jbits.se

Start capture of everything on interface outside:
#capture CAPFILE interface outside packet-length 1500 buffer 8192

Start capture on interface outside using access-list (define access-list first):
#capture CAPFILE interface outside packet-length 1500 access-list 345 buffer 8192

Stop capture
# no capture CAPFILE interface outside
Fire up a browser and go to the following URL to fetch your capture (Other protocols can be used too):
https://ASA-IP/capture/CAPFILE/pcap

Clean up
# no capture MYCAP

Normal behaviour for Windows 2008 onwards is to register all IPs for a certain adapter in DNS if dynamic dns registration is enabled.
To prevent this behaviour you need to install below mentioned hotfix and add the addresses using the following netsh syntax:

Netsh int ipv4 add address skipassource=true
http://support.microsoft.com/kb/975808/EN-US

ip route 1.1.1.1 255.255.255.255 192.168.0.2
ip route 2.2.2.2 255.255.255.255 192.168.0.3

track 101 rtr 1 reachability
track 102 rtr 2 reachability

interface vlan1
ip address 192.168.0.1 255.255.255.0
ip policy route-map failover

route-map failover permit 10
set ip next-hop verify-availability 192.168.107.2 10 track 101
set ip next-hop verify-availability 192.168.107.3 20 track 102

rtr 1
type echo protocol ipIcmpEcho 1.1.1.1
rtr schedule 1 life forever start-time now

rtr 2
type echo protocol ipIcmpEcho 2.2.2.2
rtr schedule 2 life forever start-time now

I made this little script to be able to retrieve log data from any cisco device via snmp.
Unfortunately most devices seem to have a default setting that only keeps the last line in history, this can however be increased by entering: logging history [numlines] in config mode.
Our table is located in Cisco-SysLog-MIB and has the following OID: 1.3.6.1.4.1.9.9.41.1.2.3
The following steps must be taken to allow access to this Mib via WMI:

• Install WMI SNMP Provider ( A Windows component )
• Download the following mibfiles:
  CISCO-SYSLOG-MIB.mib
  CISCO-SMI.mib
  SNMP-FRAMEWORK-MIB.mib
  INET-ADDRESS-MIB.mib
• Run the SNMP information module compiler smi2smir.exe (located in C:\WINDOWS\system32\wbem\snmp) to compile a mof from your mibfiles
  smi2smir.exe /g CISCO-SYSLOG-MIB.mib CISCO-SMI.mib SNMP-FRAMEWORK-MIB.mib INET-ADDRESS-MIB.mib > cisco-syslog-mib.mof
• Run mofcomp.exe (located in C:\WINDOWS\system32\wbem) to install your newly created mof into the WMI repository:
  mofcomp.exe cisco-syslog-mib.mof

Finally, here's the script to make it all happen:

http://download.microsoft.com/download/D/4/8/D485CEF3-25D3-4F70-8504-9F13E225F539/Netsh_TechnicalReference.zip

show snmp mib ifmib ifindex

 SNX R71 HFA1 files can be downloaded from:

• SSL Network Extender R71 HFA1 for Windows (msi)
• SSL Network Extender R71 HFA1, Security Gateway package
• SSL Network Extender R71 HFA1, Connectra Gateway package

VPN-1 R65 Gateway and up

1. Backup the $FWDIR/conf/extender/CSHELL directory:
tar -czvf CSHELL-Backup-`/bin/date +%F`.tgz CSHELL/*
2. Download the SNX_for_VPN1_Win7.tgz file.
3. Extract the file to the $FWDIR/conf/extender/CSHELL directory.
4. Move the files cashell_ver.txt and slim_ver.txt to $FWDIR/conf/extender
5. Install a policy on the gateway.

Connectra Gateway

1. Backup the $CVPNDIR/htdocs/SNX/CSHELL directory.
2. Download the SNX_for_Connectra_Win7.tgz file.
3. Extract the file to the $CVPNDIR/htdocs/SNX/CSHELL directory.
4. Install a policy on the gateway.

Restoring the original SNX version

To revert back to the original SNX version, restore the files you backed
up in step 1 of the above procedures.

http://packetlife.net/library/cheat-sheets/

tcpdump -s 0 -i eth0 -c 10 -w - -U | tee capture.pcap | tcpdump -n -r -
Full packets are written to capture.pcap, at the same time tcpdump -r decodes the stream to console.

-s 0 (Whole packets)
-w - (Write output to console)
-U (Do not buffer output)

Preparations

Allow HP SMH (TCP2381) and SNMP to the modules from selected stations

Log in and create a temporary directory (e.g. /var/HPAgents)

Download the following packages from www.hp.com for your hardware / RHEL3

• hpasm (System Health Application and Insight Management Agents)
  201002, latest version: hpasm-7.8.1-116.rhel3.i386.rpm
• cmanic (HP NIC agent), and the optional
  201002, latest version: cmanic-7.7.0-5.rhel3.linux.rpm
• hpsmh (System Management Homepage)
  201002, latest version: hpsmh-2.1.8-177.linux.i386.rpm

Download the splat_hpasm_support_files.tgz support files
http://www.opsec.com/solutions/partners/hpasm.html

Installing System Management Homepage (optional)

Login as expert on SPLAT and create the following file:
    echo "Red Hat Enterprise Linux ES release 3 (Taroon)" > /etc/redhat-release

Install the hpsmh package:
    rpm -ivh hpsmh-2.1.8-177.linux.i386.rpm

Install support files for HPASM

Extract the Splat hpasm supportfiles:
    tar xzvf splat_hpasm_support_files.tgz splat_hpasm

Copy the IPMI sysconfig file (If your system has an iLO2 Mgmt Controller)
    cp splat_hpasm/init_scripts/sysconfig_ipmi /etc/sysconfig/ipmi

Copy the IPMI init script for your kernel version (Check with uname –r)
    cp splat_hpasm/init_scripts/2.4_init_ipmi /etc/init.d/ipmi

Copy the libstdc++-3-libc6.2-2-2.10.0.so file to /usr/lib and set up a link
    cp splat_hpasm/libstdc++-3-libc6.2-2-2.10.0.so /usr/lib
    ln -s /usr/lib/libstdc++-3-libc6.2-2-2.10.0.so /usr/lib/libstdc++-libc6.2-2.so.3
    chmod 755 /usr/lib/libstdc++-3-libc6.2-2-2.10.0.so

Enable SNMP

Snmp service enable

Install HPASM

Remove any previous versions if present:
    rpm -e hponcfg
    rpm -e cmanic
    rpm -e hprsm
    rpm -e hpasm

Install the HPASM package
    rpm -ivh hpasm-7.8.1-116.rhel3.i386.rpm

Install the NIC Agents
    rpm -ivh cmanic-7.7.0-5.rhel3.linux.rpm

Configuration

Backup your snmp config files
    cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf-pre-`/bin/date +%Y%m%d`
    cp /etc/snmp/snmpd.users.conf /etc/snmp/snmpd.users.conf-pre-`/bin/date +%Y%m%d`

For first time configuration run:
    hpasm activate

To reconfigure run:
    /etc/init.d/hpasm configure or /etc/init.d/hpasm reconfigure

Do you wish to continue? <y/n> (blank is y) y
Do you want to load the hp modules even though they may "taint" your kernel? <y/n> (Blank is y) n
Do you wish to use an existing snmpd.conf (y/n) (Blank is n): n

Do you require SNMP agents (y/n) ? (Blank is y): y
Do you require Storage Agent support (y/n) ? (Blank is y): y
Do you require performance agent support (y/n) ? (Blank is y): y

Enter the localhost SNMP Read/Write community string
(one word, required, no default): ********
Re-enter the same input to confirm:********

Enter localhost SNMP Read Only community string
(one word, Blank to skip): ********
Re-enter the same input to confirm: ********

Enter Read/Write Authorized Management Station IP or DNS name
(Blank to skip): [Blank]

Enter Read Only Authorized Management Station IP or DNS name
(Blank to skip): [Blank]

Enter default SNMP trap community string
(One word; Blank to skip): [Blank]

Enter SNMP trap destination IP or DNS name
(One word; Blank to skip): [Blank]

Enter system contact information
(Name, phone, room, etc; Blank to skip): [Blank]

Enter system location information
Building, room, etc; Blank to skip): [Blank]

Do you wish to disable hpsmh support (y/n) (Blank is n):n

Do you wish to keep CCISS device handle open (y/n): y

Restore snmpd.users.conf:
    mv /etc/snmp/snmpd.users.conf.bak /etc/snmp/snmpd.users.conf

Restart SNMP Daemon
    service snmpd restart

/* ******** HP GbE2c Template Config ********
/* Replace the following strings with your own values:
/* $HOSTNAME$ - Switch Hostname
/* $SNMPRO$ - SNMP Read community
/* $SNMPRW$ - SNMP Write community
/* $UPLINKPORT$ - Your uplink port (eg 20)
/* $IPADDR$ - Switch IP Address
/* $IPMASK$ - Netmask
/* $IPBCAST$ - Broadcast
/* $IPGW$ - Gateway
/* $IPDNS1$ - DNS Server 1
/* $IPDNS2$ - DNS Server 2
/* $IPDOMAIN$ - DNS Domain name
/* $IPNTP1$ - NTP Server 1
/* $IPNTP2$ - NTP Server 2
/* ******************************************/* ------- Time Configuration -------
/c/sys/timezone 233 /* Set Timezone to Europe/Sweden
/c/sys/dlight e /* Enable Daylight saving

/* ------- SSH Configuration -------
/c/sys/sshd/on /* Enable SSH (Keys will be generated when config applied)

/* ------- BOOTP/DHCP Configuration -------
/c/sys
bootp dis
dhcp dis

/* ------- SNMP Configuration -------
/c/sys/ssnmp
name "$HOSTNAME$"
rcomm "$SNMPRO$"
wcomm "$SNMPRW$"

/* ------- UFD (Uplink failure detection) Configuration -------
/c/ufd/on
/c/ufd/fdp/ena
/c/ufd/fdp/ltm
addport $UPLINKPORT$
/c/ufd/fdp/ltd
addport 1
addport 2
addport 3
addport 4
addport 5
addport 6
addport 7
addport 8
addport 9
addport 10
addport 11
addport 12
addport 13
addport 14
addport 15
addport 16

/* ------- IP Configuration -------
/c/l3/if 256
ena
addr $IPADDR$
mask $IPMASK$
broad $IPBCAST$
/c/l3/gw 4
ena
addr $IPGW$
/c/l3/dns
prima $IPDNS1$
secon $IPDNS2$
dname $IPDOMAIN$

/* ------- NTP Configuration -------
/c/sys/ntp
on
prisrv $IPNTP1$
secsrv $IPNTP2$

/
script end /**** DO NOT EDIT THIS LINE!

/* ************** Additional Configuration Examples ******************

/* ------- Example User Configuration -------
/* /c/sys/access/user/uid 9
/* name "Username"
/* pswd "Password Hash"
/* ena
/* cos admin

/* ------- Example Port Configuration -------
/* /c/port 20
/* tag ena /* Enable tagging
/* pvid 255 /* trunk access vlan
/* /c/port 10
/* pvid 248 /* Access port on vlan 248

/* ------- Example VLAN Configuration -------
/* /c/l2/vlan 248
/* ena
/* name "Custom VLAN"
/* def 1 2 8 9 10 11 20

/* ------- Example Spanning Tree Configuration -------
/* Create unique stp groups for every vlan on the switch
/* /c/l2/stp 48/clear /* Create STP Group 48
/* /c/l2/stp 48/add 248 /* Add VLAN 248 to STP Group 48

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/inspect.html#wp1478746

* Make sure module 1 is active
* Run cphaconf set_ccp boradcast on both modules
* Upgrade module 2
* Install a policy (Will install on 2 and fail on 1)
* Run cphaprob stat and make sure module 1 is active and module 2 is ready
* Run cphastop on Module 1, Module 2 becomes active
* Upgrader Module 1
* Run cphaconf set_ccp multicast on both modules
* Run cphastart on all modules and make sure operation is back to normal

http://speedtest.emea.microsoftonline.com/

http://packetlife.net/blog/2008/oct/18/cheat-sheets-tcpdump-and-wireshark/

http://www.bladenetwork.net/userfiles/file/PDFs/2006-06-21_DeployGbE2cCisco.pdf

 Stack Creation and Modification
Stacks are created when individual switches are joined together with stacking cables. When the stack ports detect electromechanical activity, each port starts to transmit information about its switch. When the complete set of switches is known, the stack elects one of the members to be the master switch, which will be responsible for maintaining and updating configuration files, routing information, and other stack information. The entire stack will have a single IP address that will be used by all the switches.

Online Stack Adds and Removals
Switches can be added and deleted to a working stack without affecting stack performance. When a new switch is added, the master switch automatically configures the unit with the currently running Cisco IOS® Software image and configuration of the stack. The stack will gather information such as switching table information and update the MAC tables as new addresses are learned. The network manager does not have to do anything to bring up the switch before it is ready to operate. Similarly, switches can be removed from a working stack without any operational effect on the remaining switches. When the stack discovers that a series of ports is no longer present, it will update this information without affecting forwarding or routing.

Master Switch Election
The stack behaves as a single switching unit that is managed by a master switch elected from one of the member switches. The master switch automatically creates and updates all the switching and optional routing tables. Any member of the stack can become the master switch. Upon installation, or reboot of the entire stack, an election process occurs among the switches in the stack. There is a hierarchy of selection criteria for the election.

1. User priority-The network manager can select a switch to be master.
2. Hardware and software priority-This will default to the unit with the most extensive feature set. The Cisco Catalyst 3750 Advanced IP Services IPv6 (AIPv6) image has the highest priority, followed by Cisco Catalyst 3750 switches with Enhanced Multilayer Software Image (EMI) and then the Standard Multilayer Software Image (SMI) versions.
3. Default configuration-If a switch has preexisting configuration information, it will take precedence over switches that have not been configured.
4. Uptime-The switch that has been running the longest is selected.
5. MAC address-Each switch reports its MAC address to all its neighbors for comparison. The switch with the lowest MAC address is selected.

Adding New Members
When the switching stack has established a master, any new switch added afterward automatically becomes a subordinate. All the current routing and addressing information is downloaded into the subordinate so that it can immediately begin transmitting traffic. Its ports become identified with the IP address of the master switch. Global information, such as QoS configuration settings, is downloaded into the new subordinate member.

Cisco IOS Software Images Must Be Identical
The Cisco StackWise technology requires that all units in the stack run the same release of Cisco IOS Software. When the stack is first built, it is recommended that all of the stack members have the same level of software - either all SMI, all EMI, or AIPv6. This is because later upgrades of Cisco IOS Software mandate that all the switches to be upgraded to the same version as the master.
Automatic Cisco IOS Software Upgrade/Downgrade from the Master Switch
When a new switch is added to an existing stack, the master switch communicates with the switch to determine if the Cisco IOS Software image is the same as the one on the stack. If it is the same, the master switch sends the stack configuration to the device and the ports are brought online. If the Cisco IOS Software image is not the same, one of three things will occur:

1. If the hardware of the new switch is supported by the Cisco IOS Software image running on the stack, the master will by default download the Cisco IOS Software image in the master's Flash memory to the new switch, send down the stack configuration, and bring the switch online.
2. If the hardware of the new switch is supported by the Cisco IOS Software image running on the stack and the user has configured a Trivial File Transfer Protocol (TFTP) server for Cisco IOS Software image downloads, then the master will automatically download the Cisco IOS Software image from the TFTP server to the new switch, configure it, then bring it online.
3. If the hardware of the new switch is not supported by the Cisco IOS Software image running on the stack, the master will put the new switch into a suspended state, notify the user of a version incompatibility, and wait until the user upgrades the master to a Cisco IOS Software image that supports both types of hardware. The master will then upgrade the rest of the stack to this version, including the new switch, and bring the stack online.

If you want to do a quick trace from a machine running Windows try the following from a command prompt:
pathping -n -w 250 -p 100 -q 1 x.x.x.x
-n = Do not resolve hostnames
-w 250 = Wait 250 msecs for each reply (adjust to suit your needs)
-p 100 = Wait 100 msecs between pings
-q 1 = Number of queries (One enough for a simple trace, if you're troubleshooting packetloss set this high)