SHISHOLOGY

2014-10-06T14:10:00.001-04:00

Are your leaders struggling to make strategic choices and turn them into actionable plans?

www.reimerassociates.co.za

Reimer Associates can help your company get out of the numbers and into the bigger picture, making better strategic choices, better investments and a bigger bottom-line.

a boutique consultancy specializing in strategy, capabilities and change management for the FMCG and Banking sectors. Our focus is on providing facilitation, tools, frameworks and process to enable sustainable change in strategic and analytical approach.

www.reimerassociates.co.za

www.reimerassociates.co.za

www.reimerassociates.co.za

www.reimerassociates.co.za

Finding unused IP addresses

2013-07-04T03:41:00.002-04:00

A common issue when setting up a device or appliance is to find an open IP address on the subnet to use. This is usually because the subnet being used does not have a DHCP addressing scheme, usually this happens on subnets used for management, DMZ or servers.

Cisco switches and routers have a great feature, where we can ping the network address and from this see what comes back.

switch#ping 10.11.15.0

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.11.15.0, timeout is 2 seconds:

Reply to request 0 from 10.11.15.57, 1 ms

Reply to request 0 from 10.11.15.55, 17 ms

Reply to request 0 from 10.11.15.53, 8 ms

Reply to request 0 from 10.11.15.254, 1 ms

Reply to request 0 from 10.11.15.54, 1 ms

Reply to request 0 from 10.11.15.56, 1 ms

Reply to request 0 from 10.11.15.50, 1 ms

Reply to request 1 from 10.11.15.50, 1 ms

2013-06-26T08:58:00.002-04:00

Outputs

The Linux Bash is fortuantate enough to have hundreds of cli based tools for everyday tasks for the network engineer.

Getting the correct output, in a desired format is sometimes difficult though, we’ll go through a few:

MTR

My Trace Route is a great alternative to tracert or traceroute. Giving more parameters and creating a better understanding of the route between two points:

HOST: Something Loss% Snt Last Avg Best Wrst StDev

1.|-- 192.168.1.1 0.0% 10 2.3 4.4 1.4 14.3 4.0

2.|-- 10.11.36.254 0.0% 10 1.7 4.0 1.6 11.1 2.8

3.|-- 10.202.9.129 0.0% 10 2.9 4.7 2.4 11.3 2.6

4.|-- 192.168.24.2 90.0% 10 206.9 206.9 206.9 206.9 0.0

5.|-- 40.21.219.242 0.0% 10 3.1 45.2 2.1 272.9 82.6

6.|-- 196.25.253.109 0.0% 10 21.9 58.1 3.6 324.0 99.4

7.|-- 196.43.52.42 0.0% 10 14.8 52.8 3.6 359.7 108.8

8.|-- 196.43.26.106 0.0% 10 14.1 67.8 4.7 407.3 125.0

9.|-- 72.14.212.1 0.0% 10 24.3 62.9 12.8 345.9 102.0

10.|-- 64.233.174.57 0.0% 10 16.8 47.5 8.5 275.7 81.4

11.|-- 74.125.233.83 0.0% 10 31.3 34.9 6.0 201.8 59.1

To get the output into a text file:

home@Something:~$ mtr -n -r -c 10 www.google.com >> output.txt

This sends 10 packets, to google and writes the output into output.txt

This is slightly more difficult using NMap. It’s great tool that scans a range of IP’s or a single IP and shows everything from open ports to the OS and version.

It may be worth scripting something like this if you use it often; I have one script with a few options for what I need.

home@Something:~$ nmap 192.168.254.0/25 | awk 'NF==3 {printf("\"%s\",\"%s\",\"%s\"\n", $1, $2, $3);} NF!=3 {printf("\"%s\"\n",$0);}' >> mailserver.csv

2013-06-26T06:46:00.001-04:00

Wireless Tool set

Sometimes we have reason to find out more about the wireless infrastructure around us. This is simple to do since wireless AP’s transmit packets back to any queries and there is information contained in these packets.

In Ubuntu we’ll use a few tools

The first is found in the usual Ubuntu repos, and called wireless-tools

user@something:~$ sudo apt-get install wireless-tools

[sudo] password for user:

Reading package lists... Done

Building dependency tree

……….

The tool within wireless-tools is called iwlist:

user@something:~$iwlist scanning

wlan0 Scan completed :

Cell 01 - Address: C8:BB:B8:9D:0F:FF

Channel:1

Frequency:2.412 GHz (Channel 1)

Quality=55/70 Signal level=-55 dBm

Encryption key:on

ESSID:"Something"

Bit Rates:6 Mb/s; 9 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s

36 Mb/s; 48 Mb/s; 54 Mb/s

Mode:Master

Extra:tsf=000001bd2e28b71a

Extra: Last beacon: 81168ms ago

IE: Unknown: 000B5354532D5269766F6E6961

IE: Unknown: 01088C129824B048606C

IE: Unknown: 030101

IE: Unknown: 2A0100

IE: IEEE 802.11i/WPA2 Version 1

Group Cipher : CCMP

Pairwise Ciphers (1) : CCMP

Authentication Suites (1) : PSK

This gives us the SSID and the MAC Address of every AP your wireless NIC is within range of. Since the first 6 characters of a MAC Address are the OUI (Organizational Unique Identifier) of the device, we can also find the manufacturer of the AP.

To look in a little further we need to install aircrack-ng in order to put our NIC in monitoring mode:

home@something:~$ sudo apt-get install aircrack-ng

Reading package lists... Done

Building dependency tree

To then place the NIC in monitoring mode:

sudo airmon-ng start wlan0

We can then use Reaver to test the security of the AP: (since the installation process has a lot of output I will only list the inputs)

wget http://reaver-wps.googlecode.com/files/reaver-1.3.tar.gz

tar -xzvf reaver-1.3.tar.gz

sudo apt-get install libpcap-dev aircrack-ng sqlite3 libsqlite3-dev

cd reaver-1.3

cd src

./configure

make

sudo make install

Now we set Reaver to test the security of the AP , using the MAC Address we got using iwlist:

sudo reaver -i mon0 -b C8:BB:B8:9D:0F:FF

Various tools and policies can be implemented to secure your AP, I recommend a good password policy, using PSK, using a hidden SSID and if you’re a company implementing a network authentication solution.

2013-06-25T02:17:00.000-04:00

Tracking an IP in LAN

In anything other than a small network environment finding the computer with a specific IP is best done using DNS. This is provided the DNS entry shows the computer name and you know where that computer is.

Failing that we have to track down the IP from the switches.

Firstly on the core switch we have to look up the arp table:

SWITCH#sh arp 192.168.49.99

Protocol Address Age (min) Hardware Addr Type Interface

Internet 192.168.49.99 43 b846.3e60.9a1d ARPA Vlan111

Next we have to see which port the Mac Address is coming from

SWITCH#sh mac address-table address b846.3e60.9a1d

Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----

101 b846.3e60.9a1d DYNAMIC Gi1/1/1

Total Mac Addresses for this criterion: 1

Next we find out what is connected to the switch on that port

SWITCH#sh cdp neighbors detail | begin GigabitEthernet1/1/1

Interface: GigabitEthernet1/1/1, Port ID (outgoing port): GigabitEthernet1/1

Holdtime : 136 sec

Version :

Cisco IOS Software, C2960 Software (C2960-LANLITEK9-M), Version 12.2(55)SE5, RELEASE SOFTWARE (fc1)

Technical Support: http://www.cisco.com/techsupport

Compiled Thu 09-Feb-12 19:11 by prod_rel_team

advertisement version: 2

Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=00000000FFFFFFFF010221FF00000000000004DAD2205680FF0000

VTP Management Domain: 'STS'

Native VLAN: 1

Duplex: full

Power Available TLV:

Power request id: 0, Power management id: 1, Power available: 0, Power management level: -1

Management address(es):

IP address: 10.11.1.5

From this we see that there is a switch, a 2960 in this case, connected at that port and that the 2960’s management IP is 10.11.1.5. Repeating the same steps moving from the core into the distribution to the access layer we can locate the machine with the IP address we’re looking for.