy. Wiki, Subversion, Issues, all in about 5 minutes. No approval needed. It tempting to say that it is because Google's infrastructure is in Python (vs. PHP crap like Sourceforge) but probably not the case. Or maybe it is.

Are there any actively maintained ramdisk distros in 2007 that use 2.6.x?

Back in the day. Everybody did them. Hell, even I had one called Trinux: A Linux Security Toolkit which I maintained from from 1998 to 2004. There was LRP, tomsrtbt, FREESCO, HAL91, and many others. A

ll before Knoppix came and spoiled the party with their fancy talk of remastering and compressed filesystems and running from CD-ROM.

But where are they now? Devil Linux had a recent release but it uses 2.4.x. Most other became dormant in 2003-2004.

Basically I need a convenient platform for running some network tools like The Click Modular Router Project.

Am I going to have to bring Trinux back from the dead?