Macetes TI: Networking

Mostrando postagens com marcador Networking. Mostrar todas as postagens

Export/import windows server DNS zones

You can use Export-DnsServerZone and Import-DnsServerZone.

Export: Export-DnsServerZone -Name "test.com" -Filename "test.com.dns"
Import: Import-DnsServerZone -Name "test.com" -Filename "test.com.dns"

The file "test.com.dns" will be created in "C:\windows\system32\dns" folder

Only export dns records:

Get-DnsServerResourceRecord -ZoneName "test.com" | Export-Csv -Path "C:\temp\dns.csv"

Import option 2:

dnscmd localhost /zoneadd teste.com /primary /file teste.com /load

Command ip examples

# Forcefully close a connection to a specific destination
sudo ss -K dst 192.168.1.100

# view routes
ip r
ip route

# To reject a route (block traffic to an IP)
ip route add unreachable 74.1.1.0/24
ip route del unreachable 74.1.1.0/24

# add route
sudo ip route add {NETWORK/MASK} via {GATEWAYIP}
sudo ip route add {NETWORK/MASK} dev {DEVICE}
sudo ip route add default {NETWORK/MASK} dev {DEVICE}
sudo ip route add default {NETWORK/MASK} via {GATEWAYIP}

# Here is another example where I am setting up route for my VPN gateway:
ip link set dev tun0 up mtu 1500
ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255
ip route add 139.59.2.125/32 via 192.168.2.254
ip route add 0.0.0.0/1 via 10.8.0.1
ip route add 128.0.0.0/1 via 10.8.0.1

Edit config file such as /etc/sysconfig/network-scripts/route-eth0 on a CentOS/RHEL/Fedora Linux for interface eth0 using a text editor such as nano command or vim command:
vim /etc/sysconfig/network-scripts/route-eth0

Append the following text:
172.10.1.0/24 via 10.0.0.100 dev eth0

Save and exit (close) the file in a vim text editor. Finally, restart your network service on a CentOS/RHEL/Fedora Linux so they take effect:
systemctl restart network.service

A note about ip command and persistence static routing on a Debian/Ubuntu

Edit your /etc/network/interfaces file for say eth0:
vi /etc/network/interfaces

Update it as follows:

auto eth0
iface eth0 inet static
address 192.168.1.2
netmask 255.255.255.0
gateway 192.168.1.254
## static ip config START ##
up /sbin/ip route add 172.10.1.0/24 via 10.8.0.1 dev eth0
down /sbin/ip route delete 172.10.1.0/24 via 10.8.0.1 dev eth0
## static ip config END ##

## How to find the route used for an destination IP

The syntax is as follows:
ip route get to {IPv4_address_here}
ip route get to {IPv6_address_here}
ip route get to 172.66.43.74

Outputs indicating that 172.66.43.74 can be reached via the wg0 interface with 192.168.13.4 as source IP:

172.66.43.74 dev wg0 table 51832 src 192.168.13.4 uid 1000
cache

Export netflow from linux server

https://github.com/irino/softflowd

pico /etc/systemd/system/softflowd.service

[Unit]
Description=Softflowd exporter
After=network.target

[Service]
ExecStart=softflowd -i ens160 -v 9 -s 1 -t maxlife=1 -t general=15 -d -n 10.25.10.59:9996
Restart=always
User=root
Group=root

[Install]
WantedBy=default.target

Monitoring response time with curl

curl -s -o /dev/null -w "Conecction: %{time_connect}s | Start transfer: %{time_starttransfer}s | Total time: %{time_total}s\n" https://example.com

curl -s -o /dev/null -w "Conecction: %{time_connect}s | Start transfer: %{time_starttransfer}s | Total time: %{time_total}s\n" https://example.com >> /tmp/curl.txt

Veeam RMAN plugin Windows network tuning

In larger environments lots of connections are made by the Plug-In backups. It is recommended to tune the network settings of the involved Windows machines in the Veeam infrastructure (Windows VBR server and Windows repository servers) according to the Microsoft guide to improve network performance:

Increase the available dynamic port range. The default dynamic ports range in Windows is 49152-65535 which is 16384 ports. Use the following command to increase the amount of available dynamic ports for IPv4 to 55525 without affecting ports of Veeam services:

netsh int ipv4 set dynamicport tcp start=10010 num=55525
Add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpTimedWaitDelay and set it to 30 to reduce the time a port keeps being blocked for reuse (default is 240 seconds)

How to list open ports and application using them in Windows

netstat -abn

netstat -a -n -p tcp -o

Fix netplan gateway4 deprecated

            routes:
                - to: default
                  via: 192.168.10.1

example:
network:
version: 2
renderer: networkd
ethernets:
    eno1:
      dhcp4: false
      dhcp6: false
     addresses:
      - 192.168.10.10/24
     routes:
      - to: default
        via: 192.168.10.1
     nameservers:
       addresses: [192.168.10.1]

Fix permissions:
chmod 600 /etc/netplan/your_config_file.yaml

Network masks

View network connections, ports and process

View network connections, ports and process:

lsof command example

Type the following command to see IPv4 port(s), enter:
# lsof -Pnl +M -i4

Type the following command to see IPv6 listing port(s), enter:
# lsof -Pnl +M -i6

Process information
# lsof -p PID

netstat command example

Type the command as follows:
# netstat -patun

OR
# netstat -netpl

Disable IPv6 on Ubuntu

Disable in current session:

$ sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
$ sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1

The above IPv6 disable settings would not persist after the reboot. The usual way on how to load the above settings is to edit the /etc/sysctl.conf configuration file by adding the following lines:

net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1

WARNING: Please note, that at the time of writing this method to disable IPv6 after reboot using /etc/sysctl.conf configuration file on Ubuntu 18.04 does Not work. However, this seems to be a bug so feel free to try.
The recommend method to disable IPv6 on Ubuntu 18.04 after reboot is to configure the GRUB boot loader to pass kernel parameter during the boot time.

To do so open the /etc/default/grub using your favorite text editor with root privileges and change/add:

FROM:
GRUB_CMDLINE_LINUX_DEFAULT=""
GRUB_CMDLINE_LINUX=""
TO:
GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1"
GRUB_CMDLINE_LINUX="ipv6.disable=1"

update-grub

Reboot the system to disable IPv6 support.

View what process listen at port

View what process listen at port

Linux:
$ sudo lsof -i -P -n
$ sudo lsof -i -P -n | grep LISTEN


Windows:
netstat -bano | more
netstat -bano | grep LISTENING
netstat -bano | findstr /R /C:"[LISTEING]"

View DNSSEC key info

cat dsset-domain.com. |head -1

Apache deny access IPs

Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from 192.168.1.0/24

GPO error with samba 4

GPO from samba 4 don't work.

On server:
samba-tool ntacl sysvolreset

On windows client:
gpupdate /force

Linux shell network monitoring tools

1. Overall bandwidth - nload, bmon, slurm, bwm-ng, cbm, speedometer, netload

2. Overall bandwidth (batch style output) - vnstat, ifstat, dstat, collectl

2. Bandwidth per socket connection - iftop, iptraf, tcptrack, pktstat, netwatch, trafshow

3. Bandwidth per process - nethogs

Limit bandwidth in Linux

wondershaper - An easy tool to limit bandwidth of a particular interface.

apt-get install wondershaper

$ sudo wondershaper {interface} {down} {up}

the {down} and {up} are bandwidth in kpbs

So for example if you want to limit the bandwidth of interface eth1 to 256kbps downlink and 128kbps uplink,

$ sudo wondershaper eth1 256 128

To clear the limit,

$ sudo wondershaper clear eth1

Networking tool comics!

Source: https://jvns.ca/blog/2019/02/10/a-few-networking-tool-comics/

Enable/disable windows firewall

Win XP
(desativar FW) netsh firewall set opmode disable
(habilitar FW) netsh firewall set opmode enable

Win 7
(desativar FW) netsh advfirewall set allprofiles state off
(habilitar FW) netsh advfirewall set allprofiles state on

(parar serviço FW) net stop MpsSvc
(iniciar serviço FW) net start MpsSvc

* Para executar remoto, utilize PSEXEC.EXE ou envie um .BAT com os comandos para o usuário.

Windows Firewall Inbound Dynamic RPC

To create a rule that allows inbound network traffic to the RPC Endpoint Mapper service

On MBRSVR1, in Group Policy Management Editor for your server GPO, in the navigation pane, right-click Inbound Rules, and then click New rule.
On the Rule Type page, click Custom, and then click Next.
In the This program path text box, type %systemroot%\system32\svchost.exe.
Next to Services, click Customize.
Click Apply to this service, select Remote Procedure Call (RPC) with a short name of RpcSs, click OK, and then click Next.
On the warning about conflicting with Windows service-hardening rules, click Yes.
On the Protocol and Ports page, for Protocol type, select TCP.
For Local Port, select RPC Endpoint Mapper, and then click Next.
On the Scope page, click Next.
On the Action page, click Next.
On the Profile page, clear the Private and Public check boxes, and then click Next.
On the Name page, type Allow RPC Endpoint Mapper, and then click Finish.

Or: netsh advfirewall firewall add rule name="Allow RPC" protocol=tcp service=rpcss dir=in action=allow profile=domain

Source: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732839(v=ws.10)

Windows - Send message using IP list

$ListofIPs = Get-Content "<filepath\filename>";
foreach($i in $listofips){
    msg /SERVER:$i * /TIME:300 "Message"
}

Macetes TI