Misc.

How to avoid VPN on host and only connect to LAN on host?

Leave a comment

So I’ve got this work computer… yes it has too many group policies preventing me from what I want to do so I installed a VM using Player trying to set up my own stuff in the VM. I’m struggling to set up the VM’s network so it bypasses work VPN on the host and only acts as another computer on my LAN. Is this possible?

 

The VPN is Citrix Gateway, the network connection for the VPN is on Citrix Virtual Adapter network adapter. Windows 10 Enterprise.

 

In addition, the PC has cellular capability. But I don’t think it’s possible to bridge the VM to the cellular adapter? It’s a DW5820e Intel 7360 LTE-A cellular adapter.

 

I could set up a proxy server on my LAN and just use the proxy server. Citrix Gateway is letting me have access to my LAN. But I want to explore if it’s possible to have the VM completely separate from the VPN connection and only use my LAN connection, wired or wireless.

Misc.

DEM Not Applying Default Apps

Leave a comment

Hello there,

 

We have a new win 10 1909 environment we’re trying to roll out and we’re having extreme issues with DEM not applying/saving default apps and FTAs correctly and we cannot figure out why.

 

I have the Default Apps and FTAs flex engine enabled with a predefined forced setting to set Internet Explorer as default browser and to set adobe reader to open PDFs.

 

It seems to save and apply the adobe reader FTA, and it actually seems to map .http and .https files to Internet Explorer, but it only makes IE the default browser about 40-50% of the time, so when we click on a link inside of outlook it opens up in edge.

 

I worked with support and they had me drop the .xml file in the file type association page on DEM as well and like I said that part seems to be applying correctly just not for the default application part.

 

I’ll attach several pictures and a log of my latest login to see if that will help any.

 

I do appreciate it!

 

Edit: I apologize, I forgot to list that we are using DEM version 9.11 as well.

Misc.

YARA’s XOR Modifier, (Mon, Oct 14th)

Leave a comment

YARA searches for strings inside files. Strings to search for are defined with YARA rules.

With the release of YARA 3.8.0, support for searching for XOR encoded strings was introduced. By adding the modifier xor to the definition of a string, YARA 3.8.0 would search for strings that were XOR encoded, with a single-byte key, ranging from 1 to 255.

Here is an example of a string with xor modifier.

    rule xor_test {
        strings:
            $a = “https://isc.sans.edu” xor
        condition:
            $a
    }

This YARA version’s xor modifier would not match unencoded strings.

Apparently, that was not the purpose, and this was fixed with version 3.10.0.

The same rule would now also match unencoded strings.

With the latest version of YARA, 3.11.0, a YARA rule developer has now control over which XOR key range is used by modifier xor.

This is done by specifing an optional minimum-key – maximum-key range after the xor modifier, like this: xor(min-max).

The following rule has an xor modifier with key range 0x01-0xFF (minimum/maximum keys can be specified with decimal or hexadecimal values).

    rule xor_test {
        strings:
            $a = “https://isc.sans.edu” xor(0x01-0xFF)
        condition:
            $a
    }

This rule will not match unencoded strings.

 

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Misc.

WARNING: LRO: 977: cannot aggr pkt from port 0x5000002 as lro session port is 0x5000004

Leave a comment

We have started receiving the warning: “WARNING: LRO: 977: cannot aggr pkt from port 0x5000002 as lro session port is 0x5000004″.  The esx hosts are running 6.5 build 10884925.  I searched through VMware’s knowledge base, without success.  AS of yet I do not see any indications of a problem.  Any information around the error would greatly be appreciated.  We are using a nimble array with HP Proliant DL 380 G10, usiing

 

 

Thanks,

ShineKnox

Uncategorized

HPE Custom Image for ESXi 6.7 + Proliant Microserver Gen10 No IPMI capabilities

Leave a comment

Hi there,

I’m really a newbie, so I may be asking something stupid, but I hope you can help me.

I downloaded and installed the HPE Custom Image for ESXi 6.7 GA Install CD on a HPE Proliant Microserver Gen 10 and everything went smoothly.

The thing now is about monitoring.

On the web client I go to Host > Monitor and the system says: This system has no IPMI capabilities, you may need to install a driver to enable sensor data to be retrieved.

Since here https://www.hpe.com/it/it/servers/hpe-esxi.html you can read (in Italian) “it supports Gen 9 and newer servers”

My understanding was that using this image I would not need to install anything else to monitor stuff like the RAID controller status.

 

Can you help me?

 

The final goal is to get to know ESXi, in order to make a step forward and offer our customers a better service but I am moving my first steps in this V-world and everything is really interesting but overwhelming.

 

Thanks in advance.

Uncategorized

Hostd, vpxa and the vSphere API/SDK – Confusion on where the APIs actually live

Leave a comment

Hi All,

I’m taking the VMware vSphere Deploy, Manage course and was confused about this:

  • In one slide, the instructor showed that vCenter Server communicated with the ESXi host using vSphere APi/SDK (The VMware Host Client also communicated using this)
  • In another slide, the instructor showed that the vCenter Server communicated with a vCenter agent living on the ESXi host (vpxa). This then communicated with another process called hostd, which then executed commands at the hypervisor…

With the second bullet point in mind, where does the vSphere API/SDK fit in? Is hostd the item that houses the vSphere API? Does vCenter communicate with vpxa, which then communicates with hostd using the vSphere API/SDK?

 

Clarification would be much appreciated.

Misc.

Videos flickering

Leave a comment

Hello, Greetings, Can any expert here please tell me what is the hardware and Vmware settings needed on ESX 5.1 to be able to play videos on  windows servers 2008 and 2012R2. The videos are flickering currently.

Misc.

Esxi upgrade from 5.5 to 6.0U3 HPE custom offline bundle VMware-ESXi-6.0.0-Update3-6921384-HPE-600.10.2.0.23-Feb2018-depot.zip requires VSAN?

Leave a comment

Hello all,

 

I am trying to upgrade one of my HPDL 380 G7 servers from Esxi Ver 5.5 to Esxi ver 6.0U3 using the esxcli and the VMware-ESXi-6.0.0-Update3-6921384-HPE-600.10.2.0.23-Feb2018-depot.zip.

 

I SSH into box and run

 

#esxcli software vib update -d “/vmfs/volumes/mydatastore/VMware-ESXi-6.0.0-Update3-6921384-HPE-600.10.2.0.23-Feb2018-depot.zip”

 

I receive the following about VSAN being required??

[DependencyError]

VIB VMware_bootbank_esx-base_6.0.0-3.79.6921384 requires vsan >= 6.0.0-3.79, but the requirement cannot be satisfied within the ImageProfile.

VIB VMware_bootbank_esx-base_6.0.0-3.79.6921384 requires vsan << 6.0.0-3.80, but the requirement cannot be satisfied within the ImageProfile.

Please refer to the log file for more details.

 

Can anyone provide any insight on how I can resolve this error and get my Dl380 G7 server to upgrade to esxi 6.0U3?

 

Much appreciated