Power saving techniques

There are several ways to save energy when it comes to working in a (Windows based) home network. You can for instance lower the total power consumption of your PC by switching the Power Plan in Windows 7. By doing so, your PC will turn off unused hard disks, use less power for wireless radios and go to standby sooner when your user session is idling.

As we all know, you can put a PC in standby or hibernation instead of shutting it down. Even though shutting a computer completely down will save more energy than putting it in standby, it can be very useful to have the computer resume its duties quicker. I don’t put my workstations in standby or hibernation as an SSD as a boot drive makes cold boot a snappy 20 seconds wait.

Downsides to being green

The biggest problem with implementing power saving techniques is that they make the use of your computer (or in my case, my personal server based on Windows Home Server) less practical. Services running on your computer available to your local network are disrupted by these green initiatives. In the Enterprise space we have seen a great shift from using large amounts of systems (idling mostly) to using less and concentrated virtualization servers making systems and entire datacenters more efficient without it interrupting the (often SLA secured) services.

Of course the home or small business setup can be too small to warrant huge virtualization implementations. They would probably use up more energy making the whole deal rather pointless. To overcome the downsides of unavailability during standby, we have been resorting to Wake on LAN for a while now. The idea is that you wake up a computer that is in standby or hibernation remotely so it can do your bidding (RDP’ing into it, using webservices, transfer files et cetera) by sending a special command to the sleeping computer.

My weapon of choice

My personal setup is based around a Windows Home Server computer. This headless device (e.g. display / keyboardless) is stored in my utility closet next to my fiber router and TV cable connections and does all my bidding through connections of the wireless and wired network. By default Windows Home Server (and most home server software) is designed to run 24 hours a day consuming a lot of power when you don’t even need it. Think about how many hours you are out and about, cooking and sleeping when you simply have no need for it’s services. In my case I barely need it services for about 3 hours on a work day and 5 hours on a day in the weekend. So why have it run 143 hours a week when I’m not even using a computer or am at home?

To resolve this issue, I’m using LightsOut, a plugin for my Windows Home Server that automatically puts my server into hibernation when it’s idling for more than a period of time (for me, 10 minutes). It monitors sources (computers, IP addresses, load on CPU) to see if there are users using the server via a computer on the local network. By installing a small client on home computers, it has a direct connection between the two peers. It can not only put other computers in standby but also wake each (wired connected) computer up to make a backup. Basically the server won’t sleep when any of the Home Server connected computers (or other monitored sources) are using it and until all sources are disconnected for at least 10 minutes. The small client software sends a little Wake-on-LAN packet to the server upon resume/boot of a client in the event the server isn’t awake at that time.

Even though the provided client software provides an option to wake the computer in the event it’s sleeping, waking up the server when not using a PC can be more of a hassle. Using the LightsOut plugin it’s easy to make the server sleep and wake on command using the provided software, however wanting to do this without the LightsOut tools and the WHS connection can be rather annoying but not impossible.

Waking the server without the extra software

Because the server is configured to respond to Wake-on-LAN commands (a rather simple packet on UDP port 9), you can use any tool that support WOL commands to be send to the server. A number of Windows and smartphone apps can do this for you as long as you know the MAC Address of your server (also called the Physical Address). To find out the physical address of your Windows Home Server, you’ll have to make a Remote Desktop connection to it and start a command prompt on it. After that run the command ipconfig /all on it and look for the needed information:

In my case, the physical address starts with 00-15-17-31 (or 00:15:17:31) depending on how you want to write it down. By sending a special WOL packet to your local subnet formulated using this MAC address, your server will wake up. You’ll want to test this thoroughly because even attempting Wake on WAN.

Making it even more practical (Wake on WAN)

Even though having the ability to wake up the server without a computer by using a smartphone app is great, you’ll still always need the MAC address on you and be on the local network. Not so great if you’re visiting a friends house and your server has gone to sleep.

To resolve this, we’ll have to forward the so called Magic Frame (WOL command) through your internet router and into your LAN subnet. Note however that not all consumer-minded routers can do this or will allow you to do this. Please refer to PortForward.com for instructions on setting up custom port routing on your own router. Regardless of your make and model, you’ll want to login into the web interface of your local router and port forward all traffic on UDP port 9 to your local subnet.

Why route all traffic on port 9 to your entire subnet when this can be considered a possible security issue? Because you’ll want the packet to reach your server. Most routers and all switches route traffic based upon the target MAC address. However you’ll setup the port 9 routing based upon IP addresses (to get techy with you, OSI layer 3 and it will need to be routed to a layer 2). Normally a router has an ARP table and a ARP cache to translate IP addresses into MAC addresses and of course even consumer routers need this as it is a big part on how TCP/IP networks work.

The biggest problem you’ll face when setting up Wake on WAN on a consumer router is the inability to see or let alone modify the ARP table (which most business and enterprise class routers and switches can do without breaking a sweat). This is because ARP tables aren’t something to mess with and can break your working network when misconfigured. Most consumer-minded routers cache a physical address for a small period of time in it’s ARP table cache however not always and never for a longer period of time making it highly unreliable.

To overcome the lack of reliable IP to MAC resolution and ensure the target MAC address receives the Magic WOL packet without the router knowing where to send it (because of the lack of information in the ARP table), we’ll have to send the packet to the entire subnet, effectively shouting the packet out loud to all computer on the network. Again this can be a serious security issue if mishandled. You should never route large amount of traffic to the entire subnet as it will flood your network. However, in this case the packet is very very small and contains no usable information apart from the physical address of your server. Other computers will receive the packet but ignore it as the packet itself will dictate who it wants to react.

The biggest problem you’ll have setting up Wake on WAN

As explained, you’ll need to route Wake on LAN packets (so called Magic Frame) to the entire subnet when using consumer grade routing equipment. The biggest problem you’ll face is most consumer grade router will simply deny you the option to route traffic to your entire subnet (a good idea as doing so is a huge security threat and most certainly bring your network speeds to it’s knees). Some will simply deny you the option to configure it while other routers may allow the configuration but instead completely ignore your wanted configuration. Luckily my D-Link DIR-655 using firmware version 1.31EU does allow me to configure it and it even works!

Try and setup routing of UDP port 9 to your local subnet announcement address (usually something like 192.168.1.255 or 10.0.0.255). Some (or most) interfaces will not allow you to do so. Some tips to circumvent this:

1. Try disabling Javascript in your browser to prevent the web interface from filtering your input.
2. Try upgrading or downgrading your router firmware.
3. Try looking for alternative firmware for your router like dd-wrt.
4. Try changing your subnet mask effectively changing your announcement address (because of the changing boundaries of your subnet). Most router UIs that block subnet routing assume you’re using 255.255.255.0 making the announcement address x.x.x.255 and thus filter on the last number > 255.

Sometimes it’s still not enough to just simply route all traffic on UDP port 9 to your entire subnet as some routers still won’t know how to route the traffic to a physical address as it doesn’t know (or simply forgot due to cache timeout) where to send it to. You can try to trick your router into remembering your servers’ physical address by adding it’s IP and MAC address to the DHCP exclusion list:

Great! Now with routing all setup, it’s time to test your new Wake on WAN setup. You could try this by asking someone else to do this or by sending wake up command via your smartphone disconnected from your WiFi and send the packets to your internet IP address. I found this to be a hassle when testing and found two great little websites specifically to send WOL commands to your IP: wol.dtools.net and wakeonlan.me. Get someone / your smartphone / these sites to send your public IP address the proper WOL commands for your servers physical address and your server should now rise from it’s deep sleep!

Now to get fancy…

I wanted this system to be friendly and easy enough so my girlfriend could also make use of it. So I made a little server status and Wake On Wan website for us both. It contains both uptime checkers and links to wake up our server. Want to wake the server to watch a little network-hosted movie on the media player using any type of internet browser (e.g. iPad) or maybe get some file from the home server when at work? Just a little visit to a simple website and the home server is running in no time.

This little mini site does nothing but host some quick links to often used systems and does a little check to see if specific services / computers are connectable from the web. It’s written in PHP and uses the following two bits of code:

• GetServerStatus() using fsockopen()
• WakeOnLan() using socket_create()

Throw the two scripts together on a simple public-facing always-on PHP host and you’ll be able to always turn on your systems without the need of special configured software or the need to be on the same subnet as your server! The extra shortcuts will make it easier for your better half to use your geeky infrastructure.

I had logged into my Vista Ultimate machine remotely over the local network. When I walked over to the machine itself, it showed this weird inverted login screen.

A touch of the mouse, fixed it. Two more on my Flickr account.

So last week I was going over some security principles and decided that file-based encryption wasn’t enough for my mobile system. I decided to look at drive encryption and for my scenario I had 2 very good and supported choices:

·         Windows Vista Bitlocker
I run Windows Vista Ultimate x64 so using Bitlocker would be a viable option for me

·         HP Protecttools Drive Encryption
The official business-level encryption solution provided by the OEM, HP, itself.

At first I wanted to use Bitlocker and I used the Bitlocker preparation Vista Ultimate Extra to prepare my harddrive for Bitlocker usage. The tool however refused to use my harddrive as it didn’t understood some of the partitions located on the drive (yes, even I have a dualboot to Linux, don’t like it tough) and it refused my harddrive.

Too bad and I decided to use the OEM-supported solution HP ProtectTools Drive Encryption. I figured as HP is a large and  good company (who has always given me great tech support here in the Netherlands), there would be no recovery issues in the event something should go horribly wrong.

And boy did things go wrong…

Earlier this month I turned on Drive Encryption in the software (which is buggy, doesn’t autolaunch the admin tool as Administrator in Windows Vista with UAC turned on, crap HP software). It took about 2 hours to encrypt my drive and it installed a little on-the-fly decryption app in the bootloader. All was working great and performance was still very good. I backed up a recovery key to 2 different USB sticks (just in case). It also asked me whether I wanted to use the online recovery service. As the service does nothing but store your decryption key for a ridiculous amount of money / year, I declined and used the USB-only solution.

Exactly one week ago, Thursday afternoon, I was prepping a demo I was going to give the following day @ 9AM. At around 15:00, I was done with my notebook and switched it to standby. Sometime later I had to change some boot arguments of the Windows Vista bootloader and used a few applications to reflect the changes needed (who I’m guessing rewrote the Vista bootloader, nothing fancy). All was good and I rebooted to test my changes and I noticed it didn’t load the HP decryption software (usually asking me for my password) and it just gave me a flashing cursor.

I rebooted again .. same. I booted a recovery dvd with a few partition manager applications on it. Double checked whether Vista partition was the active one. It of course was. I booted the Vista DVD and try to use auto fix. It couldn’t find my Windows drive (which is explainable as it is encrypted).

The HP system relies on the bootloader software to be present in order to decrypt the harddrive. Messing with the bootloader (which a normal OS installation next to you current OS would also do), seems to wipe away the HP software. Ok great.. now I have a locked drive.

Next up .. recovery.. I had my decryption key but no means to use it as the recovery option was a part of the bootloader decryption software. I quickly visited the HP.com support site in search of a recovery solution for the encrypted harddrive. No luck. Googled on the product name and found nothing usefull.

I quickly rang up HP Netherlands as it was about a hour before lines closing. Quickly got a pro (no level-1/level-2 filtering here, GREAT!) and explained the situation. However unfortunately due to some issues with the phone systems when using T-Mobile as a provider, I got disconnected. This happened a number of times and I quickly switched to landlines (after being on hold and being disconnected 3x). Ultimately had an employee working with me on how to resolve the issue. No luck. I explained my level of expertise on Windows Vista and systems overall and we both gave great ideas on how to possibly resolve the issue (recover the drive or reinstall the bootloader software). He looked in the central database and had no luck. It was over closing time and they had to cut the call short (which I understand). I asked them whether HP USA could help me further as they are 24/7. The Dutch support line said no as they use the same internal support KB.

I was getting late and quickly went to the shops to grab some food before they all closed. Some cooking later, I was looking at the software being used by HP for the encryption. HP ProtectTools uses a branded version of Safeboot (www.safeboot.com, now owned by McAfee). I again searched the internet but didn’t find a lot of useful stuff. One forum post noted the name (which I can’t say according to HP) of a recovery solution used by enterprises.

Via sources (I’m not allowed to say which ones according to HP) I got my hands on the decryption DVD. Great! Quickly inserted the disc and booted the system yet again. “Please enter daily 4 digit code”. Oh .. euh. 1234 .. nope. Tried some other numbers and couldn’t guess the number. I opted to cancel and the recovery app locked down. It had one other option “Activation via HP backup”. Hey! I have that. Inserted my USB stick and selected the file. “Valid”. Awesome! .. “Now please enter 4 digit daily code”. Arghh.

Looked up the support number for the Safeboot tool. The Dutch number was disconnected as McAfee had bought them. When trying the US number, I got connected to McAfee Enterprise support. I opted for Safeboot support. 1 minute waiting later, I had a tech person on the line. I explained my situation and stated I had the software. Just needed the key. The kind sir explained nicely to me they couldn’t give me the key without the proper SLAs. I understood however still lame the only thing holding me is a 4 digit code which the guy had displayed on his screen but couldn’t give me. I tried asking real real nice. Nope .. no go. He advised me to ring up HP USA.

So I did. Got disconnected 3 times whilst waiting (and having to pass the horrible voice-activated menu’s, what’s wrong with keyinput?) and had to wait another 15 minutes. Ultimately I got my tech person on the phone. Took about half an hour to explain the situation. Of course the ma’am couldn’t find anything in the KB either. I also explained my situation was urgent and I had to have the drive back before 9AM next morning. She would “look into it and do some research” while I would wait on hold (with the WORST waiting music EVER). I waited for up a to an hour. She was no help and couldn’t find anything. It took her over 90 minutes to realize with the Dutch guy did in 15 minutes. Ultimately she rang McAfee USA again and we had a little conference call (after I waited another 30 minutes whilst she was explaining the situation to McAfee). Ultimately I had the McAfee tech guy on the phone but again just like before, they couldn’t do anything for me.

I thanked them both and hang up (as waiting any longer or making a escalation ticket would be pointless and take way too long).  Nearly 5 hours of calling, waiting and being disconnected, I was no further in my quest to unlock my harddrive.

Another desperate 15 minutes of Googling and ringing up 4 IT Pro’s out of their beds, I gave up. I decided the best thing to do, was to wipe the harddrive and install a clean image. As I was using special software for the demo the following day, I couldn’t just use a backup. I had to reinstall from scratch. Of course all my documents and vital information was backed up to external hdd, LAN share and trusty Sharepoint sites so that wasn’t a too big a problem. However I did took me another couple of hours to setup the demo software again from scratch. By the time I got in bed, it was nearly 4AM.

The following day I got up at 7AM and give my demo at 9AM using my cleanly installed software (which went great dispite the 3 hours of sleep). Stayed on location till 6PM. After that I went to a friends house for dinner. Fixed his internet and had a good time. By the time I was back in my bed, it was 3AM/4AM.

So basically HP is providing a encryption solution they cannot support or recover for you in case something should go wrong. There are no external decryption tools provided. If you are using HP ProtectTools Drive Encryption right now, I really suggest turning it off and migrating away from the solution. At the very least, find some way to backup your bootloader containing the decryption software.

As for the recovery service which SafeBoot is providing for HP.. It’s a yearly fee to store your (kinda useless) recovery key online and a support service (allowing you to ring the 2 McAfee persons I talked to earlier directly). I asked McAfee whether that would have saved me in my situation had I taken up the subscription. The short answer: No. They only provide you your key and provide support for resetting the password remotely. They don’t provide support when your bootloader committed suicide.

I’m never ever using full drive encryption software by HP again! Perhaps HP could have given me a better solution had I waited a couple of days so they could escalate the problem to other departments and McAfee. I didn’t have the luxury of time, and you might not too when things go wrong. Stay away from HP Drive Encryption solutions (or anything Safeboot related).

One small note: I heard that Safeboot supported the HP software directly via their own helpdesk line thus unloading complex support calls to the HP helpdesk. However McAfee bought Safeboot in 2007. The HP agreement still stands but support is limited to enterprise SLA holders only.

As if the summer heat wasn’t bad enough in my home office (26C with AC, 32C+ without), it now officially killed one of my HDDs.

About 3 months ago I bought three new 750GB Samsung F1 disks and had put them all in RAID. All was sailing smooth and the speeds were amazing. However this last Wednesday I was working with multiple virtual PC’s whilst downloading and extracting large files in the background.

Whilst extracting, WinRAR threw an CRC errors. This can happen and luckily this can be fixed using some freeware utilities. I had set QuickPAR to fix the issues .. it crashed after a few minutes. Hmm strange…

Shortly after that explorer crashed and burned. I quickly saved all the data and rebooted the workstation. The Intel RAID manager (ICH9) threw an error: “Problem occured in disk 2″. Oh dear.

Surprisingly Vista booted through it but it was quite unstable. Excel would crash every 5 minutes. I stopped the computer again and took out the HDDs. They felt as if they were on fire (which is strange as they have active cooling on them and the aircon in the room was turned on). I’d let them cool down a bit, lay them beside the casing and targeted some extra casefans on them.

Booted through again .. again the RAID warning. Windows booted and looked stable enough. Using the Intel Storage Manager app I resetted the HDD back to normal state and all was fine. Some heavy I/O later on, thing became unstable again. Double checked the Intel app again: Disk 3 error.

Nice :\ … so HDD3 is officially dying. I got all the data on external backups so that was a problem. I killed the RAID, took the disk out and recreated the RAID with just 2 disks. Fast enough for me I guess. Sending the dying one to Samsung once it’s gone through the KillDisk hell.

As some of you may know, I picked up a Geforce 8800GT and I loved it. I, however, didn’t like the cooler that much. A singleslot cooler with a very loud fan on it. It was fair enough when idle. However put some load on it and it sounds like it would take off and take the PC with it. Two weeks later I ordered a new cooler and have waited for it to be shipped. After being in backorder for nearly 2 months, I canceled it.

This week I picked up the Zalman VF-1000. Installation was a charme (for me at least) but ended up fighting the tightness in my Antec P180 in order to install the fan header. After 10 minutes of trying to hook the damn thing up, I gave up and got myself a molex-3pinfan converter from the old cabinet. Hooked it up, worked perfectly.

As for the VF1000 performance, haven’t done real temperature measurements yet, but I’m not too fond of it to be honest. The low noise setting makes a rumble noise (like a seeking HDD) and the high-speed setting is only slightly more silent over the stock fan. But the overall exhaust heat is less so that helps.

I guess we’ve come to a point that hardware is so overpowered, silence is becoming a luxury most people won’t be able to afford. That’s what we get for pushing it

Thijs van Gils is a creative designer of multiple disciplines. He often creates diverse pieces of design. I don’t always get them as I tend to think in straight lines.. but then again it’s nice we’re not all alike because then the world would be very boring. Big thanks again to you Thijs. Included below is a little teaser of some of his work..

Vine Hallway from Thijs van Gils

Raindrops Intro from Thijs van Gils

You can reach Thijs on info at thijsvangils.nl

Why? you might ask.. Well .. just a little while ago I wrote about Sherweb eating my email and how it kinda pissed me off. One example was my hotel reservation I made about a month ago. Didn’t recieve the email at all. Even if I forwarded it myself using Windows Live Mail…

As DNS is updating (after correcting some server-side errors for the MX records) most of my email is coming in at the new server. Quickly I tested the (for me now famous “hoteltest”) spam filter on the new server by forwarding the email again to my mailbox.

A blank email with the url “http://www.choicehotels.com” went straight for the Junk Mail folder. However the forward of the orginal message went great and it landed securely in my inbox (or Postvak IN)!

Meaningless to you, allot to me

Try it! Comment on this post!

Sorry for not posting more TechEd stories .. I heard a lot of people liked them. I’ve been very busy and the trip for TechEd, tough very awesome, was also very tiresome.

Will update more once I have the time.