Patrick's Blog

Windows 7 Packet Capture

patrickpreuss — Wed, 21 Dec 2011 18:24:26 +0000

You have several options to capture packets on Windows 7 on is Wireshark the other is

netsh

C:\Users\rt01>netsh trace show scenarios

Verfügbare Szenarien (18):

AddressAcquisition: Problembehandlung in Zusammenhang mit der Adressenerfassung DirectAccess: Problembehandlung in Zusammenhang mit DirectAccess FileSharing: Allgemeine Datei- und Druckerfreigabeprobleme behandeln InternetClient: Probleme mit der Webkonnektivität diagnostizieren InternetServer: Behandeln von serverseitigen Webkonnektivitätsproblemen L2SEC: Problembehandlung in Zusammenhang mit der Authentifizierung auf der 2. Schicht LAN: Problembehandlung im Zusammenhang mit verkabelten LANs Layer2: Problembehandlung in Zusammenhang mit der Konnektivität auf der 2. Schicht MBN: Problembehandlung in Zusammenhang mit mobilem Breitband NDIS: Problembehandlung in Zusammenhang mit Netzwerkadaptern NetConnection: Problembehandlung bei Netzwerkverbindungen P2P-Grouping: Peer-zu-Peer-Gruppierungsprobleme behandeln P2P-PNRP: Problembehandlung in Zusammenhang mit dem Peer Name Resolution-Protokoll (PNRP) RemoteAssistance: Probleme mit der Windows-Remoteunterstützung behandeln RPC: Probleme mit dem RPC-Framework beheben WCN: Problembehandlung in Zusammenhang mit der Windows-Sofortverbindung WFP-IPsec: Behandeln von Windows-Filterplattformproblemen und IPsec-bezogenen Problemen WLAN: Problembehandlung in Zusammenhang mit drahtlosen LANs

C:\Windows\system32>netsh trace start scenario=MBN capture=yes report=yes tracefile=c:\trace\trace.etl

Ablaufverfolgungskonfiguration:

Status: Wird ausgeführt Ablaufverfolgungsdatei: C:\trace\trace.etl Anfügen: Aus Kreisförmig: Ein Maximale Größe: 250 MB Bericht: Ein


netsh trace stop

then you can use the Network Monitor NM

Cisco Config Archive

patrickpreuss — Wed, 14 Dec 2011 19:42:00 +0000

c870-adventerprisek9-mz.124-15.T7.bin
c2960-lanlitek9-mz.122-50.SE3.bin

rt1#sh archive
The next archive file will be named ftp://cisco:cisco@10.0.160.230/config/rt1-4
 Archive #  Name
   0
   1       ftp://cisco:cisco@10.0.160.230/config/rt1-1
   2       ftp://cisco:cisco@10.0.160.230/config/rt1-2
   3       ftp://cisco:cisco@10.0.160.230/config/rt1-3 <- Most Recent
   4
   5
   6
   7
   8
   9
   10
   11
   12
   13
   14

sw2#sh archive
The maximum archive configurations allowed is 14.
The next archive file will be named ftp://cisco:cisco@10.0.160.230/config/sw2--18
 Archive #  Name
   1        ftp://cisco:cisco@10.0.160.230/config/sw2Dec-14-17-24-30.425-8
   2        ftp://cisco:cisco@10.0.160.230/config/sw2Dec-14-17-24-36.440-9
   3        ftp://cisco:cisco@10.0.160.230/config/sw2Dec-14-17-24-41.926-10
   4        ftp://cisco:cisco@10.0.160.230/config/sw2Dec-14-17-24-47.454-11
   5        ftp://cisco:cisco@10.0.160.230/config/sw2Dec-14-17-24-54.492-12
   6        ftp://cisco:cisco@10.0.160.230/config/sw2Dec-14-17-25-40.688-13
   7        ftp://cisco:cisco@10.0.160.230/config/sw2Dec-14-17-25-50.788-14
   8        ftp://cisco:cisco@10.0.160.230/config/sw2Dec-14-17-25-58.766-15
   9        ftp://cisco:cisco@10.0.160.230/config/sw2Dec-14-17-26-07.104-16
   10       ftp://cisco:cisco@10.0.160.230/config/sw2Dec-14-17-26-14.092-17 <- Most Recent

ftp> dir
200 Port command successful
150 Opening data channel for directory list.
-rw-r--r-- 1 ftp ftp          20299 Dec 14 18:18 rt1-1
-rw-r--r-- 1 ftp ftp          20299 Dec 14 18:19 rt1-2
-rw-r--r-- 1 ftp ftp          20299 Dec 14 18:21 rt1-3
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:22 sw2Dec-14-17-22-39.964-0
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:23 sw2Dec-14-17-23-45.597-1
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:23 sw2Dec-14-17-23-51.393-2
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:24 sw2Dec-14-17-23-56.972-3
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:24 sw2Dec-14-17-24-03.515-4
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:24 sw2Dec-14-17-24-08.665-5
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:24 sw2Dec-14-17-24-14.085-6
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:24 sw2Dec-14-17-24-24.176-7
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:24 sw2Dec-14-17-24-30.425-8
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:24 sw2Dec-14-17-24-36.440-9
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:24 sw2Dec-14-17-24-41.926-10
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:24 sw2Dec-14-17-24-47.454-11
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:25 sw2Dec-14-17-24-54.492-12
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:25 sw2Dec-14-17-25-40.688-13
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:25 sw2Dec-14-17-25-50.788-14
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:26 sw2Dec-14-17-25-58.766-15
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:26 sw2Dec-14-17-26-07.104-16
-rw-r--r-- 1 ftp ftp           6714 Dec 14 18:26 sw2Dec-14-17-26-14.092-17
226 Transfer OK
FTP: 1631 Bytes empfangen in 0,00Sekunden 815,50KB/s
ftp>

Cisco IOS VPN to IPCop

patrickpreuss — Fri, 09 Dec 2011 16:37:14 +0000

crypto isakmp key supersecertkey address AAA.BBB.CCC.DDD
!
crypto isakmp policy 20
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto map CSM_CME_FastEthernet0.831 131 ipsec-isakmp
 set peer AAA.BBB.CCC.DDD
 set transform-set ESP-3DES-SHA
 match address XY-TEST-CRYPTO-ACL
 reverse-route
!
ip nat outside source static 192.168.XX.121 10.4.YYY.243 add-route
!
ip access-list extended XY-TEST-CRYPTO-ACL
 permit ip 10.0.YYY.40 0.0.0.252 192.168.XX.0 0.0.0.255
!

# Do not modify 'ipsec.conf' directly since any changes you make will be
# overwritten whenever you change IPsec settings using the web interface!
#
version 2.0
config setup
       protostack=netkey
       klipsdebug="none"
       plutodebug="none"
       #plutoload=%search
       #plutostart=%search
       uniqueids=yes
       nat_traversal=yes   
       virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.5.0/255.255.255.0,%v4:!10.0.244.40/30

conn %default
       keyingtries=0
       disablearrivalcheck=no
       leftupdown=/usr/local/bin/ipsecupdown.sh

#RED
conn RED
       left=192.168.0.1
       leftsubnet=192.168.XXX.0/24
       right=AAA.BBB.CCC.EEE
       rightsubnet=10.0.YYYY.40/30
       ike=3des-sha-modp1024
       esp=3des-sha1
       ikelifetime=1h
       keylife=24h
       dpddelay=30
       dpdtimeout=120
       dpdaction=restart
       pfs=no
       authby=secret
       auto=start

Wirehark SMB2 Trace

patrickpreuss — Fri, 09 Dec 2011 10:34:41 +0000

"\Program Files\Wireshark\tshark.exe" -r trace.pcapng -R "smb2.filename or smb2.nt_status eq 0xc0000034"

0xc0000034 = STATUS_OBJECT_NAME_NOT_FOUND

PowerShell – Arrays / Hash

patrickpreuss — Fri, 18 Nov 2011 12:30:33 +0000

Arrays

$array = 1,2,3,4
$array 
1
2
3
4
$array.Length

PowerShell – Case Select

patrickpreuss — Fri, 18 Nov 2011 12:15:53 +0000

switch ($a) {
 "Value" { Write-Output "A: $a" }
 "Value" { Write-Output "A: $a" }
 default  { Write-Output "A: $a"}
}

Creating Network Diagrams with Visio and PowerShell

patrickpreuss — Fri, 18 Nov 2011 08:20:58 +0000

http://communities.netapp.com/docs/DOC-6411

Enterasys Radius authentication against ACS

patrickpreuss — Thu, 17 Nov 2011 14:53:57 +0000

set radius enable
set radius server 1 10.0.xx.y7 1812 supersecret realm any
set radius server 2 10.0.xx.y8 1812 supersecret realm any

on the acs

Radius reply item must be

Filter-ID = Enterasys:version=1:mgmt=su

Enterasys Tacacs Authentication against ACS

patrickpreuss — Thu, 17 Nov 2011 14:52:32 +0000

set tacacs enable
set tacacs command authorization enable
set tacacs singleconnect enable
set tacacs server 1 10.0.xx.y9 49 supersecret
set tacacs server 2 10.0.xx.y8 49 supersecret

ISDN Cable

patrickpreuss — Thu, 17 Nov 2011 13:19:17 +0000

ISDN BRI S/T Cable

8 Pin	TE	NT	Polarity
1	Not used	Not used	Not used
2	Not used	Not used	Not used
3	Transmit	Receive	+
4	Receive	Transmit	+
5	Transmit	Receive	-
6	Receive	Transmit	-
7	Not used	Not used	Not used
8	Not used	Not used	Not used
1	Not used	Not used	Not used

ISDN BRI Cross Over Cable

Side A (8 Pin)	connect	Side B (8 Pin)
1	Not used	1
2	Not used	2
3	<->	4
4	<->	3
5	<->	6
6	<->	5
7	Not used	7
8	Not used	8
1	Not used	Not used	Not used

Cisco 1603-R

Netzwerk Lexikon