A few minutes ago I finished taping shows for upcoming episodes of "Down To Buisness", a Intel community show about buisness technologies including Intel AMT and the like. The studio was booked for 3 hours but we managed to finish taping in 2, mostly single takes which was great. The footage will be edited and released in the coming weeks or months. I will make sure to blog about it when the shows get released.

Below, some pictures of the taping taken with my phone. Paul and Gael are the hosts of the show in the upper left picture.

Ylian
meshcentral.com

Before I start, I want to remind everyone that Intel AMT is not required for someone to use Meshcentral.com at all. If you happen to have Intel AMT on a computer, Meshcentral.com gives you a few bonus features. In the past weeks, I have been working on cloud activation of Intel AMT and now have my first demonstration video of the entire process at work. It's still early work, but it does work well. This is live now for people with Intel AMT 7.0 and higher. I still have to test on older machines.

In the video below, I demonstrate using a USB key to provision Intel AMT using the provisioning server that is located on Meshcentral.com. The big benefit here is that you don't need to install any software at all in your network. Just install the mesh agent and use the web interface to setup Intel AMT. In the video, I invoke the USB Flashing tool using Microsoft ClickOnce, if you have Chrome or Firefox, you will need to install a browser add-in to make this work.

There are plenty of flaws with this provisioning flow. For one, you need to create a USB provisioning record for each and everyone of your Intel AMT computers. I am working on Host Baased Provisioning support and remote upgrade to remote administration.

Also, last week I make a lot of improvement to how I handle CIRA connections. The servers are much more robust now.

Ylian
Meshcentral.com

A quick note to say that I added a new mesh management feature in Meshcentral.com. Starting today, when going in the Account tab some users will see a new "Manage" option on top of the list of meshes they have. This option will be shown to all Windows users that use Internet Explorer or FireFox with the "Microsoft .NET Assistant" add-in. If you see the Manage option and click on it, it will download and run the Mesh Connector tool directly from the web site. So, you don't need to seperatly download and install the tool anymore. Mesh Connector will launch using Microsoft Click-once and under this mode of operation, some options are removed. For example, you can't install the mesh local agent in this mode.

Another fun trick that I added is that you can hit F12 in the latest version of Mesh Connector to see all of the traffic that is sent/received to the server. This is useful for me to debug things, but if you are interested in mesh technology and/or are just curious that is going on, just hit F12 and look at the command stream.

For most people, you never need to use Mesh Connector, but if you want to change you mesh policy or mesh name after the fact, that is the only way to do it. It's also a more secure way to create a new mesh.

Enjoy!
Ylian
meshcentral.com

Just a reminder that you don't need Intel AMT to use Meshcentral.com, but if you do have a computer with Intel AMT, I try to provide a lot of support for it. In this blog, I want to show of an early preview video of Intel AMT Host Based Provisioning (HBP) performed from the cloud. This feature is not avaialble yet, but I recorded a video which shows how it works. Basicaly, starting with Intel AMT 6.1 and higher, we can see that Intel AMT is not setup on your computer and remotely activate it and start using it rigth away. We can even make it connect back to the cloud. This type of provisioning will work behind NAT/Routers/Firewalls and can get people that never used Intel AMT to start using it.

In the video below, you will see the Swarm Server and Provisioning Server, these are not publicaly available. The rest is the web site and of course the Intel AMT machine. In my case, I use an Intel AMT 7.0 computer. In the demo, I perform a hardware VNC session from the web after remotely activating Intel AMT and waitting for about 1 minute or two. Pretty simple and works pretty well. I expect to have this feature completely in 2 to 3 weeks and running on Meshcentral.com.

Enjoy!
Ylian
https://meshcentral.com

In the last few months, I have been making a lot of progress in adding Intel AMT support to Meshcentral.com. Support for CIRA, Provisioning, Javascript WSMAN stack and much more. Today, I am adding another interesting feature: Users can now launch Intel System Defense Utility (ISDU) and/or OpenDTK Manageability Commander directly from the Meshcentral.com web site. No more installing software or another layer of login, just click and manage your Intel AMT machines.

So, as the picture belows shows. If you are in the "Account" tab and you have a browser that supports Microsoft ClickOnce (IE or FireFox with Microsoft .NET Framework Assistant) you will see two new options show up. You can simply click on Commander or ISDU and launch it directly from the page. The launch process with validate the signed software and that you have the latest version. Also, when launching Commander or ISDU in this way, Meshcentral.com passes a limited time login token to the management consoles so they can log into the account without user prompts. As a result, you get immidiatly loged in and ready to manage all of your Intel AMT machines over the cloud. All the features offered by Intel AMT are at your fingertips.

Another note, administrators can setup Intel AMT with or without Client Initiated Remote Access (CIRA). If you opt to use CIRA, Meshcentral.com will automaticaly route the traffic into the CIRA tunnel, no questions asked. If you don't use CIRA, you need another meshed machines in the same network to act as a relay. Ether way, Commander and ISDU will launch, auto-login and route connections automaticaly to the Intel AMT machines.

Enjoy! As always, feedback appreciated.
Ylian
Meshcentral.com

Many of you probably already know about the Raspberry Pi, an inexpensive 35$ computer intended to give kids around the world access to a computer they can use to learn on and make projects. Well, about 6 months ago, I ordered one myself. It took no less than 5 months for me to get one. When I got the first one, I wanted a second for home, so this time I went on eBay and got one in 3 days for double the price.

In any case, the tiny device comes only as a tiny board with all of the connectors needed: HDMI, Ethernet, USB, SD Card, etc. I formatted an SD card with the recommanded operating system and booted it right up. I then proceeded to add support for Meshcentral.com by making sure the mesh agent works on it and that it would be easy to install. The mesh agent compiled for the Pogo Plug / Plug PC worked right away with no changes, but I did improve the installation process.

So why would you use Meshcentral.com with a Raspberry Pi? Well, I can think of two big benefits:

• FIrst, on many networks most of the computers are asleep all the time and there was no premanent presence for the mesh agent to run and monitor all the computers. For example, I have a few Intel vPro computers in a lab that are turned off or sleeping, with the Raspberry Pi always on, it automaticaly and periodicaly polls Intel AMT on the sleeping machines and reports back to Meshcentral.com the power state of the sleeping devices.

• Second is that if you have your own personal projects, or files on the Raspberry Pi itself, you can access your Pi over the Internet remotely from any browser around the world without worring about punching a hole in a firewall, etc. I can see people controlling holiday light projects over the Internet. Some developers could use the meshcentral.com API's to build web sites that control specific usageson their device.

So there we go, Meshcentral.com with Raspberry Pi support! I am going to have lots of fun with this. Below, the picture of my own Raspberry Pi, I got a transparent case so I could show it off at Intel demo's. I just plugged the power and Ethernet in this picture since I use it to monitor my other machines and don't need the display, mouse, keyboard.

Ylian
meshcentral.com

My colegue Gael Hofemeier started her own video blog for the Intel developer community and she has me featured on her very first show! Her video series is called RTFB which stands for: Reaching For Technology From Blogs... which is, really a great name for a video series! In any case, I am honored to be the first victim... guest. In the first show, I talk about Intel AMT provisioning from the cloud. The official blog about this video is here.

I started adding Intel AMT cloud provisioning into Meshcentral.com a few weeks ago, I have more work to do in this regards, but I get a pretty good start already. This cloud provisioning along with Intel AMT CIRA (Client Initiated Remote Access) makes Meshcentral.com a great site if you happen to have coomputers that support Intel AMT. In any case, here is the video! Enjoy!

Ylian
Meshcentral.com

In this blog, I want to talk about the picture below & monitoring Intel vPro power state from the cloud. With Meshcentral.com, when a computer is on it self-reports to the web site and so, you see the 7 day power state graph below showing accuratly the black regions where the computer is on. Now, what I want to really talk about is the blue and green regions when the computer is sleeping. See, Meshcentral.com can't directly see if a computer is sleeping unless another computer on the same network is powered and polling Intel AMT of the sleeping computer and reporting back to the web site. In the picture below the blue regions show when my computer called "Central" was sleeping and my PVR (Media Central PC) was awake and reporting back. You can see that the reports of "Central" sleeping are sporadic because my PVR is only on sometimes and so, we don't get a complete picture... until the last 2 days.

Two day ago, I added the Raspberry Pi 35$ computer to my network. It's always on and started reporting about the power state of all my computers at all times, polling Intel AMT when needed. So, for the last two day of the graph (the top portion) the blue and green are completely filled in.

On networks with at least one computer always on, getting the complete power state picture if not a problem, but for my own home network where I want to keep big PC's sleeping as much as possible, having a low power always on mesh'ed device is pretty nice!

I do want to point out that for people that know Intel AMT very well, using Client Initiated Remote Access (CIRA) with Meshcentral.com would allow meshcentral.com to directly notice the power state of attached PC's. I have not written for code on the server to do this yet, but regardless, my computer "Central" is Intel AMT 8.0 and does not support CIRA.

Ylian
meshcentral.com

A few weeks back, I was invited on the Intel manageability show "Down to Buisness" to talk about the Open Manageability Developer Tool Kit (OpenDTK) and demonstrate how you can manage Intel vPro computers out-of-band using Meshcentral.com. Well, here is the show! Full demonstration and all. Pretty much anyone that knows anything about Intel AMT knows about Manageability Commander, a pretty full featured Intel AMT management console and is open source.

About a year ago, I added Meshcentral.com support built right into Manageabiliity Commander, you can now discover and manage Intel AMT machines through the cloud, passed NAT/Routers/Proxies/Firewalls. It's very powerful. There are two paths Meshcentral.com can use to reach an Intel AMT machines within a private network. It can bounce-off another node on the same network, or use Client Initiated Remote Access (CIRA). Both ways work fine and Meshcentral.com automaticaly uses the right option. It will always use CIRA first if that option is avaialble.

So, episode 7 of "Down To Buisness" is here: http://software.intel.com/en-us/videos/down-to-business-7

Enjoy!
Ylian
Meshcentral.com

A few hours ago, I added one more feature to MeshCentral.com's terminal. Full web-based Intel AMT serial-over-LAN support. So, if you click on a device and go to the terminal tab, you would have one "Connect" button. If the device is equiped with Intel AMT and it's activated, you get two buttons: "Connect" and "Connect Intel AMT". If you click connect, you get the normal in-band shell. A connection is made to the mesh agent using the normal network path. If you click on "Connect Intel AMT" a connection to Intel AMT is launched and you communicate to the mesh agent or BIOS using the Intel AMT virtual serial port.

By default, the mesh agent attempts to bind a command shell to the Intel AMT serial port, so, often times you will see the same command prompt for both in-band and Intel AMT out-of-band communication paths. Now, if you are using the terminal to connect using Serial-over-LAN, you can then reboot the computer to BIOS and see the BIOS screen in the terminal. Just like with the OpenDTK Commander, but now, fully online.

So now, a few notes: I have not built the Intel AMT remote power feature yet, so you can't reboot to BIOS from the web site. In the picture below, I used Commander to boot the computer to BIOS with Serial-over-LAN mode turned on, but the web site displayed the output correctly. I hope to have remote power control on the web site soon.

Also, people that look at th Javascript of the terminal page will notice that I implemented all of the Intel AMT serial-over-LAN protocol in Javascript. So, I am not using IMRSDK.dll at all! I am using my own meshcentral.js library to open a tunnel to Intel AMT and all of the Intel AMT SOL and VT100 decoding is entirely done in Javascript. It's fast and efficient.

For people with Intel AMT, Enjoy!
Ylian
Meshcentral.com

A quick note to mention that I recently updated the mesh agent for Raspberry Pi, Pogo Plug, Linux ARM, Linux-XENx86 and DD-WRT MIPS from version 1.53 to 1.59. The biggest difference is that the file upload feature works correctly now. Before it would get stuck at the upload screen and sometimes create files with garbage names in the file system. So now, both upload and download work great! New mesh agent updates are fully automatic, so no action required, just enjoy the bug fixes.

In the picture below, a screen shot of the Meshcentral.com web file browser connected to my Raspberry Pi at home. You can drag & drop one or more files onto the browser window to start the upload. To date, you can only download one file at a time, something I would like to fix. Firefox could handle multiple file downloads at once, other browsers can't seem to have a way to handle it. Oh, by the way in Chrome you can drag a file out from the page to the desktop to start a download.

Ylian
meshcentral.com

A few hours ago, I released a pretty nice improvement to Meshcentral.com, much improved Intel AMT Hardware KVM support. If you happen to manage computers with Intel AMT 6.0 or above with the right CPU and no added graphics card, you have a remote desktop server built right into your computer's hardware. It's basicaly a VNC server.

Well, if you have such a computer hooked up to Meshcentral.com, you will now see a little display icon next to the Intel AMT status line. Clicking on this icon will bring you to the web-based VNC system that is now built to fully support Intel AMT Hardware KVM. Enter the Intel AMT username and password and you will see the computer's display and be able to move the mouse and input using the keyboard. Since this is all based on hardware, you can even reboot the computer and see the entire boot sequence on the web page, it also works if the computer is blue screened.

For people who like technical details, I added a lot more code to Meshcentral.com to be able to connect to the Intel AMT redirection port (TCP 16994 or 16995), authenticate correctly and forward the VNC traffic. So, this new feature does not require that port 5900 be enabled in Intel AMT configuration. Also, this system works by using Client Initiated Remote Access (CIRA) or by bounding off another computer in the same network. His is how the Meshcentral.com, being a web site, can route Intel AMT traffic correctly. It can even work behind an HTTP proxy or home router... as long as you have a few computers in your mesh on that network.

I have already rebooted my Intel AMT 7.0 server at home from my office using Meshcentral.com and it works great! Below screen shots of the Meshcentral.com device page with the new icon, and the web based VNC screen that asks, not for the VNC password, but the Intel AMT username and password.

Enjoy!
Ylian
meshcentral.com

I just released another update to Meshcentral.com improving cloud activation of Intel AMT. There is now a new little icon next to the Intel AMT status line in the device page that allows for activation and un-activation of Intel AMT. It's not perfect yet, but it's making lots of progress. You can now easily perform host based provisioning (HBP) and start using Intel AMT right away, all from the web site with a few clicks.

The only thing I still have to work on is un-activation of Intel AMT when it's not been activated using Host Based Provisioning. So, still work to do. It would also be nice to have live feedback as to the provisioning process on the web site. In any case, it's working pretty well as-is.

Enjoy!
Ylian
meshcentral.com

A while back, I had been working on a Mac OSX version of the Mesh Agent. It's not as polished as I would like it to be, for one, it has no installer to speak of. I also have not tested it on the latest OSX versions. Sadly, I don't keep up with the latest Mac OSX hardware. Never the less, I just updated the Mac OSX version of the mesh agent to the latest version of the code base. I also recorded a video of how to install, use and un-install the mesh agent on Mac OSX, the video will likely help some understand how to install and some of the benefits.

Enjoy!
Ylian
meshcentral.com

In the last few days I have been working on adding touch support for the web based remote desktop of Meshcentral.com. The idea is that, if the remote computer is Windows 8 that supports touch and you get touch commands on the web page, I could not try to emulate the mouse with touch but rather send the touch information directly to Windows 8. This would provide a much more natural user experience. Well, with Windows 8 there is a touch injection API and so, after learning how it works I finaly got to work and released my first touch support yesterday. In fact, I recorded a demonstration video below. his said, as I am writting this, I only support touch with Windows 8 as the target computer and IE10 on a touch device on the web browser side. I will be adding iPad and Android touch support as soon as I can.

I also fixed a problem with IE10 and remote desktop, it would lock-up in the past. I also added the "Start" and "Charm" button which are super useful when remoting to Windows 8.

Enjoy!
Ylian
meshcentral.com

Ok, this is going to be a really technical post. First, I want to highlight that Meshcentral.com can work on many computers, processors and operating systems... from Windows to OSX to the Raspberry Pi. You don't need to have an Intel vPro computer to use Meshcentral.com, however if you happen to have Intel Active Management Technology (Intel AMT) Meshcentral can make use of it.

Today I added a new feature that allows Meshcentral.com to poll for platform power state over a CIRA connection. In general, Meshcentral can see that a computer with Intel AMT was sleeping because other meshed computers on the same network poll Intel AMT for state and report that information back to Meshcentral. Well, if you have CIRA enabled, Intel AMT is no longer accessible to computers on the local network and now, the job of periodically polling for power state falls on Meshcentral.com.

Before today, if you have CIRA enabled and the computer that is sleeping or soft-off, Meshcentral would report the computer as being in an unknown power state. Now, it will poll the state every 4 minutes and 40 seconds and update the timeline accordingly. Below you can see a screen shot of the development server with an Intel AMT computer setup with CIRA and the power state and power history updates correctly.

Enjoy!
Ylian
meshcentral.com

Meshcentral.com allows users to perform remote desktop, file transfers and much more over the Internet. Currently, all that traffic has to be relayed between the mesh agents and the user's browser by the server and that's a lot of traffic. It's also not efficient, especially for remote desktop sessions. In some cases, you really have to do it... if someone is behind an HTTP proxy or is using a normal browser you have to do the relay on the server.

In some cases, I use mesh tools like the C# Mesh KVM viewer tool or Manageability Commander to manage computers on the mesh. When a tool is used, I wanted to explore the possibilities of opening a secure direct peer-to-peer communication channel between the tool and the target mesh agent when it's possible. the VoIP world has been doing it for a long time, I would explore this landscape.

Well, in the upcoming version of the Mesh agent, I added STUN support for detection of the agent's NAT situation. The STUN implementation came from a co-worker at Intel (Thanks Bryan!). I modified and added it into the agent, completing the first step. I then added a bunch for logic in the mesh server, mesh agent and tools stack to detect and open a UDP tunnel between the tool and the agent. Last night, I got it to work for the first time over the Internet!

I got it pretty reliable and added MTU (Maximum Transfer Unit) detection, so I know the maximum size UDP packet I can send and receive between the tool and the agent. Version 1.63 of the mesh agent will have this support, sadly, it will not be useful yet because I need to add some type of TCP-over-UDP crypto channel support in the agent before I can start using it for real world usages.

Just to preview what users can look forwad to: Imagine many computers on a remote network, you can now remote desktop and transfer files directly to the remote comptuers without any router configuration or added relays. For people with Intel AMT computers on the remote network, you will be able to perform Hardware KVM to Intel AMT computers over this direct channel by bounding traffic on a nearby node on the same network. Should make for a much faster management experience. Of course, this is down the road when I get everything finished off.

Ylian
meshcentral.com

I am very happy to announce that Meshcentral.com now supports Intel AMT power actions directly from the web site. So, if you happen to be managing Intel AMT computers with Meshcentral.com, you can now using Hardware KVM or Serial-over-LAN from the web site to take control of the computer and, in the same screen, perform Intel AMT power actions like: Power up, Powerd down, Reset, Boot to BIOS, etc. This can come handy in many situations. For example: You see a computer is not responding anymore, you using Hardware KVM to see what is going on and use Intel AMT reset to look at the boot sequence, all remotely and all on the web site.

To showcase this feature, I also recorded a new tutorial video:

I also have a YouTube playlist with many more Meshcentral related tutorial videos.

Enjoy!
Ylian
Meshcentral.com

A quick note to mention that I just updated the Mesh Connector tool to support adding and removing the mesh certificate from the mesh policy. For most people this is probably not important, but if you use Meshcentral.com for larget networks, you may want to keep your mesh certificate completely private for more security. Well, the new Mesh Connector tool can do that quickly and easily. I have a new tutorial video that explains how it works.

Enjoy!
Ylian
meshcentral.com

Over the last few weeks, I have been having Meshcentral.com reliability problems, the site would just go down. When looking into it, the database seemed locked and all the queries for data would hang and timeout. This would affect all server components: the web site (IIS), the binary routing server (Swarm Server) and the HTTP routing server (AJAX server). It's like someone was holding a lock on the database and not releasing it. I would reset software and it would run again, for a time, and the problem would happen again.

Last night, I finally figured it out (I think). Each time there was a lock up, the log files showed this like:

Autogrow of file 'MeshCentral_log' in database 'MeshCentral' was cancelled by user or timed out after 896 milliseconds.  Use ALTER DATABASE to set a smaller FILEGROWTH value for this file or to explicitly set a new file size.

In a nutshell, the database file on disk was too small and needed to be resized to be larger. The database was about 4 gigaytes in size and the policy was set to enlarge it by 1 megabyte increments. Even if it did grow by a little, it was not long it would need to grow again. So, last night I made the database file 10 gigabytes in length, giving it plenty of room. I am likely going to go back in a few days and make it 100 gigabytes. Since it's a dedicated server, there is no need to by stingy.

Sorry to anyone who noticed the site was down. If this was the problem, and I am confident it was, it was a very easy fix and should not happen again.

Thanks,
Ylian