Cisco SPAN, SNMP and Wireshark

Today I was assigned a task to find out and explain a certain network anomaly we are experiencing in our network. The mission started out to be a bandwidth monitoring task against a specific router. This router however was owned by a third party so we didn't have access to it. Simple enough, I started looking at the next hop from that router - the switch port it was connected which belonged to the company I was working for. Using a combination of SNMP and a nice graphing/monitoring tool called "intermapper" I was able to obtain a pretty graph with traffic going in and out of the interface.

Eventually, looking at the graph we pin pointed the time of the day which we saturated the pipe going out the router which was only a fractional T1 at 64K. However, on the graph we spotted some unexplainable traffic spikes occurring every 5 mins. We couldn't explain why such traffic would occur going out the interface to this router. This warranted for some deeper packet inspection.

Here we used something called the SPAN feature on a Cisco switch. SPAN is just another fancy name for port mirroring. Since we didn't want to impact the production network, we simply mirrored the port on the Cisco switch. The command was easy on our IOS C2960G:

In configuration terminal mode:
monitor session 1 source gi /24
monitor session 1 destination gi 0/1

The setting was straight forward, specify the source port to monitor and the destination port to dump the packets onto.

After that, plug the destination port to a workstation with wireshark aka ethereal and capture the packets! With Wireshark we can sniff whatever traffic that is traversing the interface with some useful statistics and summary reporting.

It turned out to be a strange broadcast to that vlan, resulting from a faulty application.

Layer 2 Best Practices

I think I should be stepping up my security practices. Here's an article that I came across summarized all the things one should know about Layer 2 security practices on Cisco switches.

http://www.networkworld.com/community/node/30682

Configuring VLAN in Linux

This link from the Redhat knowledge base talks all about it.

Here's the list of steps and pointers I had to go through.

1. Make sure that the 8021q module is loaded
modprobe 8021q

2. This step is important as it defines the vlan that it listens on
Make a new interface file named "ifcfg-ethX.Y" where
X - the interface it will listen on.
Y - is the VLAN ID.

Add this to the config file
VLAN=yes

3. Create the neccessary IP configurations on the new interface file

4. Make sure that physical interface file looks like this. In my case it's eth0
DEVICE=eth0
ONBOOT=yes

5. service network restart

6. Done!

How to do a HTTP POST with Curl

This page proves there are people out there who forget about the same things I forget.

Here's the POST I wanted to run today.

curl -d "platform=CHANNEL&processor_target=CERT&charge_type=PING" http://app01.qa.paygateway.com:31080/Quicksilver/

Cisco ASA/PIX Bandwidth limiting

Today, I got a chance to setup some bandwidth limit on our Firewall. The goal was to choke the speed of traffic going to our backup server to 250Mb/s. As our backup traffic goes through a firewall here's how I did it on the my ASA5520s

First Define the traffic I want to choke using an access-list:

access-list backup_traffic extended permit ip any host BACKUP01

Then create a policy map to and set the speed

policy-map backup_traffic
class backup_traffic
police input 250000000

Then apply the policy map on the interface

service-policy backup_traffic interface outside

All done! That was easy. There's a lot more you can do in terms of QoS on the PIX/ASA. All this information can be found on the cisco site.

Linux Search and Replace multiple files

I don't know how many times I've forgotten how to do this but here's the summary.

Objective: I have some text I want to modify in many files.

Solution: Using SED in a bash FOR loop

for a in `find . -name '*filename*'`; do sed 's/text1/textx2/g' $a > $a.bk; mv -f $a.bk $a; done;
.
In your FOR loop
Step 1: Find the files you want to modify
Step 2: Use sed to search and replace the contents and redirect it into a new file
Step 3: move the new file back to the old file
Step 4: close your loop with done

The trick I forgot here is I can put as many commands as I want in a FOR loop by using the ';' delimiter.

Also, as the '>' - redirect cannot be used to overwrite the current open file the trick is to split the operation into two; write to new file and then move back to old file.

Cisco ASA/PIX icmp handling

Just a quick note:

Internet Control Message Protocol (ICMP) pings and traceroute on the PIX Firewall are handled differently based on the version of PIX and ASA code.

Inbound ICMP through the PIX/ASA is denied by default. Outbound ICMP is permitted, but the incoming reply is denied by default.

Pings Inbound
Pings initiated from the outside, or another low security interface of the PIX, are denied be default. The pings can be allowed by the use of static and access lists or access lists alone

Pings Outbound
There are two options in PIX 7.x that allow inside users to ping hosts on the outside. The first option is to setup a specific rule for each type of echo message.

For example:

access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any source-quench
access-list 101 permit icmp any any unreachable
access-list 101 permit icmp any any time-exceeded
access-group 101 in interface outside

This allows only these return messages through the firewall when an inside user pings to an outside host. The other types of ICMP status messages might be hostile and the firewall blocks all other ICMP messages.

Another option is to configure ICMP inspection. This allows a trusted IP address to traverse the firewall and allows replies back to the trusted address only. This way, hosts on all inside interfaces can ping hosts on the outside and the firewall allows the replies to return. This also gives you the advantage of monitoring the ICMP traffic that traverses the firewall. In this example, icmp inspection is added to the default global inspection policy.

policy-map global_policy
class inspection_default
inspect icmp

For more detailed info visit: here