Friday, September 21, 2012

ICMP Type and Code

Reference: http://livenudefrogs.com/~anubis/icmp/

ICMP Type and Code Numbers


Type    Name                                    Reference
----    -------------------------               ---------
  0     Echo Reply                               [RFC792]
  1     Unassigned                                  [JBP]
  2     Unassigned                                  [JBP]
  3     Destination Unreachable                  [RFC792]
  4     Source Quench                            [RFC792]
  5     Redirect                                 [RFC792]
  6     Alternate Host Address                      [JBP]
  7     Unassigned                                  [JBP]
  8     Echo                                     [RFC792]
  9     Router Advertisement                    [RFC1256]
 10     Router Selection                        [RFC1256]
 11     Time Exceeded                            [RFC792]
 12     Parameter Problem                        [RFC792]
 13     Timestamp                                [RFC792]
 14     Timestamp Reply                          [RFC792]
 15     Information Request                      [RFC792]
 16     Information Reply                        [RFC792]
 17     Address Mask Request                     [RFC950]
 18     Address Mask Reply                       [RFC950]
 19     Reserved (for Security)                    [Solo]
 20-29  Reserved (for Robustness Experiment)        [ZSu]
 30     Traceroute                              [RFC1393]
 31     Datagram Conversion Error               [RFC1475]
 32     Mobile Host Redirect              [David Johnson]
 33     IPv6 Where-Are-You                 [Bill Simpson]
 34     IPv6 I-Am-Here                     [Bill Simpson]
 35     Mobile Registration Request        [Bill Simpson]
 36     Mobile Registration Reply          [Bill Simpson]
 37-255 Reserved                                    [JBP]
 40     Authentication Failures                 [RFC2521]


Type Name Reference ---- ------------------------- --------- 0 Echo Reply [RFC792] Codes 0 No Code 1 Unassigned [JBP] 2 Unassigned [JBP] 3 Destination Unreachable [RFC792] Codes 0 Net Unreachable 1 Host Unreachable 2 Protocol Unreachable 3 Port Unreachable 4 Fragmentation Needed and Don't Fragment was Set 5 Source Route Failed 6 Destination Network Unknown 7 Destination Host Unknown 8 Source Host Isolated 9 Communication with Destination Network is Administratively Prohibited 10 Communication with Destination Host is Administratively Prohibited 11 Destination Network Unreachable for Type of Service 12 Destination Host Unreachable for Type of Service 13 Communication Administratively Prohibited 4 Source Quench [RFC792] Codes 0 No Code 5 Redirect [RFC792] Codes 0 Redirect Datagram for the Network (or subnet) 1 Redirect Datagram for the Host 2 Redirect Datagram for the Type of Service and Network 3 Redirect Datagram for the Type of Service and Host 6 Alternate Host Address [JBP] Codes 0 Alternate Address for Host 7 Unassigned [JBP] 8 Echo [RFC792] Codes 0 No Code 9 Router Advertisement [RFC1256] Codes 0 No Code 10 Router Selection [RFC1256] Codes 0 No Code 11 Time Exceeded [RFC792] Codes 0 Time to Live exceeded in Transit 1 Fragment Reassembly Time Exceeded 12 Parameter Problem [RFC792] Codes 0 Pointer indicates the error 1 Missing a Required Option [RFC1108] 2 Bad Length 13 Timestamp [RFC792] Codes 0 No Code 14 Timestamp Reply [RFC792] Codes 0 No Code 15 Information Request [RFC792] Codes 0 No Code 16 Information Reply [RFC792] Codes 0 No Code 17 Address Mask Request [RFC950] Codes 0 No Code 18 Address Mask Reply [RFC950] Codes 0 No Code 19 Reserved (for Security) [Solo] 20-29 Reserved (for Robustness Experiment) [ZSu] 30 Traceroute [RFC1393] 31 Datagram Conversion Error [RFC1475] 32 Mobile Host Redirect [David Johnson] 33 IPv6 Where-Are-You [Bill Simpson] 34 IPv6 I-Am-Here [Bill Simpson] 35 Mobile Registration Request [Bill Simpson] 36 Mobile Registration Reply [Bill Simpson]

Tuesday, August 7, 2012

The Differences Between Hubs, Switches, and Routers on the Network

Today most routers have become something of a Swiss Army knife, combining the features and functionality of a router and switch/hub into a single unit. So conversations regarding these devices can be a bit misleading — especially to someone new to computer networking.

The functions of a router, hub and a switch are all quite different from one another, even if at times they are all integrated into a single device. Let's start with the hub and the switch since these two devices have similar roles on the network. Each serves as a central connection for all of your network equipment and handles a data type known as frames. Frames carry your data. When a frame is received, it is amplified and then transmitted on to the port of the destination PC. The big difference between these two devices is in the method in which frames are being delivered.

In a hub, a frame is passed along or "broadcast" to every one of its ports. It doesn't matter that the frame is only destined for one port. The hub has no way of distinguishing which port a frame should be sent to. Passing it along to every port ensures that it will reach its intended destination. This places a lot of traffic on the network and can lead to poor network response times.

Additionally, a 10/100Mbps hub must share its bandwidth with each and every one of its ports. So when only one PC is broadcasting, it will have access to the maximum available bandwidth. If, however, multiple PCs are broadcasting, then that bandwidth will need to be divided among all of those systems, which will degrade performance.

A switch, however, keeps a record of the MAC addresses of all the devices connected to it. With this information, a switch can identify which system is sitting on which port. So when a frame is received, it knows exactly which port to send it to, without significantly increasing network response times. And, unlike a hub, a 10/100Mbps switch will allocate a full 10/100Mbps to each of its ports. So regardless of the number of PCs transmitting, users will always have access to the maximum amount of bandwidth. It's for these reasons why a switch is considered to be a much better choice then a hub.

Routers are completely different devices. Where a hub or switch is concerned with transmitting frames, a router's job, as its name implies, is to route packets to other networks until that packet ultimately reaches its destination. One of the key features of a packet is that it not only contains data, but the destination address of where it's going.

A router is typically connected to at least two networks, commonly two Local Area Networks (LANs) or Wide Area Networks (WAN) or a LAN and its ISP's network . for example, your PC or workgroup and EarthLink. Routers are located at gateways, the places where two or more networks connect. Using headers and forwarding tables, routers determine the best path for forwarding the packets. Router use protocols such as ICMP to communicate with each other and configure the best route between any two hosts.

Today, a wide variety of services are integrated into most broadband routers. A router will typically include a 4 - 8 port Ethernet switch (or hub) and a Network Address Translator (NAT). In addition, they usually include a Dynamic Host Configuration Protocol (DHCP) server, Domain Name Service (DNS) proxy server and a hardware firewall to protect the LAN from malicious intrusion from the Internet.

All routers have a WAN Port that connects to a DSL or cable modem for broadband Internet service and the integrated switch allows users to easily create a LAN. This allows all the PCs on the LAN to have access to the Internet and Windows file and printer sharing services.

Some routers have a single WAN port and a single LAN port and are designed to connect an existing LAN hub or switch to a WAN. Ethernet switches and hubs can be connected to a router with multiple PC ports to expand a LAN. Depending on the capabilities (kinds of available ports) of the router and the switches or hubs, the connection between the router and switches/hubs may require either straight-thru or crossover (null-modem) cables. Some routers even have USB ports, and more commonly, wireless access points built into them.

Some of the more high-end or business class routers will also incorporate a serial port that can be connected to an external dial-up modem, which is useful as a backup in the event that the primary broadband connection goes down, as well as a built in LAN printer server and printer port.

Besides the inherent protection features provided by the NAT, many routers will also have a built-in, configurable, hardware-based firewall. Firewall capabilities can range from the very basic to quite sophisticated devices. Among the capabilities found on leading routers are those that permit configuring TCP/UDP ports for games, chat services, and the like, on the LAN behind the firewall.

So, in short, a hub glues together an Ethernet network segment, a switch can connect multiple Ethernet segments more efficiently and a router can do those functions plus route TCP/IP packets between multiple LANs and/or WANs; and much more of course.

Monday, July 30, 2012

Linux - ipv6 Commands

To Verify if ipv6 is running
~~~~~~~~~~~~~~~~~~

[kanbaras@adprobot ipv6]$ cat /proc/net/if_inet6
00000000000000000000000000000001 01 80 10 80       lo
fe80000000000000e61f13fffe68411c 03 40 20 80     eth0

To View the ipv6 route
~~~~~~~~~~~~~~~~
netstat -r -6

or

[kanbaras@adprobot ipv6]$ route -A inet6
Kernel IPv6 routing table
Destination                                 Next Hop                                Flags Metric Ref    Use Iface
fe80::/64                                   *                                       U     256    0        0 eth0
localhost6.localdomain6/128                 *                                       U     0      5188       1 lo
fe80::e61f:13ff:fe68:411c/128               *                                       U     0      0        1 lo
ff00::/8                                    *                                       U     256    0        0 eth0

To ipv6 Ping in linux
~~~~~~~~~~~~~~

kanbaras@adprobot ipv6]$ ping6 ::1
PING ::1(::1) 56 data bytes
64 bytes from ::1: icmp_seq=1 ttl=64 time=0.020 ms
64 bytes from ::1: icmp_seq=2 ttl=64 time=0.027 ms
64 bytes from ::1: icmp_seq=3 ttl=64 time=0.016 ms
64 bytes from ::1: icmp_seq=4 ttl=64 time=0.015 ms
64 bytes from ::1: icmp_seq=5 ttl=64 time=0.014 ms
64 bytes from ::1: icmp_seq=6 ttl=64 time=0.015 ms

To Configure a server load balancer
~~~~~~~~~~~~~~~~~~~~~~~~

load balancer like SI-ADX - DUT3
~~~~~~~~~~~~~~~~~~~~~~~
server real rs1 2002::606:601
 port http
 port http url "HEAD /"
 port telnet        
       

server virtual vs1 2002::505:503
 port http
 port telnet
 bind http rs1 http
 bind telnet rs1 telnet

ip route 172.26.50.0 255.255.255.0 172.26.64.1
ip route 10.37.54.0 255.255.255.0 172.26.64.1

interface ethernet 1
 ipv6 address 2002::505:502/120

interface ethernet 16
 ipv6 address 2002::606:602/120

 DUT2
 ~~~~
 172.26.64.250 7011

 int eth 24
 enable


 int eth 2
 enable


 DUT4
 ~~~~
  172.26.64.250 7012

 int eth 23
 enable


 int eth 24
 enable

 PC1
 ~~~
 ifconfig eth1 up
 ifconfig eth1:1 inet6 add 2002::0505:0501/120 up
 route -A inet6 add 2002::0606:0600/120 gw 2002::0505:0502

 PC2
 ~~~~
 ifconfig eth1 up
 ifconfig eth1:1 inet6 add 2002::0606:0601/120 up
 route -A inet6 add 2002::0505:0500/120 gw 2002::0606:0602 dev eth1

 service httpd restart


Wednesday, July 25, 2012

Simplest method of transferring a file from one linux PC to another using SCP

The simplest example of an scp command is given below

Syntax
~~~~~
scp <filename> <username@ipaddress>:/<path for the destination>

eg:

scp ASR12500b119.bin root@172.26.64.146:/var/lib/tftpboot

In the next step you will have to supply the password of the destination machine and then you will get some thing like this if the transfer is complete.

[a@CHN-A11-144 tftpboot]$ scp ASR12500e079.bin root@172.26.64.144:/var/lib/tftpboot
The authenticity of host '172.26.64.144 (172.26.64.144)' can't be established.
RSA key fingerprint is 14:bb:29:4c:62:3d:d2:95:d6:e3:17:00:ee:25:72:e8.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.26.64.144' (RSA) to the list of known hosts.
root@172.26.64.144's password:
ASR12500e079.bin                                   100%   30MB  29.9MB/s   00:00
 

Tuesday, July 10, 2012

How To Configure A Server Load Balancer For Testing With Traffic


What does a server load balancer do?
When  too many users access a particular web site, the server gets overloaded. In order to get rid of this problem a server load balancer is used.


All requests for a Web site arrives at the load balancer that then passes the request to one of the available servers. A load balancer can find out from the servers which one is least loaded, so all of them are doing an equal amount of work.

Internals of a server load balancer

SLB software establishes a virtual server that acts as a front end to physical servers, distributing user service requests among active real servers. SLB packet processing is based on the Network Address Translation (NAT) method. Packets received by the virtual server IP address are translated into the real physical IP address based on the configured distribution metric (for example, “round robin”) and sent to a real server. Packets returned by the real server for the end user are translated by SLB so that the source address is that of the virtual server instead of the real server. NAT is performed for both directions of the traffic flow. Converting virtual services to real services requires IP and TCP checksum modifications.



The server load balancing (SLB) requires associations between the application servers (real
servers) and the virtual server (VIP). The associations are done by binding TCP or UDP ports on the
real servers with TCP or UDP ports on the virtual server. When a client sends a TCP or UDP request
to an application port defined under the virtual server, then the ServerIron identifies one of the
back-end application servers based on the configured load balancing method and forwards the
client request to it. The client is completely unaware of this traffic distribution, but observes
increased availability, faster response time and better throughput. The ServerIron can be
configured to host multiple application services such as web (http), ftp, or DNS under a single
virtual server.


Configurations
~~~~~~~~~~

-----------              -------                     -----------------------             ---------            -----------

Client PC    ------- Router 1------------ Server Load Balancer---------Router 2---------Server PC

-----------              --------                    ------------------------           ----------          -------------

 
The load balancer should be configured with a real server and a virtual server and ports are created under each of them and the real and virtual server ports are bound to each other. Let us say, left side of the load balancer is kept in 1.1.1.0 network and right side in 2.2.2.0 network.

Load balancer Config:
~~~~~~~~~~~~~~~~

interface ethernet 1
 ip address 1.1.1.2 255.255.255.0
!
interface ethernet 16
 ip address 2.2.2.1 255.255.255.0

                interface ethernet 1
                enable
                ip add 1.1.1.2/24
                exit
                int eth 16
                enable
                ip add 2.2.2.1/24
                exit
                server real rs1 2.2.2.2
                port http
                port telnet
                server virtual vs1 1.1.1.4
                port http
                bind http rs1 http

Router 1 and Router 2:
~~~~~~~~~~~~~~~
Enable the  connected ethernet ports and make sure they are up

Client PC
~~~~~~~
 ifconfig eth1 1.1.1.1/24 up               
route add -net 2.2.2.0 netmask 255.255.255.0 gw 1.1.1.2


Server PC
~~~~~~~
ifconfig eth1 2.2.2.2/24 up
route add -net 1.1.1.0 netmask 255.255.255.0 gw  2.2.2.1


TESTING
~~~~~~~

Now send traffic from the client pc to the virtual server's ip (1.1.1.4) using any of the tools listed (Apache bench or Curl). (show server bind in SLB should be Active)

curl http://1.1.1.4
ab -n 10 http://1.1.1.4/


In the load balancer, sessions are created and the transmit and receive packets  are incremented



Friday, June 22, 2012

vi Search and Replace Commands

Press escape and then...

  Search STRING forward :   / STRING.
  Search STRING backward:   ? STRING.


  Repeat search:   n
  Repeat search in opposite direction:  N  (SHIFT-n)


Replace OLD with NEW:

 First occurrence on current line:      :s/OLD/NEW
 
 Globally (all) on current line:        :s/OLD/NEW/g

 Between two lines #,#:                 :#,#s/OLD/NEW/g
 
 Every occurrence in file:              :%s/OLD/NEW/g

Friday, May 11, 2012

TFTP Issues

We can copy the image files, startup-config, running config, ssl keys etc between a device and a tftp server(linux PC). Several issues might pop up while doing so. Some of them are discussed with the resolution.
1. Problem:
"Error code 1: File not found"
This is a common error obtained when ever we try to tftp a file to the server from a device(switch/router)
Resolution:
Create a file with the same name (the one you will be issuing in the tftp command) in the linux PC using
cd /var/lib/tftpboot
touch <filename>
2. Problem:
'Error Code 0' message (Permission Denied)

Resolution:
This error is obtained due to the permission issue in the tftp server. We will have to change the permission of the file to 777 and chown the file to the current user.
chmod 777


3. Problem:
'Error Code 0' message (Permission Denied)
The above error might persist even after changing the permissions. In that case it might be due to the selinux issue.

Resolution:
The resolution for this issue would be to issue the following command in the PC.
echo 0 > /selinux/enforce
and check if the content of "/selinux/enforce" shows 0

4. Problem
Even after trying all the above resolutions if there is an issue with copying files then try the following:-

Resolution:
Check the content of "/etc/xinetd.d/tftp" file. The server_args should be as follows.
server_args = -s /var/lib/tftpboot
Now the tftp server is ready to go

Friday, January 13, 2012

Linux Commands


From windows machine you connect to linux PC using telnet or ssh via putty.
You must login using your credentials.

Create Directory:
mkdir <dir name>

Change Directory Path
cd <dir name>

Create a File
Reach the particular directory under which you want to create a file and then issue this command
vi <file name>

While coming our of the file isuue :wq to save the changes and come out
Issue :q! to come out without saving the changes

Delete File
rm <file name>

Delete Directory
rmdir <dir name>
Note that there should be no files under the directory for it to be deleted using this command

List
ls -lrt

Search
To search for a pattern of a file name, issue this command under the required directory

ls *<pattern>*

To search for a file containing a particular content pattern issue this command under the required directory

grep <pattern> *

To search for a file containing a pattern recursively from a directory (if you dont know in which directory the file would be present

find . | xargs grep "pattern"

Other useful linux commands:-
~~~~~~~~~~~~~~~~~~~~~~

To kill a process:-

ps -ef  | grep <process name>
process id will be displayed.
Then kill the process using the command
kill <pid>

We can also kill  the process in a single line:-
pkill <processName>


To Enable different services for different protocols
~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  1. FTP - vsftpd
service vsftpd start

2. TELNET - xinetd


service xinetd start

3. SMTP - send mail
4. HTTP - httpd

service httpd start

5. RADIUS - radiusd

service radiusd start

6. DNS - named
service named start

7. IMAP4 - xinetd
service xinetd start

8. MMS -
9. LDAP - ldap
service ldap start

10. RTSP

Ports and Port Numbers
~~~~~~~~~~~~~~~~~~~~
 1. FTP - 21
2. TELNET - 23
3. SMTP - 25
4. HTTP - 80
5. RADIUS - 1812
6. DNS - 53
7. IMAP4 - 143
8. MMS - 1755
9. LDAP - 389
10. RTSP - 554

Command to send fragmented icmp traffic
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ping 172.26.64.213 -c 3 -s 2000


-c - count
-s - size

Command to drop SYN packets in the lnux PC using ip tables
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

iptables -A INPUT --protocol tcp --tcp-flags ALL SYN -j DROP

To flush the iptables
~~~~~~~~~~~~~~
iptables -F

Command to test with tethereal

tethereal -i eth1 tcp &

Command to unconfigure or flush an Ethernet interface ip in linux

ip addr flush eth1


ip addr del eth1 <ip>

Thursday, January 12, 2012

Testing SNMP Traps

If you are testing the snmp traps from a DUT to the linux PC then the following steps can be followed.

STEP 1 : Configure the snmp server in the DUT with the ip of the linux PC

eg:
snmp-server host 10.24.134.55 version v1

STEP 2 : Start the SNMP service in the linux PC

eg:
/etc/rc.d/init.d/snmpd start

STEP 3 : Issue "snmptrapd -f -Le" command to capture the traps in PC. If you are automating the
steps then log the traps in a file

eg: snmptrapd -f -Lf /var/log/trap.log

STEP 4 : Disable and then enable eth1 or any interface of your DUT to generate traps

eg: (config)#interface eth 1
(config-if-e1000-1)#enable
(config-if-e1000-1)#disable
(config-if-e1000-1)#enable

STEP 5 : Verify if the traps are logged

eg: tail -l /var/log/trap.log
STEP 6: Stop the snmp service

eg: /etc/rc.d/init.d/snmpd stop

Problems you might encounter:

1. If you get the following message in the PC

Warning: no access control information configured.^M
This receiver will *NOT* accept any incoming notifications.^M
NET-SNMP version 5.4.2.1

then you will have to change the file called /etc/snmp/snmptrapd.conf
Add this line to the snmptrapd.conf file

disableAuthorization yes
For details see the link:

http://forums.fedoraforum.org/archive/index.php/t-159234.html

2. If you get an error :-

couldn't open udp:162 -- errno 98 ("Address already in use")

then you will have to kill the snmptrapd process that is running.

ps -ef | grep snmptrapd
kill <pid>

or

pkill snmptrapd

How To Check If 2 IP Addresses Fall On The Same Subnet

This can be explained with an example :

137.157.7.65 - 1st ip
137.157.10.3 - 2nd ip
 255.255.252.0 - subnet mask

STEP 1 : Convert 1st ip to binary
137.157.7.65     10001001.10011101.00000111.01000001
255.255.252.0   11111111.11111111.11111100.00000000

STEP 2: Find the network address by copying all the binary digits as is if the mask is 1 and 0 if the mask is 0
10001001.10011101.00000100.00000000
137.157.4.0 - Net address

STEP 3: Convert the second address to binary
137.157.10.3     10001001.10011101.00001010.00000011
255.255.252.0   11111111.11111111.11111100.00000000

STEP 4 : Find network address of the second ip
10001001.10011101.00001000.00000000
137.157.8.0 - Net address

STEP 5: Compare the 2 network addresses
137.157.4.0 ====137.157.8.0 ----> They are not equal. Therefore they are in different subnet

Sunday, January 8, 2012

CVS

1. Command to add a directory or file

mkdir <newdir>
cvs add <newdir>
 
To add a file

cvs add newfile
cvs commit newfile

2. Command to check the status of the files - (Locally modified or up to date)
cvs status <filename/Directory name>

3. Command to incorporate your changes into the repository
 cvs commit.

4. Editing files is easy - once you have local copies, just edit them. None of your changes will be visible to other users until after you've committed them.
If you mess up a local copy of a file, starting over is easy. Delete the file using

rm <filename>, and use

 cvs update to get a fresh copy from the repository.



5. If you want all your files to be updated without considering your locally modified changes then grep for locally modified files and then delete them and then do a cvs update to get the latest files from the stream.

Command to find the list of locally modified files


cvs -q status <folder name> | grep -i locally

Command to refresh local copies
cvs checkout and cvs update -d are more or less equivalent.

Other Usefule Commands

cvs diff filenameShows differences between your local copy of filename and the repository version that filename was based on.
cvs diff -r 1.2 filenameShows differences between your local copy of filename and version 1.2 of filename.
cvs diff -r 1.2 -r 1.3 filenameShows differences between versions 1.2 and 1.3. (regardless of what version your local copy is).
cvs log filenameShow the commit log for filename (like rlog does with rcs).
cvs annotate filenameShows each line of filename, prefixed with the version number where the line was added, and the name of the person who added it. Useful for seeing who made a particular set of changes.