Managed Network & Security Consulting Services - Tools

Tools & Tricks

Here we provide short tips and reminders to things that will save time.

Blocking traffic

How to block traffic.

Protocol blocking: Use your firewall or router ACL to stop the traffic. This tactic applies to inward and outward traffic.

Website access: Use your DNS server to point the clients to an alternate IP address. 127.0.0.1 keeps the network traffic clean. Alternately you can use a web server to provide a reminder that they are going somewhere bad and to record who is trying to going where they should not.

Linux - Stuff

Bash Commands
CLUI commands we hardly ever use

at This command allows you to schedule a task to run once at a given time such as rebooting a server
at 8:00
at> reboot
at> (CTRL+d to exit)

/usr/sbin/sendmail -bt sendmail test mode
# /usr/sbin/sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter [ruleset] [address]
> 3,0 tester@testdomain.com
> (CTRL+d to exit)

TCPdump to ignore SSH
Issue tcpdump -i eth0 -n 'port ! 22' when you need to use TCPdump on an SSH connection

linking files
Issue ln -s [source] [target] when you need to make a soft link. This is similar to the windows "shortcut" concept.

Linux Permissions
Here is a summary of the meanings for individual octal digit values:

	0 --- no permission
	1 --x execute 
	2 -w- write 
	3 -wx write and execute
	4 r-- read
	5 r-x read and execute
	6 rw- read and write
	7 rwx read, write and execute

Cisco - Stuff

PING command reply codes are:

	Character 	Description
	! 	Each exclamation point indicates receipt of a reply.
	. 	Each period indicates the network server timed out while waiting for a reply.
	U 	A destination unreachable error PDU was received.
	Q 	Source quench (destination too busy).
	M 	Could not fragment.
	? 	Unknown packet type.
	& 	Packet lifetime exceeded.

TRACE command reply codes are:

	Character 	Description
	! 		success
	* 		time out
	N 		network unreachable
	H 		host unreachable
	P 		protocol unreachable
	A 		admin denied
	Q 		source quench received (congestion)
	? 		unknown (any other ICMP message)
Top Talkers
Enter the following commands in global config mode
ip flow-cache entries 4000
ip flow-cache timeout inactive 100
ip flow-top-talkers
top 10
sort-by bytes

Then on the interface that is showing the heavy load add the commands depending on the traffic direction
 ip flow ingress
or 
 ip flow egress


To see the results issue the command sh ip flow top-talkers


CPU Load
sh proc cpu sort


 Cisco ASA - Showing Preshared Keys 
To view the password unencrypted, type more system:running-config


VPN
 
Things to watch for when creating L2L VPN connections 
 

Ensure that the name of the Tunnel-Group matches the IP address of the remote-peer. 
Ensure the remote-peer is configured to send the IP address as the identifier 
Ensure that remote-peer and the local firewall have the same LANs configured to be tunneled 
Ensure that the re-key times match

eSubnet Services
Contact us regarding your network,
security and Internet services needs