WiFi Edge

Welcome to my Blog !

I'm Steve Williams and this is a place where I like to share some thoughts about WiFi, security  and technology. You can also follow me on Twitter.    Thanks for the visit!

Portable Ubuntu: Linux under Windows

 

For a couple of years, I have been using Portable Ubuntu. This enables running Ubuntu Linux under Microsoft Windows. Thanks to Claudio Sanchez (@demonccc) who ported Ubuntu to CoLinux which is Windows based. I use it on several lab machines to perform testing. It is also portable as you can copy it onto a USB key and carry it with you and execute it from any Windows machine. Ideally, you would get a USB dongle of 8GB or more.

 

It is very easy to install. First, download Version_4 from the Portable Ubuntu Remix at Sourceforge.net. For example, file: Portable_Ubuntu_V4_slimLZM2_091311.exe

Then double click the executable file and it will unzip in its own folder. To start Portable Ubuntu, open the created folder and click on pubuntu.exe.

 

 

After a few seconds you should see a discrete application bar displaying at the top of your screen. You can hide it on the left or right hand side if you wish by clicking the left or right arrows on it.

 

Clicking on the Applications menu bar will display several application categories.

 

 

In the above window, I selected the Terminal app in which I ran the top command, here it is:

 

Now you must start feeling like home! From your Windows machine, start a command shell (cmd.exe) and you will be able to see the following processes, which represent your Portable Ubuntu environment. Use the 'tasklist' command:

pubuntu.exe                 7772 Console                 0     8,372 Ko
ccolinux-daemon.exe         8952 Console                 0     7,376 Ko
colinux-console-nt.exe      8220 Console                 0     2,848 Ko
colinux-slirp-net-daemon.   9776 Console                 0     3,496 Ko

To terminate Portable Ubuntu, simply click the large red button on the Application bar or type sudo shutdown -h now from the CLI.

Now a few customization tricks:

By default, Portable Ubuntu's interface is NATed on your Windows machine's interface. Its default IP address is 10.0.2.15 and you can ping it from your Windows box. Here is an example:

pubuntu@pubuntu:~$ ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:ee:ff:33:d3:1c
inet addr:10.0.2.15  Bcast:10.0.2.255  Mask:255.255.255.0
inet6 addr: fe80::2ff:75ff:fe39:d3c1/64 Scope:Link
UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
RX packets:10246 errors:0 dropped:0 overruns:0 frame:0
TX packets:15977 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1094200 (1.0 MB)  TX bytes:12289522 (12.2 MB)
Interrupt:10

My WiFi adapter's IP address:

Ethernet Adapter WiFi Intel Advanced-N 6200 AGN:
DNS Suffix : sudo.com
Description . . . . . . . . . . . : Intel(R) Centrino(R) Advanced-N 6200 AGN
MAC Adress . . . . . . . . .: 00-00-11-22-33-11
IP Adress. . . . . . . . . . . . : 192.168.1.110
Subnet Mask. . . . . . : 255.255.255.0
Default Gateway. . . . . . : 192.168.1.1
DHCP Server. . . . . . . . . . . : 192.168.1.1
DNS Server . . . . . . . . . .  : 192.168.1.1
Lease obtained . . . . . . . . . . . : December 12, 2011 18:44:41 PM
Lease expires. . . . . . . . . . : December 13, 2011 18:44:41 PM

 

Let's say that in your lab you wish to have a syslog server and an SSH server. By default, Portable Ubuntu has these two services enabled.

root      3657     1  0 21:01 ?        00:00:00 /usr/sbin/sshd -D
root      4283     1  0 21:01 ?        00:00:00 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid

 

pubuntu@pubuntu:~$ netstat -antu | grep -E ":22|:514"
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp6       0      0 :::22                   :::*                    LISTEN
udp        0      0 0.0.0.0:514             0.0.0.0:*

Note: in the above example, syslog-ng is being used, which is superior to the basic syslogd. Please visit my Wiki for more info.

 

In order to access these services, you need to change the coLinux configuration file located under the config\portable_ubuntu.conf file. Make sure the following port redirection directive is configured under the line network_mode=slirp:

ports_to_redirect=tcp:22:22/udp:514:514

 

To make this effective, you have to stop/start Portable Ubuntu. Next, from your Windows machine, check whether ports TCP 22 and UDP 514 are available:

C:\>netstat -an | findstr ":22 :514"
TCP    0.0.0.0:22             0.0.0.0:0              LISTENING
UDP    0.0.0.0:514            *:*

 

 

You can now point your lab gear syslog to your Windows machine IP address and it will  relay it to your Portable Ubuntu server. Idem for SSH, you need to ssh to your Windows box IP address in order to access your Pubuntu machine.

One last point, from Pubuntu, you can access your Windows machine files. Here is how to do it: change your directory to /media/cofs2. This takes you to your Windows root directory or C:\

Conclusion

If you need a Linux environment for your lab testing or even to practice LInux commands, then Portable Ubuntu is a great start. It is quite stable and even survives when my laptop resumes from sleep mode. Have fun!

 

 

Tip of the Week: Quick Windows Shutdown

 

Did you know you can quickly shutdown or reboot Microsoft Windows from the command line? Here is how to do it. Start a command shell (cmd.exe) and type the following commands:

Shutdown Windows

shutdown -s -t 0 -f

 

Reboot Windows

shutdown -r -t 0 -f

 

Parameter meaning:

-r  restart the computer

-s  shutdown the computer

-t 0  wait 0 seconds before shutdown

-f  force running applications to close

 

Using Desktop Shortcuts

You don't like using a command shell or seldomly use it? Good news, you can place a shortcut on your desktop containing the above commands. In one click, you will either shutdown or reboot your Windows system. In your newly created shortcut, set the Target value to:

For a quick shutdown:

C:\Windows\System32\shutdown.exe -s -t 00 -f

For a quick reboot:

C:\Windows\System32\shutdown.exe -r -t 00 -f

 

Bonus

You can also terminate hung applications (not responding) by storing the following value in the Target field of your shortcut:

C:\Windows\System32\taskkill.exe /f /fi "status eq not responding"

 

Enjoy!

 

Links of the Week - 2011-07-18

Here is a few interesting links for those who missed them:

Gartner MarketScope for Wireless LAN Intrusion Prevention Systems - A WIPS roundup with AirTight at the top

Using the Asus Eee Slate EP121 for Site Surveys - WiFi expert Chris Lyttle shares his views about using an Asus tablet for WiFi site surveys

Tablets Welcomed. Won’t BYOD increase my device troubleshooting costs? - Part 2 of the blog series. - Interesting video with Cisco NCS/WCS Product Manager Saurabh Bhasin.

Cisco Live! Brings Virtual Communities Together - WiFi expert Andrew vonNagy relates his week at Cisco Live! 2011 and the impact of social media and its value /  professional impact on virtual communities.

Cisco workforce Reduction of Approximately 6,500 Employees - Cisco Announces Additional Detail on Comprehensive Action Plan

Mac OS X 10.7 Lion: the Ars Technica review - Thorough review of the latest OS X release 

Upgrading to Mac OS X 10.7 Lion - Recommended Steps for Upgrading to Mac OS X 10.7 Lion, including a procedure to burn Lion onto a USB drive (make sure you do so before launching the Lion install)

Major Overhaul Makes OS X Lion King Of Security - Lion is an operating system with state-of-the-art security protections that make it more resistant to malware exploits and other hack attacks

IPexpert CCIE Written Video On Demand Series- WiFi expert Jennifer Huber describes her experience on recording material about CCIE Wireless Written Video On Demand series for IPexpert

What is an Ethernet Fabric ? - Greg Ferro, Network and Datacenter expert demystifies the term Switch Fabric. Also see his previous post: What is a Switch Network Fabric ?

 

 

 

 

Indoor MESH with Cisco AP 1131

The Lightweight Access Point Cisco 1131 is a two-radio Wi-Fi infrastructure device that can be used for indoor mesh deployments. It is a CAPWAP/LWAPP based product. It provides a 2.4 GHz radio and a 5.8 GHz radio compatible with 802.11b/g and 802.11a. One radio can be used for local (client) access for the access point (AP) and the second radio can be configured for wireless backhaul. The AP 1131 supports P2P, P2MP, and mesh type of architectures. Other Cisco indoor AP models are also mesh capable.

 

 

 

Indoor mesh is a subset of the Enterprise mesh architecture deployed on Unified Wireless architecture. With indoor mesh, one of the radios (typically 802.11b/g) and/or the wired Ethernet link is used to connect to clients, while the second radio (typically 802.11a) is used to backhaul client traffic. A mesh AP can be either a RAP (Root AP) or a MAP (Mesh AP). A RAP act as bridge between the controller and other wireless APs. A MAP connects to a RAP or a MAP over the air on a 802.11a radio and also services clients on a 802.11b/g radio.

 

Basic Mesh Configuration

The first step consists in setting the AP in bridge mode. After the AP reboots, set the AP role to RAP. This root AP has a wired connection with the WLC controller (through a switch).

 

In this example, we set the bridge group name to BG1, the backhaul interface is 802.11a and we let the data rate to auto.

 

Configure the next AP as a bridge and set its AP Role to MeshAP. A MAP does not have a wired connection to the WLC. It communicates with the WLC through a RAP. In this example, we set the bridge group name to BG1 (so it matches the RAP), the backhaul interface is 802.11a and we let the data rate to auto.

 

I checked the Mesh DCA Channels and let the rest default values. Next, you must configure the desired DCA channels under Wireless > 802.11a/n.

 

As a basic security measure, you need to provide the AP MAC Address of each RAP/MAP in the Local MAC Filters. Not doing so will prevent the MESH APs to come up.

 

Note: the AP MAC Address is the wired side MAC address.

 

 

 

Authenticating MESH APs with RADIUS

MAC Filtering does not scale well across multiple controllers and provides minimum security. You are better off using central authentication for all your Mesh APs. Cisco uses EAP-FAST to authenticate its mesh APs. Here is how to do it.

From the Mesh Security section, choose EAP, and check both External MAC Filter Authorization and Force External Authentication, Then check a RADIUS server from the list.

 

 

 

To setup your RADIUS server, please complete these 2 steps:

 

1. Configure EAP-FAST on the RADIUS server and install the certificates.

 

EAP-FAST authentication is required if mesh access points are connected to the controller using an 802.11a interface; the external RADIUS servers need to trust Cisco Root CA 2048. You must download the EAP-FAST certs from Cisco.com. For information about installing and trusting the CA certificates, see Configuring RADIUS Servers, Cisco Wireless Mesh Access Points, Design and Deployment Guide, Release 7.0

 

2. Configure MAC filters for MESH APs

 

For each RAP/MAP, you need to provide two credentials in RADIUS

- MAC filter / Password

- Username / Password

 

The MAC filter / password format are as follows:

AP_MAC_Address / AP_MAC_Address

 

Example:

001d451f5d22 / 001d451f5d22

 

User and password format are as follows:

AP_Model-AP_MAC_Address / AP_Model-AP_MAC_Address

 

Example:

C1130-001d451f5d22 / C1130-001d451f5d22

 

Note: the AP MAC Address is the wired side MAC address.

 

 

TIP: From this point, you no longer need Local MAC filtering for your MAPs. Please purge them from your WLC.

The following figure shows Cisco ACS Passed Authentications report for both the mesh AP MAC filter and the mesh AP username.

 

Conclusion

We covered the basics on how to use the Cisco AP 1131 to create an indoor mesh network. This can be useful for several reasons, such as extending a network where cabling is not always economical or for temporary work setups. MAC address filtering represents the least secure way of authenticating RAPs and MAPs. You should instead authenticate all APs with a RADIUS server. You may also want to authenticate the wired APs (RAP) using 802.1X, see my previous blog post for details.

 

 

802.1X Authentication for Cisco Lightweight Access Points

 

Several corporations are rolling out 802.1X at the access LAN switch level to prevent unauthorized access to their networks. Cisco IOS Software offers network access control at the media access level (layer 2) through implementation of the 802.1X protocol. 802.1X is an IEEE standard for media-level access control, offering the capability to permit or deny network connectivity, control VLAN access and apply traffic policy, based on user or machine identity. Cisco lightweight access points have an 802.1X supplicant to authenticate on the wired side. Let's examine how this can be achieved.

 

Configure LAN Switch Ports for 802.1X

The first step consists into implementing 802.1X authentication on the authenticator side or LAN switches. Here is a sample configuration:

aaa new-model

aaa authentication dot1x default group radius

radius-server host 10.199.200.71 auth-port 1812 acct-port 1813 key <yourkey>

 

dot1x system-auth-control

 

interface FastEthernet0/3

description WiFi Access Point with 802.1X Auth

switchport access vlan 200

switchport mode access

dot1x pae authenticator

authentication port-control auto

spanning-tree portfast

 

NOTE:  The port-control auto option says that once a device logs off, that switchport reverts to an unauthorized state

The above example only shows one LAN port. You need to repeat this for all ports in the switch.

 

Configure your RADIUS Server

Configure your RADIUS server with the user name and password you will specify in your WLC controller (Wireless > Radios > Global Configuration > 802.1X Supplicant Credentials)

 

Configure the Cisco WLC with the 802.1X Supplicant Credentials

From the following menu, configure your global 802.1X supplicant credentials

Wireless > Radios > Global Configuration > 802.1X Supplicant Credentials

 

 

Check 802.1x Authentication, then fill both the 802.1X username and password. These have a global significance and all LAPs that already joined that WLC will inherit these credentials. In the LAP's config, you will find a config snippet similar to this:

 

dot1x credentials lwapp_credentials

username 8021xglobal

password 010203040506070809

Please note that you can also implement per-AP credentials instead of global credentials.

 

Provisioning new LAPs

New LAPs will not be able to join the WLC if their wired switch port is configured for 802.1X. The easiest way to have them join that WLC is to disable 802.1X authentication on one switch port and let the LAP reboot. It will then inherit its new configuration, including the 802.1X credentials. Next, enable 802.1X authentication on the switch port. Another way is to 'prime' your LAPs in a lab with these 802.1X credentials.

 

Conclusion

Implementing 802.1X on the wired side of your network reinforces your overall network security. With a few mouse clicks, you can configure 802.1X supplicant credentials for all your Cisco lightweight access points from a central location.

 

5 Ways To Save Time with CLI Using Aliases

As a network admin, typing the same commands over and over can get tedious. With the use of aliases, you can get more done in less time. Let's examine some of the most popular CLI (command line interfaces) and how they implement aliasing.

 

Cisco IOS

Cisco routers and switches running IOS (not CatOS) implement the alias exec command. Here are some examples:

show ip route
alias exec sir show route

show ip interface brief
alias exec siib show ip interface brief

configure terminal
alias exec ct config term

show running-config
alias exec sr show running

copy running-config startup-config
alias exec cp copy running start

Equivalent of a Linux grep command
alias exec g show running-config | i

show CPU processes and exclude all those with 0% usage:
alias exec cpu sh proc cpu | e 0.00%

 

 

Cisco ASA Firewall

Cisco ASA Firewalls implement the command-alias command to enable you to create aliases.

show running-config
command-alias exec sr show running

configure terminal
command-alias exec ct config term

show interface ip brief (notice the inversion here compared with its IOS cousin)
command-alias exec siib show int ip brie

show ip route
command-alias exec sir sh route

Equivalent of a Linux grep command
command-alias exec g show running-config | i

show vpn session database detail for LAN-to-LAN
command-alias exec vpnl show vpn-sessiondb detail l2l

show vpn session database with full index 
command-alias exec vpnf show vpn-sessiondb detail full index 1

 

Linux / Unix /Mac OS X

Mac OS X and the *nixes of this world all have different kind of shells. The one I use is BASH shell. I store all my favorite aliases in a hidden file called .bashrc which get read at shell creation. Here is some of them:

clear the display
alias k='clear'

Issue the ping command
alias p='ping'

Issue the traceroute command
alias t='traceroute'

List the directory, long form
alias ll='ls -l'

List the directory, long form and pause
alias llm='ls -l | more'

List the directory, long form with the most recent entries first and pause
alias lltm='ls -lt | more'

 

Windows Command Shell

Under Microsoft Windows, you can implement something similar to aliases with the doskey command. You can store all of these in a batch file which gets executed at startup. Then, execute the cmd.exe command to start a command shell and type your aliases when needed. Here is a few examples:

Clear the display
doskey k=cls

Display your IP address
doskey ip=ipconfig /all

Display the running processes
doskey pef=tasklist

Find a specific process among the running processes, e.g., peff cmd.exe
doskey peff=tasklist $b findstr /i $1

Display the running services
doskey svc=sc query

Find a specific service among the running services
doskey svcc=sc query $b findstr /i "$1"

Stop a running process, e.g., ki word.exe
doskey ki=wmic process where name="$1" delete

Equivalent of a Linux grep command
doskey g=findstr /i "$1"

Exit the command shell
doskey q=exit

 

TextExpander

You can also use TextExpander and set your aliases in there instead of configuring your network gear with them. This tool enables you to have a portable set of aliases on your MacBook. Some CLI interfaces do not support aliases, I am thinking to Cisco WLC (Wireless LAN Controller). If you do lots of WLC CLI stuff, you could save keystrokes by using TextExpander.

 

Conclusion

Several operating systems implement aliases in some form and using them will help you save time and type faster under your CLI.

Dynamically Display your WiFi IP Address on MAC OS X

 

I do lots of WiFi lab work using my MacBook PRO. IP addresses keep changing and the easiest way for me to display my current IP is to launch a terminal session and type the command: ifconfig -a. You can also use MacBook's system preferences > network > select your airport adapter > click advanced > click TCP/IP tab. But this is kind of tedious.

The ifconfig command will actually list all interfaces and their corresponding IP addresses, if configured. To get rid of the clutter, I use the ifconfig en1 command, which simply lists my WiFi interface, as follows:

ifconfig en1
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 58:b0:35:6a:61:be 
inet 192.168.1.101 netmask 0xffffff00 broadcast 192.168.1.255
media: autoselect
status: active

This results in a 5 line output, which is too much. All I need is the IP address field. Let's refine this with the following command:

ifconfig en1 | grep inet
inet 192.168.1.101 netmask 0xffffff00 broadcast 192.168.1.255

This time, it only displayed the third line, looks good, but not enough. Lets print the IP address only:

ifconfig en1 | grep inet | cut -d " " -f2
192.168.1.101

You noticed the cut command uses a space as delimiter (-d " ") and prints field number 2 (-f2)

Now the fun part, let's use the watch command to dynamically display the WiFi interface IP address:

watch -d2 'ifconfig en1 | grep inet | cut -d" " -f2'

After you execute this command, your terminal session display will clear and only display IP address updates every 2 seconds. (parameter -d2). If we take this one step further, you can create an alias to invoke this command when needed. Here is an alias called ipwatch that I stored in my .bashrc file:

alias ipwatch="watch -d2 'ifconfig en1 | grep inet | cut -d\" \" -f2'"

You probably noticed that I added backslashes before the double quotes after the cut command. This is to prevent shell expansion. Now, all you have to do is to type ipwatch and watch you IP address updating dynamically.

If you do not have the watch command installed in your MAC OS X system, you can add it using MacPorts. In a previous blog I describe how to install MacPorts on your MacBook. Just make sure you download the latest MacPorts version for your platform.

As an alternative, if you do not want to install MacPorts, you can create a loop in your terminal session with the while command. Here is an example

while ifconfig en1 | grep inet | cut -d" " -f2; do sleep 2; done

Use the following ipwatch alias form in you .bashrc file:

alias ipwatch="while ifconfig en1 | grep inet | cut -d\" \" -f2; do sleep 2; done"

Whenever you type ipwatch, your WiFi IP will display every 2 seconds, 1 per line. Hit control-c to stop.

 

Conclusion

Dynamically displaying your WiFi IP address from a terminal shell command line is easy and efficient. Using shell aliases can help simplify this task further.

 

 

iPhone Personal HotSpot & Co-Channel Interference

 

I recently updated my iPhone 4 from iOS 4.2 to iOS 4.3. This update introduces Apple's Personal Hotspot, which turns your iPhone into a WiFi access point. In this mode, your iPhone can associate with up to 3 clients. These will be able to share your Internet 3G connection as depicted in the following figure:

 

While in Hotspot mode, the iPhone can also associate to an AP as a WiFi client. In that case, the iPhone is both a WiFi AP and a WiFi client:

 

By default, the iPhone will use channel 1 in the 2.4 GHz frequency band. Now, let's suppose a nearby AP already uses channel 1, the iPhone avoidance mechanism will select channel 2. In the following picture, the iPhone has SSID <iPhone> on channel 2 while my other AP has SSID <axtnet> on channel 1. Why not use channel 6 or 11 instead?

 

 

Adding another AP on channel 2 (SSID APN) made the iPhone HotSpot function to bump its frequency up to channel 3.

 

Conclusion

WLAN design best practices state that we must use non-overlapping channels in the 2.4 GHz band (1, 6 and 11). Otherwise the WLAN is subject to 802.11 co-channel interference. It does not seem that Apple followed these rules in their iPhone Personal HotSpot implementation. But this feature can become handy in certain situations.

 

Using ASDM for Firewall Troubleshooting

 

A client recently contacted me regarding a problem he attributed to his Cisco ASA firewall. The problem prevented encrypted email traffic out on the Internet. The encryption used to access Gmail's servers was TLS / STARTTLS on port TCP 587.

For this troubleshooting session, I used ASDM (ASA graphical tool for 550x firewalls). First, I conducted a 'Packet Tracer' to source IP 172.27.0.32 (server issuing the e-mail). A packet trace simulates the forwarding of a data packet, with the TCP / UDP port of your choice, and with the source and destination addresses of your choice. In this instance, the destination smtp.gmail.com is resolved to 74.125.93.109 and TCP port of destination was 587. All this from the COR interface (inside). As depicted in the following figure, the packet passed all the checks between the interface COR (inside) and PUB (outside). Green check marks indicate success for each phase, like ACLs, NAT, etc.

 

The above results confirms that type of traffic is allowed through the firewall. At this point, I began suspecting the client's Windows server.

ASDM provides a tool called 'real time log viewer'. It lets you view the logging in the ASA in real time (this feature has been available forever), but in addition you can filter by IP address, source / destination port, etc.. There is even an option 'Build Filter' which helps to build the filter conditions, similar to Wireshark. The following figure illustrates several connection attempts to smtp.gmail.com (IP 74.125.93.109) with the server's source IP (172.27.0.32) to TCP ports 80, 58, 586, 587. All these connections passed through the firewall, except for port 587. At that moment, I concluded that port 587 was blocked at the client's server. After investigation, I found that a newly installed anti-virus package denied certain types of traffic. I circumvented the rule in the anti-virus software and traffic for TCP port 587 began to forward, as observed in the last logging entry (log entries are listed in descending chronological order).

 

Conclusion

I have often witnessed connectivity problems in client servers due to Windows Firewall service. Recently, anti-virus software caused a similar connectivity problem. ASDM real time log viewer added value in the troubleshooting process. If you are using a Cisco ASA firewall, I recommend installing ASDM on at least one of your Windows servers sitting behind the firewall. This tool is free and easy to use.

 

 

Two Top Network Bloggers

At the conclusion of Wireless Field Day, most delegates were returning home, except for three of us who stayed one extra day in San Jose. Coincidence you will say, I spent a great deal of Saturday with two top network bloggers. Andrew von Naggy (@revolutionwifi) and Greg Ferro (@etherealmind). As you may have noticed, these folks can crunch large quantities of high quality of blog posts on a regular basis. And I enjoy reading them. I had an opportunity to learn quite a few tricks from them, tools, blogging approach, time management and discipline.

Funny enough, the three of us do use a MacBook. I also noticed that a majority of the WFD delegates do use a MacBook as well. Is this because it is trendy ? I don't think so. MacBooks just work ! Top bloggers like Andrew and Greg are efficient, and they use efficient tools too ! Greg showed me great pieces of software that can help better concentrate on the writing task. No matter which hardware/software you use, these will only help you get the results done faster. They are not a substitute to creativity, discipline and focus. And this is what these top bloggers have in common.