I'm Steve Williams and this is a place where I like to share some thoughts about WiFi, security and technology. You can also follow me on Twitter. Thanks for the visit!
I'm Steve Williams and this is a place where I like to share some thoughts about WiFi, security and technology. You can also follow me on Twitter. Thanks for the visit!
Posted at 00:19 | Permalink | Comments (0)
For a couple of years, I have been using Portable Ubuntu. This enables running Ubuntu Linux under Microsoft Windows. Thanks to Claudio Sanchez (@demonccc) who ported Ubuntu to CoLinux which is Windows based. I use it on several lab machines to perform testing. It is also portable as you can copy it onto a USB key and carry it with you and execute it from any Windows machine. Ideally, you would get a USB dongle of 8GB or more.
It is very easy to install. First, download Version_4 from the Portable Ubuntu Remix at Sourceforge.net. For example, file: Portable_Ubuntu_V4_slimLZM2_091311.exe
Then double click the executable file and it will unzip in its own folder. To start Portable Ubuntu, open the created folder and click on pubuntu.exe.
After a few seconds you should see a discrete application bar displaying at the top of your screen. You can hide it on the left or right hand side if you wish by clicking the left or right arrows on it.
Clicking on the Applications menu bar will display several application categories.
In the above window, I selected the Terminal app in which I ran the top command, here it is:
Now you must start feeling like home! From your Windows machine, start a command shell (cmd.exe) and you will be able to see the following processes, which represent your Portable Ubuntu environment. Use the 'tasklist' command:
pubuntu.exe 7772 Console 0 8,372 Ko
ccolinux-daemon.exe 8952 Console 0 7,376 Ko
colinux-console-nt.exe 8220 Console 0 2,848 Ko
colinux-slirp-net-daemon. 9776 Console 0 3,496 Ko
To terminate Portable Ubuntu, simply click the large red button on the Application bar or type sudo shutdown -h now from the CLI.
Now a few customization tricks:
By default, Portable Ubuntu's interface is NATed on your Windows machine's interface. Its default IP address is 10.0.2.15 and you can ping it from your Windows box. Here is an example:
pubuntu@pubuntu:~$ ifconfig eth0
eth0 Link encap:Ethernet HWaddr 00:ee:ff:33:d3:1c
inet addr:10.0.2.15 Bcast:10.0.2.255 Mask:255.255.255.0
inet6 addr: fe80::2ff:75ff:fe39:d3c1/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:10246 errors:0 dropped:0 overruns:0 frame:0
TX packets:15977 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1094200 (1.0 MB) TX bytes:12289522 (12.2 MB)
Interrupt:10
My WiFi adapter's IP address:
Ethernet Adapter WiFi Intel Advanced-N 6200 AGN:
DNS Suffix : sudo.com
Description . . . . . . . . . . . : Intel(R) Centrino(R) Advanced-N 6200 AGN
MAC Adress . . . . . . . . .: 00-00-11-22-33-11
IP Adress. . . . . . . . . . . . : 192.168.1.110
Subnet Mask. . . . . . : 255.255.255.0
Default Gateway. . . . . . : 192.168.1.1
DHCP Server. . . . . . . . . . . : 192.168.1.1
DNS Server . . . . . . . . . . : 192.168.1.1
Lease obtained . . . . . . . . . . . : December 12, 2011 18:44:41 PM
Lease expires. . . . . . . . . . : December 13, 2011 18:44:41 PM
Let's say that in your lab you wish to have a syslog server and an SSH server. By default, Portable Ubuntu has these two services enabled.
root 3657 1 0 21:01 ? 00:00:00 /usr/sbin/sshd -D
root 4283 1 0 21:01 ? 00:00:00 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
pubuntu@pubuntu:~$ netstat -antu | grep -E ":22|:514"
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp6 0 0 :::22 :::* LISTEN
udp 0 0 0.0.0.0:514 0.0.0.0:*
Note: in the above example, syslog-ng is being used, which is superior to the basic syslogd. Please visit my Wiki for more info.
In order to access these services, you need to change the coLinux configuration file located under the config\portable_ubuntu.conf file. Make sure the following port redirection directive is configured under the line network_mode=slirp:
ports_to_redirect=tcp:22:22/udp:514:514
To make this effective, you have to stop/start Portable Ubuntu. Next, from your Windows machine, check whether ports TCP 22 and UDP 514 are available:
C:\>netstat -an | findstr ":22 :514"
TCP 0.0.0.0:22 0.0.0.0:0 LISTENING
UDP 0.0.0.0:514 *:*
You can now point your lab gear syslog to your Windows machine IP address and it will relay it to your Portable Ubuntu server. Idem for SSH, you need to ssh to your Windows box IP address in order to access your Pubuntu machine.
One last point, from Pubuntu, you can access your Windows machine files. Here is how to do it: change your directory to /media/cofs2. This takes you to your Windows root directory or C:\
Conclusion
If you need a Linux environment for your lab testing or even to practice LInux commands, then Portable Ubuntu is a great start. It is quite stable and even survives when my laptop resumes from sleep mode. Have fun!
Posted at 22:13 in Linux, Windows | Permalink | Comments (0)
Did you know you can quickly shutdown or reboot Microsoft Windows from the command line? Here is how to do it. Start a command shell (cmd.exe) and type the following commands:
Shutdown Windows
shutdown -s -t 0 -f
Reboot Windows
shutdown -r -t 0 -f
Parameter meaning:
-r restart the computer
-s shutdown the computer
-t 0 wait 0 seconds before shutdown
-f force running applications to close
Using Desktop Shortcuts
You don't like using a command shell or seldomly use it? Good news, you can place a shortcut on your desktop containing the above commands. In one click, you will either shutdown or reboot your Windows system. In your newly created shortcut, set the Target value to:
For a quick shutdown:
C:\Windows\System32\shutdown.exe -s -t 00 -f
For a quick reboot:
C:\Windows\System32\shutdown.exe -r -t 00 -f
Bonus
You can also terminate hung applications (not responding) by storing the following value in the Target field of your shortcut:
C:\Windows\System32\taskkill.exe /f /fi "status eq not responding"
Enjoy!
Posted at 08:27 | Permalink | Comments (0)
Here is a few interesting links for those who missed them:
Gartner MarketScope for Wireless LAN Intrusion Prevention Systems - A WIPS roundup with AirTight at the top
Using the Asus Eee Slate EP121 for Site Surveys - WiFi expert Chris Lyttle shares his views about using an Asus tablet for WiFi site surveys
Tablets Welcomed. Won’t BYOD increase my device troubleshooting costs? - Part 2 of the blog series. - Interesting video with Cisco NCS/WCS Product Manager Saurabh Bhasin.
Cisco Live! Brings Virtual Communities Together - WiFi expert Andrew vonNagy relates his week at Cisco Live! 2011 and the impact of social media and its value / professional impact on virtual communities.
Cisco workforce Reduction of Approximately 6,500 Employees - Cisco Announces Additional Detail on Comprehensive Action Plan
Mac OS X 10.7 Lion: the Ars Technica review - Thorough review of the latest OS X release
Upgrading to Mac OS X 10.7 Lion - Recommended Steps for Upgrading to Mac OS X 10.7 Lion, including a procedure to burn Lion onto a USB drive (make sure you do so before launching the Lion install)
Major Overhaul Makes OS X Lion King Of Security - Lion is an operating system with state-of-the-art security protections that make it more resistant to malware exploits and other hack attacks
IPexpert CCIE Written Video On Demand Series- WiFi expert Jennifer Huber describes her experience on recording material about CCIE Wireless Written Video On Demand series for IPexpert
What is an Ethernet Fabric ? - Greg Ferro, Network and Datacenter expert demystifies the term Switch Fabric. Also see his previous post: What is a Switch Network Fabric ?
Posted at 06:17 in Wireless | Permalink | Comments (0)
The Lightweight Access Point Cisco 1131 is a two-radio Wi-Fi infrastructure device that can be used for indoor mesh deployments. It is a CAPWAP/LWAPP based product. It provides a 2.4 GHz radio and a 5.8 GHz radio compatible with 802.11b/g and 802.11a. One radio can be used for local (client) access for the access point (AP) and the second radio can be configured for wireless backhaul. The AP 1131 supports P2P, P2MP, and mesh type of architectures. Other Cisco indoor AP models are also mesh capable.
Indoor mesh is a subset of the Enterprise mesh architecture deployed on Unified Wireless architecture. With indoor mesh, one of the radios (typically 802.11b/g) and/or the wired Ethernet link is used to connect to clients, while the second radio (typically 802.11a) is used to backhaul client traffic. A mesh AP can be either a RAP (Root AP) or a MAP (Mesh AP). A RAP act as bridge between the controller and other wireless APs. A MAP connects to a RAP or a MAP over the air on a 802.11a radio and also services clients on a 802.11b/g radio.
The first step consists in setting the AP in bridge mode. After the AP reboots, set the AP role to RAP. This root AP has a wired connection with the WLC controller (through a switch).
In this example, we set the bridge group name to BG1, the backhaul interface is 802.11a and we let the data rate to auto.
Configure the next AP as a bridge and set its AP Role to MeshAP. A MAP does not have a wired connection to the WLC. It communicates with the WLC through a RAP. In this example, we set the bridge group name to BG1 (so it matches the RAP), the backhaul interface is 802.11a and we let the data rate to auto.
I checked the Mesh DCA Channels and let the rest default values. Next, you must configure the desired DCA channels under Wireless > 802.11a/n.
As a basic security measure, you need to provide the AP MAC Address of each RAP/MAP in the Local MAC Filters. Not doing so will prevent the MESH APs to come up.
Note: the AP MAC Address is the wired side MAC address.
MAC Filtering does not scale well across multiple controllers and provides minimum security. You are better off using central authentication for all your Mesh APs. Cisco uses EAP-FAST to authenticate its mesh APs. Here is how to do it.
From the Mesh Security section, choose EAP, and check both External MAC Filter Authorization and Force External Authentication, Then check a RADIUS server from the list.
To setup your RADIUS server, please complete these 2 steps:
1. Configure EAP-FAST on the RADIUS server and install the certificates.
EAP-FAST authentication is required if mesh access points are connected to the controller using an 802.11a interface; the external RADIUS servers need to trust Cisco Root CA 2048. You must download the EAP-FAST certs from Cisco.com. For information about installing and trusting the CA certificates, see Configuring RADIUS Servers, Cisco Wireless Mesh Access Points, Design and Deployment Guide, Release 7.0
2. Configure MAC filters for MESH APs
For each RAP/MAP, you need to provide two credentials in RADIUS
- MAC filter / Password
- Username / Password
The MAC filter / password format are as follows:
AP_MAC_Address / AP_MAC_Address
Example:
001d451f5d22 / 001d451f5d22
User and password format are as follows:
AP_Model-AP_MAC_Address / AP_Model-AP_MAC_Address
Example:
C1130-001d451f5d22 / C1130-001d451f5d22
Note: the AP MAC Address is the wired side MAC address.
TIP: From this point, you no longer need Local MAC filtering for your MAPs. Please purge them from your WLC.
The following figure shows Cisco ACS Passed Authentications report for both the mesh AP MAC filter and the mesh AP username.
We covered the basics on how to use the Cisco AP 1131 to create an indoor mesh network. This can be useful for several reasons, such as extending a network where cabling is not always economical or for temporary work setups. MAC address filtering represents the least secure way of authenticating RAPs and MAPs. You should instead authenticate all APs with a RADIUS server. You may also want to authenticate the wired APs (RAP) using 802.1X, see my previous blog post for details.
Posted at 22:28 in Wireless | Permalink | Comments (0)
Several corporations are rolling out 802.1X at the access LAN switch level to prevent unauthorized access to their networks. Cisco IOS Software offers network access control at the media access level (layer 2) through implementation of the 802.1X protocol. 802.1X is an IEEE standard for media-level access control, offering the capability to permit or deny network connectivity, control VLAN access and apply traffic policy, based on user or machine identity. Cisco lightweight access points have an 802.1X supplicant to authenticate on the wired side. Let's examine how this can be achieved.
The first step consists into implementing 802.1X authentication on the authenticator side or LAN switches. Here is a sample configuration:
aaa new-model
aaa authentication dot1x default group radius
radius-server host 10.199.200.71 auth-port 1812 acct-port 1813 key <yourkey>
dot1x system-auth-control
interface FastEthernet0/3
description WiFi Access Point with 802.1X Auth
switchport access vlan 200
switchport mode access
dot1x pae authenticator
authentication port-control auto
spanning-tree portfast
NOTE: The port-control auto option says that once a device logs off, that switchport reverts to an unauthorized state
The above example only shows one LAN port. You need to repeat this for all ports in the switch.
Configure your RADIUS server with the user name and password you will specify in your WLC controller (Wireless > Radios > Global Configuration > 802.1X Supplicant Credentials)
From the following menu, configure your global 802.1X supplicant credentials
Wireless > Radios > Global Configuration > 802.1X Supplicant Credentials
Check 802.1x Authentication, then fill both the 802.1X username and password. These have a global significance and all LAPs that already joined that WLC will inherit these credentials. In the LAP's config, you will find a config snippet similar to this:
dot1x credentials lwapp_credentials
username 8021xglobal
password 010203040506070809
Please note that you can also implement per-AP credentials instead of global credentials.
New LAPs will not be able to join the WLC if their wired switch port is configured for 802.1X. The easiest way to have them join that WLC is to disable 802.1X authentication on one switch port and let the LAP reboot. It will then inherit its new configuration, including the 802.1X credentials. Next, enable 802.1X authentication on the switch port. Another way is to 'prime' your LAPs in a lab with these 802.1X credentials.
Implementing 802.1X on the wired side of your network reinforces your overall network security. With a few mouse clicks, you can configure 802.1X supplicant credentials for all your Cisco lightweight access points from a central location.
Posted at 07:05 in Security, Wireless | Permalink | Comments (0)
As a network admin, typing the same commands over and over can get tedious. With the use of aliases, you can get more done in less time. Let's examine some of the most popular CLI (command line interfaces) and how they implement aliasing.
Cisco routers and switches running IOS (not CatOS) implement the alias exec command. Here are some examples:
show ip route
alias exec sir show route
show ip interface brief
alias exec siib show ip interface brief
configure terminal
alias exec ct config term
show running-config
alias exec sr show running
copy running-config startup-config
alias exec cp copy running start
Equivalent of a Linux grep command
alias exec g show running-config | i
show CPU processes and exclude all those with 0% usage:
alias exec cpu sh proc cpu | e 0.00%
Cisco ASA Firewalls implement the command-alias command to enable you to create aliases.
show running-config
command-alias exec sr show running
configure terminal
command-alias exec ct config term
show interface ip brief (notice the inversion here compared with its IOS cousin)
command-alias exec siib show int ip brie
show ip route
command-alias exec sir sh route
Equivalent of a Linux grep command
command-alias exec g show running-config | i
show vpn session database detail for LAN-to-LAN
command-alias exec vpnl show vpn-sessiondb detail l2l
show vpn session database with full index
command-alias exec vpnf show vpn-sessiondb detail full index 1
Mac OS X and the *nixes of this world all have different kind of shells. The one I use is BASH shell. I store all my favorite aliases in a hidden file called .bashrc which get read at shell creation. Here is some of them:
clear the display
alias k='clear'
Issue the ping command
alias p='ping'
Issue the traceroute command
alias t='traceroute'
List the directory, long form
alias ll='ls -l'
List the directory, long form and pause
alias llm='ls -l | more'
List the directory, long form with the most recent entries first and pause
alias lltm='ls -lt | more'
Under Microsoft Windows, you can implement something similar to aliases with the doskey command. You can store all of these in a batch file which gets executed at startup. Then, execute the cmd.exe command to start a command shell and type your aliases when needed. Here is a few examples:
Clear the display
doskey k=cls
Display your IP address
doskey ip=ipconfig /all
Display the running processes
doskey pef=tasklist
Find a specific process among the running processes, e.g., peff cmd.exe
doskey peff=tasklist $b findstr /i $1
Display the running services
doskey svc=sc query
Find a specific service among the running services
doskey svcc=sc query $b findstr /i "$1"
Stop a running process, e.g., ki word.exe
doskey ki=wmic process where name="$1" delete
Equivalent of a Linux grep command
doskey g=findstr /i "$1"
Exit the command shell
doskey q=exit
You can also use TextExpander and set your aliases in there instead of configuring your network gear with them. This tool enables you to have a portable set of aliases on your MacBook. Some CLI interfaces do not support aliases, I am thinking to Cisco WLC (Wireless LAN Controller). If you do lots of WLC CLI stuff, you could save keystrokes by using TextExpander.
I do lots of WiFi lab work using my MacBook PRO. IP addresses keep changing and the easiest way for me to display my current IP is to launch a terminal session and type the command: ifconfig -a. You can also use MacBook's system preferences > network > select your airport adapter > click advanced > click TCP/IP tab. But this is kind of tedious.
The ifconfig command will actually list all interfaces and their corresponding IP addresses, if configured. To get rid of the clutter, I use the ifconfig en1 command, which simply lists my WiFi interface, as follows:
ifconfig en1
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 58:b0:35:6a:61:be
inet 192.168.1.101 netmask 0xffffff00 broadcast 192.168.1.255
media: autoselect
status: active
This results in a 5 line output, which is too much. All I need is the IP address field. Let's refine this with the following command:
ifconfig en1 | grep inet
inet 192.168.1.101 netmask 0xffffff00 broadcast 192.168.1.255
This time, it only displayed the third line, looks good, but not enough. Lets print the IP address only:
ifconfig en1 | grep inet | cut -d " " -f2
192.168.1.101
You noticed the cut command uses a space as delimiter (-d " ") and prints field number 2 (-f2)
Now the fun part, let's use the watch command to dynamically display the WiFi interface IP address:
watch -d2 'ifconfig en1 | grep inet | cut -d" " -f2'
After you execute this command, your terminal session display will clear and only display IP address updates every 2 seconds. (parameter -d2). If we take this one step further, you can create an alias to invoke this command when needed. Here is an alias called ipwatch that I stored in my .bashrc file:
alias ipwatch="watch -d2 'ifconfig en1 | grep inet | cut -d\" \" -f2'"
You probably noticed that I added backslashes before the double quotes after the cut command. This is to prevent shell expansion. Now, all you have to do is to type ipwatch and watch you IP address updating dynamically.
If you do not have the watch command installed in your MAC OS X system, you can add it using MacPorts. In a previous blog I describe how to install MacPorts on your MacBook. Just make sure you download the latest MacPorts version for your platform.
As an alternative, if you do not want to install MacPorts, you can create a loop in your terminal session with the while command. Here is an example
while ifconfig en1 | grep inet | cut -d" " -f2; do sleep 2; done
Use the following ipwatch alias form in you .bashrc file:
alias ipwatch="while ifconfig en1 | grep inet | cut -d\" \" -f2; do sleep 2; done"
Whenever you type ipwatch, your WiFi IP will display every 2 seconds, 1 per line. Hit control-c to stop.
Conclusion
Dynamically displaying your WiFi IP address from a terminal shell command line is easy and efficient. Using shell aliases can help simplify this task further.
Posted at 08:15 | Permalink | Comments (1)
I recently updated my iPhone 4 from iOS 4.2 to iOS 4.3. This update introduces Apple's Personal Hotspot, which turns your iPhone into a WiFi access point. In this mode, your iPhone can associate with up to 3 clients. These will be able to share your Internet 3G connection as depicted in the following figure:
While in Hotspot mode, the iPhone can also associate to an AP as a WiFi client. In that case, the iPhone is both a WiFi AP and a WiFi client:
By default, the iPhone will use channel 1 in the 2.4 GHz frequency band. Now, let's suppose a nearby AP already uses channel 1, the iPhone avoidance mechanism will select channel 2. In the following picture, the iPhone has SSID <iPhone> on channel 2 while my other AP has SSID <axtnet> on channel 1. Why not use channel 6 or 11 instead?
Adding another AP on channel 2 (SSID APN) made the iPhone HotSpot function to bump its frequency up to channel 3.
Conclusion
WLAN design best practices state that we must use non-overlapping channels in the 2.4 GHz band (1, 6 and 11). Otherwise the WLAN is subject to 802.11 co-channel interference. It does not seem that Apple followed these rules in their iPhone Personal HotSpot implementation. But this feature can become handy in certain situations.
Posted at 21:10 | Permalink | Comments (0)
A client recently contacted me regarding a problem he attributed to his Cisco ASA firewall. The problem prevented encrypted email traffic out on the Internet. The encryption used to access Gmail's servers was TLS / STARTTLS on port TCP 587.
For this troubleshooting session, I used ASDM (ASA graphical tool for 550x firewalls). First, I conducted a 'Packet Tracer' to source IP 172.27.0.32 (server issuing the e-mail). A packet trace simulates the forwarding of a data packet, with the TCP / UDP port of your choice, and with the source and destination addresses of your choice. In this instance, the destination smtp.gmail.com is resolved to 74.125.93.109 and TCP port of destination was 587. All this from the COR interface (inside). As depicted in the following figure, the packet passed all the checks between the interface COR (inside) and PUB (outside). Green check marks indicate success for each phase, like ACLs, NAT, etc.
The above results confirms that type of traffic is allowed through the firewall. At this point, I began suspecting the client's Windows server.
ASDM provides a tool called 'real time log viewer'. It lets you view the logging in the ASA in real time (this feature has been available forever), but in addition you can filter by IP address, source / destination port, etc.. There is even an option 'Build Filter' which helps to build the filter conditions, similar to Wireshark. The following figure illustrates several connection attempts to smtp.gmail.com (IP 74.125.93.109) with the server's source IP (172.27.0.32) to TCP ports 80, 58, 586, 587. All these connections passed through the firewall, except for port 587. At that moment, I concluded that port 587 was blocked at the client's server. After investigation, I found that a newly installed anti-virus package denied certain types of traffic. I circumvented the rule in the anti-virus software and traffic for TCP port 587 began to forward, as observed in the last logging entry (log entries are listed in descending chronological order).
Conclusion
I have often witnessed connectivity problems in client servers due to Windows Firewall service. Recently, anti-virus software caused a similar connectivity problem. ASDM real time log viewer added value in the troubleshooting process. If you are using a Cisco ASA firewall, I recommend installing ASDM on at least one of your Windows servers sitting behind the firewall. This tool is free and easy to use.
Posted at 14:49 in Firewalls, Security, Windows | Permalink | Comments (0)
At the conclusion of Wireless Field Day, most delegates were returning home, except for three of us who stayed one extra day in San Jose. Coincidence you will say, I spent a great deal of Saturday with two top network bloggers. Andrew von Naggy (@revolutionwifi) and Greg Ferro (@etherealmind). As you may have noticed, these folks can crunch large quantities of high quality of blog posts on a regular basis. And I enjoy reading them. I had an opportunity to learn quite a few tricks from them, tools, blogging approach, time management and discipline.
Funny enough, the three of us do use a MacBook. I also noticed that a majority of the WFD delegates do use a MacBook as well. Is this because it is trendy ? I don't think so. MacBooks just work ! Top bloggers like Andrew and Greg are efficient, and they use efficient tools too ! Greg showed me great pieces of software that can help better concentrate on the writing task. No matter which hardware/software you use, these will only help you get the results done faster. They are not a substitute to creativity, discipline and focus. And this is what these top bloggers have in common.
Posted at 12:51 in Wireless | Permalink | Comments (0)