Online networking resources

Know these Cyber security TERMS

2011-02-04T10:53:00.000+04:00

Spam – Unsolicited e-mails, sent in batches of 10,000s or 100,000s, using spamming tools available on the web.

Phishing – Criminally fraudulent process of attempting to obtain sensitive information such as user names, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.
Malware – Malicious computer program or code written to steal user information and passwords.
Trojan – Malware that automatically download themselves (when launching infected web pages or opening spam e-mails) allowing hackers to take control of victim computers to launch attacks on other computers or networks.
“Smishing” or “vishing” – Fraudulent SMS message sent to your cellphone or automated voice response call to your cellphone/landline phone saying there’s a problem with your bank account. You’re given a phone number to call or a website to log into and asked to provide personal identifiable information—like a bank account number, PIN, or credit card number—to fix the problem.

What a big Deal ! NAT (Network Address Translation ) / PAT (Port Address Translation )

2011-01-08T19:41:00.002+04:00

What is NAT : (Network address translation )/PAT (port address Translation )

NAT ! what it does is , translate inside ip address to outside ip address or vise versa , ok by now you are thinking what is inside and what is outside ? let me give you an example , let say you have a router it has two interface , one connected to your pc or switch the other one connected to your service provider . the one connected to your pc or switch will be an inside interface and the other one connected to service provider will be outside interface .

Router does NAT !

what happens is , router gets an ip address from service provider , that will be a public ip address , now behind the router inside interface there might be 10 or 100 computers connected to router through switch and every computer wanted to use internet ,these computers gets an ip address via DHCP or static assignment , most of the time these are private ip address , defend on your design and money that your spending , public ip address are expensive to get and even they are running out of stock soon , that’s why IPV6 in place .

What router does is , translate all private address to one public address via different port number , that is PAT (port address translation ) .

Why use NAT !

The shortage of public IP addresses is only one reason to use NAT. Two other good reasons are: Security and Administration.

Example : NAT is like the receptionist in a large office. Let's say you have left instructions with the receptionist not to forward any calls to you unless you request it. Later on, you call a potential client and leave a message for them to call you back. You tell the receptionist that you are expecting a call from this client and to put them through.
The client calls the main number to your office, which is the only number the client knows. When the client tells the receptionist who they are looking for, the receptionist checks a lookup table that matches up the person's name and extension. The receptionist knows that you requested this call, therefore the receptionist forwards the caller to your extension.

Various NAT Type :

Static NAT – Mapping an unregistered IP address to a registered IP address on a one-to-one basis. Particularly useful when a device needs to be accessible from outside the network.

Dynamic NAT – Maps an unregistered IP address to a registered IP address from a group of registered IP addresses. Dynamic NAT also establishes a one-to-one mapping between unregistered and registered IP address, but the mapping could vary depending on the registered address available in the pool, at the time of communication.

(Most popular ) Overloading – A form of dynamic NAT that maps multiple unregistered IP addresses to a single registered IP address by using different ports.

Known also as PAT (Port Address Translation),

Overlapping – When the IP addresses that you are using in your internal network and the company that you are going to connect to are using same ip addresses range in their network, the router must maintain a lookup table of these addresses so that it can intercept them and replace them with registered unique IP addresses. It is important to note that the NAT router must translate the "internal" addresses to registered unique addresses and also it must translate the "external" registered addresses to addresses that are unique to the private network. This can be done either through static NAT or you can use DNS and implement dynamic NAT.

Break DOWN your DNS knowledge into pieces

2011-01-05T22:49:00.002+04:00

The Domain Name System (DNS) provides visitors access to websites using domain names rather than IP addresses.

How does DNS work?

DNS translates human-speak (domain names) into computer-speak (IP addresses). Domain names are text-based names used to identify a website or Internet location. IP addresses are strings of numbers used by every computer connected to the Internet to identify a website's location and communicate with other computers and Web servers.
DNS translates the text-based website or location identifier a visitor enters to the number-based IP address of the associated website or Internet location. For example, myweb.com is a domain name. 208.109.80.200 is an IP address associated with myweb.com. DNS translates the domain name myweb.com to the IP address 208.109.80.200
Using DNS, we can enter easily-remembered text-based domain names and reach machine-readable Internet addresses.

How does DNS know which IP address to use?

Each domain name stores its DNS information in a zone file. Large collections of zone files for different domain names are stored on nameservers. Domain names point to nameservers to locate their zone files — to do this, a domain name must point to the nameserver holding its specific zone file.

How do I know which name server to use?

When you register a domain name, the provider will automatically park the domain name and set its name server to parking servers. If you activate the domain name or make changes to your website's hosting, your hosting company provides the name server names or IP addresses where your domain name's zone file is located. Use this information to update your domain name settings at your registrar. Once you've updated your name servers or IP address, allow 24 to 48 hours for the new information to propagate through the Internet, and then visitors can reach your website using your domain name.
Zone files organize the zone records for domain names and sub domains in a DNS server. Every domain name and sub domain has a zone file, and each zone file contains zone records. These files, editable in any plain text editor, hold the DNS information linking domain names and sub domains to IP addresses. Zone files usually contain several different zone records.

NOTE: Although domain names might have sub domains, the zone files for sub domains are not considered sub-zone. All zone files are separate entities and do not have a hierarchal structure.

The most common records contained in a zone file are start of authority (SOA), name server, mail exchanger, host, and CNAME. These are described below.

Start of Authority (SOA) — Required for every zone file, the SOA record contains caching information, the zone administrator’s email address, and the master name server for the zone. The SOA also contains a number incremented with each update. As this number updates, it triggers the DNS to reload the zone data.
Name Server (NS) — The NS record contains the name server information for the zone.
Mail Exchanger (MX) — The MX record provides the mail server information for that zone to deliver email to the correct location.
Host (A) — Uses the A record to map an IP address to a host name. This is the most common type of record on the Internet.
Canonical Name (CNAME) — A CNAME is an alias for a host. Using CNAMEs, you can have more than one DNS name for a host. CNAME records point back to the A record. When you change the IP address in your A record, all CNAME records for that domain name automatically follow the new IP address.
Text (TXT) — This is an informational record. Use it for additional information about a host or for technical information to servers.
Service Records (SRV) — SRV records are resource records used to identify computers hosting specific services.
AAAA — AAAA records store a 128-bit Internet Protocol version 6 (IPv6) address that does not fit the standard A record format. For example, 2007:0db6:85a3:0000:0000:6a2e:0371:7234 is a valid 128-bit/IPv6 address.

Don't Shy ! watch out 10 Tips from Dr.Bob

2011-01-03T17:36:00.004+04:00

How to configure cisco SDM and loopback address on GNS3

2010-12-31T13:40:00.000+04:00

Split Horizon, Routing update, Distance Vector, Poison Route, Periodic Update, Routing Table, metric, passive interface, auto summary

2010-12-29T20:41:00.003+04:00

Split Horizon:

Split horizon is a method of preventing a routing loop in a network. The basic principle is simple: Information about the routing for a particular packet is never sent back in the direction from which it was received.

Routing Update:

A message defined by routing protocol that lists routing information, including the subnet number, subnet mask, and metric.etc.

Distance Vector:

Distance Vector means that Routers are advertised as vector of distance and direction. 'Direction' is represented by next hop address and exit interface, whereas 'Distance' uses metrics such as hop count.

Routers using distance vector protocol do not have knowledge of the entire path to a destination. Instead Distance Vector uses two methods:

Direction in which or interface to which a packet should be forwarded.
Distance from its destination.

Poison Route:

A route listed in a routing update that the routing protocol purposefully assigns a metric value considered to be infinite, meaning that the route has failed.

Periodic Update:

A routing protocol behavior in which the routing protocol sends Update messages on a regular interval (the period).

Routing Table:

A list kept by routers that lists the best IP routes known to the router. Each entry lists a subnet or network, the associated mask, possibly the outgoing interface and/or IP address of the next-hop router, and other related info.

Metric :

A numeric value that a routing protocol uses to imply how good a particular route is, so that when a router learns more than 1 route for the same network/subnet, the router can choose the best route as the route with the lowest metric.

Passive Interface:

An interface local to a router, for which the routing protocol does not send routing protocol messages out to that interface. Different routing protocol has different view about Passive interface , in RIP when passive interface command applied in a interface , router will not send any update through that interface however will receive update . in EIGRP if passive interface command applied router will not form any adjacency , because the command will not allow EIGRP hello .

Auto Summary:

If auto summary is enabled , router will automatically summary all routes in their class full boundaries .let say you have used a class B ip address 172.16.0.0/16 and subnet ed into many network ( 172.16.1.0/24 , 172.16.2.0/24 ) , however if auto summary is enable in your configuration , you will see only one summary route (172.16.0.0/16) in your routing table .

Whats in your mind ? Plan ==> Do ==> Check ==> Act .

2010-12-28T19:35:00.001+04:00

hey, wanted to take somebody out :) or do something for your self , fit into Formula .

How to configure HOT_sTANDby_routing_protocol (HSRP) on a router

2010-12-25T16:56:00.002+04:00

Concise notes Load Balancing HSRP, VRRP, GLBP

2010-12-24T14:59:00.013+04:00

Hot Standby Router Protocol (HSRP) : Download this

provides network redundancy for IP networks, ensuring that user traffic immediately and transparently recovers from first hop failures in network edge devices or access circuits .HSRP allows multiple routers to share a virtual IP and MAC address so that the end-user hosts do not realize when a failure occurs.

Some of the key HSRP features are as follows:

■ Virtual IP address and virtual MAC active on the Master routerf

■ Standby routers listen for Hellos from the Active router, defaulting to a 3-second hello interval and 10-second dead interval

■ Highest priority ( default is 100, range 1–255) determines the Active router, with preemption disabled by default

■ Supports tracking, whereby a router’s priority is decreased when a tracked object (interface or route) fails

■ Up to 255 HSRP groups per interface,

■ Virtual MAC of 0000.0C07.ACxx, where xx is the hex HSRP group

■ Virtual IP address must be in the same subnet as the routers’ interfaces on the same LAN

■ Virtual IP address must be different from any of routers’ individual interface IP addresses

■ Supports clear-text and MD5 authentication (through a key chain)

HSRP, VRRP, and GLBP, can track interface states.can track based on the line protocol or the IP routing table.

Because HSRP uses only one Active router at a time, any other HSRP routers are idle. To provide load sharing in an HSRP configuration, the concept of Multiple HSRP, or MHSRP, was developed.In MHSRP, two or more HSRP groups are configured on each HSRP LAN interface, where the configured priority determines which router will be active for each HSRP group.

MHSRP requires that each DHCP client and statically configured host is issued a default gateway corresponding to one of the HSRP groups and requires that they’re distributed appropriately. Thus, in an MHSRP configuration with two routers and two groups, all other things being equal, half of the hosts should have one HSRP group address as its default gateway, and the other half of the hosts should use the other HSRP group address.

HSRP is Cisco proprietary,

Virtual Router Redundancy Protocol (VRRP) :

VRRP (RFC 3768) provides a standardized protocol to perform almost the exact same function. VRRP implementation has the same goals in mind as HSRP but with these differences:

■ VRRP uses a multicast virtual MAC address (0000.5E00.01xx, where xx is the hex VRRP group number).

■ VRRP uses the IOS object tracking feature, rather than its own internal tracking mechanism, to track interface states for failover purposes.

■ VRRP defaults to use pre-emption, but HSRP defaults to not use pre-emption. Both can be configured to either use pre-emption or not.

■ The VRRP term Master means the same thing as the HSRP term Active.

■ In VRRP, the VRRP group IP address is the interface IP address of one of the VRRP routers.

Gateway load balancing Protocol (GLBP) :

is a newer Cisco-proprietary tool that adds load-balancing features in addition to gateway redundancy features. Hosts still point to a default gateway IP address, but GLBP causes different hosts to send their traffic to one of up to four routers in a GLBP group. To do so, the GLBP Active Virtual Gateway (AVG) assigns each router in the group a unique virtual MAC address, following the format 0007.B400.xxyy, where xx is the GLBP group number, and yy is a different number for each router (01, 02, 03, or 04). When a client ARPs for the (virtual) IP address of its default gateway, the GLBP AVG replies with one of the four possible virtual MACs. By replying to ARP requests with different virtual MACs, the hosts in that subnet will in effect balance the traffic across the routers, rather than send all traffic to the one active router.Cisco IOS devices with GLBP support permit configuring up to 1024 GLBP groups per physical interface and up to four hosts per GLBP group.

How to configure Cisco ROUTER as DHCP server

2010-12-21T23:32:00.001+04:00

WHAT is a DHCP server :

DHCP : Dynamic Host Control Protocol

In a network, a DHCP server manages a pool of IP addresses, as well as default gateway details, DNS details and other information for the clients’ network configuration. When a new computer is introduced into a DHCP server-enabled network, it will send a query to the DHCP server requesting all the necessary information. When the query reaches the DHCP server, it will grant the new computer a new IP address and a lease - a time frame for which the computer can use this IP address, as well as other configuration details. The whole process takes place immediately after the new computer boots, and to be successful, it has to be completed before initiating IP based communication with other hosts in the network.

How to do Router ON-A-STICK

2010-12-18T22:08:00.002+04:00

WHAT is router on-a-stick ? watch the VIDEO , you will have good understanding on topics !!!

concise Multicast notes CCNA/CCNP/CCIP/CCIE

2010-12-18T11:49:00.000+04:00

Multicast :

What is IP Multicast :

IP multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to potentially thousands of corporate recipients and homes. Applications that take advantage of multicast include video conferencing, corporate communications, distance learning, and distribution of software, stock quotes, and news.

IP multicast delivers application source traffic to multiple receivers without burdening the source or the receivers while using a minimum of network bandwidth. Multicast packets are replicated in the network at the point where paths diverge by Cisco routers enabled with Protocol Independent Multicast (PIM) and other supporting multicast protocols, resulting in the most efficient delivery of data to multiple receivers.

Reverse Path Forwarding (RPF)

PIM uses the unicast routing information to create a distribution tree along the reverse path from the receivers towards the source. The multicast routers then forward packets along the distribution tree from the source to the receivers. RPF is a key concept in multicast forwarding. It enables routers to correctly forward multicast traffic down the distribution tree. RPF makes use of the existing unicast routing table to determine the upstream and downstream neighbors. A router will forward a multicast packet only if it is received on the upstream interface. This RPF check helps to guarantee that the distribution tree will be loop-free.

Multicast operation :

sparse mode : shared tree concept . explicit join , no traffic unless you ask for it

employs rendezvous point (RP) to process join request .uses pull technology.

Dense mode : source tree concept .implicit join , all traffic unless you say you want it, uses push technology , flood and prune behavior .

Sparse-Dense : sparse for a group with an RP , dense for all other .

If sparse mode assign a RP ...

to configure Statically RP use : ip pim rp-address command

to dynamically assign RP use : Auto-rp ( cisco proprietary )

bootstrap router(BSR) pim version 2 (industriy standard )

S,G : S meaning source ,G meaning group

*.G : don’t care about the source if there is an * meaning any source

show ip pim neighbor command will multicast neighbor router

shortest path tree : DR sends uni cast to RP

shared path tree : request goes to RP and come back

multicast uses UDP port

some well-known multicast address :

224.0.0.1 all multicast systems on the subnet

224.0.0.2 all multicast router on the subnet

global multicast address range 224.0.1.0 -238.255.255.255

private range 239.0.0.0 - 239.255.255.255

IGMP internet group management protocol , client use this protocol to join

a multicast group . three version available v1, v2, v3 .

using v2 client can use leave message to router , so router can drop the multicast flow.

using v3 client can specify by a join message to a multicast enable router which multicast stream they want to listen to meaning the source, by v2 it was not possible .

Cisco group management protocol (CGMP ) router tells to switch about multicast Mac address.

IGMP snooping : IGMP snooping allows switch to see IGMP query message , join message , leave message ,

What is multicast assert message :

with in multicast router if there is two path to a multicast source , client will use one path based on unicast routing table , when that route goes down ,the other router takes over and when the failed router come back online it will send an assert message to replace the backup router .

The assert election criteria are as follow in decreasing order of priority:

1- Administrative distance to the source S (10.10.10.1)

2- Cost of the route to S (10.10.10.1)

3- Highest multicast interface IP address.

When multiple PIM routers are connected to a LAN subnet, they send Assert messages

to determine which router will be the forwarder of the multicast traffic on the LAN.

Both PIMDM and PIM-SM routing protocols use assert messages.

A PIM-DM router sends Prune and Graft messages based on the demand for multicast

group traffic. If nobody wants the group traffic, the PIM-DM router sends a Prune

message to its upstream router. If somebody requests group traffic and the router is not

receiving the traffic from its upstream router, it sends a Graft message to its upstream router.

DOWNLOAD this notes Download now

How to do port forwarding DynDNS and Dynamic IP

2010-12-17T21:51:00.000+04:00

concise MPLS notes CCNP/CCIP/CCIE

2010-12-17T14:12:00.000+04:00

M PLS :

What is MPLS (Multi-protocol label switching ) : MPLS is a packet-forwarding technology which uses labels to make data forwarding decisions. With MPLS, the Layer 3 header analysis is done just once when the packet enters the MPLS domain. MPLS impose a label in a packet between data link layer and network layer . label 0-15 are reserved label.

LSR : label switching router /provider router which called as P router

edge LSR / provider edge (PE) router : which is called as PE router

Label distribution protocol (LDP)

TDP : tag distribution protocol by Cisco uses TCP /UDP port 711 uses 224.0.0.2 all router in multicast subnet

LDP : uses TCP/UDP port 646 and 224.0.0.2

Forwarding information base (FIb) which CEF table : “show ip cef” will show you details

label information Base (LiB) “show MPLS ldp binding” command will show details of LIB.

label forwarding information base (LFIB ) which is action table, “ show MPLS forwarding-table” command will show forward table .

MPLS default hello interval is 5 sec and hold time is 15 second

MPLS control plane :

where L3 routing protocol exist

where label exchange protocol exist LDP/TDP

control plane take care of exchanging routing information conjunct with LDP.

LDP assigns a label to a route for its incoming and outgoing interface, for

instance network 10.0.0.0/8 gets a label 24 for incoming interface and 25 for outgoing

interface

only PE router looks routing lookup and does label removal .

MPLS Data plane /forwarding plane:

sends data based on L3 or L2 information

takes care of label swapping in other word data plane take cares of LFIB

MPLS process :

1.router build routing table by routing protocol

2. the mpls-enabled routers assign label to each route

3. the routers advertise the route to other LSRs

4. all LSRs build their FIBs, LIBs and LFIBs table

Some Important command :

shw mpls ldp discovery details

show mpls ldp parameters

show mpls forwarding table

show mpls ldp binding

show mpls ip binding

PHP = penultimate hop popping does not work in ATM ( a label gets remove by the P router before it sending to PE router , to reducing table lookup in PE router)

VRF = virtual routing and forwarding

MPLS VPN terms :

Route Distinguisher : (RD) keep customer routes unique with a number

Route Target (RT) : route target number can be use for import and export routes , has to be identical on PE router

PE /Edge LSR router keeps following information :

control plane : routing protocol

ip routing table

label distribution protocol

Data plane : ip forwarding table

label forwarding table

in ATM VPI and VCI is used as label , and its called cell mode MPLS

MPLS traffic engineering require OSPF or is-is routing protocol

LSP = label switch path , LSP build by routing protocol

in MPLs VPN route summarization should not be use , because in vpn end to end LSPs are required

the LSR assigns a label to a network connected locally and advertise the to all neighbor , saying this is the label for my network .

MPLS is defend on IGP protocol for loop prevention although it has 8 bit TTL value , when time to leave value decrease to 0 the packet gets drop , to prevent endless loop. TTL value by default on in Cisco router.

but can be disable , the benefit is if some one does trace route it will show core LSR in trace if TTL blocked in LSR. if TTL disable , should have to disable in all Router .

MPLS frame mode uses per platform labels , this is not secure , and causes label spoofing attack , can call it unsolicited downstream label distribution

MPLS ATM mode uses per interface labels , ATM use downstream on demand approach

router with higher ip address initiate TCP session , loopback beats physical interface , higher is batter

uni-cast IP address also can be used to form neighbor , instead 224.0.0.2 .

How to install Gns3 in windows machine CCNA/CCNP/CCIP

2010-12-17T00:01:00.000+04:00

concise BGP notes CCNP/CCIE

2010-12-15T19:11:00.000+04:00

BGP :

BGP is a path vector routing protocol

EBGP route has the distance of 20

IBGP route has the distance of 200

BGP private autonomous system range 64512-65535

TTL value is 1 by default for EBGP session

use EBGP multi hop command to increase TTL value it will increase to 255 .

in EBGP loop prevention happens based on AS-path information

if IBGP neighbor learns a network from another IBGP neighbor , it can not

advertise the same route to another IBGP neighbor if it does not have neighbor configured , that is where route reflector comes into play.

BGP routers only advertise best path route to their neighbor

BGP route based on TCP port 179 and it does not show in routing table

that the route learn through an interface , unlike IGP protocols

, BGP always shows that route learned from an ip address.

in BGP ( ? ) mark in origin code shows that route either redistributed to BGP

or route injected through BGP inject map.

weight and local preference typically used to effect outbound traffic coming in

As-path and MED used to manipulate to inbound traffic going out to neighbor

in BGP neighbor ship who ever having highest router id , will initiate a TCP session to port 179 to its neighbor from a random port , meaning it will act as BGP client,

to its neighbor , and neighbor will reply from TCP port 179 to a random port to its destination, that will act as TCP server.

BGP update are incremental , meaning if there is change it triggers an update

BGP packet type :

open : start the session

keealive :

update : network reach ability exchange

notification: something bad has happened close session

BGP Tables :

neighbor table : connected peers

BGP table : all routes router know about

routing table : list of best route

EBGP multi hop command required when peering with EBGP neighbor if neighbor not connect directly . if neighbor connected directly no need EBGP multi hop command .

Rule BGP synchronization :

A BGP speaking router do not use or advertise a EBGP route via IBGP , until there is a valid route learned for that through IGP.

BGP next-hop processing :

for EBGP peers : change next hop address on advertise routes.

for IBGP peers : do not change next hop address on advertise routes

BGP split horizon :

BGP split horizon rule , if a route receive via IBGP update from a IBGP peer

don’t send it back to other IBGP peer.

BGP neighbor relationship status:

1. idle : verifying route to neighbor

2. active : attempting connectivity to neighbor

3.open sent : open message (hello) sent to neighbor

4. open confirm : neighbor replied to open message

4.active : neighbor failed to reply or mismatched parameters

5.Establised

BGP well know attribute :

weight

as=path

next hop address

origin

local preference

MED : to influence other autonomous system routing path , meaning updates are going out can be modified through MED

the difference between weight and local preference is weight locally significant

with in the router , local preference gets advertise with in Autonomous system

by a router .

OSPF summary notes CCNA/CCNP/CCIE

2010-12-14T20:54:00.000+04:00

OSPF :

OSPF is link state IGP protocol

OSPF uses IP protocol 89

OSPF uses a shorted path first algorithm in order to build data path and ... The shortest path is calculated with the use of the Dijkstra algorithm.

OSPF send trigger update if there is change in network

OSPF send periodic update of entire routing table every 30 minute

in OSPF all area must connect to area 0

all router in an area have the same topology table

all area must have hierarchical ip addressing design , so that summarization with in the area would be easier.

in OSPF ABR and ASBR can only do summarization

Rule : OSPF router id

all ip address configured with in interfaces in a router , the highest ip will elect as ospf router id. however loop back interface will beat physical interface , even loop back has a lowest ip address .if there is multiple loop back , highest loop back gets elected .OSPF router id keep changing if a router or process gets reboot .always better to hard code router id .

OSPF neighbor states :

OSPF down state : if router send out a hello message on a interface still did not hear back , this is called down state

OSPF init state : if router receive a hello message ( receive hello) , the router goes to init state .

OSPF 2 way state : when a router reply to hello message , router goes to 2way state .

OSPF ex-start state : if hellos and all are agreed it comes to master and slave selection process , where router goes to ex-start state . the master sends DBD packet ( database description packet ) and then slaves sends its DBD back to master .

OSPF Loading state : once DBDs received and acknowledged router goes to loading state .

OSPF full state : once neighbor synchronized with database router goes to full state .

hello message are send out once very 10 second in broadcast/point2point network , and every 30 second in no broadcast network

dead time is 4 times to hello timer

to form a neighbor OSPF router must match hello and dead timer , network mask , area id and authentication .

OSPF maintains 3 table :

neighbor table :

topology table : knows about network with in a area

routing table :

on a OSPF broadcast segment, OSPF DR/BDR gets elected

all OSPF speaking router communicate on multicast address 224.0.0.5

DR/BDR routers communicate on 224.0.0.6

OSPF packet type :

hello

Database description DBD

LSR : link state request

LSA : link state advertisement

LSU : link state update

LSACK : link state acknowledgement

OSPF network type :

broadcast multi-access

non-broadcast multi-access default on serial interface

point to multipoint RFC standard advertise /32 for each link

point-2-point Cisco proprietary default mode on sub interface

broadcast

point 2 multipoint non broadcast Cisco proprietary static neighbor configuration required

OSPF ABR summarization happen with “ area --- range “ command , and it creates a summary route or null 0 route in local router .

OSPF ASBR summarization happen with “ summary address” command in OSPF process .

OSPF LSA type :

LSA type 1 : router LSA (routing update )*****

LSA type 2 : network LSA (DR generated )

LSA type 3 : summary LSA ( ABR summary route) route from ABR

LSA type 4 : summary LSA ( ASBR location ) ip address of ASBR advertise

LSA type 5 : External LSA (ASBR summary route )

Some OSPF handy command :

show ip ospf nei

show ip ospf int

clear ip ospf process

show ip ospf database

LSA (link state advertisement ) 1 -- originated by every router in an area

In OSPF broadcast segment hellos are send as multicast

In OSPF non broadcast segment hellos are send as unicast

on OSPF non-broadcast network , neighbor has to be configured on

OSPF DR router manually by neighbor command.

In general loopback interface route will be treated as host route in OSPF

if loopback need to advertise as a network , use ip ospf network point-to-point

command on loopback interface .

for OSPF network type point to point hello time 10 dead time 40

for OSPF network type multipoint hello time 30 dead time 120

point to multipoint network does not have DR/BDR election send hellos as multicast to

224.0.0.5, its change the next hop value .

inter area route is LSA 3 shows as OIA in routing table

intra area routes are LSA 1 & 2 shows as O in routing table

100

OSPF cost = -----------------------

Interface bandwidth in Mbps

every shared network should have DR and a BDR

DR BDR election :

Highest priority on interface is better

if it is tie then highest OSPF router ID better

OSPF area :

stub area : block type 5 lsa entering into this area instead gets a default route from neighbor O*IA mark, along with inter area route, this is industry standard

totally stub area : block type 3 , 4 and 5 LSA entering to this area , this is Cisco proprietary , to enable this use 'area x no-summary’ on border router command

router gets only a default route o*IA.

not-so-stuby area : passes external (type 5) LSA via type 7 LSA to the backbone area 0 and once it passes not so stuby area converted by ABR, the LSAs shows as type 5

meaning external route . router receive a O*IA default route

OSPF does not use key chain method of authentication , it uses authentication on interface , support two type authentication , md5 and clear text .if we use ip OSPF authentication-key command , we are using clear text authentication.

OSPF routes type :

E1 : cost of route increments as it passes through the autonomous system .

E2 (default) : cost of route remain same as it passes through autonomous system this is default type for OSPF external route

use auto-cost reference bandwidth to adjust cost as require in OSPF process .

Default-information originate ' command will send a default route to the network o*E2 mark , router should have a static route, if there is no static route use ' default-information originate always ' command to advertise a default route.

EIGRP summary notes : CCNA/CCNP/CCIE

2010-12-13T19:06:00.000+04:00

EIGRP  :

It’s a hybrid protocol .

AS number has to match in all EIGRP router

EIGRP does not support VLSM by default , to support VLSM must use no auto-summary command

split horizon always on ,

EIGRP uses own protocol 88 and DUAL algorithm

EIGRP uses multicast address 224.0.0.10

EIGRP manual summary address command on interface creates a null 0 route on local router routing table , and it gives administrative distance of 5 to summary route .

EIGRP uses administrative distance 90 for normal routes and 170 for external routes

EIGRP will load balance across 4 equal cost path .by default unequal load balancing is off to enable unequal load balance use variance command with value .

EIGRP routers use query message to find backup route around the network ,

a router send query message to its neighbor for its connected network , even if it is goes down , which is unrealistic , because it is sending a query for its own network to a neighbor .

EIGRP (SIA ) stuck in active comes into play when a router wait to hear for a query , which is for 3 minute . and neighbor get re-initiated .

EIGRP stub , stub router does not receive a query message from neighbor. Stub command mostly used in hub-and-spoke network.

when EIGRP stub command applied in a router by default it will advertise summary and connected routes to its neighbor .

EIGRP stub receive-only command ,,,,,, only receives routes from neighbor does not send anything to its neighbor .

when a router goes down in EIGRP send a final hello message which is called good bye message ..

if we use neighbor command update are send through unicast , both neighbor have

to have neighbor command in place

if you use passive interface command , router will not exchange hellos , hence no neighbor relationship .

if u use split horizon on hub , to get the router from spoke to spoke

use neighbor command on all router .

EIGRP maintains a topology table , if a route goes down other route comes back from topology table

EIGRP does unequal cost load balancing

EIGRP router maintains 3 table : neighbor table , topology table , routing table ,

EIGRP table and terminology :

Feasible Distance (FD) : how far a route is from me (router)

Advertise Distance (AD) : how far a route is from my neighbor router

Successor : which goes to routing table meaning a primary path

Feasible Successor : backup route

Rule : to be consider a feasible successor the advertise distance must be less

than feasible distance of the successor . its a loop prevention mechanism

eigrp active : meaning bad route, router is trying to find an active route by sending query

eigrp passive : good route , everything ok

EIGRP uses 5 packet type for peering neighbor and route exchange:

hello : forms relationship

update : sends update to each other

query : asks about routes

reply : response to a query

ack : acknowledges the update, query , and reply messages .

EIGRP metric calculation :

by default metric based on bandwidth and delay

Bandwidth : can be configured manually on interface

Delay : can be configured manually on interface

reliability :

loading :

MTU :

ip default network ---- command flag a default route to its neighbor