Prowling the Network for a Rogue Wireless Access Point

Prowling the Network for a Rogue Wireless Access Point

By way of review, a wireless access point (WAP) is a device that allows wired communication devices to connect to a wireless network using Wi-Fi or Bluetooth. The WAP usually connects to a router and can relay data between wireless devices, such as computers or printers and wired devices on the network. Prior to wireless networks, setting up a computer network required running tons of cables through walls and ceilings in order to deliver access to all the devices in the building. With a WAP, network users can add devices that access the network with fewer cables.

Wireless access is convenient and increases flexibility but at the same time security becomes a larger issue. Wired networks usually base the security on physical access control, but if wireless access points are connected to the network, anyone close by could connect. In fact, major data thefts have been initiated by attackers who have gained wireless access to organizations by connecting wirelessly to access points inside the organization.

Most often, the hardest part is convincing IT that there is an actual wireless network security breach. Fortunately, solutions like Wildpackets OmniPeek Network Analyzer make looking for wireless signals easy.

When I suspected a breach on a customer's network, I immediately turned to OmniPeek and produced a quick demo. My first step was to check the peer map for unencrypted connctions (see illustration below).

The IT guy said that there was no problem. After I reviewed the header of an email that he had just sent, I asked him if he was sure. There was an address on this plot, which was really close to the IP address of his mail server. After a bit of head scratching, he agreed.

Looking closer at the suspect IP address, it indicated that it was coming from a D-Link wireless router. But the company didn't have any of those, so they assumed it "wasn't a problem". After offering a further explanation of rogue access points, they began to slowly agree.

In the end, OmniPeek convinced the IT department that there was a problem to be investigated - an unauthorized access point on a critical server. With tools like OmniPeek, it's easy to prowl through complex networks and identify security issues, but a well-rounded explanation of the problem is truly the key to keeping networks healthy.

Troubleshooting Your Ethernet? Look for Physical Frame Corruption!

When troubleshooting your Ethernet network, the first thing to look for is physical frame corruption. Provided an organization is using coaxial Ethernet, below are four possible causes of physical frame corruption in an Ethernet network, each one different in the way it corrupts the frame and therefore recognizable (Note: Twisted-pair Ethernet implementations will not manifest these types of corruption patterns).

1) Collisions

Generally when a collision occurs, several bytes of the preamble of the colliding frame will be read into your analyzer's buffer before the signal is completely destroyed. You will see these bytes in the hexadecimal decode of the packet as either several bytes of AA's or several bytes of 55's at the very end of the frame (remember, AAh=1010b, 55h=0101b. Depending on where the collision occurred, the preamble could be perceived as either of these). If you see more than 8 bytes of AA or 55, then the corruption was not caused by a collision and more investigation is necessary.

2) Signal Reflections

One cause of signal reflection is an un-terminated cable. Electrons travel down the wire until they reach the cable's end, where, with no resistor to absorb the voltage potential, they reflect back from the open end of the cable. Another cause of signal reflections is mixing cables with different impedances. Impedance can be thought of as the "rate of flow" of the wire. When electrons from the higher impedance wire attempt to travel through the lower impedance wire, some of them can't make it and are reflected back, destroying the signal. The final cause of signal reflections is exceeding the maximum allowable bend radius of the cable. The copper media is deformed, causing reflections.

3) Electrical Noise

Physical frame corruption caused by electrical noise is similar in appearance to corruption caused by reflections in that there is no preamble in the frame -- the frame just seems to stop short, but is different in that the frames are generally cut off at random lengths.

4) Malfunctioning Hardware

Frame corruption caused by hardware malfunctions is potentially the hardest to diagnose because of the large number of ways that hardware can malfunction. Generally, hardware malfunctions will occur either randomly or constantly, but not regularly. The type of frame corruption is impossible to predict, generally manifesting as random "garbage" in the frame, but some common signs are: 

•  A stream of ones or zeros. A transceiver has malfunctioned and is "jabbering" on the wire. Most transceivers have jabber detection circuitry that prevents the adapter from transmitting for longer than a certain preset time.
• Gigantic frames (greater than 1500 bytes). Same as above. 

With these four main causes dissected above, troubleshooting an Ethernet network doesn't have to be confusing. While these tips are universal, specific analyzer's behavior might differ and an organization should determine what's best in terms of troubleshooting its own specific network.

How to Play By the Rules of Fast Ethernet

With today's bandwidth-intensive multimedia applications that number is barely adequate. For example, full motion video for video conferencing can require up to 25 Mbps. That means that classic Ethernet, at 10 Mbps, can only deliver poor quality real-time video for a single session. Fast Ethernet, which runs at 100 Mbps, allows for watching a broadcast presentation in one window while running a conference with three people in three other windows, while still leaving enough margin for network-based application usage.

Below are two primary areas to think about, if you want to play by the rules, when it comes to upgrading your network from 10Mbps to 100Mbps:

1. Cabling

A common problem with Fast Ethernet is the different cabling specifications. In Fast Ethernet, twisted pair cabling either needs to be category 5 or category 3 with proper twist on all four pairs. In classic Ethernet, it was easy to distinguish  between 10Base-2 for 10Base-5. With Fast Ethernet, special care must be taken to verify that the entire connection between station and concentrator either supports TX's 31.25MHz signal or maintains T4's four pairs with proper twist. There are a number of good cable testers and pair scanners available to help in determining this for your network.

2. Hubs

The problem with hubs is the number allowed in a single collision domain. Classic Ethernet allows hubs to be cascaded up to four deep between any two stations. In Fast Ethernet, the number of hubs allowed in a collision domain is drastically reduced to only a single hub. Sometimes it may be possible to have more than one hub in a collision domain, but it will probably be easier over the long term to design a Fast Ethernet network assuming that only one hub is allowed.

What the IEEE 802.3 spec does not explicitly state is that this limitation only applies to shared 100BASE-T, not switched 100BASE-T. Because switches act like bridges in defining a separate collision domain, installing Fast Ethernet switches will allow you to work around the single-hub problem. Even if it is not necessary to deliver dedicated switched Fast Ethernet to each desktop, Fast Ethernet hubs can be connected to switches. Connecting a number of repeaters to a switch will provide shared Fast Ethernet and allow you to maintain the size of your network.

The increase in speed and quality is well worth the transition to Fast Ethernet, however the number of hubs, along with the length and the type of cabling, need to be considered when upgrading your network to make sure it's an easy switch and has an overall positive impact on your organization.

"Installing Webmin on CentOs 5"

I just installed the latest version of webmin on my CentOs 5 server. I have not used webmin in about 2 years, I can not believe how much the interface has improved. Webmin is a GUI control panel that lets you administer a Linux box.

Here is all you need to do to get it installed:

This will install some dependencies.

yum -y install perl-Net-SSLeay

Install the system:
cd /usr/src
wget http://prdownloads.sourceforge.net/webadmin/webmin-1.510-1.noarch.rpm 

rpm -i webmin-1.510-1.noarch.rpm

Once you log in, you will see screens like this, click the image for a larger view:

Congrats to the Webmin team for keeping the product fresh!

Network Troubleshooting Commands

Troubleshooting computer network is one of the most important job description for network administrators, system administrators, network technicians and IT consultants. A computer network may have different types of problems as being infected with viruses and spyware, hacker attacks, can access by unauthorized users and may Connectivity problems due to failure of the faulty network devices or configurations face. The following is a list of basic network troubleshooting commands that are built into the Windows-based operating systems and UNIX etc. The right use of these commands can troubleshooting helps a lot in the diagnosis and solution of problems with your computer network.

PING

Ping is the most important troubleshooting command and checks the connectivity with other computers. For example, your system’s IP address is 10.10.10.10 and your network server’s IP address is 10.10.10.1 and you can check the connection to the server by using the ping command in the following format.
At DOS command prompt, type ping 10.10.10.1 and press Enter
When you receive the response from the server then the connectivity is ok and if you get the error message like this means to get “Request time out” so that there is a problem in connecting to the server.

IPCONFIG

IPconfig is another important command in Windows. It shows the IP address of the computer and it shows the DNS, DHCP, Gateway addresses the network and subnet mask.
At DOS prompt type ipconfig and press Enter to see the IP address of your computer.
inconfig In DOS prompt / all and press Enter to display the detailed information.

NSLOOKUP

NSLOOKUP is a TCP / IP-based command and checks domain name aliases, DNS records, information on the operating system by query the Internet domain name server. You can correct the error with the DNS server on your network

HOST NAME

Hostname command shows you the name of the computer.
At DOS prompt hostname and press Enter

NETSTAT

NETSTAT utility shows a statistical protocols and the current established TCP / IP connections to the computer.

NBTSTAT

NBTSTAT helps to resolve the NetBIOS name resolution problems.
ARP
ARP displays and modifies IP Physical address translation table that is used by the ARP protocols.

FINGER

Finger command is used to retrieve information about a user on a network.

TRACERT

Tracert command is used to determine the path of the remote system. This tool also provides the number of hops and the IP address of each hop. For example, if you see how many hops (routers) are involved to achieve, www.yahoo.com, and what the IP address of each hop is then to use the following command.
At the command prompt, type tracert www.yahoo.com you a list of all the hops and their IP addresses to see.

TRACE ROUTE

Traceroute is a very useful network debugging command and it is in the search for the server slows down the transmission on the Internet and it also shows the distance between the two systems are used.

ROUTE

Route command, you can manually make entries in the routing table.
Hopefully, the above commands will help you diagnose the troubleshooting computer networking problems.

Use Mac's Network Utility to troubleshoot networks

Prepackaged commands

Quick quiz: name the eight operations the Network Utility performs. Many Mac admins won’t even remember that the utility can perform that many functions, much less the actual operations. The actual network tasks and commands that the utility performs are:

• Info (customizable by specific network interface)
• Netstat
• Ping
• Lookup
• Traceroute
• Whois
• Finger
• Port Scan

The Info window returns detailed configuration information for a specific network interface. In addition to listing IP address, hardware (MAC) address, link speed and link status, the Info page also lists transfer statistics. The best part, like all the Network Utility tabs, all information is displayed within an easily read GUI.
The Netstat tab displays results from canned Netstat operations, including routing tables, comprehensive network statistics for protocols, multicast information and socket state status. The Netstat data proves helpful when troubleshooting routing issues and network failures by offering route, destination and socket data.
Ping, which tests connectivity and latency, offers just two options: address and number of pings. Techs simply enter the address (either a numeric IP or friendly web address) to test and specify either an unlimited number of pings or a specific limit.

Lookup simplifies testing DNS resolution. Techs enter a numeric or Web address in the provided field, specify the type of information to look up and click the provided button. The command then runs. Among the lookup options are Internet addresses, canonical names, MX records, name servers, and host names, among others.

Traceroute helps identify failures along a route. By tracing the path packets follow to a destination, enterprise administrators can learn where a breakdown is occurring. I’ve solved maddening routing issues with Traceroute’s assistance. I’ve had clients whose attempts to connect to cloud-based servers in Minnesota from Kentucky failed due to bad handoffs by the ISP in Utah. Copying and forwarding the Traceroute screens are what convinced the ISP’s technical staff that the problem was with their network.

Whois assists administrators in determining the owner of registered Web addresses. Besides returning registrar information, Whois searches also display domain expiration dates, name server settings and related information. Multiple Whois databases can be searched, including those maintained by Internic, Network Solutions ,and APNIC.
Finger enables supplying a user account and node address to learn more information about a user account, such as office location, telephone number, or other data. In the Internet’s early days, seeking and obtaining such information was commonly accepted, but latter-day security concerns typically result in finger traffic being blocked by many networks.
The Port Scan tab allows an enterprise administrator to list a specific IP address or site and perform a scan of open ports. To speed results, administrators can also test ports within specific ranges or just a single port using the supplied checkbox option. Such Port Scans can assist staff in ensuring only appropriate ports are enabled, thereby tightening a network’s security configuration.

Quick work of complex commands

The Mac’s Network Utility makes quick work of common, often complex commands. The addition of an easily read GUI makes the Network Utility, and the information it returns, that much more user friendly. Reached from /Applications/Utilities, the Network Utility.app tool assists engineers in diagnosing common network problems and obtaining critical information needed to speed repair.

command for cisco initial configuration

I found the following handy Cisco commands are very useful for initial configuration of Cisco devices.
I always use these commands to configure Cisco devices from fresh configuration.

router> enable
router> configure terminal
router (config)# no ip domain-lookup

The no ip domain-lookup is very useful, what this command does is tell the Cisco device not to do a domain lookup when you mistype something in the CLI. For example if you do this without the no ip domain-lookup:

router# pign
Translating "pign"... domain server (255.255.255.255)
%unknown command or computer name, or unable to find computer address

The Cisco device will try to find the computer name of pign, it doesn't know that you mistyped ping. This process could take a very long time.
If you apply the no ip domain-lookup, the Cisco device won't try to do the domain lookup.
The second command is the alias command. This command makes an alias of a command that you use frequently.
For example you often use the command show ip interface brief, you can make an alias of it to be "ship".

router (config)# alias exec ship show ip interface brief

You configure it by entering alias first, followed by which mode the command resides in - in this example the show command resides in the exec mode - type in the alias for the command, then you enter the full commands that you want to make alias.
Now you just have to type in ship instead of the long show ip interface brief command.

Next command is useful when you connect to the Cisco devices and you need a very long time to configure it.
The Cisco devices have a default time of how long you're allowed to get connected to them. Sometimes you don't want to reconnect again all the time, but mind you that the time limitation is set because of security concern.

router (config)# line vty 0 4
router (config-line)# no exec-timeout

The above commands tell the router to give you all the time that you need when configuring the router from the telnet session, it won't cut your connection. You can also configure it for the console connection.
Last one is my favorite one, you know when you're configuring a Cisco device sometimes you'd get some notifications from the device which is great, it tells you things going on in it.
But it gets annoying when you're trying to configure it and the notifications just cut down your halfway written command.
The following command tells the router to write back the command you entered before the notifications cut it:
router (config)# line vty 0 4
router (config-line)# logging synchronous