Cisco controller Layer 3 authentication(CWP) with Windows 2008 NPS

If you want use captive web portal authentication for wireless users using Cisco wireless lan controller (WLC) and Windows NPS as the RADIUS server you need to tick few boxes that are not ticked by default. In simple term you need to enable PAP in the NPS network policy.

WLC configuration,

Create a SSID

Select no Layer 2 security 

Select "Web policy" as layer 3 security 

Windows NPS configuration 

Select NPS and click on configure 802.1x

Finally the pkt capture at the RADIUS server looks like this. The service type is "login", instead of "Framed".

Network Delay Generation

If for any testing you would like to generate network delay you can use the software tool netem. I used the instruction in the web site below for setting up netem.

http://www.linuxfoundation.org/collaborate/workgroups/networking/netem#How_come_first_ping_takes_longer.3F

I am going to explain a simple setup you can use this tool to test the effect of network delay on network protocols,

1. Introduce ping round trip delay,

2. At the Ubuntu desktop enter the following commands in the shell 

For delay d1 ,

shell# tc qdisc add dev eth0 root netem delay 100ms


For delay d2 (need to create a ifb interface),

shell#  modprobe ifb
shell#  ip link set dev ifb0 up
shell#  tc qdisc add dev eth0 ingress
shell#  tc filter add dev eth0 parent ffff: \ protocol ip u32 match u32 0 0 flowid 1:1 action mirred egress redirect dev ifb0
shell#  tc qdisc add dev ifb0 root netem delay 750ms


3. Now ping from any client to the Ubuntu box 172.16.1.177 and the ping round trip delay will be around 850ms,

4. Lets say you want to change the delay d1 and d2, use the two commands below,

shell# tc qdisc change dev eth0 root netem delay d1ms
shell#  tc qdisc change dev ifb0 root netem delay d2ms


5. To remove network delay,

shell# tc qdisc del dev eth0 root netem delay d1ms
shell#  tc qdisc del dev ifb0 root netem delay d2ms



6. I used this to test the effect of network delay on NTP. The NTP server was installed in the Ubuntu box (apt-get install ntp) and introduced a 60 second delay to see whether the client failed time sync,

Wifi Spectrum Analysis test with video transmitter

I was curious to see how Aerohive HiveManager and Cisco controller would report my 2.4GHz video transmitter (2.4G 4CH XL24017),

Aerohive HIveManager + AP330 identified the video transmitter as a video bridge,

Cisco controller + AP 3502i reported it as a continuous transmission, which is correct because it is a continuous analog transmission, but it would have been nice if the controller could identify that it is a video transmitter.

WIN 2008 R2 DHCP server not showing leases

I have run in to this issue several times and finally found the solution. If you Windows 2008 R2 DHCP server does not show leases just refresh the leases.

Before refresh :

After refresh :

Broadcast and Multicast analysis using Wireshark

I have been looking for a way to analyse a packet capture and provide a visual representation to show how much multicast and how much broadcast is in a capture compared to unicast. There are commercially available software to do this kind of analysis but those are not cheap.  Playing around with tools in Wireshark I found that IO graph can show this analysis in a graph,

Steps : Open the capture using Wireshark --> goto Statistics --> IO Graph --> Enter the filter you want for each line in the graph.

IPv4 multicast filter :  eth.dst[0] == 0x01
IPv6 multicast filter :  eth.dst[0] == 0x33
Broadcast filter        :  eth.dst[0] == 0xff
Unicast is not(multicast or broadcast) : !(eth.dst[0] == 0x33 || eth.dst[0] == 0x01 || eth.dst[0] == 0xff)

Crack WEP

WEP is known to be easy to crack and at a cryptography class I learnt the mathematics behind it. After starting to study for CWSP I want to to see for my self how easy or difficult it is to crack WEP. Follow the steps below and WEP can be cracked,

1) You can attempt to install aircrack-ng in your choice if Linux distro but easy way out is to download and install Kali in Virtual box. http://www.kali.org/downloads/

2) I tested few different USB wifi dongles, the one actually worked was Netcomm NP910n Ralink chip. Only 2.4GHz, couldn't find one which worked properly for 5GHz.

AirPcap Nx - Was detected by Kali but didn't capture anything
ekahau NIC-300 - Was detected by Kali but didn't capture anything
EnGenius EUB1200AC - Was not detected by Kali

***Update  - bought an ALFA AWUS051NH, this wifi card can capture both 2.4GHz and 5GHz if you are trying to capture a WPA 4-way handshake.

3)  Used an Aerohive AP330. You can use any AP for this experiment. Just configure WEP security in the SSID.

4) Follow this guide - http://www.aircrack-ng.org/doku.php?id=simple_wep_crack . It cracked the password in few seconds. But I spend more than a day to figure out which wifi card worked, get my head around the process and install Kali.

Conclusion is that even though WEP is easy to crack in theory,  some one with basic computer literacy will not be able to crack it :D , but its not that difficult for some one with an understanding of networking and Linux.

bk precision 1786B Power supply - set and read voltage and current python script

#----- python ----


import sys
import serial
import time
import string
import binascii
import time
import os

try:

 filename1 = "Power-Consumption"+time.strftime("%Y-%m-%d-%H%M%S")+".csv"
 print filename1
 on_time = 1 # in seconds
 mac_v = 12
 actual_v = 12
 actual_a = 3   # Amp
 sleep_cmd_int = 0.1 # time for gap between commands
 v1 = 0 # currect mA
 a1 = 0 # voltage V

 ser = serial.Serial('COM14',38400,timeout=1)
 print ser.portstr


#------------- enable remote management ---------------------------
 a0 = 'AA';a1 = '00';a2 = '20';a3 = '01';a4 = '00';a5 = '00';a6 = '00'
 a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
 a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
 a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

 btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

 cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

 btsend1[25] = int(cksum1,16)

 s = bytearray(btsend1)

 ser.write(s)
 ser.write("\r\n")

# ---- sleep ---

 time.sleep(sleep_cmd_int)

#-------------------Set V---------------------

 a0 = 'AA';a1 = '00';a2 = '23';a3 = 'E0';a4 = '2E';a5 = '00';a6 = '00'
 a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
 a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
 a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

 btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

 cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

 btsend1[25] = int(cksum1,16)

 s = bytearray(btsend1)

 ser.write(s)
 ser.write("\r\n")

# ----

 time.sleep(sleep_cmd_int)

#-----------------------set the current---------------------

 a0 = 'AA';a1 = '00';a2 = '24';a3 = 'B8';a4 = '0B';a5 = '00';a6 = '00'
 a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
 a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
 a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

 btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

 cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

 btsend1[25] = int(cksum1,16)

 s = bytearray(btsend1)

 ser.write(s)
 ser.write("\r\n")
# ----

 time.sleep(sleep_cmd_int)

# -------   turn on ---
 a0 = 'AA';a1 = '00';a2 = '21';a3 = '01';a4 = '00';a5 = '00';a6 = '00'
 a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
 a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
 a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

 btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

 cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

 btsend1[25] = int(cksum1,16)

 s = bytearray(btsend1)

 ser.write(s)
 ser.write("\r\n")

# ------------

 time.sleep(on_time)

#---- flush ---

 ser.flush()
 while 1==1:
  ser.flush()

# ----------read current -------------

  a0 = 'AA';a1 = '00';a2 = '26';a3 = 'B8';a4 = '0B';a5 = '00';a6 = '00'
  a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
  a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
  a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

  btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

  cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

  btsend1[25] = int(cksum1,16)

  s = bytearray(btsend1)

  ser.write(s)
  ser.write("\r\n")

# ---- sleep ---

  time.sleep(.1)

# --- flush ---

  ser.flush()

# ---- sleep ---

  time.sleep(.1)

  msg2 = ser.read(1000)

  btreceived1 = list(msg2)
#print btreceived1
  if '\x26' in btreceived1:
   a11 = btreceived1[btreceived1.index('\x26')+1:btreceived1.index('\x26')+3]
   a12 = a11[1].encode('hex')+a11[0].encode('hex')
   a1 = int(a12,16)
   v11 = btreceived1[btreceived1.index('\x26')+3:btreceived1.index('\x26')+7]
   v12 = v11[3].encode('hex')+v11[2].encode('hex')+v11[1].encode('hex')+v11[0].encode('hex')
   print "..."
   print str(a1)+"mA"+" @ "+str(float(int(v12,16))/1000)+"V"+" - "+time.strftime("%Y-%m-%d %H:%M:%S")
   writettoofile = str(a1)+","+str(float(int(v12,16))/1000)+","+time.strftime("%Y%m%d%H%M%S")+"\n"
  #--- open/close file ---
   f1 = open(filename1,'a',0)
   f1.write(writettoofile)
   f1.close

#--- sleep ---
   time.sleep(1)

except:
 print "Something went wrong"
#--- sleep ---
 time.sleep(2)
#----- turn off -------
 a0 = 'AA';a1 = '00';a2 = '21';a3 = '00';a4 = '00';a5 = '00';a6 = '00'
 a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
 a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
 a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

 btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

 cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

 btsend1[25] = int(cksum1,16)

 s = bytearray(btsend1)

 ser.write(s)
 ser.write("\r\n")


#--------------Disable remote -------


 a0 = 'AA';a1 = '00';a2 = '20';a3 = '00';a4 = '00';a5 = '00';a6 = '00'
 a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
 a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
 a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

 btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

 cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

 btsend1[25] = int(cksum1,16)

 s = bytearray(btsend1)

 ser.write(s)
 ser.write("\r\n")