The Men & Mice Blog

Version 8.3 – Faster, Leaner, Fitter DHCP

Posted by Johanna E. Van Schalkwyk on 1/11/18 11:16 AM

Doing DHCP

The beauty of DHCP is the speed at which it functions. Basically, DHCP (Dynamic Host Configuration Protocol) does what administrators can do manually, but DHCP just does it automatically, more efficiently, and in a fraction of the time.

Size can trump speed

Yet the bigger a network gets, the more DHCP servers and scopes are needed to dynamically assign, or lease, IP addresses and related IP information to network clients. The number of servers and scopes and the way the load is distributed and processed affect the speed at which networks can keep DHCP data fresh and IP leases available for use. On large networks, how efficiently DHCP lease data is documented, processed and synchronized becomes just as important as the initial matchmaking between DHCP clients and servers.

The relationship between DHCP client and server

DHCP does the hard work of handling communication between servers on a network, and client computers trying to access that network. If the series of messages between a DHCP server and a client computer would be illustrated as a conversation, it would probably look something like this.

DHCP conversation.png

Mind you, at any given moment on a large network, hundreds, or even thousands, such conversations can be occurring simultaneously. On top of that, the client computer sends its DHCPDISCOVER broadcast packet to all available servers, and all available servers can respond with a DHCPOFFER. The client is not programmed to be picky and always accepts the first offer it receives. Once they detect that their offers were not accepted, the other DHCP servers will withdraw their offers. In short, there’s a whole lot of to-and-fro action behind the scenes that is invisible to network administrators and users, but still finds its way into DHCP servers’ lease history. 

To complicate matters – or simplify it – these DHCP client-server relationships, or leases, are mostly temporary arrangements. Both parties know it will end. The server will revoke the lease once it’s expired. The client, on the other hand, can attempt to keep the lease by renewing it, or start looking for another IP address lease if the one they had had expired.

Apart from doing matchmaking between clients and servers, DHCP also ensures that each network client has a unique IP address and appropriate subnet masks. If two clients were to try and use the same IP address, neither of them would be able to communicate on the network.

These rotating relationships make the way DHCP lease data is documented, processed and synchronized so much more critical. If this is not done fast and efficiently, the whole process of dynamically assigning IP addresses can become slowed down, leaving DHCP clients, servers and ultimately network users, frustrated and ineffective.

Making DHCP management faster, leaner and fitter

Once networks run to hundreds, or thousands of DHCP scopes and servers, one needs to re-assess the way DHCP data is processed, and develop ways to improve speed and efficiency. This is exactly what Men & Mice developers set out to achieve in Version 8.3 of the Men & Mice Suite.

DHCP optimizations in Version 8.3 include:

  • Reduced network traffic, especially between the Central server and a DHCP server controller 
  • Improved database performance when processing data from a DHCP server
  • Reduced load on a DHCP server while it is being synced

Optimizing processes in these areas has resulted in lightening the often heavy load on DHCP servers, making DHCP server management considerably faster and more efficient – and more pleasurable for the people in charge of keeping it all going, all the time.

To dig into the more technical aspects of these enhancements and get the lowdown on what this boost in DHCP performance and scalability could mean for you or your network, get in touch with one of our sales engineers to walk you through the details.

 New Call-to-action

Topics: Men & Mice Suite, IPAM, DHCP, CLOUD, Akamai, Performance

Men & Mice Suite Version 8.1 – Loving you long time

Posted by Men & Mice on 1/24/17 10:10 AM

It’s January, so it must be time for the annual Men & Mice Suite LTS release, aka long term support release.

A version upgrade of the Men & Mice Suite is scheduled for release three times a year. The versions are differentiated as Long Term Support (LTS) releases, and feature releases.

The first release in January of every year is an LTS release. By LTS we mean this version will be supported for two years after its initial release date. The two feature releases have a shorter LTS.pngsupport cycle.

While the primary focus of the feature releases is to introduce new functionality and features, the primary focus of the LTS releases is to fine-tune and improve newly introduced features, as well as to improve the stability and performance of the Men & Mice Suite in general. We like to see our annual LTS release as the prime example of our commitment to quality, superior functionality and keeping our solution as fast, simple and stable as our customers have become accustomed to.

To have a peek at what good features found their way into the Suite in 2016 and are fine-tuned in Version 8.1, check out details on our Windows Server 2016 support, REST API and VMware plug-in here. If you want to sink your teeth into the REST API, read our detailed article on the subject. And if you’re curious about support for ISC Kea DHCP and Windows Server 2016 Response Rate Limiting, look no further than here.

Finally, read more on how Men & Mice also made inroads into the cloud in 2016 with support for Azure DNS, developed in close cooperation with the Microsoft Azure Team.

One brand new tidbit added to 8.1. is a beautiful new look to the console. A new, fresher font and some easy-to-follow icons are sure to make the superior Men & Mice Suite ergonomic experience all that much more visually pleasing. Enjoy!

All further information on Men & Mice Suite Version 8.1 is obtainable from the Documentation Release Notes.

New Call-to-action


If you’d like to meet up with Men & Mice in person, please come and visit us at Booth E54 at Cisco Live Berlin at the end of February.

If you can’t make it to Berlin, let Men & Mice come to you - sign up for the Bind 9 Logging Best Practices webinar on February 2nd!

Happy January all the way from a not-so-chilly Iceland,

The Men & Mice Team

 

Topics: Men & Mice Suite, DDI

Men & Mice Suite Version 7.3 – Plugging into VMware while having a REST

Posted by Men & Mice on 11/10/16 9:12 AM

Men & Mice Suite Version 7.3 has arrived - and not a minute too soon! Yet considering that it’s jam-packed with goodies such as a brand-new REST API, VMware vRealize Orchestrator plug-in and further support for Windows Server 2016, it was definitely worth the wait.

Let’s take a quick peek at what Version 7.3 has in store for our customers.

Taking a break with the REST API

API.png

API. In the world of the Internet, it means Application Programming Interface. In the world of the Icelandic language (where Men & Mice has its roots) it means … monkey. Literally. And maybe just as well – a good API, with or without hair, really does seem to make life so much better.

Monkey business or no monkey business, the Men & Mice REST API is sure to offer customers a very welcome extra set of hands - and feet, so to speak – with which to create workflows and write handy scripts for the import and export of data, amongst other things.

Used by browsers, REST (Representational State Transfer) is often considered to be the language of the internet. By using HTTP requests to GET, POST, PUT and DELETE data, REST paves the way for two computers to communicate over the internet by one acting as a web server and the other as a web browser. Making use of a stateless protocol, RESTful services exhibit particularly fast performance, reliability and scalability.

The Men & Mice REST API includes all the functionality of the existing Men & Mice SOAP API and JSON-RPC, but delivers the added advantages of ease of use, combined with a rich set of tools and support libraries. Additionally REST, as a resource-based instead of a standards-based API, means users gain considerably greater operational flexibility.

More information on how to get the most out of REST can be found in the Men & Mice REST API article.

Plugging in where it matters – VMware vRealize Orchestrator Plug-In

Men & Mice takes a further step towards simplifying virtualization by introducing the VMware vRealize Orchestrator plug-in. Designed to integrate seamlessly within the VMware Orchestrator framework, the Men & Mice Suite VMware plug-in allows for fast and efficient provisioning of virtual machines.

 

vmware_plugin.png

 

When a Men & Mice Suite user puts in a request for a new virtual machine (VM), the vRealize Orchestrator receives the next available IP address from the requested subnet, together with other essential configuration information. vCenter creates the VM and communicates the changes back to the Men & Mice Suite, which then updates DNS infrastructure accordingly. Additionally:

  • the Men & Mice Suite’s custom properties allow further customization of the VM’s visibility and status.
  • VM information retained in the Men & Mice Suite enables VM tracking, synchronization and updates, including the release of IP addresses after a virtual server is taken down.
  • the Men & Mice Suite talks to DNS servers and registers DNS entries and other changes, such as updates to DNS policies, thereby consolidating DNS data required by the vRealize Orchestrator.

By plugging into the vRealize Orchestrator, the Men & Mice Suite enables integrated functionality that not only saves time, but also strengthens security, eliminates errors of configuration and ensures improved and continuously synchronized network manageability.

Windows Server 2016 Support Released in Tandem with General Availability

Men & Mice Suite support for primary Windows Server 2016 DNS and DHCP features was already included in Version 7.2, released in May 2016. A stand-out feature was support for Response Rate Limiting, which significantly reduces the impact of a Denial of Service (DoS) attack on servers.

With Windows Server 2016 achieving General Availability in September 2016, Men & Mice expands its support for the following additional Windows Server 2016 features:

DNS policies

DNS policies grant a user control over how queries are handled based on specific criteria. These criteria can, for example, be used in the following scenarios:

  • High availability of DNS services
  • Traffic management
  • Split brain DNS 
  • Filtering
  • Forensics
  • Redirection based on date/time

Specific types of policies are:

  • Zone transfer policies
    Essentially used to define how zone transfers take place, zone transfer policies control zone transfer permission on the server level or the zone level. 
  • Recursion policies
    Control how the DNS server performs recursion for a query. 
  • DNS query resolution policies
    Used to specify how incoming DNS queries are handled by the DNS server. 

IPv6 root hints

The IPv6 root servers can now be used for performing name resolution. 

DANE TLSA records

DANE, or DNS-based Authentication of Named Entities, allows a domain owner to specify in a particular DNS record which certificates authorities are allowed to issue for the domain.

The Men & Mice Suite Release Notes provide more detail on other minor improvements and fixes that form part of the Version 7.3 Release.

That wraps it up for a quick round-up of all things new and shiny that the Men & Mice Suite Version 7.3 has to offer. If you’d like to jump right in and try out these new features, treat yourself to a Version 7.3 free trial. 

Men & Mice Suite trial

 

Coming up in December is the last in our 2016 series of webinars, this time focusing on DNS high availability tools. Don’t forget to sign up!

 

Topics: Men & Mice Suite, DDI, API, VMware

Men & Mice Web Service: REST API

Posted by Men & Mice on 11/10/16 6:42 AM

Introduction

Men & Mice is expanding our web service offerings by adding a REST API web service to the existing SOAP/XML and JSON-RPC services.

This article serves as an introduction to the Men & Mice REST API, providing information on background, purpose and functionality.

What is REST?

REST, or more specifically Representational State Transfer, is often described as the language of the Internet. An architectural style for distributed hypermedia systems, REST was first introduced by Roy Fielding in his doctoral dissertation at UC Irvine in the year 2000.

Fielding’s experience as one of the principal authors of the HTTP specification led to his development of REST as a set of principles and constraints for communication between computers on the Internet. The six architectural constraints unique to REST are client-server separation, statelessness, cacheability, uniform interface, layered systems and code on demand – the latter being the only constraint that is optional.

According to Fielding, the purpose of creating REST was to simplify and enhance the distribution of data between systems. Given how widespread REST has become, it’s safe to say Fielding’s mission has been accomplished. Architectural properties affected by REST are performance, scalability, simplicity of a uniform interface, modifiability of components, visibility of communication between components, portability of components and reliability.

Since its introduction, REST has gained much popularity, likely due to its positive effect on architectural properties and its simplicity, both particularly critical in the era of exponential increases in cloud usage offerings. Today, the majority of new web services are designed as RESTful[1] services instead of SOAP/XML, JSON-RPC, or other types of communications.


Why add a REST API to the Men & Mice Suite?

Men & Mice web services in the form of SOAP/XML and JSON-RPC provide an extensive set of commands to configure and control all aspects of the Men & Mice Suite. However, REST has become the first choice of communication for web service applications. By making use of a stateless protocol, RESTful services exhibit particularly fast performance, reliability and scalability. Additionally, REST’s simplicity generally makes it easier for users to get started and engage with the service.

The greatest difference for users between SOAP and REST is that SOAP as a standards-based web service access protocol is more rigid in execution, whereas REST as a resource-based web service provides greater flexibility. In most cases, a user will only need a browser or a simple command line tool such as cURL to access data from a RESTful web service.


How does the Men & Mice REST API work?                                               

In REST, the focus is on resources. You specify a resource with a URL (Uniform Resource Location) and then apply an operation on the resource using an HTTP method.

The Men & Mice REST API supports the four most common HTTP methods: GET, PUT, POST and DELETE.

  • GET – Retrieve a resource (read)
  • PUT - Modify an existing resource (update)
  • POST - Add a new resource (create)
  • DELETE - Remove a resource (delete)

The resources or the objects found in the Men & Mice Suite are:

  • AddressSpaces
  • ADForests
  • ADSiteLinks
  • ADSites
  • ChangeRequests
  • CloudNetworks
  • Clouds
  • Devices
  • DHCPAddressPools
  • DHCPExclusions
  • DHCPGroups
  • DHCPReservations
  • DHCPScopes
  • DHCPServers
  • DNSRecords
  • DNSServers
  • DNSViews
  • DNSZones
  • Folders
  • Groups
  • Interfaces
  • IPAMRecords
  • Ranges
  • Roles
  • Users

 
An example of a URL referring to a DNS zone would be:

            http://mmsuite.company.com/mmws/api/DNSZones


To get all the zones defined in the Men & Mice Suite you would use HTTP GET:

            GET http://mmsuite.company.com/mmws/api/DNSZones


To get a specified zone, e.g. test.menandmice.com, you would also use HTTP GET, but with a reference to the specific zone:

            GET http://mmsuite.company.com/mmws/api/DNSZones/test.menandmice.com.

 
The Men & Mice REST API understands two types of content: JSON and XML. The content type of the response will depend on the type of content in the request. If there is no content in the body of the request, the web service will check for a clue in the HTTP header fields "Content-Type" and "Accept". If either of the fields exist and contain "application/json", it will return a JSON formatted response. If either of the fields exist and contain "application/xml" or "application/soap+xml", it will return an XML formatted response. If no clues can be found, it will select JSON as the response format.

It’s also possible to mix these two content types during the same session and the web service will simply respond with JSON if this was a JSON request, or XML if the content type detected was XML.

The Men & Mice REST API is built on the same code base as both SOAP/XML and JSON-RPC. However, some of the commands you will see in SOAP/XML and JSON-RPC are not a part of the REST API. The reason for this is that in REST, the focus is on resources, not commands. You can, however, execute all the commands found in SOAP/XML and JSON-RPC using the URL: api/command/<command>.  For example, to get all orphan DNS records found in your Men & Mice Suite, you can say: 

            GET http://mmsuite.company.com/mmws/api/command/GetOrphanReverseDNSRecords


Orphan DNS records are PTR records where the corresponding A/AAAA record is missing.

For possible commands, please refer to the Men & Mice SOAP reference manual.


Arguments

The Men & Mice REST API supports many arguments that can be added to the URL. For example, when getting zones you can say:

            GET http://mmsuite.company.com/mmws/api/DNSZones?limit=2&pretty=true

This would return to you a list of zones in the Men & Mice Suite. At the most two lists would be returned, with the output made easier to read by adding lines and spaces.

There are a few arguments that are always available, no matter what resource you are referring to:

  • pretty – If set to ‘true’ it will make the response more readable.
  • server - Name or address of a Men & Mice Central server to connect to.
  • loginName - The name of the user who wants to log in.
  • password - The password for the user.
  • session - An ID of a valid session.

These arguments are only optional. You don't need to use arguments to log on to a server. The Men & Mice REST API offers different types of authentication, such as Basic Authentication, Windows NTLM and Kerberos. Note that in order for a user to be able to use the REST web service, the user has to have the applicable permission to use the web user interface.

There are some arguments that you can provide in many cases when using the HTTP GET method:

  • filter - Filtering criteria for the result returned.
  • offset - Specifies the offset to use when listing the results. A value of 0 starts with the first result.
  • limit - The maximum number of results to return.
  • sortBy - The name of the field to sort by.
  • sortOrder - The sort order to use.

When adding, or changing a resource, you will need to provide some data. In most cases the data will be provided as a body of the HTTP request. Data can also be provided as an argument. The server will understand that you are providing something that should be a part of the data. For example, when adding a DNS record, instead of providing a body with the HTTP method POST, you can say instead:

            POST http://mmsuite.company.com/mmws/api/DNSZones/test.menandmice.com./

                        DNSRecords?dnsRecord={ "name": "restest", "type": "A", "data": "1.2.3.11"}

 

Filter arguments

The filter argument is a powerful argument that can be provided with most of the HTTP GET methods. It allows you to limit the result you get to only the items you want to see. You can use wildcards and regular expressions with a filter.

The filter has the following format:

            [<property>:][!][^]<value>[$]

Both <property> and <value> can be quoted using " in case they contain characters that might confuse the filter, such as a space. The "!", "^" and "$" are all optional where the "!" symbol means ‘does-not-match’, the "^" sign means ‘starts-with’, and the "$" sign means ‘ends-with’.

 

Some examples:

Filtering by string "mycorp" on all properties:

            filter=mycorp

Filtering by string "mycorp" on property "name":

            filter=name:mycorp

Filtering by string starting with "mycorp" on property "name":

            filter=name:^mycorp

Filtering by string not ending with "mycorp" on property "name":

            filter=name:!mycorp$


If the text must contain whitespace, it must be quoted to filter by string, not starting with "requested by" on property "comment":

            filter=comment:"!^requested by"


The same applies if the property name contains whitespace, so to filter by string "mycorp" on property "Company Name":

            filter="Company Name":mycorp


When getting zones, the following filter can be used to get all master zones, excluding reverse zones:

            filter=type:^Master$ name:!arpa.$


Getting only zones with name "domain.com.":

            filter=name:^domain.com.$


Getting only zones ending with the name "domain.com.":

            filter=name:domain.com.$


The following examples illustrate the usage of a filter when getting DNSRecords. The next filter will get all records containing the name "time" from within the specified zone:

            filter=name:^time$

Getting all A records from within the specified zone:

            filter=type:^A$

Getting all records with data "ntp":

            filter=data:^ntp$

Getting all A records with the name "time":

            filter=type:^A$ name:^time$

 

Men & Mice REST API in action - examples 

Several great tools are available for working with web services, such as Postman and cURL.

Postman is highly recommended, especially for those interested in testing web services. Postman allows the testing of requests, after which it can be asked to generate code snippets for that request in different programming languages.

cURL is a popular command line tool that is available on most platforms. It is installed by default on most Unix flavors. For Windows, it can be downloaded from https://curl.haxx.se  

cURLl can be handy when you want to export data or combine data with simple scripts. The examples on the following pages were created by trying out the REST API using cURL.

For these examples, let's assume that our web service is running on the server mmsuite.company.com, our user name is "john" and our password is "secret". 

$ curl --user john:secret -X GET http://mmsuite.company.com/mmws/api/DNSServers

{

  "result": {

    "dnsServers": [

      {

        "ref": "DNSServers/3",

        "name": "a-win2008r2.mmsuite.company.com.",

        "resolvedAddress": "172.17.0.17",

        "port": 1337,

        "type": "MS",

        "state": "OK",

        "customProperties": {},

        "subtype": "Win2008",

        "enabled": true

      }

    ],

    "totalResults": 1

  }

}


Since we didn’t provide any information about what kind of content type we wanted, the server responded with JSON output. If we want to get the result back in XML format, we can simply add the XML "Content-Type".

$ curl --user john:secret --header "Content-Type: application/xml" -X GET http://mmsuite.company.com/mmws/api/DNSServers

<response>

  <result>

    <dnsServers>

      <dnsServer>

        <ref>DNSServers/3</ref>

        <name>a-win2008r2.mmsuite.company.com.</name>

        <resolvedAddress>172.17.0.17</resolvedAddress>

        <port>1337</port>

        <type>MS</type>

        <state>OK</state>

        <customProperties />

        <subtype>Win2008</subtype>

        <enabled>1</enabled>

      </dnsServer>

    </dnsServers>

    <totalResults>1</totalResults>

  </result>

</response>

 

 
Now let's try to use filters and get a list of all reverse zones in the Men & Mice Suite.

$ curl --user john:secret -X GET "http://mmsuite.company.com/mmws/api/ DNSZones?filter=name:in-addr.arpa.&pretty=true"

{

  "result": {

    "dnsZones": [

      {

        "ref": "DNSZones/10",

        "name": "1.5.2.in-addr.arpa.",

        "dynamic": false,

        "adIntegrated": false,

        "dnsViewRef": "DNSViews/3",

        "authority": "a-win2008r2.remote.mm.lab.",

        "type": "Slave",

        "dnssecSigned": false,

        "kskIDs": "",

        "zskIDs": "",

        "customProperties": {}

      },

      {

        "ref": "DNSZones/11",

        "name": "10.in-addr.arpa.",

        "dynamic": false,

        "adIntegrated": false,

        "dnsViewRef": "DNSViews/3",

        "authority": "a-win2008r2.remote.mm.lab.",

        "type": "Slave",

        "dnssecSigned": false,

        "kskIDs": "",

        "zskIDs": "",

        "customProperties": {}

      }

    ],

    "totalResults": 2

  }

}


Notice the quotation marks around the URL and the arguments. The reason for this is that we are using characters such as "&" that might confuse the command line. By putting quotation marks around it, we are saying that everything inside the quote is a part of the data and should not be interpreted in a different way.

Here is another great example of how powerful the filters are. Let's find all A records starting with “vm” in the zone dev.lab.

$ curl --user john:secret -X GET "http://mmsuite.company.com/mmws/api/ DNSZones/dev.lab./DNSRecords?filter=type:^A$ name:^vm&pretty=true"

{

  "result": {

    "dnsRecords": [

      {

        "ref": "DNSRecords/374",

        "name": "vm-1",

        "type": "A",

        "ttl": "",

        "data": "10.4.4.3",

        "comment": "",

        "enabled": true,

        "dnsZoneRef": "DNSZones/20"

      },

      {

        "ref": "DNSRecords/376",

        "name": "vm-1",

        "type": "A",

        "ttl": "",

        "data": "10.4.4.1",

        "comment": "",

        "enabled": true,

        "dnsZoneRef": "DNSZones/20"

      },

      {

        "ref": "DNSRecords/377",

        "name": "vm-1",

        "type": "A",

        "ttl": "",

        "data": "10.4.4.2",

        "comment": "",

        "enabled": true,

        "dnsZoneRef": "DNSZones/20"

      }

    ],

    "totalResults": 3

  }

}


Note that all of the GET commands can be executed in a simple browser. When you enter a URL in a browser, it will send an HTTP GET command to the server you are referring to. This can become handy if you don't have cURL installed. You can try this by opening a browser, entering the address of your Men & Mice Web Server and appropriating a REST resource, e.g.

            http://menandmice.com mmws/mmws/api/DNSZones&pretty=true

If your Men & Mice web service is configured to allow Basic Authentication or Windows Authentication (NTLM or Kerberos), it will prompt you for a user name and password.


Scripts or programming languages

Now what about scripts or programming languages? Because, as mentioned earlier, REST is the simplest and most popular choice when creating a web service, it is usually well supported in all languages. As an example, let's look at how we would list out all records in a reverse zone that are suspicious. A reverse zone usually only contains NS and PTR records. Other record types are allowed, but usually don't appear there.

We wrote this script using Python. Python is a great scripting language and well-suited to smaller scripts, especially when dealing with JSON and strings. It is a pretty comprehensive language, yet there are plenty of additional libraries to be explored, if one should need something more.

From Python 3 onwards you can use the http.client library to create a REST request. Bear in mind that Python 2.7, however, does not include the http.client library. Since we will be using Python 2.7, we will be using the requests library which is not a part of the standard installation. For information on how to install the requests library, see http://docs.python-requests.org/en/latest/

#!/usr/bin/env python

#

# restDemo.py - list all suspicious records found in

# reverse zones

import requests

 

username = 'john'

password = 'secret'

headers = {'content-type':'application/json'}

url = 'http://mmsuite.company.com/mmws/api/'

params= {'filter' : 'name:in-addr.arpa.'}

 

sess = requests.Session()

resp = sess.get(url + 'DNSZones', params=params, auth=(username, password), headers=headers)

# resp should now contain a list of all reverse zone

if resp.ok:

    for zone in resp.json()['result']['dnsZones']:

        print 'checking zone: ' + zone['name']

        # for each zone get all the records

        resp = sess.get(url + zone['ref'] + '/DNSRecords'

                    , auth=(username, password), headers=headers)

        if resp.ok:

            for rec in resp.json()['result']['dnsRecords']:

                if rec['type'] not in ['SOA', 'NS', 'PTR']:

                    print '\t!!!\t' + rec['name'] + '\t' +

                          rec['type'] + '\t' + rec['data']

 


The output resulting from the script is illustrated in the next box.
 

$ ./restDemo.py

checking zone: 1.5.2.in-addr.arpa.

checking zone: 10.in-addr.arpa.

checking zone: 137.168.192.in-addr.arpa.

checking zone: 4.6.2.in-addr.arpa.

checking zone: 49.10.in-addr.arpa.

checking zone: 7.3.2.in-addr.arpa.

checking zone: 2.2.63.in-addr.arpa.

      !!!   jonas TXT   test

 

 

The script found 7 reverse zones. One of them contained a TXT record which we consider suspicious.

And just for fun, because we love those filters, we could have used them to retrieve only the records that are not of the type SOA, NS and PTR. So the last part of our Python script could have been written like this:

...

        print 'checking zone: ' + zone['name']

 

        params= {'filter' : 'type:!^(SOA or NS or PTR)$'}

        # for each zone get all the records, only get records of

        # all types other then SOA, NS or PTR

        resp = sess.get(url + zone['ref'] + '/DNSRecords', params=params

                    , auth=(username, password), headers=headers)

        if resp.ok:

            for rec in resp.json()['result']['dnsRecords']:

                print '\t!!!\t' + rec['name'] + '\t' +

                       rec['type'] + '\t' + rec['data']

 

Writing the script this way leads to less traffic and less load, which can make a difference if the reverse zones are large.

When creating scripts, it is best to create a new, dedicated user account that only has access to the objects the script needs to function. If you are running Microsoft Windows in an AD environment, the web service can also be configured to allow single sign-on.

Men & Mice REST API: Summary

The primary focus of the Men & Mice development team has always been to simplify the complex task of administering a DDI[2] environment, while retaining network flexibility and maintaining speed, as different network environments and different types of users have very different needs. To achieve this flexibility, our mission has been, and continues to be, developing and providing a rich set of commands, combined with easy user access through a web service interface.

Extending the Men & Mice Suite to include a REST API creates a powerful additional tool for users. With the Men & Mice REST API, users gain easier access to data in the Men & Mice Suite, as well as the means to process it according to their particular needs. The Men & Mice REST API therefore extends the range of tools with which customers can create workflows, write handy scripts to import and export data or generally just develop customized ways to lighten the load of administering the often complex, but vital, daily tasks existing in our technical lives.

[1] REST or RESTful?

REST is the set of architectural constraints and is not dependent on any protocol. Web service APIs are typically called RESTful when they adhere to the REST architectural constraints. Practically every RESTful service uses HTTP as its underlying protocol.

[2] DNS, DHCP and IP Address Management

Topics: Men & Mice Suite, API

Microsoft Azure DNS and Men & Mice Making More Sparks Together

Posted by Men & Mice on 9/29/16 10:57 PM

Chemistry. Sometimes, when two separate entities meet, they just have it. Sometimes they don’t. When it comes to Men & Mice and Microsoft, it’s definitely a case of the former. There’s surefire chemistry, and, even though the relationship already dates back to way back when, we’ve never been stronger together than we are now.

Just this week, Microsoft Azure announced General Availability of their domain hosting service, Azure DNS, in a joint statement with Men & Mice, released on September 26th at the Microsoft Ignite conference in Atlanta, USA. The General Availability announcement comes slightly more than a year after Microsoft first unveiled the public preview of this new addition to their cloud network offerings at Microsoft Ignite in Chicago in 2015. Men & Mice had already announced support for Microsoft Azure DNS in January of this year, with the release of the Men & Mice Suite Version 7.1. Now everyone is able to pick the fully ripe fruits of this productive partnership.

According to Jonathan Tuliani, Program Manager for Azure Networking – DNS and Traffic Manager, with this announcement Azure DNS is now ready to be used for production workloads. Given that Azure DNS “is supported via Azure Support and is backed by a 99.99% availability SLA” this means that Men & Mice Suite customers can now sit back and enjoy the high availability, performance, low cost and convenience of hosting their domains in the cloud with Azure DNS, while maintaining full control of their DNS domains and IP address blocks with the help of the powerful DNS, DHCP and IP Address Management (DDI) tools provided by the Men & Mice Suite.

azure_dns.jpg

Magnus E. Bjornsson, CEO of Men & Mice, sees this as one more positive step towards the continued development of third-party support products in close cooperation with Microsoft. “We are proud partners of Microsoft and embrace the opportunity to join forces with this leader in the field of IT. Our mutual collaboration enhances the value of the open and adaptable Men & Mice Suite to our customers.”

The Men & Mice Suite already exhibits a core, unfettered synergy with Microsoft Active Directory, which helps to make it one of the world’s top choice suppliers of DNS, DHCP and IP Address Management software solutions. With the addition of support for Azure DNS, as well as support for Windows Server 2016, there’s no telling where this juicing up of existing chemistry will take us next. If the past is anything to go by, it’s bound to be a happy combination of small steps and giant leaps towards collaborative, innovative creation.

The full General Availability announcement can be accessed on the Microsoft Azure blog.

 

Topics: Men & Mice Suite, DNS

Men & Mice Suite Version 7.2 Released

Posted by Men & Mice on 5/19/16 10:38 AM

Flying High with Kea DHCP and Windows RRL

Men & Mice celebrates the arrival of the long, arctic summer nights with the release of Version 7.2 of the Men & Mice Suite.

This blog post offers a quick round-up of what’s new in Version 7.2.

Versatile simplicity, as always, forms our bottom line. Version 7.2 is no exception. This time around, support for the new ISC Kea DHCP server and a dedicated UI for Windows 2016 Response Rate Limiting (RRL) should warm the hearts of network administrators far and wide. At least, that’s what it’s been doing for us here in the North!

Let’s run through what major highlights Version 7.2 contains.

Taking flight with the new ISC Kea DHCP server

Men & Mice introduces support for the brand new ISC Kea DHCP server, the natural successor to the ISC DHCP server.

Like its namesake, the uniquely strong and intelligent New Zealand kea parrot, the brand new ISC Kea DHCP server is a powerful beast that reaches more than 1000 leases/second, allowing for clean and fast implementation of both DHCPv4 and DHCPv6.

Kea DHCP also boasts PXE Boot Support, DHCPv6 prefix delegation, dynamic reconfiguration and dynamic DNS updates.

As with other servers supported by the Men & Mice Suite, the Kea DHCP server functionality is fully controlled through the Men & Mice Management Console. This includes the effortless migration of IP subnets (scopes), including options, from ISC DHCP to Kea DHCP.

In the spirit of open source, Kea DHCP is released under the widely used Mozilla Public License 2.0, paving the way for collaborative improvements to the source code for many years to come. 

A taste of the Kea DHCP and how it integrates with the Men & Mice Suite, can be enjoyed in this recent webinar presented by Mr Carsten Strotmann.

For those interested in plunging into the Kea DHCP full force, Men & Mice, in cooperation with ISC, is offering intensive two-day hands-on training courses in Europe and the USA in the fall of 2016. The courses are aimed at small groups, so don’t forget to sign up in time! 


Scaling up with Windows Server 2016 support

The Men & Mice Suite’s architecture as an overlay solution exhibits a singular synergy with Windows Servers, making it the logical solution for any Microsoft-based network. Consequently, the Men & Mice Team is developing and releasing support for specific new Windows 2016 features as and when they are made available by Microsoft.

From Version 7.2, the Men & Mice Suite supports all of the primary Windows DNS and DHCP Server 2016 features.

Support for other new Microsoft Server 2016 features, such as DNS Zone Scopes and DNS policies, is scheduled for the Men & Mice Suite Version 7.3 release later this year.


Reinforcing DNS Security with Windows 2016 RRL

Security only works if you work it, and the more tools you have to work your security, the better. Adding to your menu of security options, the Men & Mice Suite Version 7.2 introduces a dedicated UI for the Windows 2016 Response Rate Limiting (RRL) feature.

Response Rate Limiting can make all the difference in the event of a Denial of Service (DoS) attack on DNS servers. During a DoS attack, the IP number of a victim computer is used to send high volumes of forged DNS queries to multiple DNS servers. DNS servers tricked into sending replies to these queries can push the number of DNS requests and replies over a manageable threshold and disable targeted networks. Restricting DNS servers’ response rate with Response Rate Limiting helps to control a suspicious volume of malicious enquiries and minimize the impact on the affected servers.

Microsoft sheds more light on Response Rate Limiting and how it works on their TechNet blog.

RRL.png


Men & Mice Suite Console Enhanced

Spring cleaning at the Men & Mice headquarters has resulted in a Management Console with a cleaner, and ultimately more manageable, look. From Version 7.2, windows in the Management Console are dockable, making it both simpler to manage and easier to navigate for the user.

MC.png

 

The Men & Mice Suite Release Notes provide more detail on other minor improvements and fixes that form part of the Version 7.2 Release.

That wraps it up for a quick round-up of what Men & Mice Suite Version 7.2 has to offer. In the next months, Men & Mice will publish further blogs and webinars on installing and managing Kea DHCP, Windows 2016, Docker containers and Yeti. Watch this space! Or better yet, just watch Men & Mice.

Free Trial of Suite

 

Topics: Men & Mice Suite, DDI, IPAM

Men & Mice Suite Version 7.1 Released

Posted by Men & Mice on 1/14/16 10:30 AM

Men & Mice, one of the world’s leading providers of DNS, DHCP and IP address management (DDI) software solutions, announces the release of Version 7.1 of the Men & Mice Suite.

The Men & Mice Suite is a software-based IP Address Management (IPAM) solution, used by many large and growing global enterprises, to establish secure and efficient control of their networks.

As an overlay solution with a particularly robust SOAP API, the Suite is deployed on top of existing DNS and DHCP servers, thereby granting seamless control over hybrid environments that include Linux, Unix, Microsoft and Cisco IOS servers - all without the need to replace your current IP infrastructure, and providing tight MS/AD integration where required.

Supporting a wide range of DNS and DHCP servers (BIND, Microsoft DNS/DHCP, Unbound, Cisco DHCP and ISC DHCP) and increasingly reaching further into the cloud with support for Amazon Route 53 and, from Version 7.1, also Microsoft Azure DNS, the Men & Mice Suite offers superb solutions for network administrators involved in the daily battles of administration, planning, auditing and reporting in large networks.

Major Version 7.1. Highlights

Release Strategy and Naming Scheme

Version 7.1 introduces the Men & Mice long term support (LTS) release strategy, concurrent with the new Men & Mice Suite version naming scheme. Both the LTS release strategy and the new Suite version naming scheme aim at better aligning Men & Mice products with the diverse protocols and demands existing in our customers’ individual operating environments. For more information on the Men & Mice release strategy and naming scheme, please read the white paper here.

Azure DNS

Together, Amazon and Microsoft are the undisputed leaders in cloud services with their respective cloud computing platforms, Amazon Web Services (AWS) and Azure. In 2014, Men & Mice took the initiative with transforming DDI for the cloud by adding support for AWS Amazon Route 53. Now, from Version 7.1, Men & Mice is taking DDI cloud dexterity one step further by also adding support for Microsoft Azure DNS. Known for its versatility in heterogeneous operating environments, support for Azure DNS further strengthens the Men & Mice Suite’s ability to scale successfully with businesses as they grow outwards, and upwards, into the cloud.

Other highlights of Version 7.1 are:

  • Microsoft SQL Server 2014 is now supported as a database backend for Men & Mice Central.
  • Improved usability with the First Use Wizard. Users will now be able to paste in all license keys at once instead of having to paste them in one at a time.
  • The Linux installers for the Men & Mice Remote Controllers have been improved and features added, such as a silent mode which enables the user to automate the installation of the Men & Mice Remote controllers.
  • A new Scope Creation Wizard makes creating DHCP scopes even easier.
  • No need for untimely upgrading prompts. From Version 7.1, the Update Manager has been adapted to accommodate long term support (LTS) releases. Users can now select if they only want to be notified of LTS releases in the Update Manager.
  • DHCP lease history gathering has been improved, lightening the load on SQL servers.
  • Men & Mice Suite administrators can now disable one or multiple servers from within the Men & Mice Suite.

Detailed release notes on Version 7.1 can be obtained here.

 

Men & Mice Suite version 7.1 Free Trial  


 


About Men & Mice

Founded in 1990, Men & Mice is headquartered in Iceland.  Drawing inspiration from our strategic geographic location midway between the USA and Europe, we possess a unique perspective on the challenges of DNS, DHCP and IP address management faced by medium to large, and growing, global enterprises today.

The combination of our extensive experience and expertise and our excellent software products, provides our customers with versatile, yet highly reliable, DDI solutions.

In a competitive DDI market, we pride ourselves on our ability to adapt our solutions to suit our customers’ needs. We don’t expect our customers to adapt their needs to suit our solutions.

Men & Mice has operations in the US, Europe and Asia, as well as resellers in many countries.

Contact us at Sales or Call us at +1 408.516.9582 to speak to a sales representative.

Topics: Men & Mice Suite, IPAM, CLOUD

DDI dreaming with Candle Stealer

Posted by Men & Mice on 12/24/15 1:00 AM

kertasnikir.jpg

Last to arrive, Candle Stealer (Kertasníkir) follows children in order to steal their candles, which, in former times, were made of tallow and therefore edible.

It’s beyond me why Mother had so many children.  Some say there are 80 of us living in the mountains. I don’t know. I’ve long lost count. Besides, she only seems to trust the 13 of us to go down to the humans AND find our way back, so who cares about the others.

Why only 13, I’m sometimes asked. I really can’t say, although I suspect it has something to do with Mother’s obsession with DNS and the DNS root name servers number 13. Perhaps she was hoping they’d rename the servers after her boys. Calling them A, B, C, D, E up to M is really, well, uninspirational, she’s said. Then again, we existed long before DNS. Mother conveniently seems to forget this the moment she switches on her computer.

I’m really, really tired now. Need a break. I told Mother I’ve had enough of snow. Next year, I plan to find my way into some hot countries and dive into an Azure blue ocean. I demand her full support for my adventure. She didn’t answer. She had that far-off look on her face. I like to call it her IPAM expression, the one that makes her look as if she’s stored her consciousness in a Cloud and she’s busy figuring out how to connect all the dots. I think she’s dreaming of a new set of Windows. She may be a bit harsh on naughty children, but she’s very clever at deciphering clues and optimizing network utilization.

Too tired to chase children tonight. Hungry. Need candles but children nowadays only seem to have electrical bed lights and lava lamps. Last year, I ended up eating a scented candle in the washroom. Unpleasant after effects that had.

Maybe it’s time for me to think out of the box and adapt to the times. Up, up and away I go! Merry Christmas All!

Goodbye 2015!

Hello 2016!

Boy, are we going to have a good time together!

 

Topics: Men & Mice Suite, DDI

Updating reverse DNS records with Meat Hook

Posted by Men & Mice on 12/23/15 1:00 AM

kjotkrokur.jpg

Second-last to arrive, Meat Hook (Ketkrókur) stealthily steals meat with a hook.

Sometimes I just don’t know whether I’m going forwards or backwards. This time of year it’s especially bad. So much meat everywhere!

Once I get down to the humans with my sack of presents, the smells just make me go round and round and round and round. Roast turkey here, smoked leg of lamb there, glazed ham, prime rib, stuffed chicken, juicy quail, tender beef, pork crackling! Where to start! I really have to be careful. It’s so mouthwatering, I might just end up slipping on my own saliva.

When I don’t know where to turn, I like to spend a moment syncing before I make any decisions. You know, updating my reverse records and all. I find it’s best to use the Update Reverse Records Wizard in the Men & Mice Suite for this purpose. It allows me to create reverse DNS zones for selected ranges that exist on subnet boundaries and contain 254 or more IP Addresses (/24 or larger).

I only need to access IP Address Ranges on the object list, select the ranges, right-click, select Update Reverse Records from the shortcut menu and take it from there. Dead easy!

Now only if it were that easy to sync some roasted meat straight onto my hook …

 

Click here to get daily  DDI tips and tricks delivered straight to your inbox

Topics: Men & Mice Suite, DDI

Monitoring DNSSEC with Doorway Sniffer

Posted by Men & Mice on 12/22/15 1:00 AM

gattathefur.jpg

Third to last, Doorway Sniffer (Gáttaþefur) uses his abnormally large nose and acute sense of smell to locate Christmas “leaf” bread.

It’s a gift they say. You can do so much with it! Sure, it kind of stands out and it is a somewhat conspicuously grand sniffer nose for a simple Yule Lad, but it’s a talent like no other. Not even trained sniffer dogs can match my ability to detect delicious leaf bread, no matter where it’s hidden. I’m also super good at finding keys and lost toys, but only if you managed to touch it with sticky fingers before losing it. I generally find more keys than toys.

Large sniffers are often also sensitive sniffers. Just like a signed DNSSEC zone is much more vulnerable to software or operational errors, my sniffer is also more vulnerable to bread errors. Sometimes, I think I’m detecting “leaf” bread, but the only thing on offer is gluten free spelt bread. That’s such a disappointing misconfiguration.

In a signed DNSSEC zone, such small misconfigurations can render the whole zone invalid. Therefore it’s always a good idea to monitor a newly signed DNSSEC zone to detect potential DNSSEC validation issues before the zone goes public. Or at least that’s what Leppaludi says, and he sure knows a lot about validation issues, being married to Mother and all. He’s given me a great list of tools to help me monitor DNSSEC signed zones. Who knows, it might even help me with my nose!   I just won’t be the same without it.

Click here to get daily  DDI tips and tricks delivered straight to your inbox

 

Topics: Men & Mice Suite, DDI