Free live webinars covering the new Wireshark certification

What should you study? How should you study? What are the hot areas on the Exam? What are the Exam question formats? What should you watch for? What if you need to reschedule the Exam? What can you bring with you?

This are the questions that Laura Chappell will try to answer in the 4 free live webinars hosted at Chappell Seminars on from 17th to 19th of August 2010. I you are curious who is Laura Chappell, you should know that, according to her bio, she is the Founder of Wireshark University (www.wiresharkU.com) and Chappell University (www.chappellU.com) and a self-admitted “packet geek” as well as a highly-energetic speaker and author of numerous industry titles on network communications, analysis and security. Nicknamed “Glenda, the Good Witch,” Laura has presented to thousands of State, Federal and international law enforcement officers, judicial members, engineers, network administrators, technicians and developers.

Ms. Chappell is a member of the High Technology Crime Investigation Association (HTCIA) and an Associate Member of the Institute for Electrical and Electronic Engineers (IEEE) since 1989. Her blend of humor, personal experiences, energy and clarity have earned her a top spot as an industry speaker at Microsoft, Novell, Hewlett-Packard, High Technology Crime Investigation Association and US Court conferences.

I believe that this is enough to wake up your interest in this event. Considering that it is offer for free, I don’t see why you should not attend especially if you are interested in network technology. There is always room for more knowledge.

Sign in for this event

Manage VirtualBox over Web Interface

A while ago, I wrote an article about How to integrate GNS3 with VirtualBox in which I have shown how you can easily create a guest machine with its own Operating System and attach it with GNS3.  Everything is working fine when you have the system in front of you, and if you have a graphical interface, but what if you have a powerful server somewhere and you want to use it for virtualization with VirtualBox? Of course, you can use CLI to manage VirtualBox, create new machines, tune settings and so on, but it’s more likely to you would like to see something graphic and use the point and click method to achieve results.


One of the differences between VMware and VirtualBox, is that VMware is including a Web Interface for remote management and VirtualBox is, in fact, a desktop application. This keep me for using sometimes VMware instead of VirtualBox on remote machines. As you probably observed I’m not a big fan of VMware due to the fact the it’s integration with Ubuntu (my favourite Linux flavour) is not running all the time as expected. For example, in case of a kernel upgrade  you’ll have to patch again the source to obtain working VMware modules.

OK, enough with talking, the news is that now you can easily manage VirtualBox over Web Interface due to phpVirtualBox. What is phpVirtualBox? According to it’s developers phpVirtualBox, “is an open source, AJAX implementation of the VirtualBox user interface written in PHP with a modern web interface that allows you to access and control remote VirtualBox instances.”

phpVirtualBox interface, open in a browser, looks something like this:

Almost like the VirtualBox application on your desktop.

Installation is very simple and you can do it following the steps below (for Ubuntu 9.10).

As any web interface, phpVirtualBox require some mandatory software to be installed on your machine. In this case is Apache + PHP >= 5.2.0. I assume that you have them already installed. If not, please check this tutorial.

1. Add in your /etc/apt/source.list

deb http://download.virtualbox.org/virtualbox/debian karmic non-free

2. Update your repository

apt-get update

3. Install VirtualBox

apt-get install virtualbox-3.2

if you have problems finding it, then try to search for virtualbox:

apt-cache search virtualbox

4.phpVirtualBox requires you to start vboxwebsrv (a program distributed with VirtualBox).

Optional step – Create a user that will run vboxwebsrv or you may run it with your existing user

Then start vboxwebsrv

su vbox -c ‘/usr/bin/vboxwebsrv -b –logfile /home/vbox/vb.log –host 1.1.1.1 –port 18083’

vbox – user that I have created to run vboxwebsrc
-b – run in background
–logfile – where you want to keep your log file
–host – IP address where the process to listen; useful if you keep your VirtualBox on one machine and the phpVirtualBox web interface on another one;  if you don’t specify this paramter it will default to 127.0.0.1 and you can access it over web interface only if the phpVirtualBox script is on the same machine with VirtualBox software
–port – on which port this daemon will listen

5. Download phpVirtualBox

wget http://phpvirtualbox.googlecode.com/files/phpvirtualbox-0.5.zip

This is the last release now, but in the future it may be deprecated, so please check phpVirtualBox downloads for the latest version

6. Unpack the phpVirtualBox archive in a directory that is accessible from Web and edit config.php file

unzip phpvirtualbox-0.5.zip

cd phpvirtualbox-0.5

nano config.php

You’ll need to edit the following mandatory parameters:

/* Username / Password for system user that runs VirutalBox */
var $username = ‘vbox’;
var $password = ‘your-password’;
var $location = ‘http://1.1.1.1:18083/’;

Now you should be able to access phpVirtualBox using your customized URL in web browser.

Below you have some screen shots, just to get an idea about this excellent piece of software. The rest I’ll let you discover by your own.

Add new machine. Easy as that:

Fine tune machine settings:

Import VirtualBox appliance:

Cisco 2900 – Interface related chassis modification



The Cisco Enhanced EtherSwitch Service Modules seen above, expands the router’s capabilities by integrating Layer 2 and Layer 3 switching feature sets identical to those found in the Cisco Catalyst 3560-E and Catalyst 2960 Series Switches.

The new Cisco Enhanced EtherSwitch Service Modules are the first modules to take advantage of the increased capabilities on the Cisco 3900 and 2900 Series Integrated Services Routers. Additionally, these service modules enable Cisco’s industry-leading power initiatives, Cisco EnergyWise®, Cisco Enhanced Power over Ethernet (ePoE), and per-port PoE power monitoring-all of which enhance the ability of the branch office to scale to next-generation requirements and still meet important initiatives for IT teams to operate a power efficient network.

Furthermore, the Cisco Enhanced EtherSwitch Service Modules not only perform local line-rate switching and routing but also support direct service module-to-service module communication through the Integrated Services Router Generation 2 multigigabit fabric (MGF) which separates LAN traffic from WAN resources.

Below, you have a hands on demonstration how to add, remove or replace a module in the new Cisco 2900 chassis and what to is recommended to do or avoid during this operations. This is nothing new for the engineers that have to change modules everyday in chassis like 6500 or 7600 platform, but may be very useful for the beginners.

Enjoy!

Cisco: Speed vs Bandwidth interface command

It’s not uncommon to see people making mistake about the two interface commands speed and bandwidth. Most of the young engineers ( and not only ) assume that bandwidth and speed have the same meaning when applied under the interface and that purpose is to reduce the throughput of the interface up to the limit specified by bandwidth or speed.

Well this cannot be more wrong. The two commands are not doing at all throughput limitation and their scope is totally different. Let’s analyze them a little bit:

Bandwidth

What is Cisco.com saying about it:

To set the inherited and received bandwidth values for an interface, use the bandwidth command in interface configuration mode. To restore the default values, use the no form of this command.

bandwidth {kbps | inherit [kbps] | receive[kbps]}

no bandwidth {kbps | inherit [kbps] | receive[kbps]}

Now for the explanation. Bandwidth command is an optional, but most of the time, recommend interface command. Despite the word, it is not there to limit the bandwidth and you cannot adjust the actual bandwidth of an interface using this command.The interface bandwidth command is used  to communicate the speed of the interface to higher level protocols. Most of the time, a routing protocol needs to know the speed of the interface so it can choose the best route. Another effect of this command is that  TCP will adjust its initial retransmission parameters based on the bandwidth configured on the interface.



I’m sure that you are familiar or at least heard about the dynamic routing protocols like OSPF and EIGRP or at least you heard of it. Now, OSPF and EIGRP in particular use the interface bandwidth to calculate metrics.  I will not go into mathematics calculation of metrics for OSPF and EIGRP, but rather explain it in human terms. Imagine that you have 100Mbps interfaces connecting two routers, with 2 connection in parallel (2 x 100Mbps interface / router)  over provider network. The provider is limiting your actual bandwidth to 10Mbps on one connection and to 1 Mbps over the other connection. You run OSPF or EIGRP over this connection.  If you don’t specified the accurate bandwidth on each connection, OSPF or EIGRP will calculate the metrics based on the default interface speed (100Mbps). From their point fo view both lines are equal, you have equal metric and you can run on the problem that the routers will push packets on both lines, but one line will have a higher throughput, so the packet will arrive at destination out-of-order.

If you specify the bandwidth command under the 100Mbps interface (bandwidth 10000 and bandwidth 1000) then IP routing protocols will sense the difference and the 10Mbps line will be more prefered than 1Mbps line.

Speed

What is Cisco.com saying about it:

To configure the speed for a Fast Ethernet or Gigabit Ethernet interface, use the speed command in interface configuration mode. To return to the default setting, use the no form of this command.

speed {10 | 100 | 1000 [negotiate] | auto [speed-list]}

no speed

Speed command explanation is actual much more simplest than bandwidth. Some interface (hardware dependent) allow you to set the speed. So, even if the interface is a 100Mbps you can set it to 10Mbps. That means that the interface is transmitting packets on up to 10Mbps.  You will ask me now, probably, OK, then if we set the interface speed to 10Mbps,  this will not tell the OSPF / EIGRP to calculate the metrics based on this value. Of course, yes. But what will you do when there is another value than standard 10Mbps or 100Mbps for the speed command. Like 1Mbps. You cannot set speed 1. Or if you have a hardware card which does not support speed slower than 1Gbps? That’s why you use the bandwidth command to tell the upper protocols the actual interface capability of throughput.

Speed command is also important, as it has to be the same on both ends of the connection. It can auto-negotiate is true, but sometimes it fail and when speed auto-negotiation fails, it default to 10Mbps half-duplex. You know what duplex is, don’t you? Well, imagine that your interfaces are 100Mbps full-duplex capable, but due to auto-negotiation failure, you will transmit at 10Mbps and half-duplex (only one packet in a direction at the time on the wire). That will be a huge drawback in your network capacity. If you have doubts about your device auto-negotiation capability, better hardcode there speed and duplex for to enjoy your night sleep.

I hope you understood the differences between speed and bandwidth interface command and I was clear in my explanation. If not, there are always comments for. Just ask me.

Web Server Directory Traversal Vulnerability in Cisco CDS

The Cisco Internet Streamer application, part of the Cisco Content Delivery System, contains a directory traversal vulnerability on its web server component that allows for arbitrary file access. By exploiting this vulnerability, an attacker may be able to read arbitrary files on the device, outside of the web server document directory, by using a specially crafted URL.

An unauthenticated attacker may be able to exploit this issue to access sensitive information, including the password files and system logs, which could be leveraged to launch subsequent attacks.

All versions of system software on the Cisco Internet Streamer application are vulnerable prior to the first fixed release, but Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.

This vulnerability can be exploited over all open HTTP ports; TCP ports 80 (Default HTTP port), 443 (Default HTTPS port) and 8090 (Alternate HTTP and HTTPS port), as well as those that are configured as part of the HTTP proxy.

As an interim step prior to upgrading the Cisco content delivery system software, it is possible to deny access to sensitive directories via service rules. The following example shows denying access to move up a directory level. This also caters for other directory moves, such as “\.\./”, “.\./” or “\../”:

rule enable
rule action block pattern-list 1
rule pattern-list 1 url-regex ^http://.*/../.*
rule pattern-list 1 url-regex ^https://.*/../.*

If you are affected by this issue or just want to read more please do it at http://www.cisco.com/warp/public/707/cisco-sa-20100721-spcdn.shtml.