Monday, 15 October 2018

snmp traps vs notification and pdu

This table gives the difference between the SNMPv1 and SNMPv2 traps.
SNMPv1 Trap and SNMPv2 Notification, notification is advance

TrapNotification
1. Contains agent address.
1. Does not contain agent address.
2. It has information about specific trap and generic trap value.
2. It has Trap OID in the second varbind.
3. It does not have error index and status.
3. It has error index and status.
4. Does not support confirmed trap.
4. Supports Confirmed Notification (INFORM).

 
SNMPv2 PDUs fixed this by introducing the notion of an INFORM, which is nothing more than an acknowledged TRAP.


SNMP Protocol data units (PDUs) 



PDU Type may be get, get next, set, trap










TC means TEXTUAL-CONVENTION

CISCO-SMI contain the first starting OID for cisco assigned by IANA.
----------------------snip ---------------------------
cisco MODULE-IDENTITY
LAST-UPDATED "9704090000Z"
ORGANIZATION "Cisco Systems, Inc."
CONTACT-INFO
" Cisco Systems
Customer Service

Postal: 170 West Tasman Drive
San Jose, CA  95134
USA

   Tel: +1 800 553-NETS

E-mail: cs-snmp@cisco.com"
DESCRIPTION
"The Structure of Management Information for the
Cisco enterprise."
REVISION      "9704090000Z"
DESCRIPTION
"Added ciscoPartnerProducts to generate sysObjectID
for partner platforms"

REVISION      "9505160000Z"
DESCRIPTION
"New oid assignments for Cisco REPEATER MIB and others."
REVISION      "9404262000Z"
DESCRIPTION
"Initial version of this MIB module."
::= { enterprises 9 } -- assigned by IANA


ciscoProducts OBJECT-IDENTITY
STATUS current
DESCRIPTION
"ciscoProducts is the root OBJECT IDENTIFIER from
which sysObjectID values are assigned.  Actual
values are defined in CISCO-PRODUCTS-MIB."
::= { cisco 1 }

local OBJECT-IDENTITY
STATUS current
DESCRIPTION
"Subtree beneath which pre-10.2 MIBS were built."
::= { cisco 2 }

temporary OBJECT-IDENTITY
STATUS current
DESCRIPTION
"Subtree beneath which pre-10.2 experiments were
placed."
::= { cisco 3 }
------------------------sniip---------------





TC MIB example 


----------------------- snip of TC MIB -----------------
CISCO-ENTITY-REDUNDANCY-TC-MIB DEFINITIONS ::= BEGIN

IMPORTS
     MODULE-IDENTITY            FROM SNMPv2-SMI
     TEXTUAL-CONVENTION         FROM SNMPv2-TC
     ciscoMgmt                  FROM CISCO-SMI
     ;

ciscoEntityRedunTcMIB MODULE-IDENTITY
    LAST-UPDATED    "200510010000Z"
    ORGANIZATION    "Cisco Systems, Inc."
    CONTACT-INFO
                    "Cisco Systems, Inc.
                     Customer Service
                     Postal: 170 W. Tasman Drive
                             San Jose, CA  95134-1706
                             USA
                     Tel: +1 800 553-NETS
                     Email: cs-ha@cisco.com"

    DESCRIPTION
        "This module defines the textual conventions used within
         Cisco Entity Redundancy MIBs.
         "
    REVISION      "200510010000Z"
    DESCRIPTION
         "The initial version of this MIB module."
    ::= { ciscoMgmt 494 }


-- Start of Textual Conventions
CeRedunType ::= TEXTUAL-CONVENTION
    STATUS       current
    DESCRIPTION
        "Defines the following group redundancy types:

         other(1)
           Indicates a type of redundancy which doesn't fall into
           any other listed category.

         yCable(2)
           A form of redundancy in which signals from a common line 
           are connected to ports on two redundant members using a 
           special Y-shaped splitter/combiner cable.  The receive 
           signals are split and fed to the receive ports on each 
           redundant member. The transmit signals are combined from 
           the transmit ports on each member. However, only the active
           redundant member transmits a signal, while the standby 
           member suppresses sending a signal into the Y-combiner.

         aps(3) 
           Automatic Protection Switching.  A form of redundancy 
           using redundant lines with one connected to the working 
           port on the primary member and the other connected to 
           the protection port on the secondary member.  APS 
           redundancy protects against line (or fiber) failures in 
           addition to protecting against port module hardware 
           failures.

         featureCard(4)
           The featureCard option is used when the module
           does not have external line interfaces. Examples are
           modules which provide packet processing, additional
           memory or even fans or power supplies.

         externalSwitch(5)
           A form of redundancy similar to yCable but using an
           external switch to select or direct the receive or 
           transmit signals from a common line to ports on 
           redundant members. Additional control (not provided in
           this general MIB) may be necessary in order to control
           and monitor the external switch.
         
         slotPair(6)
           Some platforms require the user to configure a slot-pair
           group in order to allow internal signals to be bridged to 
           redundant linecards in the slot-pair.  But redundancy groups
           would also need to be configured for contained entities, 
           such as ports. Switchovers should take place independently 
           for each contained entity (e.g. port).

           The slotPair groups support only basic group and member
           configuration including the primary/secondary designation.
           Switchovers may only be supported for the contained
           entity.  The primary/secondary roles of contained group 
           members must match the primary/secondary role of the 
           containing entity.
         
          cmts(7)
           redundancy is provided for Cable Modem Termination Systems.
        "
    SYNTAX      INTEGER {
                          other(1),
                          yCable(2),
                          aps(3),
                          featureCard(4),
                          externalSwitch(5),
                          slotPair(6),
                          cmts(7)
                        }


----------------------- snip of TC MIB -----------------


MIB example 

----------------------- snip of MIB -----------------
CISCO-ENTITY-REDUNDANCY-MIB DEFINITIONS ::= BEGIN

IMPORTS
     MODULE-IDENTITY, 
     NOTIFICATION-TYPE,
     OBJECT-TYPE,
     Gauge32, 
     Counter64, 
     Unsigned32,
     Integer32
                                    FROM SNMPv2-SMI
     RowStatus,
     TimeStamp,
     TruthValue,
     StorageType,
     AutonomousType
                                    FROM SNMPv2-TC
     SnmpAdminString
                                    FROM SNMP-FRAMEWORK-MIB
     PhysicalIndex
                                    FROM ENTITY-MIB
     InetAddressType,
     InetAddress
                                    FROM INET-ADDRESS-MIB
     MODULE-COMPLIANCE, 
     OBJECT-GROUP, 
     NOTIFICATION-GROUP
                                    FROM SNMPv2-CONF
     CeRedunType,
     CeRedunScope,
     CeRedunArch,
     CeRedunSwitchCommand,
     CeRedunMode,
     CeRedunMbrStatus,
     CeRedunStateCategories,
     CeRedunReasonCategories
                                    FROM CISCO-ENTITY-REDUNDANCY-TC-MIB
     ciscoMgmt                    
                                    FROM CISCO-SMI
     ;

ciscoEntityRedunMIB MODULE-IDENTITY
    LAST-UPDATED    "200510010000Z"
    ORGANIZATION    "Cisco Systems, Inc."
    CONTACT-INFO
                    "Cisco Systems, Inc.
                     Customer Service
                     Postal: 170 W. Tasman Drive
                             San Jose, CA  95134-1706
                             USA
                     Tel: +1 800 553-NETS
                     Email: cs-ha@cisco.com"

    DESCRIPTION
        "This management information module supports 
         configuration, control and monitoring of redundancy 
         protection for various kinds of components on 
         Cisco managed devices. 

         It is meant to be generic enough to handle basic 
         redundancy control and monitoring for many types of 
         redundant member components and redundancy architectures
         as long as there is an Entity MIB entPhysicalIndex and 
         entPhysicalVendorType assigned to each member component.

         It is designed so that the tables can be augmented in
         other extension MIBS which build upon this MIB by 
         adding additional objects that may be specific to a 
         particular type of redundancy or member component.

         This MIB can also be used in cases where some types of
         redundancy groups and members don't require explicit 
         user configuration. One example may be redundant fan
         assemblies. In those cases, the managed system should 
         internally assign group and member indexes, so that 
         it can provide read-only access to the group and member 
         tables. This allows MIB monitoring for these types of 
         redundant entities.
        "
    REVISION      "200510010000Z"
    DESCRIPTION
         "The initial version of this MIB module."
    ::= { ciscoMgmt 498 }

ciscoEntityRedunMIBNotifs OBJECT IDENTIFIER
    ::= { ciscoEntityRedunMIB 0 }

ciscoEntityRedunMIBObjects OBJECT IDENTIFIER
    ::= { ciscoEntityRedunMIB 1 }

ciscoEntityRedunMIBConform OBJECT IDENTIFIER
    ::= { ciscoEntityRedunMIB 2 }

--
-- Redundancy Group Tables
--
-- These tables allow managed systems to report information about 
-- the types of redundancy groups available on the reporting system.
-- They also allow configuration and monitoring of objects which
-- apply to each redundancy group.
--
ceRedunGroup   OBJECT IDENTIFIER ::= {ciscoEntityRedunMIBObjects 1 }

-- Redundancy Group Types Table
ceRedunGroupTypesTable OBJECT-TYPE
    SYNTAX      SEQUENCE OF CeRedunGroupTypesEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "This table lists the basic types of redundancy groups 
         supported on the managed device along with additional 
         information about each group type.
        "
    ::= {ceRedunGroup 1 }

ceRedunGroupTypesEntry OBJECT-TYPE
    SYNTAX      CeRedunGroupTypesEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
        "A conceptual row in the ceRedunGroupTypesTable."
    INDEX { ceRedunGroupTypeIndex }
    ::= {ceRedunGroupTypesTable 1 }

CeRedunGroupTypesEntry ::= SEQUENCE {
    ceRedunGroupTypeIndex              Unsigned32,
    ceRedunGroupTypeName               SnmpAdminString,
    ceRedunGroupCounts                 Gauge32,
    ceRedunNextUnusedGroupIndex        Unsigned32,
    ceRedunMaxMbrsInGroup              Unsigned32,
    ceRedunUsesGroupName               TruthValue,
    ceRedunGroupDefinitionChanged      TimeStamp
}

ceRedunGroupTypeIndex OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "An index assigned for each type of redundancy group supported 
         on a managed system that requires its own table listing 
         entPhysicalVendorTypes allowed as members for its groups.

         For instance, port groups have a different set of allowed
         entPhysicalVendorTypes than linecard groups. So each should 
         have a separate ceRedunGroupTypeIndex. 

         For this example, a command line interface may differentiate
         by using separate keywords (port-group versus linecard-group) 
         rather than exposing the ceRedunGroupTypeIndex to a user.
        "
    ::= { ceRedunGroupTypesEntry 1 }

ceRedunGroupTypeName OBJECT-TYPE
    SYNTAX      SnmpAdminString
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "The textual name of the redundancy group type.  The value
         of this object should be the name of the redundancy group 
         type assigned by the local device as it would appear
         for display commands entered at the device's `console'.
         Examples are port-group, linecard-group, fan-group, etc.
        "
    ::= { ceRedunGroupTypesEntry 2 }

ceRedunGroupCounts OBJECT-TYPE
    SYNTAX      Gauge32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "The current count of redundancy groups for a specific 
         ceRedunGroupTypeIndex. This count indicates the number 
         of rows in the ceRedunGroupTable for a specific 
         ceRedunGroupTypeIndex.
        "
    ::= { ceRedunGroupTypesEntry 3 }

ceRedunNextUnusedGroupIndex OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "The next unused group index available for configuring 
         a new redundancy group for this group type.

         In order to avoid unnecessary collisions between competing 
         management stations, `adjacent' retrievals of this object 
         should give different index values. 
         
         But in order to prevent leaks of unused indexes, it is 
         acceptable to cycle through and report unused indexes again 
         if all of the indexes have already been retrieved previously, 
         yet some remain unused.  So the retrieval of an index 
         should not be considered a permanent longterm reservation.

         If there are no more unused group indexes available, the 
         managed system should return 0. 
         
         Note: 0 may be an acceptable group index on some 
         managed systems.
        "
    ::= { ceRedunGroupTypesEntry 4 }

ceRedunMaxMbrsInGroup OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "The maximum number of primary plus secondary members allowed
         in a group for a specific ceRedunGroupTypeIndex. If only
         1:1 or 1+1 is supported, this should be 2.

         If the maximum number is unknown or not determinable, the 
         managed system should return 0.
        "
    ::= { ceRedunGroupTypesEntry 5 }

ceRedunUsesGroupName OBJECT-TYPE
    SYNTAX      TruthValue
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Boolean to indicate whether this type of redundancy group 
         uses the ceRedunGroupString object as a group name 
         identifier. If it is reported as 'true', the 
         ceRedunGroupString name must contain no internal spaces.

         If it's reported as 'false', the ceRedunGroupString object
         is just used as an optional description for the group
         rather than as the group name. 
        "
    ::= { ceRedunGroupTypesEntry 6 }

----------------------- snip of MIB -----------------


Friday, 7 September 2018

Private IP address

What is private IP address:

  • A private IP address is an IP address that's reserved for internal use behind a router or other Network Address Translation (NAT) device, apart from the public.

Which IP Addresses Are Private?

  • The Internet Assigned Numbers Authority (IANA) reserves the following IP address blocks for use as private IP addresses:
    • 10.0.0.0 to 10.255.255.255     ==> 16 million addresses
    • 172.16.0.0 to 172.31.255.255    ==> 1 million addresses
    • 192.168.0.0 to 192.168.255.255   ==>  65,000
  • Another range of private IP addresses is 169.254.0.0 to 169.254.255.255, but those addresses are for Automatic Private IP Addressing (APIPA) use only.
  • In 2012, the IANA allocated 4 million addresses of 100.64.0.0/10 for use in carrier-grade NAT environments.

Why using Private IP address:

  • IP address are limited, so private IP addresses provide an entirely separate set of addresses that still allow access on a network but without taking up a public IP address space.

Reserved IP Addresses

  • Another set of IP addresses that are restricted even further are called reserved IP addresses.
  • These are similar to private IP addresses in the sense that they can't be used for communicating on the greater internet, but they're even more restrictive than that.
  • The most famous reserved IP is 127.0.0.1. This address is called the loopback address and is used to test the network adapter or integrated chip.  
    • Technically, the entire range from 127.0.0.0 to 127.255.255.255 is reserved for loopback purposes but you'll almost never see anything but 127.0.0.1 used in the real world.
  • Addresses in the range from 0.0.0.0 to 0.255.255.255 are also reserved but don't do anything at all. If you're even able to assign a device an IP address in this range, it will not function properly no matter where on the network it's installed.
Source:
     https://www.lifewire.com/what-is-a-private-ip-address-2625970

Tuesday, 4 September 2018

Kernel: kernel running process or module details, conntrack & iptables



  • Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system.
  • A module can be configured as built-in or loadable.
  • To create a kernel moduld, you can read The Linux Kernel Module Programming Guide
  • A module can be configured as built-in or loadable. 
  •  For example,
    • One type of module is the device driver, which allows the kernel to access hardware connected to the system.
    • Without modules, we would have to build monolithic kernels and add new functionality directly into the kernel image.
    • Besides having larger kernels, this has the disadvantage of requiring us to rebuild and reboot the kernel every time we want new functionality.


Example:

:~$ lsmod | grep conn
nf_conntrack_ipv4      16384  1
nf_defrag_ipv4         16384  1 nf_conntrack_ipv4
nf_conntrack          106496  3 nf_nat,nf_nat_ipv4,nf_conntrack_ipv4

:~$ lsmod | grep iptab

iptable_nat            16384  1
nf_nat_ipv4            16384  1 iptable_nat
iptable_filter         16384  0
ip_tables              28672  2 iptable_filter,iptable_nat
x_tables               36864  4 ip_tables,xt_tcpudp,iptable_filter,xt_REDIRECT

~$ lsmod | grep nat
nf_nat_redirect        16384  1 xt_REDIRECT
iptable_nat            16384  1
nf_nat_ipv4            16384  1 iptable_nat
nf_nat                 24576  2 nf_nat_redirect,nf_nat_ipv4
nf_conntrack          106496  3 nf_nat,nf_nat_ipv4,nf_conntrack_ipv4
ip_tables              28672  2 iptable_filter,iptable_nat


machine:~$ modinfo nf_conntrack
filename:       /lib/modules/3.19.0-25-generic/kernel/net/netfilter/nf_conntrack.ko
license:        GPL
srcversion:     87BEFE2F26ECB852F6EF9EC
depends:
intree:         Y
vermagic:       3.19.0-25-generic SMP mod_unload modversions
signer:         Magrathea: Glacier signing key
sig_key:        6A:AA:11:D1:8C:2D:3A:40:B1:B4:DB:E5:BF:8A:D6:56:DD:F5:18:38
sig_hashalgo:   sha512
parm:           tstamp:Enable connection tracking flow timestamping. (bool)
parm:           acct:Enable connection tracking flow accounting. (bool)
parm:           nf_conntrack_helper:Enable automatic conntrack helper assignment (default 1) (bool)
parm:           expect_hashsize:uint

:~$ modinfo ip_tables
filename:       /lib/modules/3.19.0-25-generic/kernel/net/ipv4/netfilter/ip_tables.ko
description:    IPv4 packet filter
author:         Netfilter Core Team <coreteam@netfilter.org>
license:        GPL
srcversion:     44A16130862F8CA2ECA59D9
depends:        x_tables
intree:         Y
vermagic:       3.19.0-25-generic SMP mod_unload modversions
signer:         Magrathea: Glacier signing key
sig_key:        6A:AA:11:D1:8C:2D:3A:40:B1:B4:DB:E5:BF:8A:D6:56:DD:F5:18:38
sig_hashalgo:   sha512

machine:~$ modinfo nf_nat
filename:       /lib/modules/3.19.0-25-generic/kernel/net/netfilter/nf_nat.ko
license:        GPL
srcversion:     A7C7F33E2B7EFD16A2534DF
depends:        nf_conntrack
intree:         Y
vermagic:       3.19.0-25-generic SMP mod_unload modversions
signer:         Magrathea: Glacier signing key
sig_key:        6A:AA:11:D1:8C:2D:3A:40:B1:B4:DB:E5:BF:8A:D6:56:DD:F5:18:38
sig_hashalgo:   sha512

Wednesday, 22 August 2018

ftp server on ubuntu (vsftpd)

FTP server on Ubuntu

FTP server:

To install:

sudo apt install vsftpd

Anonymous FTP Configuration:

  • Go to this file sudo vi  /etc/vsftpd.conf  and change below

 anonymous_enable=Yes

File location:


cd /srv/ftp/


  •  copy our file into above location.
  • To restart the vsfpd server:

 sudo service vsftpd restart

 If we restart then only anonymous user will be take effect

From Client:

To connect:


ftp 172.31.141.47
username: anonymous
pwd   is just give enter(empty string)

------- snip ---------
Connected to 172.31.141.47.
220 (vsFTPd 3.0.2)
Name (172.31.141.47:labuser): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>
------------------ snip -------------

Command:


 ls -> to list remove server file
 !ls -> to list client VM file list.
 get file.txt  -> To download the file
 put file.txt  -> To upload the file to the server.
--------- snip of get ----------
ftp> get 210
local: 210 remote: 210
200 PORT command successful. Consider using PASV.
150 Opening BINARY mode data connection for 210 (45219860 bytes).
226 Transfer complete.
45219860 bytes received in 3.90 secs (11335.1 kB/s)
ftp>
--------- snip of get ----------


Thursday, 14 June 2018

How firefox is working & know the DNS ?

How firefox is working & know the DNS ?

  • How firefox know the DNS ?

    • /etc/resolv.conf file is used to inform to firefox about the DNS server ip address.
    • This file contain the list of DNS IP address, using this IP address firefox send the DNS request to get the IP for given web page(Eg: google.com)
    • resolv.conf is the name of a computer file used in various operating systems to configure the system's Domain Name System (DNS) resolver.

  • How firefox is working:

    • While user give "google.com" and enter, first it will check the cache, if it cache contain this then load from cache.
    • Suppose first time we are giving, then cache dont have this information.
    • So it tries to resolve the "google.com" string into an IP address,
    • To conver IP address, firefox uses the DNS protocol,
    • As mentioned above it will get the DNS IP address and request DNS for google IP address.
    • Once it get the google.com IP address, then it will start the session to that IP address using TCP syn,
    • Google will reply back with Ack+syn,
    • Again firefox replay the ACK, now 3 way handshake is over and it will get the page from google and will load.
    • Usually google.com doesn't give only one flow, many flows (connnection) will be used to load the single google page.

Wednesday, 11 April 2018

How to list and delete IPtables

How to list and delete iptables


  • To delete Input rules:
    • iptables -L -n -v --line-number
    • For example, if we want to delete the input rule that drops invalid packets, we can see that it's rule 3 of the INPUT chain. So we should run this command:
    • iptables -D INPUT 3
  • To delete POSTROUTING:
    • iptables -t nat -L -n -v --line-number
    • iptables -t nat -D POSTROUTING 2
    • --------------- snip -----------
      • Chain POSTROUTING (policy ACCEPT 57 packets, 4044 bytes)
      • num   pkts bytes target     prot opt in     out     source               destination
      • 1      670 42596 SNAT       all  --  *      br2     0.0.0.0/0            0.0.0.0/0            to:172.30.13.90
      • 2        0     0 SNAT       tcp  --  *      *       0.0.0.0/0            192.168.1.254        tcp dpt:80 to:192.168.1.99
    • ---------------snip ----------------
    • The above place line 2 is deleted.

Command to list the IPtables:

    • iptables -L -v
    • iptables -L
    • iptables -L -n  => For INPUT, FORWARD and OUTPUT-chains
    • iptables -L -t nat
    • iptables -t nat -L -n -v  -> to View nat rules

Friday, 6 April 2018

How to specify particular source address & port in iptables

How to specify particular source address & port in iptables:


  • Source ip (-s)
    • -s, --source address[/mask][,...]
  • Destination (-d)
    • -d, --destination address[/mask][,...]
  • Source Port:
    • --source-port,--sport [!] port[:port]
  • Destination port:
    • --destination-port,--dport [!] port[:port]
  • protocol
    • -p <protocol name, tcp, udp, icmp> 

Example:

iptables -t nat -A PREROUTING -p tcp -s 192.168.1.99 --sport 58902 -d 173.223.52.123 --dport 80 -j DNAT --to-destination 192.168.1.254:80