Sunday, May 06, 2018

PowerShell Effective Route Table Lookup

Looking up the routes on a windows host via PowerShell can be misleading; at work (www.appliedi.net) our principal use is to see not just normal destination next-hops associated with actual adapters, but moreso those of SSL-VPN connections.  A Disclaimer: what follows is ugly, and while I applaud the ability to derive this information from a single PowerShell statement, I abhor the statement itself and Microsoft's continued inability to to easily provide what is universally needed. With that chiding disclaimer, here ya go:

Get-NetIpInterface -ConnectionState Connected |Where-Object -FilterScript {$_.InterfaceAlias -notmatch "^Lo.*"}|Select-Object -Unique -Property ifIndex|Get-NetRoute|Where-Object -FilterScript {$_.NextHop -notmatch "((0`.0`.0`.0)|::)"}|Format-Table -Property @{L='Destination';E='DestinationPrefix'}, @{L='Next Hop';E='NextHop'},@{L='Interface';E='InterfaceAlias'}


We grab routes from the IP Interfaces they originate from, ferreting out the useless usual suspects with output to human-readable-non-CamelCase output. Here's an example:

Destination       Next Hop    Interface
-----------       --------    ---------
174.136.79.138/32 192.168.1.1 Wi-Fi 4
0.0.0.0/0         192.168.1.1 Wi-Fi 4
216.167.192.0/20  10.95.0.8   fortissl
192.168.75.0/24   10.95.0.8   fortissl
174.136.88.0/21   10.95.0.8   fortissl
174.136.86.0/23   10.95.0.8   fortissl
174.136.85.0/24   10.95.0.8   fortissl
174.136.84.224/27 10.95.0.8   fortissl

Enjoy!

Friday, January 26, 2018

Logstash Imap input plugin works, but not as described

I've been re-entering the world of Logstash as I attempt to leverage it for workflow automation solutions. If that sounds fun, it's because it is.

However, applications that don't work as described can cause an large amount of non-fun when on boarding them into your operations. Don't get me started on Autotask, for instance (whoa Nelly!).

I will call out the Logstash Imap input plugin here, however. It works, and is awesome. But the description is woefully incorrect-

Descriptionedit

Read mails from IMAP server
Periodically scan an IMAP folder (INBOX by default) and move any read messages to the trash.

So when setting this up for testing I thought it would look at emails in the "INBOX" and act on them via the filter rules and then move them to the trash. But in testing nothing happened at all. I was using two gmail accounts and the Ubuntu server had it's logstash and postfix properly set up. I was debugging and tailing and everything... and nothing was happening.

But send it an email, and then it works. Well, sorta- it acts on that new email via filter rules, but does not move it to the trash. And it leaves all the other emails alone.

I didn't post this to beat up on the Logstash team, I think they're doing wonderful work. It's just that I've perused at least three or four blogposts out in Internetland that show how to use this input... and none of them reference this documentation error. I thought that someone should acknowledge it so others could avoid it.