To share what I've learned !

Producing IPv6 traceroute results in HTML format using NMAP

2011-12-09T13:08:00.000+05:30

I searched how we can display the IPv6 trace-route results to web in automated manner. There may be different PHP / perl modules but using nmap trace route option we can archive similar fashion.

we can have the list of hosts separated by space
nmap.org www.apnic.net he.net

we can use following command to create the XML output.

nmap -6 --traceroute -vv -iL TestList -sn -oX test.xml --stylesheet /usr/share/nmap/nmap.xsl

-6 to enable IPv6
-vv increase the verbosity of the oubput
--sn no port scan
-oX output XML
--stylesheet where to find { to translate from XML to HTML }

xsltproc test.xml --output test.html

PPTP Server as Cisco for Mikrotik Client

2011-11-26T14:38:00.001+05:30

Following configuration explains the Cisco as PPTP server and connecting two sites:

Following Configuration needed to enable the VPDN and default server:

vpdn enable
!
vpdn-group Mtik
! Default PPTP VPDN group
 accept-dialin
  protocol pptp
  virtual-template 1

interface Virtual-Template1
 ip unnumbered Loopback0
 peer default ip address pool IPPOOL1
 ppp encrypt mppe auto required
 ppp authentication ms-chap-v2 ms-chap pap

ip local pool IPPOOL1 192.168.150.10 192.168.150.224

Few more additional things we need to keep the same ip address for the user:

aaa new-model
!
!
aaa authentication ppp default local
aaa authorization network default local
!
aaa attribute list Gobi
 attribute type addr 192.168.150.13 service ppp protocol ip mandatory
 attribute type route "10.0.0.0 255.255.255.0 192.168.150.13"
 attribute type interface-config "description Gobi-test"

Finally apply the attribute list to the user:

username gobi password 0 test
username gobi aaa attribute list Gobi

Mikrotik Configurations:

/interface pptp-client
add add-default-route=no allow=mschap2 connect-to=192.168.16.2 \
    dial-on-demand=no disabled=no max-mru=1500 max-mtu=1500 mrru=1500 name=\
    gobi password=test profile=default-encryption user=gobi

[admin@HOST1] > ip add print
Flags: X - disabled, I - invalid, D - dynamic
 #   ADDRESS            NETWORK         INTERFACE
 0   192.168.10.2/30    192.168.10.0    ether1
 1   192.168.16.1/30    192.168.16.0    ether2
 2   10.0.0.1/24        10.0.0.0        ether1
 3 D 192.168.150.13/32  192.168.150.1   gobi

IP route placed in the mikrotik as static :

/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=gobi scope=30 \
    target-scope=10

1500 df-bit ping test

R1#ping 10.0.0.254 size 1500 df-bit

Type escape sequence to abort.
Sending 5, 1500-byte ICMP Echos to 10.0.0.254, timeout is 2 seconds:
Packet sent with the DF bit set
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 100/124/152 ms

l2tpv3 configuration reference

2011-11-19T12:39:00.000+05:30

Reference Comparing , Designing and Deploying VPNs chap - 02 :
L2TPv3 is the enhanced version of L2TPv2 protocol. Mikrotik uses L2TPv2 i suppose but it offer another similar tunneling mechanism as EOIP.
L2TPv3 in cisco provides Pseudo-wire services to the customer. L2TPv3 only require the IP connectivity between peers but it can transport Ethernet, 802.1Q , HDLC, PPP framerelay etc.

Advantage over MPLS is the customer having the full control of their routing domain.

L2TP depolyment methods having 3 topologies
LAC - LNS , LNS - LNS , LAC - LAC

Following Diagram explain simple LAC - LAC L2TPv3 setup.

It uses two types of messages:
control connection messages - used for signaling between LCEs
session data messages - Used to transport layer 2 protocols and connections

Data channel Message Header having Session ID & cookie to correctly associate with the tunnel
Deploying dynamic Pseudowires session
1) configure CEF - Its default in IOSs now.
2) configure a loopback interface to use as the pseduowire endpoint ( need to have the connectivity)
3) configure an L2TP class ( optional)
L2TPv3 Class enables to configure number of control channel configurations.
authentication , keepalive intervals , receive window size, retransmission parameters, timeouts
4) configure a pseudowire class
5) bind attachment circuits to pseudowires

R1:

l2tp-class digest_r1
 digest secret 7 096F673A3A2A hash SHA1

pseudowire-class R1toR2
 encapsulation l2tpv3
 sequencing both
 protocol l2tpv3 digest_r1
 ip local interface Loopback0

xconnect peer-address VCID ( should be unique) pw-class [name]

interface FastEthernet1/0
 no ip address
 duplex auto
 speed auto
 xconnect 172.16.0.2 100 pw-class R1toR2 sequencing both

R2:

l2tp-class digest_r2
 digest secret 7 062526126F61 hash SHA1

pseudowire-class R2toR1
 encapsulation l2tpv3
 sequencing both
 protocol l2tpv3 digest_r2
 ip local interface Loopback0

interface FastEthernet1/1
 no ip address
 duplex auto
 speed auto
 xconnect 172.16.0.1 100 pw-class R2toR1 sequencing both

Between Two Circuits

R6#ping 192.168.20.2 size 1500 repeat 2 df-bit

Type escape sequence to abort.
Sending 2, 1500-byte ICMP Echos to 192.168.20.2, timeout is 2 seconds:
Packet sent with the DF bit set
!!
Success rate is 100 percent (2/2), round-trip min/avg/max = 72/94/116 ms

CDP from remote devices :

R6#show cdp neighbors detail  | inc Device|IP|Int
Device ID: R1
  IP address: 172.16.0.1
Interface: FastEthernet1/0,  Port ID (outgoing port): FastEthernet1/0
Device ID: R7
  IP address: 192.168.20.2
Interface: FastEthernet1/0,  Port ID (outgoing port): FastEthernet1/0

R1#show l2tun session all

L2TP Session Information Total tunnels 1 sessions 1

Session id 56564 is up, tunnel id 23863
  Remote session id is 61449, remote tunnel id 53859
  Remotely initiated session
Call serial number is 10785
Remote tunnel name is R2
  Internet address is 172.16.0.2
Local tunnel name is R1
  Internet address is 172.16.0.1
IP protocol 115
  Session is L2TP signaled
  Session state is established, time since change 00:58:25
  DF bit off, ToS reflect disabled, ToS value 0, TTL value 255
  UDP checksums are disabled
  FS cached header information:
    encap size = 28 bytes
    45000014 00000000 FF736353 AC100001
    AC100002 0000F009 00000000
    881 Packets sent, 881 received
    744359 Bytes sent, 744061 received
  Last clearing of counters never
  Counters, ignoring last clear:
    881 Packets sent, 881 received
    744359 Bytes sent, 744061 received
    Receive packets dropped:
      out-of-order:             0
      total:                    0
    Send packets dropped:
      exceeded session MTU:     0
      total:                    0
  Sequencing is on
    Ns 872, Nr 872, 0 out of order packets received
    Packets switched/dropped by secondary path: Tx 0, Rx 0
  Conditional debugging is disabled
  Unique ID is 1
Session Layer 2 circuit, type is Ethernet, name is FastEthernet1/0
  Session vcid is 100
  Circuit state is UP
    Local circuit state is UP
    Remote circuit state is UP

Have to try the interoperability between cisco & mikrotik

Modifying the Wireshark Column.

2011-11-18T20:31:00.000+05:30

Basically i had a packet capture file where i need to check the ICMP sequence number to check any packet drops. going each packet one by one and finding out the sequence number is a tedious job. So i was looking to find a way to add another column to display the icmp sequence number.
Its quite easy
1) Go to Edit -> Preference
2) Add a new column and select the field type as custom and give the filter as icmp.seq

3) You can see following result . According to our requirement we can modify the field type.

Cost Effective 1 Port Terminal Server Rs232 using mikrotik / 3G

2011-07-21T22:30:00.001+05:30

out of band management is critical for the network operation. when searching solution for console access through rs232 and 3G i came across Mikrotik serial connection option. I haven't tested the 3G setup yet but quite impressive options available in 79$ Mikrotik router for RS232 access:
1st have to set the baud-rate and similar settings :

[admin@Console_Tik] > port export            
# jan/02/1970 00:32:05 by RouterOS 5.5
# software id = WE49-11I9
#
/port
set 0 baud-rate=9600 data-bits=8 flow-control=none name=serial0 parity=none \
stop-bits=1
/port firmware
set directory=firmware
[admin@Console_Tik] >

2nd if we are using for console access we need to disable the console port option on mikrotik as follows :

[admin@Console_Tik] > system console print 
Flags: X - disabled, U - used, F - free 
#   PORT                                   TERM                                 
0 X serial0                                vt102

From mikrotik we can directly access the console port of cisco as follows :

[admin@Console_Tik] > system serial-terminal serial0    
[Ctrl-A is the prefix key]
TEST>

or we can create separ te user account and divert the user directly to the serial access :
1) have to create separate user account :

[admin@Console_Tik] > u er print 
Flags: X - disabled 
#   NAME         GROUP        ADDRESS                                           
0   ;;; system default user
admin        fullZ       
1   terminal     full

2) have to assign the user to the spcial-login option

admin@Console_Tik] > special-login print   
Flags: X - disabled 
#   USER                                      PORT                              
0   terminal                                  serial0

if we telnet using the special user account directly redirected to serial access : 

MikroTik v5.5
Login: terminal
Password:

[Ctrl-A is the prefix key]



VOICE_TEST>

shorten the MPLS IOS commands

2011-07-04T20:14:00.000+05:30

when it comes to mpls + vrf we can observe some lengthly commands..

R3#show bgp vpnv4 unicast vrf CusA
BGP table version is 7, local router ID is 192.168.254.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 65001:100 (default for vrf CusA)
*> 192.168.200.0    192.168.100.1            0             0 65100 i
*>i192.168.210.0    192.168.254.8            0    100      0 65101 i

how to shorten these commands as usual we can use aliases

eg:

alias exec shbgpvrf show bgp vpnv4 unicast vrf

R3#shbgpvrf CusA
BGP table version is 7, local router ID is 192.168.254.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 65001:100 (default for vrf CusA)
*> 192.168.200.0    192.168.100.1            0             0 65100 i
*>i192.168.210.0    192.168.254.8            0    100      0 65101 i

eg2: alias exec shvrf show ip route vrf

R3#shvrf CusA

Routing Table: CusA
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route

Gateway of last resort is not set

      192.168.100.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.100.0/30 is directly connected, Ethernet0/0
L        192.168.100.2/32 is directly connected, Ethernet0/0
B     192.168.200.0/24 [20/0] via 192.168.100.1, 00:10:08
B     192.168.210.0/24 [200/0] via 192.168.254.8, 00:08:42

MPLS LAB for experiment.

2011-06-24T21:49:00.002+05:30

This is the lab prepared using the L2IOU (http://tinyurl.com/69j77ju )

NETMAP :
1:0/0 3:0/0
1:0/1 4:0/0
2:0/0 3:0/1
2:0/1 4:0/1
3:0/2 5:0/0
4:0/2 5:0/1
5:0/3 6:0/0
5:0/2 7:0/1
6:0/1 7:0/0
7:0/2 8:0/0
7:0/3 9:0/0
8:0/1 10:0/0
9:0/1 11:0/0

root@box:/home/tc# cat labstart_mpls 
#!/bin/sh

if [ "`pgrep i86bi`" ]
then
 echo ""
 echo ""
 echo "The lab is already loaded"
 echo ""
 echo ""
else
 echo ""
 echo ""
 echo please wait for the Lab to be loaded..
 echo ""
 ./wrapper -m ./i86bi_linuxl2-upk9-ms.M -p 2001 -- -c configs/R1.cfg -e1 -s0 1 > /dev/null 2>&1 & sleep 5
 echo R1 loaded
 ./wrapper -m ./i86bi_linuxl2-upk9-ms.M -p 2002 -- -c configs/R2.cfg -e1 -s0 2 > /dev/null 2>&1 & sleep 5
 echo R2 loaded
 ./wrapper -m ./i86bi_linuxl2-upk9-ms.M -p 2003 -- -c configs/R3.cfg -e1 -s0  3 > /dev/null 2>&1 & sleep 5
 echo R3 loaded
 ./wrapper -m ./i86bi_linuxl2-upk9-ms.M -p 2004 -- -c configs/R4.cfg -e1 -s0 4 > /dev/null 2>&1 & sleep 5
 echo R4 loaded
 ./wrapper -m ./i86bi_linuxl2-upk9-ms.M -p 2005 -- -c configs/R5.cfg -e1 -s0 5 > /dev/null 2>&1 & sleep 5
 echo R5 loaded
 ./wrapper -m ./i86bi_linuxl2-upk9-ms.M -p 2006 -- -c configs/R6.cfg -e1 -s0 6 > /dev/null 2>&1 & sleep 5
 echo R6 loaded
 ./wrapper -m ./i86bi_linuxl2-upk9-ms.M -p 2007 -- -c configs/R7.cfg -e1 -s0 7 > /dev/null 2>&1 & sleep 5
echo R7 loaded 
./wrapper -m ./i86bi_linuxl2-upk9-ms.M -p 2008 -- -c configs/R8.cfg -e1 -s0 8 > /dev/null 2>&1 & sleep 5  
echo R8 loaded
./wrapper -m ./i86bi_linuxl2-upk9-ms.M -p 2009 -- -c configs/R9.cfg -e1 -s0 9 > /dev/null 2>&1 & sleep 5  
echo R9 loaded
./wrapper -m ./i86bi_linuxl2-upk9-ms.M -p 2010 -- -c configs/R10.cfg -e1 -s0 10 > /dev/null 2>&1 & sleep 5  
echo R10 loaded
./wrapper -m ./i86bi_linuxl2-upk9-ms.M -p 2011 -- -c configs/R11.cfg -e1 -s0 11 > /dev/null 2>&1 & sleep 5  
echo R11 loaded
 echo ""
 echo ""
 nohup -g -Fa `pgrep i86bi` > /dev/null 2>&1
fi

Router configuration :

Can you run two AS Numbers in Single Router ? - Local AS

2011-06-04T12:35:00.000+05:30

according to my experience we can't but similar functionalities given by Local AS option . It enables to act one AS for some of the neighbors and another AS for other neighbors

R2 connects to R1 using remote as 100 , but the R1 using remote-as as 2 rather than 300

R2#
router bgp 300
 no synchronization
 bgp log-neighbor-changes
 network 200.200.200.0
 neighbor 192.168.100.1 remote-as 100
 neighbor 192.168.100.1 local-as 2

R1#router bgp 100
 no synchronization
 bgp log-neighbor-changes
 neighbor 192.168.100.2 remote-as 2
 no auto-summary

but when the route injected it shows originated AS as 300

R1#show ip bgp 
BGP table version is 2, local router ID is 192.168.100.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 200.200.200.0    192.168.100.2            0             0 2 300 i

with no-prepend we can remove the local as prepending .

R2#show ip bgp 
BGP table version is 3, local router ID is 192.168.100.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 100.100.100.0/24 192.168.100.1            0             0 100 i
*> 200.200.200.0    0.0.0.0                  0         32768 i

R2#router bgp 300
 no synchronization
 bgp log-neighbor-changes
 network 200.200.200.0
 neighbor 192.168.100.1 remote-as 100
 neighbor 192.168.100.1 local-as 2 no-prepend
 no auto-summary

prefix Deaggregation and inject map - BGP Design & Implementation Chap 4

2011-06-04T11:42:00.001+05:30

this lab is directly taken from BGP Design & Implementation Chap 4. GNS3 configurations attached below.
Summary -
In the boarder router if the summary route injected as follows

aggregate-address 172.16.0.0 255.255.0.0 as-set summary-only

downwards the originality of the prefix may be lost therefore to specify the best exist path we can regenerate the path we use inject path .

bgp inject-map Map1 exist-map Map2

Map1 injects the path
Map2 checks whether path is available , it at least two match statements one is route-source & aggregate prefix. Whether u can inject weird prefix other than aggregate .. (eg aggregate is 172.16.0.0/16 but if you try to inject 10.0.0.0/24 ???) As usual you can't :)

following is the attached diagram

R5 Relevant configuration.

router bgp 100
 no synchronization
 bgp log-neighbor-changes
 bgp inject-map AS200-Specific exist-map AS200-aggregate
 neighbor 192.168.12.2 remote-as 100
 neighbor 192.168.12.2 send-community
 neighbor 192.168.23.2 remote-as 100
 neighbor 192.168.23.2 send-community
 neighbor 192.168.24.1 remote-as 200
 neighbor 192.168.24.1 send-community
 no auto-summary
!
ip forward-protocol nd
!
ip bgp-community new-format
!
ip http server
no ip http secure-server
!
!
ip prefix-list AS200-R3 seq 5 permit 192.168.24.1/32
!
ip prefix-list Aggregate seq 5 permit 172.16.0.0/16
!
ip prefix-list Specific seq 5 permit 172.16.1.0/24

no cdp run
!
!
!
route-map AS200-Specific permit 10
 set ip address prefix-list Specific
 set community 100:200 no-export
!
route-map AS200-aggregate permit 10
 match ip address prefix-list Aggregate
 match ip route-source AS200-R3
!

R7#show ip bgp
BGP table version is 4, local router ID is 192.168.13.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*>i172.16.0.0       192.168.24.1             0    100      0 200 300 i
* i                 192.168.35.1             0    100      0 200 400 i
*>i172.16.1.0/24    192.168.24.1             0    100      0 ?
*>i172.16.2.0/24    192.168.35.1             0    100      0 ?

show ip route OSPF sync in the AS100

R7#show ip route 
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C    192.168.12.0/24 is directly connected, FastEthernet0/1
C    192.168.13.0/24 is directly connected, FastEthernet0/0
O E2 192.168.24.0/24 [110/20] via 192.168.12.1, 00:00:56, FastEthernet0/1
     172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks
B       172.16.0.0/16 [200/0] via 192.168.24.1, 00:00:51
B       172.16.1.0/24 [200/0] via 192.168.24.1, 00:00:51
B       172.16.2.0/24 [200/0] via 192.168.35.1, 00:00:23
O    192.168.23.0/24 [110/20] via 192.168.13.2, 01:21:56, FastEthernet0/0
                     [110/20] via 192.168.12.1, 01:21:23, FastEthernet0/1
O E2 192.168.35.0/24 [110/20] via 192.168.13.2, 00:00:46, FastEthernet0/0

when the BGP peer goes down between R3 & R5

*Mar  1 01:25:37.511: %BGP-5-ADJCHANGE: neighbor 192.168.24.1 Down BGP Notification sent
*Mar  1 01:25:37.511: %BGP-3-NOTIFICATION: sent to neighbor 192.168.24.1 4/0 (hold time expired) 0 bytes 
*Mar  1 01:25:38.511: BGP(0): no valid path for 172.16.0.0/16
*Mar  1 01:25:38.511: BGP(0): no valid path for 172.16.1.0/24
*Mar  1 01:25:38.515: BGP(0): nettable_walker 172.16.0.0/16 no best path
*Mar  1 01:25:38.515: BGP(0): nettable_walker 172.16.1.0/24 no best path
*Mar  1 01:25:38.519: BGP(0): 192.168.12.2 send unreachable 172.16.1.0/24
*Mar  1 01:25:38.519: BGP(0): 192.168.12.2 send UPDATE 172.16.1.0/24 -- unreachable
*Mar  1 01:25:38.519: BGP(0): 192.168.12.2 send UPDATE 172.16.0.0/16 -- unreachable
*Mar  1 01:25:38.623: BGP(0): updgrp 3 - 192.168.12.2 updates replicated for neighbors: 192.168.23.2
*Mar  1 01:25:47.283: BGP(0): updating injected prefix 172.16.1.0/24, from source prefix 172.16.0.0/16
*Mar  1 01:25:47.283: BGP(0): retaining injected prefix 172.16.1.0/24, from source prefix 172.16.0.0/16

when the BGP peer up

*Mar  1 01:27:06.899: %BGP-5-ADJCHANGE: neighbor 192.168.24.1 Up 
*Mar  1 01:27:06.947: BGP(0): 192.168.24.1 rcvd UPDATE w/ attr: nexthop 192.168.24.1, origin i, metric 0, aggregated by 200 192.168.46.2, path 200 300
*Mar  1 01:27:06.951: BGP(0): 192.168.24.1 rcvd 172.16.0.0/16
*Mar  1 01:27:06.955: BGP(0): Revise route installing 1 of 1 routes for 172.16.0.0/16 -> 192.168.24.1(main) to main IP table
*Mar  1 01:27:06.959: BGP(0): 192.168.12.2 NEXT_HOP is on same subnet as the bgp peer and set to 192.168.24.1 for net 172.16.0.0/16
*Mar  1 01:27:06.959: BGP(0): 192.168.12.2 send UPDATE (format) 172.16.0.0/16, next 192.168.24.1, metric 0, path 200 300
*Mar  1 01:27:06.963: BGP(0): updgrp 3 - 192.168.12.2 updates replicated for neighbors: 192.168.23.2
*Mar  1 01:27:47.331: BGP(0): creating injected prefix 172.16.1.0/24, from source prefix 172.16.0.0/16
*Mar  1 01:27:47.331: BGP(0): updating injected prefix 172.16.1.0/24, from source prefix 172.16.0.0/16
*Mar  1 01:27:47.335: BGP(0): retaining injected prefix 172.16.1.0/24, from source prefix 172.16.0.0/16
*Mar  1 01:27:47.335: BGP(0): retaining injected prefix 172.16.1.0/24, from source prefix 172.16.0.0/16
*Mar  1 01:27:48.063: BGP(0): Revise route installing 1 of 1 routes for 172.16.1.0/24 -> 192.168.24.1(main) to main IP table
*Mar  1 01:27:48.063: BGP(0): 192.168.12.2 NEXT_HOP is on same subnet as the bgp peer and set to 192.168.24.1 for net 172.16.1.0/24
*Mar  1 01:27:48.063: BGP(0): 192.168.12.2 send UPDATE (format) 172.16.1.0/24, next 192.168.24.1, metric 0, path Local
*Mar  1 01:27:48.163: BGP(0): updgrp 3 - 192.168.12.2 updates replicated for neighbors: 192.168.23.2
*Mar  1 01:28:47.355: BGP(0): updating injected prefix 172.16.1.0/24, from source prefix 172.16.0.0/16
*Mar  1 01:28:47.359: BGP(0): updating injected prefix 172.16.1.0/24, from source prefix 172.16.0.0/16
*Mar  1 01:28:47.359: BGP(0): retaining injected prefix 172.16.1.0/24, from source prefix 172.16.0.0/16
*Mar  1 01:28:47.359: BGP(0): retaining injected prefix 172.16.1.0/24, from source prefix 172.16.0.0/16

GNS3 Configurations

show ip ospf route undocumented command in IOS

2011-05-21T11:13:00.000+05:30

This command i think introduced in NX-OS series but IOS also support this but not documented seems to be:
I have checked in the following version:

R2#show ver
Cisco IOS Software, 3700 Software (C3725-ADVENTERPRISEK9-M), Version 12.4(15)T7, RELEASE SOFTWARE (fc3)

Not supported command ??

R2#show ip ospf ro?  
% Unrecognized command

R2# show ip ospf route

            OSPF Router with ID (192.168.30.10) (Process ID 10)

    Area BACKBONE(0)

    Intra-area Route List
*   192.168.20.0/30, Intra, cost 64, area 0, Connected
      via 192.168.20.1, Serial0/1

    Intra-area Router Path List
i 192.168.20.2 [64] via 192.168.20.2, Serial0/1, ABR, Area 0, SPF 4

    Inter-area Route List
*>  192.168.10.64/26, Inter, cost 138, area 0
      via 192.168.20.2, Serial0/1
*>  192.168.10.32/28, Inter, cost 129, area 0
      via 192.168.20.2, Serial0/1
*>  192.168.10.0/27, Inter, cost 128, area 0
      via 192.168.20.2, Serial0/1

    Inter-area Router Path List
I 192.168.10.33 [128] via 192.168.20.2, Serial0/1, ASBR, Area 0, SPF 4

    Area 1

    Intra-area Route List
*>  192.168.30.0/29, Intra, cost 74, area 1
      via 192.168.30.9, Serial0/0
*   192.168.30.8/29, Intra, cost 64, area 1, Connected
      via 192.168.30.10, Serial0/0

    External Route List
*>  100.100.100.0/24, Ext2, cost 20, tag 0
      via 192.168.20.2, Serial0/1

This is similar to show ip route ospf but it has nice area separation . Also lists the ABR , ASBR rather than checking "show ip ospf border-routers" this command list in the route as
Intra-area Router Path List,Inter-area Router Path List,
vs

R2#show ip route ospf
     192.168.30.0/29 is subnetted, 2 subnets
O       192.168.30.0 [110/74] via 192.168.30.9, 00:17:26, Serial0/0
     192.168.10.0/24 is variably subnetted, 3 subnets, 3 masks
O IA    192.168.10.64/26 [110/138] via 192.168.20.2, 00:08:30, Serial0/1
O IA    192.168.10.32/28 [110/129] via 192.168.20.2, 00:12:08, Serial0/1
O IA    192.168.10.0/27 [110/128] via 192.168.20.2, 00:16:10, Serial0/1

Connecting Mikrotik in GNS3

2011-05-08T11:14:00.003+05:30

Attaching Mirkotik x86 to GNS3.
its quite easy anyway in ubuntu you need the qemu multicast patch , you can download qemu v13 patch ( http://nchc.dl.sourceforge.net/project/gns-3/Qemu/qemu-0.13.0-patches.zip) and Qemu source (http://wiki.qemu.org/download/qemu-0.13.0.tar.gz)
please check the following post to how to patch the qemu.
(http://blog.gns3.net/2009/10/olive-juniper/2/)

Installation requires Mikrotik x86 version(http://download.mikrotik.com/mikrotik-5.2.iso) and qemu image which can be created as follows

qemu-img create -f raw mtik.img 128M

In GNS3 please check whether qemuwrapper working properly ( you need to copy 2 python files distributed with GNS3)

-rwxr-xr-x 1 root root 868374 2011-05-08 09:22 pemubin.py
-rwxr-xr-x 1 root root 34162 2011-05-08 09:21 qemuwrapper.py

if all are setup you can create the qemu host as follows.

If you want to connect through winbox please follow the following post to create the tap interface :

http://www.kbrandt.com/2009/01/how-to-setup-up-an-emulated-cisco-lab-using-gns3-in-ubuntu-part1.html

Then you can run winbox ( You need to have wine installation )

I've followed following steps to connect the Mikrotik 5.12 with GNS3 in Windows 7 , may be helpful

First Create the Image

C:\Program Files\GNS3>qemu-img.exe create -f qcow2 mtik5-12.img 256M

Second install the Image

C:\Program Files\GNS3>qemu.exe mtik5-12.img -cdrom mikrotik-5.12.iso -boot d

3rd create the host in GNS3 ( link the image you have created in previous stage) if you want multiple host replicate the image and create multiple hosts.

One drop while tracing - icmp unreachable & traceroute

2011-05-07T10:11:00.000+05:30

Have you ever notice the * * while you are tracing some destination ?

Cochran#traceroute 192.168.16.1 probe 4

Type escape sequence to abort.
Tracing the route to 192.168.16.1

  1 172.20.15.5 4 msec 4 msec 0 msec 0 msec
  2 172.20.15.2 4 msec *  0 msec * 
Cochran#

When you ping no drops at all

Cochran#ping 192.168.16.1 repeat 4

Type escape sequence to abort.
Sending 4, 100-byte ICMP Echos to 192.168.16.1, timeout is 2 seconds:
!!!!
Success rate is 100 percent (4/4), round-trip min/avg/max = 4/5/8 ms

This behaviour due to ICMP unreachable rate limit configuration , only the last hop needs to generate icmp-unreachble others normally return the reply via ttl expired ( remember the way traceroute works )

Lindbergh#show ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            unassigned      YES NVRAM  administratively down down    
Serial0/0                  172.20.15.2     YES NVRAM  up                    up      
FastEthernet0/1            192.168.16.1    YES NVRAM  up                    up

Lindbergh#show ip icmp rate-limit 

                           DF bit unreachables       All other unreachables   
Interval (millisecond)     500                       500                      

Interface                  # DF bit unreachables     # All other unreachables 
---------                  ---------------------     ------------------------ 
Serial0/0                  0                         16                       
FastEthernet0/1            0                         0                        

Greatest number of unreachables on Serial0/0

check this information for more detail.
http://www.cisco.com/en/US/docs/ios/12_4t/12_4t2/hticmpun.html#wp1053877

Exploring Cisco Network Address Translation ( NAT) - Part -I

2011-04-15T21:11:00.006+05:30

Even though I worked with NAT configuration it still troublesome when configuring NAT on the Cisco Router (I prefer the Mikrotik way of configuration, simple but powerful).
First in the Cisco NAT world we have to understand these 4 terms. Directly taken from Cisco [1]

• Inside local address—The IP address assigned to a host on the inside network. This is the address configured as a parameter of the computer OS or received via dynamic address allocation protocols such as DHCP. The address is likely not a legitimate IP address assigned by the Network Information Center (NIC) or service provider.
• Inside global address—A legitimate IP address assigned by the NIC or service provider that represents one or more inside local IP addresses to the outside world.
• Outside local address—The IP address of an outside host as it appears to the inside network. Not necessarily a legitimate address, it is allocated from an address space routable on the inside.
• Outside global address—The IP address assigned to a host on the outside network by the host owner. The address is allocated from a globally routable address or network space.

Following diagram depicts the terms in the actual traffic flow.

Following as depicted host1 and host 2 in the range if 192.168.100.0/24 range and 192.168.100.1 as the virtual ip for the HSRP group 10.
Simulated Inside network doesn’t have access to outside without natting.

R2#ping 192.168.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.100.1, timeout is 2 seconds:
...
Success rate is 0 percent (0/3)

First lets see what the options available for ip nat : (7200 Software (C7200-ADVENTERPRISEK9-M),

R1(config)#ip nat ?
Stateful           Stateful NAT configuration commands 
create             Create flow entries
inside             Inside address translation
log                NAT Logging
outside            Outside address translation
piggyback-support  NAT Piggybacking Support
pool               Define pool of addresses
portmap            Define portmap of portranges
service            Special translation for application using non-standard port
sip-sbc            SIP Session Border Controller commands
source             Source address translation
translation        NAT translation entry configuration

1) stateful nat (SNAT) works with HSRP/or independently to smooth tcp transition when the active/primary router fails [2]. this feature simply sync the flow entries to other router udp it uses port 15555.

first HSRP configuration on the R1#

R1# 
interface FastEthernet1/0
ip address 192.168.100.2 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
standby 10 ip 192.168.100.1
standby 10 priority 110
standby 10 name snat_hsrp

second we have to create ip nat stateful configuration .

ip nat Stateful id 10 #id should be unique for each router
redundancy snat_hsrp // identify the hsrp group
mapping-id 100 // this id will be mapped with nat
protocol   udp // we can use either tcp or tcp

Then we have to create the NAT pool :

ip nat pool TEST2 117.117.117.1 117.117.117.1 netmask 255.255.255.0
ip nat inside source list 105 pool TEST2 mapping-id 100 overload 
// check the mapping id is matched here..

same as R8 configured

R8#show run int fa2/0
Building configuration...

Current configuration : 192 bytes
!
interface FastEthernet2/0
ip address 192.168.100.3 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
standby 10 ip 192.168.100.1
standby 10 name snat_hsrp
// stateful configuration. 


ip nat Stateful id 20 // id is different
redundancy snat_hsrp
mapping-id 100
protocol   udp
ip nat pool TEST2 117.117.117.1 117.117.117.1 prefix-length 24
ip nat inside source list 105 pool TEST2 mapping-id 100 overload

according to this configuration, if stateful nat is not configured only the R1 should have the natting flow entries ( HSRP priority 110). but if you check the R8 nat table same entries kept on R8.

R8#show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
tcp 117.117.117.1:55833 192.168.100.100:55833 116.116.116.5:22 116.116.116.5:22
tcp 117.117.117.1:55834 192.168.100.100:55834 116.116.116.5:22 116.116.116.5:22

[1] “NAT: Local and Global Definitions - Cisco Systems.” [Online]. Available: http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094837.shtml. [Accessed: 14-Apr-2011].

[2] “Scalability for Stateful NAT - Cisco Systems.” [Online]. Available: http://www.cisco.com/en/US/docs/ios/12_4/12_4_mainline/snatsca.html. [Accessed: 15-Apr-2011].

wirless environment OSPF neigbor issue.

2011-04-09T09:27:00.002+05:30

This is setup is simple point to point but the physical transport medium is wireless.

when i enable the ospf neighbor getting up but frequently the ospf neighbor up & down.

Apr 9 08:09:33.719 LKT: %OSPF-5-ADJCHG: Process 10, Nbr 192.168.61.192 on Vlan2 from FULL to DOWN, Neighbor Down: Dead timer expired
Apr 9 08:09:33.731 LKT: %OSPF-5-ADJCHG: Process 10, Nbr 192.168.61.192 on Vlan2 from LOADING to FULL, Loading Done
Apr 9 08:12:23.720 LKT: %OSPF-5-ADJCHG: Process 10, Nbr 192.168.61.192 on Vlan2 from FULL to DOWN, Neighbor Down: Dead timer expired
Apr 9 08:12:33.735 LKT: %OSPF-5-ADJCHG: Process 10, Nbr 192.168.61.192 on Vlan2 from LOADING to FULL, Loading Done
Apr 9 08:15:13.721 LKT: %OSPF-5-ADJCHG: Process 10, Nbr 192.168.61.192 on Vlan2 from FULL to DOWN, Neighbor Down: Dead timer expired
Apr 9 08:15:23.737 LKT: %OSPF-5-ADJCHG: Process 10, Nbr 192.168.61.192 on Vlan2 from LOADING to FULL, Loading Done
Apr 9 08:19:43.729 LKT: %OSPF-5-ADJCHG: Process 10, Nbr 192.168.61.192 on Vlan2 from FULL to DOWN, Neighbor Down: Dead timer expired
Apr 9 08:19:53.740 LKT: %OSPF-5-ADJCHG: Process 10, Nbr 192.168.61.192 on Vlan2 from LOADING to FULL, Loading Done

I've confirmed there is no link failure but the hello packets are not received and the dead timer expired. I'm not sure where the problem, but i assume the problem is some multicast supporting on the wireless bridge devices . But this can be fixed using uni-cast neighbor establishment.
change the interface network type to NBMA

#ip ospf network ?
broadcast Specify OSPF broadcast multi-access network
non-broadcast Specify OSPF NBMA network
point-to-multipoint Specify OSPF point-to-multipoint network
point-to-point Specify OSPF point-to-point network

and in the ospf process define the neighbor statically this makes the unicast hello which solve this problem.

(config-router)#neighbor ?
A.B.C.D Neighbor address

cisco packet switching order

2011-03-16T22:29:00.001+05:30

This Lab setup i was trying to understand the Routing TCP/IP vol 1 - cisco packet switching order.

In this setup if we enable the debug ip packet on the R1 and see whether packet transferred between Host 1 & Host 2 ? lets ping from Host2 to Host1
mm execpt some broadcast packet nothing in the debugging output why ?

R1#debug ip packet
IP packet debugging is on
R1#
*Mar 1 00:15:00.823: IP: s=0.0.0.0 (FastEthernet0/0),
d=255.255.255.255, len 576, rcvd 2
R1#
*Mar 1 00:15:03.835: IP: s=0.0.0.0 (FastEthernet0/0),
d=255.255.255.255, len 576, rcvd 2
R1#
*Mar 1 00:15:06.839: IP: s=0.0.0.0 (FastEthernet0/0),
d=255.255.255.255, len 576, rcvd 2
R1#
*Mar 1 00:15:29.907: IP: s=0.0.0.0 (FastEthernet0/0),
d=255.255.255.255, len 576, rcvd 2
R1#
*Mar 1 00:15:32.911: IP: s=0.0.0.0 (FastEthernet0/0),
d=255.255.255.255, len 576, rcvd 2
R1#
*Mar 1 00:15:35.911: IP: s=0.0.0.0 (FastEthernet0/0),
d=255.255.255.255, len 576, rcvd 2

answer is
ip packet debugging only shows the packet transferred through packet switching.

Lets try further:
Lets change the processing to process switching on the R1 fa0/0 which is facing 192.168.1.2 Host. to disable cef we can use following command.

R1(config)#int fa0/0
R1(config-if)#no ip route-cache ?
cef Enable Cisco Express Forwarding
flow Enable Flow fast-switching cache
policy Enable fast-switching policy cache for outgoing

packets
same-interface Enable fast-switching on the same interface
R1(config-if)#no ip route-cache cef
R1(config-if)#no ip route-cache

Lets try to ping from 192.168.3.2 to 192.168.3.1

R1#
*Mar 1 00:36:30.131: IP: tableid=0, s=192.168.1.2 (FastEthernet0/0), d=192.168.3.2 (FastEthernet0/1), routed via FIB
*Mar 1 00:36:30.131: IP: s=192.168.1.2 (FastEthernet0/0), d=192.168.3.2 (FastEthernet0/1), g=192.168.2.2, len 84, forward
R1#
R1#
R1#
R1#

mmm .. only one packet shown here others ? above output shows two behaviors:

when the inbound is Process switching and outboud CEF / fast switching the resulting switching method will be Fastswitching that is the output shown here the first packet process switched as the expected behavior for fast switching

there is not packet shown as the src 192.168.3.2 because that stage the processing will happen via CEF( if inbound CEF & outbound process / Fast switching method CEF)

summary :

1) If the inbound is CEF switching method will be CEF
2) if the inbound is Process and the outbound is CEF / Fast resulting switching will be Fastswitching
3) if the inbound is Fast and outbound is CEF resulting will be Fast
4) if the inbound is Fast and outbound is Process resulting will be Process

There are exemption list we need to consider.

Reference : Table 3.1 Chapter 3 - routing tcp/ip vol 1 2nd edition.

proxy arp

2011-03-06T17:55:00.001+05:30

In the above diagram , both hosts don't have default routes. But both are in the same /16 subnet. When host1 tries to ping host2 will it be able to ping ? Yes this behaviour due to the Proxy Arp feature.
Note: Cisco by default enabled the proxy arp feature you have to disable it manually .

Check the following Debug messages "debug arp" from the router.
When the Arp request for 192.168.20.101 received on the router Fa0/1 it replies with its own mac address of fa0/1. (c200.03fc.0001)and vice versa

*Mar 1 00:11:43.071: IP ARP: rcvd req src 192.168.12.154 00aa.00f4.6800, dst 192.168.20.101 FastEthernet0/1
*Mar 1 00:11:43.075: IP ARP: sent rep src 192.168.20.101 c200.03fc.0001,dst 192.168.12.154 00aa.00f4.6800 FastEthernet0/1

*Mar 1 00:13:13.067: IP ARP: rcvd req src 192.168.20.101 00aa.0041.1d00, dst 192.168.12.154 FastEthernet0/0
*Mar 1 00:13:13.067: IP ARP: sent rep src 192.168.12.154 c200.03fc.0000,
dst 192.168.20.101 00aa.0041.1d00 FastEthernet0/0

following command per interface can disable the proxy arp feature.

# no ip proxy-arp.

Internet Protocol Control Protocol in PPP links.

2011-03-05T19:02:00.000+05:30

this blog we will look the PPP link's ip route / address negotiation .

In the above diagram, there is not static routing / protocol implemented just serial interface with ppp encapsulation link brought up .
if you try to ping the R1 interface ip 192.168.100.1 from R2 interface ip 192.168.1.1 will it succeed ?

R2#ping 192.168.100.1

Lets check the router interface:

R1#show run int s1/0
Building configuration...
Current configuration : 160 bytes
!
interface Serial1/0
ip address 192.168.200.1 255.255.255.0 secondary
ip address 192.168.100.1 255.255.255.0
encapsulation ppp
serial restart-delay 0

R2#show run int s1/0
Building configuration...

Current configuration : 110 bytes
!
interface Serial1/0
ip address 192.168.1.1 255.255.255.254
encapsulation ppp
serial restart-delay 0
end

Answer is Yes you can ping.

R2#ping 192.168.100.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/36/84 ms
R2#

Check the routing table: " 192.168.100.1" directly connected !!

R2#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
192.168.1.0/30 is subnetted, 1 subnets
C 192.168.1.0 is directly connected, Serial1/0
192.168.100.0/32 is subnetted, 1 subnets
C 192.168.100.1 is directly connected, Serial1/0

How it works :
ip address negotiated through IPCP as defined in RFC 1332
“The IP Control Protocol (IPCP) is responsible for configuring, enabling, and disabling the IP protocol modules on both ends of the point-to-point link.“

enabled the debugging to what is going on :

*Mar 1 00:31:48.207: Se1/0 PPP: I pkt type 0x8021, datagramsize 14 link[ip]
*Mar 1 00:31:48.211: Se1/0 IPCP: I CONFREQ [Open] id 3 len 10
*Mar 1 00:31:48.211: Se1/0 IPCP: Address 192.168.100.2 (0x0306C0A86402)
*Mar 1 00:31:48.215: Se1/0 IPCP: O CONFREQ [Open] id 3 len 10
*Mar 1 00:31:48.215: Se1/0 IPCP: Address 192.168.1.1 (0x0306C0A80101)
*Mar 1 00:31:48.215: Se1/0 IPCP: O CONFACK [Open] id 3 len 10
*Mar 1 00:31:48.219: Se1/0 IPCP: Address 192.168.100.2 (0x0306C0A86402)
*Mar 1 00:31:48.367: Se1/0 PPP: I pkt type 0x8021, datagramsize 14 link[ip]
*Mar 1 00:31:48.367: Se1/0 IPCP: I CONFACK [ACKsent] id 3 len 10
*Mar 1 00:31:48.371: Se1/0 IPCP: Address 192.168.1.1 (0x0306C0A80101)

Further Reading:
Internet Protocol Control Protocol in PPP links - http://tools.ietf.org/html/rfc1332

/31 bit Point to Point ip address configuration .

2011-03-04T13:17:00.007+05:30

Can we assign /31 address on the point to point link & save 50 % of ip address?
Answer is yes.

R2(config)#int fa0/0
R2(config-if)#ip address 192.168.1.0 255.255.255.254
% Warning: use /31 mask on non point-to-point interface cautiously

R4(config)#int fa0/0
R4(config-if)#ip address 192.168.1.1 255.255.255.254
% Warning: use /31 mask on non point-to-point interface cautiously

Let’s try to ping :)

R4#ping 192.168.1.0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.0, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

Ok do we need privilege mode to ping ? no .

R4> ping 192.168.1.0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.0, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

Let’s check the ip route:

R4#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

192.168.1.0/31 is subnetted, 2 subnets
C 192.168.1.0 is directly connected, FastEthernet0/0
C 192.168.1.2 is directly connected, FastEthernet0/1

I tried to assign the same way on switches 3550,3560 there was no issues.

" im just wondering.... So wht is a the use of Network n Broadcast addrs anyway ?":
Fist if its real point to point interface ( eg: serial, ppp) we don’t need to assign the ip address at all , unnumbered or we could use /32 at both side 
But when we use Ethernet as Point to Point we need to consider the broadcast addresses:

RFC 1812 says in section 4.2.3.1 IP Broadcast Addresses :
“ (2) SHOULD silently discard on receipt (i.e., do not even deliver to
applications in the router) any packet addressed to 0.0.0.0 or {

, 0 }. If these packets are not silently
discarded, they MUST be treated as IP broadcasts (see Section
[5.3.5]). There MAY be a configuration option to allow receipt
of these packets. This option SHOULD default to discarding
them.
“
Broadcast fall in to two categories:

Limited broadcast (Local)

0.0.0.0
All one -255.255.255.255

Directed broadcast

Network < all zero > - this is obsolete ( Reference RFC 3021 section 2.2 )
Network , < all one>

But our concern here is the directed broadcast , therefore if there is any broadcast it can uses limited broadcast . we have to understand the directed broadcast only affects the local router and the segment which is the point to point link . Further routing protocols uses the multicast, limited broadcast or unicast addresses that is not going to affected by the /31 addressing scheme.
Anyway directed broadcasts are always filtered as the best practice.

Further Reading:
http://www.faqs.org/rfcs/rfc3021.html

http://www.faqs.org/rfcs/rfc1812.html
http://www.cisco.com/en/US/docs/ios/12_2t/12_2t2/feature/guide/ft31addr.html

Whether we can give actual details to the forums ?

2011-02-17T15:37:00.005+05:30

After the release of the rootkit.com whole Mysql database (http://stfu.cc/rootkit_com_mysqlbackup_02_06_11.gz) 85000 users detail (if we remove the duplicate at least 50000 users) I searched my data obviously listed there.. :( Anyway i used to rotate my passwords and use lame passwords in the forums i feel safe. But after the breach the owners could advise the users of the group may be they don’t have the data now ? Some of the hashes i could reverse. I searched some Sri Lankan users around 30 users i could reverse some of the users password obviously my one too as reference ;).

Hope dedicated crackers could use large rainbow table to reverse more of it I don’t wont to waste my time.

One reverse hashing site:
http://md5.thekaine.de/ ( if you have better sites please let me know)
http://md5.my-addr.com/md5_decrypt-md5_cracker_online/md5_decoder_tool.php
http://www.netmd5crack.com/cracker/
http://isc.sans.edu/tools/reversehash.html

1023 passwords are - "123456" :)
384 - password is "password"
329 - password is "rootkit"
190 - 111111
181 - 12345678
174 - qwerty

Analysis about the attack:
http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack.ars

jibberjabber :)

mikrotik queue tree - Per connection queuing.

2011-02-09T20:59:00.012+05:30

One of the cool feature on Mikrotik queuing is Per Connection Queuing . we can equally distribute the bandwidth among Number of users.[1]
This setup explores the per connection queuing in the congestion situation and how to utilize the priority queuing features.

[Please note Mikrotik Queue lowest priority value have highest priority eg: queue priority 7 traffic gets highest preference over queue priority 8 ]
In this test setup 192.168.92.50 and 51 given 512Kbps per connection queuing(PCQ) Priority 6 . 192.168.52 and 54 placed under 256Kbps PCQ (Priority 8) and further youtube users given 384Kbps irrespective to the queue they are currently placed ( FIFO) .

1) Bridge setup - " Don't forget to enable the bridge firewall :) "

/interface bridge

add admin-mac=00:00:00:00:00:00 ageing-time=5m arp=enabled auto-mac=yes comment="" disabled=no forward-delay=15s l2mtu=1522 \

max-message-age=20s mtu=1500 name=br_traffic_shaper priority=0x8000 protocol-mode=none transmit-hold-count=6



/interface bridge port

add bridge=br_traffic_shaper comment="" disabled=no edge=auto external-fdb=auto horizon=none interface=ether1 path-cost=10 point-to-point=auto \

priority=0x80

add bridge=br_traffic_shaper comment="" disabled=no edge=auto external-fdb=auto horizon=none interface=ether2 path-cost=10 point-to-point=auto \

priority=0x80

/interface bridge settings

set use-ip-firewall=yes use-ip-firewall-for-pppoe=no use-ip-firewall-for-vlan=no

Place an address list to define the 512Kbps users:

/ip firewall address-list

add address=192.168.92.50 comment="" disabled=no list=specical

add address=192.168.92.54 comment="" disabled=no list=specical

all others are placed in 256Kbps through marking the whole subnet (/29). Make sure the passthrough. Youtube traffic simply matched through content of the packet . It will match the whole session traffic.

/ip firewall mangle

add action=mark-connection chain=prerouting comment="" content=youtube disabled=no  \

new-connection-mark=youtube passthrough=yes

add action=mark-packet chain=prerouting comment="" connection-mark=youtube disabled=no new-packet-mark=youtube-packet passthrough=no

add action=mark-connection chain=prerouting comment="" disabled=no new-connection-mark=special passthrough=yes src-address-list=specical

add action=mark-packet chain=prerouting comment="" connection-mark=special disabled=no new-packet-mark=special_pkt passthrough=no

add action=mark-connection chain=prerouting comment="" disabled=no dst-address=192.168.92.48/29 new-connection-mark=all_conn \

passthrough=yes

add action=mark-packet chain=prerouting comment="" connection-mark=all_conn disabled=no new-packet-mark=all_pkt \

passthrough=yes

3) Define the queue type ,

/queue type

add kind=pcq name=256K_Users pcq-classifier=dst-address pcq-limit=50 pcq-rate=256000 pcq-total-limit=2000

add kind=pcq name=512K_Users pcq-classifier=dst-address pcq-limit=50 pcq-rate=512000 pcq-total-limit=2000

4) Define the Parent queue:

/queue tree

add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=1024k max-limit=1024k name=Test_Parent_Dwn parent=ether1 \

priority=8

add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=1024k max-limit=1024k name=Test_Parent_Up parent=ether2 \

priority=8

4) Define the sub queue tree based on the marking:

/queue tree

add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 max-limit=1024k name=256K_U packet-mark=all_pkt parent=\

Test_Parent_Dwn priority=8 queue=256K_Users

add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 max-limit=512k name=go packet-mark=special_pkt parent=\

Test_Parent_Dwn priority=6 queue=512K_Users

add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 max-limit=384k name=youtube packet-mark=youtube-packet parent=\

Test_Parent_Dwn priority=2 queue=default

we can see if all the users download in this situation ( except youtube) the total bandwidth goes 1.5Mbps but since the max-limit for 512K users 512Kbps they will equally share the bandwidth 256Kbps but if one user not downloading other user will get 512Kbps full.
but if the max limit is 768Kbps both users will devide the bandwidth equally but at the same time 256Kbps user will get 128kbps each.

In this scenario (max-limit 512kbps & 384 for youtube) when 4 usrs downloading & one user goes to youtube he will get 384Kbps and remaining bandwidth 640Kbps will be available for other users.
since 512Kbps goes to priority 6 users so only 128Kbps allocated for 256k users except youtube ( There is a dependency on the packet mark order in our setup highest order )

if the subqueues (which have the highest priority - Lower number) max-limit total > Total bandwidth
loweset priority queues will starve (0 kbps will be allocated) . Do some math before allocating bandwidth & priority.

[1] Manual:Queues - PCQ - http://wiki.mikrotik.com/wiki/Manual:Queues_-_PCQ

ANSI color code what to do with windows terminal .

2011-02-01T22:30:00.003+05:30

I was trying some telnet coding on NET::TELNET and received some text as the response from mikrotik router.
[m [36m/interface [m [m [36methernet
when you see such a text file in your windows notepad editor (? ) ( i thought to replace this unwanted character :) ) what you will do ?

after some googling i found this is the ANSI color code that supported by Linux terminals, if you do cat it will display correctly . windows there are some resources seems to be outdated anyone find better resources ?
http://www.andre-simon.de/zip/download.html#ansifilter
http://www.defacto2.net/nfo-files.cfm

can you assign same ip address to two interfaces

2011-01-28T21:59:00.005+05:30

cisco if the interface type is point to point we don't need to assign ip address related to RFC 1812 2.2.7 section :
Related to this if the interface type is P2P we can assign same ip address to two interfaces.


Serial1/0                  192.168.1.1     YES manual up                    up  
Serial1/1                  192.168.1.1     YES manual up                    up

Ok if i ping 192.168.1.2 where it will go ? lets explore it ..

Basic diagram

R2 (s1/0)--<(s1/1) R1 (s1/0)>--(s1/0) R3 -- LO 192.168.6.1/32


R1#show ip route 192.168.1.2
Routing entry for 192.168.1.0/30
  Known via "connected", distance 0, metric 0 (connected, via interface)
  Routing Descriptor Blocks:
  * directly connected, via Serial1/0
      Route metric is 0, traffic share count is 1
    directly connected, via Serial1/1
      Route metric is 0, traffic share count is 1

so basically load sharing :)
further more ,


R1#show ip cef 192.168.6.1
192.168.6.1/32
  nexthop 192.168.1.2 Serial1/0
  nexthop 192.168.1.2 Serial1/1

if i enabled the debug ip icmp and interface changed the loadsharing mode to per packet :


R1#ping 192.168.6.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.6.1, timeout is 2 seconds:
U!
*Jan 28 22:24:25.455: ICMP: dst (192.168.1.1) host unreachable rcv from 192.168.1.2
*Jan 28 22:24:25.555: ICMP: echo reply rcvd, src 192.168.6.1, dst 192.168.1.1.!U
Success rate is 40 percent (2/5), round-trip min/avg/max = 76/88/100 ms
R1#
*Jan 28 22:24:27.635: ICMP: echo reply rcvd, src 192.168.6.1, dst 192.168.1.1
*Jan 28 22:24:27.743: ICMP: dst (192.168.1.1) host unreachable rcv from 192.168.1.2

So we can assign the ip address but if its connecting to same device no issue otherwise will be problem

XAMPP WebDAV Vulnerability

2011-01-28T12:07:00.008+05:30

This vulnerability basically WebDav can be access like ftp server if you know the username & Password. since Xampp places the default username & password the user doesn't restrict the access to xampp directory after the xampp installtion attackers can places their files & execute remotely. they can use your PC to DDoS their targets.

Quite a strange my machine generating 80Mbps traffic towards one of the host.
as usual i searched through process explore (sysinternal ) for any unwanted process + tcp connection, Nothing suspicious.But Anti-Virus logs points out http.exe trying to access IRC ports http.exe is xammp apache server process.


1/21/2011 10:02:23 AM Blocked by port blocking rule  X:\xampplite\apache\bin\httpd.exe Anti-virus Standard Protection:Prevent IRC communication 173.192.66.130:6666
1/21/2011 10:35:45 AM Blocked by port blocking rule  X:\xampplite\apache\bin\httpd.exe Anti-virus Standard Protection:Prevent IRC communication 199.27.134.100:6668
1/21/2011 10:37:04 AM Blocked by port blocking rule  X:\xampplite\apache\bin\httpd.exe Anti-virus Standard Protection:Prevent IRC communication 199.27.134.100:6666
1/21/2011 10:39:36 AM Blocked by port blocking rule  X:\xampplite\apache\bin\httpd.exe Anti-virus Standard Protection:Prevent IRC communication 74.53.201.162:6668

so i was suspicious over the xampp and started to google around vulnerability for Xampp and found xampp webdav has default password , anybody can access it and place files in the folder it. through that they can access whole server content.
Next step the apache logs ,
Access log points that too ( watch the PUT) :


50.22.21.218 - - [18/Jan/2011:14:02:34 +0530] "GET /webdav/ HTTP/1.1" 200 313 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12"
50.22.21.218 - - [18/Jan/2011:14:02:34 +0530] "PROPFIND /webdav/ HTTP/1.1" 401 1369 "-" "WEBDAV Client"
50.22.21.218 - wampp [18/Jan/2011:14:02:34 +0530] "PROPFIND /webdav/ HTTP/1.1" 207 2397 "-" "WEBDAV Client"
50.22.21.218 - wampp [18/Jan/2011:14:02:35 +0530] "PROPFIND /webdav/ HTTP/1.1" 207 2397 "-" "WEBDAV Client"
50.22.21.218 - wampp [18/Jan/2011:14:02:35 +0530] "PUT /webdav/info.php HTTP/1.1" 201 332 "-" "WEBDAV Client"
50.22.21.218 - wampp [18/Jan/2011:14:02:36 +0530] "PROPFIND /webdav/ HTTP/1.1" 207 3174 "-" "WEBDAV Client"
50.22.21.218 - - [18/Jan/2011:14:02:41 +0530] "GET /webdav/info.php HTTP/1.1" 200 105 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12"
50.22.21.218 - wampp [18/Jan/2011:14:02:49 +0530] "DELETE /webdav/info.php HTTP/1.1" 204 - "-" "WEBDAV Client"
50.22.21.218 - wampp [18/Jan/2011:14:02:49 +0530] "PUT /webdav/x32.php HTTP/1.1" 201 331 "-" "WEBDAV Client"
50.22.21.218 - wampp [18/Jan/2011:14:02:50 +0530] "PROPFIND /webdav/ HTTP/1.1" 207 3174 "-" "WEBDAV Client"
50.22.21.218 - wampp [18/Jan/2011:14:02:50 +0530] "PUT /webdav/servconfig.php HTTP/1.1" 201 338 "-" "WEBDAV Client"
50.22.21.218 - wampp [18/Jan/2011:14:02:52 +0530] "PROPFIND /webdav/ HTTP/1.1" 207 3958 "-" "WEBDAV Client"

3 files placed by the attackers leaf.php,servconfig.php, x32.php ( no idea what is leaf.php anybody have any idea ? here i've attached the php files. :


01/22/2011  03:03 AM             1,107 leaf.php
01/21/2011  08:56 PM             3,775 servconfig.php
12/20/2009  12:00 AM               277 webdav.txt
01/18/2011  02:02 PM             1,975 x32.php

rar file .
http://hotfile.com/dl/100076218/c618307/webdav.rar.html

x32.php gives basic interface where you can place host & time duration for the attack. Sample attack request : This may be vary depend on the php /active content the attacker places.


"91.121.2.103 - - [27/Jan/2011:15:09:14 +0530] "GET /webdav/x32.php?act=phptools&host=76.105.134.136&time=120&port=3074 HTTP/1.1" 200 1133 "-" "-"
91.121.2.103 - - [27/Jan/2011:15:10:14 +0530] "GET /webdav/x32.php?act=phptools&host=76.105.134.136&time=120&port=3074 HTTP/1.1" 200 1134 "-" "-"
91.121.2.103 - - [27/Jan/2011:15:10:51 +0530] "GET /webdav/x32.php?act=phptools&host=76.105.134.136&time=120&port=3074 HTTP/1.1" 200 1133 "-" "-"
91.121.2.103 - - [27/Jan/2011:15:13:48 +0530] "GET /webdav/x32.php?act=phptools&host=76.105.134.136&time=120&port=3074 HTTP/1.1" 200 1134 "-" "-" 
"

workaround:
Change the default username and password on the webdav folder that placed by the xampp
X:/xampp/security/webdav.htpasswd

Delete the webdev folder / search google XAMPP WebDAV vulnerability.

Mirotik queue change through API

2010-12-12T20:23:00.003+05:30

I was implementing time based queue change. Rather than using mikrotik in-built scheduler i thought to execute a crontab through central location. Therefore i tried with except scripting but with telnet it failed or not working properly. I think the returned results might have any color coding input. while searching i stumble on the mikrotik perl api written by Hugh [URL:http://forum.mikrotik.com/viewtopic.php?f=8&t=22744].
i just edited the example code as follows. this is the upgrade this will be edited for the download.


#!/usr/bin/perl -w
#to define the api. 
BEGIN {push @INC, '/root/upgradefolder'}
use Mtik ;

$mtik_host =  "192.168.28.49";
$mtik_user =  "user_script";
$mtik_passwd = "passwordscript";
my(@cmd);
push(@cmd,"/queue/simple/set");
push(@cmd,"=limit-at=6144000/6144000");
push(@cmd,"=max-limit=6144000/6144000");
push(@cmd,"=.id=2M");

$Mtik::debug = 0;
if (Mtik::login($mtik_host,$mtik_user,$mtik_passwd)) {
      my($retval,@results) = Mtik::raw_talk(\@cmd);
      foreach my $result (@results) {
        print ">>> $result\n";
      }
  Mtik::logout();
}
else {
  print "Couldn't log in to $mtik_host\n";
}

Mikrotik side I've enabled api services.


 ip service print
Flags: X - disabled, I - invalid
 #   NAME                  PORT  ADDRESS            CERTIFICATE
 0   telnet                23    0.0.0.0/0
 1   ftp                   21    0.0.0.0/0
 2   www                   80    0.0.0.0/0
 3   ssh                   22    0.0.0.0/0
 4 X www-ssl               443   0.0.0.0/0          none
 5   api                   8728  0.0.0.0/0
 6   winbox                8291  0.0.0.0/0

and named the queue as 2M


>queue simple print
Flags: X - disabled, I - invalid, D - dynamic
 0    name="2M" target-addresses=192.168.28.48/29 dst-address=0.0.0.0/0
      interface=ether3 parent=none direction=both priority=8
      queue=default-small/default-small limit-at=4096000/4096000
      max-limit=4096000/4096000 burst-limit=0/0 burst-threshold=0/0
      burst-time=0s/0s total-queue=default-small

And added the crontab according to it .

#Auto bandwidth upgrade script
01 19 * * * /root/upgradefolder/test_upgrade.pl
01 07 * * 1-5 /root/upgradefolder/test_downgrade.pl

CCNA Access list lab

2010-12-12T20:11:00.002+05:30

Tasks are defined in the packet trace file. 10.10.12.0/24 network ip address not bound to the PC.
Otherwise this is the basic diagram.

Download:http://hotfile.com/links/88950992/ac4cb5e/acl.pkt.html

Little endian, Big endian -- back to network programming.

2010-12-05T11:42:00.002+05:30

This is for my reference :) .


Data Pattern AFB3
Little endian B3 AF
Big endian AF  B3
Network Byte Order Big-Endian
Host Byte Order -Depend on the Host

Ref: http://beej.us/guide/bgnet/output/html/multipage/ipstructsdata.html

application virtualization concept - Qubes OS

2010-12-03T22:43:00.006+05:30

Invisible Things Lab - they are focused on kernel security, virtualization security and system/firmware level security who brings up certain vulnerabilities in Intel process introducing qubes which is based on virtualization concept. core concept behind the OS is based on Security by Isolation .

Architecture mentioned in the above diagram(taken from the documentation).
I couldn't test / or willing to download ;) .
!!NOTE: You can only install Qubes on a 64-bit CPU! (most recent laptops have 64-bit CPUs)
!!!NOTE: Do not try to install Qubes in a VM, e.g. VMWare.

By the way if you want to try :
http://www.qubes-os.org/trac/wiki/InstallationGuide
http://qubes-os.org/Architecture.html
http://www.invisiblethingslab.com/itl/Welcome.html

IEEE P802.3az Energy Efficient Ethernet

2010-12-03T22:29:00.002+05:30

Energy Efficient concept move from data centers to servers CPU and finally come up to the Ethernet controller level. I didn't want to read the IEEE standard ( i don't have capability to understand the content ). but in future drivers will interact to provide the dynamic negotiation of the bandwidth over the Ethernet, when the link idle it tries to save the power.
Relevant resources:
Overall intro :
http://www.nanog.org/meetings/nanog50/abstracts.php?pt=MTY0NCZuYW5vZzUw&nm=nanog50
IEEE working group:
http://www.ieee802.org/3/az/public/
One more tutorial :
http://www.ieee802.org/802_tutorials/07-July/IEEE-tutorial-energy-efficient-ethernet.pdf
Interesting concepts :
Desktop-to-switch links
– Are mostly idle
• Lots of very low bandwidth “chatter”
– High bandwidth needed for bursts
• Bursts are often seconds to hours apart
• Server links are also often not fully utilized
– Higher speed links offer more opportunity to save energy
– This is an area where more data is needed
• Evidence of low utilization (desktop users)
– LAN link utilization is generally in range 1 to 5% [1, 2]
– Utilization for “busiest” user in USF was 4% of 100 Mb/s

Asus's calming they are the first one :)

Internet Banwidth will be free ?

2010-11-21T13:13:00.002+05:30

Few years back getting 1Mb bandwidth internet port cost much , the same scenario experienced by the mobile operators. when the competition increases the new price model and service oriented architecture and focus on the data services increases. But the wholesale internet business seems to be facing the same problem . "Wholesale Internet Bandwidth Prices Keep Falling" according to the 2008 report it suggest between 10$ -14$ this values indicate the US pops pricing . But in the Asian countries specially south Asian countries the pricing stricture really high when compared to Europe due to the lack of infrastructure. But the Indian market giving the pressure to reduce the pricing structure. That will have certain impact on the neighbor countries.
with this in mind when reaching 2020 the per Gigabit cost will be the same and the services that use to offer will be the dominating factor in the service providers. Hosting may migrate to community offer or hybrid cloud structure. where the ipv6 will gives individuals to host their own service. reliability will be given through the distributed peer to peer structure. Wireless providers will be moved to promising wireless new standardize such as 802.11ac. (802.11ac Standard Will Bring Gigabit Speeds to WiFi) . and upcoming new standards.

Internet will be a utility service , but the services the user going to be consume will dominate the pricing. This can't be a free service but the charges can be indirectly obtained through different ways.

network related project concepts

2010-08-05T20:16:00.004+05:30

Some of the ideas I've thought may be some people already done, but need to do literature survey on these areas:
1) Application issue identification based on network analysis.
Since i'm working in an ISP sometime really hard to figure out the application issues that affected by network interaction. such as packet loss , throughput , mtu , jitter etc ... analyzing the packet using wireshark or other tools sometimes won't reveal important factors. ( May be i don't know how to use this tool :) ) .
initial search yields some commercial tools ....

2) Data management for Network Management data.
This is related to my previous post. Data capturing and logging almost standardized but how we are analyzing and how to take action mostly depend on the requirement on hand. Based on the requirements there can be different ideas.
* Mal-ware , bot control traffic etc .. signature extraction
* CRM integration
* Network event identification
* Digital Forensic analysis
* etc...

Network Monitoring Databases

2010-07-31T19:57:00.003+05:30

I was quite unhappy regarding the space & processing power that require to store and process the network traffic data into general database. As well as the efficiency when handling the network flow. For an example in an ISP the data generated from Netflow is a significant amount that varies with the number of flow eg:Million flows per hour. Netflow considered De facto standard for network accounting / billing and now anomaly detection schemes. Therefore the general database structures not an efficient for processing large network traces. Therefore i was checking relevant projects in the academic world but AT&T Industry have come up with the project called Gigascope(Still i couldn't get the source code :) ). But similar product i found interesting CoMo Project. This area of researches are follows the "Network Data Streaming" Database structure.
Lets explore it "http://como.sourceforge.net/publications.php" :)

Mikrotik IPSec Performance Study

2010-05-29T12:47:00.003+05:30

Sample network is implemented with similar devices and the Internet connection simulated via Lan connectivity. Two end hosts provide the transfer and reviver functionality.

Network Setup.

The test environment designed as explained in the diagram 1.0.

Test Setup Figure 1.0

End Host Configuration- Table 1.0

End Point 1

End point 2

Microsoft windows XP Professional SP3

CPU count 2

1.87 GB RAM 3.00GHz

100Mbps Realtek RTL8139/810x Family Fast Ethernet NIC

Microsoft windows XP Professional SP3

CPU count 1

1.47GB RAM 3.06GHz

100Mbps Realtek RTL8139 Family PCI Fast Ethernet NIC

Router Configuration - Table 1.1

	Router 1
Speed	264 MHz	264 MHz
Memory	30MB RAM	30MB RAM
HD	128 MB	64 MB
	RouterOS 3.30	RouterOS 3.20

Workload:

Hashing algorithm parameter is fixed to SHA and changed the encryption algorithm. Default CPU load without the traffic is stays around 2% from both routers. Traffic generated through iperf for the sample traffic.

	Protocol	Cipher	Packet Size	Hash	Maximum Bandwidth Trial 1 TX Kbits/ RX Kbits	Maximum Bandwidth Trial 2 TX Kbits/ RX Kbits	Maximum Bandwidth Trial 3 TX Kbits/ RX Kbits	Maximum Bandwidth Trial 4 TX Kbits/ RX Kbits	AVG TX Kbits/ RX Kbits
1.	TCP*	--	64	--	5.70/5.37	5.32/5.54	5.17/5.37	5.43/5.67	5.405/5.487
2.	TCP	DES	64	SHA	616/598	809/784	611/626	801/790	709/700
3.	TCP	3DES	64	SHA	616/ 594	601/537	802/769	638/614	664/628
4.	TCP	AES-128	64	SHA	795/868	615/639	788/806	821/807	755/780
5.	TCP	AES-192	64	SHA	613/628	803/769	602/627	768/816	697/710
6.	TCP	AES-256	64	SHA	541/577	784/753	632/645	778/826	684/700
7.	TCP*	--	96	--	6.15/5.97	6.02/ 6.21	6.03/6.29	6.29/6.55	6.122/6.225
8.	TCP	DES	96	SHA	724/716	839/771	716/724	813/ 775	773/747
9.	TCP	3DES	96	SHA	837/771	740/729	829/788	826/788	808/769
10.	TCP	AES-128	96	SHA	846/ 795	730/743	754/737	800/ 870	782/786
11.	TCP	AES-192	96	SHA	856/803	716/712	798/855	721/723	773/773
12.	TCP	AES-256	96	SHA	738/725	853/789	742/729	782/843	779/771
13.	TCP*	--	1536	--	10.4/8.43	8.85/9.90	8.37/10.4	9.06/9.71	9.17/9.61
14.	TCP	DES	1536	SHA	863/867	860/873	861/867	836/895	855/875
15.	TCP	3DES	1536	SHA	954/817	875/881	881/885	876/881	904/866
16.	TCP	AES-128	1536	SHA	894/ 898	898/909	897/901	828/968	879/919
17.	TCP	AES-192	1536	SHA	822/962	883/894	888/894	885/889	869/910
18.	TCP	AES-256	1536	SHA	883/889	821/955	876/888	879/882	865/903

* Bandwidth measured in Mbps.

Automatic FTP upload when content changed in folder - perl script

2010-05-29T12:32:00.002+05:30

This was rudimentary script needed to edit more, but found interesting .


#! perl -slw
use strict;
use Win32::ChangeNotify;
use threads;
#monitoring path. 
my $path = 'c:\folder';

my $notify = Win32::ChangeNotify->new( $path, 0, 'FILE_NAME' );

my %last;
  @last{ glob $path . '\*' } = ();

my $count = 0;
while( 1 ) {
    next
     unless $notify->wait( 10_000 ); # Check every 10 seconds
     $notify->reset;
     print $/, 'Something changed';
     my @files = glob $path . '\*';
     if( @files>  scalar keys %last ) {
         my %temp;
         @temp{ @files } = ();
         delete @temp{ keys %last };
         #print for keys %temp;
        my $k;
        my $v;
        while ( ($k,$v) = each %temp ) {
   my $thr1 = threads->create(\&load, $k,$count);
     }
  }
     else {
         print "A non-deletion or creation change occured";
     }
     undef %last;
     @last{ @files } = ();
  $count = $count +1;
}

sub load {
my ($file,$count) = @_;
  if(fileSize($file))
        {
        ftp__command_generator($file,$count);
        }
        
}
#check the file is still copying
sub fileSize {
    my($filename,$count) = @_;
    while(1)
    {
        my $value;
        $value = open(FILEx,$filename);
        if ($value)
        {
            close(FILEx);
            return 1;
        }
        else
        {
            sleep(10);
        }
    }
}

sub ftp__command_generator {
my($Changed_file,$count) = @_;
my $outfile = "file$count.dat";
open (FILE2,">$outfile");
print (FILE2 "user USERNAME");
print (FILE2 "PASSWORD");
print (FILE2 "bin");
print (FILE2 "put \"$Changed_file\"");
print (FILE2 "quit");
close(FILE2);
system("ftp -n -s:$outfile 192.168.0.1");
}

Mikrotik Backup through perl script

2010-04-03T20:48:00.004+05:30

I don't know how many people are still using telnet but suppose if you are using this will help. Script uses export command to take the backup and save it. I thought better to share it. I'll check the ssh variation and upload when possible.


#Date - 31st April 2010
#Gobinath
#To retrive the backup from the mikrotik router.
#!/usr/bin/perl
use Net::Telnet;
use POSIX ;

#Input 
# routerlist contains ipaddress and name that save the backupfile seprated by tab # used for comments. 
#Backup Path.
$path = "/mikrotik/backups";
#router List
$filename = "routerlist.txt";

#Mikrotik Username Password +ct used to remove the color codes
@username_list = ('admin+ct','admin');
@password_list = ('######','######');
#Read the router List
open (FILE,$filename) ;

#Time Stamp.
my $datestamp = strftime("%Y%m%d",localtime);
chomp($datestamp);



sub retriver {
undef @output ;
   my($username, $pass,$hostname) = @_;
   $telnet = new Net::Telnet ( Timeout,5, Errmode=>'return');
   $telnet->binmode(0);
   $telnet->open($hostname);
   $telnet->login($username,$pass);
   $msg = $telnet->errmsg;
   if ($msg =~ /ogin failed/ )
   {
   $output[0] = "failed";
    return @output;
   }
   else
   {
   #Retrive the export .
   $telnet->waitfor('/] >/i');
   @output = $telnet->cmd('/export');
   return @output;
   }
}


while ()
{
        if (lcfirst $_ != '#')
        {
            undef @output ;
            my($hostname,$filename)=  split('\t', $_);
            chomp($filename);
            my $count =  0;
            foreach(@username_list)
            {

                my $username = $_;
                my $pass =  $password_list[$count];
                @output = &retriver($username,$pass,$hostname);
                if ( $output[0] !~ /failed/ )
                {

                    $filepath = $path."/".$filename."_".$datestamp.".txt";
                    open(OUT,">$filepath");
                    print OUT @output;
                    last;
                }
             $count = $count +1;
            }
        }
}

close(FILE);

issue noted with mikrotik version 3.0 and related OS. still couldn't fix the problem.

IP Based search engine

2009-12-16T20:45:00.005+05:30

Search on gigablast provide a unique facility to search based on IP/IP Range.
eg: ip:69.63.181 (http://gigablast.com/search?k4a=576656&s=10&q=ip:69.63.181)
List all the websites hosted on the facebook ip range. quite interesting to know. :)

Conditional BGP Advertisement

2009-10-30T21:34:00.005+05:30

Introduction:
This we can use to advertise the prefixes automatically when one peer goes down rather manually advertise the prefixes.
Design Notes:
In this example I’m trying to advertise 10.0.0.0/16 through AS 65001 but if the peer (203.143.0.5) goes down automatically advertise the 10.0.0.0/16 through AS 65002(203.143.0.1).
To make the configuration works we need to match against a prefix that advertise from that(203.143.0.5) peer. But to make sure that learned through that peer we can use AS-Path match or community based match. Here in this example I’m matching against 172.16.0.0/24 advertise through 65001 and match against the as path ^ 65001.
Configuration Notes:
This is the only configuration different from normal one:
neighbor 203.143.0.1 advertise-map otherblock non-exist-map[exist-map] inblock
Better notes on this:

Normal Status:


R2#show ip bgp neighbors 203.143.0.1 | inc Cond
Condition-map inblock, Advertise-map otherblock, status: Withdraw
R0#show ip route
Gateway of last resort is not set
B    172.16.0.0/16 [20/0] via 203.143.0.2, 00:08:41
     203.143.0.0/30 is subnetted, 1 subnets
C       203.143.0.0 is directly connected, FastEthernet0/0
B    192.168.0.0/16 [20/0] via 203.143.0.2, 00:08:11


R2#show ip bgp neighbors 203.143.0.1 advertised-routes
BGP table version is 5, local router ID is 203.143.0.6
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? – incomplete
   Network          Next Hop            Metric LocPrf Weight Path
*> 172.16.0.0       203.143.0.5              0             0 65001 i
*> 192.168.0.0/16   0.0.0.0                  0         32768 i
Total number of prefixes 2

When the BGP PEER Down:


R2#show ip bgp summary
Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
203.143.0.1     4 65002     113     141        7    0    0 00:13:20        0
203.143.0.5     4 65001     117     121        0    0    0 00:00:52 Active
R2#show ip bgp neighbors 203.143.0.1 advertised-routes
BGP table version is 7, local router ID is 203.143.0.6
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? – incomplete
 Network          Next Hop            Metric LocPrf Weight Path
*> 10.0.0.0/16      0.0.0.0                  0         32768 i
*> 192.168.0.0/16   0.0.0.0                  0         32768 i
Total number of prefixes 2
R2#show ip bgp neighbors 203.143.0.1 | inc Cond
  Condition-map inblock, Advertise-map otherblock, status: Advertise

Configuration:


R2#
hostname R2
interface FastEthernet0/0
 ip address 203.143.0.2 255.255.255.252
 duplex auto
 speed auto

interface FastEthernet0/1
 ip address 203.143.0.6 255.255.255.252
 duplex auto
 speed auto
!
router bgp 65003
 no synchronization
 bgp log-neighbor-changes
 network 10.0.0.0 mask 255.255.0.0
 network 192.168.0.0 mask 255.255.0.0
 neighbor 203.143.0.1 remote-as 65002
 neighbor 203.143.0.1 soft-reconfiguration inbound
 neighbor 203.143.0.1 advertise-map otherblock non-exist-map inblock
 neighbor 203.143.0.5 remote-as 65001
 neighbor 203.143.0.5 soft-reconfiguration inbound
 neighbor 203.143.0.5 prefix-list allow_65001 out
 neighbor 203.143.0.5 route-map inbound_65001 in
 no auto-summary
!
ip route 10.0.0.0 255.255.0.0 Null0
ip route 192.168.0.0 255.255.0.0 Null0
!
ip as-path access-list 1 permit ^65001
ip prefix-list allow_65001 seq 5 permit 10.0.0.0/16
ip prefix-list allow_65002 seq 5 permit 192.168.0.0/16
access-list 1 permit 10.0.0.0 0.0.255.255
access-list 2 permit 172.16.0.0 0.0.255.255
route-map otherblock permit 10
 match ip address 1
!
route-map allow_65001 permit 10

route-map inbound_65001 permit 10
 set community 4259905537
route-map inblock permit 10
 match ip address 2
 match as-path 1 ! to match the as-path
end
R2 END#

R1#show run!
!
interface FastEthernet0/0
ip address 203.143.0.5 255.255.255.252
 duplex auto
 speed auto
!
router bgp 65001
 no synchronization
 bgp log-neighbor-changes
 network 172.16.0.0
 neighbor 203.143.0.6 remote-as 65003
 no auto-summary
!
ip forward-protocol nd
ip route 172.16.0.0 255.255.0.0 Null0 
R1 END#
R0#show run
ip cef
interface FastEthernet0/0
ip address 203.143.0.1 255.255.255.252
 duplex auto
 speed auto

router bgp 65002
 no synchronization
 bgp log-neighbor-changes
 neighbor 203.143.0.2 remote-as 65003
 neighbor 203.143.0.2 soft-reconfiguration inbound
 no auto-summary

Network Switch ip to port mapping using neo

2009-10-10T09:56:00.006+05:30

Open Source Network Administration gives some introduction to this network tool called neo. Latest version can be found ktools.org
(http://www.ktools.org/dist/neo/neo-1.3.1.tar.gz)

There is one catch while you compile & install in Ubuntu since the object_statstransfer.c , object_sleeper.c uses CLK_TCK i think CLK_TCK obsolete we have to use CLOCKS_PER_SEC instead. But i just defined as followed in the both files.

/* Define my constant */
#define CLK_TCK 100

Installation process :
1 ) gunzip -c neo-1.3.1.tar.gz | tar xvf -
2 ) cd neo-1.3.1
3 ) ./configure
4 ) Do the relevant changes as explained earlier in the both source files.
5 ) make
6 ) make install

neo has its own command line. But basic things you need to get ip to port map two command arpfind , locate .

Before doing that you can define the switches & the core router in one file. (router needed to find the ip to arp resolution)
example /var/neo/switches

192.168.1.10
192.168.1.11

if you want to find the relevant ip to arp mapping you could issue the command as
neo -c "community string" arpfind @f:/var/neo/switches
This will give u the arp address ,
then you can issue the location command to locate the port number.

neo -c "community string" locate @f:/var/neo/switches

I've combined both into one perl script. I haven't use the community string here since i complied the default community as relevant string. You can change the community string while compiling (
object_global.c


  g->argv0=NULL;
  g->readcom=strdup("public");
  g->writecom=strdup("public");
  neo_global_set_burst(g, 1);



#!/usr/bin/perl
#Arp to IP Mapper Argument as host
$arg = $ARGV[0];

#To save the actual arp
$real_arp = "";
#Identify the arp of the host
@arp = `neo arpfind $arg \@f:/root/gobi/neo-1.3.1/switches`;
foreach (@arp)
{
 if ($_ =~ /says/)
 {
 $real_arp = substr($_,-18);
 last ;
 }
}
chomp($real_arp);
@port = `neo locate -u $real_arp \@f:/root/gobi/neo-1.3.1/switches`;

foreach(@port)
{
print $_;
}

root@--:~/gobi# ./run.pl 192.168.29.2
Found on 6@192.168.0.200
Found on 10@192.168.0.204

I'm doing some reverse mapping also using simple snmp queries like
@ip2arp_tbl = `snmpwalk -c "public" -v 2c 192.168.0.99 "ip.ipNetToMediaTable.ipNetToMediaEntry.ipNetToMediaPhysAddress"`; I'll give that in a different post if successful .

Mysql Ipaddress subnet wise search

2009-09-22T21:29:00.006+05:30

I was encountered to search mysql table with ip address based on subnetmask information. This was part of the netflow tools for our internal use. I exported the flow data from flow-export to mysql database. I created the database "ip address" as Text.The built-in mysql function makes life easy to search the table.

According to Mysql ref: if an ip is 209.207.224.40
The generated number is always in network byte order. For the example just shown, the number is calculated as 209×(256^3) + 207×(256^2) + 224×256 + 40.

To search subnet we need add relevant no # host data to the search.
for example to search 216.239.60.0/23
i need to convert the network detail to number - 3639557120
since /23 i need to add 512 to the network figure so 3639557632
Then if i could write the query .. like this works fine..


mysql> select dstaddr ,dpkts,srcaddr,srcport,dstport  from Raw1253672304  where INET_ATON(dstaddr) > 3639557120 and INET_ATON(dstaddr) <>



May be there can be easy way.

DDOS protection using iptables (recent module)

2009-08-02T19:16:00.006+05:30

This article related to iptable recent module. which can be used to defend against the DDOS attack. This setup tested in bridged mode.
Recent working with DDOS mitigation for one of the customer had give some interesting capabilities "recent module" of iptables.
One of the website came under attack with extensive sync and "GET" request from distributed zombies. we could identify around 4000 - 5000 unique hosts.
to define the attack pattern we have captured some traffic it had only sync and GET request nothing else to define the pattern. therefore I've conceptualized if the one host create more than 20 session during 100 seconds drop the packet.


iptables -I FORWARD -p tcp --dport 80 -i bridge0 -m state --state NEW -m recent --set
iptables -I FORWARD -p tcp --dport 80 -i bridge0 -m state --state NEW -m recent --update --seconds 100 --hitcount 20 -j DROP

Initially i applied these rules but no traffic reduction. When i checked the source code


static unsigned int ip_list_tot = 100;
 static unsigned int ip_pkt_list_tot = 20;

(http://www.il.is.s.u-tokyo.ac.jp/lxr-xp/source/net/netfilter/xt_recent.c)
Therefore only 100 unique source ips can be in the list. this was not capable to handle more then 4000 hosts.
Therefore i've removed module and changed the default value.


iptables -F
rmmod xt_recent
modprobe ipt_recent ip_list_tot=5000 ip_pkt_list_tot=100

reapplied the rules that filtered the massive traffic. when i'm writing this post still the attack is going on :( . But still the web sever able to handle the load :)

GNS3 Lab for Framerelay over ISIS

2009-05-23T11:56:00.003+05:30

Here i've shared the GNS3 files for CCNP BSCI lab.

LINK:
http://ifile.it/vz0h8gx

Experience vs Knowledge Trouble shooting ~

2009-05-23T09:48:00.002+05:30

Have to face some situation, something physically goes wrong or somebody else screw up your network. This kind of scenario your knowledge will give you confidence but knowledge sometime unable to provide the answer. Something I've learned from the faults and mistakes.

1) Don't panic. When you feel the pressure you are unable to concentrate.
2) Use the tools you have in your hand. ( Trace route, looking glasses, ping , etc...)
3) Isolate the problem. In this step people try to correlate with existing experience !! sometime the prediction is correct some time utterly wrong.
4) Try to contact the right person, provide the correct detail. Persuade the people to work for you is really hard thing. sometime they also bound to some contract that makes that you can get help from them. have some good relationship. Thank them when the problem is resolved. Until they understand they won't put their heart !

5) Hope for the best ! :)

Mikrotik Hierachical Queue

2009-04-21T20:23:00.009+05:30

This particular setup to provide guaranteed bandwidth for Mail traffic. I archived through Queue tree because we can archive most complicated queuing structure through queue tree and pcq.

This is a simple setup:
1) Need to mark the relevant connection andpackets.
This can be a ip firewall address list / src address or port number this is depend on your requirements.
2) Define parent queue and child queues.

1)Mark the connection for mail traffic:
chain=prerouting action=mark-connection new-connection-mark=mail passthrough=yes src-address=10.10.10.3

chain=prerouting action=mark-packet new-packet-mark=mail-packet passthrough=no connection-mark=mail

chain=prerouting action=mark-packet new-packet-mark=others passthrough=yes packet-mark=!mail
(please note the ! sign)

2) create relevant queues and apply it.

3 name="Parent" parent=ether3 packet-mark="" limit-at=0 queue=default priority=8 max-limit=1024000 burst-limit=0
burst-threshold=0 burst-time=0s

4 name="Mail" parent=Parent packet-mark=mail limit-at=256000 queue=default priority=8 max-limit=1024000 burst-limit=0
burst-threshold=0 burst-time=0s

5 name="queue1" parent=Parent packet-mark=others limit-at=768000 queue=default priority=8 max-limit=1024000

This particular queuing strategy will satisfy the above requirements. You can identify the particular traffic using different parameters :)

hierarchical queuing on Cisco

2009-04-08T11:05:00.006+05:30

Recently i tested on assigning different bandwidth requirement for number of users. Example setup is showed in the following diagram. 512kbps is divided between users and one user can use whole bandwidth when others are not using.I've done some testing on this and i archived the requirement through hierarchical queuing strategy.

1) I setup the natting / and other basic setup-


ip route 0.0.0.0 0.0.0.0 10.0.0.2
ip nat inside source list 2 interface FastEthernet0/0 overload
access-list 2 permit 192.168.2.0 0.0.0.255
ip nat outside
ip nat inside

2) Define the class-maps.

2.1 - Access-list for match the ips.


access-list 101 permit ip host 192.168.2.1 any
access-list 101 permit ip any host 192.168.2.1
access-list 102 permit ip host 192.168.2.2 any
access-list 102 permit ip any host 192.168.2.2
access-list 103 permit ip host 192.168.2.3 any
access-list 103 permit ip any host 192.168.2.3

2.2 - match ACL.


class-map match-all shape256_pir256_HostA
match access-group 101
class-map match-all shape64_pir64_HostB
match access-group 102
class-map match-all shape128_pir512_HostC
match access-group 103

3) queues ..
3.1 - Define the parent shaper.


policy-map shape_512
class class-default
shape average 512000
service-policy shapeinside

3.2 - child queues


policy-map shapeinside
class shape256_pir256_HostA
bandwidth 256
police rate 256000 bps burst 32000 bytes
class shape64_pir64_HostB
bandwidth 64
police rate 64000 bps burst 32000 bytes

4) Apply it on the interface


interface FastEthernet0/1
ip address 192.168.2.1 255.255.255.0
ip nat inside
duplex auto
speed auto
service-policy output shape_512

My test result showed the bandwidth guaranteed for the HOST A,B if those are not using HOST C can utilize that's the reason i did not put any shape in the child.

Design Check List for Time Series Forcasting with Neural Network

2008-03-16T22:28:00.003+05:30

Designing Neural Network Architecture is an Art not an expert routine. Therefore when designing is based on the trial and error or experience of the developer.
One useful design Neural networks are used in this Time Series Forecasting.
This review gives some basic steps: (Ref: "Computational Intelligence in Time Series Forecasting" chap 3- Neural Network Approach )

Data Preparation:-
Acquisition, Preprocessing , Normalization and structuring of Data.
Determination of training and test datasets.

Network Architecture Determination:-

Type of network
Number of input, output nodes
Number of layers
Number of neurons within the layers
Interconnection between the neurons
Selection of neuron activation function
design of the training strategy
training algorithm , performance index , training monitoring approch.

Network analyzer for mobile device

2007-09-15T22:46:00.000+05:30

Most of this explanation for network analyzer for the mobile device.
When we are closing the "X" button on a windows mobile 6 C# application.
Its not closing that is the reason we couldn't remove the dll from the memory. (specific to mobile network analyzer)
Actually its minimizing. therefore its necessary to set one property MinimizeBox to false.

http://msdn2.microsoft.com/en-us/library/system.windows.forms.form.mi...
says;
"Gets or sets a value indicating whether the Minimize button is
displayed in the caption bar of the form."
My understanding is it's not closing , but minimizing.

If we set the property, we can trigger one event when the form closes,
MainForm_Closing(object sender, CancelEventArgs e)
then we can check the user preference and if the user does not need to
save we can set the
e.Cancel = false; //good bye.

2007-09-06T08:19:00.000+05:30

#include "cc352.h"
#include <netinet/tcp.h>

int main(int argc, char **argv)
{
int fd; //socket descriptor
int sndbuff = 32*1024; //send buffer
int rcvbuff = 32*1024;
int error;//to hold the errocode

socklen_t len; // option len for getsock
//create the socket.
fd = socket(AF_INET,SOCK_STREAM,0);
//call the socket option
error = setsockopt(fd,SOL_SOCKET,
SO_SNDBUF,&sndbuff,
sizeof(sndbuff));
//setsockopt return 0 when it is ok -1 for error
if(error)
{
printf("Set sockopt fails!n");
return -1;
}
//set the rcv buffer.
error = setsockopt(fd,SOL_SOCKET,
SO_RCVBUF,&rcvbuff,
sizeof(rcvbuff));
if(error)
{
printf("Set socket option fail!n");
return -1;
}

//checking the values
error = getsockopt(fd,SOL_SOCKET,
SO_SNDBUF,&sndbuff,&len);

if(error)
{
printf("Get Socket option fails!n");
return -1;
}

error = getsockopt(fd,SOL_SOCKET,
SO_RCVBUF,&rcvbuff,&len);
if(error)
{
printf("Get Socket option fails!n");
return -1;
}
/*print the buffer sizes */
printf("Socket fd: %d n",fd);
printf("Send Buffer %d bytes n",sndbuff);
printf("Receive Buffer %d bytes n", rcvbuff);
return 0;
//any way kernel will decide the size.. so no way. myone says 65536::

}