If you are attached to a corporate or an enterprise network and connect to internet from behind a BlueCoat proxy which proxies FTP connections then FileZilla FTP client needs needs to be configured accordingly to get it work properly. There is an FTP proxy configuration and a Generic Proxy configuration that can be set in FileZilla client.

Using a Generic Proxy forces it to use Passive Mode connections.However, if you need to use Active mode FTP connections then FTP Proxy should be configured.

Click Edit – Settings from menu to open the FileZilla client settings. Expand FTP in the leftpane and click "FTP Proxy".In the rightpane, select "custom" under "Type of FTP Proxy" and enter the following format specifications:

USER %u@%h

PASS %P

ACCT %w

Once done, enter the IP Address/Hostname and of the Proxy host (if it is not listening on the standard TCP/21 then provide the prot number along with the IP address or hostname, ex: proxy:8085) then the user (username@domainname where domainname is name of the Windows Domain, if it uses WSSO or Intergrated Windows Authentication) and the password (domain password if using windows domain name as above)

This should set the configs appropriately. To check if the connection works OK, try connecting to the external FTP server and you should be able to first connect to the BlueCoat proxy where it first issues a Welcome message as in the following screenshot before it connects you to the remote FTP server.

This should help!

Back from the holidays only to find my Windows Profile gone missing at work. One of the annoying things was to add all my remote hosts back onto WyseTerm. While the bad news is that there is no single file (which one would expect) that maintains this list, the good news comes in the form of Windows Registry. Yes, the WyseTerm host information is stored in Windows Registry and can be exported from the registry on to a new profile or other users profile.

The WyseTerm Host information, also known as the Common Address Book can be exported from the Windows Registry and then imported onto the new users profile as follows:

1. Click Start – Run – type "regedit" and press enter to open Windows Registry.

2. Navigate to

[HKEY_CURRENT_USER\Software\Hummingbird\Connectivity\[version]\HostExplorer\Common]

where [version] is the version of your Hummingbird software.

3. Click File and select EXPORT to export the "Common Address Book". Enter a file name to save the reg file.

4. Now, login as the new user and run this reg file. This should import the WyseTerm host list onto the users WyseTerm.

 This should help!!!

With Spanning Tree Protocol, messages from a connected device always takes the least cost path to the Root Bridge. The least cost path also called as Link Cost or Port cost is the lowest cost path of the one or more paths available from the device to the root bridge. Each link type has its own default costs which is used by the Spanning Tree Protocol (STP) to calculate the least cost path.

Here we see a list of various Costs associated with link types based on the bandwidth:

Bandwidth      Cost
===================
4 Mbit/s       250
10 Mbit/s      100
16 Mbit/s      62
45 Mbit/s      39
100 Mbit/s     19
155 Mbit/s     14
200 Mbit/s     12
622 Mbit/s     6
1 Gbit/s         4
2 Gbit/s         3
10 Gbit/s       2
20 Gbit/s       1
[EtherChannel] 

Advanced Subnet Calculator from SolarWind is a simple but powerful easy to use Subnet Calculator for Windows.

Advanced Subnet Calculator can perform

whois lookups for hostnames and Domain Names

IPWhois Lookup for the provided IP Address

Classful Subnet Calculator

Claseless Inter-Domain Routing (CIDR) Calculator

Address Generator for a given IP Address and Subnet Mask

The tool can calculate both claseful Subnets and CIDRs and generate subnets. Also, can generate a list of IP Addresses for a given IP address and Subnet mask.

A quick and efficient tool for Network Administrators and designers and is completely free.

Advanced Subnet Calculator runs on Windows. To download advanced Subnet Calculator, click here

RANCID is Really Awesome New Cisco Config Differ. AS its name implies, RANCID monitors network device configuration, including software and hardware and uses CVS (Concurrent Version System) or Subversion to maintain history of changes. RANCID is simple and is easy to use.

The same very functionality of RANCID can be used as a backup system for Network device config backup system or even a config change alert system as it can email changes from previous saved configurations. All this RANCID does by logging on to a network device using Telnet or SSH and runs various show commands to grab config changes (hardware & Software), send alert emails of any changes, format the info and commit to the CVS system.

Some of the devices that RANCID supports

Cisco Routers and Cisco Catalyst Switches (IOS & CatOS)

Juniper Routers

Foundry Switches

HP ProCurve Switches

Alteon Switches

Redback NAS

ADC EZT3 MUXs

MRTd & IRRd

RANCID is a Linux based software and needs to be compiled and installed (unfortunately there is no package built for specific Linux platforms)

RANCID can be downloaded from SHURBBERY networks here

RANCID requires the expect module installed on the Linux platform. A sample email notification showing changes based on the previous config versions can be found here.

Packet Trap pt360 Tool suite is a Windows based free Network Diagnostic tools suite and a Network Monitoring tool. Packet Trap has a nice Dashboard with drag and drop dashboard components.

At the first look, Packet Trap is very impressive, simple, easy to use, easy to understand, simple and easy navigation and menu options. All the diagnostic tools are graphic and provides a great advantage as a one stop shop for most of the Network troubleshooting. What is even more impressive is that the monitoring system being integrated into a Network Diagnostic suite which allows an admin to monitor and troubleshoot all from one place and they all can export the results in nice HTML format.

The network diagnostic tools available in Packet Trap are

Ping Scan – To scan networks using ICMP

Enhanced Ping – Detailed reporting on Ping Time, Reponse time, Average response time, status and packet loss details.

Graphical Ping – Pings persistently and Graphs the response time in milliseconds over a period of time

DNS Audit – DNS Lookup for a host with simple lookup details

Whois Lookup

Port Scan for a given IP or a range of IPs

MAC Address Scan for a given IP or a range of IPs

SNMP Scan – Supports SNMPv1/2&3 thereby any platform that supports SNMP are supported

WMI Scan – Windows WMI support

Wake On LAN – Wake on LAN list of Hosts (hosts that support the option at the hardware level. For example, in BIOS for x86 systems)

TraceRoute – with response times and Packet Loss info

Traffic Jam – Traffic Generator on TCP and UDP ports with customisation options on the packet size, bandwidth

TFTP server

All the diagnostic tools are also available as individual downloads, if you do not want a host of these features on your system. Although, the fully loaded suite is certainly not bloated. There is also a commercial PRO version of this tool which extends support to

Cisco Config Management

Netflow Analyzer

Opensource tools integration (like Nagios & Cacti)

Remote TCP reset

Syslog server

Network Discovery

Encrypted Password vault

If I have to point and select the best possible  feature, I would choose Wake On LAN feature which allows you to start a bunch of hosts which supports the feature. This can be of great help with remote access/administration when you need to start a PC which you know is shutdown. Departments may even adapt it for green policies. Also, all SNMP, Password and other credentials are stored in encrypted format on the disk.

Overall a great tool for simple network administration. If there is anything that one could call a downside it is that PacketTrap pt360 could have been Web-based Client-Server tool than desktop based. This would allow Small and Medium Networks and may be to a level Enterprise networks to adapt.

As a Network professional, I would personally recommend this product to my fellow professionals!!!

For more information and download, click here

Sometimes, there is a need to have more than one IP Addresses assigned to a PC or a Server. If you have multiple services running on a server like a webserver and a mail server and want to assign each of these services seperate IP Addresses the Multiple IP addresses will help. While this need not necessarily require to have more than one Network Interface Card (NIC) on the server.

You can add multiple IP Addresses to a single interface card. However, these IP Addresses should be in the same logical network although in different subnets.

The following procedure will just guide you how to add Multiple IP Addresses:

1. Open Control Panel and Network Connections.

2. Right-click the LAN connection and select properties.

3. Select Internet Protocol (TCP/IP) and click properties.

4. Select "Use the following IP Address" and enter the primary IP Address, Subnet mask and Gateway and the primary and secondary DNS Servers.

5. Click Advanced then Add under IP Addresses.

6. Add the IP Address and Subnet mask. Repeat the procedure if there are additional IP Addresses to be added.

7. Click Add under "Default Gateways" and add the gateway addresses.
NOTE: The system will always use the 1st available Gateway and will use the additional gateways unless the primary gateway is not reacheable.

8.Click OK then OK and then OK to save the changes.

9. To confirm the multiple IP Addresses are set, from the command prompt (Start-Run and type CMD) run the ipconfig command. You can see multiple IP addresses on one Network Interface Card.

ICMP redirect is a type 5 ICMP error message sent by a gateway router to a sending host informing of an optimal alternate route to the destination host and to update its routing table with the new host route to the target destination host.

ICMP Redirects being an inefficient way to update a hosts routing table of an optimal route to a target destination can cause security issues. A malicious hacker with little knowledge about the network can launch a Denail of Service (DoS) attack on a host on the network.

ICMP Redirect is by default enabled in Windows. If ICMP redirects are not required for the host it should be disabled. To disable ICMP Redirects in Windows (windows 2000, Windows XP and higher) you need to edit the Windows Registry and modify the default value for ICMP Redirects.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Use Registry Editor at your own risk.

Click Start – Run, type "regedit" and press enter.

Once into Windows Registry, navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

In the right pane, double-click "EnableICMPRedirect" DWORD and change the value to "0"

This should disable ICMP Redirects in Windows.

ICMP Redirect is a type 5 ICMP error message sent by a gateway router to a sending host informing of an optimal alternate route to the destination host and to update its routing table with the new host route to the target destination host. The router forwards the original packet to the next hop router or to the destination host and sends the ICMP Redirect message to the sending host so that the subsequent packets to the destination host can be sent via the new route.

For instance in an ideal setup, a host on a subnet will have a default route configured and all the packets are sent to the default router which takes care of the routing. In the following setup, Host A has Router A as the default Gateway.

In the following setup, when Host A wants to send a packet to Host B

Host A sends a packet for Host B to Router A

Router A receives the packet and checks its routing table and forwards the packet to the next hop router Router B.

Router A also finds its "OUT" interface and Router B "IN" interface are in the same subnet as that of the Host A. It only makes sense that the optimal route for Host A to Host B will be through Router B

Router A now sends an ICMP Redirect (ICMP type 5) message back to Host A indicating the alternate route and to send subsequent packets for Host B to Router B and forwards the current packet to the next hop router.

Host A adds a static host route for Host B with Router B as the next hop router and the subsequent packets are sent to Router B.

The ICMP Redirect message is a type 5 ICMP message with one of the following codes:

0 – Redirect Datagrams for Network
1 – Redirect Datagram for Host
2 – Redirect Datagram for Service and the Network
3 – Redirect Datagram for Service and the Host

The codes 0 and 2 are depreciated and made obsolete and hence are the ICMP Network Redirects and only code 1 and 3 are used. Hence, ICMP Redirects are ICMP Host Redirects.

For a gateway router configured to send ICMP redirects, to send an ICMP Redirect message,

• the incoming packet should not have a Soure Route option (RFC1812)
• the incoming and outgoing interface for the packet on the router should be the same (RFC1812)
• the Source IP on the packet should be on the same IP Network or subnet of the next hop address (RFC1812)
• the route for the outgoing message should not be an ICMP redirect or a default route

On the other hand, according to RFCs a host or a device which is not acting as a router or a gateway,

• should be able to accept ICMP redirect messages (RFC1122)
• should not send a ICMP Redirect messages (RFC1122)
• should update its routing table of the new host route as advised by the ICMP Redirect message if the new router or gateway is on the directly connected network and is received from the current router or gateway for the destination

Also according to RFCs, a device acting as a Gateway or a Router,

• should discard a ICMP redirect message it receives, if the new gateway or router specified is not in the same IP network or subnet on which it received the redirect message (RFC1122)
• a router can ignore the ICMP redirect message if it is running a Routing protocol (RFC1812)
• a router can ignore the ICMP redirect message if forwarding is enabled on the router and/or on the interface on which the packet is being sent (RFC1812)

ICMP Redirects are not the very efficient way to update a host table of efficient routes as it can easily fill up a hosts routing table to cause performance issues. Also, can be used by a malicious hacker to launch a Denial of Service Attack on a host on the network using a properly crafted redirect packet to inject malicious routes into the hosts routing table, with very little knowledge of the network itself.

ClarkConnect is an all-in-one Opensource networking suite from Point Clark Networks. It is a full blown security suite on one front with Stateful firewall protection, Intrusion Detection and prevention, Maile Gateway with Antivirus, Anti-spam and Anti-phishing support, proxy & web content filtering, peer to peer connection filtering for web protection while is also a networking suite with IPSec and PPTP support, bandwdith and system monitoring and a server with web-server, Database server support, file & print sharing, mail server, system and mail backup. All built on a cut down redhat linux with a good web interface.

ClarkConnect is an opensource winner with all the features are directly enabled by opensource packages.

The top features of ClarkConnect are

• Statefule Firewall with DMZ interface enabled, NAT and port forwarding support
• Intrusion Detection (Snort) and Preention (snortsam)
• Peer to Peer connection prevention
• MultiWAN support with bandwidth monitoring
• VPN support with IPSec and PPTP support
• Webproxy, Content Filtering, Popup/banner adblocker
• Email Server support (POP, IMAP and SMTP) and webmail support
• Dns, DynDNS, DHCP Support
• Mail Gateway with antispam (spamassasin,Dspam,greylisting), Antivirus (ClamA), phishing filter,  Mail Disclaimer support
• Groupware and Flexshare
• Webserver (LAMP)
• File and Print Sharing, FTP server
• Network Backup

For more detailed listing of features, click here

ClarkConnect comes in three different editions as Enterprise, Office and Community editions. The Community edition is a free edition with no support for the serices and hence is good for Home and Small Office. The Office edition has all of the network and security features enabled with the exception of the Grouware support and the all enabled version is the Enterprise edition. While the Office and Enterprise editions are commercial, the cost is not very pricey.

For a comparision on the versions, click here

A detailed hardware requirement can be found on ClarkConnect website with downloads available here.

A Reader's Toolbox

For 640-802, it is important to qualify both 350-001 as well as 70-291. Still a number of individuals settle for 70-649 too.