How do we find the user in question so we can thump them on the head to make them stop?

This is a basic exercise in information gathering. For the most part, we’ll have the user’s IP address, and we’re a mac shop with many users running iTunes. If the user is sharing their library, you can use iTunes as a covert means of determining a user’s name, as iTunes will use the local computer’s name as the library name.

Telnet to the machines DAAP port, and issue:

John-adamss-macbook-pro:~ jna$ telnet x.x.x.x 3689
Trying x.x.x.x...
Connected to x.x.x.x.
Escape character is '^]'.
GET /server-info HTTP/1.1
Host: x.x.x.x
Client-DAAP-Version: 3.7
User-Agent: iTunes/8.0.2 (Macintosh; N; Intel)
Accept-Language: en-us, en;q=0.50

HTTP/1.1 200 OK
Date: Tue, 13 Jan 2009 21:26:38 GMT
DAAP-Server: iTunes/8.0.2 (Mac OS X)
Content-Type: application/x-dmap-tagged
Content-Length: 280

msrvmstt?mproaproaeSVaeFPatedmsedmsmlmsmOk?[minmUSER NAME’s LibrarymslrmstmsalmsasmsupmspimsexmsbrmsqymsixmsrsmsdcmstcImmsto???

Other options for this include attempting to sign on to the server with Apple-K if AFP on TCP port 548 is active (which will reveal the computer’s name) and using nmap with service detection to glean information about the host.

In my previous Apple Macbook Pro to Local network host (Mac Mini) testing, my top connection speed was around 2.4 Mbps. After the upgrade, it’s between 4.65Mbps and 7.5Mbps. Nothing near the promised speeds of 802.11N (300Mbit/sec), but I suspect that this is because of an incompatibility between Apple’s hardware and Netgear’s Hardware.

------------------------------------------------------------
Client connecting to 10.1.1.15, TCP port 5001
TCP window size:   129 KByte (default)
------------------------------------------------------------
[  3] local 10.1.1.70 port 51617 connected with 10.1.1.15 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-10.0 sec  8.59 MBytes  7.19 Mbits/sec

Update:

After disassociating and reassociating with the AP, speeds went way up:

retina:~ jna$ iperf -s
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 64.0 KByte (default)
------------------------------------------------------------
[  4] local 10.1.1.15 port 5001 connected with 10.1.1.70 port 52865
[ ID] Interval       Transfer     Bandwidth
[  4]  0.0-10.0 sec  34.8 MBytes  29.1 Mbits/sec

With other devices on the WLAN, speeds go down. My current theory is that 802.11g devices on the same wireless network (such as the older Macbooks that we have) drag 802.11n speeds down, but I’m yet to be able to prove that.

I turned to CAIDA, the Cooperative Association for Internet Data Analysis, which has long been a provider of excellent network performance tools. Their research focuses on developing tools to measure the Internet in many amazing ways, such as this map of interconnections between the all Autonomous Systems (AS) of the Internet. 

There’s many tools available, but the unofficial standard for bandwidth measurement is iperf. It’s a simple tool to show the maximum possible bandwidth between two points. One machine runs a server, using ‘iperf -s’. The client connects to the server (using iperf -c server) and as much data as can be sent in a single interval is sent. 

Between two of my machines running OS X 10.5.5, I get great results:

retina:/tmp jna$ ./iperf -c hackintosh -i 1
------------------------------------------------------------
Client connecting to hackintosh, TCP port 5001
TCP window size:   129 KByte (default)
------------------------------------------------------------
[  3] local 10.1.1.15 port 52150 connected with 10.1.1.20 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0- 1.0 sec    107 MBytes    894 Mbits/sec
[ ID] Interval       Transfer     Bandwidth
[  3]  1.0- 2.0 sec    109 MBytes    912 Mbits/sec
[ ID] Interval       Transfer     Bandwidth
[  3]  2.0- 3.0 sec    107 MBytes    901 Mbits/sec

The situation is not so wonderful between my laptop, An Intel Macbook Pro, on 802.11N wireless via a Netgear WNR3500.

dhcp-102:iperf-2.0.4 jna$ src/iperf -i 1 -c hackintosh
------------------------------------------------------------
Client connecting to hackintosh, TCP port 5001
TCP window size:   129 KByte (default)
------------------------------------------------------------
[  3] local 10.1.1.102 port 49518 connected with 10.1.1.20 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0- 1.0 sec  2.45 MBytes  20.6 Mbits/sec
[ ID] Interval       Transfer     Bandwidth
[  3]  1.0- 2.0 sec  2.59 MBytes  21.8 Mbits/sec
[ ID] Interval       Transfer     Bandwidth
[  3]  2.0- 3.0 sec  2.36 MBytes  19.8 Mbits/sec

I don’t believe wireless sales materials anymore (when did I ever?) regarding the maximum speed of these devices. I have five bars on Apple’s wireless icon here, the Macbook Pro supports 802.11N, and I can’t get more than 21.8 Mbits/sec to local machines here. On my Comcast cable, my maximum download speed is around 13 Mbits/sec, so I probably have the best speed possible for downloading from the Internet, but moving files across the local LAN via wireless is a different story. It’s much slower and I’ll go directly to the gigabit, hard wired connection for movies and music.

Interestingly enough, 21.8 Mbits/s is well within 802.11g’s allocation of 25 Mbits/s per client. My 802.11N configuration is no better than 802.11g, even though Apple’s Network Utility reports a link speed of 130Mbits/second and that I have the 802.11 a/b/g/n Network adapter installed.

I’m unsure as to why the network configuration disagrees with the achieved bandwidth, though. It’ll be something I research in the next few days.

I’d also like to take a moment here and condemn Belkin’s entire line of wireless devices. They use a piece of Javascript with breaks the RFC standards in so many ways. If you attempt to configure these devices using CIDR, such as “10.1.1.0/24″, which is what my home network is, their devices force you to a netmask of “255.0.0.0″ because the javascript in the setup form sees 10.0.0.0/8 as a class A network. Classless notation in network allocation is the standard these days, and Class A, B, and C notation is a thing of the past.

This broke my network for hours until I was frustrated enough to bring the device back to Best Buy and purchase the WGR3500. At least I didn’t have to deal with an online return!