![\"\"](\"https://altbrain.net/media/posts/40/cable-conductors.png\")
I recently resurrected an EMC Data Domain as I have a new, potential use for it. It was offline for a while and the thought was to power it on, check out its health, the firmware version, and a few other things. As luck would have it though, when attempting to log in using the web UI, the page wouldn’t load. After poking at it for a few and some additional Googling, I found that the self-signed certificate expired resulting in the web services not starting. In this post, I’ll share the steps that were taken to get the UI back up and running.
\nhttps / http) to apply changes.First, connect to the device via SSH, grab the FQDN of the Data Domain, and confirm whether an imported host certificate exists for the HTTPS application:
\nadmin@datadomain# hostname\nThe Hostname is: datadomain.example.local\n\nadmin@datadomain# adminaccess certificate show imported-host application https\n**** There is no imported host certificate for application(s): https.If no imported host certificate exists (or if it is invalid), proceed with regenerating the self-signed certificate.
\nGenerate a fresh self-signed certificate and force a regeneration of the local Certificate Authority:
\nadmin@datadomain# adminaccess certificate generate self-signed-cert regenerate-ca\n\n** WARNING: Regenerating local CA certificate will invalidate existing trust with external system(s).\n Secure communication to trusted host(s) will be broken until mutual trust is reestablished.\n\n Do you want to proceed? (yes|no) [no]: yes\nNew certificates have been generated.Next, tear down the stale mutual trust entry associated with the local hostname and re-add it using the newly generated CA fingerprint.
\nDelete the old mutual trust entry:
\nadmin@datadomain# adminaccess trust del host datadomain.example.local type mutual\nDeleting trust with ' datadomain.example.local ' may cause some management functions to stop working.\n Are you sure? (yes|no) [no]: yes\n\nok, proceeding.Re-add mutual trust for the local hostname:
\nadmin@datadomain# adminaccess trust add host datadomain.example.local type mutual\nThe SHA1 fingerprint for the remote host's CA certificate is\nXX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX\nDo you want to trust this certificate? Are you sure? (yes|no) [no]: yes\n\nok, proceeding.\n\nFor adding the mutual trust with \" datadomain.example.local \", enter \" datadomain.example.local \" admin password:\nMutual Trust with host \" datadomain.example.local \" has been added.Finally, cycle the HTTPS and HTTP admin services to bind the new SSL certificates:
\nadmin@datadomain# adminaccess disable https\nHTTPS Access: disabled\n\nadmin@datadomain# adminaccess enable https\nHTTPS Access: enabled\n\nadmin@datadomain# adminaccess disable http\nHTTP Access: disabled\n\nadmin@datadomain# adminaccess enable http\nHTTP Access: enabledOpen a browser and navigate to https://datadomain.example.local. Accept the self-signed certificate warning, and the Data Domain System Manager login screen should load normally.
The other day, I was alerted to a storage space alarm on a Linux system that hosts a handful of Docker containers. Having had a few go arounds with Docker and logs filling up disks, I suspected that but logs weren’t to blame here. In this case, what was taking up considerable space was a decent collection of container images that accumulated over time. This post will review some basic troubleshooting and how to handle some basic Docker image maintenence.
\nFirst, let’s talk about how you get to this point. When you build or pull a new version of an image to update a container, in the end, the old container image isn’t automatically deleted. Instead, it remains stored locally on disk. Over months of automated deployment or iterative testing, dozens or hundreds of gigabytes of stale images accumulate under /var/lib/docker.
\nAs always, take a snapshot or some other backup that you can rely on.
\nStep 1: Check Storage Allocation Across Docker
\nBefore running destructive commands, inspect how Docker is distributing disk usage across images, containers, local volumes, and build cache. The output will show you the amount of Images and the space the consume along with how much space is reclaimable. This also shows the same info for actual Containers, Local Volumes, and the Build Cache
docker system df
Step 2: Inspect Active and Stopped Containers
\nBefore purging images, or anything for that matter, verify which containers exist on the host so you don’t accidentally attempt to wipe an image tied to a stopped but vital service.
docker ps -a
Step 3: List All Local Docker Images
\nInspect all locally available images, including tags, Image IDs, and sizes. Take note of the Image ID, which you may use in the next step providing you want to delete specific images.
\ndocker image ls
\nStep 3: Cleaning Up
\nOption 1 – If you want to manually delete a specific, obsolete image by its ID
\ndocker image rm <image_ID>
\nNote on Container Dependencies – If Docker prevents deletion with an error stating the image is referenced in a stopped container, you must either remove the stopped container first (docker rm ) or force removal (docker image rm -f )
\nOption 2 – Rather than deleting individual images by ID, to sweep away all untagged and dangling images safely, in that active and tagged images remain untouched
\ndocker image prune
\nOption 3 (Full Cleanup) – If you want to fully delete all unused images AND stopped containers AND unused networks AND build caches in one sweep
\ndocker system prune -a
\nWhen you’re all set, revisit Step 1 to see where you landed. Of course, you can also run below to see how the overall storage capacity has changed
\ndf -ah
", "image": "https://altbrain.net/media/posts/46/docker-img1-2.webp", "author": { "name": "Mike" }, "tags": [ "Linux", "Docker" ], "date_published": "2026-09-27T08:29:00-04:00", "date_modified": "2026-10-03T09:48:50-04:00" }, { "id": "https://altbrain.net/openssl-generate-private-keys-and-csrs-2.html", "url": "https://altbrain.net/openssl-generate-private-keys-and-csrs-2.html", "title": "OpenSSL, Generate Private Keys and CSRs", "summary": "I’ve run into a handful of occasions where I’ve had to defer to OpenSSL to generate certificate signing requests (CSR), for signing by certificate authority (CA) like an internal CA server or a 3rd party issuer like Digicert. Sometimes, applications, network gear, or something else…", "content_html": "I’ve run into a handful of occasions where I’ve had to defer to OpenSSL to generate certificate signing requests (CSR), for signing by certificate authority (CA) like an internal CA server or a 3rd party issuer like Digicert. Sometimes, applications, network gear, or something else you’re working with just don’t have the facilities or UI to pull this off but you need a SSL certificate. In these situations, my go to move is to hop on to a nearby Linux system and generate the private key and subsequent CSR from there. Then I take my CSR to to the CA for getting my signed SSL certificate.
\nIn this post, we’ll get right to it by displaying the steps below. I have added some brief comments to walk through this step by step. I have also added some additional details immediately below so check that out. If you feel that you want to just script this, then scroll way down to see the bash script there.
\n# Step 1 - Make a new folder for the certificate files, change directory to it\ncd /home/username/\nmkdir 2026-ssl-cert-renewal-appname\ncd 2026-ssl-cert-renewal-appname\n\n# Step 2 - Create a 2048 bit private key\nopenssl genrsa -out appname.example.com.key 2048\n\n# Step 3 - Restrict key permissions\nchmod 600 appname.example.com.key\n\n# Step 4 - Generate the CSR\nopenssl req -new -key appname.example.com.key -out appname.example.com.csr -sha256 -subj \"/C=US/ST=Washington/L=Redmond/O=Org Name/CN=appname.example.com\" -addext \"subjectAltName=DNS:appname.example.com\"\n\n# Step 5 - Before sending to your CA, validate:\n# CN = appname.example.com\n# Subject Alternative Name includes DNS:appname.example.com\nopenssl req -in appname.example.com.csr -noout -text\n\n# Step 6 - Send CSR to your CA for processing\nBelow are some some additional details for each of the above steps.
\nStep 1
You’re essentially, changing directory cd to your home folder, creating a new folder mkdir to save the private key and CSR in, and the changing directory cd to the new folder you made.
Step 2
You’re generating the private key with openssl, in this case a 2048 bit RSA key.
genrsa: This tells OpenSSL to use its RSA key generation tool. RSA is a commonly used algorithm used for securing web traffic.-out appname.example.com.key: This specifies the destination and name of the file where the private key will be saved. In this case, it writes it to a file named appname.example.com.key in your current directory.2048: This defines the key length in bits. 2048-bit is what we’re choosing here.Step 3
You’re restricting the private key permissions, immediately after creation. Do it, it’s a solid security practice. By default, the private key file may be readable by others depending on their umask. Running chmod 600 ensure that only owner can read the sensitive private key.
Step 4
You’re creating the CSR file in the current working directory using openssl.
req -new: Tells OpenSSL that you want to create a new certificate request.-key appname.example.com.key: Points OpenSSL to the private key you generated in the previous step.-out appname.example.com.csr: Specifies the filename for the outputted CSR file. This is the text file you will bring to your CA for signing.-sha256: Forces the request to use the SHA-256 hashing algorithm, to meet modern requirements.-subj \"...\": Bypasses interactive prompts by passing your organization’s identity details directly in a single line.-addext \"subjectAltName=DNS:appname.example.com\": Adds the Subject Alternative Name (SAN) extension. This is critical as modern web browsers ignore the Common Name (CN) for security verification and do look at the SAN list. Even if you only have one domain, it must be listed here as a SAN, or browsers will throw a “Not Secure” privacy error.Step 5
You’re validating that your CSR is in good shape
req: Tells OpenSSL you are working with a Certificate Signing Request tool.-in appname.example.com.csr: Points OpenSSL to the specific CSR file you want to examine.-noout: Suppresses the output of the raw, encoded text blocks (the -----BEGIN CERTIFICATE REQUEST----- clutter). You only want to see the decoded data, not the scrambled cryptographic text.-text: Instructs OpenSSL to print the contents of the CSR in full, human-readable text format.Want a script that you can bend to your own will? Here’s a good starting point in bash:
\n# Define your domain variable once\nDOMAIN=\"appname.example.com\"\n\n# Create the directory\nmkdir -p ~/certs/2026-${DOMAIN}-renewal\ncd ~/certs/2026-${DOMAIN}-renewal\n\n# Generate key and restrict permissions\nopenssl genrsa -out ${DOMAIN}.key 2048\nchmod 600 ${DOMAIN}.key\n\n# Generate the CSR using the variable\nopenssl req -new -key ${DOMAIN}.key -out ${DOMAIN}.csr -sha256 \\\n -subj \"/C=US/ST=Washington/L=Redmond/O=Org Name/CN=${DOMAIN}\" \\\n -addext \"subjectAltName=DNS:${DOMAIN}\"Before getting into it, I want to raise some caution. Every environment is different and you really want to make sure that you’ve got your head wrapped around what removing a domain controller will impact in your specific environment. In this post, the idea is to provide a high level view of the general process, while presenting some things to consider that are sometimes missed. The general idea is to think before you do and to do as much as possible to get you to a successful outcome.
\nrepadmin /replsummary and repadmin /showrepl to ensure Active Directory is replicating perfectly before you change the topology. Demoting a DC in an unhealthy forest can cause lingering objects.netdom query fsmo to see who holds the roles. If it’s this server, move them using PowerShell (Move-ADDirectoryServerOperationMasterRole).repadmin).netdom query fsmo). You may ask yourself, why would I do this again as I checked it the other day??? I will tell you why. You should do this because it takes 5 seconds and because not everyone is a great communicator. Other people sometimes do stuff that you’re not aware about. Ask me how I know!ping YourDomainName.local).A vSphere cross-vCenter migration allows you to move virtual machines (VMs) between two different vCenter Server instances. This comes in handy for data center consolidations, hardware refreshes, or general workload balancing. It’s a native vCenter feature that you can use if the vCenters are in the same SSO domain or if they are independent vCenters.
\nFor historic understanding and discussion, this cross vCenter migration capability was not baked into earlier versions of vCenter. Instead, it was available as a VMware Fling. Flings were the primary vehicle for rapid innovation, acting as a sandbox for features that eventually became foundational to vSphere. A lot of the Flings were rolled into final product releases, but in advance of that they were available to customers for download and for use “at your own risk”. Another example would be VMware PowerCLI. In my opinion, Flings came from a point in time when using VMware was exciting and the people who worked for VMware were excited and super innovative. This showed in their products and we benefited from their work, as a result. It’s a larger discussion, and maybe one for a future post, but it’ll be interesting to see if Broadcom looks and feels the same as their ongoing changes to the vSphere platform continue to evolve. What do you think?
In any case, as it relates to this write up, we will be working with 2 vCenter’s in 2 different SSO domains. We’ll be leveraging the Advanced Cross vCenter vMotion (XVM) method.
There are a few prerequisites to consider.
\nTo get things moving along, you’ll need to do the following:
\nAfter the migration wraps up, review the following
\nIn summary, not overly exciting but useful when you need it.
", "image": "https://altbrain.net/media/posts/43/object-migrate-img1.webp", "author": { "name": "Mike" }, "tags": [ "Virtualization" ], "date_published": "2026-08-12T08:26:00-04:00", "date_modified": "2026-10-04T20:18:12-04:00" }, { "id": "https://altbrain.net/monitoring-your-ups-and-pdu-gear.html", "url": "https://altbrain.net/monitoring-your-ups-and-pdu-gear.html", "title": "Monitoring your UPS and PDU Gear", "summary": "I wanted to post on this topic because the underlying UPS and PDU equipment that feeds our power thirsty server and network gear never seems to get much attention. These are the lowly, second hand citizens of our physical infrastructure. The good news is that…", "content_html": "I wanted to post on this topic because the underlying UPS and PDU equipment that feeds our power thirsty server and network gear never seems to get much attention. These are the lowly, second hand citizens of our physical infrastructure. The good news is that we’re breaking the silence today! In this post, I’ll shed some insights on how to give these unsung heroes the love and care they deserve.
\nTo set the stage, we’re purely focusing on the management of Schneider Electric (APC) gear, and specifically devices with APC NMC (network management card), Smart Connect, or common management interface ports. I’m sure that other brands have similar management capabilities. If you support alternate brand gear like Eaton, please do read on but you’ll want to contact your Eaton rep or VAR to see what they offer.
\nGenerally speaking, if you have a couple UPSs and PDUs, you’ll probably get away with managing the stand-alone devices on an individual basis. All these devices have a browser based management UI that you can log into and use to configure, manage, operate, and maintain them. You can set up alerts, view power stats, assess health, and a bunch of other stuff. Again, it’s not a big lift to manage them individually if you have just a handful. However, this approach doesn’t scale well when you’ve got a lot of these devices in all kinds of network closets, server rooms, IDF’s, MDF’s, and data centers. Taking it a step further, if you sprinkle these devices at remote sites all over the globe, you’re going to need to think of a better way to tackle this growing problem.
\nBy now, and as you can probably imagine, things start to get super difficult to manage as your environment grows. Often times though, since these devices are generally set and forget until there’s a problem, I’ve seen a lot of admins just turn a blind eye to them. However, the reality is that these devices run embedded operating systems and they expose services to the networks they connect to. These assets do indeed require operational maintenance throughout their lifecycle. It is indeed important to keep their firmware updated, the devices secure from vulnerabilities, their batteries maintained in a healthy state, and their warranties in check. To accomplish all this, we need one, single pane of glass. We need a tool where all these devices are all linked to, from where you can manage all of them centrally. In the Schneider (APC) space, this solution is referred to as Datacenter Infrastructure Management (DCIM) tooling.
\nYears ago, the preferred tool for this was called APC Data Center Expert. I’m not going to get into it here because I have a love hate relationship with it. It did certainly help manage a lot of distributed devices (loved it), but it was dated, cranky, and usually warranted a call to APC Support after every upgrade (hated it). It was a paid tool as well and just tossing that in here for general awareness.
\nFast forwarding to more recent times, Schneider Electric, probably recognizing that they needed a more modern solution, set out to deliver a reasonably good offering in Schneider Electric EcoStruxure IT Expert. This is a modern, SaaS, cloud-based solution that enables monitoring and visibility into your IT physical infrastructure from anywhere. Also, for general awareness, this is not a free service but I would say that the juice is worth the squeeze, in my opinion. It delivers on the centralized, single pane of glass experience and does so with a fairly simple to deploy solution.
\nBefore we get into the solution architecture and high level deployment, let’s talk about what it can do for your distributed power infrastructure. Below is a list of the features and capabilities that I find most useful and you can check out the link above to further dig into any of this.
\nIn terms of the solution architecture, it’s not a big deal or overly complicated. It pretty much consists of these main components:
\nTo help frame out how all the pieces fit, this is it what it looks like :
SaaS Web App at se.com <—– TCP, 443 —– ITE Gateway VM <—– various ports, protocols —–> PDU and UPS Gear NMC/Smart Ports
With everything up to this point in mind, the remainder of the post is the basic step-by-step. Consider this a general guide though and not specifically tailored for your environment and all its nuances.
\nLog into your NMC web interfaces and ensure the basics are set:
\nIf your security policy requires SNMPv3, ensure the encryption settings on the NMC match the Gateway. When configuring AES on the APC NMC, always select AES128 in the ITE Gateway interface. If you have firewalls between your gear and the gateway appliance, you must account for that in any applicable ACLs (see below)
\n| Source | \nDestination | \nProtocol | \nPort(s) | \nDescription | \n
| ITE Gateway IP | \nDevice or Device Subnet | \nUDP | \n161 | \nSNMP Polling | \n
| ITE Gateway IP | \nDevice or Device Subnet | \nTCP | \n21 and 22 | \nFirmware / Config File Transfer | \n
| Device or Device Subnet | \nITE Gateway IP | \nUDP | \n162, 1062 | \nReal-time SNMP Traps | \n
With your power gear ready to talk, it’s time to configure the ITE Gateway.
\nDeploy and Access the Gateway Interface – Once the Gateway software is installed on your local Windows or Linux server, open a browser and navigate to https://<Gateway_IP_or_Hostname>/gateway/index.html. Establish your local ITE Gateway admin password.
Define Device Credentials – Before scanning, you must tell the Gateway what strings to use. Go to Device Credentials and select New Credentials. Add your SNMPv1 community string (or SNMPv3 profiles) to match the settings you configured on the NMCs.
\nAdd File Transfer Credentials – Navigate to File Transfer Credentials and select FTP or SCP. Enter the management username and password for your APC cards. This allows ITE to push mass firmware updates directly from the cloud through the gateway.
\nRun Device Discovery – Go to Discover Devices. Input the specific static IP addresses or the entire management subnet range of your UPS and PDU gear. Click Discover. The gateway will scan the range, match the credentials, and pull the hardware into the local pool.
\nRegister Gateway to the Cloud – Click the Register Gateway button. Log into your centralized EcoStruxure IT organization account. This binds the local gateway token to your cloud tenant, sending all discovered UPS and PDU data straight to your cloud console and mobile app.
\nOnce the sync completes, log into the EcoStruxure IT web portal or mobile app to verify your deployment:
\nIn summary, and hopefully as you can see, this is not a big deal and actually a project that’s worth it in my opinion. It solves some real challenges and helps you manage a lot of stuff with more efficiency while greatly improving visibility and overall management. It’s not going to break the bank either. Connect with your Schneider Electric rep for more information and start giving these devices the love they deserve!
", "image": "https://altbrain.net/media/posts/41/datacenter-img1.webp", "author": { "name": "Mike" }, "tags": [ "Datacenter" ], "date_published": "2026-07-24T08:25:00-04:00", "date_modified": "2026-10-03T09:49:41-04:00" }, { "id": "https://altbrain.net/all-about-ethernet-cabling.html", "url": "https://altbrain.net/all-about-ethernet-cabling.html", "title": "All about Ethernet Cabling", "summary": "Ethernet cabling refers to the physical wires used to connect computers, routers, and switches within a Local Area Network (LAN). It transmits data as electrical pulses, providing a significantly more stable, secure, and faster internet connection than wireless networks like Wi-Fi. Not all cable is…", "content_html": "Ethernet cabling refers to the physical wires used to connect computers, routers, and switches within a Local Area Network (LAN). It transmits data as electrical pulses, providing a significantly more stable, secure, and faster internet connection than wireless networks like Wi-Fi. Not all cable is considered equal and there’s quite a bit to consider when you’re deploying low-voltage infrastructure to support common local area networks.
\nIn this post, we’ll scratch the surface and I’ll point out some of the basics to help display the different types of Ethernet cabling. We’ll also lightly touch on how things interconnect using Ethernet cabling. Let’s get started!
Ethernet Cable – Construction, Category, Data Rate, Bandwidth, Distance, and Common Usage
Immediately below is a cut-away image of a Cat5e Ethernet cable. Note the blue protective outer jacket, 4 twisted pairs (8 total conductors) that are twisted to reduce cross-talk of conductor wires, and a ripcord that’s used to slice open the outer jacket of the cable to expose the twisted pairs. The twisted pairs of conductor wires are color-coded: green, white-green / orange, white-orange / blue, white-blue / brown, white-brown. The conductor wires can be solid or stranded core. For what we’re talking about in this post, let’s run with solid core wiring.
\nEach conductor wire serves a purpose, as displayed in chart below.
\n| Wire Pair | \nPin Numbers | \nPrimary Function | \n
|---|---|---|
| Orange/White & Orange | \n1 & 2 | \nTransmit Data: These wires carry outbound data (signals leaving your device). | \n
| Green/White & Green | \n3 & 6 | \nReceive Data: These wires capture inbound data (signals coming from the internet or other devices). | \n
| Blue & Blue/White | \n4 & 5 | \nSpare / PoE: In 10/100 Mbps networks, these are spare. In Gigabit+ networks, they are used for data transmission. They are also commonly used for Power over Ethernet (PoE) to supply electrical power to devices like security cameras or VoIP phones. | \n
| Brown & Brown/White | \n7 & 8 | \nSpare / PoE: Similar to the blue pair, these wires are used for additional data lanes in Gigabit and faster networks and help carry PoE power. | \n
Below is a reference chart displaying the various types (categories) of network cabling that everyone has most likely run across at some point. You can buy pre-made cables or boxed spools of cabling for larger projects. Every “Category” represents a generation of engineering. As the numbers go up, so do the the specs including tighter wire twists, better insulation, and optimized shielding. All of these improvements aim to reduce crosstalk (noisy signal interference between conductor wires) and try to buck EMI (Electro Magnetic Interference). Less noise allows data to travel at higher frequencies (measured in Megahertz, or MHz). These days, Cat5e and greater are what you’ll most often run into.
\n| Cable Category Type | \nMaximum Data Rate | \nBandwidth | \nMaximum Distance | \nTypical Usage | \n
|---|---|---|---|---|
| Category 1 | \n1 Mbps | \n0.4 MHz | \n\n | Telephone and modem lines | \n
| Category 2 | \n4 Mbps | \n4 MHz | \n\n | LocalTalk & Telephone | \n
| Category 3 | \n10 Mbps | \n16 MHz | \n100 m (328 ft.) | \n10BaseT Ethernet | \n
| Category 4 | \n16 Mbps | \n20 MHz | \n100 m (328 ft.) | \nToken Ring | \n
| Category 5 | \n100 Mbps | \n100 MHz | \n100 m (328 ft.) | \n100BaseT Ethernet | \n
| Category 5e | \n1 Gbps | \n100 MHz | \n100 m (328 ft.) | \n100BaseT Ethernet, residential homes | \n
| Category 6 | \n1 Gbps | \n250 MHz | \n100 m (328 ft.) 10Gb at 37 m (121 ft.) | \nGigabit Ethernet, commercial buildings | \n
| Category 6a | \n10 Gbps | \n500 MHz | \n100 m (328 ft.) | \nGigabit Ethernet in data centers and commercial buildings | \n
| Category 7 | \n10 Gbps | \n600 MHz | \n100 m (328 ft.) | \n10 Gbps Core Infrastructure | \n
| Category 7a | \n10 Gbps | \n1000 MHz | \n100 m (328 ft.) 40Gb at 50 m (164 ft.) | \n10 Gbps Core Infrastructure | \n
| Category 8 | \n25 Gbps (Cat8.1) 40 Gbps (Cat8.2) | \n2000 MHz | \n30 m (98 ft.) | \n25 Gbps/40 Gbps Core Infrastructure | \n
Cable Shielding
\nThe primary purpose of shielding in Ethernet cables is to protect data transmissions from Electromagnetic Interference (EMI) and Radio Frequency Interference (RFI). It ensures signal integrity and maintains high-speed performance in environments with heavy electronic activity. You would choose the cabling for your specific application. For example, if you install network cabling to a manufacturing environment that has a potential for a lot of interference, you’d want cabling with the appropriate shielding. Defer to your low-voltage professionals for direction on what to use for your application.
\n| ISO/IEC Designation | \nCommon Abbreviation | \nShielding – Conductor | \nShielding – Cable | \n
|---|---|---|---|
| U/UTP | \nUTP or TPP | \nNone | \nNone | \n
| F/UTP | \nFTP or STP | \nFoil | \nNone | \n
| S/UTP | \nSTP | \nBraiding | \nNone | \n
| SF/UTP | \nSFTP or STP | \nBraiding & Foil | \nNone | \n
| U/FTP | \nSTP | \nNone | \nFoil | \n
| F/FTP | \nFFTP | \nFoil | \nFoil | \n
| S/FTP | \nSFTP | \nBraiding | \nFoil | \n
| SF/FTP | \nSFTP or SSTP | \nBraiding & Foil | \nFoil | \n
| S/STP | \nSSTP | \nBraiding | \nBraiding | \n
In my last paragraph, I mentioned low voltage professionals. Find a good one and work with them when planning cabling projects. Up to this point, we’ve been zoning in on just the physical cabling and its characteristics. As you’re probably starting to realize, there’s a little more to this than some may think. For instance, there are low-voltage building codes, local codes and industry standards, and safety measures to consider. There are specific kinds of Ethernet cabling that are Plenum Rated. A plenum rated Ethernet cable is a networking cable specially designed with a fire-retardant jacket. It emits very little smoke and few toxic fumes when burned. You must use plenum rated cables when running wires through plenum spaces which are the hidden air-handling areas of a building such as the space above drop ceilings or below raised floors. There’s also a requirement to use fire stop sealant when passing cabling through fireproof walls. Fire stopping is required whenever cables penetrate a fire-rated wall or floor (such as firewalls, smoke barriers, or shaft enclosures). Its purpose is to seal the openings around the cables to maintain the structure’s original fire-resistance rating and prevent the spread of flames, smoke, and toxic gases. Again, you should always consult with a professional.
\nMoving on from the network cabling, we’ll look at the other components that you’d commonly find on an Ethernet network.
RJ45 Modular Cable Ends
The RJ45 Modular Plug (cable end) is the plastic, clip-like contraption that crimps on to each end of an Ethernet cable and ultimately inserts into a switch port, network device, patch panel, or wall jack. They look like the image below and require special tools to make the crimp connection. I have hand made and crimped a LOT of cables and I would challenge anyone to make one faster than me!
\nThis is what an RJ45 Modular Plug looks like:
\n![\"\"](\"https://altbrain.net/media/posts/40/rj45-cable-ends.png\")
This is what a RJ45 Crimp Tool looks like:
\n![\"\"](\"https://altbrain.net/media/posts/40/crimp-tool.png\")
To crimp a cable end on to a network cable, you strip back the outer jacket to expose the 4 wire pairs. You untwist each pair as little as possible and line up the 8 conductors in the correct order (we will cover that next). At this time, it’s important to trim the wires down so that they are as short as reasonably possible to allow them to slip into the cable end slots. Make sure that the cable jacket is contained inside the RJ45 cable end. Afterwards, you grab your crimp tool and crimp the connector so that it’s permanently affixed to the network cable. This is what the finished product should look like.
\n![\"\"](\"https://altbrain.net/media/posts/40/rj45-pin-out.png\")
Wiring Pin-Out
\nT568A and T568B are the two standards. The main difference between T56A and T56B is the color order of green and orange pairs. Most commonly, the RJ45 Modular Plugs are wired the same exact way on each end of a cable and this is known as a “straight-through” cable. Some applications call for a “cross-over” cable. This simply means that one side of the cable is wired in T56A and the other in T56B.
\n![\"\"](\"https://altbrain.net/media/posts/40/t56a-t56b.png\")
Patch Panels
\nEthernet Patch Panels are commonly found in MDF (Main Distribution Frame) and IDF (Intermediate Distribution Frame) rooms or closets. An Ethernet patch panel organizes and centralizes multiple network cable drops in a structured cabling system. Patch Panels provide a clean, mounted termination point for cable runs that originate from wall jacks and other places. From the Patch Panels in your network racks, you then “patch” them into a network switch. Pre-made Patch Cables are commonly used to link the ports on the front of the patch panel to nearby Ethernet switch ports. Immediately below is a high level view on where Patch Panels fit between your PC NIC and the destination Ethernet network switch.
Your PC NIC <— Ethernet Patch Cable —> Wall Jack — Hidden/Fixed Ethernet Cable Run —- Patch Panel <— Ethernet Patch Cable —> Ethernet Network Switch
Below is what a common Ethernet Patch Panel looks like. The front view is on top and the rear view is on the bottom.
\n![\"\"](\"https://altbrain.net/media/posts/40/patch-panel.png\")
To terminate an Ethernet cable run to the rear of the patch panel, and to the rear of your Ethernet wall jack, you require a special tool called an Ethernet Punch Down Tool. The tool is used to neatly shove the Ethernet cable conductor wires into their color-coded slots using the T56A or T56B pin-out standards. You can see the color-coded pin arrangement diagram on the rear view of the patch panel displayed above. As you push the conductor wires into the corresponding colored slot of the patch panel by putting pressure on the tool, the tool will ultimately “punch down” and trim off excess wiring leaving a neat wire termination behind; and not something that looks like a barbaric caveman installed it. Below is what a punch down tool looks like. Orient the tool the right way. Some lessons are worth learning the hard way so you’ll know what I mean if you don’t!
\n![\"\"](\"https://altbrain.net/media/posts/40/punchdown-tool.png\")
I briefly mentioned that Ethernet cabling is punched down to the rear side of a wall jack. On the wall jack side, the component the cabling is punched down to is often called a RJ45 Keystone Jack or RJ45 Quick Port. For those interested, this is the behind the scenes view of what’s going on behind the wall jack faceplate. The general procedure is to strip back the outer jacket from the cabling, line up the cable pairs to the Keystone Jack using the T56A or T56B standard, and then punching down the conductor wiring to the Keystone Jack. Then you simply snap the Keystone Jack into the faceplate and mount the faceplate to the wall. Below are pictures of a Keystone Jack with conductor wiring punched down to the component. Additionally, a fully assembled 2-port face plate with 2 RJ45 Keystone Jacks mounted to it is displayed below.
\n![\"\"](\"https://altbrain.net/media/posts/40/keystone-jack.png\")
![\"\"](\"https://altbrain.net/media/posts/40/2port-faceplate.png\")
Always use a label maker and label the faceplate so that you can identify it and know where the other end is. The information on the faceplate label needs to align to the patch panel port number on the other end. Use a naming convention like MDF1-P1-22. The MDF1 part identifies that this cable run goes to the MDF1 room. P1 identifies Patch Panel 1 in the MDF1 room. The number 22 lines up with port 22 on Patch Panel 1 in the MDF1 room. You get it.
\nAn Ethernet Patch Cable is commonly a shorter (3ft, 7ft, 14ft) cable that’s purchased and ready to use with RJ45 modular ends preinstalled. The cable connects a PC network interface card to the wall port, on the office side of the cable run. Back in the MDF or IDF, where the patch panels are located, another patch cable is used to link the patch panel port to a nearby switch. Patch cables look like this:
\n![\"\"](\"https://altbrain.net/media/posts/40/ethernet-patch.png\")
In the end, if all the moons align and you’ve punched down and crimped everything right, you’ll be rewarded with the glorious green link light on both the computer NIC and the switch port! Job well done. If you don’t get a link light, you’ll need to get a cable tester and perform additional troubleshooting; which really leads me to my final point before wrapping up this post.
\nEarlier in this post, I jokingly referenced something that “looks like a barbaric caveman installed it”. I want to elaborate on this. For those of you who know me, you’ll probably chuckle and probably don’t need to read too much further. For those of you who don’t know me, I am self-admittingly “that guy” when it comes to maintaining cabling order. I’ll make a few final points about my take on this and then ask you to look at the 2 photos below.
\nAsk yourself, “In which environment would I want to troubleshoot a problem or replace a failed switch in?”. The choice is yours.
\n![\"\"](\"https://altbrain.net/media/posts/40/closet-messy.png\")
![\"\"](\"https://altbrain.net/media/posts/40/closet-neat.png\")
winget (the Windows Package Manager) is Microsoft’s answer to the classic Linux experience of apt or dnf. It allows you to discover, install, upgrade, and configure applications via the command line. This is ideal and arguably safer, as it helps avoid hunting for downloads from the Internet which could lead to problems should you run into a sketchy site with a mal intent.
\nUnder the hood, winget is a client interface for a massive repository of community-vetted and developer-submitted software. While tools like apt and dnf manage software specifically packaged for a Linux distro, winget acts more like an orchestrator in Windows. It finds the installer for the app you want, downloads it, and runs it (often silently) with the proper arguments.
\nWhile the workflow feels familiar, there are some distinct Windows-specific nuances:
\nIf you’re comfortable with Linux package managers like apt, these will feel like second nature:
\n| Action | \nWinget Command | \napt Equivalent | \n
| Search | \nwinget search [app] | \napt search | \n
| Install | \nwinget install [app] | \napt install | \n
| Upgrade All | \nwinget upgrade --all | \napt upgrade | \n
| Uninstall | \nwinget uninstall [app] | \napt remove | \n
| Check Info | \nwinget show [app] | \napt show | \n
| List available updates | \nwinget update | \napt update | \n
Below is an example of listing all available updates. You could then follow up with winget upgrade –all, to install all of them.
\nPS C:\\> winget update\nName Id Version Available Source\n-----------------------------------------------------------------------------------------------------------------------\nNotepad++ (64-bit x64) Notepad++.Notepad++ 8.9.4 8.9.6.4 winget\nLibreOffice 26.2.3.2 TheDocumentFoundation.LibreOffice 26.2.3.2 26.2.4.2 winget\nDell Command | Update for Windows Universal Dell.CommandUpdate.Universal 5.4.0 5.7.0 winget\nMicrosoft Visual C++ 2010 x64 Redistributable - … Microsoft.VCRedist.2010.x64 10.0.30319 10.0.40219 winget\nMicrosoft Edge Microsoft.Edge 149.0.4022.62 149.0.4022.69 winget\nMicrosoft Visual C++ 2010 x86 Redistributable - … Microsoft.VCRedist.2010.x86 10.0.30319 10.0.40219 winget\nMicrosoft Windows Desktop Runtime - 6.0.12 (x64) Microsoft.DotNet.DesktopRuntime.6 6.0.12 6.0.36 winget\nMicrosoft Visual C++ 2015 Redistributable (x86) -… Microsoft.VCRedist.2015+.x86 14.0.23026.0 14.51.36247.0 winget\nBrother iPrint&Scan Brother.iPrintScan 10.5.0.74 15.2.0.11 winget\nMicrosoft Visual C++ 2015-2022 Redistributable (x… Microsoft.VCRedist.2015+.x64 14.44.35211.0 14.51.36247.0 winget\n10 upgrades available.\nPS C:\\>If you are managing a VMware environment, doing everything through the vSphere client GUI can quickly become tedious. Enter PowerCLI, VMware’s powerful PowerShell module that allows you to automate almost any vSphere task.
\nWhether you are spinning up a new automation pipeline or just need to quickly manage snapshots across your environment, having a few reliable go-to commands saves an immense amount of time. Below is a quick-start cheat sheet for installing PowerCLI, connecting to your vCenter, and managing VM snapshots.
\n# Install the VMware PowerCLI module for the current user\nInstall-Module VMware.PowerCLI -Scope CurrentUser\n\n# Bypass untrusted SSL certificate warnings and connect to vCenter\nSet-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false\nConnect-VIServer vcenter.domain.local\n\n# List all virtual machines on this vCenter\nGet-VM\n\n# Create a new snapshot for a specific VM\nGet-VM \"servername\" | New-Snapshot -Name \"test snapshot\" -Description \"testing, hope it works\"\n\n# View all snapshots associated with a specific VM\nGet-VM \"servername\" | Get-Snapshot\n\n# Delete all snapshots for a specific VM (without prompting for confirmation)\nGet-VM \"servername\" | Get-Snapshot | Remove-Snapshot -Confirm:$false\n\n# List only the names of the snapshots on a specific VM\nGet-VM \"servername\" | Get-Snapshot | Select-Object Name\n\n# Find and delete a specific snapshot by its name\nGet-VM \"servername\" | Get-Snapshot -Name \"test snapshot\" | Remove-Snapshot -Confirm:$false|), we can seamlessly pass a virtual machine object from Get-VM straight into snapshot management commands like New-Snapshot or Remove-Snapshot.I want to preface this by stating that although Port Security may still have a place, it’s a legacy approach, replaced with more modern standards like 802.1x & RADIUS. I’d look at Cisco ISE, as a more enterprising way of managing who and what can connect to the network. Nonetheless, for anyone specifically interested in Port Security, read on!
At its core, Port Security is a Layer 2 traffic filtering feature on Cisco switches that gives you control over exactly what can plug into a specific physical network port. It prevents rogue devices from establishing network connections. The feature looks at device MAC addresses, and based on the configuration of Port Security it will allow the connection of an allowed device, or potentially disable the port if a violation occurs. Some reasons to consider using it are:
Port Security relies on three main concepts:
\nAn appropriate example here would be a scenario where a user (Jack) has 1 data port in his office. The upstream Cisco switch port has Port Security enabled and Port Security is set with a maximum limit of 2 MAC addresses remembered with the default Shutdown violation mode set. Connected to that wall port is an IP phone (unique MAC 1) and daisy chained to it is a desktop computer (unique MAC 2). At this point, all is good and everything is working normally for Jack. Later on, Jack finds a spare switch in an unused office and connects the 5 port unmanaged switch to his wall jack, to support more ports for connecting a printer and a laptop. Upon connecting the next device, the printer (unique MAC 3), Port Security senses that the limit has been exceeded resulting in a port security violation. The upstream switch port becomes disabled and now Jack has nothing.
\nNow, if your curious to know what it’s like to manage this specific configuration (Sticky MAC, Limit=2, Violation Mode=Shutdown), specifically in offices where there’s constant people and equipment movement, it’s brutal so be warned. Decisions have consequences.
\nManaging Port Security Violations (scenario is Sticky MAC, Limit=2, Violation Mode=Shutdown)
\nFirst, you need to find out where the active Port Security violation is by reviewing the log. Using the scenario above, this is the port in Jack’s office where he plugged in the 5 port switch. Note the port number and MAC address that caused the violation.
\nshow logNext, find out if that MAC used to live on another port. This can be considered the abandoned port. Note that MAC addresses are case sensitive and Cisco’s MAC table stores them in lowercase format (example, 001a.2b3c.4d5e)
\nshow port-security address | include [MAC address]Now, let’s clear the port security violation on the abandoned port first so that it won’t become an issue later. Due to Violation Mode being set to shutdown, we have to down the abandoned port, clear port security on it, and then turn the port back on.
\nconf t\ninterface [abandoned_interface_name]\nshutdown\nexit\n\nclear port-security all interface [abandoned_interface_name]\n\nconf t\ninterface [abandoned_interface_name]\nno shutdown\nexitFinally, we will clear the port security violation on the active port.
\nconf t\ninterface [active_interface_name]\nshutdown\nexit\n\nclear port-security all interface [active_interface_name]\n\nconf t\ninterface [active_interface_name]\nno shutdown\nexitSo we’re back to square one now, but Jack still needs that additional laptop and printer. To review, 2 additional MAC addresses are necessary for a total of 4 unique MAC address on the upstream switch port. Below is the configuration of a switch port that can meet the requirement.
\ninterface GigabitEthernet1/0/12\n description Jack-Office Port with Port Security Enabled\n switchport mode access\n switchport access vlan 10\n switchport port-security\n switchport port-security maximum 4\n switchport port-security violation shutdown\n switchport port-security mac-address sticky