Mental Note: Tracking L3 Glean Attacks

Here’s a handy debug command for tracking L3 Glean attacks on IOS based Cisco routers / L3 switches.

From there, you can take the output, paste the contents into a file, then use some Linux foo to determine the attacker.

Supporting documentation: Built-in CPU Sniffer

Share on FacebookTweet about this on TwitterShare on LinkedInShare on RedditEmail this to someone

November 28, 2014

Posted In: cisco, IOS, L3 glean, Layer 3 Switching, network security, Routing Protocols

RHCE Series: Route IP traffic and create static routes

As I start preparing for the RHCE exam, I’m attempting to go through each exam objective one by one and put together my notes on the subjects. I’ll try to go trough each exam objective in the order that it’s listed on it’s page, but I may skip around a little bit on the objectives that very vague on what exactly they want. This first set of notes is on routing IP traffic and static routes. Enjoy.

There are two installed packages that can provide the same routing and information and allow you to create static routes. Those packages are net-tools and iproute.

 

Above, you will see the package description, as well as the files that are installed with each package. Net-tools is the old tools and are pretty much kept around for compatibility. I personally like the output of the ifconfig and the route command better than I do the ip command, but as ifconfig and route are pretty much depreciated and will be going away at some point, I’ll focus my notes on the command sequence of the ip command.

ip command structure:

ip route {list, add, delete}:

Let’s break it down:

  • ‘ip route add’ – add a route
  • 192.168.100.0/24 – the destination network
  • ‘via 192.168.122.1’ – the gateway to reach the 192.168.100.0/24 network.
  • ‘dev eth0’ – the interface to send the traffic to both the gateway and destination network.

The ‘dev eth0’ is optional.

To make static routes persistent, you can create a static-routes file in /etc/sysconfig/. This file is already referenced in the network init script.

The ‘static-routes’ file has a similar syntax to the ‘route’ command. The reason for that is because the network init script uses the route command when it reads the static-routes file! That syntax is:

An example would be:

 

The next option would be to add a route-dev file in /etc/sysconfig/network-scripts.

An example of this file would be:

 

Share on FacebookTweet about this on TwitterShare on LinkedInShare on RedditEmail this to someone

October 11, 2012

Posted In: Linux, RHCE Study Notes, Routing Protocols