netwyman

Routing Protocols - Define Top Network Routing Protocols

2021-09-16T16:58:00.000+05:30

Routing is a process in which the layer 3 devices (either router or layer 3 switch) finds the optimal path to deliver a packet from one network to another. Dynamic routing protocols uses metric, cost and hop count to identify the best path from the path available for destination network.

Below are the types of Routing Protocol:

- Distance Vector Routing Protocol
RIP
IGRP
- Link State Routing Protocol
OSPF
IS-IS
- Advanced Distance vector routing protocol
EIGRP

Distance Vector Routing Protocol:

Distance vector protocols usually send the complete routing table to each neighbor (a neighbor is directly connected router that runs the same routing protocol). They employ some version of Bellman-Ford algorithm to calculate the best routes. Compared with link state routing protocols.

Distance vector protocols are easier to configure and require little management, but are susceptible to routing loops and converge slower than the link state routing protocols. Distance vector protocols also use more bandwidth because they send complete routing table, while the link state protocol send specific updates only when topology changes occur.

Distance vector protocol selects best path in the basis of hop counts to reach a destination network in a specific way. The path will the least hop count will be chosen as best path.

Link State Routing Protocol:

Link state routing protocols are the second type of routing protocols. They have the same basic purpose as distance vector protocols, to find a best path to a destination, but use different methods to do so. Unlike distance vector protocols, link state protocols don’t advertise the entire routing table. Instead, they advertise information about a network topology (directly connected links, neighboring routers…), so that in the end all routers running a link state protocol have the same topology database.

Link state routing protocols converge much faster than distance vector routing protocols, support classless routing, send updates using multicast addresses and use triggered routing updates. They also require more router CPU and memory usage than distance-vector routing protocols and can be harder to configure.

The Link State Routing protocol also known as SPF – Shortest Path First protocol

The main thing is need to understand about the Link routing as an Each router running a link state routing protocol creates three different tables:

neighbor table – the table of neighboring routers running the same link state routing protocol.
topology table – the table that stores the topology of the entire network.
routing table – the table that stores the best routes.

Shortest Path First algorithm is used to calculate the best route. OSPF and IS-IS are examples of link state routing protocols.

Advance Distance Vector Routing Protocol:

This is also known as hybrid routing protocol which uses the concept of both the Distance Vector and Link State Routing protocols.

EIGRP as Enhanced Interior Gateway Routing Protocol is an example of this routing protocol. EIGRP acts as a link state routing protocol as it uses the concept for neighbor discovery also the EIGRP acts as distance vector routing protocol as it leaned routes from directly connected neighbors.

Network Security Tools You Should Use, as per the experts

2021-07-01T10:45:00.000+05:30

Securing a network looks like overwhelming. the globe of Security may be complex. Network security tools assist in securing to your monitoring IT environment.

The more tools an InfoSec professional has got to work with, the higher they'll be ready to address the task at hand. Accessing to a large range of electronic network security software is simply the beginning. Knowing the way to put them to use is that the essence of network protection.

New security threats seemingly appear daily. The progressive nature of those attacks requires dynamic multi-point security solutions. it is critical by the administrators to quickly identify vulnerabilities to guard data security.

Encryption Tools

Tor

Tor tool has gained lots of press when people started talking about the “dark web” some years back. The dark web clothed to not be as scary as urban legends made it dead set be. It is simply looks like a tool to make sure privacy on the web. The system get routes requests to proxy web servers for privacy, making users harder to trace. Although there are malicious exit nodes accustomed sniff traffic, this isn’t a big concern with careful use. This applications in InfoSec are more plentiful than its applications in cybercrime.

KeePass

Used in identity management, KeePass may be a necessity for several office settings. an easy password management system. KeePass allowing to each users to access all of their accounts with single password. Combining convenience with security purpose, tool lets users set unique passwords for various accounts with an auto-fill function when typing within the master password. people who have dealt in InfoSec for quite daily know the way important this could be. Sometimes it happens and face security issue just comes right down to bad password management. KeePass helps network security officers manage the human element of the duty.

TrueCrypt

TrueCrypt remains always popular despite with having gone years and without any of updates. Abandoned by its developer in 2014, It is technically outdated, yet still a powerful tool. A disk encryption system, This tool allows for specifically layered content encryption with two tiers of access control. Free, powerful, open software. It’s easy to work out why TrueCrypt remains popular despite not having been updated in four years. one in all the simplest open source security programs available.

Tools of Web Vulnerability

Burp Suit

A powerful tool for network protection. Burp Suite may be a real-time network security scanner designed to spot critical weaknesses. Burp Suite will determine how cybersecurity threats might invade a network via a simulated attack. The suite is out there in three versions: Community, Professional, and Enterprise. Professional and Enterprise are paid application testing tools, including the online vulnerability scanner. The Community version is free but severely limited. Community includes only the essential manual tools. Burp Suite could be a potent tool for businesses, but perhaps pricey for smaller organizations. Still, a critical application security testing tool.

Nikto

One of the most effective open-source vulnerability scanner management tools. Nikto will scan web servers and networks for matches with a database of over 6400 threats. Although the network protection software itself has not been updated in it slow, it's still up up to now. this can be because the threat database is frequently updated. There are countless plugins being released and continuously updated. for several security professionals, Nikto may be a cornerstone of the vulnerability assessment routine.

It is totally java-based web proxy Paros Proxy includes several useful tools for running security tests. These include an online spider, traffic recorder, and vulnerability scanner kind of stuffs. Excellent for detecting network intrusion openings to kind of the foremost common threats, including detecting SQL injection attacks and cross-site scripting.

Paros Proxy

It is totally easy to edit and update with even rudimentary Java or HTTP/HTTPS knowledge. Anyone who can write an online application can edit Paros Proxy. an attractive network protection software testing tool for identifying a security risk before it becomes a security breach.

Nmap

The all companies looking for to improved access of potential weak spots in their network can use this free open source monitoring tool. it's been designed to produce an in depth take a look at every network. Including indicating hosts, what services are being provided at each host, what sorts of packet filters are in use and other features.

Nmap also includes a debugging tool for all major platforms and will be accustomed scan one network at a time or multiple networks directly. The network security tool is supposed to be user-friendly and will be easily customized.

Nessus

For all the days that your organization may have improperly configured security settings or put within the wrong patch, this software corrects mistakes and improves the integrity of your networks.

Nessus always identifies and repair those detected vulnerabilities, it includes missing or incomplete patches; software bugs; or other general misconfigurations throughout applications, devices, and respected operating systems.

Along with the professional version, admins/security experts can consider a free open source scanner that appears for possible exploits. One advantage of these service is daily database updates things. Current information about those threats and patches are always available. It also just doesn’t check to work out if version numbers match, but programs do what they’re presupposed to. Users can access a spread of security plug-ins further as develop their own and scan individual computers further as networks.

It is available for Unix and Linux based systems, there is also a couple of Win32 GUI client that works with Windows products. In-order users pay an annual subscription to utilize all its services. Nessus is employed by over 24,000 companies worldwide and claims to possess rock bottom false positive rate among its competitors, plus offers access to quite 100,000 security plug-ins that are regularly updated.

Discuss about Best practices of Mail server IP reputations

2021-06-15T11:36:00.002+05:30

Ever wondered why your immediate response intended message wasn't replied in time, or not replied at all?

Everyone would have faced email delivery issues from time to time – like messages delivered to Spam directory or rejected/bounced back thanks to the amount of reasons. whether or not bounced back, we'd have left out it. Causing Mail delivery a large number for normal users and a nightmare for admins. Let’s determine the way to prevent our messages ending up within the Spam folder of recipients.

Things to notice as a Server Administrator

Pre check : Requirements for server setup:

The Outgoing IP ( of the Mail server ) should be with a decent reputation from day one. But the information centres ( by mistake or because of negligence ) might deliver Blacklisted IPs to new servers. So, it’s knowing ask them to produce a Clean IP with the order. Also, ask them to feature rDNS value for the Mail sending IP, preferably to server hostname .

A secondary IP for post can be beneficial . Since most RBLs don't allow One-Click delisting, A secondary IP are going to be handy to travel on the post, if the Mail IP got blacklisted. Still, this could not be a permanent change as stopping spamming should be more important. Also, keep one's hands off from TLDs with very bad reputation ( like .loan , .tk ) historically and use a well-liked TLD ( like .com , .org , .net ) to own a decent reputation.

There are various methods to detect an ongoing Spam activity and limit it, within the server.

1. Mail limit alerts:

Most providers ( like Plesk, CPanel ) have an choice to set ‘Number of emails (per hour)’ which can stop further processing of emails from the corresponding domain when the limit is reached. it'll also send a notification to the Server Admin’s email address. Then, manual checking of the server logs and live transactions are needed to spot the spammer.

With the free Configserver Firewall & Login Failure Daemon (https://configserver.com/cp/csf.html), website scripts alerts ( like Local relay Alert, Script Alert ) and login alerts ( AuthRelay alert ) may also be set.

For Plesk servers powered by Windows OS and Mailenable, you'll use a script to observe the mail queues. ( like “SMTP Queue Overview Utility” at https://www.mailenable.com/addons_Diagnostic.asp )

2. External Monitors

Sometimes, all of the low number which are spams can get your server blacklisted. And you may never be notified by the above options.

For such cases, an external Blacklisting alert are often set, just like the RBLCheck plugin (https://netwyman.com/) . this may inquire major RBLs for your IP address on routine and provide you with a warning via email if any hits were yielded .

3. Mitigate Real-time Spamming:

There are not any specific rules, but these measures should help to mitigate an Ongoing spamming.

Check log for recent top senders and their messaging pattern ( like Subject, Recipient addresses, From Header value etc )

Check Mail delivery failures or regain messages received at the time.
Usually, Spam emails will have suspicious ‘Subject’ or are going to be sent to an inventory of users.

To stop spamming, reset the e-mail account’s password as soon as possible. Then, ensure to reload necessary services ( like Dovecot cache, Exim ) to finish any active login sessions. likewise the messages was sent by a PHP script, disable the script or parent directory as per required.

If an RBL provider blocks the IP, you ought to take immediate action to prevent the spamming activity and notify them. Also, make the clients adhere to mail policy of every recipient’s providers ( like GMail ) .

Those defined Modern control panels has options to automatically disable an email account when a spamming activity is detected, thus controlling spamming activity without manual intervention, like “Hold outgoing mail” in cPanel Tweaks. Please seek advice from the entire options available in cPanel for this at:

https://documentation.cpanel.net/display/74Docs/Tweak+Settings+-+Mail

CPU Stress for windows server - utility

2021-06-11T10:39:00.003+05:30

CPU Stress

CPU Stress may be a utility which will be accustomed simulate CPU activity by running up to 64 threads during a tight loop.

Each thread will be started, paused or stopped independently and might be configured with the subsequent parameters:

Activity Level this will be Low, Medium, Busy or Maximum which controls how long the thread sleepss between cycles. Also set the mentioned value to Maximum causes the thread to run continuously.

Priority This controls the thread priority. see Windows Internals by Mark Russinovich for details on thread priorities

Runs on:

Client: Windows Vista and better
Server: Windows Server 2003 and better
Nano Server: 2016 and better

Link from windows you can refer:
The official updates and errata page for the definitive book on Windows internals.

Download Utility from below:
CPU Stress:

How to Use STRESS command in Linux/Ubuntu

2021-06-08T19:59:00.000+05:30

One can check CPU on Linux other subsystem. Instances within which this can be useful include those during which a computer user wishes to perform tuning activities, a kernel or libc programmer wishes to judge denial of service possibilities, test your systems entirely on high load and monitoring the health and more. this is often also useful for sysadmin, system builders, and overclockers who want to check their hardware under high load and monitor stability and thermal environment.

Stress Test CPU and Memory (VM) On a Linux / Unix

stress : it's a straightforward workload generator for POSIX systems. It imposes to be configurable number of CPU, memory, I/O, and disk stress on the system. it's written in C, and is free software licensed under the GPLv2. it's not a benchmark, but is very a tool designed

stress-ng : it's an updated version of stress tool and it'll check a server for the subsequent features:

CPU compute
Cache thrashing
Drive stress
I/O syncs
VM stress
Socket stressing
Context switching
Process creation and termination

It includes over 60 different stress tests, over 50 CPU specific stress tests that exercise floating point, integer, bit manipulation and control flow, over 20 computer storage stress tests.

This program is meant to be easy to use and recommended for brand spanking new sysadmins. The tool is thought to figure on x86 Linux and FreeBSD/OpenBSD, powerpc AIX and Linux, SPARC Solaris, Compaq Alpha Tru64 UNIX, and plenty of others.

Install stress package on a Linux
You can install stress as a part of the Linux or Unix distribution.

Just same as below Install stress on a CentOS, RHEL, and Fedora Linux

sudo yum install stress

As per below Install stress on a Debian and Ubuntu Linux

apt-get install stress

According to below step you can Install stress on a FreeBSD Unix system
Type the following pkg command to install the stress tool using binary method:

pkg install stress
## OR ##
pkg install sysutils/stress

Install stress on a OpenBSD Unix system
Type the following pkg_add command to install the stress tool using binary method:

## if installpath not set in  /etc/pkg.conf as follow ##
## installpath =   http://mirror.esc7.net/pub/OpenBSD/%c/packages/%a/ use ##
## PKG_PATH  ##
export PKG_PATH=http://ftp.usa.openbsd.org/pub/OpenBSD/`uname -r`/packages/`arch -s` 
pkg_add stress

How do I use stress tool on Linux?
First, note down the current system load averages by typing the following command:

# uptime

Next, run any one of the following command to see load on screen:

# watch uptime

OR you can use tload command:

# tload

The syntax is as follows:

stress [OPTION]
## Stress using CPU-bound task
stress -c 4
## Stress using IO-bound task 
stress -i 2

For example, a load average of four is imposed on the system by specifying two CPU-bound processes, one I/O-bound process, and one memory allocator process as follows:

# uptime # stress -c 2 -i 1 -m 1 --vm-bytes 128M -t 10s # uptime

stress [OPTION]
## Stress using CPU-bound task

stress -c 4
## Stress using IO-bound task
stress -i 2

For example, a load average of four is imposed on the system by specifying two CPU-bound processes, one I/O-bound process, and one memory allocator process as follows:

# uptime
# stress -c 2 -i 1 -m 1 --vm-bytes 128M -t 10s
# uptime

While,

-c 2 : Spawn two workers spinning on sqrt()
-i 1 : Spawn one worker spinning on sync()
-m 1 : Spawn one worker spinning on malloc()/free()
--vm-bytes 128M : Malloc 128MB per vm worker (default is 256MB)
-t 10s : Timeout after ten seconds
-v : Be verbose

Do You Know How to Install Ansible on 64-bit Ubuntu 14.04 server

2021-06-03T14:15:00.001+05:30

You just need to follow below steps:

Step 1: Install the software-properties-common package

$ sudo apt-get update && sudo apt-get install software-properties-common

Step 2: Add the Ansible repository to your system

$ sudo apt-add-repository ppa:ansible/ansible

Step 3: Install Ansible

$ sudo apt-get update && sudo apt-get install ansible

Configuring Ansible Hosts

Ansible keeps track of all of the servers that it knows about through a “hosts” file. We need to set up this file first before we can begin to communicate with our other computers.

Open the file with root privileges like this:

You will see a file that has a lot of example configurations, none of which will actually work for us since these hosts are made up. So to start, let’s comment out all of the lines in this file by adding a “#” before each line.

We will keep these examples in the file to help us with configuration if we want to implement more complex scenarios in the future.

Once all of the lines are commented out, we can begin adding our actual hosts.

The hosts file is fairly flexible and can be configured in a few different ways. The syntax we are going to use though looks something like this:

Example hosts file

The group_name is an organizational tag that lets you refer to any servers listed under it with one word. The alias is just a name to refer to that server.

So in our scenario, we are imagining that we have three servers we are going to control with Ansible. These servers are accessible from the Ansible droplet by typing:

You should not be prompted for a password if you have set this up correctly. We will assume that our droplets’ IP addresses are 172.0.12.1, 172.0.12.2, and 172.0.12.3. We will set this up so that we can refer to these individually as host1, host2, and host3, or as a group as droplets.

This is the block that we should add to our hosts file to accomplish this:

[droplets]
host1 ansible_ssh_host=172.0.12.1
host2 ansible_ssh_host=172.0.12.2
host3 ansible_ssh_host=172.0.10.3

Hosts can be in multiple groups and groups can configure parameters for all of their members. Let’s try this out now.

With our current settings, if we tried to connect to any of these hosts with Ansible, the command would fail (assuming you are not operating as the root user). This is because your SSH key is embedded for the root user on the remote systems and Ansible will by default try to connect as your current user. A connection attempt will get this error:

Ansible connection error

On my Ansible computer, I’m using a user called demo. Ansible will try to connect to each host with ssh demo@server. This will not work if the demo user is not on the remote system.

We can create a file that tells all of the servers in the “droplets” group to connect using the root user.

To do this, we will create a directory in the Ansible configuration structure called group_vars. Within this folder, we can create YAML-formatted files for each group we want to configure:

We can put our configuration in here. YAML files start with “—”, so make sure you don’t forget that part.

/etc/ansible/group_vars/droplets

Save and close this file when you are finished.

If you want to specify configuration details for every server, regardless of group association, you can put those details in a file at /etc/ansible/group_vars/all. Individual hosts can be configured by creating files under a directory at /etc/ansible/host_vars.

What is Load average? and what's good load average for Linux servers?

2021-05-31T20:02:00.000+05:30

If you're employing a Linux server, you're probably at home with the term load average/system load.

By time to time measuring of the load average is helpful to understanding how your servers are performing; if overloaded, Whenever you would like to kill or optimize the processes which consumes higher amount of resource, or provide more and more resources to balance the workload.

But how does one determine if your server has sufficient load capacity, and when do you have to be worried? Let's dive in and see.

What is a load average?

The load average is that the average system load on a Linux server for an outlined period of your time. In other words, it's the CPU demand of a server that features sum of the running and therefore the waiting threads.

Typically, the highest or the uptime command will provide the load average of your server with output that appears like:

These numbers are the averages of the system load over a period of 1, five, and quarter-hour.

Before stepping into the way to measure the load average output and what each of those values mean, let's get into the best example: a server with one core processor.

Breaking down the load

A server with one core processor is sort of a single line of consumers waiting to induce their items billed during a market. During peak hours, there's usually a protracted line and therefore the waiting time for each individual is additionally high.

If you are the cashier and wish to record the waiting time, one important metric would be the quantity of individuals waiting during a specific period of your time. If there aren't any customers waiting, then the wait time is zero. On the opposite hand, if there's a protracted line of shoppers, then the wait time is high.

After applying it to the load average output (0.5, 1.5, 3.0) that we got above:

0.5 means the minimum waiting time at the side of counter. Between 0.00 and 1.0, there's no must worry. Your servers are safe!
1.5 means the queue is filling up. If the typical gets any higher, things are visiting start slowing down.
3.00 means there is a considerably long queue waiting, and an additional resource/counter is required to clear up the queue faster.

What you would like may be a queue/load average value between 0.00 and 1.00. So can we conclude that the best load average is 1.00, and anything above that's an action call to troubleshoot? Well, although it is a safe bet, a more proactive approach is leaving some extra headroom to manage unexpected loads.

Multicores and multiprocessors to the rescue

Are one quad core processor and a server with four processors (with one core each) the same? Relatively, yes. the most difference between multicore and multiprocessor is that the previous refers to one CPU having multiple cores, while the latter refers to multiple CPUs. To sum up: one quad core is adequate to two dual cores which is adequate to four single cores.

The load average is relative to the amount of cores available within the server and not how they're detached over CPUs. this implies the most utilization range is 0-1 for one core, 0-2 for a dual core, 0-4 for a quad core, 0-8 for an octa-core, and so on.

Referring to the cashier example again, a load of 1.00 would mean the capacity is simply right one core processor; while on a dual core processor, a load of 1.50 would mean one line is filled up, and also the other line is filling up. Similarly, a load of 5.00 on a quad core processor are a few things to fret about, while on an octa-core processor, 5.00 is merely just filling up, and there's optimum space available.

Basic Docker Commands along with the information about Docker

2021-05-27T08:30:00.001+05:30

In previous blog we have discussed about Docker and the image of it. Today we are going to cover basic list of Docker commands with some basic information of it like why you need to use Docker? How do you use Docker? etc....

Docker:

'A unique and smart way to build apps’, as stated on its website, is an open-source platform for building apps and micro-services. The catch here is the automated deployment of your app in a container, by OS level virtualization provided by Dockers. Dockers are better than VMs as you can do away with the additional costs for maintaining and starting the latter. By deploying your app and its dependencies (i.e. the per-requisite apps for its proper functioning) in a container, your app becomes portable during all the phases of development and testing. Moreover, the isolated apps eliminate conflicts, enable team collaboration, and reduce the time-to-market.

When Do You Need to Use a Docker?

For Docker CI/CD during numerous development phases (dev/test/QA)

For replicating the environment on your server, while running your code locally on your laptop

For distributing your app’s OS with a team, and as a version control system.

How Do You Setup a Docker Locally

Download a Docker edition and the Docker Toolbox

Make sure your BIOS has Virtualization Technologies, AMD-V, or KVM enabled

Install the Extension Pack in the Oracle Virtual Box.

Run the Setup

How Do You Use a Docker?

The biggest advantage of VMs is that they create snapshots which can be revisited instantly later. Docker containers further enhance the lightweight process virtualization by being OS independent and using the Linux Kernel’s functionality. They are created from Docker images – like snapshots. Docker images are created using a Docker file which can be customized or used as is. The default execution driver for creating a docker container is ‘libcontainer’. Docker Hub can be used for searching docker images and seeing the way they have been built.

To create a Docker container, download the ‘hello world’ image, by typing the following command in the terminal –

$ docker run hello world

For checking the number of images on your system, use the following command –
$ docker images

For searching an image in the Docker Hub –
$ docker search <image>

List of Docker Basic Commands

docker run – Runs a command in a new container.

docker start – Starts one or more stopped containers

docker stop – Stops one or more running containers

docker build – Builds an image form a Docker file

docker pull – Pulls an image or a repository from a registry

docker push – Pushes an image or a repository to a registry

docker export – Exports a container’s filesystem as a tar archive

docker exec – Runs a command in a run-time container

docker search – Searches the Docker Hub for images

docker attach – Attaches to a running container

docker commit – Creates a new image from a container’s changes
Check out the complete list of commands in the Docker documentation.

observability? Let's discuss about some myths from facts ...........

2021-05-26T08:30:00.003+05:30

Microservices and distributed architectures became the norm for building modern-day applications. While the cloud has made it easier to deploy and scale microservices, it's opened a posh set of problems for DevOps by virtue of the sheer volume of interactions between those services.

Tracing a blunder across a microservice architecture could be a huge challenge, and without proper insight, longer are required to resolve issues, resulting in an increased unit of time To Resolve (MTTR) in all about business related critical situations for along DevOps and site reliability engineers (SREs).

This is where observability plays a vital role. As applications become more complex, it's essential to form them observable, because you'll be able to only analyze, monitor, and optimize your system after you know the way it behaves.

This blog discusses observability, the common myths, and also the facts that disprove them.

3 pillars of observability

How does one define observability? If at any given time, you'll be able to assess your system's state, health, and behavior, then your system is observable. you ought to even be able to trace the foundation reason behind a controversy or unearth problems that otherwise go unnoticed.

Correlating data using metrics, logs, and traces shows a holistic picture by your environment. This is kind of often why those metrics, logs, and traces are considered the three pillars of observability.

Myths and facts about observability

As the term "observability" gains traction, there are some misconceptions surrounding it. Below, we'll discuss a number of the common myths together with the particular facts proving them wrong.

Myth: Monitoring and observability are two independent subjects.
Fact: Monitoring and observability go hand in hand. In fact, observability may be a superset of testing and monitoring. A system becoming the observable by gaining visibility via data/metrics from monitoring tools. and also the more observable your system is, the more granular and efficient your monitoring are.

Myth: Observability is barely for tech giants.
Fact: regardless of the scale and scale of your organization, if your application performance affects your business bottom line, then you would like to take a position in making your systems observable. While the concept of observability was initiated by tech giants, it's become a subject of interest among businesses of all sizes thanks to the rise within the adoption of cloud technologies and therefore the complexities related to it. you do not must be an outsized enterprise to implement observability in your systems. whether or not your application is easy, it's imperative to confirm your systems are observable.

Myth: Observability is that the final piece of the puzzle to solving all of your performance problems.
Fact: No, it's not. In fact, making your systems observable is just the place to begin. It doesn't suggest that after you've got achieved observability, the remainder will be sure of itself. By making your systems more observable, you open the window to spot the nitty-gritty details of your application behavior that otherwise go unnoticed. The system also enables you to implement shift-left principles in your DevOps cycle.

Achieving observability

Assess the requirements and requirements of your system before you invest. Define the key performance indicators of your application performance, and start your observability journey from there. Tweak to your defined key performance indicators (KPIs) according to you scale.

Define benchmarks for your KPIs, and establish remedial actions to require place once they are breached.

To Identify, capture, and consolidate the all logs from various services which are affect your key performance indicators. Define the rules for filtering using these logs, and detect anomalous patterns.

Basics of Wireshark: Part-2

2021-05-24T23:00:00.001+05:30

What is color coding in Wireshark?

The packets within the Wireshark are highlighted with blue, black, and green color. These colors help users to spot the kinds of traffic. it's also called as packet colorization. The all defined coloring rules within the Wireshark are kind of temporary rules and permanent rules.

The temporary created all rules are already there until the program is in active mode or until we quit the in middle program.
The permanent color rules are available until the Wireshark is in use or the following time you run the Wireshark. The steps to use color filters are discussed later during this topic.

Below is the list of filters used in Wireshark:

Filters	Description
ip.addr Example- ip.addr==10.10.100.247 ip.src ip.dst	It is used to specify the IP address as the source or the destination. This example will filter based on this IP address as a source and a destination. If we want for a particular source or destination then, It is used for the source filter. It is used for the destination.
protocol Example- dns or http 'Dns and http' is never used.	This command filters based on the protocol. It requires the packet to be either dns protocol or http protocol and will display the traffic based on this. We would not use the command 'dns and http' because it requires the packet to be both, dns as well as http, which is impossible.
tcp.port Example: tcp.port==443	It sets filter based on the specific port number. It will filter all the packets with this port number.
4. udp.port	It is same as tcp.port. Instead, udp is used.
tcp.analysis.flags example is shown in fig(5).	Wireshark can flag TCP problems. This command will only display the issues that Wireshark identifies. Example, packet loss, tcp segment not captured, etc. are some of the problems. It quickly identifies the problem and is widely used.
6.!() For example, !(arp or dns or icmp) This is shown in fig (6).	It is used to filter the list of protocols or applications, in which we are not interested. It will remove arp, dns, and icmp, and only the remaining will be left or it clean the things that may not be helpful.
Select any packet. Right-click on it and select 'Follow' and then select' TCP stream.' Shown in fig. (7).	It is used if you want to work on a single connection on a TCP conversation. Anything related to the single TCP connection will be displayed on the screen.
tcp contains the filter For example- tcp contains Facebook Or udp contains Facebook	It is used to display the packets which contain such words. In this, Facebook word in any packet in this trace file i.e., finding the devices, which are talking to Facebook. This command is useful if you are looking for a username, word, etc.
http.request For the responses or the response code, you can type http.response.code==200	It will display all the http requests in the trace file. You can see all the servers, the client is involved.
tcp.flags.syn==1 This is shown in fig (10). tcp.flags.reset	This will display all the packets with the sync built-in tcp header set to 1. This will show all the packets with tcp resets.

Basics of Wireshark - Part:- 1

2021-05-22T16:39:00.001+05:30

What is Wireshark?

As we all know Wireshark is an open-source packet analyzer, which is help to all or any folks like employed for education, analysis, software development, communication protocol development, and network troubleshooting.

It is accustomed track the packets so as that every is filtered to meet our specific needs. which is generally called as a sniffer, network protocol analyzer, and network analyzer. it is also utilized by network security engineers to appear at security problems.

Wireshark may well be a liberated to use application which is utilized to apprehend the knowledge back and forth. it's often called as a free packet sniffer computer application. It's adding the actual the network card into an unselective mode, i.e., to simply accept all the packets which it receives.

Uses of Wireshark:

Wireshark will be utilized in the subsequent ways:

It is utilized by network security engineers to look at security problems.
It allows the users to look at all the traffic being skipped over the network.
It is employed by network engineers to troubleshoot network issues.
It's so much help in troubleshoot latency issues and malicious activities on your network.
It may also analyze dropped packets.
It helps us to understand how all the devices like laptop, mobile phones, desktop, switch, routers, etc., communicate during a local network or the remainder of the globe.

Functionality of Wireshark:

Wireshark is analogous to tcpdump in networking. Tcpdump may be a common packet analyzer which allows the user to display other packets and TCP/IP packets, being transmitted and received over a network attached to the pc. it's a graphic end and a few sorting and filtering functions. Wireshark users are able to see all the traffic which are passing through the network.

Wireshark also can monitor the unicast traffic which is not sent to the network's MAC address interface. But, the switch doesn't pass all the traffic to the port. Hence, the promiscuous mode isn't sufficient to work out all the traffic. the varied network taps or port mirroring is employed to increase capture at any point.

Port mirroring could be a method to observe network traffic. When it's enabled, the switch sends the copies of all the network packets present at one port to a different port.

Features of Wireshark

It is multi-platform software functionality, Example:- it can run on Linux, Windows, OS X, FreeBSD, NetBSD, etc.
It is a regular three-pane packet browser.
It performs deep inspection of the many protocols.
It often involves live analysis, i.e., from the various forms of the network just like the Ethernet, loopback, etc., we are able to read live data.
It has sort and filter options which makes ease to the user to look at the information.
It is also useful in VoIP analysis.
It may capture raw USB traffic.
Various settings, like timers and filters, is accustomed filter the output.
It can only capture packet on the PCAP (an application programming interface accustomed capture the network) supported networks.
Wireshark supports a range of well-documented capture file formats like the PcapNg and Libpcap. These all formats are using to store the already captured data.
It is the all over networking areas related number:1 piece of software for its purpose. it's countless applications starting from the tracing down, unauthorized traffic, firewall settings, etc.

What is LLDP? - Benefits of Link Layer Discovery Protocol

2021-05-20T21:30:00.001+05:30

What is LLDP?

The link layer discovery protocol (LLDP) is an open and extendable part of the Internet protocol suite used in IEEE 802 to advertise a device’s identity and abilities, as well as other devices connected within the same network.

LLDP

Link Layer Discovery Protocol

LLDP is mainly used in wired Ethernet-connected devices to facilitate management of network resources and simplify networking tasks for administrators in a multi-vendor network. The protocol’s multi-vendor support enables network discovery of devices and management tools like Simple Network Management Protocol (SNMP) in a network made up of devices from different manufacturers. LLDP makes it unnecessary to use a larger number of proprietary protocols to support a multi-vendor network or, on the other hand, limit oneself to the hardware of a single vendor.

LLDP is also known as Station and Media Access Control Connectivity Discovery, as specified in IEEE 802.1AB. Similar proprietary protocols include Cisco Discovery Protocol (CDP), Extreme Discovery Protocol, Foundry Discovery Protocol (FDP), Microsoft's Link Layer Topology Discovery and Nortel Discovery Protocol (AKA SONMP).

On an interval schedule, an LLDP device sends its information in Ethernet frames. A frame starts with the required TLVs of Chassis ID, Port ID, and time-to-live (TTL). The frame contains the device’s destination MAC address as a multicast address that is not forwarded outside a network, assuming 802.1D compliance.

Benefits of LLDP

Simplifies the use of network management tools in a multi-vendor environment.

Accurate discovery of physical network topologies that simplifies troubleshooting within enterprise networks.

Enables discovery of stations in multi-vendor environments.

Provides device capability and supports optional system name and description, and management address.

Provides information that can be used to detect duplex and speed mismatches.

Discover devices with misconfigured or unreachable IP addresses.

LLDP operating modes

An LLDP agent operatesbelow three modes:

Transmit-only mode: The agent can only transmit the information about the capabilities and the current status of the local system.

Receive-only mode: The agent can only receive the information about the capabilities and the current status of the remote systems.

Transmit and Receive mode: The agent can transmit the local system capabilities and status information and receive the remote system’s capabilities and status information.

LLDP timers

Hold timer refers to the time or duration that an LLDP device maintains the neighbor information before aging it. The default is 120 seconds. If the timer expires and no LLPD packet was received, the neighbor information will be discarded.

Frequency timer pertains to the interval at which the network devices sends LLDP updates to neighboring devices. The default is 30 seconds.

Reinit timer is the delay time for LLDP to initialize on any interface. The default is 2 seconds.

Do You know challenges about VoIP during remote work, and meeting ?

2021-05-20T10:00:00.001+05:30

Though remote work has been in practice for a good number of years, the pandemic has made businesses take up the challenge of shifting to a totally remote workforce. All this wouldn't are possible without high-speed internet access for all employees. Another tool that has made the transition smooth and ensured uninterrupted communication is voice Internet Protocol (VoIP).

The evolution of VoIP tools

When it had been first developed in 1995, VoIP technology aimed to chop down on long-distance and international telephone charges. the primary internet phone comprised of software that compressed voice signals, converted them into digital packets, and distributed them over the web. Further enhancements started within the early 2000s with the evolution of Session Initiation Protocol (SIP), which led to the adoption of hosted VoIP. SIP allowed developers to beat the restrictions of hardware by creating applications that might integrate with almost any telephone system. In the year of 2008, 80 % of all the new private branch exchange (PBX) lines installed internationally were VoIP.

With the event of WebRTC, it's now feasible for web developers to enable VoIP in web-based applications. With the event of WebRTC, it's now feasible for web developers to enable VoIP in web-based applications.

How VoIP has facilitated remote work

Now offering the pliability of plugging in an exceedingly VoIP phone to any home router or forwarding calls to private handsets, VoIP technology has evolved plenty. This hosted VoIP model and also the mobile app facility are the explanations that VoIP has lent a hand during remote work.

How VoIP can benefit businesses of all ranges

Being low-cost and versatile has always given VoIP services some brownie points. Modern VoIP systems are providing instant messages, availability about information, and remote access to data and their voicemail and fax, on top of forwarding, conferencing, call queueing, speed dialing, transferring, auto-attendants, and video conferencing. This helps even small and medium-sized businesses use VoIP for his or her communication.

With the less hardware-dependent VoIP systems gaining momentum, further because the arrival of 5G networks, mobile VoIP systems expect big growth by 2025, which could have an impressive impact on how business communications are redefined across sectors. While the BFSI and IT sectors are already using VoIP to the fullest, the healthcare sector is additionally slowly learning speed with its VoIP implementations since the lockdown. This, plus the blending with the online of Things also data, clearly indicates how the VoIP is maturing supported outlying that technology.

The need for monitoring

Keeping in mind the importance of VoIP and the way many organizations have grown enthusiastic about it, it's also important to investigate the technology’s cons. Choppy voices also, audio delays, echoes, and voice compression have caused with their frustration and affected business deals. These problems are common across vendors and are primarily because of network issues. To pinpoint and fix them, it's important to investigate which path of the bidirectional communication is experiencing such errors. VoIP monitoring tools monitor the standard of service (QoS) across the network and call path to spot and fix problems.

Meeting QoS challenges

Jitter: Jitter, the foremost common issue, takes place when the packets reach the destination in a very different order than they were originally sent, leading to poor or scrambled audio. you'll identify the quantity of jitter by monitoring the decision path and take a look at out methods to eliminate jitter, like using an coaxial cable rather than Wi-Fi, reducing the connections over the identical network, limiting the quantity of simultaneous data transfers, and avoiding bufferbloat.

Latency: Never let your latency transcend 200ms. Keep a watch on this metric and speak to your internet service provider (ISP) if you face prolonged latency issues. you ought to always have a backup internet connection when your VoIP calls are business-critical. Offices with multiple ISPs easily bypass these types of issues. However, for home networks during remote work, make sure that your mobile LTE signals are strong enough to back you up when your broadband allows you to down.

MOS: Mean opinion score (MOS) is another key metric that rates the standard of calls. On a scale of 1 (unacceptable) to five (excellent), VOIP calls are often within the 3.5 to 4.2 range. Any deviation over some extent of your time must be closely tracked and analyzed.

The primary technique to debug and troubleshoot VoIP is to research what has been sent and received by the VoIP devices. Monitoring the traffic employing a VoIP network monitoring tool is a simple thanks to accomplish this.

Do you know which metrics you should monitor to keep your servers under control

2021-05-19T10:00:00.009+05:30

"Why is my server down?" could be a common question that comes up among system administrators and infrastructure managers very often. Inefficient server monitoring and management often make it difficult to investigate the unpredictable and complicated information running through data centers and see the explanation for an outage. That's when an efficient server monitoring tool comes in handy. However, the important challenge lies in selecting appropriate server management software and monitoring the proper performance indicators.

So what does it really mean to pick out the proper monitoring tool with the proper performance indicators? Well first, it is important to know your requirements before getting started. counting on the appliance running on your servers, your monitoring needs may vary. However, irrespective of what the applying is, there are a collection of performance metrics that ought to be monitored 24x7.

Server Availability and Uptime

Server uptime reflects the reliability and availability of your servers, stressing on the need to have your servers always up and running. It is not required to spend every minute checking on your uptime report, but it is essential to know when your server is down. For production servers, uptime of less than 99% calls for attention, and less than 95% calls for trouble.

System-level Performance Metrics

Metrics like CPU, memory, disk usage, and network activity are usually all are immediate suspects once you identify a server performance degradation issue in your data center. Checking on these metrics help detect servers with insufficient RAM, limited drive space, high CPU utilization, or any bandwidth bottlenecks. this might make it lots easier to troubleshoot and act fast before you run into problems along with your servers.

Application-level Performance Metrics

The application running on your servers consists of multiple services and understanding the intra-service dependencies, connection patterns may be difficult. Monitoring each and each service and process running on the server can tell which service/process is impacting server performance, analyze the server load, and manage system resources.

Security-level Performance Metrics

With such a lot of background tasks running in your servers, it are often quite difficult to grasp what's being written or modified to or from your files. A monitoring eye to notify of such changes would be a true time-saver to stay you responsive to unauthorized access that would lead to the loss of sensitive data or any improper changes done which will cause data breach and compliance failure. Knowing when files are modified, content changes are made, or perhaps if specific resources are accessed can help act as an intrusion detection system and secure your infrastructure. Another important metric to stay a watch on to avoid security issues are the logs generated by servers, applications, and security devices. Monitoring these logs can help system administrators scan and hunt for errors, problems, specific text patterns, and rules indicating important events within the log files.

Do You know how to fix CredSSP Authentication Error in RDP ?

2021-05-18T10:00:00.001+05:30

Microsoft has already released some security patches in year of March 2018 to repair the precise vulnerabilities for the CredSSP (Credential Security Support Provider Protocol) employed by the Remote Desktop Protocol in Windows Server. But a recent update has made CredSSP Authentication error in RDP and caused hindrance to several users.

Microsoft pushed the update of May 2018 to harden the protection by making it mandatory for both client and server computers to possess the update installed. This resulted in windows servers not accessible via RDP for several users and made many to reboot their servers to repair the matter thinking it as a server side issue. This blog will facilitate your on the way to repair the CredSSP Authentication related error in Remote Desktop Protocol (RDP)

What is CredSSP?

“CredSSP” or “Credential Security Support Provider Protocol” could be a security support provider which helps to securely delegate user credentials from a client computer to a windows server by using TLS (Transport Layer Security) as an encrypted pipe.

Why the update?

The update in May is formed to correct how CredSSP validates requests during the authentication process. Microsoft has found a credssp error in rdp and located a fix for the vulnerability by mandatory requiring to update both the client and server computer to figure properly.

An authentication error has occurred.

The function requested isn't supported

Remote computer:

This could ensue to CredSSP encryption oracle remediation.

For more information, Click on the link

This error is thanks to the windows update not installed either on the server or on the client computer.

How to fix it?

To fix the issue, you need to uninstall the update and roll back to an older version. But rolling back to an old version is not a best practice. You can fix this by changing the group policy in the local computer to use the vulnerable setting

1. Go to “Run” (Win Key + R)
2. Type “gpedit.msc” and click “Enter”

3. Go to Computer Configuration -> Administrative Template -> System -> Credentials Delegation -> Encryption Oracle Remediation

4. Double Click on “Encryption Oracle Remediation”, choose “Enable” and change protection level to “Vulnerable” and click “Apply” or “Ok”

You can also fix the issue with the help of a Windows Registry Editor

1. Open Windows Registry by typing “regedit” in “Run”
2. Navigate to Computer -> HKEY_LOCAL_MACHINE -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> Policies -> System -> CredSSP -> Parameters

3. Doubleclick on the Key “Allow Encryption” Change the value to “2”

This method also gives the same output as achieved through the Group Policy Editor.

How to Enable/Disable Administrator Account in Windows 10

2021-05-16T23:35:00.000+05:30

Method 1 – Via Command

Select “Start” and type “CMD“.
Right-click “Command Prompt” then choose “Run as administrator“.
If prompted, enter a username and password that grants admin rights to the computer.
Type: net user administrator /active:yes
Press “Enter“.

Replace “yes” with “no” to disable the admin account on the welcome screen.

(if you can’t run as admin)

– Run safe mode with command prompt
– You will be prompted to enter admin password. If you didn’t set. Just hit enter. I
– type method 1. Once administrator is actives.

2. Login again using safe mode
– Administrator user appears. Login as Administrator. Password is blank.
– Continue with Method 2. Run “Luscmgr.MSc” etc.
– Restart in normal mode

Method 2 – From Admin Tools

Hold the Windows Key while pressing “R” to bring up the Windows Run dialog box.
Type “lusrmgr.msc“, then press “Enter“.
Open “Users“.
Select “Administrator“.
Uncheck or check “Account is disabled” as desired.
Select “OK“.

Method 3 – From Registry

Hold the Windows Key while pressing “R” to bring up the Windows Run dialog box.
Type “regedit“, then press “Enter“.
Navigate to the following:
HKEY_LOCAL_MACHINE
SOFTWARE
Microsoft
Windows NT
CurrentVersion
Winlogon
SpecialAccounts
UserList
On the right side, right-click on “UserList” and select “New” > “DWORD Value“.
Give the value a name of “Administrator“. Press the “Enter” key when you are done.
Close the Registry Editor and restart the computer.
Delete the “Administrator” value to turn it off and prevent it from appearing on the Welcome screen.

Method 4 – Group Policy

Note: This will not work in Home editions of Windows 10.

Hold the Windows Key while pressing “R” to bring up the Windows Run dialog box.
Type “gpedit.msc“, then press “Enter“.
Navigate to the following:
Local Computer Configuration
Windows Settings
Security Settings
Local Policies
Security Options
Accounts: Administrator Account Status
Enable or Disable the setting as desired.