Network
Routing | Additional IP | Change MAC | Ports | Firewall | IP Forward | NAT | DNS | DHCP | Traffic | QoS | NIS | Netcat
Debugging (See also Traffic analysis)
Linux
# ethtool eth0 # ethtool -s eth0 speed 100 duplex full # ethtool -s eth0 autoneg off # ethtool -p eth1 # ip link show # ip link set eth0 up # ip addr show # ip neigh show
Other OSes
# ifconfig fxp0 # arp -a # ping # traceroute # ifconfig fxp0 media 100baseTX mediaopt full-duplex # netstat -sAdditional commands which are not always installed per default but easy to find:
# arping 192.168.16.254 # tcptraceroute -f 5
Routing
Print routing table
# route -n # netstat -rn # route print
Add and delete a route
FreeBSD
# route add 212.117.0.0/16 192.168.1.1 # route delete 212.117.0.0/16 # route add default 192.168.1.1Add the route permanently in /etc/
static_routes="myroute" route_myroute="-net 212.117.0.0/16 192.168.1.1"
Linux
# route add -net 192.168.20.0 netmask 255.255.255.0 gw 192.168.16.254 # ip route add 192.168.20.0/24 via 192.168.16.254 # route add -net 192.168.20.0 netmask 255.255.255.0 dev eth0 # route add default gw 192.168.51.254 # ip route add default via 192.168.51.254 dev eth0 # route delete -net 192.168.20.0 netmask 255.255.255.0
Solaris
# route add -net 192.168.20.0 -netmask 255.255.255.0 192.168.16.254 # route add default 192.168.51.254 1 # route change default 192.168.50.254 1Permanent entries are set in entry in
/etc/defaultrouter.
Windows
# Route add 192.168.50.0 mask 255.255.255.0 192.168.51.253 # Route add 0.0.0.0 mask 0.0.0.0 192.168.51.254Use add -p to make the route persistent.
Configure additional IP addresses
Linux
# ifconfig eth0 192.168.50.254 netmask 255.255.255.0 # ifconfig eth0:0 192.168.51.254 netmask 255.255.255.0 # ip addr add 192.168.50.254/24 dev eth0 # ip addr add 192.168.51.254/24 dev eth0 label eth0:1
FreeBSD
# ifconfig fxp0 inet 192.168.50.254/24 # ifconfig fxp0 alias 192.168.51.254 netmask 255.255.255.0 # ifconfig fxp0 -alias 192.168.51.254Permanent entries in /etc/
ifconfig_fxp0="inet 192.168.50.254 netmask 255.255.255.0" ifconfig_fxp0_alias0="192.168.51.254 netmask 255.255.255.0"
Solaris
Check the settings withifconfig -a
# ifconfig hme0 plumb # ifconfig hme0 192.168.50.254 netmask 255.255.255.0 up # ifconfig hme0:1 192.168.51.254 netmask 255.255.255.0 up
Change MAC address
Normally you have to bring the interface down before the change. Don't tell me why you want to change the MAC address...# ifconfig eth0 down # ifconfig eth0 hw ether 00:01:02:03:04:05 # ifconfig fxp0 link 00:01:02:03:04:05 # ifconfig hme0 ether 00:01:02:03:04:05 # sudo ifconfig en0 ether 00:01:02:03:04:05 # sudo ifconfig en0 lladdr 00:01:02:03:04:05Many tools exist for Windows. For example etherchange /toolbox/etherchange. Or look for "Mac Makeup", "smac".
Ports in use
Listening open ports:# netstat -an | grep LISTEN # lsof -i # socklist # sockstat -4 # netstat -anp --udp --tcp | grep LISTEN # netstat -tup # netstat -tupl # netstat -ano
Firewall
Check if a firewall is running (typical configuration only):Linux
# iptables -L -n -v Open the iptables firewall # iptables -P INPUT ACCEPT # iptables -P FORWARD ACCEPT # iptables -P OUTPUT ACCEPT # iptables -Z # iptables -F # iptables -X
FreeBSD
# ipfw show # ipfw list 65535 # sysctl =0 # sysctl =1
IP Forward for routing
Linux
Check and then enable IP forward with:# cat /proc/sys/net/ipv4/ip_forward # echo 1 > /proc/sys/net/ipv4/ip_forwardor edit /etc/ with:
net.ipv4.ip_forward = 1
FreeBSD
Check and enable with:# sysctl # sysctl =1 # sysctl =1 Permanent with entry in /etc/: gateway_enable="YES"
Solaris
# ndd -set /dev/ip ip_forwarding 1
NAT Network Address Translation
Linux
# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # iptables -t nat -A PREROUTING -p tcp -d 78.31.70.238 --dport 20022 -j DNAT \ --to 192.168.16.44:22 # iptables -t nat -A PREROUTING -p tcp -d 78.31.70.238 --dport 993:995 -j DNAT \ --to 192.168.16.254:993-995 # ip route flush cache # iptables -L -t natDelete the port forward with -D instead of -A. The program netstat-nat /projects/netstat-nat is very useful to track connections (it uses
/proc/net/ip_conntrack or
/proc/net/nf_conntrack).
# netstat-nat -n
FreeBSD
# natd -s -m -u -dynamic -f /etc/ -n fxp0 Or edit /etc/ with: firewall_enable="YES" firewall_type="open" natd_enable="YES" natd_interface="tun0" natd_flags="-s -m -u -dynamic -f /etc/"Port forward with:
# cat /etc/ same_ports yes use_sockets yes unregistered_only # redirect_port tcp insideIP:2300-2399 3300-3399 redirect_port udp 192.168.51.103:7777 7777
DNS
On Unix the DNS entries are valid for all interfaces and are stored in /etc/. The domain to which the host belongs is also stored in this file. A minimal configuration is:nameserver 78.31.70.238 search domainCheck the system domain name with:
# hostname -d
Windows
On Windows the DNS are configured per interface. To display the configured DNS and to flush the DNS cache use:# ipconfig /? # ipconfig /all
Flush DNS
Flush the OS DNS cache, some application using their own cache (. Firefox) and will be unaffected.# /etc//nscd restart # lookupd -flushcache # dscacheutil -flushcache # ipconfig /flushdns
Forward queries
Dig is you friend to test the DNS settings. For example the public DNS server213.133.105.2 can be used for testing. See from which server the client receives the answer (simplified answer).
# dig . 600 IN A 78.31.70.238 ;; SERVER: 192.168.51.254#53(192.168.51.254)The router 192.168.51.254 answered and the response is the A entry. Any entry can be queried and the DNS server can be selected with @:
# dig MX # dig @127.0.0.1 NS # dig @204.97.212.10 NS MX # dig AXFR @The program host is also powerful.
# host -t MX # host -t NS -T # host -a
Reverse queries
Find the name belonging to an IP address (.). This can be done withdig,
host and
nslookup:
# dig -x 78.31.70.238 # host 78.31.70.238 # nslookup 78.31.70.238
/etc/hosts
Single hosts can be configured in the file /etc/hosts instead of runningnamed locally to resolve the hostname queries. The format is simple, for example:
78.31.70.238 sleepyowlThe priority between hosts and a dns query, that is the name resolution order, can be configured in
/etc/ AND /etc/. The file also exists on Windows, it is usually in:
C:\WINDOWS\SYSTEM32\DRIVERS\ETC
DHCP
Linux
Some distributions (SuSE) use dhcpcd as client. The default interface is eth0.# dhcpcd -n eth0 # dhcpcd -k eth0The lease with the full information is stored in:
/var/lib/dhcpcd/
FreeBSD
FreeBSD (and Debian) uses dhclient. To configure an interface (for example bge0) run:# dhclient bge0The lease with the full information is stored in:
/var/db/.bge0Use
/etc/to prepend options or force different options:
# cat /etc/
interface "rl0" {
prepend domain-name-servers 127.0.0.1;
default domain-name "";
supersede domain-name "";
}
Windows
The dhcp lease can be renewed withipconfig:
# ipconfig /renew # ipconfig /renew LAN # ipconfig /release WLANYes it is a good idea to rename you adapter with simple names!
Traffic analysis
Bmon /~tgr/bmon/ is a small console bandwidth monitor and can display the flow on different interfaces.Sniff with tcpdump
# tcpdump -nl -i bge0 not port ssh and src \(192.168.16.121 or 192.168.16.54\) # tcpdump -n -i eth1 net 192.168.16.121 # tcpdump -n -i eth1 net 192.168.16.0/24 # tcpdump -l > dump && tail -f dump # tcpdump -i rl0 -w traffic.rl0 # tcpdump -i rl0 -s 0 -w traffic.rl0 # tcpdump -r traffic.rl0 # tcpdump port 80 # tcpdump host # tcpdump -i eth0 -X port \(110 or 143\) # tcpdump -n -i eth0 icmp # tcpdump -i eth0 -s 0 -A port 80 | grep GETAdditional important options:
-
-APrint each packets in clear text (without header) -
-XPrint packets in hex and ASCII -
-lMake stdout line buffered -
-DPrint all interfaces available
Scan with nmap
Nmap /nmap/ is a port scanner with OS detection, it is usually installed on most distributions and is also available for Windows. If you don't scan your servers, hackers do it for you...# nmap # nmap -sP 192.168.16.0/24 # nmap -sS -sV -O PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 3.8.1p1 FreeBSD-20060930 (protocol 2.0) 25/tcp open smtp Sendmail smtpd 8.13.6/8.13.6 80/tcp open http Apache httpd 2.0.59 ((FreeBSD) DAV/2 PHP/4. [...] Running: FreeBSD Uptime 33.120 days (since Fri Aug 31 11:41:04 2007)Other non standard but useful tools are
hping () an IP packet assembler/analyzer and
fping (). fping can check multiple hosts in a round-robin fashion.
Traffic control (QoS)
Traffic control manages the queuing, policing, scheduling, and other traffic parameters for a network. The following examples are simple practical uses of the Linux and FreeBSD capabilities to better use the available bandwidth.Limit upload
DSL or cable modems have a long queue to improve the upload throughput. However filling the queue with a fast device (. ethernet) will dramatically decrease the interactivity. It is therefore useful to limit the device upload rate to match the physical capacity of the modem, this should greatly improve the interactivity. Set to about 90% of the modem maximal (cable) speed.Linux
For a 512 Kbit upload modem.# tc qdisc add dev eth0 root tbf rate 480kbit latency 50ms burst 1540 # tc -s qdisc ls dev eth0 # tc qdisc del dev eth0 root # tc qdisc change dev eth0 root tbf rate 220kbit latency 50ms burst 1540
FreeBSD
FreeBSD uses thedummynet traffic shaper which is configured with ipfw. Pipes are used to set limits the bandwidth in units of [K|M]{bit/s|Byte/s}, 0 means unlimited bandwidth. Using the same pipe number will reconfigure it. For example limit the upload bandwidth to 500 Kbit.
# kldload dummynet # ipfw pipe 1 config bw 500Kbit/s # ipfw add pipe 1 ip from me to any
Quality of service
Linux
Priority queuing withtc to optimize VoIP. See the full example on
or
. Suppose VoIP uses udp on ports 10000:11024 and device eth0 (could also be ppp0 or so). The following commands define the QoS to three queues and force the VoIP traffic to queue 1 with QoS
0x1e (all bits set). The default traffic flows into queue 3 and QoS
Minimize-Delay flows into queue 2.
# tc qdisc add dev eth0 root handle 1: prio priomap 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 0 # tc qdisc add dev eth0 parent 1:1 handle 10: sfq # tc qdisc add dev eth0 parent 1:2 handle 20: sfq # tc qdisc add dev eth0 parent 1:3 handle 30: sfq # tc filter add dev eth0 protocol ip parent 1: prio 1 u32 \ match ip dport 10000 0x3C00 flowid 1:1 match ip dst 123.23.0.1 flowid 1:1Status and remove with
# tc -s qdisc ls dev eth0 # tc qdisc del dev eth0 root
Calculate port range and mask
The tc filter defines the port range with port and mask which you have to calculate. Find the 2^N ending of the port range, deduce the range and convert to HEX. This is your mask. Example for 10000 -> 11024, the range is 1024.# 2^13 (8192) < 10000 < 2^14 (16384) # echo "obase=16;(2^14)-1024" | bc
FreeBSD
The max link bandwidth is 500Kbit/s and we define 3 queues with priority 100:10:1 for VoIP:ssh:all the rest.# ipfw pipe 1 config bw 500Kbit/s # ipfw queue 1 config pipe 1 weight 100 # ipfw queue 2 config pipe 1 weight 10 # ipfw queue 3 config pipe 1 weight 1 # ipfw add 10 queue 1 proto udp dst-port 10000-11024 # ipfw add 11 queue 1 proto udp dst-ip 123.23.0.1 # ipfw add 20 queue 2 dsp-port ssh # ipfw add 30 queue 3 from me to anyStatus and remove with
# ipfw list # ipfw pipe list # ipfw flush
NIS Debugging
Some commands which should work on a well configured NIS client:# ypwhich # domainname # ypcat group # cd /var/yp && make # rpcinfo -p servernameIs ypbind running?
# ps auxww | grep ypbind /usr/sbin/ypbind -s -m -S servername1,servername2 /usr/sbin/ypbind # yppoll Map has order number 1190635041. Mon Sep 24 13:57:21 2007 The master server is .
Linux
# cat /etc/ ypserver servername domain broadcast
Netcat
Netcat (nc) is better known as the "network Swiss Army Knife", it can manipulate, create or read/write TCP/IP connections. Here some useful examples, there are many more on the net, for example [...] /2006/11/06/netcat-a-couple-of-useful-examples and here /blog/2007/08/07/few-useful-netcat-tricks.You might need to use the command
netcat instead of
nc. Also see the similar command
socat.
File transfer
Copy a large folder over a raw tcp connection. The transfer is very quick (no protocol overhead) and you don't need to mess up with NFS or SMB or FTP or so, simply make the file available on the server, and get it from the client. Here 192.168.1.1 is the server IP address.tar -cf - -C VIDEO_TS . | nc -l -p 4444 nc 192.168.1.1 4444 | tar xpf - -C VIDEO_TS cat largefile | nc -l 5678 nc 192.168.1.1 5678 > largefile dd if=/dev/da0 | nc -l 4444 nc 192.168.1.1 4444 | dd of=/dev/da0 nc 192.168.1.1 4444 | dd of=
Other hacks
Specially here, you must know what you are doing.Remote shell
Option -e only on the Windows version? Or use nc 1.10.# nc -lp 4444 -e /bin/bash # nc -lp 4444 -e
Emergency web server
Serve a single file on port 80 in a loop.# while true; do nc -l -p 80 < ; done
Chat
Alice and Bob can chat over a simple TCP socket. The text is transferred with the enter key.nc -lp 4444 nc 192.168.1.1 4444