Putty Trick – 1. Save output to a file

To automatically save the output to a file while using Putty, you can change one setting of Putty to achieve this.
1. Start putty.exe.
2. Go to Session -> Logging.
3. Select “Printable output”
4. Choose the folder, where you want the file to be placed.
5. Append a file name like &H_&Y&M&D_&T.log to the path (host_YearMonthDay_time.log)
6. Save the profile as default settings.

Chasing Packets in GNS3 & Production Environment, Part 2: IOS Embedded Packet Capture & tee off to a TFTF server

aaa2

IOS Embedded Packet Capture Configuration in a nutshell:

r1#monitor capture buffer PAKCETBUFFER size 2048 max-size 128 linear

r1#monitor capture point ip cef E0_0 e0/0 both

r1#monitor capture point associate E0_0 PAKCETBUFFER

r1#monitor capture point start E0_0

 

Generate some traffic: example showing ICMP traffic generation

aaa9

Generate some RTP traffic: example showing use of Cisco IP communicator in this lab

aaa11.png

 

r1#monitor capture point stop E0_0

r1#monitor capture buffer PAKCETBUFFER export tftp://172.168.10.10/mycapture.pcap

 

***You must specify the name of the file, otherwise the teeing off to TFTP server will not work!!!

 

aaa8

 

Example of ICMP traffic packet capture:

aaa10.png

 

Example of RTP traffic packet capture.

aaa7

 

 

=======================================================================

Actual configuration:

r1#monitor capture buffer PAKCETBUFFER size 2048 max-size 128 linear

 

r1#show mon cap buffer PAKCETBUFFER parameters

Capture buffer PAKCETBUFFER (linear buffer)

Buffer Size : 2097152 bytes, Max Element Size : 128 bytes, Packets : 0

Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0

Associated Capture Points:

Name : E0_0, Status : Inactive

Configuration:

monitor capture buffer PAKCETBUFFER size 2048 max-size 128 linear

monitor capture point associate E0_0 PAKCETBUFFER

 

r1#mon cap point ip cef E0_0 e0/0 both

*Apr  5 07:30:22.526: %BUFCAP-6-CREATE: Capture Point E0_0 created.

 

r1#show mon cap point all

Status Information for Capture Point E0_0

IPv4 CEF

Switch Path: IPv4 CEF            , Capture Buffer: None

Status : Inactive

 

Configuration:

monitor capture point ip cef E0_0 Ethernet0/0.100 both

 

r1#mon cap point associate E0_0 PAKCETBUFFER

 

r1#show mon cap point all

Status Information for Capture Point E0_0

IPv4 CEF

Switch Path: IPv4 CEF            , Capture Buffer: PAKCETBUFFER

Status : Inactive

 

Configuration:

monitor capture point ip cef E0_0 Ethernet0/0.100 both

 

r1#show mon cap buffer PAKCETBUFFER parameters

Capture buffer PAKCETBUFFER (linear buffer)

Buffer Size : 2097152 bytes, Max Element Size : 128 bytes, Packets : 0

Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0

Associated Capture Points:

Name : E0_0, Status : Inactive

Configuration:

monitor capture buffer PAKCETBUFFER size 2048 max-size 128 linear

monitor capture point associate E0_0 PAKCETBUFFER

 

 

r1#show mon cap buffer PAKCETBUFFER parameters

Capture buffer PAKCETBUFFER (linear buffer)

Buffer Size : 2097152 bytes, Max Element Size : 128 bytes, Packets : 0

Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0

Associated Capture Points:

Name : E0_0, Status : Active

Configuration:

monitor capture buffer PAKCETBUFFER size 2048 max-size 128 linear

monitor capture point associate E0_0 PAKCETBUFFER

r1#show mon cap buffer PAKCETBUFFER parameters

Capture buffer PAKCETBUFFER (linear buffer)

Buffer Size : 2097152 bytes, Max Element Size : 128 bytes, Packets : 3

Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0

Associated Capture Points:

Name : E0_0, Status : Active

Configuration:

monitor capture buffer PAKCETBUFFER size 2048 max-size 128 linear

monitor capture point associate E0_0 PAKCETBUFFER

r1#show mon cap buffer PAKCETBUFFER parameters

Capture buffer PAKCETBUFFER (linear buffer)

Buffer Size : 2097152 bytes, Max Element Size : 128 bytes, Packets : 4

Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0

Associated Capture Points:

Name : E0_0, Status : Active

Configuration:

monitor capture buffer PAKCETBUFFER size 2048 max-size 128 linear

monitor capture point associate E0_0 PAKCETBUFFER

r1#show mon cap buffer PAKCETBUFFER parameters

Capture buffer PAKCETBUFFER (linear buffer)

Buffer Size : 2097152 bytes, Max Element Size : 128 bytes, Packets : 657

Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0

Associated Capture Points:

Name : E0_0, Status : Active

Configuration:

monitor capture buffer PAKCETBUFFER size 2048 max-size 128 linear

monitor capture point associate E0_0 PAKCETBUFFER

r1#mon cap point stop E0_0

r1#mon cap point stop E0_0

*Apr  5 07:34:11.582: %BUFCAP-6-DISABLE: Capture Point E0_0 disabled.

r1#show mon cap buffer PAKCETBUFFER parameters

Capture buffer PAKCETBUFFER (linear buffer)

Buffer Size : 2097152 bytes, Max Element Size : 128 bytes, Packets : 657

Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0

Associated Capture Points:

Name : E0_0, Status : Inactive

Configuration:

monitor capture buffer PAKCETBUFFER size 2048 max-size 128 linear

monitor capture point associate E0_0 PAKCETBUFFER

 

 

r1#show monitor capture buffer PAKCETBUFFER dump

07:33:16.228 UTC Apr 5 2016 : IPv4 LES CEF    : Et0/0.100 None

 

F4E2C230: AABBCC00 0100000C 2978156D 81000064  *;L…..)x.m…d

F4E2C240: 08004560 0034EE83 40007F06 1959C0A8  ..E`.4n.@….Y@(

F4E2C250: 640B8EC8 400B0570 07D079AA FEBF61F3  d..H@..p.Py*~?as

F4E2C260: 050A5018 FAC0BFD0 00000400 00001100  ..P.z@?P……..

F4E2C270: 00000000 000000                      …….

… Content omitted for brevity

 

 

r1#monitor capture buffer PAKCETBUFFER export ?

disk0:  Location to dump buffer

disk1:  Location to dump buffer

ftp:    Location to dump buffer

http:   Location to dump buffer

https:  Location to dump buffer

pram:   Location to dump buffer

rcp:    Location to dump buffer

scp:    Location to dump buffer

snmp:   Location to dump buffer

tftp:   Location to dump buffer

unix:   Location to dump buffer

 

r1#monitor capture buffer PAKCETBUFFER export tftp://172.168.10.10/mycapture.pcap

!

***You must specify the name of the file, otherwise the teeing off to TFTP server will not work!!!

 

Chasing Packets in GNS3 & Production Environment, Part 1: Capturing packets using built-in Live Wireshark Capture in GNS3 1.4.4

Why do you want to do this lab?

You can capture any interesting packets and analyse for your learning purpose, analyzing packet captures can give you the real inside of how the packets are working on the devices and on different segments of the network. Simply reading the books and learn about how packets work behind the scenes is a little like trying to learn something as if you are three wise monkeys (see no evil, hear no evil, speak no evil).

On the real production, you can use other methods to capture interesting packets. Some examples are IOS Embedded Packet capture and tee off the configuration to a TFTP server, use a sniffer using spanning port or remote spanning port. Also, use more advanced method of Cisco NAM (Network Analyzer).

In this part, I will quickly show you how to whiz up a simple lab and capture some packets on GNS3 and Wireshark live capture within, GNS3. In the next section, I will demonstrate IOS Embedded Packet capture and teeing off to a TFTP server. Lastly, I will demonstrate packet capturing using spanning port and remote span.

Prerequisite 1: GNS3 1.4.4 pre-installed on Windows PC/laptop

Prerequisite 2: IOU VM ova deployed and integrated with GNS3

Prerequisite 3: Familiar with VMware workstation and Windows loopback configuration

 

Topology:

aaa1

Step 1: Add devices as below and make all connections. When you add the devices, your GNS3 topology will look like this. Remember to use dummy switches to make connection between your virtual machines and your host PC loopback to your IOU switches.

aaa2.png

Step 2: Configure your routers and switches similar to the configuration found in  the attached zip file.

r1

r2

sw1

sw2

 

Step 3: Capture packets using various link positions

aaa3

aaa4

If you run into the following error, you will have to go to GNS3 setting and update the path of Wireshark.

aaa5

=> Error: SW3: Could not start the packet capture reader: [WinError 2] The system cannot find the file specified: None

Changing path in GSN3 preferences:

C:\Program Files\Wireshark\wireshark.exe” ==> C:\Program Files (x86)\Wireshark\wireshark.exe

 

Step 4: Wireshark will open automatically and start capturing all the traffic on the link you have selected.

e.g.) TCP/IP packet capture example

aaa6.png

e.g.) Voice packet capture using soft phones (On virtual machines) between two work stations and CUCM.

aaa7

Now you can set up any server and clients and study how TCP/IP, UDP work behind the scenes. Jump straight in and try to enjoy your study!

 

Note: This lab can be completed on a single PC, Save Electricity, save Money, save Time, SAVE THE PLANET.

 

 

 

Notes on Cisco QoS: Clearing the fog – Part 4. Modular QoS Lab

Lab topology:

Module QoS 2

How this lab can be configured in GNS3 on a single PC.

  • SW1 and SW2 is the local GNS3 switches, merely serving as a connector between PC1 and HTTP Server respectively. These dummy switches must be used while connecting virtual machines to GNS3 devices.

Module QoS 1

Step 1: Configure R1 and R2 to allow communication between the networks.

R1 base configuration:

hostname R1

interface FastEthernet0/0
ip address 192.168.30.254 255.255.255.0
duplex auto
speed auto
!
interface Serial0/0
ip address 1.1.1.1 255.255.255.0
clock rate 2000000
!
router eigrp 1
network 1.0.0.0
network 192.168.30.0
auto-summary

==============================================

R2 base configuration:

hostname R2

interface FastEthernet0/0
ip address 192.168.40.254 255.255.255.0
duplex auto
speed auto

router eigrp 1
network 1.0.0.0
network 192.168.40.0
auto-summary

==============================================

Step 2: Configure R1 with Access List, class-map and policy-map

access-list 200 permit icmp host 192.168.30.30 host 192.168.40.40 echo
access-list 200 permit icmp host 192.168.30.30 host 192.168.40.40 echo-reply
access-list 100 permit tcp any any eq www

class-map match-all WEB_TRAFFIC
match access-group 100
class-map match-all ICMP_TRAFFIC
match access-group 200

policy-map MODULAR
class ICMP_TRAFFIC
bandwidth 256
class WEB_TRAFFIC
bandwidth 128
class class-default

Step 3: Apply policy map to output queue of Serial 0/0

!Apply Service-policy to output interface s0/0

interface Serial0/0
ip address 1.1.1.1 255.255.255.0
clock rate 2000000
 service-policy output MODULAR

==============================================

Step 4: Run quick check on the configuration

R1#show class-map
Class Map match-all WEB_TRAFFIC (id 1)
Match access-group  100

Class Map match-any class-default (id 0)
Match any

Class Map match-all ICMP_TRAFFIC (id 2)
Match access-group  200

R1#show policy-map
Policy Map CCIE
Class ICMP_TR
Bandwidth 128 (kbps) Max Threshold 64 (packets)
Class WEB_TR
Bandwidth 64 (kbps) Max Threshold 64 (packets)
Class class-default

==============================================

Before any ping or http traffic is sent across the WAN link

R1#show policy-map interface s0/0
Serial0/0

Service-policy output: MODULAR

Class-map: ICMP_TRAFFIC (match-all)
    0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group 112
Queueing
Output Queue: Conversation 265
Bandwidth 128 (kbps)Max Threshold 64 (packets)
(pkts matched/bytes matched) 0/0
(depth/total drops/no-buffer drops) 0/0/0

Class-map: WEB_TRAFFIC (match-all)
      0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group 120
Queueing
Output Queue: Conversation 266
Bandwidth 64 (kbps)Max Threshold 64 (packets)
(pkts matched/bytes matched) 0/0
(depth/total drops/no-buffer drops) 0/0/0

Class-map: class-default (match-any)
697 packets, 46091 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any

==============================================

Step 5: Generate ICMP traffic by pining the server from the client PC

To generate ICMP traffic, from the client PC (192.168.30.30) ping http server at 192.168.40.40.
ICMP pinging

‘show policy-map interface s0/0’ after 8 ping messages have been sent from 192.168.30.30 (client) to 192.168.40.40 (Server)

R1#show policy-map interface s0/0
Serial0/0

Service-policy output: MODULAR

Class-map: ICMP_TRAFFIC (match-all)
8 packets, 512 bytes <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group 112
Queueing
Output Queue: Conversation 265
Bandwidth 128 (kbps)Max Threshold 64 (packets)
(pkts matched/bytes matched) 0/0
(depth/total drops/no-buffer drops) 0/0/0

Class-map: WEB_TRAFFIC (match-all)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group 120
Queueing
Output Queue: Conversation 266
Bandwidth 64 (kbps)Max Threshold 64 (packets)
(pkts matched/bytes matched) 0/0
(depth/total drops/no-buffer drops) 0/0/0

Class-map: class-default (match-any)
766 packets, 50456 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any

==============================================

Step 6: Access web page of http server from the client PC

To generate some http traffic, access http://192.168.40.40/ from the client PC to HTTP Server.
Access IIS

==============================================

show policy-map interface serial0/0 after generating http traffic

R1#show policy-map interface s0/0
Serial0/0

Service-policy output: MODULAR

Class-map: ICMP_TRAFFIC (match-all)
    12 packets, 768 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group 112
Queueing
Output Queue: Conversation 265
Bandwidth 128 (kbps)Max Threshold 64 (packets)
(pkts matched/bytes matched) 0/0
(depth/total drops/no-buffer drops) 0/0/0

Class-map: WEB_TRAFFIC (match-all)
13 packets, 2539 bytes <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group 120
Queueing
Output Queue: Conversation 266
Bandwidth 64 (kbps)Max Threshold 64 (packets)
(pkts matched/bytes matched) 0/0
(depth/total drops/no-buffer drops) 0/0/0

Class-map: class-default (match-any)
878 packets, 57842 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any

 

==============================================

R1#show ip route
Codes: C – connected, S – static, R – RIP, M – mobile, B – BGP
D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
E1 – OSPF external type 1, E2 – OSPF external type 2
i – IS-IS, su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2
ia – IS-IS inter area, * – candidate default, U – per-user static route
o – ODR, P – periodic downloaded static route

Gateway of last resort is not set

1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C       1.1.1.0/24 is directly connected, Serial0/0
D       1.0.0.0/8 is a summary, 00:59:46, Null0
C    192.168.30.0/24 is directly connected, FastEthernet0/0
D    192.168.40.0/24 [90/2195456] via 1.1.1.2, 00:59:41, Serial0/0

 

R2#show ip route
Codes: C – connected, S – static, R – RIP, M – mobile, B – BGP
D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
E1 – OSPF external type 1, E2 – OSPF external type 2
i – IS-IS, su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2
ia – IS-IS inter area, * – candidate default, U – per-user static route
o – ODR, P – periodic downloaded static route

Gateway of last resort is not set

1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C       1.1.1.0/24 is directly connected, Serial0/0
D       1.0.0.0/8 is a summary, 00:04:16, Null0
D    192.168.30.0/24 [90/2195456] via 1.1.1.1, 00:04:11, Serial0/0
C    192.168.40.0/24 is directly connected, FastEthernet0/0

 

All this lab was done on a laptop, go easy on the environment. 🙂

On a single PC

Notes on Cisco QoS: Clearing the fog – Part 2. Quality issues

Quality of Service

QOS = Method of giving priority to some specific traffic as moving over the network.

The basic aim of QoS is to have a consistent and predictable performance on your network.

 

1 qos intro

General characteristics of today’s Converged Network:

  • Small voice packet compete with bursty data packets, many different applications are using network as services
  • Critical traffic must get priority over less critical traffic, without QoS, default behavior is First In First Out (FIFO)
  • Voice and video traffics are time-sensitive
  • Outages are not acceptable

 

Converged Network Quality issues:

  • Lack of Bandwidth
  • Packet Loss
  • Delay
  • Jitter

 

Bandwidth

2 Bandwidth Measure.png

  • Maximum available bandwidth is the slowest link on the traffic paths
  • On the same physical links (traffic paths), multiple flows compete for the same bandwidth, multiple applications sharing the same bandwidth
  • Lack of bandwidth causes performance degradation on network applications

 

 

Packet Loss

3 Tail Drop due to Queue Congestion

Packet loss due to Tail Drop: Queue only can so much packets and once it is full and more packets arrive at the tail end of the queue before the queue is emptied (due to link congestion etc.), the packets will be dropped, and this behavior is called ‘Tail Drop’. If the tail drop occurs to the time sensitive traffics such as voice and video, the effects are immediately felt by the users on the flow. If this happens to data traffic, it may interrupt file transfer and corrupt the file.

 

 

Delay

4 Types of Delay

  • Processing Delay – time taken by router to process packets from an input interface and put them into the output queue of output interface
  • Queuing Delay – time a packet resides in the output queue of a router
  • Serialization Delay – time taken to place bits on the wire
  • Propagation Delay – time taken for packets to cross links from one end to the other end

 

 

Jitter

5 Jitter

  • Packets from a source will reach a destination with different delay times
  • Congestion on the network will cause jitter
  • Congestion can occur at a router interface/Service Provider network if the circuits are not properly provisioned

 

Simple TSHOOT notes: 1 VLANS

Quick VLAN Review
– VLAN lives in L2 Broadcast Domain
– Correct L2 configuration is a must for a stable network, if L2 is not working correclty then L3 won’t work.
– Data/Voice(a.k.a AUxiliary vlan) VLANS, seperate vlans for voice is recommended on enterprise network
– VLAN 1 = default VLAN, not tagged, Trunked Native vlan. As best practice, VLAN 1 is disabled
– Any unused ports are moved to a dummy VLAN as a security measures
– Extended Range VLANS 1006- 4094, if required but this range is hardly used

Hot tip:
– Extended Range is only available if your switch is in Transparent mode.
– If you try to create VLAN in client mode, your switch will throw up “error”, you must be in server mode to create VLANs

Switch VLAN Configuration in a nutshell:

conf t
vlan 100
name DATA_NETWORK
vlan 200
name VOICE_NETWORK

int fa0/3
switchport mode access
switchport access vlan 100
switchport voice vlan 200

int fa0/24
switchport mode trunk
switchport trunk vlan 99

Useful commands:
show interface status                   <<< displays interface status
show vlan brief                               <<< does the vlan exist and which ports participate in respective vlans
show interface fa0/3 switchport <<< get all of details of VLAN on a particular switchport
show vlan id                                      <<< shows vlan ID
show int trunk                                  <<< shows trunk interface
show monitor                                   <<< shows monitoring ports

GNS3 1.4.2 and IOU VM.ova Installation Tips

Assumption 1: You’ve already have a VMware Workstation or Virtual Box installed and running on your PC/Laptop
Assumption 2: You’ve already downloaded GNS3 1.4.2 and GNS3 VM.ova files from “https://github.com/GNS3/gns3-gui/releases&#8221;.
Now Let’s get started:

Step1: Import “GNS3 VM.ova” file on your VMWare Workstation or Virtual Box

Step 1a: Upload IOU L2 and L3 image files on “http://192.168.56.101:8000/upload&#8221;, under IOU
Step 1b: Upload CiscoIOUKeygen.py file on “http://192.168.56.101:8000/upload&#8221;, under IOU

Step2: Install GNS3 1.4.2
Step 2a: complete basic GNS3 setup following YouTube videos.
One of the videos is as below: https://www.youtube.com/watch?v=1j4VHW-vvR8

Step3: SSH into your IOU VM machine, and go to “/etc” folder and run the following commands under respective folder.
(Video Reference: https://www.youtube.com/watch?v=V0SdjK5tEcA)

Tip: Default IOU VM UID = gns3
Default IOU VM PWD = gns3

Required commands:
echo -ne \\x1\\x0\\x0\\x0 > /etc/hostid
echo -ne \\x1\\x0\\x0\\x0 > /etc/ioukey
echo hostid = 0000001 ; echo hostname = gns3-iouvm ; echo ioukey = 3d9

Step 4: Go to http://192.168.56.101:8000/upload and upload CiscoIOUKeygen.py file

Step 5: Go to /opt/gns3/images/IOU directory and take ownership of the unloaded keygen file

Step 6: use python or python3 command to generate your 16 character long IOU key

root@gns3vm:/opt/gns3/images/IOU# python CiscoIOUKeygen.py
hostid=00000001, hostname=gns3vm, ioukey=25f

Add the following text to ~/.iourc:
[license]
gns3vm = acf51841caabfb0f;

You can disable the phone home feature with something like:
echo ‘127.0.0.127 xml.cisco.com’ >> /etc/hosts

============================================
***Notice that my VM machine works with python command but not python3 command!!!

root@gns3vm:/opt/gns3/images/IOU# chmod +x CiscoIOUKeygen.py

## Notice that python3 command does not work here!!!!
root@gns3vm:/opt/gns3/images/IOU# python3 CiscoIOUKeygen.py
File “CiscoIOUKeygen.py”, line 11
print “hostid=” + hostid +”, hostname=”+ hostname + “, ioukey=” + hex(ioukey)[2:]
^
SyntaxError: invalid syntax
==============================================

Step 7: Using the “gns3vm’ value, create a txt file containg the license information. Save the file as IOURC.txt and point your GNS3 remote server to this txt file.

[license]
gns3vm = acf51841caabfb0f;