Each network adapter (network card) has a unique (burned-in) network (MAC, media access control) 6-octet address.

Under W95, use winipcfg to display yours.

Under Linux, we use ifconfig :

Command ncpa.cpl opens a GUI list of adapters

A network adapter requires a device driver, the software that enables a computer to work with that particular device.
Over a driver, we define some protocols, rules and procedures for communicating. If we have a mix of adapters and protocols, the binding order determines the order in which the operating system runs the protocol.

IP aliasing is associating more than one IP address to a network interface - wiki

• RJ11 - módem, teléfono - 4 cables.

• RJ45 - red Ethernet, ADSL - 8 cables.

  Use this connector to connect a Category 3 (10 Mbps) or Category 5 (100 Mbps) Ethernet cable to enable a LAN connection.

Blanco-naranja, Naranja, Blanco-verde, Azul, Blanco-Azul, Verde, Blanco-marrón, Marrón.

pin 1 : Blanco - Naranja : Transceive data+ pin 2 : Naranja : Transceive data- pin 3 : Blanco - Verde : Receive data+ pin 6 : Verde : Receive data- Details

Female

Se suelen unir todos los hilos, pero para las comunicaciones Ethernet solo hacen falta los pares "1"-"2" y "3"-"6".

El conector RJ-11 encaja dentro del RJ-45, coincidiendo los pines 4 y 5 con los usados para la transmisión de voz en el RJ-11.

Video com crimpar un conector RJ45

CrossOver cable : 1-3, 2-6, 3-1, 4, 5, 6-2, 7, 8, G-G

USB 3.0 to RJ45, 10 €

Top

• 802.2 Local Area Network Logical Link Control (LLC)
• 802.3 CSMA/CD LAN - Ethernet
• 802.5 Token Ring LAN
• 802.11 - specs for implementing WLAN (wireless local area network) computer communication
• 802.11a - 54 Mbps of bandwidth, operates at a frequency range around 5 GHz
• 802.11b - 11 Mbps of bandwidth, operates at a frequency range around 2,4 GHz
• 802.11g - 54 Mbps of bandwidth, operates at 2,4 GHz
• 802.11n - 300 Mbps of bandwidth, operates at 2,4 GHz and 5 GHz
• 802.11ac - operates at 2,4 GHz and 5 GHz ; 1300 Mbps on the 5 GHz band and up to 450 Mbps on the 2.4 GHz band
• 802.11ax - to be published February 2021

Get Intel 802.11 ac for dummies

wiki

The Internet protocol suite, often referred to as TCP/IP, is a set of protocols designed to work together to provide end-to-end transmission of messages across interconnected networks.

                                                       Application formats - HTML, XML

 Application layer  Telnet, FTP, API (as Sockets)      layer 5-7 : session, presentation - SSL, HTTP
  |                  |                                 * --- socket interface API
 Transport layer    TCP, UDP                           layer 4 : transport - TCP o UDP
  |                  |
 Network layer      IP, ICMP                           layer 3 : network - IP
  |                  |
 Link layer         ARP, LLC                           layer 2 : data - ethernet
  |                  |
 Physical layer     Ethernet hardware                  layer 1 : physical - twisted pair

 TCP - connection-oriented; splits and re-assembles data using datagrams. Stream protocol.
 UDP - connectionless, unreliable. Datagram protocol.
 IP - no error control, only a header checksum.
 ARP - maps IP addresses to hardware addresses : "who has <IP>; tell <IP>" : output is a MAC
 RARP - "who is <MAC>; tell <MAC>" : output is an IP

Auto-negotiation is the feature that allows a port on a switch, router, server, or other device to communicate with the device on the other end of the link to determine the optimal duplex mode and speed for the connection.

It must be enabled on both sides of the link.

what is ethernet auto negotiation

An IP address is a 32-bit number that uniquely identifies a host (computer or other device, such as a printer or router) on a TCP/IP network.
The subnet mask is used by the TCP/IP protocol to determine whether a host is on the local subnet or on a remote network.

By example :

This gives you the following:

When a network device generates network traffic that needs to be sent across a network, it first compares the destination's IP address with its own network prefix.
If the destination IP address has the same network prefix as that of the sending device, then the sending device will recognise that the destination device is on the same network and, therefore, it can then send the traffic directly to it.
If the network prefixes differ, then it will send the message to its default gateway, which will forward it on towards the receiving device.

pg 37/320, Learning Python Network Programming (2015), Gooner, \\w500\C:\sebas\miscosas\llibres\tech

subnetting details

TCP/IP utilities Few useful utilities are : ipconfig [win] / netstat -nr [unix] Flags que el poden complementar : /release - release the IP address for the specified adapter. /renew - renew the IP address for the specified adapter. /flushdns - purges the DNS Resolver cache. /registerdns - refreshes all DHCP leases and re-registers DNS names [***] /displaydns - display the contents of the DNS Resolver Cache, quite interesting /showclassid - displays all the DHCP class IDs allowed for adapter. /setclassid - modifies the DHCP class id. ping Convierte nombre NETBIOS en dirección IP. ICMP based => not session based See ping -r or pingroute or pathping pathping (win32) c:\> pathping Usage: pathping [-g host-list] [-h maximum_hops] [-i address] [-n] [-p period] [-q num_queries] [-w timeout] [-P] [-R] [-T] [-4] [-6] target_name Options: -g host-list Loose source route along host-list. -h maximum_hops Maximum number of hops to search for target. -i address Use the specified source address. -n Do not resolve addresses to hostnames (faster !). -p period Wait period milliseconds between pings. -q num_queries Number of queries per hop. -w timeout Wait timeout milliseconds for each reply. -P Test for RSVP PATH connectivity. -R Test if each hop is RSVP aware. -T Test connectivity to each hop with Layer-2 priority tags. -4 Force using IPv4. -6 Force using IPv6. tracert   arp ARP performs IP address-to-Media Access Control (MAC) address resolution for outgoing packets. wiki : given an IP, it will try to find the corresponding MAC address. mr Yuri Volobuev's (1997) ARP and ICMP redirection games, magnific ! 2x codi : send_arp.c & icmp_redir.c. ARP spoofing (Arpspoof (parte de las herramientas de DSniff), Arpoison, Cain and Abel, Ettercap y netcut son algunas de las herramientas que pueden usarse para llevar a cabo los ataques ARP Poisoning) : Fyodor's exploit world arping Convert MAC to IP Works for machines which answer broadcast pings, i.e. not for windows machines arping is a tool for probing hosts in a network. Unlike the ping command, which operates at the network layer, arping operates at the data link layer and uses the Address Resolution Protocol (ARP). FreshMeat (linux only) : Arping is an ARP level ping utility. It's good for finding out if an IP is taken before you have routing to that subnet. It can also ping MAC addresses directly. manual & package [root@lab2 ~]# arping Usage: arping [-fqbDUAV] [-c count] [-w timeout] [-I device] [-s source] destination -f : quit on first reply -q : be quiet -b : keep broadcasting, don't go unicast -D : duplicate address detection mode -U : Unsolicited ARP mode, update your neighbours -A : ARP answer mode, update your neighbours -V : print version and exit -c count : how many packets to send -w timeout : how long to wait for a reply -I device : which ethernet device to use (eth0) -s source : source ip address destination : ask for what ip address The -I option seems to indicate that you are using the version from the iputils-arping package Try the arping package instead nicolau@mars:~$ arping -I wlx984827ca1628 192.168.1.229 ARPING 192.168.1.229 from 192.168.1.134 wlx984827ca1628 Unicast reply from 192.168.1.229 [6C:1D:EB:F7:FA:A5] 43.207ms Unicast reply from 192.168.1.229 [6C:1D:EB:F7:FA:A5] 4.963ms Unicast reply from 192.168.1.229 [6C:1D:EB:F7:FA:A5] 5.797ms rarp wiki : given a MAC address, it tries to find the corresponding IP address. url : Reverse ARP is a predecessor to BOOTP, on which DHCP is based. Generally, the spec. requires an *authoritative* response (hence the questions about a RARP server). It may very well be that there are TCP/IP implementations out there which will respond to RARP packets in the way you describe, but I have yet to find any. Besides, RARP (because of it's associations with BOOTP), is totally the wrong thing to use... what you *really* want is INVARP which was invented for use by ATM switches so that their IP addresses could be queried directly based on MAC address. But, again, nobody outside of the ATM community implements INVARP in their TCP/IP stack. Effectively, what this means is that there is *no way* within the scope of the standard protocols to force a system whose MAC address you know to tell you it's associated IP address. There may be a way to do it outside of the standards (maybe by crafting an ICMP packet with a bogus IP and sending it directly to the system... and then reading the real IP out of the reply..), but that would have unpredictable results... Anyway, sorry to continue the bad news :-( route See route print ! Llista les interficies i els seus "adapter number" : c:\> route print =========================================================================== Interface List 16...78 dd 08 c1 ce ab ......Bluetooth Device (Personal Area Network) 12...00 21 6a b6 cd 56 ......Intel(R) WiFi Link 5300 AGN 1...........................Software Loopback Interface 1 19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2 30...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3 La manera mes moderna és: c:\> netsh int ipv4 show interfaces Idx Met MTU State Name --- ---------- ---------- ------------ --------------------------- 1 50 4294967295 connected Loopback Pseudo-Interface 1 12 25 1500 connected Wireless Network Connection 16 50 1500 disconnected Bluetooth Network Connection ftp = file transfer protocol ftp [-v] [-d] [-i] [-n] [-g] [-k realm] [-f] [-x] [-u] [-t] [host] "ftp -i <url>" for non-interactive multiple file transfer The prompt feature of the mput command can be disabled by invoking ftp with the -i option. In this instance, all file names that match the pattern in your mput command will be transferred without confirmation. url CD = change remote working dir DIR = list remote directory PWD = display remote directory name LCD = change LOCAL directory ! nbtstat Convierte dirección IP en nombre NETBIOS c:\> nbtstat  -A   192.168.1.33 Conexión de área local 3: Dirección IP: [192.168.1.2] Id. de ámbito : []            NetBIOS Remote Machine Name Table        Nombre               Tipo         Estado     ---------------------------------------------     AIRIS-1234   <00>  Único       Registrado     AIRIS-1234   <20>  Único       Registrado     GRUPO_TRABAJO  <00>  Grupo       Registrado     GRUPO_TRABAJO  <1E>  Grupo       Registrado     GRUPO_TRABAJO  <1D>  único       Registrado     Dirección MAC = 00-10-A7-2C-42-1A netstat   nslookup DNS : nslookup uses /etc/resolv.conf Try to use dig or dig web interface 8 nslookup commands Use nslookup to troubleshoot DNS : find out "A" record (IP address) of domain : "nslookup yahoo.com" find out Reverse Domain lookup : "nslookup 209.191.122.70" find out specific Domain lookup : "nslookup ir1.fp.vip.mud.yahoo.com." query MX (Mail Exchange) record : "nslookup -query=mx www.yahoo.com" query NS (Name Server) record : "nslookup -query=ns www.yahoo.com" query SOA (Start of Authority) record : "nslookup -type=soa www.yahoo.com" query all Available DNS records : "nslookup -query=any yahoo.com" {***} enable Debug mode : "nslookup -debug yahoo.com" + "set debug" + "yahoo.com" Or you can use dig ! 10 Linux nslookup command examples for DNS lookup $ nslookup redhat.com $ nslookup -query=mx redhat.com - maps a domain name to a list of mail exchange servers for that domain $ nslookup -type=ns redhat.com {*****} - output the name serves which are associated with the given domain $ nslookup -type=soa redhat.com - provides the authoritative information about the domain, the e-mail address of the domain admin, the domain serial number, etc $ nslookup -type=any google.com $ nslookup 209.132.183.181 $ nslookup redhat.com ns1.redhat.com $ nslookup -port 56 redhat.com $ nslookup -timeout=10 redhat.com $ nslookup -debug redhat.com The Geek Stuff nslookup command to find email servers c:\> nslookup -query=mx tinet.cat Server: abc.mydomain.com Address: 1.2.3.4 Non-authoritative answer: tinet.cat MX preference = 10, mail exchanger = mx2.tinet.org tinet.cat MX preference = 10, mail exchanger = mx1.tinet.org Top ARP games Clear ARP cache (windows) : netsh interface ip delete arpcache Top netsh - doing it from command line Set IP, mask, default gateway, DNS : netsh interface ip show config // display IP configuration netsh interface ip set address name="Local Area Connection" static 192.168.0.100 255.255.255.0 192.168.0.1 1 // set IP configuration netsh interface ip set dns "Local Area Connection" static 192.168.0.200 // set DNS show all interfaces with an IP c:\> netsh interface ip show config Configuration for interface "Bluetooth Network Connection" DHCP enabled: Yes InterfaceMetric: 50 DNS servers configured through DHCP: None Register with which suffix: Primary only WINS servers configured through DHCP: None Configuration for interface "Wireless Network Connection" DHCP enabled: Yes IP Address: 192.168.1.99 Subnet Prefix: 192.168.1.0/24 (mask 255.255.255.0) Default Gateway: 192.168.1.1 Gateway Metric: 0 InterfaceMetric: 25 DNS servers configured through DHCP: 192.168.1.1 Register with which suffix: Primary only WINS servers configured through DHCP: None Configuration for interface "Loopback Pseudo-Interface 1" DHCP enabled: No IP Address: 127.0.0.1 Subnet Prefix: 127.0.0.0/8 (mask 255.0.0.0) InterfaceMetric: 50 Statically Configured DNS Servers: None Register with which suffix: Primary only Statically Configured WINS Servers: None Top DNS register, display, flush, etc Purgar DNS en windows: > ipconfig /flushdns Purgar DNS Linux: # /etc/init.d/nscd restart Purgar DNS Ubuntu: $ sudo /etc/init.d/networking restart Registrar DNS windows: > ipconfig /registerdns [***] Registrar Linux con cliente samba en servidor DNS win: $ net ads dns register -P Ver servidores DNS en Windows: > ipconfig /all Ver servidores DNS en Linux / Ubuntu: $ cat /etc/resolv.conf Ver Gateway en Windows: > ipconfig Ver Gateway en Linux / Ubuntu: $ route | grep default (nota: $ route -n => la pasarela de la superruta 0.0.0.0 es el gateway principal) Llista de comandes per DNS [***], as net stop dns net start dns Curiós: If a DNS server with static IP is not running the DHCP Client, the server may receive Event ID 5782 with "No DNS servers configured for local system" error. Interesting Linux command : nsupdate, but not an easy one ... Client configuration file : /etc/dhclient.conf has "send host-name 'host.fq.name'" line ! dubtes DNS Com es fa per definir un "alias" ? dubtes resolv.conf When configuring the resolver library to use the BIND name service for host lookups, you also have to tell it which name servers to use. There is a separate file for this, called resolv.conf. If this file does not exist or is empty, the resolver assumes the name server is on your local host. This means that on a host running a name server, you should create a zero-length /etc/resolv.conf file, even if you don't intend to put any directives in it. {"BIND bible", page 123} If you run a name server on your local host, you have to set it up separately, as will be explained in the following section. If your are on a local network and have the opportunity to use an existing nameserver, this should always be preferred. The most important option in resolv.conf is nameserver, which gives the IP-address of a name server to use. If you specify several name servers by giving the nameserver option several times, they are tried in the order given. You should therefore put the most reliable server first. Currently, up to three name servers are supported. Two other options, domain and search deal with default domains that are tacked onto a hostname if BIND fails to resolve it with the first query. The search option specifies a list of domain names to be tried. If no search option is given, a default search list is constructed from the local domain name by using the domain name itself, plus all parent domains up to the root. On a normally configured system, this file should not be necessary. The only name server to be queried will be on the local machine (no nameserver in resolv.conf), the domain name is determined from the host name, and the domain search path is constructed from the domain name. url Diferencia entre "search bar.es.hal.com" i "domain bar.es.hal.com" dins de resolv.conf ? Si posem "search example.com company.net" dins el fitxer "resolv.conf" i fem servir un nom curt com "test", llavors s'intenta resoldre primer "test.example.com" i despres "test.company.net" Si posem "domain vbrew.com", i volem resoldre el nom vale, primer fem servir el nom "vale", i si falla, "vale.vbrew.com", i finalment "vale.com". Conclusió : 1-o va NAMESERVER 2-o va SEARCH 3-o va DOMAIN Compte : aqui diu que ... (sobre "resolv.conf File Format for TCP/IP", AIX 6.1) The domain entry and search entry are mutually exclusive. If both entries are used, the one that appears last will override the other. Also "BIND bible" page 105 ...

Top FQDN url You can't change the FQDN (as returned by hostname --fqdn) or the DNS domain name (as returned by dnsdomainname) with this command. The FQDN of the system is the name that the resolver(3) returns for the host name. Technically: The FQDN is the name gethostbyname(2) returns for the host name returned by gethostname(2). The DNS domain name is the part after the first dot. Therefore it depends on the configuration (usually in /etc/host.conf) how you can change it. Usually (if the hosts file is parsed before DNS or NIS) you can change it in /etc/hosts. The FQDN

route print de les meves maquines P4 : ====================================================================== Interface list 0x1 ............................. MS TCP Loopback interface 0x30002 ... 00 10 A7 2C 70 30 ... Ralink RT2500 Wireless LAN card 0x2 ....... 00 02 2A FA 00 04 ... Realtek RTL8139 (A/B/C/8130) PCI Ethernet adapter ====================================================================== T42 : ====================================================================== Interface list 0x1 ............................. MS TCP Loopback interface 0x3 ....... 00 11 25 43 08 1a ... Intel(R) PRO/1000 MT Mobile Connection 0x40002 ... 00 00 00 00 00 01 ... AGN Virtual Network Adapter 0x40005 ... 00 0e 35 9a 07 69 ... Intel(R) PRO/Wireless 2200BG Network Connection ====================================================================== route command Commands route print route add route delete route print command Display interface id and MAC address: c:\> route print =========================================================================== Interface List 16...78 dd 08 c1 ce ab ......Bluetooth Device (Personal Area Network) 12...00 21 6a b6 cd 56 ......Intel(R) WiFi Link 5300 AGN 1...........................Software Loopback Interface 1 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter 13...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter 14...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface 19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2 =========================================================================== route add command If your need to get to site x.x.x.x you can use the following command. route add x.x.x.x mask 255.255.255.255 y.y.y.y where y.y.y.y is your local gateway. There is a flag that you have to add if you want it to survive a reboot though (-p) url

TCP/IP tools List Good network tools [1,2 MB] License for version 2.50 : url Registration Name + Registration Number ? Forensic, Nessus ... for NT Network Forensic tools (not free). From Neohapsis FoundStone : security toolkit. FTP Explorer FTP passiu & command-line [Alby] see Port Scanners

Top

A socket is an abstraction of a communication endpoint and it allows your program to communicate with another program using file descriptors.r

The socket pair for a TCP connection is a 4-tuple that identifies two endpoints of the TCP connection: the local IP address, local port, foreign IP address, and foreign port. A socket pair uniquely identifies every TCP connection on a network. The two values that identify each endpoint, an IP address and a port number, are often called a socket.

Each sockets conversation is identified by a unique combination of source and target ip address and port number, as x.x.x.x(aaaa) y.y.y.y(bbbb)

Only one conversation can exist on a network with a specific signature.

MQFirewalls.pdf [T42:\MQ\BOOKS\Security]

Top

Unlike TCP, UDP has no notion of connections. A UDP socket can receive datagrams from any server on the network and send datagrams to any host on the network. In addition, datagrams may arrive in any order, never arrive at all, or be duplicated in transit.

twisted matrix docs

Here's simple code to post a note by UDP in Python 3:

Here's simple code to receive UDP messages in Python 3:

UDP communication wiki.python

• linux hint - good samples, lots of links
• send / rcv using CLI & NC
• complete echo client/server sample

Top

wiki :

traceroute works, ping not : stackexchange :

• ping uses ICMP protocol
• tracert (windows) uses ICMP
• traceroute (linux) uses UDP packets

From nmap (insecure.org), see reference manual

W2K : is this correct ?

 c:\TEMP>ping www.google.es -n 09
 Bad value for option -n, valid range is from 1 to 4294967295.

Del llibre WSNP, chapter 16 :

As we describe in Chapter 14, "Debugging", the ICMP ping facility provides a way to reach out and gently touch another machine. All TCP/IP hosts are required to reply to an ICMP echo request. Sending an echo request, and reading the echo reply is the simplest way to check IP connectivity between two network hosts and by implication it can provide a surprising amount of other information.

The ICMP ping capability is essential for any network management application designed to run over WinSock, but many average applications can benefit also. By embedding ICMP ping an application can perform simple diagnostics automatically. This can help application users, and provide essential information to support personnel.

To create an ICMP ping application a WinSock socket() function must support the "raw ICMP" socket type (af=AF_INET, type=SOCK_RAW, protocol=IPPROTO_ICMP). The following code example shows you how.

The following code example illustrates the essentials that go into a ping application. A few things to notice about in this example:

• You can use this code in any operation mode (blocking, non-blocking or asynchronous).
• The ID and sequence numbers in the ICMP header (nIcmpId and nIcmpSeq) allow an application to match echo requests with replies. At least one WinSock implementation uses the ID field for their own, so we recommend using the sequence field for portability.
• You can expect the echo reply to contain a copy of the data you send
• The syntax for sends and receives are asymmetric. As in Berkeley Sockets, you provide the ICMP header and data when you send, but when you receive you get the IP header as well as the ICMP header and data.
• In implementations that support the IP_TTL socket option (which we describe next) you could alter the IP time to live before sending the ICMP echo, and read the destination address from the ICMP error packet response and trace the route of the datagram.

Aquest missatge ...

... indicates a routing loop :

Top

A normal MAC address looks like this: 00:09:5B:EC:EE:F2. It is composed of six octets.
The first half (00:09:5B) of each MAC address is known as the Organizationally Unique Identifier (OUI). Simply put, it is the card manufacturer.
The second half (EC:EE:F2) is known as the extension identifier and is unique to each network card within the specific OUI. Many access points will ignore MAC addresses with invalid OUIs. So make sure you use a valid OUI code when you make up MAC addresses. Otherwise, your packets may be ignored by the Access Point.

The current list of OUIs may be found here.

Make sure that that the last bit of first octet is 0. This corresponds to unicast addresses. If it is set to 1, this indicates a group address, which is normally exclusively used by multicast traffic. MAC addresses with a source set to multicast are invalid and will be dropped.

Examples of valid OUIs: 00:1B:23, 08:14:43, AA:00:04 because 0, 8 and A are even.
Examples of invalid OUIs: 01:1B:23, 03:23:32
In particular, it is recommended that the first octet to be 00.

url

Buscador de MAC's ... vendor finder

Top

• 0trace
• 5nmp
• Angry IPScan
• Arping
• Autoscan
• Fping
• Genlist
• Hping2
• Hping3
• Lanmap
• Lanmap2
• Nbtscan
• Netifera
• Nmap
• Nsat
• Onesixtyone
• OutputPBNJ
• ScanPBNJ
• SCTPscan
• SSLscan
• TCPtraceroute
• Unicornscan
• Zenmap

Top

By default, nmap does host discovery and then performs a port scan against each host it determines is online.

Global nmap description : The Art of Port Scanning, by Fyodor [1997].
Fyodor at Black Hat 2008, DEFCON 16
Homepage, docs. Tutorial [***] host discovery : ARP ping "-PR".

Top 30 nmap command examples for sys/network admins [***]

See "Xmas ping" ... to all the IP's !

Use sudo to display the MAC's !!

The Connect Scan
If a SYN Packet is sent to an closed port, a SYN, ACK response will not be sent. Instead the target will reply with a RST, ACK (Rest, Acknowledge) indicating the port is closed.
Read more details here

The SYN (half open) scan.
The concept behind the half open scan is to hide the fact a connection is taking place from the remote operating system. This is accomplished by never completing the 3 way handshake. Instead of sending the ending "ACK, a "RST" is sent to notify the target that the connection should be closed before it is fully open.

The Null scan.
The concept behind a Null scan is to send a packet with invalid flags set, in the case of a null scan, setting no flags. When the target receives such a packet, it will either be dropped or responded to with a RST, this will obviously be dependent on what state the destination port is currently in (open or closed).

The Xmas Scan
The Xmas scan is similar to the null scan; it is also based on the idea of sending packets with invalid flags set. Where as the null scan sends a packet with no options, the XMAS Scan uses the URG PSH and FIN (Urgent, Push and Finish) flags. Once again, if the port is closed, a RST will be sent back to the client and if it is open the packet will be dropped.

Download nmap 4 Windows.

WinPcap is a Windows driver for raw network connection. It is used by nmap (port scanner software) and tcpdump (ethernet sniffer). It is open source and is a driver.

To fill the ARP table, scan all IPs of a range :

Exemples :

SuSE SLES 10 SP1 - rpm requires rtld (GNU-HASH) requisite.

Newer versions of nmap will only show the MAC address if you're running as root

netcat is used for just about anything under the sun involving TCP, UDP, or UNIX-domain sockets. It can open TCP connections, send UDP packets, listen on arbitrary TCP and UDP ports, do port scanning, ...

port scan :

On the server launch :

On the client launch :

El filtre a Guindous es així :

M'agrada mes

Seguit de :

Millor encara :

El millor de tots (20150506):

Author, Salvatore Meschini, says to download latest version from here
Own site is at : http://smeschini.altervista.org ; old (dead) was http://web.tiscali.it/no-redirect-tiscali/salvatoremeschini/download/netstat32.htm
Read it here.

Replacement for "netstat" is "ss" - another utility to investigate sockets

Replacement for "netstat -r" is "ip route "

Replacement for "netstat -i" is "ip -s link"

Replacement for "netstat -g" is "ip maddr"

Top

uSoft : Dynamic Host Configuration Protocol (DHCP) is a standard protocol defined by RFC 1541 (which is superseded by RFC 2131) that allows a server to dynamically assign IP address and other parameters (DHCP options) to devices on the network.

The protocol uses both UDP port 67 (server) and UDP port 68 (client) and several different message types.

Normally the DHCP server provides the client with at least this basic information:

• IP address
• subnet mask
• default gateway

Other information can be provided as well, such as Domain Name Service (DNS) server addresses and Windows Internet Name Service (WINS) server addresses.

Managing MS DHCP Servers - com fer que el DHCP propagui el DNS !

Wiki DHCP

To configure a DHCP server, the /etc/dhcpd.conf configuration file must be created. DHCP also uses the file /var/lib/dhcp/dhcpd.leases to store the client lease database.

First line must select DNS update shema. Refer to the dhcpd.conf man page for details about the different modes.

• ddns-update-style ad-hoc; // old fashion, deprecated
• ddns-update-style interim; // recommended mode
• ddns-update-style none; //

DNS's are included in a sentence like:

Centos, HowToForge

RFC 2131

• DHCP_discover
• DHCP_offer
• DHCP_request
• DHCP_ack

Managing dynamic IP networks, page 22 and 72.

• DHCPDISCOVER

  This DHCP message type is used by the DHCP client to discover DHCP servers.

• DHCPOFFER

  This DHCP message type is used by the DHCP server to respond to a received DHCPDISCOVER message and also offers configuration details at that time.

• DHCPREQUEST

  This message comes from a client and to the DHCP server to convey three various messages.
  The first is to request configuration details from one specific DHCP server and specifically rejecting offers from any other potential DHCP servers.
  Secondly it can be used for verification of previously used IP address after a system has undergone a reboot.
  Lastly, it can be used to extend the lease of a specific IP address.

DHCP tutorial part1 part 2

1, 2, Web Admin tools.

Linux: if you want to get a new IP address assigned from your DHCP server, use the pump command or dhclient

DHCP tools :

Netsh commands for DHCP.

DHCP @ uSoft TechNet.

dhcp_probe : locate DCHP and BootP servers

I want to know who provided me my IP

"cat /var/log/syslog | grep dhcp"

mind you can have a "fixed" IP

From file /var/lib/named/log/named_query.log

All leases story can be found in file /var/lib/dhcp/db/dhcpd.leases

For the DHCP server to provide a fixed IP, we must declare its MAC explicitly :

url.

We configure the destination file in named.conf :

We administer the trace level using rndc, nameserver control utility :

wiki

Online O'Reilly book !

Llibre administració SuSE.

L'eina principal és el nslookup i el dig i el host :

Per veure a quin domini som fem servir la comanda:

Per veure quins host(s) veu un DNS, fem servir la comanda:

Espectacular:

Any answer that originates from the DNS Server which has the complete zone file information available for the domain is said to be authoritative answer.

Que vol dir si no funciona ?

Top

Los archivos de configuración que tendremos que modificar en el servidor DNS son :

• /etc/bind/named.conf
• /etc/bind/named.conf.options
• /etc/bind/named.conf.local
• /etc/bind/db.aulaESI.com
• /etc/bind/db.192.168.1

url

DNS/BIND/DHCP/WINS Issues Forum (tek tips) [/].

El fitxer de configuració principal és named.conf:

Compte :

I el detall de cada zona:

zonesample url

No funciona d'inici:

Modifiquem:

Ara ja funciona:

Si fem cap canvi, cal reiniciar el dimoni :

Com verificar el funcionament ? url.

DNS tools. Interrogating DNS.

If netconfig utility is in use, "forwarders" values are in file /etc/sysconfig/network/config Otherwise, they are in file /etc/named.conf

forward is only relevant in conjunction with a valid forwarders statement. If set to 'only' the server will only forward queries. If set to 'first' (default) it will send the queries to the forwarder and if not answered will attempt to answer the query.

See details here

BIND provides two tools to check the syntax of named.conf and zone files:

More information and samples for Opensuse's implementation of BIND located here: /usr/share/doc/packages/bind

Problema:

Per arreglar-ho, cal crear una zona de reverse lookup :

Lets do it - to create a reverse lookup zone, perform the following steps:

1. In DNS Manager, right-click your DNS server, and then click New Zone.
2. Click Primary from the "Creating New Zone for" dialog box, and then click Next.
3. The Zone Name is derived from your IP network address.
   In the example information, the Zone Name is 58.168.192.in-addr.arpa. Type your reverse zone name (the least significant part of the IP address, and work toward the most significant part of the address). For example:
   If your network ID is: Then your reverse zone is: 10.0.0.0 10.in-addr.arpa 130.20.0.0 20.130.in-addr.arpa 250.30.203.0 203.30.250.in-addr.arpa

   NOTE: The syntax of the reverse lookup zone is imperative to its operation.

4. After you type the reverse lookup zone name, press Tab and the reverse lookup zone file name will automatically fill in using the zone name in step 3 appended by ".dns" (without the quotes).
5. Click Next, and then click Finish.

Tot va començar pel missatge
The query was for the SRV record for _ldap._tcp.dc._msdcs.cloud.bisc The DNS record is not registered in DNS

Fitxer interessant : \system32\config\NETLOGON.DNS - conté ...

Un altre fitxer interessant : %windir%\debug\NETSETUP.LOG - used for logging domain joins, including joinings to a workgroup. NETSETUP.log will exist on every workstation, server and domain controller. They will all have a copy of this file, which is updated on each join so it has a nice history.
Have a look also at DCPromo.log and the DCPromoUI.log at the Active Directory / Domain Controller server, %windir%\debug\

url

Comanda interessant:

Eines interessants aqui : Windows Server 2003 Service Pack 2 32-bit Support Tool : NETDIAG.exe & DCDIAG.exe !

Problema i solució de dcdiag /q:

Testing server: Default-First-Site-Name\MINNIE Starting test: Connectivity The host 405990df-28f4-4962-b53b-ead34915f175._msdcs.ad.imoveinc.com could not be resolved to an IP address. Check the DNS server, DHCP, server name, etc. ......................... MINNIE failed test Connectivity

Let's manually create the missing record

1. right click _msdcs.ad.imoveinc.com
2. choose New Alias (CNAME)
3. in the Alias Name field, type in 405990df-28f4-4962-b53b-ead34915f175
4. in the "Fully qualified..." field, type in MINNIE.ad.imoveinc.com
5. click OK
6. ipconfig /registerdns
7. net stop netlogon
8. net start netlogon

Comanda interessant:

This query to the DNS Server will return all the domain controllers in the domain name:

D'una altra manera :

Explicació :

A workstation that is logging on to a Windows 2000 domain queries DNS for SRV records in the general form:

_Service._Protocol.DnsDomainName

Active Directory servers offer the LDAP service over the TCP protocol; therefore, clients find an LDAP server by querying DNS for a record of the form:

_ldap._tcp.DnsDomainName

SRV Resource Records [***]

• connect to your Windows DNS server and open the DNS control panel (start->Administrative Tools->DNS)
• expand the node corresponding to your server
• expand the "Forward Lookup Zones" node
• expand the node corresponding to your domain
• delete the _msdcs node if it exists
• right click on the domain node and select "New Domain..."
• enter "_msdcs" as the name
• right click on the new "_msdcs" node, select "New Domain...", and choose "dc" as the name
• right click on the new "dc" node and select "Other New Records..."
• select "Service Location (SRV)" as the record type and click the "Create Record" button
• select "_ldap" as the service and "_tcp" as the protocol
• enter 389 as the port
• put in the fully qualified host name of your DC, or the IP address, in the "Host offering this service:"
• click "OK" and then "Done"
• open up the services console (start->run->services.msc)
• right click on the "DNS Server" service and select "Restart"
• your domain DNS record should now be set up

url

Després de un canvi en un AD/DC :

Read DNS root zone : The root servers have the official names a.root-servers.net to m.root-servers.net. The root name servers are hosted in multiple secure sites with high-bandwidth access to accommodate the traffic load. Usually each DNS server installation at a given site is physically a cluster of machines with load-balancing routers. A comprehensive list of servers, their locations, and properties is available at http://root-servers.org.

Llista actualitzada : ftp://ftp.rs.internic.net/domain/named.root

Ubicacions, as Mountain View

Top

RH manual install

Make sure the service is started and will auto-start on reboot.

Check the current status of the service

To disable the firewall, run the following commands.

The GUI screen to control the firewall is available from the menu (System > Administration > Firewall) or can be started from the command line using the system-config-firewall command. If it is not already present, it can be installed using the following command.

Always read wiki - active vs passive. Also Filezilla Network Configuration

Read documentation

If a filename has an accent at source, Filezilla will admit it and send the file to Tinet

That filename will be displayed by Tinet in Filezilla with strange signs and wont be deleted by usual way

We have to use manual FTP then ...

Transfer and Session logs : C:\Users\bisc\AppData\Roaming\Ipswitch\WS_FTP\Logs

Mínims :

• 2 tarjes de xarxa
• cable creuat
• ficar IP's manuals ( as 192.169.1.30 ), Mask 255.255.255.0, sense GW ni DNS.
• propietats de la tarja de xarxa - ha de tenir "File and Printer Sharing for uSoft Networks"
  *** NO seleccionar "Show icon in notification area when connected" ***
• W98 : Primary Logon := "uS Network Client"
• ambdós a "System" + "WorkGroup" := WORKGROUP ;

Un ordinador pot aconseguir conectivitat mitjançant :

• una tarja Ethernet
• un enllaç d'infrarrojos
• un enllaç Bluetooth
• un enllaç Wifi
• una tarja PCMCIA
• una conexió USB
• una conexió Firewire

Description on how NCSI determines whether a network has Internet connectivity:

1. a request for DNS name resolution of dns.msftncsi.com - [131.107.255.255]
2. a HTTP request for http://www.msftncsi.com/ncsi.txt returning 200 OK and the text Microsoft NCSI

This can be disabled with a registry setting. If you set

... to 0, Windows will no longer probe for internet connectivity.

In Windows 2000, the Host name (Directory Naming Service, DNS) and Computer name (NetBIOS) must be the same.
In some previous operating systems, you could have two or more aliases that point to the same computer, by having multiple host names.
To view/change the computer name, use Start / Settings / Control Panel / System / Network Identification / Properties.
NOTE: In Windows 2000, the host name is the actual point of reference. The computer name was provided for backwards compatibility.

How do you set, under W95 :

• (*) Computer name - NetBIOS ; broadcasts or WINS ; 16 chars ; no domain ;
  Control Panel + Network + Identification : set Computer Name and Workgroup.
  Displayed using nbtstat -A <hostip>
  W2000 : Control Panel + System + Network Identification. Displayed using hostname

• (*) Host name - TCP/IP based ; HOSTS file or DNS ; 255 chars ; usualy as part of a domain ;
  TCP/IP Properties + DNS configuration : set Host and Domain.
  Displayed using winipcfg. W2000 : nslookup <hostip>

• el WAS deix de funcionar si canviem el HostName !
• el DB2 deix de funcionar si canviem el HostName !
  Solució : fitxer ... ?

Each distribution has a script that runs at boot time which sets the hostname. The way to change the hostname permanently thus differs by distribution.

• Debian has an init script, /etc/init.d/hostname.sh, which is called at boot time and sets the hostname what is given in /etc/hostname. To change the hostname, place only the unqualified hostname (e.g., gauss) in /etc/hostname and run sudo /etc/init.d/hostname.sh.
• Ubuntu, like Debian, also uses /etc/hostname, but to update the hostname after making a change, run sudo service hostname start.
• Slackware uses /etc/HOSTNAME. Set the appropriate hostname there and run hostname -F /etc/HOSTNAME as root.
• Red Hat systems look for a line like
  HOSTNAME=gauss
  in /etc/sysconfig/network

url

Compte : agafa el domini de /etc/hosts !

Problemes :

• ping rc = 65 : firewall or router did disable ICMP Echo and Echo Reply packets.

mtr - a network diagnostic tool

mtr combines the functionality of the traceroute and ping programs in a single network diagnostic tool.

1. click Windows Start and then click Run. In the Run dialog box, Windows 95, 98, and Me users: Type command and click OK. Windows NT, 2000, and XP users: Type cmd and click OK. The command line screen opens.
2. type PING 127.0.0.1. This is your local host address. The address assures that TCP/IP is installed and functions properly. If you can't complete this ping, disconnect the router and then repeat the installation procedure.
3. type PING followed by your IP address. This assures that your PC responds to requests. If you can't complete this ping, make sure all the cables connect properly and that all the correct drivers are installed.
4. type PING followed by your gateway address to check the communication with your gateway. (The default gateway address is 192.168.1.1.) This assures that you can connect to other machines and the router. If you can establish communication with the router, you can access the Administration page and configure settings. If you can't complete this ping, make sure that the router power cord is plugged in. Also make sure that the router is properly connected to your PC.
5. type PING followed by the outside Internet address of your router. This is the address that is provided either by your ISP or by the outside LAN. This procedure will assure that your router functions properly and allows traffic to pass through.
6. type PING followed by your known DNS server address. This will allow you to resolve valid Internet host names to IP addresses and to verify that you can access the Internet.

Top

The HOSTS file had 2 "localhost" entries, the last one of them pointing to some external IP.

support nicrosoft

1) Para cambiar el puerto predeterminado de todas las conexiones nuevas creadas en el servidor Terminal Server, hay que abrir esta clave del Registro :

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

Busque la subclave "PortNumber" y observe el valor 00000D3D (hexadecimal de 3389). Modifique el número de puerto en hexadecimal y guarde el nuevo valor.

2) Para cambiar el puerto de una conexión específica en el servidor Terminal Server:

Ejecute Regedt32 y vaya hasta esta clave:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\connection

Busque la subclave "PortNumber" y observe el valor 00000D3D (hexadecimal de 3389). Modifique el número de puerto en hexadecimal y guarde el nuevo valor.

Display it from command line :

Top

Test your smtp server with telnet utility - sample :

url

• Using "lsof -i" :
  mate@punt-omnia:~$ sudo lsof -i :80 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME node 1682 root 19u IPv6 23200 0t0 TCP *:http (LISTEN)

• Using "netstat" :
  mate@punt-omnia:~$ sudo netstat -peanut | grep 80 tcp 0 0 10.139.238.194:48164 10.139.130.119:80 TIME_WAIT 0 0 - tcp 0 0 10.139.238.194:39048 10.139.130.102:80 TIME_WAIT 0 0 - tcp 0 0 10.139.238.194:39050 10.139.130.102:80 TIME_WAIT 0 0 - tcp 0 0 10.139.238.194:39046 10.139.130.102:80 TIME_WAIT 0 0 - tcp 0 0 10.139.238.194:52130 10.139.130.117:80 TIME_WAIT 0 0 - tcp 0 0 10.139.238.194:59694 10.139.130.69:80 TIME_WAIT 0 0 - tcp 0 1 10.139.238.194:36854 10.139.130.230:80 SYN_SENT 0 883273 1545/node tcp 0 0 10.139.238.194:59692 10.139.130.69:80 TIME_WAIT 0 0 - tcp6 0 0 :::80 :::* LISTEN 0 23200 1682/node tcp6 0 0 10.139.238.194:80 10.139.238.194:41118 TIME_WAIT 0 0 - udp6 0 0 ::1:50743 ::1:41544 ESTABLISHED 13 835880 4368/(pinger)

• Using nmap [*****]

Top

Open SSH 4 Windows - minimal OpenSSH server and client utilities. OpenSSH url, download

OpenSSH suite replaces rlogin and telnet with the ssh program, rcp with scp, and ftp with sftp.

AIX scp para copiar un fichero remoto : $ scp remote_user@remote_ip:remote_file_name local_file_name

Copies between two remote hosts are permitted.

El scp es el client i ve instal.lat amb el ssh. Al servidor hi ha d'haver el ssh-server corrent i escolant (normalment per la porta 22) i res mes.

exemple 1: vull enviar l'arxiu albert.tgz que tinc al meu homedir del meu pc, al meu homedir del server "kaka.com".

(no et deixis els dos punts finals)

exemple 2: vull baixar-me l'arxiu dades.tgz del subdirectori "merdetes" que es al servidor kaka.com al homedir del pep:

(no et deixis el punt final amb espai)

Aixo et demanarà la password cada vegada ...

Amb un port diferent : scp -p 2222 nom.mp4 sebas@93.176.177.116 {compte "P" ay cygwin}

Install the (guindous) program into "openssh"

The OpenSSH server listens for traffic on TCP port 22 by default.

Interessant : $ ssh usuari@nom_maquina "<comanda> <parametres>"

Brutal el SSH !

Locate passwd in C:\Program Files (x86)\OpenSSH\etc Replace /home/YOUR_NAME with /cygdrive/c/Documents and Settings/YOUR_NAME.

Under Windows, the format of passwd file is a bit tricky :

Now ssh-keygen writes into proper directory c:\sag\sshd\.ssh :

Sebas

Enric

To fix it, creating a vulnerability on your server, edit /etc/ssh/sshd_config on the server, append the following line {una sola linia} and restart sshd daemon :

1. disable OpenSSH Server
2. only use SSH protocol 2
3. limit users' SSH access
4. configure idle Log Out timeout interval
5. disable .rhosts files
6. disable Host-Based Authentication
7. disable root login via SSH : vi /etc/ssh/sshd_config ; "PermitRootLogin no" ; /etc/init.d/sshd restart
8. enable a warning banner : "vi /etc/ssh/sshd_config" to contain "Banner /etc/ssh/my_banner.txt" plus "sudo service sshd restart"
9. firewall SSH Port # 22
10. change SSH Port {I dont agree} and Limit IP Binding
11. use strong SSH passwords and passphrase
12. use Public Key Based Authentication
13. use Keychain Based Authentication
14. chroot SSHD (Lock Down Users To Their Home Directories)
15. use TCP wrappers
16. disable empty passwords
17. thwart SSH crackers (Brute Force Attack)
18. rate-limit incoming port # 22 connections
19. use Port Knocking {I dont agree}
20. use Log Analyzer : RH {/var/log/secure}, others {/var/log/auth.log}
21. patch OpenSSH and operating systems

url

Run the command

... to check the validity of your configuration and of your keys.

To do it once run

1. edit "/etc/ssh/sshd_config" to contain "LogLevel VERBOSE"
2. sudo service rsyslog restart
3. sudo tail -f /var/log/auth.log

url

Can enter after

Also use

Symptom :

Remove PAM :

Symptoms : client displays "ssh_exchange_identification: Connection closed by remote host"

1. start sshd server on foreground on a diferent port
   $ guifi@torrelles:/etc/ssh$ /usr/sbin/sshd -D -d -p 10222

2. connect client to new port
   C:\temp> ssh -v -v -v 10.139.130.34 -p 10222

3. see results
   debug1: Server will not fork when running in debugging mode. debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8 debug1: inetd sockets after dupping: 3, 3 debug1: Connection refused by tcp wrapper

Solution : edit /etc/hosts.deny

Have a look at the log file:

(p7029) remote ssh was closed, and sshd.log had

Fixed by

1. create destination files
   p7029-6E3:/var/log # mkdir sshd p7029-6E3:/var/log # touch /var/log/sshd/sshderr.log p7029-6E3:/var/log # touch /var/log/sshd/sshd.log

2. configure /etc/syslog-ng/syslog-ng.conf.in
   # SSH Filters filter f_sshderr { match('^sshd\[[0-9]+\]: error:'); }; filter f_sshd { match('^sshd\[[0-9]+\]:'); }; # SSH Logging destination sshderr { file("/var/log/sshd/sshderr.log"); }; log { source(src); filter(f_sshderr); destination(sshderr); flags(final); }; destination sshd { file("/var/log/sshd/sshd.log"); }; log { source(src); filter(f_sshd); destination(sshd); flags(final); };

3. run SuSEconfig

4. restart daemon
   service syslog restart

url

Configure to have a banner :

On hi tenim

Finalment

Note : even if the banner is enabled in sshd_config and sshd is fully restarted, the user's own ~/.ssh/config can suppress the banner using:

On Ubuntu systems, /etc/motd is typically a symbolic link to /run/motd.dynamic - see "man update-motd"

1. [u1@lab1 ~]$ ssh-keygen -t rsa
2. [u1@lab1 ~]$ ssh u2@lab2 mkdir -p .ssh
3. [u1@lab1 ~]$ cat .ssh/id_rsa.pub | ssh u2@lab2 'cat >> .ssh/authorized_keys'
4. [u1@lab1 ~]$ ssh u2@lab2 hostname

Sample session:

linuxproblem

url, url.

M.A. (gracias!) :

1. [lab001] fer logon com "sebas", usuari que es fa servir pel SCP

2. [lab001] crear clau pública / clau privada :
   ssh-keygen -t rsa

3. [lab001] copiar la clau pública a destinació :
   scp id_rsa.pub sebas@bcnlab0s8:.

4. [lab008] add 001’s public key at /home/sebas/.ssh/ & change permissions :
   cat id_rsa.pub >> authorized_keys chmod 600 authorized_keys

5. [lab001] verificar funciona sense password :
   ssh sebas@lab008 scp src_file sebas@lab008:.

• "If any of the files (or directories leading up to the files) {~/.ssh or ~/.ssh/authorized_keys} have permissions set too loose, the connection will fail"
  server$ chmod go-w ~/ server$ chmod 700 ~/.ssh server$ chmod 600 ~/.ssh/authorized_keys

• read /var/log/secure

Good page.

Just installed but does not start:

No log in "c:\Program Files (x86)\OpenSSH\var\log>"

Per saber si hi es :

documentar PSCP.EXE - FTP via SSH (Putty Secure Copy Client)

Similar al WinSCP ...

Top

SNMP provides its users with a "simple" set of operations that allows these devices to be managed remotely.

The core of SNMP is a simple set of operations (and the information these operations gather) that gives administrators the ability to change the state of some SNMP-based device. For example, you can use SNMP to shut down an interface on your router or check the speed at which your Ethernet interface is operating. SNMP can even monitor the temperature on your switch and warn you when it is too high.

O'Reilly - Essential SNMP.chm

SNMP (Simple Network Management Protocol) is a protocol for managing networks. Each managed entity in the network will run an snmp server (snmpd) which is going to collect datas from the server such as networking, load, cpu ...

• acces remot ubuntu
• resum curt
• llarg amb concepte
  • p1
  • p2
  • p3
• amb Cacti

SNMP uses UDP because it outperforms TCP in lossy networks.

SNMP uses the User Datagram Protocol (UDP) as the transport protocol for passing data between managers and agents. UDP, defined in RFC 768, was chosen over the Transmission Control Protocol (TCP) because it is connectionless; that is, no end-to-end connection is made between the agent and the NMS when datagrams (packets) are sent back and forth. This aspect of UDP makes it unreliable, since there is no acknowledgment of lost datagrams at the protocol level. It's up to the SNMP application to determine if datagrams are lost and retransmit them if it so desires.

Compte amb els "trap"

SNMP uses the UDP port 161 for sending and receiving requests, and port 162 for receiving traps from managed devices.

A computer network system that uses SNMP for network management consists of the three fundamental components :

• The SNMP manager
  It is a software that usually runs on the machine of network administrator or any human manager managing the computer network.
• The SNMP agent
  It is a software that usually runs on the network node that is to be monitored. This node could be a printer, router etc.
• The SNMP MIB
  MIB stands for Management information base. This component makes sure that the data exchange between the manager and the agent remains structured.

In SNMP, MIB objects are defined by the convention x.y, where x is the actual OID of the managed object and y is the instance identifier. For scalar objects (that is, objects that aren't defined as a row in a table) y is always 0. In the case of a table, the instance identifier lets you select a specific row of the table;

SNMPv1 and SNMPv2 use the notion of communities to establish trust between managers and agents. An agent is configured with three community names: read-only, read-write, and trap. The community names are essentially passwords; there's no real difference between a community string and the password you use to access your account on the computer. The three community strings control different kinds of activities.

Most vendors ship their equipment with default community strings, typically public for the read-only community and private for the read-write community. It's important to change these defaults before your device goes live on the network.

SNMP communication between manager and agent takes place in form of messages. Following are the basic messages used for communication :

• SNMP GET
• SNMP GET-NEXT
• SNMP GET-RESPONSE
• SNMP SET
• SNMP TRAP

The messages GET and GET-NEXT are used to fetch the value of a particular MIB object.
The message GET-RESPONSE is used mostly by the agent to send the response to a GET or GET-NEXT message.
The message SET is used by the manager to set the new value of a particular MIB object at the agent.
The message TRAP is used by the agent to send information about some alarming values for some object to the manager so that appropriate action could be taken by the manager.

All SNMP devices share the following common configurable parameters:

• sysLocation
• sysContact
• sysName
• Read-write and read-only access community strings (and frequently, a trap community string)
• Trap destination

snmptrapd allows you to send SNMP trap messages to facilities such as Unix syslog or stdout.

Here's how the Net-SNMP snmptrap program is invoked:

Video Find Your Raspberry Pi

If 41 is the first octet to "ping" ...

From a BAT file ...
FOR command variables which use a single leading % on the command line or a double leading %% when used in a batch file :

ss64

From cygwin :

Using nmap :

Or netcat :

The windows shell has no "sleep" command, so a local ping can stand-in. Following command is effectively sleep 4 :

url

Port Scanners list

Top

Wiki.

My tests

Investigar tunneling thru squid to koltrane !

There are 2 class of tunnels : "L" local or "R" remote.

I want to set up a tunnel from, port 10001 on the local host to port 3689 on the remote host :

"localhost" refers to the host at the remote side which we want to act as the other end of our tunnel

Now, I can type http://locahost:10001 in my browser, which will access port 3689 on my server

Que tenim a casa :

Si a casa donem

The "-f" tells ssh to go into the background just before it executes the command.
The "-N" instructs OpenSSH to not execute a command on the remote system.

Estem dient : "quan jo parli amb el port local 10001 vull sortir a 172.25.37.121:22 passant per 10.138.238.1"

Després podem fer

No funciona - encara no en se prou.

By example

This allows anyone on the remote server to connect to TCP port 8080 on the remote server. The connection will then be tunneled back to the client host, and the client then makes a TCP connection to port 80 on localhost.
This particular example would be useful for giving someone on the outside access to an internal web server. Or exposing an internal web application to the public Internet.

ProxyTunnel homepage - nice description

ProxyTunnel is a small C program that is parameterised with the proxy to connect through, a proxy userid/password and the name and port of a server to connect to.

ProxyTunnel builds a network connection to the proxy and executes the CONNECT command (authenticating to the proxy as specified). Once it has done so it then acts as a bridge between its caller and the proxy/target server (it does this through inherited file descriptors 0 and 1)

Are you trying to set up a website, ftp server, mail server or any other type of online service that you want people to be able reach over the Internet?

Does your ISP only give you a dynamic IP address, one that changes from time to time and is not static ?

Here are a few simple steps to follow to get yourself setup and online with No-IP.com's free dynamic DNS service, so you can run your servers at your home or business without a static IP address.

How to remote access your device:

1. (internet) create an account at no-ip and create a Hostname - add a host or domain to your account : sebastiasebas.hopto.org
   A hostname is used instead of your IP address whenever you want to connect to a service at your location.
2. (server) download the Dynamic Update Client (DUC) for guindows or linux
   The DUC keeps your hostname updated with your current IP address.
3. (router) Port Forward your router
4. the best alternative is Duck DNS

[ http://www.no-ip.com ] [hopto.org] { 20210505 coupon code: SUP8 (x2) }

1. go to noip.com and configure a new Hostname pointing to our external IP
   r3sag.ddns.net -> 2.138.10.107
2. ... or use Duck DNS,
3. go to FO modem and open the port so external requests are routed to local server

Installing DUC for linux : howtoforge.com

Verificar :

• {odin} http://r3sag.ddns.net:9035 {R3 and FO}
  ex http://myraspiodin.hopto.org:9035
• {raspall} http://raspall.hopto.org:9007 - "semafor d'en JA"
• {pomnia} http://xarxatorrelles.ddns.net:7080

To run the client in the background using config "/usr/local/etc/no-ip2.conf" file, the command is :

• ps -aux | grep -v grep | grep noip2
• host myraspiodin.hopto.org
• host raspall.hopto.org
• host xarxatorrelles.ddns.net

Place this line in file "/etc/rc.local" :

servidors DDNS gratuits :

• no-ip (needs refresh)

• the best alternative is Duck DNS, which is both free and Open Source - free dynamic DNS hosted on Amazon EC2 - how-to

• other great apps like No-IP are FreeDNS (Freemium), Dynu Dynamic DNS (Free), NameCoin (Free, Open Source)

In crontab, place

As a result, /home/pi/duckdns/duck.sh -> duck.log has "OK"

uTube howto

http://sebas-r0.duckdns.org:2000/ ---> r0:3000 as http://pi0:3000/ === Fronius SmartMeter data APP at R0 http://sebas-r0.duckdns.org:9080 ---> r0:9080 === web server al R0 http://sebas-r3.duckdns.org:9083 ---> r3:9083 === web server al R3 access it ! http://sebas-r0.duckdns.org:9180 ---> r0:22 == 192.168.1.222:22 === R0 admin sebas@minie:~$ ssh 192.168.1.222 -p 22 http://sebas-r3.duckdns.org:9183 ---> r3:22 == 192.168.1.123:22 === R3 admin http://sebas-r4.duckdns.org:9184 ---> r4:22 == 192.168.1.200:22 === R4 admin sebas@minie:~$ ssh sebas-r4.duckdns.org -p 9184 http://myraspiodin.hopto.org:8123/ === TC74 temperature {oldie}

Al ZTE de Masmovil {2025} es configuren a "Internet" + "Security" + "Port Forwarding"

Verifiquem conectivitat :

• vamos a la web www.no-ip.com y abrimos una cuenta y creamos una nombre de dominio, por ejemplo, "mi_prueba.no-ip.info"
• descargamos el software "No-Ip DUC" - debe correr en nuestro PC, ya que será el enlace de nuestra IP variable al nombre de dominio

1. entrem al router i anem a "Configuracion Avanzada"
2. al "Advanced Setup -> DNS -> Dynamic DNS" piquem el botó "Afegir"
3. D-DNS provider := "NO-IP" ;
4. Hostname := el nostre hostname a no-ip
5. Interface := 6/ppp0.1
6. no-ip user/password := your values

ddns in router

Available tools :

• Apache is a well established web server and runs quite well on Raspberry Pi.
• another choice is LigHTTP
  sudo apt install lighttpd
• I prefer NGINX
  sudo apt install nginx

Now that NGINX is installed we can start the server and test that its running.

Now we can use PHP or NodeJS

Chris

• DHCP update problems : see /var/log/messages at DNS server
• DHCP setup, as NAMED.CONF : see /usr/share/doc/packages/dhcp-server/DDNS-howto.txt

enpXsY signifies that it's a pci device (from the p), on pci bus X, in slot Y

Top

Knoppix includes the capability to transfer your important files over a network if that is the method you prefer. By far the easiest way to accomplish this is to have your Knoppix system run an SSH server for you. SSH provides the capability to interactively log into your Knoppix system as well as transfer files, all over an encrypted transmission, meaning that should anyone intercept your communication, he'd have a very difficult time deciphering the actual data. If the system to which you are transferring the files resides on a Linux or Knoppix system, the capability to SFTP files is already built into the system. If you are transferring your files to a Windows system, you need to download an SFTP client (one recommend free version is WinSCP, available at WinSCP)

To allow a remote Linux or Windows system to connect to the Knoppix system you want to back up, start the SSH server on the Knoppix system by selecting Knoppix>Services>Start SSH Server. A key used for encryption is generated in the window that opens. Enter a strong password, and then enter it the second time the same way. The password you enter here is used when logging into the system via SFTP, and it is case sensitive, so make sure that you remember your exact password.

You need to know your system's IP address (use the command ipconfig eth0 to determine your IP address; it is four sets of numbers separated by dots, such as 192.168.1.1). Using WinSCP or another SFTP/SCP client, connect to your Knoppix machine with the IP address. Enter knoppix as the username, and then enter the password you created earlier. Now you can navigate the file system to find the files you want to copy to the remote system using SFTP commands if you are connecting via the command line, or by dragging and dropping if you are using a graphical application such as WinSCP.

extremetech

You can save (bookmark) any directory you need to access regularly. url.

Also, you can set Default directories also : url. WinSCP Login -> Environment -> Directories -> {set} -> Save.

Top

Have you ever gone on a trip with a laptop and wanted access that web page with all the information about where you are going? Well, here is a complete open source solution and completely free.

1. install cygwin GNU utilities from www.cygwin.com - Cygwin is a Linux-like environment for Windows.
2. install HTTrack, a web mirroring application. For Windows it's called WinHTTTrack - http://www.httrack.com/

You are now ready to copy a web site. A final piece de resistance is to add the Spiderzilla extension to Firefox. Before you do that you have to copy and paste the URL into the WinHTTTrack application. After you do that, there is an option in the "tools" menu of Firefox "download this site with SpiderZilla...".

The result is that complete sites can be downloaded. Since I also run a local Apache/PHP/MySQL, I simply save the site in my www folder. I can then access it on http://localhost/egb/webs

It's all quite simple and innovative. I think this is what ought to be meant by "integration".

Compare curl vs wget, resum

wiki, standalone [***], win package

Get full site, using the -r, -k, and -l switches :

life wire

Output to screen :

Pre-requisits:

Baixem el paquet:

wget requires GnuTLS, 3.0.4 ; GnuTLS depends on Libnettle, and you will need to install it before installing GnuTLS.

TAR requires "xz-utils" url.

Or get "tar v 1.22" - support for xz compression (--xz option) :

Lets get gnutls :

Lets modify WGET (@labss2):

1. vi main.c
2. make
3. make install
4. ln -s /usr/local/bin/wget /usr/bin/wget ; create link to mycode
5. wget --help

Do

or

1. vi ~/.wgetrc
2. paste
   use_proxy = on http_proxy = http://70.32.89.160:3128 https_proxy = http://70.32.89.160:3128 ftp_proxy = http://70.32.89.160:3128
3. wget http://www.apkmirror.com

Use -d (debug) switch

url

Per fer-ho be, hem de agafar la sortida de "diskuse.shtml" i posar-ho com entrada formatejada a "wget -i lst.txt"

Si anem a la pagina http://www.tinet.cat i fem "View Source" i alli "find Form", veurem :

Aixi, el requeriment a fer servir via wget sera :

From a browser : File 2 HD

Nice intro

All return codes

How to get RC properly

It fails when getting an Ad :

La càrrega de contingut dinàmic amb curl no funciona, perque curl no executa el javascript. Això es fa amb altres eines.
Busca "headless browsing" o "automatic web testing".

Use "m" to set overall timeout, and "s" to remove progress bar :

Ho podem fer doble :

wiki : a headless browser is a web browser without a graphical user interface.

List :

• PhantomJS - a headless WebKit scriptable with a JavaScript API

Download

PhantomJS JavaScript API : open Wikipedia and, upon loading, save a screenshot to a file and exit.

Lets do it : homepage - create a file called github.js :

Run the command "phantomjs github.js"

Now with parameters :

And the code is :

1. start ADSL
2. start IE and set Firewall User and Password
3. start AT&T Network Client
4. you have a VPN over ADSL

AT&T : 195.75.101.199

Proton VPN : Minie 2025.05.14

You need a russian VPN server ...

• VPN-приложения для доступа к российским сервисам за границей

• Planet
  Используя Planet VPN для любого вашего устройства при подключении к VPN серверу России, вы получаете полностью анонимное и безопасное соединение в сети интернет с IP-адреса России.

• fine VPN
  Бесплатная служба VPN для России от FineVPN обеспечивает бесперебойную и безопасную работу в Интернете, предоставляя российский IP-адрес, обеспечивая доступ к контенту и услугам с географическим ограничением, как если бы вы физически находились в России.

state.gov Kremlin funded media !!!

Using VLC wizard

The maximal speed of transfer makes 12 Mbit/s for standard USB 1.1 and 480 Mbit/s for Hi-Speed USB 2.0.

url

Interessant : wiki.

IEEE 1394 "Host Adapter".

RFC 2734 specifies how to run IPv4 over the FireWire interface, and RFC 3146 specifies how to run IPv6.

Wiki.

• USB 2.0 : 480 Mbps
• SATA (150) : 1200 Mbps

url wiki

• ipconfig displays ... Tunneling Pseudo-Interface
• At the command prompt, type ipv6 uninstall, and then press ENTER.
• IPV6.exe @ uSoft.
  c:\>ipv6 -v if
• Manual configuration

Top

Una empresa te moltes màquines i permet accés de clients externs. Un client extern vol accedir per fer FTP a

• una determinada màquina ...
• un determinat disc ...
• un determinat directori ...
• determinats fitxers ...

Una generalització fora que tingués accés a diversos directoris ubicats a diferents màquines.

Top

FileZilla Server conectat a guifi.net em diu :

You appear to be behind a NAT router.
Please configure the passive mode settings and forward a range of ports in your router.
Warning: FTP over TLS is not enabled, users cannot securely log in.

Top

url

La magia de que varies IPs puguin sortir sense fer-se un liu es basa en que cada peticio a l'exterior te una "source ip + source port" que esdevé unic a la intranet.
Aixo es diu "ip masquerading", i el router es guarda una taula per saber a qui retornar les coses.

E, 20200930

Masquerading is assuming you have two network cards, moving traffic from one card to the other and in the process connecting two networks.
The other assumption is that you have an internal network with Private IP Addresses that you will change to an external address on the machine

begin linux

To list the masquerade rules use the -l argument :

• bill auer intro
• more in depth : oReilly "Linux Network Administrator's Guide - Chapter 11 - IP Masquerade and Network Address Translation"

Top

putty at wiki ; http://extraputty.free.fr/ - fork from 0.63 version of putty ; User Manual ; source code !

Get plink (a command-line interface to the PuTTY back ends) from the putty's download page.

Then, you can use it like this

Another way is

where commands.txt contents is:

Maybe it's more general to use ssh ... {sebas}

"Paste" function is done by (Ctrl+) Shift + Insert

• tips and tricks [****] as
  • click on Window -> select the "Change the size of the font" under "When window size is resized" section
  • move Putty sessions to another computer
  • delete all PuTTY sessions together : "C:> putty -cleanup"
• add-ons as
  • Connection Manager : 5 powerfull features
  • PuTTYcyg - lets you use PuTTY as a local cygwin terminal
  • PuTTY Portable - launch PuTTY from the USB drive and carry the sessions along with you
• session manager

On ESX, we get:

Because in sshd_config we have

Si configurem be el Putty, ens estalviem la configuracio del X11 amb "display" :

• Connection
• SSH
• X11
• check Enable X11 Forwarding

"Access denied" initial message

After receiving the "Access denied" message, hold Ctrl and right-click on the PuTTY window, then select Event log. At the bottom you will see what exactly caused the failure.

Run this CMD :

To restore these profiles, just double-click on the "reg" file or

Once you have set up plink to be able to log in to a remote server without any interactive prompting, you can use it for lots of scripting and batch purposes. For example, to start a backup on a remote machine, you might use a command like:

Or perhaps you want to fetch all system log lines relating to a particular web area:

Any non-interactive command you could usefully run on the server command line, you can run in a batch file using Plink in this way.

url

• wireshark

• FireBug

• tcpdump, wireshark on PCAP files, use filters !

• Fiddler : Fiddler es un Servidor proxy que captura tráfico HTTP y HTTPS para depurar código HTTP

Passive LAN taps essentially allow all traffic on a network device to be monitored

"network tap" at wiki

home made

Use WireShark in promisc mode - wiki wireshark

Some examples: url

• SharkTap Network Sniffer - amzn - unavailable
• SharkTap Gigabit Network Sniffer - amzn - 180 $
• Throwing Star LAN Tap - amzn - 11 $ {got it}

1. hak5 video
2. great Scott gadgets
3. throwing star LAN tap - compro 20201213, 18 €
4. get open source design files
5. obrir amb KiCad

(minut 2:50 del video)
Normal gigabit signals travel in both directions and its impossible to build a completelly passive tap.
Throwing Star degrades the signal with 2 capacitors that force the connection down to 100 Mbps by adding a slight noise into the line

They use "back track 5" live CD - now Kali Linux (since 2013)

Another : build passive network tap by wiring

Podem monitoritzar :

• les dades de SmartLife cap al nuvol
• les dades del nuvol cap al SP21 i/o cap el SB50
• (202501) request de la APP "Solar Web" per rebre la energia consumida (la API es resisteix)

El esquema és :

Que veiem :

• 20201218 - mirem sortida de casa :

  • en tocar el estat del SP21 amb la APP SmartLife, el SP21 envia un paquet TLS v1.2 de "Application Data" a
    18.184.31.90 (ec2-18-184-31-90.eu-central-1.compute.amazonaws.com) 52.57.38.165 (ec2-52-57-38-165.eu-central-1.compute.amazonaws.com)

  • periodicament el SP21 envia paquets
    source = 192.168.1.87 destination = 255.255.255.255 protocol = UDP source port = 49154 destination port = 6667

• 20201221 - mirem la entrada a casa : en tocar el estat del SP21, el cloud envia 4 paquets via TLS
  nicolau@mars:~$ nslookup 52.57.38.165 165.38.57.52.in-addr.arpa name = ec2-52-57-38-165.eu-central-1.compute.amazonaws.com.

• 20201221 - mirem que envia Smart Life : paquets UDP a 8.185.71.208 o 3.121.48.166
  nicolau@mars:~$ nslookup 18.185.71.208 208.71.185.18.in-addr.arpa name = ec2-18-185-71-208.eu-central-1.compute.amazonaws.com. nicolau@mars:~/eines/ubiquiti$ nslookup 3.121.48.166 166.48.121.3.in-addr.arpa name = ec2-3-121-48-166.eu-central-1.compute.amazonaws.com.

  192.168.1.78 (Mi9) comença amb un DNS (a1.tuyaeu.com) :

  nicolau@mars:~$ ping a1.tuyaeu.com PING a1.tuyaeu.com (35.156.68.42) 56(84) bytes of data. 64 bytes from ec2-35-156-68-42.eu-central-1.compute.amazonaws.com (35.156.68.42): icmp_seq=1 ttl=227 time=38.7 ms

  Curiosament 192.168.1.85 (Alexa) tambe fa un requeriment DNS (api.amazon.com) :

  nicolau@mars:~$ ping api.amazon.com PING api.amazon.com (52.119.196.31) 56(84) bytes of data. 64 bytes from 52.119.196.31 (52.119.196.31): icmp_seq=1 ttl=236 time=104 ms

When using a passive or active LAN tap, both the "incoming" and "outgoing" channels need to be bonded together for IDS systems to process as a single network flow channel. This setup involves using a technique called bonding to take two physical interfaces and bond them together, creating a logical interface that we can use for Snort as an example.
For step-by-step instructions on how to set up port bonding, see How To Create a Bonded Network Interface

passive LAN taps

Wireshark version 1.8 has a great new feature that allows data to be captured from multiple interfaces at the same time.

samkear

Read Ethernet capture setup , capture using a net tap

Top

Homepage, wiki, capture setup wlan {****}

Per treballar amb W7 ens cal la versio 4.0 com a maxim !

• display own traffic to DHCP
• display own traffic to DNS
• display PING Request/Reply (only)

1. "Go" menu
2. Auto Scroll in Live Capture

Capture filters are set before start capturing traffic in Wireshark. This type of filter can’t be changed while capturing traffic. It is generally used for capturing a specific type of traffic.

Apuntem alguns filtres "capture" interessants :

• capture only traffic to or from IP address 172.18.5.4 : host 172.18.5.4

• capture traffic to or from a range of IP addresses : net 192.168.0.0/24

• capture only DNS traffic : port 53

• capture only traffic to or from specific MAC : "ether host 1c:90:ff:43:c7:35"

Display Filters are used to reduce the packets which are showing in Wireshark. This type of filter can be changed while capturing traffic. It is generally used for hiding traffic to analyze the specific type of traffic.

Apuntem alguns filtres "display" interessants :

• display only traffic from port number 25 or icmp packets : tcp.port eq 25 or icmp

• display only traffic to or from IP address 192.168.0.87 : ip.addr == 192.168.0.87

• display only traffic to or from specific MAC : eth.src==MACaddress

• To only display packets containing a particular protocol, type the protocol name in the display filter toolbar of the Wireshark window and press enter to apply the filter.
  Capture only IPv4 traffic - the shortest filter, but sometimes very useful to get rid of lower layer protocols like ARP and STP:
  ip

• capture only unicast traffic - useful to get rid of noise on the network if you only want to see traffic to and from your machine, not, for example, broadcast and multicast announcements:
  not broadcast and not multicast

• capture except all ARP and DNS traffic:
  port not 53 and not arp

  wiki wireshark on "capture filters"

• display DHCP traffic : as DHCP is implemented as an option of BOOTP, you can only filter on BOOTP messages.

  Show only the BOOTP based traffic:

  bootp

  capture Filter - as DHCP is implemented as an option of BOOTP, you can only filter on BOOTP messages. You cannot directly filter BOOTP protocols while capturing if they are going to or from arbitrary ports.

  DHCP

• set a filter for just MQTT - “tcp.port eq 1883” or "mqtt" as "display" filter after the capture

  See this video and its python scripts

Configure (at install time) :

1. sudo dpkg-reconfigure wireshark-common
2. select "yes" in response to "should non-superusers be able to capture packets?"
3. add yourself to the "wireshark" group by running "sudo usermod -a G wireshark <your user>" and logging out and back

When a network card is in promiscuous mode it accepts all packets, even if the destination MAC of the frame does not match it's own MAC. Broadcasts are accepted anyway. Without promiscuous mode frames with MACs other than the one the interface has are ignored (apart from broadcasts, again)

wikipedia

Two ways to display its status :

Now we change it :

tots.1o24

1. Verify that promiscuous mode is not enabled :
   nicolau@mars:~$ sudo ip link show wlx8416f90e4d75 [sudo] password for nicolau: 4: wlx8416f90e4d75: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DORMANT group default qlen 1000 link/ether 84:16:f9:0e:4d:75 brd ff:ff:ff:ff:ff:ff

   Using "netstat" :

   nicolau@mars:~$ sudo netstat -i Kernel Interface table Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg enp4s0 1500 34922 0 17 0 17596 0 0 0 BMRU lo 65536 7697 0 0 0 7697 0 0 0 LRU wlx8416f 1500 17816 0 730 0 16502 0 0 0 BMRU

2. Enable the promiscuous mode :
   nicolau@mars:~$ sudo ip link set wlx8416f90e4d75 promisc on nicolau@mars:~$ sudo ip link show wlx8416f90e4d75 4: wlx8416f90e4d75: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DORMANT group default qlen 1000 link/ether 84:16:f9:0e:4d:75 brd ff:ff:ff:ff:ff:ff nicolau@mars:~$ sudo netstat -i Kernel Interface table Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg enp4s0 1500 34976 0 17 0 17596 0 0 0 BMRU lo 65536 7725 0 0 0 7725 0 0 0 LRU wlx8416f 1500 18099 0 739 0 16737 0 0 0 BMPRU nicolau@mars:~$ grep -r 'promiscuous' /var/log/kern.log Dec 8 16:29:29 mars kernel: [10202.015338] device wlx8416f90e4d75 entered promiscuous mode

url , from here

If you're trying to capture network traffic that's not being sent to or from the machine running Wireshark or TShark, i.e. traffic between two or more other machines on an Ethernet segment, or are interested in 802.11 management or control packets, or are interested in radio-layer information about packets, you will probably have to capture in "monitor mode".

The easiest way to manually turn monitor mode on or off for an interface is with the airmon-ng script in aircrack-ng

The command "sudo airmon-ng start wlan0" will produce output such as

The "monitor mode enabled on mon0" means that you must then capture on the "mon0" interface, not on the "wlan0" interface, to capture in monitor mode.

To turn monitor mode off, you would use a command such as sudo airmon-ng stop mon0, not "sudo airmon-ng stop wlan0".

When capturing traffic in monitor mode, you can capture on a single, fixed channel, or capture while hopping through multiple channels (channel hopping).

capture setup wlan + turn on monitor mode

If you are running Wireshark 1.4 or later on a *BSD, Linux system, and it's built with libpcap 1.0 or later, for interfaces that support monitor mode, there will be a "Monitor mode" checkbox in the "Capture Options" window in Wireshark.

How to capture traffic without constant nag of saving capture file?

Go to Edit > Preferences. Uncheck "Confirm unsaved capture files."

osqa-ask

The card the MARS has is :

The linux driver is rtl8188eu, quasi compatible with Linux

We start like this :

After installing it, we have :

We go with :

Now we can display

Then we kill them :

ath0 should have gone, but it does not

Guess we need this RealTek RTL8188eus WiFi driver with monitor mode

airmon-ng UG

On T60 we get better results ...

Guy Harris said :

There's promiscuous mode and there's promiscuous mode.

Originally, the only way to enable promiscuous mode on Linux was to turn on the IFF_PROMISC flag on the interface; that flag showed up in the output of command such as ifconfig.
In the 2.2 kernel (i.e., a long time ago), a second mechanism was added; that mechanism does not set the IFF_PROMISC flag, so the interface being in promiscuous mode does not show up in the output of ifconfig, and it does not require promiscuous mode to be turned off manually - closing the last descriptor on which promiscuous mode was requested suffices.
libpcap uses the second mechanism if it's available; tcpdump and Wireshark both use libpcap to do packet capturing, so they'll use the second mechanism on any Linux system with a 2.2 or later kernel. Therefore, neither tcpdump nor Wireshark will, when capturing in promiscuous mode, cause ifconfig to show "PROMISC".

However:

• if you're capturing on an Ethernet that's on a switched network, promiscuous mode isn't sufficient to capture other machine's traffic, because that traffic probably isn't going to be sent to your switch port; see the Wireshark Wiki's page on Ethernet capture setup for more information;

• if you're capturing on Wi-Fi, promiscuous mode might not do anything at all - you'd need to capture in monitor mode, and set up Wireshark to be able to decrypt traffic if it's a "protected" network using WEP, WPA, WPA2, or WPA3. See the Wireshark Wiki's page on Wi-Fi capture setup for information on monitor mode and the Wireshark Wiki's "how to decrypt 802.11" page for information on that topic.

• install wireshark !

• user's guide

• how to decrypt 802.11

• capture setup - ethernet

• capture setup - wlan, promiscous mode , how to decrypt 802.11

Top

• DNS
• HTTP
• TLS

Saber com es parlen :

• Whatsapp l Android amb el Whatsapp al Ubuntu - "telephone batery low"
• Alexa amb el endoll Teckin
• APP Android amb el endoll Teckin

There are few ways your computer can connect to the server

Type

• secure long polling (default)
• secure websocket

Network option

• live (default internet)
• live2 (CDN) - a route provided by our Content Delivery Network

Top

Homepage and python API - installed at R4

Try

Mes complert :

• sudo apt-get update
• sudo apt-get install python-pip
• sudo apt autoremove
• pip install speedtest-cli
• python3 -m pip install speedtest-cli
  sebas@r4:~/python/speed_test $ python3 -m pip install speedtest-cli Looking in indexes: https://pypi.org/simple, https://www.piwheels.org/simple Collecting speedtest-cli Installing collected packages: speedtest-cli The scripts speedtest and speedtest-cli are installed in '/home/sebas/.local/bin' which is not on PATH. Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location. Successfully installed speedtest-cli-2.1.3

how to forge

Compte que hem anat a python v3 ! (20200513)

• sudo apt-get install python3-pip
• pip install speedtest-cli
• python3 -m pip install speedtest-cli

20210512 :

Solucio :

If we want to run it against a specific server, here is the way to discover them :

Now we can use curl :

Find pyspeedtest in github - Discontinued - use https://github.com/sivel/speedtest-cli or https://github.com/zpeters/speedtest - abandonded 2019

codegreeper

wikipedia : Preboot eXecution Environment specification describes a standardized client-server environment that boots a software assembly, retrieved from a network, on PXE-enabled clients.

The basic PXE process starts with a DHCP request which is expecting responses that include

• 1) an IP address for the booting system,
• 2) the address of the PXE server and
• 3) the name of the .0 file (the PXE boot menu).

If only #1 is returned and not 2,3, an E53 error is displayed.

Error: PXE-E53: No boot filename received

Lets try it on T60 :

1. install DHCP server :
   sebas@T60ubuntu:~$ sudo apt-get install isc-dhcp-server

2. configure DHCP server for eth0 on T60 :
   sebas@T60ubuntu:~$ sudo vi /etc/default/isc-dhcp-server INTERFACESv4="eth0" INTERFACESv6=""

3. setup DHCP server :
   sebas@T60ubuntu:~$ sudo vi /etc/dhcp/dhcpd.conf # option definitions common to all supported networks... option domain-name "T60ubuntu.lan"; option domain-name-servers 8.8.8.8, 8.8.4.4; # If this DHCP server is the official DHCP server for the local # network, the authoritative directive should be uncommented. authoritative; # A slightly different configuration for an internal subnet. subnet 192.168.1.0 netmask 255.255.255.0 { range 192.168.1.200 192.168.1.239; option domain-name-servers 8.8.8.8, 8.8.4.4; option domain-name "T60ubuntu.lan"; option subnet-mask 255.255.255.0; option routers 192.168.1.1; option broadcast-address 192.168.1.255; default-lease-time 600; max-lease-time 7200; }

4. restart DHCP service :
   sebas@T60ubuntu:~$ sudo systemctl restart isc-dhcp-server

5. verify status :
   sebas@T60ubuntu:~$ sudo systemctl status isc-dhcp-server â isc-dhcp-server.service - ISC DHCP IPv4 server Loaded: loaded (/lib/systemd/system/isc-dhcp-server.service; enabled; vendor preset: enabled) Active: active (running) since Tue 2019-06-11 00:16:41 CEST; 5s ago Docs: man:dhcpd(8) Main PID: 11546 (dhcpd) Tasks: 1 (limit: 4915) CGroup: /system.slice/isc-dhcp-server.service ââ11546 dhcpd -user dhcpd -group dhcpd -f -4 -pf /run/dhcp-server/dhcpd.pid -cf /etc/dhcp/dhcpd.conf jun 11 00:16:41 T60ubuntu sh[11546]: PID file: /run/dhcp-server/dhcpd.pid jun 11 00:16:41 T60ubuntu dhcpd[11546]: Wrote 0 leases to leases file. jun 11 00:16:41 T60ubuntu sh[11546]: Wrote 0 leases to leases file. jun 11 00:16:41 T60ubuntu dhcpd[11546]: Listening on LPF/eth0/00:24:7e:14:2d:14/192.168.1.0/24 jun 11 00:16:41 T60ubuntu sh[11546]: Listening on LPF/eth0/00:24:7e:14:2d:14/192.168.1.0/24 jun 11 00:16:41 T60ubuntu dhcpd[11546]: Sending on LPF/eth0/00:24:7e:14:2d:14/192.168.1.0/24 jun 11 00:16:41 T60ubuntu sh[11546]: Sending on LPF/eth0/00:24:7e:14:2d:14/192.168.1.0/24 jun 11 00:16:41 T60ubuntu dhcpd[11546]: Sending on Socket/fallback/fallback-net jun 11 00:16:41 T60ubuntu sh[11546]: Sending on Socket/fallback/fallback-net jun 11 00:16:41 T60ubuntu dhcpd[11546]: Server starting service.

6. install PXE server along with TFTP and other dependencies :
   sebas@T60ubuntu:~$ sudo apt-get install apache2 tftpd-hpa inetutils-inetd

7. configure PXE server :
   sebas@T60ubuntu:/etc/default$ cat tftpd-hpa {add 2 lines at bottom} # /etc/default/tftpd-hpa TFTP_USERNAME="tftp" TFTP_DIRECTORY="/var/lib/tftpboot" TFTP_ADDRESS=":69" TFTP_OPTIONS="--secure" RUN_DAEMON="yes" OPTIONS="-l -s /var/lib/tftpboot"

8. edit internet daemon to disable tftp - it will be run as "service" :
   sebas@T60ubuntu:~$ sudo vi /etc/inetd.conf {insert or modify} # tftp dgram udp wait root /usr/sbin/in.tftpd /usr/sbin/in.tftpd -s /var/lib/tftpboot

9. restart TFTP service :
   sebas@T60ubuntu:~$ sudo systemctl restart tftpd-hpa

10. verify TFTP service is running or not :
    sebas@T60ubuntu:~$ sudo systemctl status tftpd-hpa â tftpd-hpa.service - LSB: HPA's tftp server Loaded: loaded (/etc/init.d/tftpd-hpa; generated) Active: active (running) since Tue 2019-06-11 00:24:20 CEST; 1min 1s ago Docs: man:systemd-sysv-generator(8) Process: 14894 ExecStop=/etc/init.d/tftpd-hpa stop (code=exited, status=0/SUCCESS) Process: 14899 ExecStart=/etc/init.d/tftpd-hpa start (code=exited, status=0/SUCCESS) Tasks: 1 (limit: 4915) CGroup: /system.slice/tftpd-hpa.service ââ14907 /usr/sbin/in.tftpd --listen --user tftp --address :69 --secure /var/lib/tftpboot jun 11 00:24:20 T60ubuntu systemd[1]: Starting LSB: HPA's tftp server... jun 11 00:24:20 T60ubuntu tftpd-hpa[14899]: * Starting HPA's tftpd in.tftpd jun 11 00:24:20 T60ubuntu tftpd-hpa[14899]: ...done. jun 11 00:24:20 T60ubuntu systemd[1]: Started LSB: HPA's tftp server.

11. copy Ubuntu installation files to the PXE Server :
    $ ls -al /home/sebas/isos/ (src) ubuntu-16.04-server-amd64.iso (686.817.280) {si te directori /install/netboot/} ubuntu-18.04.2-live-server-amd64.iso (874.512.384) {no te directori /install/netboot/} ubuntu-16.04.6-server-amd64.iso (915.406.848) {no te directori /install/netboot/}

12. mount ISO on any mount point :
    sebas@T60ubuntu:~$ sudo mkdir /mnt/uiso sebas@T60ubuntu:~$ sudo su - root@T60ubuntu:~$ sudo mount -o loop /home/sebas/isos/ubuntu-16.04-server-amd64.iso /mnt/uiso mount: /mnt/uiso: failed to setup loop device for /home/sebas/isos/ubuntu-16.04-server-amd64.iso. sebas@T60ubuntu:/etc/dhcp$ sudo lsmod | grep loop sebas@T60ubuntu:/etc/dhcp$ {if you get no output, that means you have to mount the loop device kernel module} sebas@T60ubuntu:/etc/dhcp$ sudo modprobe loop {still empty}

    You don't need to "modprobe loop" in 9.04, as the loopback driver is compiled into the kernel, not as a module.

    1. wget http://releases.ubuntu.com/18.04.2/ubuntu-18.04.2-live-server-amd64.iso

    2. verify the ISO :
       sebas@T60ubuntu:~/isos$ echo "d078985ad87562376cf9ed74610ba2f53 *ubuntu-18.04.2-live-server-amd64.iso" | sha256sum --check ubuntu-18.04.2-live-server-amd64.iso: OK root@T60ubuntu:/isos# echo "803a89a5a6bd1f6aabea2e5e34ac1ab7eb9786ac *ubuntu-16.04.6-server-amd64.iso" | sha256sum --check ubuntu-16.04.6-server-amd64.iso: OK sebas@T60ubuntu:~/isos$ echo "b8b107ccf66f00fc6a324a6da6eba67de71746f6 *ubuntu-16.04-server-amd64.iso" | sha256sum --check ubuntu-16.04-server-amd64.iso: OK

    3. sudo su -

    4. cd /home/sebas/isos

    5. muntem el CD :
       root@T60ubuntu:/home/sebas/isos# mount -o loop ubuntu-18.04.2-live-server-amd64.iso /mnt/uiso mount: /mnt/uiso: WARNING: device write-protected, mounted read-only. sebas@T60ubuntu:~/isos$ sudo mount -o loop ubuntu-16.04-server-amd64.iso /mnt/uiso/ mount: /mnt/uiso: WARNING: device write-protected, mounted read-only.

13. copy the bootable installation files to /var/lib/tftpboot/ directory of our PXE server :
    sebas@T60ubuntu:~$ cd /mnt/uiso sebas@T60ubuntu:~$ sudo cp -fr install/netboot/* /var/lib/tftpboot/ sebas@T60ubuntu:/mnt/uiso/install/netboot$ ls -al /var/lib/tftpboot/ total 16 lrwxrwxrwx 1 root root 47 jun 11 21:02 ldlinux.c32 -> ubuntu-installer/amd64/boot-screens/ldlinux.c32 lrwxrwxrwx 1 root root 33 jun 11 21:02 pxelinux.0 -> ubuntu-installer/amd64/pxelinux.0 lrwxrwxrwx 1 root root 35 jun 11 21:02 pxelinux.cfg -> ubuntu-installer/amd64/pxelinux.cfg dr-xr-xr-x 3 root root 4096 jun 11 21:02 ubuntu-installer -r--r--r-- 1 root root 58 jun 11 21:02 version.info

14. create a directory called "ubuntu" in the apache root document folder :
    sebas@T60ubuntu:~$ sudo mkdir /var/www/html/ubuntu

15. copy all the files from the Ubuntu ISO :
    sebas@T60ubuntu:~$ sudo cp -fr /mnt/* /var/www/html/ubuntu/ {658M}

16. edit /var/lib/tftpboot/pxelinux.cfg/default file and add at end
    label linux kernel ubuntu-installer/amd64/linux append ks=http://192.168.1.60/ks.cfg vga=normal initrd=ubuntu-installer/amd64/initrd.gz ramdisk_size=16432 root=/dev/rd/0 rw --

    Here 192.168.1.60 is the PXE server IP address

17. configure DHCP server :
    $ sudo vi etc/dhcp/dhcpd.conf (add at end) allow booting; allow bootp; option option-128 code 128 = string; option option-129 code 129 = text; next-server 192.168.1.60; filename "pxelinux.0";

18. restart DHCP server and verify it runs ok :
    $ sudo systemctl restart isc-dhcp-server $ sudo systemctl status isc-dhcp-server

Your PXE server is ready to use !

Install PXE server on ubuntu 16.04

... using

• PowerShell
• PXE_Diag - requires Virtual PC (so W7)

Logging goes to /var/log/syslog, so you can try :

Also

Verify service status :

See program status

After a reboot the PXE server does not start. We do :

• we try to start it
  root@T60ubuntu:~# systemctl restart tftpd-hpa Job for tftpd-hpa.service failed because the control process exited with error code. See "systemctl status tftpd-hpa.service" and "journalctl -xe" for details.

  And now

  root@T60ubuntu:~# systemctl status tftpd-hpa.service â tftpd-hpa.service - LSB: HPA's tftp server Loaded: loaded (/etc/init.d/tftpd-hpa; generated) Active: failed (Result: exit-code) since Wed 2019-06-12 19:25:32 CEST; 1min 36s ago Docs: man:systemd-sysv-generator(8) Process: 2868 ExecStart=/etc/init.d/tftpd-hpa start (code=exited, status=71) jun 12 19:25:32 T60ubuntu systemd[1]: Starting LSB: HPA's tftp server... jun 12 19:25:32 T60ubuntu tftpd-hpa[2868]: * Starting HPA's tftpd in.tftpd jun 12 19:25:32 T60ubuntu in.tftpd[2875]: cannot bind to local IPv4 socket: Address already in use jun 12 19:25:32 T60ubuntu systemd[1]: tftpd-hpa.service: Control process exited, code=exited status=71 jun 12 19:25:32 T60ubuntu systemd[1]: tftpd-hpa.service: Failed with result 'exit-code'. jun 12 19:25:32 T60ubuntu systemd[1]: Failed to start LSB: HPA's tftp server.

• service says "cannot bind to socket: address already in use"

• display who uses the port :
  sebas@T60ubuntu:~$ sudo lsof -i :69 {or "sudo netstat -peanut | grep 69"} {or socklist from procinfo package} command name inetutils *:tftp

• tftp was started twice :
  • from /etc/inetd.conf, controlled by inetd daemon
  • as system service

• solució : comentar la linia tftp de /etc/inetd.conf

• el PXE funciona perfectament !

• radio : quality is related to bit-rate, as 128 Kbps
• youtube : 720p requires 2,5 Mbps
• Netflix - quin ample de banda li cal ?

Tools:

• band width monitor

The flow:

1. A request is sent to the server.
2. The server doesn’t close the connection until it has a message to send.
3. When a message appears – the server responds to the request with it.
4. The browser makes a new request immediately.

building Lichess -> long polling

A sketch of client-side subscribe function that makes long requests:

AL1 Consulting Group - Barcelona y alrededores, España (Barcelona Area, Spain)
Job Description - Empresa líder en internet, requiere Ingeniero Senior en Redes para:

• Llevar a cabo el diseño tecnológico y la implementación de arquitecturas de red en entornos complejos.
• Implementar la configuración de los equipos y servicios asociados, documentando la configuración realizada.
• Proporcionar soporte técnico en la implementación de sistemas y mantenimiento de los mismos.
• Atender las necesidades y consultas de los usuarios.

Desired Skills & Experience

• Formación en Ingeniero Técnico deseable.
• Más de 5 años de experiencia en:
  • Administración de Redes.
  • Trabajando en entornos de redes en producción de alta criticidad
  • Ser experto en Firewalls, Routing, Switching, Balanceadores de Carga, Sistemas de Autenticación, VPN’s, BGP, wireless, alta disponibilidad y seguridad de red.
  • Experiencia destacable en sistemas de monitorización.
  • Clara orientación de servicio y a cliente, empatía, capacidad de resolución y actitud proactiva.

Deseable

• Certificación Cisco CCNP
• Conocimientos en protocolo 802.1X
• Conocimientos en IDP/IPS
• Conocimientos en ipv6
• Valorable aportar otras certificaciones

Si no podem reiniciar la IP :

Intentem reiniciar el stack de TCPIP :

Texbelt homepage

El codi es :

I el resultat :

Try it now: use key=textbelt to send 1 free text per day.

Create your own key to send more messages afterwards ... [/]

API documentation

If you want to validate your key without actually using your text quota, append "_test" to your key and you will receive a response from the /text endpoint confirming that a text would send. However, credit will not be deducted from your account.

Top

• com llistar els usuaris (hostname) als que he donat una IP dinamica ?
  cat /var/lib/dhcp/db/dhcpd.leases
  
  Com es que nslookup no troba .78.200 ?

• Com mostrar els valors assignats per un DHCP en Linux ? (DNS's & default gateway)

• SSH/SCP without PWD - cant make it work

• how to trace a problem in /var/log/secure ?

• Microsoft virtual vifi miniport adapter -- to disable it :
  netsh wlan stop hostednetwork netsh wlan set hostednetwork mode=disallow

• com saber les caraterístiques del nostre stack IP ?
  Jo veig que vnetsniffer està aturat i el ATT dialer l'engega i vull saber-ne la raó ...
  Tambe veig que ipconfig em treu informació "nova" ...

• que nassos és "Conexión de area local 2", de nom "Conexión de TV/Video de Microsoft" ? [T42]

• que nassos vol dir Guindows amb el missatge
  The current setting of search method requires at least one DNS suffix.

• com saber si hi ha un programa escoltant a un port ?

  Solució : netstat -ano = display all connections, numerical form, display owning process

• how to reset your TCP/IP Stack :
  1. click Start
  2. type in Search box Command
  3. right click Command and select Run as Administrator
  4. ipconfig /flushdns
  5. nbtstat -R
  6. nbtstat -RR
  7. netsh int reset all
  8. netsh int ip reset
  9. netsh i i r r
  10. netsh winsock reset
  11. restart machine

• com reiniciar el stack TCP ?

  The reset command is available in the IP context of the NetShell utility:

  netsh int ip reset resetlog.txt
  
  Reboot the computer. url.

  When you run the reset command, it rewrites two registry keys that are used by TCP/IP. This has the same result as removing and reinstalling the protocol. The reset command rewrites the following two registry keys:

  SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ SYSTEM\CurrentControlSet\Services\DHCP\Parameters\

  url, url.

  Em sembla millor aquesta eina : WinSock XP fix

• com modificar un parametre de TCP/IP des "Startup" ?
  C:\WINDOWS\system32\reg.exe add HKLM\System\CurrentControlSet\Services\TCPIP\Parameters /v SearchList /t REG_SZ /d spss.com /f

• com probar que arribem fins a un port ?

  • NO arribem
    C:\> telnet 192.168.21.1 1415 Connecting To 192.168.21.1... Could not open a connection to host on port 1415 : Connect failed

  • SI arribem
    Connect REJECTED

• que fer si la carpeta Network Connections es buida ? {empty My Network properties}
  • netsh winsock reset - remove all the third-party LSPs and restore Winsock to factory default setting.
  • get WinsockxpFix.exe
  • I unistalled the drivers for the network adapters and rebooted. They got reinstalled, and everything worked fine. (Win XP pro, sp2)
  • make sure that the Network Connections service is enabled and running ("conexiones de red" - [es])
  • KB313242
    regsvr32 netshell.dll regsvr32 netcfgx.dll regsvr32 netman.dll
  • KB825826, internet fixes
  • KB953979

• que fem si un SCP s'atura dient "STALLED" ? Use the "-C" flag on SCP command to "compress". Alsu, use "-vv" flag to see more details.

• si tenim un servidor amb un servei al port 5678 amb moltes IP's de clients conectats ... com podem tallar la conexió d'una determinada IP ?
  [sag@lab cmds]$ netstat -ano | grep 5678 tcp 0 0 0.0.0.0:5678 0.0.0.0:* LISTEN off (0.00/0/0) tcp 0 0 99.137.164.154:5678 99.172.140.82:2111 ESTABLISHED keepalive (6514.07/0/0) tcp 0 0 99.137.164.154:5678 99.172.140.48:1614 ESTABLISHED keepalive (1769.82/0/0) tcp 0 0 99.137.164.154:5678 99.145.87.157:52364 ESTABLISHED keepalive (6178.23/0/0) tcp 0 0 99.137.164.154:5678 99.145.31.215:4481 ESTABLISHED keepalive (2704.30/0/0)

  cutter (via IPTABLES, as Fco), tcpkill,
  tcpkill is part of the dsniff package. Use "config" to verify pre-requisites, as "libnet not found" at labss.

• com es que no funciona WGET ni CURL amb aquesta URL ?
  nicolau@mars:/tmp$ curl -v sebastianet.byethost6.com/pkw_byet.htm * Trying 185.27.134.131... * TCP_NODELAY set * Connected to sebastianet.byethost6.com (185.27.134.131) port 80 (#0) > GET /pkw_byet.htm HTTP/1.1 > Host: sebastianet.byethost6.com > User-Agent: curl/7.58.0 > Accept: */* > * Empty reply from server * Connection #0 to host sebastianet.byethost6.com left intact curl: (52) Empty reply from server

• Two popular references on TCP/IP are:
  • "TCP/IP Illustrated, Volume 1: The Protocols," Richard Stevens, Addison Wesley, 1994
  • "Internetworking with TCP/IP, Volume 1: Principles, Protocols, and Architecture," Douglas E. Comer, Prentice Hall, 1995

• shunnel

• iftop does for network usage what top does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts. Handy for answering the question "why is our ADSL link so slow?".

• Enable / disable adapter from win command line using devcon

• How to connect Ubuntu to Internet

• Linux Home Networking - bon texte, complert.

• Scanners, for NT and NetBIOs, and Tools.

• Eines :
  • Snort
  • Ethereal Network Protocol Analyzer (W95) => WireShark, wiki. W2K
  • nmap
  • p0f
  • nmon - Nigel's performance monitor [*****]

• Molts articles .... en rus : UINC.RU, as ARP i ICMP by Igor, and non-standard use of ARP

• Beginner scan analysis [pro, with solutions]  
  There's one every month !!!

• tcp/ip reference [good]

• DNS book, articles; LDAP [*****]

• tcp/ip commad line utilities : arp, ipconfig, nbtstat, netstat, ping, tracert, getmac, netsh, tasklist (xp pro), taskkill, set, recover, regsvr32.

• ping :
  
  • intro and links
  • details [Internet Encyclopedia]
  • RFC 792
  • per llençar un ping des de 13 llocs diferents del món a la vegada.
  • l'eina d'en Francisco (Java sota Linux)
  • la meva eina en Delphi

• DNS : RFC 882 & 883 (old, 1983), RFC 1034 & 1035 (1987).

• Cesca : serveis, as DNS.

• CATNIX : serveis, as servidor arrel de noms F.

• FTP servers : Cerberus, FileZilla

  "could not connect to server, port 14147" -> start windows service "FTP server" !

• FTP clients (passive ?)
  • CuteFTP
  • CoreFTP
  • Fire FTP (FireFox)
  • SmartFTP
  • WS_FTP

• Telnet Server(s) ?
  • W2000 Pro Telnet Service is set to start "Manually". Ep ! Hi ha un "Telnet Server Administration" dins la carpeta "Administrative Tools"
    XP Pro el porta incorporat : url. Use tlntadmn !
  • Kpt M - free, open source telnet/ssh server for Guindous 2000/XP.

  Client : Putty ! Homepage (0.63). Documentacio. + PSCP + PSFTP !

• Web Server : Abyss Web Server X1

• SMTP Server (outgoing mail, to be used by BLAT) ??? PostCast ???

• Linux NETBIOS client (Samba) configuration

• Delphi Networking

• NetBios & SMB protocols description
  • http://www.first.org/events/progconf/2002/d2-01-chaboya-paper.pdf
  • ftp://ftp.rfc-editor.org/in-notes/rfc1002.txt
  • http://www.samba.org/cifs/docs/what-is-smb.html
  • http://www.ubiqx.org/cifs
  • http://www.codefx.com/CIFS_Explained.htm
  • http://www.snia.org/tech_activities/CIFS/CIFS-TR-1p00_FINAL.pdf
  • http://www.richardsharpe.com/

• (1) page 116, Robert Orfali and Dan Harkey, "Client/Server programming with OS/2 2.1"

• que fa
  echo 'GET / HTTP/1.0\n' | nc hotbot.com 80 | egrep '^Server:'

  Que es nc ? NetCat - see rpmfind
  From here

• MAC @ to vendor

• read uS TCP/IP ! [good]

  Descripció MOLT complerta !

• Analyze a site : NetCraft : What's that site running ?

• ICANN - get domain registration date, registry expiration, owner’s name and mailing address.

• from "The Book of VMWARE", page 139 :

  To learn more about IP networking, read Andrew Tanenbaum's Computer Networks (Prentice-Hall, 1996); for the ultimate programming reference, look at W. Richard Stevens' Unix Network Programming, Volume 1 (Prentice-Hall, 1998). In addition, your author's Linux Problem Solver (No Starch Press, 2000) provides hands-on systems administration information for Linux kernel version 2.2.

• Google or All The Web

• Llibre : "Computer Networks and Internets with Internet Applications" by Douglas E. Comer. See "Code Examples" button.

• Eines de xarxa

• Display IP in your tray : TYGI

• NetTool : Web & Network debugger

• Disassemble and reassemble TCPIP in Guindous [not for the faint of heart, egb]

• SJ 34/3 : Network Technologies and Systems

• Firewall Builder.

• Here is the Microsoft's IPv6 Guide for Windows Sockets Applications: url. Appendix B has an IP-version agnostic source code sample.

• Peli New Stack -

• mr Stefan Savage - interessant ... San Diego. Inside Slammer worm (with code) Network Security

• Windows Server Support Tools alphabetical list :
  • browstat

• List of Security Tools available in Ubuntu :
  • wireshark - ex-Ethereal ! (portable) network protocol analyzer
  • nessus
  • nmap
  • etherape
  • kismet
  • chkrootkit
  • rkhunter
  • tiger
  • gnuPG
  • seahorse
  • nemesis
  • tcpdump
  • openSSH
  • denyHosts
  • snort
  • firestarter
  • clamav
  • ettercap
  • netcat
  • MTR
  • Hping3
  • ngrep
  • john
  • tcptrace
  • netdude
  • tcpreplay
  • dsniff
  • scapy
  • ntop
  • NBTscan
  • tripwire

• (large) Network Monitoring Tools list & {lots of} URLs
  Wiki comparison.
  • Cacti [Alli.nz]

• 10 free server network monitoring tools :
  • Monit
  • Ganglia
  • Munin
  • Cacti
  • Nagios (+++), RRDTOOL, login continu
  • Zabbix
  • Observium
  • Zenoss org
  • Collectd
  • Argus
  • OpenNMS
  • Hobbit -> xymon
  • Pandora FMS
  • The Dude
  • Nino (in PERL)
  • Splunk
  • GroundWork
  • Zyrion
  • Paessler
  • Reinvigorate
  • Osmius
  • SpiceWorks
  • MetaPing
  • Mahapahit
  • Mikoomi - agents for DB2, WebSphere and Java JVM
  • Live Check .. your web
  • Bobup scanner - shows NetBIOS names, MAC and IP addresses on a local network within a few seconds
  • OpsView

• Top 125 Network Security Tools : 51 is IPScan (Angry IP scanner)

• TCP tuning (nice) article.

• IP info, similar to what is my IP

• SSH Port Forwarding : see "Remote Forward example".

• Fix TCP stack or WinSock library corrupted (10038 = no socket)

• Improving windows networking defaults
  • http://www.broadbandreports.com/

• Gigabyte Ethernet finder

• Linux Home Networking

• Guide to IP Layer Network Administration with Linux, version 0.4.5, Martin A. Brown

• CTDP Linux User's Guide (2000) - functions and files, as DNS.

• Port Forwarding

• Solar Wind - TFTP server. Good intro (to use it at PIX).

• Cisco 2641 XM - what is it ?

• Network security hacks

• T42 MfyReg T42:\Rexx\Registry\MfyReg\fer.bat tool

• IP Address Blocks

• SS7

• TOR : anonymizer proxy

• test port 32764 - why ?

• Google ( hardping freeware )

• JA: Cisco airnet 1130ag

• uSoft tool : PortQryV2.exe, a command-line utility that you can use to help troubleshoot TCP/IP connectivity issues, "displays the state of TCP and UDP ports" - direct url. See \\w500\eines\PortQryV2

• defcon 16, speakers

• una alternativa al wireShark : YAF

• kit herramientas de red - crimpadora, probador de cables, conector de red, vainas de plástico, cortador de cables LAN - 13 €

• IPFS - InterPlanetary File System
  https://dweb.link - how to link to content on IPFS

• turn any Linux computer into a SOCKS5 proxy with one command {***}

• *** iperf3, tutorial

• Tinet

• Previous page

• Back to main page

• Site map

• Escriu-me !