Some Interview Question: CCNA & Basic Networking

Basics Q & A {Switching}

1) What is unicast and how does it work?

** Unicast is a one-to-one transmission method. A single frame is sent from the source to a destination on a network. When this frame is received by the switch, the frame is sent on to the network, and the network passes the frame to its destination from the source to a specific destination on a network.

2) What is multicast and how does it work?

** Multicast is a one-to-many transmission method. A single frame is sent from the source to multiple destinations on a network using a multicast address. When this frame is received by the switch, the frame is sent on to the network and the network passes the frame to its intended destination group.

3: What is broadcast and how does it work?

** Broadcast is a one-to-all transmission method. A single frame is sent from the source to a destination on a network using a multicast address. When this frame is received by the switch, the frame is sent on to the network. The network passes the frame to all nodes in the destination network from the source to an unknown destination on a network using a broadcast address. When the switch receives this frame, the frame is sent on to all the networks, and the networks pass the frame on to all the nodes. If it reaches a router, the broadcast frame is dropped.

4: What is fragmentation?

** Fragmentation in a network is the breaking down of a data packet into smaller pieces to accommodate the maximum transmission unit (MTU) of the network.

5:What is MTU? What's the MTU for traditional Ethernet?

** MTU is the acronym for maximum transmission unit and is the largest frame size that can be transmitted over a network. Messages longer than the MTU must be divided into smaller frames. The network layer (Layer 3) protocol determines the MTU from the data link layer (Layer 2) protocol and fragments the messages into the appropriate frame size, making the frames available to the lower layer for transmission without further fragmentation. The MTU for Ethernet is 1518 bytes.

6: What is a MAC address?

** A MAC address is the physical address of a network device and is 48 bits (6 bytes) long. MAC addresses are also known as physical addresses or hardware addresses.

7) What is the difference between a runt and a giant, specific to traditional Ethernet?

** In Ethernet a runt is a frame that is less than 64 bytes in length, and a giant is a frame that is greater than 1518 bytes in length. Giants are frames that are greater than the MTU used, which might not always be 1518 bytes.

8: What is the difference between store-and-forward and cut-through switching?

** Cut-through switching examines just the frame header, determining the output switch port through which the frame will be forwarded. Store-and-forward examines the entire frame, header and data payload, for errors. If the frame is error free, it is forwarded out its destination switch port interface. If the frame has errors, the switch drops the frame from its buffers. This is also known as discarding the frame to the bit bucket.

9: What is the difference between Layer 2 switching and Layer 3 switching?

* * Layer 2 switches make their forwarding decisions based on the Layer 2 (data link) address, such as the MAC address. Layer 3 switches make their forwarding decisions based on the Layer 3 (network) address.

10: What is the difference between Layer 3 switching and routing?

** The difference between Layer 3 switching and routing is that Layer 3 switches have hardware to pass data traffic as fast as Layer 2 switches. However, Layer 3 switches make decisions regarding how to transmit traffic at Layer 3 in the same way as a router. A Layer 3 switch cannot use WAN circuits or use routing protocols; a router is still required for these functions.

Materials About CCNA

OSI

(ISO) International organization for standardization

Iso has designed a reference model called osi reference model(open system interconnection).
It has 7 layers. It says ठाट Any n/w for comunication needs 7 layers


7.Application layer:

The user uses application layer to send the data। The protocols@ this layer are ftp,http,smtp(e-mail) telenet etc.

6.Presentation layer:

Presentation layer takes the data from application layer and presentIn different formats for securing reason. The services offered @This layer areCompression – decompressionCoding – decodingEncryption - decryption

5. Session layer:

Establishing the session or the conectivity n/w n/w 1 & n/w 2 is doneBy the session layer.It 1. Establishes a session2. maintains it &3. Terminates it b/w the application

4. Transport layer:

End-end connectivity during a session b/w two application is doneBy the transport layer. It also decides the type of connection like tcpor udp i.e. connection oriented or connection less.Services:SequencingFlow ctrl, error detection & correctionTransport layer info + data is called segment

3. Netwrok layer :

Logical addressing is done at thenetwork layer i.e. source address &destination address are attached to the data.Protocols @network layerRouted protocols routing protocolsEg: ip,ipx eg: rip,igrp,ospfRouted protocols: they always carry the data along with themRouting protocol: they identify the path for routed protocol tocarry the dataAt this layer routers & layer 3 switches forms packets.

2.Data link layer:

It has two Sub layersa)MAC{Media access control } b) LLC {logical link control framing of data}Ip address is lik the pincode & MAC address is like house number.Here layer2 switches are used.Wab protocols used at this layer are PPP,HDLC,FP,X.25 etc.Here error checking CRC bits are added to the packetsDLL info+ packets --> frames

1. physical layer:

Takes care of physical connectivity i.e connector,cable etc. hereFrames are converted to bits (1’s & 0’s).The devices like hubs, repeaters,cables & connectors are used atthis layer

Important Networking Q & A

1: What information must be stored in the route table?

** At a minimum, each entry of the routing table must include a destination address and the address of a next-hop router or an indication that the destination address is directly connected.

2: What does it mean when a route table says that an address is variably subnetted?

**Variably subnetted means that the router knows of more than one subnet mask for subnets of the same major IP address.

3: What are discontiguous subnets?

** Discontiguous subnets are two or more subnets of a major IP network address that are separated by a different major IP address.

4: What command is used to examine the route table in a Cisco router?

** show ip route is used to examine the routing table of a Cisco router.

5: What are the two bracketed numbers associated with the non-directly connected routes in the route table?

**The first bracketed number is the administrative distance of the routing protocol by which the route was learned. The second number is the metric of the route.

6: When static routes are configured to reference an exit interface instead of a next-hop address, in what way will the route table be different?

**When a static route is configured to reference an exit interface instead of a next-hop address, the destination address will be entered into the routing table as directly connected.

7: What is a summary route? In the context of static routing, how are summary routes useful?

**A summary route is a single route entry that points to multiple subnets or major IP addresses. In the context of static routes, summary routes can reduce the number of static routes that must be configured.

8: What is an administrative distance?

**An administrative distance is a rating of preference for a routing protocol or a static route. Every routing protocol and every static route has an administrative distance associated with it. When a router learns of a destination via more than one routing protocol or static route, it will use the route with the lowest administrative distance.

9: What is a floating static route?

** A floating static route is an alternative route to a destination. The administrative distance is set high enough that the floating static route is used only if a more-preferred route becomes unavailable.

10: What is the difference between equal-cost and unequal-cost load sharing?

**Equal-cost load sharing distributes traffic equally among multiple paths with equal metrics. Unequal-cost load sharing distributes packets among multiple paths with different metrics. The traffic will be distributed inversely proportional to the cost of the routes

OSPF Q & A

1: What is an OSPF neighbor?

*** From the perspective of an OSPF router, a neighbor is another OSPF router that is attached to one of the first router's directly connected links.


2: What is an OSPF adjacency?

***An OSPF adjacency is a conceptual link to a neighbor over which LSAs can be sent.

3: What is an LSA? How does an LSA differ from an OSPF Update packet?


***A router originates a link state advertisement to describe one or more destinations. An OSPF Update packet transports LSAs from one neighbor to another. Although LSAs are flooded throughout an area or OSPF domain, Update packets never leave a data link.

4: What is a link state database? What is link state database synchronization?

***The link state database is where a router stores all the OSPF LSAs it knows of, including its own. Database synchronization is the process of ensuring that all routers within an area have identical link state databases.

5: What is the default HelloInterval?

***The default OSPF HelloInterval is 10 seconds.

6: What is the default RouterDeadInterval?

***The default RouterDeadInterval is four times the HelloInterval.

7: What is a Router ID? How is a Router ID determined?

***A Router ID is an address by which an OSPF router identifies itself. It is either the numerically highest IP address of all the router's loopback interfaces, or if no loopback interfaces are configured, it is the numerically highest IP address of all the router's LAN interfaces.


8: What is an area?

***An area is an OSPF sub-domain, within which all routers have an identical link state database.

9: What is the significance of area 0?

***Area 0 is the backbone area. All other areas must send their inter-area traffic through the backbone.

10: What is MaxAge?

***MaxAge, 1 hour, is the age at which an LSA is considered to be obsolete.


EIGRP Q & A

1: Is EIGRP a distance vector or a link state routing protocol?

*** EIGRP is a Hybrid routing protocol,it have features of both distance vector and link state routing protocol.

2: What is the maximum configured bandwidth EIGRP will use on a link? Can this percentage be changed?

*** By default, EIGRP uses no more than 50% of the link's bandwidth, based on the bandwidth configured on the router's interface. This percentage to be changed with the command ip bandwidth-percent eigrp.

3: How do EIGRP and IGRP differ in the way they calculate the composite metric?

*** EIGRP and IGRP use the same formula to calculate their composite metrics, but EIGRP scales the metric by a factor of 256.

4: In the context of EIGRP, what does the term reliable delivery mean? Which two methods ensure reliable delivery of EIGRP packets?

*** Reliable delivery means EIGRP packets are guaranteed to be delivered, and they are delivered in order. RTP uses a reliable multicast, in which received packets are acknowledged, to guarantee delivery; sequence numbers are used to ensure that they are delivered in order.

5: Which mechanism ensures that a router is accepting the most recent route entry?

*** Sequence numbers ensure that a router is receiving the most recent route entry.

6: What is the multicast IP address used by EIGRP?

*** EIGRP uses the multicast address 224.0.0.10.

7: At what interval, by default, are EIGRP Hello packets sent?

*** The default EIGRP Hello interval is 5 seconds, except on some slow-speed (T1 and below) interfaces, where the default is 60 seconds.

8: What is the default hold time?

*** The EIGRP default hold time is three times the Hello interval.

9: What is the difference between the neighbor table and the topology table?

*** The neighbor table stores information about EIGRP-speaking neighbors; the topology table lists all known routes that have feasible successors.


10: What is the feasibility condition?

*** The feasibility condition is the rule by which feasible successors are chosen for a destination. The feasibility condition is satisfied if a neighbor's advertised distance to a destination is lower than the receiving router's feasible distance to the destination. In other words, a router's neighbor meets the feasibility condition if the neighbor is metrically closer to the destination than the router. Another way to describe this is that the neighbor is "downstream" relative to the destination

OSPF Q & A Part -II

1: What are the five OSPF packet types? What is the purpose of each type?

*** The five OSPF packet types, and their purposes, are:

Hellos, which are used to discover neighbors, and to establish and maintain adjacencies

Updates, which are used to send LSAs between neighbors

Database Description packets, which a router uses to describe its link state database to a neighbor during database synchronization

Link State Requests, which a router uses to request one or more LSAs from a neighbor's link state database

Link State Acknowledgments, used to ensure reliable delivery of LSAs


2: What are LSA types 1 to 5 and LSA type 7? What is the purpose of each type?

*** The most common LSA types and their purposes are:

Type 1 (Router LSAs) are originated by every router and describe the originating router, the router's directly connected links and their states, and the router\xd5 s neighbors.

Type 2 (Network LSAs) are originated by Designated Routers on multiaccess links and describe the link and all attached neighbors.

Type 3 (Network Summary LSAs) are originated by Area Border Routers and describe inter-area destinations.

Type 4 LSAs (ASBR Summary LSAs) are originated by Area Border Routers to describe Autonomous System Boundary Routers outside the area.

Type 5 (AS External LSAs) are originated by Autonomous System Boundary Routers to describe destinations external to the OSPF domain.

Type 7 (NSSA External LSAs) are originated by Autonomous System Boundary Routers within not-so-stubby areas.

3: What are the four OSPF router types?

***The four OSPF router types are:

# Internal Routers, whose OSPF interfaces all belong to the same area

# Backbone Routers, which are Internal Routers in Area 0

# Area Border Routers, which have OSPF interfaces in more than one area

# Autonomous System Boundary Routers, which advertise external routes into the OSPF domain


4: What are the four OSPF path types?

***The four OSPF path types are:

Intra-area paths

Inter-area paths

Type 1 external paths

Type 2 external paths


5: What are the five OSPF network types?

*** The five OSPF network types are:

i)Point-to-point networks

ii) Broadcast networks

iii) Non-broadcast multi-access (NBMA) networks

iv) Point-to-multipoint networks

v) Virtual links


6: What is a Designated Router?

***A Designated Router is a router that represents a multiaccess network, and the routers connected to the network, to the rest of the OSFP domain.


7: How does a Cisco router calculate the outgoing cost of an interface?

***Cisco IOS calculates the outgoing cost of an interface as 108/BW, where BW is the configured bandwidth of the interface.


8: What is a partitioned area?

***An area is partitioned if one or more of its routers cannot send a packet to the area's other routers without sending the packet out of the area.


9: What is a virtual link?

*** A virtual link is a tunnel that extends an OSPF backbone connection through a non-backbone area.


10: What is the difference between a stub area, a totally stubby area, and a not-so-stubby area?

***A stub area is an area into which no type 5 LSAs are flooded. A totally stubby area is an area into which no type 3, 4, or 5 LSAs are flooded, with the exception of type 3 LSAs to advertise a default route. Not-so-stubby areas are areas through which external destinations are advertised into the OSPF domain, but into which no type 5 LSAs are sent by the ABR.


11: What is the difference between OSPF network entries and OSPF router entries?

*** OSPF network entries are entries in the route table, describing IP destinations. OSPF router entries are entries in a separate route table that record only routes to ABRs and ASBRs.


12: Why is type 2 authentication preferable over type 1 authentication?

***Type 2 authentication uses MD5 encryption, whereas type 1 authentication uses clear-text passwords.


13: Which three fields in the LSA header distinguish different LSAs? Which three fields in the LSA header distinguish different instances of the same LSA?

***The three fields in the LSA header that distinguish different LSAs are the Type, Advertising Router, and the Link State ID fields. The three fields in the LSA header that distinguish different instances of the same LSA are the Sequence Number, Age, and Checksum fields

Routing Information Protocol Version 2

1: Which three fields are new to the RIPv2 message format?

*** The Route Tag field, the Subnet Mask field, and the Next Hop field are RIPv2 extensions that do not exist in RIPv1 messages. The basic format of the RIP message remains unchanged between the two versions; version 2 merely uses fields that are unused in version 1.

2: Besides the extensions defined by the three fields of question 1, what are the other two major changes from RIPv1?

***In addition to the functions that use the new fields, RIPv2 supports authentication and multicast updates.

3: What is the multicast address used by RIPv2? What is the advantage of multicasting messages over broadcasting them?

***RIPv2 uses the multicast address 224.0.0.9. Multicasting of routing messages is better than broadcasting because hosts and non-RIPv2 routers will ignore the multicast messages .

4: What is the purpose of the Route Tag field in the RIPv2 message?

*** When another routing protocol uses the RIPv2 domain as a transit domain, the protocol external to RIPv2 can use the Route Tag field to communicate information to its peers on the other side of the RIPv2 domain.

5: What is the purpose of the Next Hop field?

*** The Next Hop field is used to inform other routers of a next-hop address on the same multiaccess network that is metrically closer to the destination than the originating router.

6: What is the UDP port number used by RIPv2?

***RIPv2 uses the same UDP port number as RIPv1, port number 520.

7: Which one feature must a routing protocol have to be a classless routing protocol?

***A classless routing protocol does not consider the major network address in its route lookups, but just looks for the longest match.

8: Which one feature must a routing protocol have to use VLSM?

*** To support VLSM, a routing protocol must be able to include the subnet mask of each destination address in its updates.

9: Which two types of authentication are available with Cisco's RIPv2? Are they both defined in RFC 1723?

*** Cisco's implementation of RIPv2 supports clear-text authentication and MD5 authentication. Only clear-text authentication is defined in RFC 1723.

Routing Information Protocol

1:What port does RIP use?

* RIP uses UDP port 520.

2:What metric does RIP use? How is the metric used to indicate an unreachable network?

* RIP uses a hop count metric. An unreachable network is indicated by setting the hop count to 16, which RIP interprets as an infinite distance.

3:What is the update period for RIP?

* RIP sends periodic updates every 30 seconds minus a small random variable to prevent the updates of neighboring routers from becoming synchronized.

4:How many updates must be missed before a route entry will be marked as unreachable?

* A route entry is marked as unreachable if six updates are missed.

5:What is the purpose of the garbage collection timer?

* The garbage collection timer, or flush timer, is set when a route is declared unreachable. When the timer expires, the route is flushed from the route table. This process allows an unreachable route to remain in the routing table long enough for neighbors to be notified of its status

V-LAN

1. What is a VLAN? When is it used?

Answer: A VLAN is a group of devices on the same broadcast domain, such as a logical subnet or segment. VLANs can span switch ports, switches within a switch block, or closets and buildings. VLANs group users and devices into common workgroups across geographical areas. VLANs help provide segmentation, security, and problem isolation.

2. When a VLAN is configured on a Catalyst switch port, in how much of the campus network will the VLAN number be unique and significant?

Answer: The VLAN number will be significant in the local switch. If trunking is enabled, the VLAN number will be significant across the entire trunking domain. In other words, the VLAN will be transported to every switch that has a trunk link supporting that VLAN.

3. Name two types of VLANs in terms of spanning areas of the campus network.

Answer: Local VLAN
End-to-end VLAN

4. What switch commands configure Fast Ethernet port 4/11 for VLAN 2?

Answer: interface fastethernet 4/11
switchport mode access
switchport access vlan 2


5. Generally, what must be configured (both switch and end-user device) for a port-based VLAN?

Answer: The switch port

6. What is the default VLAN on all ports of a Catalyst switch?

Answer: VLAN 1

7. What is a trunk link?

Answer: A trunk link is a connection between two switches that transports traffic from multiple VLANs. Each frame is identified with its source VLAN during its trip across the trunk link.

8. What methods of Ethernet VLAN frame identification can be used on a Catalyst switch trunk?

Answer: 802.1Q
ISL

9. What is the difference between the two trunking methods? How many bytes are added to trunked frames for VLAN identification in each method?

Answer: ISL uses encapsulation and adds a 26-byte header and a 4-byte trailer. 802.1Q adds a 4-byte tag field within existing frames, without encapsulation.

10. What is the purpose of the Dynamic Trunking Protocol (DTP)?

Answer: DTP allows negotiation of a common trunking method between endpoints of a trunk link.

11. What commands are needed to configure a Catalyst switch trunk port Gigabit 3/1 to transport only VLANs 100, 200 through 205, and 300 using IEEE 802.1Q? (Assume that trunking is enabled and active on the port already. Also assume that the interface gigabit 3/1 command already has been entered.)

Answer: switchport trunk allowed vlan 100, 200-205, 300


12. Two neighboring switch trunk ports are set to the auto mode with ISL trunking encapsulation mode. What will the resulting trunk mode become?

Answer: Trunking will not be established. Both switches are in the passive auto state and are waiting to be asked to start the trunking mode. The link will remain an access link on both switches.

13. Complete the following command to configure the switch port to use DTP to actively ask the other end to become a trunk:
switchport mode _________________


Answer: switchport mode dynamic desirable


14. Which command can set the native VLAN of a trunk port to VLAN 100 after the interface has been selected?

Answer: switchport trunk native vlan 100


15. What command can configure a trunk port to stop sending and receiving DTP packets completely?

Answer: switchport nonegotiate

16. What command can be used on a Catalyst switch to verify exactly what VLANs will be transported over trunk link gigabitethernet 4/4?

Answer: show interface gigabitethernet 4/4 switchport
or
show interface gigabitethernet 4/4 switchport trunk


17. Suppose that a switch port is configured with the following commands. A PC with a nontrunking NIC card then is connected to that port. What, if any, traffic will the PC successfully send and receive?

interface fastethernet 0/12
switchport trunk encapsulation dot1q
switchport trunk native vlan 10
switchport trunk allowed vlan 1-1005
switchport mode trunk

Answer: The PC expects only a single network connection, using a single VLAN. In other words, the PC can't participate in any form of trunking. Only untagged or unencapsulated frames will be understood. Recall that an 802.1Q trunk's native VLAN is the only VLAN that has untagged frames. Therefore, the PC will be capable of exchanging frames only on VLAN 10, the native VLAN.

Networking Basics

1: What is the definition of a network?

** A network is a system of lines or channels that cross or interconnect, or a group or system of electrical components and connecting circuitry designed to function in a specific manner.

2: What are network models?

** Network models provide the guiding principles behind the development of network standards.

3: What is a network standard, and why are there network standards?

** Network standards define the rules of network communication and are like laws that must be followed for different equipment vendors to work together.

4: What is a proprietary feature?

** If a vendor implements a feature that does not adhere to any network standards, it is called a proprietary feature.

5: What are the three data transmission modes, and how do they operate?

** Simplex mode, half-duplex mode, and full-duplex mode. Simplex mode is one-way communication only. Half-duplex mode is two-way communication, but not at the same time. Full-duplex mode is simultaneous two-way communication.

6: List the major characteristics of a LAN.

** The primary characteristic of a LAN is its geographic coverage. LANs are found in a small geographic area where there is a short distance between connected computers, as in small offices or on each floor of a larger office building. LANs enable the sharing of office resources, such as file servers for file sharing among users or print servers for shared printers.

7: List the major characteristics of a MAN.

** MANs are found in a metropolitan, or citywide, geographic area, interconnecting two or more office buildings in a broader geographic region than a LAN would support, but not so broad that a WAN would be required.

8: List the major characteristics of a WAN.

** WANS are found in broad geographic areas, often spanning states and countries, and are used to connect LANs and WANs together.

9: What are the three parts of a frame? What is a function of each part?

** Header, data (or payload), trailer. The header is the beginning of the frame, significant in that the frame's source and destination are found in the frame header. The payload is the data part of the frame, the user's information. The trailer identifies the end of the frame.

10: What function in a network does cabling provide?

** Cabling provides the physical interconnection between network devices and nodes.

11: List some examples of user data.

** Examples of user data include e-mail, web-browsing traffic, word-processed documents, spreadsheets, database updates.

12: What is the best definition of network topology?

** Network topology refers to the physical or logical geometric arrangement of interconnected network devices.

13: What is the best definition of network protocol?

** A network protocol is the communication rules and formats followed by all interconnected devices on a network requiring communication with one another.

14: What is the definition of network media?

** Network media refers to the physical component of a network. Communication signals traverse network media from source to destination. Some examples of network media are copper and fiber-optic cabling.

15: What is a network origination point?

** A network connection has two ends: the origination and termination points. The origination point is the source of the data—the location from which the data is being sent.

16: What is a network termination point?

** A network connection has two ends: the origination and termination points. The termination point is the destination of the data—the location to which the data is being sent.

Layer 3 Switching

1. What might you need to implement interVLAN routing?

** One or more Layer 3 interfaces

One or more SVIs

Static routes

A dynamic routing protocol

2. Can interVLAN routing be performed over a single trunk link?

** Yes. Packets can be forwarded between the VLANs carried over the trunk.

3. To configure an SVI, what commands are needed?

** First, make sure the VLAN is defined on the switch.

interface vlan vlan-id
ip address ip-address mask
no shutdown


4. What command can verify the VLAN assignments on a Layer 2 port?

** show interface type mod/num switchport

or

show interface status


5. A switch has the following interface configurations in its running configuration:

interface fastethernet 0/1
switchport access vlan 5
!
interface vlan 5
ip address 192.168.10.1 255.255.255.0
no shutdown


What is necessary for packets to get from the FastEthernet interface to the VLAN 5 SVI?

Answer: Nothing. Both are assigned to VLAN 5, so normal Layer 2 transparent bridging will take care of all forwarding between the two.

6. What is the source of FIB information?

** The routing table, as computed by the Layer 3 engine portion of a switch.

7. How often is the FIB updated?

** As needed. It is downloaded or updated dynamically by the Layer 3 engine whenever the routing topology changes or an ARP entry changes.

8. What is meant by the term "CEF punt"?

** A packet can't be forwarded or switched by CEF directly because it needs further processing. The packet is "punted" to the Layer 3 engine, effectively bypassing CEF for a more involved resolution.

9. What happens to the FIB when distributed CEF (dCEF) is used?

** It is simply replicated to each of the independent CEF engines. The FIB itself remains intact so that each engine receives a duplicate copy.

10. What happens during a "CEF glean" process?

** The MAC address (ARP reply) for a next-hop FIB entry is not yet known. The Layer 3 engine must generate an ARP request and wait for a reply before CEF forwarding can continue to that destination.

11. What does a multilayer switch do to the IP TTL value just before a packet is forwarded?

** The TTL is decremented by one, as if a router had forwarded the packet.

12. What is fallback bridging?

** On switch platforms that cannot multilayer-switch (route) all routable protocols, those protocols can be bridged transparently between VLANs instead.

13. Is it possible for an SVI to go down? If so, for what reasons?

** Yes. The SVI can be shut down administratively with the shutdown command, as with any other interface. Also, if the VLAN associated with the SVI is not defined or active, the SVI will appear to be down

OSPF Q & A in CCNP

1: Which command in OSPF shows the network LSA information?

** The command show ip ospf [process-id area-id] database network displays the network link-state information.

2: What command would you use to create a totally stubby area?

** The command area area-id stub no-summary will create a totally stubby area. This is a subcommand to the router ospf process-id command. It is necessary only on the ABR, but all the other routers in the area must be configured as stub routers.

3: What is a virtual link, and what command would you use to create it?

** A virtual link is a link that creates a tunnel through an area to the backbone (Area 0). This allows an area that cannot connect directly to the backbone to do so virtually. The command to create the link is area area-id virtual-link router-id. Note that the area-id that is supplied is that of the transit area, and the router-id is that of the router at the other end of the link. The command needs to be configured at both ends of the tunnel.

4: Where would you issue the command to summarize IP subnets? State the command that is used.

** Summarization is done at area boundaries. The command to start summarization is the area range command, with the syntax area area-id range address mask. To summarize external routes, use the summary-address command on the ASBRs.

5: How would you summarize external routes before injecting them into the OSPF domain?

** The command summary-address address mask is the command that you would use.

6: When is a virtual link used?

** A virtual link is used when an area is not directly attached to the backbone area (Area 0). This may be due to poor design and a lack of understanding about the operation of OSPF, or it may be due to a link failure. The most common cause of an area separating from the backbone is link failure, which can also cause the backbone to be segmented. The virtual link is used in these instances to join the two backbone areas together. Segmented backbone areas might also be the result of two companies merging.

7: Give the command for defining the cost of a default route propagated into an area.

** The command to define the cost of a default route propagated into another area is area area-id default-cost cost.

8: Give an example of when it would be appropriate to define a default cost.

** It is appropriate to define a default cost for the default route when a stub area has more than one ABR. This command allows the ABR or exit point for the area to be determined by the network administrator. If this link or the ABR fails, the other ABR will become the exit point for the area.

9: On which router is the area default cost defined?

** The default cost for the default route is defined on the ABR. The ABR will then automatically generate and advertise the route cost along with the default route.

10: Give the command to configure a stub area and state on which router it is configured.

** The command syntax to configure a stub area is area area-id stub. This command is configured on the ABR connecting to the area and on all the routers within the area. Once the configuration is completed, the Hellos are generated with the E bit set to 0. All routers in the area will only form adjacencies with other routers that have the E bit set.

11: What is the purpose of the area range command, and why is it configured on the ABR?

** The area range command is configured on an ABR because it dictates the networks that will be advertised out of the area. It is used to consolidate and summarize the routes at an area boundary.

12: Give the commands to configure a router to place subnets 144.111.248.0 through to 144.111.255.0 in Area 1 and to put all other interfaces into Area 0.

** The commands are as follows:


network 144.111.248.0 0.0.7.255 area 1



network 0.0.0.0 255.255.255.255 area 0


13: Give the syntax to summarize the subnets 144.111.248.0 to 144.111.254.255 into another autonomous system.

** The syntax is as follows:


summary-address 144.111.248.0 255.255.248.0


14: Explain briefly the difference between the area range command and the summary-address command.

** The area range command is used to summarize networks between areas and is configured on the ABR. The summary-address command is used to summarize networks between autonomous systems and is configured on the ASBR.

15: Explain the following syntax and what it will achieve: area 1 stub no-summary.

** The command area 1 stub no-summary creates a totally stubby area. The number after the word area indicates the area that is being defined as a totally stubby area. This is necessary because the router might be an ABR with connections to many areas. Once this command is issued, it prevents summarized and external routes from being propagated by the ABR into the area. To reach the networks and hosts outside the area, routers must use the default route advertised by the ABR into the area.

16: Why would you configure the routing process to log adjacency changes as opposed to turning on debug for the same trigger?

** The reason to configure the router process to log adjacency changes to syslog as opposed to running debug is an issue of resources. It takes fewer router and administrator resources to report on a change of state as it happens than to have the debugger running constantly. The debug process has the highest priority and thus everything waits for it.

17: Give some of the common reasons that neighbors fail to form an adjacency.

** Many OSPF problems stem from adjacency problems that propagate throughout the network. Many problems are often traced back to neighbor discrepancies.

If a router configured for OSPF routing is not seeing an OSPF neighbor on an attached network, do the following:

- Make sure that both routers are configured with the same IP mask, MTU, Interface Hello timer, OSPF Hello interval, and OSPF dead interval.

- Make sure that both neighbors are part of the same area and area type.

- Use the debug and show commands to trace the problem.

18: When configuring a virtual link, which routers are configured?

** The configuration is between the ABRs, where one of the ABRs resides in Area 0 and the other in the area that is disconnected from the backbone. Both of the ABRs are also members of the transit area. Having created the virtual link, both ABRs are now members of Area 0, the disconnected area, and the transit area.

19: What does the command area 1 default-cost 15 achieve?

** The command area 1 default-cost 15 will assign a cost of 15 to the default route that is to be propagated into the stub area. This command is configured on the ABR attached to the stub area.

20: Explain what is placed in the parameters area-id and router-id for the command area area-id virtual-link router-id.

** The parameter area-id is the area ID of the transit area. So if the ABR in Area 0 is creating a virtual link with the ABR in Area 3 through Area 2, the area ID stated in the command is Area 2. The router ID is the router ID of the router with whom the link is to be formed and a neighbor relationship and adjacency established.

Continue reading Some Interview Question: CCNA & Basic Networking

Download: PHP Project Solutions Training

Author: Dave Mercer
Download: Free
Release Date: 2004-02-10
Orgenial Price: Single User: US$ 99.95
Orgenial Multi User(10): US$ 500.00
Duration: 6.5 hrs / 87 lessons
Compatibility: Win Vista, XP, 2000, 98SE, Mac OS X, OS 9, Linux

Work Files: Yes

http://rapidshare.com/files/44308057/VTC.PHP.Project.Solutions.part1.rar
http://rapidshare.com/files/44308424/VTC.PHP.Project.Solutions.part2.rar





Add a comment with ur Mail address to get the password
Continue reading Download: PHP Project Solutions Training

Download: Microsoft SQL Server 2005 Administration Training

Author: Mark Long / Certified Instructor
Download: Free
Release Date: 2006-03-16
Orgenial Price: Single User: US$ 99.95
Orgenial Multi User(10): US$ 500.00
Duration: 7 hrs / 92 lessons
Compatibility: Win Vista, XP, 2000, 98SE, Mac OS X, OS 9, Linux

Work Files: Yes

http://rapidshare.com/files/44311609/VTC.SQL.Server.2005.Admin.part1.rar
http://rapidshare.com/files/44314501/VTC.SQL.Server.2005.Admin.part2.rar





Add a comment with ur Mail address to get the password
Continue reading Download: Microsoft SQL Server 2005 Administration Training

Download: CBT Linux - 10 CDs

CBT Linux - 10CDs Including:

CD01 - Linux Basic
CD02 - Client Install
CD03 - Linux RedHat Desktop
CD04 - Linux RedHat Client Admin
CD05 - Linux RedHat Server Install
CD06 - Linux RedHat System Management
CD07 - Linux RedHat Network Admin
CD08 - Linux RedHat Web Services


CD01 - Linux Basic:

http://rapidshare.com/files/12535907/CD1-LinuxBasics-share-nigmae-net.part1.rar
http://rapidshare.com/files/12536828/CD1-LinuxBasics-share-nigmae-net.part2.rar
http://rapidshare.com/files/12536948/CD1-LinuxBasics-share-nigmae-net.part3.rar
http://rapidshare.com/files/12542701/CD1-LinuxBasics-share-nigmae-net.part4.rar


CD02 - Client Install:

http://rapidshare.com/files/12666299/CD2-Client_Installs-share-nigmae-net.part01.rar
http://rapidshare.com/files/12666606/CD2-Client_Installs-share-nigmae-net.part02.rar
http://rapidshare.com/files/12667485/CD2-Client_Installs-share-nigmae-net.part03.rar
http://rapidshare.com/files/12667351/CD2-Client_Installs-share-nigmae-net.part04.rar
http://rapidshare.com/files/12667083/CD2-Client_Installs-share-nigmae-net.part05.rar
http://rapidshare.com/files/12667338/CD2-Client_Installs-share-nigmae-net.part06.rar
http://rapidshare.com/files/12667859/CD2-Client_Installs-share-nigmae-net.part07.rar
http://rapidshare.com/files/12668190/CD2-Client_Installs-share-nigmae-net.part08.rar
http://rapidshare.com/files/12668605/CD2-Client_Installs-share-nigmae-net.part09.rar
http://rapidshare.com/files/12667681/CD2-Client_Installs-share-nigmae-net.part10.rar


CD03 - Linux RedHat Desktop:

http://rapidshare.com/files/12692455/cd3-share-nigmae-net.part1.rar
http://rapidshare.com/files/12692521/cd3-share-nigmae-net.part2.rar
http://rapidshare.com/files/12692334/cd3-share-nigmae-net.part3.rar
http://rapidshare.com/files/12697524/cd3-share-nigmae-net.part4.rar
http://rapidshare.com/files/12694049/cd3-share-nigmae-net.part5.rar
http://rapidshare.com/files/12694505/cd3-share-nigmae-net.part6.rar
http://rapidshare.com/files/12694904/cd3-share-nigmae-net.part7.rar
http://rapidshare.com/files/12694955/cd3-share-nigmae-net.part8.rar


CD04 - Linux RedHat Client Admin:

http://rapidshare.com/files/12829189/CD4_-_Client_Admin-share-nigmae-net.part1.rar
http://rapidshare.com/files/13139207/CD4_-_Client_Admin-share-nigmae-net.part2.rar
http://rapidshare.com/files/13139140/CD4_-_Client_Admin-share-nigmae-net.part3.rar
http://rapidshare.com/files/13139210/CD4_-_Client_Admin-share-nigmae-net.part4.rar
http://rapidshare.com/files/13140268/CD4_-_Client_Admin-share-nigmae-net.part5.rar
http://rapidshare.com/files/13140090/CD4_-_Client_Admin-share-nigmae-net.part6.rar


CD05 - Linux RedHat Server Install:

http://rapidshare.com/files/13610246/cd5-share-nigmae-net.part1.rar
http://rapidshare.com/files/13610803/cd5-share-nigmae-net.part2.rar
http://rapidshare.com/files/13613778/cd5-share-nigmae-net.part3.rar
http://rapidshare.com/files/13613947/cd5-share-nigmae-net.part4.rar
http://rapidshare.com/files/13615529/cd5-share-nigmae-net.part5.rar
http://rapidshare.com/files/13614093/cd5-share-nigmae-net.part5.rar
http://rapidshare.com/files/13615572/cd5-share-nigmae-net.part6.rar
http://rapidshare.com/files/13615307/cd5-share-nigmae-net.part7.rar


CD06 - Linux RedHat System Management:

http://rapidshare.com/files/14236622/cd6-share-nigmae-net.part1.rar
http://rapidshare.com/files/14236669/cd6-share-nigmae-net.part2.rar
http://rapidshare.com/files/14236949/cd6-share-nigmae-net.part3.rar
http://rapidshare.com/files/14236770/cd6-share-nigmae-net.part4.rar


CD07 - Linux RedHat Network Admin:

http://rapidshare.com/files/14371279/cd7-share-nigmae-net.part1.rar
http://rapidshare.com/files/14371302/cd7-share-nigmae-net.part2.rar
http://rapidshare.com/files/14371324/cd7-share-nigmae-net.part3.rar
http://rapidshare.com/files/14371323/cd7-share-nigmae-net.part4.rar
http://rapidshare.com/files/14371364/cd7-share-nigmae-net.part5.rar
http://rapidshare.com/files/14372955/cd7-share-nigmae-net.part6.rar
Continue reading Download: CBT Linux - 10 CDs

Download:Real World PHP Programming Tutorial

Author: Mike Morton
Download: Free
Release Date: 2005-09-13
Orgenial Price: Single User: US$ 99.95
Orgenial Multi User(10): US$ 500.००
Duration: 6 hrs / 86 lessons
Compatibility: Win Vista, XP, 2000, 98SE, Mac OS X, OS 9, Linux
Work Files: Yes

http://rapidshare.com/files/136734322/VTC.Real.World.PHP.Programming.Basics.part1.rar
http://rapidshare.com/files/136755396/VTC.Real.World.PHP.Programming.Basics.part2.rar
http://rapidshare.com/files/136790558/VTC.Real.World.PHP.Programming.Basics.part3.rar
http://rapidshare.com/files/136807403/VTC.Real.World.PHP.Programming.Basics.part4.rar




Add a comment with ur Mail address to get the password
Continue reading Download:Real World PHP Programming Tutorial

Cacti The ULTIMATE Management Solution

Purpose

The purpose of this document is to explain how to install Red Hat’s Fedora Core 2 product and utilize a suite of applications for network based SNMP management. This document will take you thru step-by-step how-to install Linux on a new system and configure all the necessary tools that will get you a fully functional SNMP management station. SNMP management can be used to monitor just about anything on just about any IP enabled device.

Requirements

Before you get started make sure you have the following things:

. • Fedora Core 2 CD’s 1 thru 3

. • Active Connection to the Internet

. • Computer that can be formatted and have a new OS installed from scratch

. • About 3-4 hours of time

How it works

Cacti uses a suite of applications to do visual web front end graphing of results pulled via SNMP। These SNMP values can range from input/output rates on network / server interfaces to the number of mac-addresses associated to a given access-point. Using SNMP to manage a network can provide a non­technical central point of consolidation and health monitoring of your infrastructure. As stated earlier, SNMP is something that is already or can easily be enabled on many IP capable devices. Using SNMP to constantly pull statistical information and graphing that information can be useful in tracking things like disk utilization, network activity and much more. The CACTI application requires several utilities to be configured to work together in order to present the information in a GUI web front end. These utilities include a web server, a database, PHP and RDTOOL. All of which is freely available for the Linux operating system.

Show me the Files

You are now ready to begin downloading the files necessary to install and run Cacti. This can be done via the command line (CLI) using a command called wget. Before we start downloading the files we must first create a directory that we want to download the files to. For sake of this how-to that directory will be located under the root file system (/) in a directory called cacti-install. (Remember you should be logged in as root for the duration of this how-to. After all is setup you can login as a normal user and sudo for root privileged commands if you wish).

Run these commands as root

mkdir /cacti-install cd /cacti-install

wget http://apache.mirrors.versehost.com/httpd/httpd-2.0.52.tar.gz

wget http://us4.php.net/get/php-4.3.8.tar.gz/from/this/mirror

wget http://dev.mysql.com/get/Downloads/MySQL-4.0/mysql-4.0.21.tar.gz/from/http://www.signal42.com/mirrors/mysql/

wget http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/pub/rrdtool-1.0.49.tar.gz

wget http://unc.dl.sourceforge.net/sourceforge/net-snmp/net-snmp-5.1.2.tar.gz

wget http://www.cacti.net/downloads/cacti-0.8.6b.tar.gz

File Download Scrip


Once you have downloaded the files it is HIGHLY recommended to check the directory and make sure all the files are actually downloaded. As noted earlier version numbers change and the location of the files may change so the wget script will fail if that is the case. If they fail during download you must fine a new location

Install MySQL

Run these commands as root

cd /cacti-install

tar -zxvf mysql*

cd mysql*

./configure --prefix=/usr/local/mysql

make

make install

groupadd mysql

useradd -g mysql mysql

scripts/mysql_install_db

chown -R root /usr/local/mysql

chown -R mysql /usr/local/mysql/var

chgrp -R mysql /usr/local/mysql

rm -f /etc/my.cnf

cp support-files/my-medium.cnf /etc/my.cnf

echo /usr/local/mysql/lib/mysql >> /etc/ld.so.conf

echo /usr/local/lib >> /etc/ld.so.conf

ldconfig –v

cp support-files/mysql.server /etc/init.d/mysql /usr/local/mysql/bin/mysqld_safe --user=mysql & Echo

cd /etc/rc3.d/

ln -s ../init.d/mysql S85mysql

ln -s ../init.d/mysql K85mysql

cd /etc/rc5.d/

ln -s ../init.d/mysql S85mysql

ln -s ../init.d/mysql K85mysql

cd /etc/init.d/ chmod 755 mysql

MySQL Install Script



Install Apache

Run these commands as root


cd /cacti-install


tar -zxvf httpd*


cd httpd*


./configure --prefix=/www –enable-so


make


make install


cd /www/bin


cp apachectl /etc/init.d/httpd


y


cd /etc/rc3.d/


ln -s ../init.d/httpd S85httpd


ln -s ../init.d/httpd K85httpd


cd /etc/rc5.d/


ln -s ../init.d/httpd S85httpd


ln -s ../init.d/httpd K85httpd


/www/bin/apachectl start


Apache Install Script




Install PHP

Run these commands as root

cd /cacti-install

tar -zxvf php*

cd php*

./configure --prefix=/www/php --with-apxs2=/www/bin/apxs --with-config-file-path=/www/php --enable-sockets --with-mysql=/usr/local/mysql --with-zlib­dir=/usr/include –with-gd

make

make install

cp php.ini-dist /www/php/php.ini

cp /www/conf/httpd.conf /www/conf/httpd.conf.backup

echo ####################### >> /www/conf/httpd.conf

echo # Added via Lee Carter's Script >> /www/conf/httpd.conf

echo ####################### >> /www/conf/httpd.conf

echo AddType application/x-tar .tgz >> /www/conf/httpd.conf

echo AddType application/x-httpd-php .php >> /www/conf/httpd.conf

echo AddType image/x­icon .ico >> /www/conf/httpd.conf

echo DirectoryIndex index.php index.html index.html.var >> /www/conf/httpd.conf service httpd stop

service httpd start

PHP Install Script




Configure MySQL


Run these commands as root

cd /cacti-install

group-add cacti

useradd -g cacti cactiuser

/usr/local/mysql/bin/mysql

mysql> set password for root@localhost=password('rootpw');

mysql> create database cactidb;

mysql> grant all on cactidb.* to root;

mysql> grant all on cactidb.* to root@localhost;

mysql> grant all on cactidb.* to cactiuser;

mysql> grant all on cactidb.* to cactiuser@localhost;

mysql> set password for cactiuser@localhost=password('cactipw');

mysql> exit

MySQL Configure Script




Install RRDTOOL


Run these commands as root

cd /cacti-install

tar -zxvf rrdtool*

cd rrdtool* ./configure --prefix=/usr/local/rrdtool

make

make install

RRDTOOL Install Script




Install NET- SNMP


Run these commands as root

cd /cacti-install

tar -zxvf net-snmp*

cd net-snmp*

./configure

make

make install

NET-SNMP Install Script




Install Cacti



Run these commands as root

cd /cacti-install

cp cacti* /www/htdocs/

cd /www/htdocs/

tar -zxvf cacti*

mv cacti-0.8.6b cacti/

cd /cacti /usr/local/mysql/bin/mysql --user=root --password=rootpw cactidb <>

Cacti Install Script



Now edit your /www/htdocs/cacti/include/config.php

The finished product should look like so:

$database_defaut = “cactidb”;
$database_hostname = “localhost”;
$database_username = “cactiuser”;
$database_password = “cactipw”;

Now add the following line in your /etc/ctrontab The finished product should look like so:

*/5 * * * * cactiuser /www/php/bin/php /www/htdocs/cacti/poller.php > /dev/null 2>&1

NOTE*** DO NOT RUN THE ABOVE COMMAND. LET THE CRONTAB FILE RUN IT.

If you run the above command as root there will be several files created under ...../rra and ..../log that will now be owned by the user ROOT and your graphs will NOT populate correctly. So the moral is... JUST TYPE IN WHAT YOU SEE ABOVE AND SAVE THE FILES. DONT RUN THEM.


Finalize Setup

You are now ready to finalize the setup process for cacti. To do this you will need to point your browser to the IP address of the cacti system like so:

http://localhost/cacti

or

http://remoteIP/cacti

1. Click Next

2. Default (New Install) -> Click Next

3. Two errors locating php and rrdtool to Fix them replace what they have with:

RRDTOOL = /usr/local/rrdtool/bin/rrdtool

PHP = /www/php/bin/php

4. Click Finish

5. Login admin/admin

6. Change Password for user admin

7. Click Save


That'it! Your done. Congratulations on your new install. You can now start playing with the cacti utility it's self. I highly recommend going to the message boards to find add-ons and helpful hints when trying to do any advanced things in cacti. This is a highly versatile utility and is really only limited to your imagination.





Continue reading Cacti The ULTIMATE Management Solution

Linux as an Ethernet Bridge

It passes packets like a bridge and filters like a firewall. Put extra security and versatility in front of any server or device, without reconfiguring it.

Have you ever been asked to secure a router over which you did not have administrative control? What about when you are on a network you don't own but want to secure the segment are you using? A request similar to this one is what brought me to the wonderful world of Bridge, the Linux Ethernet bridging project.

According to the Bridge Web site:

Ethernet bridging is a way to connect networks together to form a larger network. The standard for bridging is ANSI/IEEE 802.1d. A bridge is a way to connect two separate network segments together in a protocol-independent way. Packets are forwarded based on Ethernet address, rather than IP address (like a router). Since forwarding is done at Layer 2, all protocols can go transparently through a bridge.

The code currently is maintained by Stephen Hemminger for both the Linux 2.4 and 2.6 kernels. Most modern distributions using the 2.6 series kernel have the bridging code built in. For the purposes of this article, we are using Fedora Core 3, which is built on the 2.6 kernel. If you're stuck with the 2.4 kernel, don't despair. Kernel patches are available on the Bridge site (see the on-line Resources), so you can play too.

The firewall component of the bridging firewall is achieved by using another related project called ebtables. The ebtables program is a filtering layer for a bridging firewall. The filtering connects into the Link Layer Ethernet frame field. In addition to filtering, you also may manipulate the Ethernet MAC addresses. The ebtables code also allows iptables rules to function in bridging mode, giving you both IP- and MAC-level filters for your firewall.

What Is a Bridge?

A bridge is a device that links two or more network segments that use the same network technologies. The topologies may differ, though, so you can go from fiber to copper, but the technologies must remain the same. In its most simple form, think of a Linux hub. Add as many ports to the box as you want, and they all become part of the single hub device. What comes in one port goes out all of the other ports in the hub fabric, unless you state otherwise in the rules. Once your hub is up, you can use iptables and ebtables to filter traffic as you would any other Linux forwarding system.

Getting Started

We start out simply by attempting to achieve connectivity between a simple two-NIC machine. When we are finished, this Linux box should act as a standard hub, passing traffic from one port to another as needed. When we plug one NIC in to our regular network jack and a laptop into the second NIC, we will be able to use the network from the laptop as if we were connected directly.


Figure 1. In this simple network, the Linux system acts like an Ethernet hub, passing all traffic.

We want this bridge to be transparent to any device plugged in to it. Interestingly enough, beyond the ability to connect remotely to the bridge to maintain it and check logs, there is no requirement to give the bridge an IP address. Of course, in today's connected world it makes sense to assign an IP address and we do so here.

I started with an old box that has been waiting for a project such as this. It's an AMD K6-450 with 256MB of RAM. It has a single 15GB IDE hard drive and a single 3Com 10/100MB Ethernet card. I also had a spare 3Com 10/100MB Ethernet card that works well with Linux, so it is added as the second interface. I am going to run only the bridge software, some simple firewall rules and perhaps Snort for intrusion detection. The traffic volumes are low and I don't expect massive amounts of Snort data, so 256MB of RAM should suffice. If you're going to be passing gigabit traffic and want to sniff live, ramp up the specs of the machine considerably.

Now install Fedora Core 3, selecting the extras you feel are needed. If you work in high-security environments, I recommend keeping your software options to the bare minimum. You always can grab extras later with YUM if you forget something. For now, simply get a working Linux install going and make sure that it finds your network cards. You need the kernel source and usual compile utilities to make the ebtables code, so add those in. Remember to stay secure and remove any software you don't need once you place the device into production. Once the install completes, reboot and log in as root.

Now you are ready to create a virtual network device. You can call it whatever you want; I went with br0—the first bridge device:

#> brctl addbr br0

Run ifconfig. Do you see your network interfaces (Listing 1)?

Listing 1. Before configuring the network, check that both Ethernet interfaces are up.

#> ifconfig
 
eth0      Link encap:Ethernet  HWaddr 00:CC:D0:99:EB:26
          inet6 addr: fe80::2b0:d0ff:fe99:eb26/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:86208855 errors:0 dropped:0 overruns:63 frame:0
          TX packets:77098217 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:3871506445 (3692.1 Mb)  TX bytes:266311184 (253.9 Mb)
          Interrupt:5 Base address:0xec00
 
eth1      Link encap:Ethernet  HWaddr 00:CC:03:D8:3A:1A
          inet6 addr: fe80::201:3ff:fed8:3a1a/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:77087614 errors:0 dropped:0 overruns:0 frame:0
          TX packets:85110321 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:264995582 (252.7 Mb)  TX bytes:3672580334 (3502.4 Mb)
          Interrupt:9 Base address:0xec80

In Listing 1, you can see that we have two network cards with no IP addresses bound to them. If you have IP addresses assigned to the interface, remove them for simplicity's sake. On Fedora, edit the file /etc/sysconfig/networking-scripts/ifcfg-X, where X is the card identifier. On my system, the two interfaces are eth0 and eth1. Delete or comment out the lines that relate to the IP address. It is important to make sure the cards are on at boot time. Listing 2 shows a basic configuration that should work. Don't forget to reinitialize networking once you've completed the above, using service network reload.

Listing 2. Two Simple Config Files for Network Cards with No IP Addresses

/etc/sysconfig/networking-scripts/ifcfg-eth0:
 
DEVICE=eth0
ONBOOT=yes
BOOTPROTO=static
 
 
/etc/sysconfig/networking-scripts/ifcfg-eth1:
 
DEVICE=eth1
ONBOOT=yes
BOOTPROTO=static

Next, tell the system what devices belong to this group, as shown below. Also, give the command that actually initializes the virtual device, as shown in the last line:

#> brctl addif br0 eth0
#> brctl addif br0 eth1
#> ip link set br0 up

In its most basic form, your Linux box now is acting like a hub. For the keen ones, you can plug in the Ethernet adapters and begin to play. The box itself, however, currently is passing traffic blindly and does not have an IP address assigned to it. I like to be able to connect remotely to my devices after I install them, so I am going to add an IP address and some routing information to the virtual device br0.

To add an IP address to the bridge interface, issue:

#> ip addr add 10.1.1.18/16 brd + dev br0

I had to state both the subnet mask (/16) and which bridge device it should be assigned to. This becomes important if you have more than one virtual device on the machine. I have only the one, but the syntax requires it. If you named your bridge device something else, you need to state that explicitly here.

The last thing to do before you can play with your bridge remotely is to configure the routing:

#> route add default gw 10.1.1.1 dev br0

The usual routing rules and commands apply, and for all intents and purposes you can use the device (br0) as you would any other Linux network interface.

Testing

Now that we have everything in place, let's test it out. First, let's confirm that all of our configurations have taken hold:

#> brctl show
bridge name  bridge id          STP enabled  interfaces
br0          8000.0030843e5aa2  no           eth0
                                             eth1

As you can see above, we have a single bridge device called br0 that uses interfaces eth0 and eth1. This confirms that we should be in business.

Installation

Now it's time to do the physical setup. Connect one network card to your network switch as you would normally do for any other computer. You should see link lights on both ends of the link. Connect a desktop or laptop to the other interface on your Linux box using a crossover cable. Wait for the link lights to come on, count to ten and ping another node on your network from your desktop or laptop. You should be able to use the network on the other side of the Linux hub as if it was attached directly.

Surviving a Reboot

How you set up your install to survive a reboot is your choice. A simple way is to add all of the commands we have used to /etc/rc.local, which is processed at the end of startup. Enter the commands used above to this file, and your bridge is functional after startup.

Firewalling

As with any Linux install that passes or forwards traffic, you have the ability to filter the stream of information as it passes by. A bridging firewall is no different. There are many ways to create and maintain firewall configurations. Below, I explain how to use the most basic firewall type: deny all, pass some. We want to deny everything passing this firewall unless we specifically state that something is allowed.

This firewall configuration requires you to download and install the ebtables user-space tools available from the ebtables Web site (see Resources). At the time of this writing, the latest release was v2.0.6. Grab a copy of this from one of the many mirrors. Do the usual extract and install dance without the initial configure step:

#> tar -xzf ebtables-v2.0.6.tar.gz
#> cd ebtables-v2.0.6
#> make
#> install

If all goes well, you should have the ebtables command set at your fingertips. Test this by typing ebtables at the prompt; you should see something similar to this:

#> ebtables -V
ebtables v2.0.6 (November 2003)

Let's start by making sure iptables is set to accept. Remember we're on Fedora Core 3, so we simply can tell the service to quit, which does the same thing:

#> service iptables stop
#> chkconfig --level 35 iptables off

You can do something similar by issuing the flush command. List your available chains and then flush each of them in turn:

#> iptables -L
#> iptables -F INPUT
#> iptables -F OUTPUT
#> iptables -F FORWARD
#> iptables -F RH-Firewall-1-INPUT

Now we want to stop all traffic from all areas of our network from passing through the firewall. The following rules are specific to the network we're working with for this example; you need to amend the subnets or hosts to reflect your specific requirements:

 
/sbin/ebtables -A FORWARD -p IPv4 --ip-source 10.2.0.0/16 -j DROP
/sbin/ebtables -A FORWARD -p IPv4 --ip-source 10.7.0.0/16 -j DROP
/sbin/ebtables -A FORWARD -p IPv4 --ip-source 10.4.0.0/16 -j DROP
/sbin/ebtables -A FORWARD -p IPv4 --ip-source 10.5.0.0/16 -j DROP
/sbin/ebtables -A FORWARD -p IPv4 --ip-source 10.6.0.0/16 -j DROP
/sbin/ebtables -A FORWARD -p IPv4 --ip-source 10.1.0.0/16 -j DROP
 

Those of you familiar with iptables should notice that the syntax above is similar. We tell the ebtables program that when FORWARDING using the IPv4 protocol to DROP any packets sourced from the 10.1.0.0/16 subnet. We then tell it to repeat for the rest of the subnets.

The next step is to allow the device behind the firewall itself. If you do not allow its IP address to pass through, nothing works. Also, if you assign an IP address to the firewall itself, don't forget to allow it as well:

/sbin/ebtables -I FORWARD 1 -p IPv4 --ip-source 10.1.1.5 -j ACCEPT
/sbin/ebtables -I FORWARD 1 -p IPv4 --ip-source 10.1.1.18 -j ACCEPT

Here, I add the devices on my network that are allowed to access my laptop:

 
/sbin/ebtables -I FORWARD 1 -p IPv4 --ip-source 10.1.10.30 -j ACCEPT
/sbin/ebtables -I FORWARD 1 -p IPv4 --ip-source 10.1.10.19 -j ACCEPT
/sbin/ebtables -I FORWARD 1 -p IPv4 --ip-source 10.1.10.87 -j ACCEPT
 

To test this, I simply go to a machine listed in the ACCEPT rules above and see if I can ping my laptop at 10.1.1.5. Now move to a node not listed above—no pings for you!

Real-World Implementation

Recently, I was called to a customer's site to secure a financial server. The request was simple: we need a firewall in front of this system but we cannot change its IP address. With two NICs and a Linux OS, I was able to have a working firewall up and running in a few minutes. Installation also was a breeze. I simply used a crossover cable that connected the firewall to the server and a regular cable from the other network card on the firewall to the network jack. That was it. No redesign was necessary of any part of the existing IP scheme; it truly was plug-and-play. Once a few rules were in place to drop all packets unless they were from the IP addresses and ports listed as acceptable, the project was completed.

One of the beautiful aspects of Linux is its ability to run many services on one system. Take the above example. I quickly firewalled a sensitive server, but that was not the end of the project. With all the extra time and money we saved using Linux, we were able to load Snort on the firewall. With a quick hack to the sniffer's config file—/etc/snort.conf in our case—we told Snort to listen to interface br0, and snort immediately began to do its stuff on the bridging interface.

This is where the true power of the bridging code can be felt. Ever had a segment of the network running slow but you don't know why? Next time, load a Linux box with Snort and any other sleuthing software you like and get the bridge up and running. Find your trusty crossover cable and head out to the site. Because the bridge acts like a hub, you simply can insert your Linux box at any point in the network. As long as you have the physical connections, you can drop your box in and begin to sniff live in a matter of seconds. The latest project we have been working on included transparent Squid cache servers that are truly transparent requiring zero reconfiguration to the IP scheme, clients or browsers. Simply insert the Squid box in front of the router and redirect all port 80 traffic to the box itself and you're done.

The ability of Linux to slide transparently into existing network infrastructure opens a world of new and improved services that the penguin can provide. With the ability to place dissimilar networking devices into one virtual entity, you can use a single device to firewall and monitor any aspect of your network. You're only limitation is the speed of your hardware and its number of available slots.

Continue reading Linux as an Ethernet Bridge

Installing phpMyAdmin on Linux

phpMyAdmin is a utility written in PHP which is intended to aid in the administration of a MySQL server, either locally, or over the WWW. It is maintained through the hard work and dedication of the folks at The phpMyAdmin project, and is currently available in 47 different languages...

Some of its current capabilities include the ability to create and drop databases, create , drop, and alter tables, execute SQL statements, delete, edit, and add fields, manage keys on fields, and manage privileges. In addition, it has the ability to export your data in a number of different formats. phpMyAdmin is an excellent tool and will make the life of any MySQL database administrator much more enjoyable.

This short tutorial assumes you already have Apache, MySQL, and PHP installed correctly and functioning, and will not cover those installations. Also, the machine being used for this example is running Fedora Core 1, so your mileage may vary depending on your Linux distro of choice and how the above mentioned packages were installed, however, unless you did something strange, you should find most installs similar. Lastly, it assumes you can use a text editor for basic editing tasks.

So lets get started !

Installation


First things first, we need to get the latest version of phpMyAdmin, at the time this tutorial was written the latest stable version was 2.11.5-pl1, and you can get it at:

#wget http://prdownloads।sourceforge।net/phpmyadmin/phpMyAdmin-२.11.5-english.tar.gz?download

Grab the download, then open a terminal window and do the following:

Change to the directory where you saved the downloaded file , such as:

$cd mydownloads

Cool, now we need to move the file to the root directory of your Apache webserver, which is usually /usr/local/apache/htdocs, also, root usually owns the Apache directory structure so you'll need to do the rest as root, so...

$su
$password

Now, lets move the file to where we need it:

#mv
phpMyAdmin-२.11.5-english.tar.gz /usr/local/apache/htdocs

Done, now make the Apache root directory your working directory:

#cd /usr/local/apache/htdocs

Cool, now lets unpack the file:

#tar -zxf
phpMyAdmin-२.11.5-english.tar.gz

That will take a second, then, when the machine returns the prompt, do a directory listing:

#ls

You should see a new directory which has been created called phpMyAdmin-2.11.5-pl1, assuming you do go ahead and get rid of the original file:

#rm
phpMyAdmin-२.11.5-english.tar.gz

Now, the new directory name is a bit long, and definatley not something you want to type in all the time, so lets make it easier:

#mv phpMyAdmin-2.11.5-pl1 phpmyadmin

Cool, now you've renamed the directory to something a little easier to remember, now make that your working directory:

#cd phpmyadmin

Configuration


Now, what we need to do is edit the config.inc.php file so it works with your setup. So using vi, or whatever your favorite editor happens to be, open config.inc.php, find the following lines, and edit them as appropriate for your setup:

$cfg['PmaAbsoluteUri'] = ''; (Default)
$cfg['PmaAbsoluteUri'] = 'http://www.yoursite.com/phpmyadmin/'; (Edited)

$cfg['Servers'][$i]['user'] = 'root'; (Default)
$cfg['Servers'][$i]['user'] = 'your_MySQL_root_user'; (Edited)

$cfg['Servers'][$i]['password'] = ''; (Default)

$cfg['Servers'][$i]['password'] = 'your_password'; (Edited)

Thats it, save the file and close it.

Now, lets see if it works, open a browser and point it to phpMyAdmin by using your site info such as www.yoursite.com/phpmyadmin, or, localhost/phpmyadmin if you are only working locally. If all is well you should see the welcome screen for phpMyAdmin , if you don't, then check your logs and remember, Google is your friend. If you see a page full of PHP errors, make sure you used the correct username and password when you edited the lines mentioned above.

Now, knowing what this cool program is capable of, its probably not something you want just anyone to be able to access, luckily we can take care of that very easily using Apache's authentication process, so lets do it!

Still as root make a directory to store the password file we will be creating:

#mkdir /usr/local/apache/passwd

Now, lets create the file and add an allowed user:

#/usr/local/apache/bin/htpasswd -c /usr/local/apache/passwd/authpass myphp

htpasswd will prompt you for the password you would like to assign to this user, once entered, it will create the file authpass and populate it with the information for the user called myphp. You can use whatever names you like, this is only an example.

Now the final step, change to your Apache configuration directory:

#cd /usr/local/apache/conf

And again using your favorite editor, open the file named httpd.conf and find the following section:


Options FollowSymLinks
AllowOverride None


Directly under this section add the following (assuming you used the names from the example above):


AuthType Basic
AuthName "myphp"
AuthUserFile /usr/local/apache/passwd/authpass
Require user myphp


Thats it, save the file and close it, then restart Apache by issuing the following command:

#/usr/local/apache/bin/apachectl restart

Perfect, now fire up your browser again and point it back to your phpMyAdmin site, this time you should be prompted for a username and password before being allowed access to the site. Enter the required information, and you are in business!

That brings us to the end of this tutorial, hopefully you found this information helpful, and Good Luck!
Continue reading Installing phpMyAdmin on Linux