Louwrentius

Currently, I am running VMware ESXi 4.1 on a test system. To manage ESXi, you need the VSphere client, which is only available for the Windows platform. Therefore, I run VMware Fusion on my Mac to be able to access VSphere and manage my ESXi host.

The trouble is that both ESXi and VMware Fusion use the control-alt shortcut to release a console. So as soon as you start using a console within the VSphere client which itself runs within VMware Fusion, you cannot get back to the Windows OS.

You will have either access to Mac OS X or the ESXi guest. And to top it of, the mouse just completely disappears on Windows.

To get arount this problem, you need to somehow be able to send a control-alt sequence to the Windows guest withouth actually pressing control-alt.

Fortunately, VMware fusion allows you to create a key mapping that allows this.

Within the preferance pane, the first tab is called Key Mappings. You can create a new key mapping. For example, I mapped control+q to control-alt. This allows me to get out of the ESXi guest within the VSphere client, witouth getting grown back to Mac OS X. As a side effect, the mouse also showed up again, which is to be expected.

I'd like to introduce the utility 'dstat'. Dstat provides detailed statistics about what is currently happening on your Linux box.

Dstat allows you to monitor the system load, disk troughput, disk io, network bandwith, and many more items.

Dstat is so valuable because it provides you with all required information on a single row that updates every so often. It is a great tool for debugging system performance. An example of the output of dstat:

Click on this image to view the dstat output at the original size. It will tell you a small story on what happened on the system.

As you can see, a copy action is going on between two disks. Then suddenly, some other process is writing data to the source disk. Both read and write performance drops. As soon as the additional writing process stops, the read and write performance of the still running copy process returns back to normal.

The real benefit of this utility is that it clearly provides almost all information you might want to know in a single line.

One of the most used options are the disk throughput and network throughput columns. By default, dstat displays the aggregated throughput for all disks and network cards. You can bypass this behavior by specifying individual disks or network devices with the -D or -N option, like:

dstat -D sda,sdb -N eth0,eth1 20

Please note that the '20' argument at the end specifies how often the screen gets updated. Thus every single row is the average of that 20 second time frame.

For a full overview of all options that are available, issue the 'dstat --list' command.

You may find it very useful.

I started a project to see if I could track smartphone users by sniffing for wifi-clients. Most smartphones support wifi and most people don't bother disabling wifi when they go outdoors1. If wifi is left on, it is possible to detect these smartphones and track their movement. To be able to track smartphones, all I had to do is grab a computer with a wifi card and start to listen for nearby smartphones.

Over de course of 10 days I was able to detect around 590 unique wireless client devices passing the vicinity of my house (near Amsterdam, The Netherlands). Please note that not all of those devices are smartphones, so I have to determine which are and which are not. I just used airmon-ng to sniff for wifi clients.

It is very easy to track a person if wifi is enabled on their smartphone since the phone will broadcast its unique identifier: its MAC-address. A MAC-address is as unique as a phone number so ideal for tracking down people. A single wifi sniffing computer is not enough to follow people, but if you would setup a grid of wifi sniffing devices, tracking people would be very easy.

Then I got bored with this project and decided that if I could get any additional information out of my data set of 590 wifi clients. The fun thing is that the first tree parts of a MAC-address disclose the vendor of the device. For instance, this MAC-address (made anonymous) belongs to HTC, thus is probably an HTC smartphone.

90:27:E4:B7:XX:XX

There is a whole list that shows which MAC-addresses belong to which manufacturers. This allows me to create a list of vendors associated with the MAC-addresses I captured. This is fun, because I can now count how many devices I 'caught' from a particular vendor.

The majority of wireless devices are from Apple (64%). The second largest is HTC (12%). That is an incredible difference between number one and number two. If these numbers actually mean anything, they are very interesting.

I think this picture is telling, but it's accuracy can be questioned. There are some problems with my data set. For instance, maybe many people using a particular brand of smartphone who do often disable wifi to conserve battery life.

Also, look whose missing in this list: Sony Ericsson. Are Dutch people not using Sony Ericsson smartphones? I must say that I deliberately used a Sony Ericsson smartphone to test my setup and it detected the device without any problem. So Sony Ericsson devices might not be that popular.

The main question is which conclusions can be drawn from this data: that iOS users often leave their wifi enabled and more than other smartphone users?

It is difficult to say what this data actually means and how accurate it is, but it may be an interesting technique none the less for real-life sampling of a smartphone population.

1 Unless your phone is so crappy that it won't hold a charge through the day with wifi enabled.