"adapter not available" in windows XP with Odyssey Client

I have Windows XP laptop and it has Atheros AR9285 Wireless Network Adapter with Driver date 3/27/2009 version 7.7.0.267.

It was all working fine with Odyssey client Manager version 0.15.

Suddenly after reboot i observed  "adapter not available" in Odyssey. Exit, disable/enable the service, reboot of the laptop does not resolve the issue.

I had to uninstall the Wireless card and again reinstall it. After that it started working.

Error (STOP: 0X0000007B (0xF78d2524,0XC0000034,0X00000000, 0X00000000)] in installing Windows XP

Recently i tried to change the OS of DELL Inspiron from ubuntu to Widows XP. I keep getting this error

STOP: 0X0000007B (0xF78d2524,0XC0000034,0X00000000, 0X00000000)

The solution was to change in the BIOS setting, the mode of  SATA controller from AHCI mode to ATA mode.

How to change IGMP Version (IGMP v1/v2/v3) in Windows XP PC?

By default when the Windows XP host joins IGMP group it uses IGMP v3. If you want to change this behavior and want PC to generate IGMP v1 or v2 messages change the registry settings as follows:


1) Start -> Run -> regedit

2) Go to HKEY_LOCAL_MACHINE ->SYSTEM->CurrentControlSet->Services->Tcpip->Paramters

3) Right Click -> New-> DWORD Value-> Rename the field as  "IGMPVersion"

Set the Value according to the table below and reboot the PC.  

Value "2" ->  IGMP Version 1

        "3" -> IGMP Version 2

        "4" -> IGMP Version 3 ( Default)


              

Why windows XP sends messages with 239.255.255.250 destination IP address?

We can see few packets destined to 239.255.255.250 IP address in Wireshark. They are:

1) SSDP Messages

2)  IGMP messages destined to 239.255.255.250

SSDP protocol is used to discover Upnp (Plug and play) devices in network. When we enable or disable the network interface, you can observe these messages.

What is Wireshark filter for SSDP protocols?

For SSDP protocols there is no separate Wireshark filter. We have to use either of the following two:


1) (udp.dstport==1900)

2) http

How to disable SSDP ( Simple Service Discovery Protocol) in Windows Microsoft XP ?

If you are running some captures and seeing lot of messages for SSDP  you have two options to filter out the messages in wireshark

Either disable it completely or use wireshark Filter " 

• !(udp.dstport==1900) "
• !((udp contains "HTTP/1.1") and ((udp contains 0a:53:54:3a) or (udp contains 0a:59:54:3a)))

How to disable the SSDP in Win XP

The two services you need to disable are:

• Universal Plug and Play Device Host
• SSDP Discovery Service

Disable the UPnP Device Host first by double-clicking on the service and selecting "Disabled" in the drop-down menu. Next, go on to the SSDP Discovery Service, double-click and select to stop the service, then disable it in the same manner. 

What is Duration attack in wireless (WLAN) ?

The Duration attack in short:

"The duration value in the WLAN frame indicates the time duration in milliseconds for which the channel is reserved. The Network Allocation Vector (NAV) stores this duration information. The rule is that any node can transmit only if the NAV reaches zero.

Attackers make use of the above vulnerability. They inject packets into the WLAN with huge duration values. This would force the other nodes in the WLAN to keep quite as they cannot send any packet until this value reaches zero. If the attacker sends such frames continuously it will prevent other nodes in the WLAN from operation for a long time and there by disrupting the entire wireless service."

Ref :http://manageengine.com.mx/wireless-network-management/duration-attack.html

The Omnipeek sniffer or some wireless sniffers can identify this attack and the packets can be seen in the logs. This effectively make the wireless network down, as many devices will be waiting and the attacker will be utilizing the bandwindth." 

Some of the other examples where this type of issue is identified :


1 ) Meru Wireless AP 

Below excerpts taken from

https://supportforums.cisco.com/thread/339022

=================================================

Meru's secret [manipulation of the RF] may leave a bitter aftertaste, especially if a neighboring business is running a Meru system on the same channel as your non-Meru system. Cisco was unambiguous in claiming that Meru is violating 802.11 standards by artificially manipulating the NAV (network allocation vector) value in certain duration fields (see "Duration, Duration, Duration" below). Meru denies these allegations, claiming its products are "100 percent standards-compliant." Based on our understanding of 802.11's virtual carrier sense architecture and the role that duration field values play in managing contention, we find Cisco's charges credible, but we'll reserve final judgment until other industry experts weigh in on this controversial issue."

 In other words, by manipulating the carrier sense in an unorthodox manner, the Cisco APs never get a chance to talk on the RF.

 For some reason, Cisco products appear to be more susceptable to this Meru-induced issue.

 Your Cisco WLC should be able to see the adjacent WiFi devices - if any exist. 

Or, if you have a wireless sniffer (AirMagnet, etc.), you might be able to see adjacent "rogue" access points.  Even a laptop with WiFi might be able to see a list of foreign SSIDs that are not yours.

 If you can get the wireless MAC address of these foreign APs (assuming that they are there), you can lookup OUI (the first three bytes of the MAC address) at the following site to determine the manufacturer of the access point:

 http://standards.ieee.org/regauth/oui/index.shtml

 If Meru pops up, it might be the source of your problem.  If so, you may be able to work around this problem by using a channel other than that of the neighboring Meru WLAN (since Meru uses the *same* channel for *EVERY* access point in its WLAN - yes, bizarre, but true).

 =======================================================

2)  Apple IPhone

http://revolutionwifi.blogspot.in/2012/05/are-apple-iphones-misbehaving-on-wi-fi.html

========================================================


 The finding in question was that the Apple iPhone, iPad, and other mobile devices based on the latest Broadcom chipsets are setting really long Duration values in the range of 10-14ms within Wi-Fi control frames (e.g. RTS/CTS-to-self). This essentially reserves the medium for the device to transmit without a collision. The problem is that this is an excessively long period of time for an 802.11n capable device, and through my packet analysis I have found that no large frame transmission is subsequently occurring. This indicates that a performance problem may exist with the devices, and may be reported as an NAV DoS attack on the network by WIPS systems.

=======================================================


3)  Intel client

http://revolutionwifi.blogspot.in/2012/05/are-apple-iphones-misbehaving-on-wi-fi.html

========================================================
Intel clients use the technique of sending a long duration (usually 4ms) in an RTS frame, sending their data and then releasing with a CFE frame. They only do this under certain circumstances however. You can see it by associating an 11n Intel client (I used a 6205) to an 11n AP (using the 2.4GHz radio) and then associating a legacy (non-11n) client. From a wired pc, then ping the 11n client. You'll see the RTS frames that the 11n client sends (for wireless protection) have a large duration and after it transmits the ping response, it sends a CFE.

So someone at Intel believes this is a better method of sending data in a crowded environment. They don't do this behavior in 5GHz as far as I've seen. Broadcom may be trying to replicate something like this.

==========================================================

So if in your WLAN network if you are seeing such packets, try to identify the device, client or AP, see if its one of above. If not, post in comments.

How to take backups of Linux machine?

I have not tried it yet, but  Clonezilla is one free tool which can create 1 PC backup or can take simultaneously back up of many PCs.

http://clonezilla.org/

Unicast DHCPREQUEST is not sent by DHCPCLIENT after T1 time expires ?

Recently i came across one issue in which unicast DHCPREQUEST was not being sent by the DHCP CLIENT after the T1 expires.

I will explain some basic things about DHCP before going to the issue.

1)  It is explained in RFC 2131.
2) The packets between server and clients are DHCPDISCOVER, DHCPOFFER,DHCPREQUEST and DHCPACK
3) After T1 time ( 50 % of lease time)  the client should send unicast DHCPREQUEST to server. If server available, renew lease, if not continue using the lease.
4) If server is not present after T1 time wait for T2 time ( 87.5 % of lease time) and send broadcast DHCPREQUEST.
5) if Server is not available  after T2, continue using the IP address till lease time expires. Stop using the IP and start sending broadcast DHCPDISCOVER.


Now the issue :

We had a server in which lease time is set as 15 min.The client gets the ip address and other parameter from server. The t1 time is 7 min, after T1 time the client should send unicast DHCPREQUEST, but it sends broadcast DHCPREQUEST. It appears as an issue because when client moves to renewing state it should send unicast DHCPREQUEST.

As per RFC 2131

   At time T1 the client moves to RENEWING state and sends (via unicast) a DHCPREQUEST message to the server to extend its lease.

These are some of the Observations :

1) Server Windows 2008 DHCP server ( lease time 15 min)

2) Linux PC as client

Setup :

Linux PC---switch--WINDOWS DHCP Server.

Once the client gets IP remove the server.

Linux showed  DHCPREQUEST as broadcast packets.


Analysis:

In Linux the default arp timeout value is 60 sec and is configured using this parameter

 

/proc/sys/net/ipv4/neigh/eth1/gc_stale_time

 

After the arp entry for DHCP server will get deleted, the device will send ARP REQUEST for the DHCP server. After T1 time, if it does not get any arp reply, it is sending the BROADCAST DHCPREQUEST message.

 

If the server is always connected, the ARP will get resolved and it will send the unicast DHCPREQUEST.

 

So it seems not an issue. If ARP entry is present in the device, the client will send the unicast DHCPREQUEST, if it gets expired before T1 it will send broadcast DHCPREQUEST.

 

Let me know your comments, observation on this.

 

Keep learning, Keep sharing !!!

What will happen in this basic networking subnet case ?

We have two PC with switch in between

PC1----------------------------------------------------------Switch-------PC2 ( 192.168.7.1 netmask 255.255.0.0)
(192.168.7.10 netmask 255.255.255.0)

Will they ping each other ?

What I am changing here ?

I am changing the subnet mask of the PC , so that they are in different broadcast domains.

Let me know what you think ?

ARP Timeout Value for Linux, Windows, Cisco 2960 and DELL Switch

ARP timeout


As per RFC 826

"https://tools.ietf.org/html/rfc826"

"It may be desirable to have table aging and/or timeouts.  The
implementation of these is outside the scope of this protocol."

So the ARP timeouts are vendor dependent and can very drastically from one vendor to another. Here is some information about ARP timeouts.

1) ARP timeout for Cisco 2960 switch

# show interfaces vlan 1
Vlan1 is up, line protocol is down
  Hardware is EtherSVI, address is 5897.1ec9.1040 (bia 5897.1ec9.1040)
  Internet address is 192.168.100.1/24
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not supported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:10:09, output 00:10:07, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     60274 packets input, 5100402 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     66629 packets output, 52011719 bytes, 0 underruns
     0 output errors, 3 interface resets
     0 output buffer failures, 0 output buffers swapped out

The default ARP timeout for cisco switch is 4 hrs.

It can be changed using following command :


#configure
Configuring from terminal, memory, or network [terminal]? t
Enter configuration commands, one per line.  End with CNTL/Z.
cisco(config)#interface vlan 1
cisco(config-if)#arp timeout ?
  <0-2147483>  Seconds
cisco(config-if)#arp timeout 600


2) ARP time out for DLINK switch


Default value for ARP timeout is 20 sec in DLINK switch


# show arpentry
Command: show arpentry


ARP Aging Time : 20

Interface      IP Address       MAC Address        Type
-------------  ---------------  -----------------  ---------------
System         192.168.100.0      FF-FF-FF-FF-FF-FF  Local/Broadcast
System         192.168.100.167    00-1B-11-11-BD-41  Local
System         192.168.100.255    FF-FF-FF-FF-FF-FF  Local/Broadcast

Total Entries  : 3


Command to change the ARP entry time out value in DLINK switch

DES-3026:4#config arp_aging
Command: config arp_aging

Next possible completions:
        time

DES-3026:4#config arp_aging time
Command: config arp_aging time

Next possible completions:
        <value 0-65535>

DES-3026:4# config arp_aging time 600



3) Linux Fedora core 16

Default ARP timeout value in LInux is 60 sec

can be changed at  /proc/sys/net/ipv4/neigh/eth1/gc_stale_time

gc_stale_time (since Linux 2.2)

Determines how often to check for stale neighbor entries. When a neighbor entry is considered stale, it is resolved again before sending data to it. Defaults to 60 seconds.

gc_thresh1 (since Linux 2.2)

The minimum number of entries to keep in the ARP cache. The garbage collector will not run if there are fewer than this number of entries in the cache. Defaults to 128.

gc_thresh2 (since Linux 2.2)

The soft maximum number of entries to keep in the ARP cache. The garbage collector will allow the number of entries to exceed this for 5 seconds before collection will be performed. Defaults to 512.

gc_thresh3 (since Linux 2.2)

The hard maximum number of entries to keep in the ARP cache. The garbage collector will always run if there are more than this number of entries in the cache. Defaults to 1024.

4)  Windows

It was difficult to find about XP. For windows 2000 i got following lines from the link given at reference.

Windows 2000 adjusts the size of the ARP cache automatically to meet the needs of
the system. If an entry is not used by any outgoing datagram for two minutes, the entry is
removed from the ARP cache.Entries that are being referenced are given additional time, in two minute increments,
up to a maximum lifetime of 10 minutes.After 10 minutes, the ARP cache entry is removed and must be rediscovered using
an ARP Request frame. To adjust the time an unreferenced entry can remain in the ARP cache, change the
value of the ArpCacheLife and ArpCacheMinReferencedLife registry entries.
(HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters).


So the default value looks like is 2 min.


5) For brocade switch the default value is 10 min.

command to enable aging time

ip arp-aging-timeout value

no ip arp-aging-timeout

The ARP ageing time is different from the MAC bridge learning time or the MAC table time . If there is mismatch between the MAC bridge learning table and ARP ageing time , it can result in unicast flood. So normally , its better if the ARP aging time is less than the bridge learning table time ( in Linux this value is 300 sec or 5 min can be seen using brctl command)

References:


http://linux.die.net/man/7/arp
https://tools.ietf.org/html/rfc826
http://thetechfirm.com/packets/ARP.pdf
http://www.brocade.com/downloads/documents/html_product_manuals/NOS_CLI_301/wwhelp/wwhimpl/common/html/wwhelp.htm#href=commands_a_z.4.172.html&single=true


ARP table and MAC table discussions

https://learningnetwork.cisco.com/thread/44041

https://learningnetwork.cisco.com/thread/2450

How to configure LACP in DLINK switches

To configure LACP in DLink switches , these commands can be used


DLINK 1

config link_aggregation group_id 1 master_port 20 ports 20-21 state enable

config link_aggregation algorithm mac_destination

config lacp_port 20-21 mode active

 

 

 

 

DLINK 2

 

config link_aggregation group_id 1 master_port 20 ports 20-21 state enable

config link_aggregation algorithm mac_destination

config lacp_port 20-21 mode passive

 

How to configure VLAN in DLINK switches

These are the commands to configure VLAN in DLINK switches

config vlan default delete 1-26

config vlan default add untagged 1-14

 

 

create vlan vlan_100 tag 100

config vlan vlan_100 add untagged 18

config vlan vlan_100 add tagged 19-20

 

create vlan vlan_200 tag 200

config vlan vlan_200 add untagged 10

config vlan vlan_200 add tagged 11-12

IXIA Chariot version 4.3 console always terminates When Microsoft Windows remote login terminates or minimized

We use IXIA Chariot tool for performance tests. It is a licensed software product from IXIA which supports, different types of tests.

For more information on this you can refer :

http://www.ixiacom.com/support/ixchariot

Just to explain how it is used , it has one console and other act as endpoints. The traffic runs between the endpoints.

Now the issue ( We have IXIA Chariot console version 4.3)

1) Lets say console is installed in Windows XP PC, and we are remotely login in this using Microsofts "remote desktop" , in windows

Start-> Run ->mstsc -> it will open one window -> Give the IP address of the PC to connect to and login to the PC.


2) Now run the chariot remotely->  it will run fine.

3) Minimise the remote window -> open again -> No trace of Chariot console ??? ( it will get closed :-( )

4) Again start the tests

5) Terminate the remote session and go to that PC and login locally to check results.

6) No results -> issue ->  the moment , the remote desktop session is closed the chariot console stopped.

Why

Reason -> Unknown

Is it a bug in Chariot ? Well, not sure, how it behaves in newer version. If you have ,do some analysis and let me know...

My analysis

Ran Wireshark and did following tests :

1) Local PC ran Chariot and stopped using its right hand corner "x" button

2) Local PC ran Chariot , stopped chariot.exe process using taskmanager

3) Remotely ran Chariot and closed the session

Well, the Wireshark capture for point 2 and 3 are almost same. So this implies that when we are closing the remote session, the chariot process is also getting killed.

What you can do 

If you are in IXIA QA team, raise a bug. If you have Chariot, test the same thing and let me know your observation.


Keep breaking, Keep Learning !!!!

How to create virtual IP interfaces in Linux

We have this requirement , always , to simulate large number of clients using less no of resources ( Read PC or test pcs).

So we use virtual interfaces  on Linux PC to simulate this.

These are the commands to enable virtual interface and assign IP address to them

1) #cd /etc/sysconfig/network-scripts

2) create a new range file
 
# vim ifcfg-eth0-range0

CLONENUM_START=0
IPADDR_START=11.1.1.1
IPADDR_END=11.1.1.254

3) create another range file with another group of address
 
CLONENUM_START=254
IPADDR_START=11.1.2.1
IPADDR_END=11.1.2.254

4) # ifdown eth0

5) # ifup eth2

6) # ifconfig

It should show all the interface created with numbers like this.

eth0, eth0:0, eth0:1

To Remove all the virtual interface issue below command

#ifdown eth2


Internally Linux uses ifup-aliases script in /etc/sysconfig/network-scripts for crating aliases.



Happy Learning, Happy Working !!!

How to configure Cisco Switch for Radius authentication ?

Setup :

                ______________________   
                 | Port1   Port2  Port3.......|
                 ------------------------------------
                    |             |
Client PC ---              ------------ FreeRadius Server


Client PC is windows XP

Free radius is on Linux Fedora core 14

 Console Commands to configure 802.1X in Cisco Switch Catalyst  2950 series:
-------------------------------------------------------------------

configure terminal
aaa new-model
aaa authentication dot1x default group radius
interface fastethernet0/1
dot1x port-control auto
end
config t
interface vlan 1
ip address 197.168.10.1 255.255.255.0
no shutdown

--------------------------------------------------------------------
Switch(config)# radius-server host 197.168.10.230 auth-port 1812 key shared-secret


The client should get authenticated with free radius server, with user name and password configured in free radius server (users file) and given on PC.

Happy New Year 2013!

Happy new year to all ! Hope this year brings more joys and achievements for everyone .

Keep Learning, Keep Sharing and Keep Exploring!!!

IPv6 Supported SNMP MIB Browsers

We have below SNMP MIB browser , which supoorts both IPv6 and IPv4.

Some of these are licensed product , but free evaluation copy is available for limited time.


1) NuDesign :http://www.ndt-inc.com/SNMP/Download.html

2) WebNMS: http://www.webnms.com/snmputilities/mib-browser.html

3) ByteSphere : http://www.oidview.com/news_mib_browser_to_support_ipv6_with_snmp_traps.html

4) MG-Soft : http://www.mg-soft.si/mgMibBrowserPE-evaluate.html

5) Ireasoning :http://ireasoning.com/mibbrowser.shtml

Which Internet browsers supports link local IPv6 address ?

This draft states of making zone identifier common for all browsers. It is set to expire in May , 2013

http://tools.ietf.org/html/draft-ietf-6man-uri-zoneid-05


A section from this states:

==================================================
Web Browsers


   Due to the lack of a standard in this area, web browsers have been inconsistent in providing for ZoneIDs.  Many have no support, but there are examples of ad hoc support.  For example, older versions of Firefox allowed the use of a ZoneID preceded by an unescaped "%" character, but this was removed for consistency with RFC 3986.  As another example, recent versions of Internet Explorer allow use of a ZoneID preceded by a "%" character escaped as "%25", still beyond the
   syntax allowed by RFC 3986.  This syntax extension is in fact used internally in the Windows operating system and some of its APIs.

   This document implies that all browsers should recognise a ZoneID preceded by an escaped "%".  In the spirit of "be liberal with what
   you accept", we also recommend that URI parsers accept bare "%" signs (i.e., a "%" not followed by two valid hexadecimal characters).  This
   makes it easy for a user to copy and paste a string such as  "fe80::a%en1" from the output of a "ping" command and have it work.


======================================================


1) IE version 7 and above support link local with '%25' added

  http://msdn.microsoft.com/en-us/library/windows/desktop/ms740593%28v=vs.85%29.aspx

2) Firefox older version 3.x supported, later it got removed , firefox bug which states this:

   https://bugzilla.mozilla.org/show_bug.cgi/attachment.cgi?id=392428&action=edit

3) Chrome bug:

     http://code.google.com/p/chromium/issues/detail?id=70762


Could not find information on Opera and Safari.

How to enable DHCPv6 route option in ISC-DHCP server

As per information given in link

http://www.isc.org/community/blog/201111/routing-configuration-over-dhcpv6

I tried to enable route prefix option in ISC-DHCP server , the configuration of server is :

vim /etc/dhcp/dhcpv6.conf
===================================================

## NEXT_HOP option with RTPREFIX option included
option dhcp6.next-hop-rt-prefix code 242 = { ip6-address, unsigNed integer 16,un
signed integer 16, unsigned integer 32, unsigned integer 8, unsigned integer 8,
ip6-address };
#
#   # This statement configures actual values to be sent
#   # RTPREFIX option code = 243, RTPREFIX length = 22
#   # lifetime = 9000 seconds
#   # route 2001:db8:2::/64
#   # metric 1
  option dhcp6.next-hop-rt-prefix 2001:db8:270::100:100 243 64 9000 0 1 ::;

=================================================

the configuration of dhcp client :


vim /etc/dhcp/dhcpv6.conf

=========================================

script "/sbin/dhclient-script";

option dhcp6.next-hop-rtprefix code 242 = { ip6-address,unsigned integer 16, uns
igned integer 16,unsigned integer 32,unsigned integer 8, unsigned integer 8, ip6
-address };

# RTPREFIX option

interface "eth1" {
                 request dhcp6.next-hop-rtprefix,dhcp6.vendor-opts,dhcp6.name-servers;
                       }

=================================

I can see the prefix 242 in DHCP packets.