Broadcast and Multicast analysis using Wireshark

I have been looking for a way to analyse a packet capture and provide a visual representation to show how much multicast and how much broadcast is in a capture compared to unicast. There are commercially available software to do this kind of analysis but those are not cheap.  Playing around with tools in Wireshark I found that IO graph can show this analysis in a graph,

Steps : Open the capture using Wireshark --> goto Statistics --> IO Graph --> Enter the filter you want for each line in the graph.

IPv4 multicast filter :  eth.dst[0] == 0x01
IPv6 multicast filter :  eth.dst[0] == 0x33
Broadcast filter        :  eth.dst[0] == 0xff
Unicast is not(multicast or broadcast) : !(eth.dst[0] == 0x33 || eth.dst[0] == 0x01 || eth.dst[0] == 0xff)

Crack WEP

WEP is known to be easy to crack and at a cryptography class I learnt the mathematics behind it. After starting to study for CWSP I want to to see for my self how easy or difficult it is to crack WEP. Follow the steps below and WEP can be cracked,

1) You can attempt to install aircrack-ng in your choice if Linux distro but easy way out is to download and install Kali in Virtual box. http://www.kali.org/downloads/

2) I tested few different USB wifi dongles, the one actually worked was Netcomm NP910n Ralink chip. Only 2.4GHz, couldn't find one which worked properly for 5GHz.

AirPcap Nx - Was detected by Kali but didn't capture anything
ekahau NIC-300 - Was detected by Kali but didn't capture anything
EnGenius EUB1200AC - Was not detected by Kali

***Update  - bought an ALFA AWUS051NH, this wifi card can capture both 2.4GHz and 5GHz if you are trying to capture a WPA 4-way handshake.

3)  Used an Aerohive AP330. You can use any AP for this experiment. Just configure WEP security in the SSID.

4) Follow this guide - http://www.aircrack-ng.org/doku.php?id=simple_wep_crack . It cracked the password in few seconds. But I spend more than a day to figure out which wifi card worked, get my head around the process and install Kali.

Conclusion is that even though WEP is easy to crack in theory,  some one with basic computer literacy will not be able to crack it :D , but its not that difficult for some one with an understanding of networking and Linux.

bk precision 1786B Power supply - set and read voltage and current python script

#----- python ----


import sys
import serial
import time
import string
import binascii
import time
import os

try:

 filename1 = "Power-Consumption"+time.strftime("%Y-%m-%d-%H%M%S")+".csv"
 print filename1
 on_time = 1 # in seconds
 mac_v = 12
 actual_v = 12
 actual_a = 3   # Amp
 sleep_cmd_int = 0.1 # time for gap between commands
 v1 = 0 # currect mA
 a1 = 0 # voltage V

 ser = serial.Serial('COM14',38400,timeout=1)
 print ser.portstr


#------------- enable remote management ---------------------------
 a0 = 'AA';a1 = '00';a2 = '20';a3 = '01';a4 = '00';a5 = '00';a6 = '00'
 a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
 a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
 a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

 btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

 cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

 btsend1[25] = int(cksum1,16)

 s = bytearray(btsend1)

 ser.write(s)
 ser.write("\r\n")

# ---- sleep ---

 time.sleep(sleep_cmd_int)

#-------------------Set V---------------------

 a0 = 'AA';a1 = '00';a2 = '23';a3 = 'E0';a4 = '2E';a5 = '00';a6 = '00'
 a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
 a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
 a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

 btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

 cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

 btsend1[25] = int(cksum1,16)

 s = bytearray(btsend1)

 ser.write(s)
 ser.write("\r\n")

# ----

 time.sleep(sleep_cmd_int)

#-----------------------set the current---------------------

 a0 = 'AA';a1 = '00';a2 = '24';a3 = 'B8';a4 = '0B';a5 = '00';a6 = '00'
 a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
 a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
 a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

 btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

 cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

 btsend1[25] = int(cksum1,16)

 s = bytearray(btsend1)

 ser.write(s)
 ser.write("\r\n")
# ----

 time.sleep(sleep_cmd_int)

# -------   turn on ---
 a0 = 'AA';a1 = '00';a2 = '21';a3 = '01';a4 = '00';a5 = '00';a6 = '00'
 a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
 a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
 a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

 btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

 cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

 btsend1[25] = int(cksum1,16)

 s = bytearray(btsend1)

 ser.write(s)
 ser.write("\r\n")

# ------------

 time.sleep(on_time)

#---- flush ---

 ser.flush()
 while 1==1:
  ser.flush()

# ----------read current -------------

  a0 = 'AA';a1 = '00';a2 = '26';a3 = 'B8';a4 = '0B';a5 = '00';a6 = '00'
  a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
  a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
  a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

  btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

  cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

  btsend1[25] = int(cksum1,16)

  s = bytearray(btsend1)

  ser.write(s)
  ser.write("\r\n")

# ---- sleep ---

  time.sleep(.1)

# --- flush ---

  ser.flush()

# ---- sleep ---

  time.sleep(.1)

  msg2 = ser.read(1000)

  btreceived1 = list(msg2)
#print btreceived1
  if '\x26' in btreceived1:
   a11 = btreceived1[btreceived1.index('\x26')+1:btreceived1.index('\x26')+3]
   a12 = a11[1].encode('hex')+a11[0].encode('hex')
   a1 = int(a12,16)
   v11 = btreceived1[btreceived1.index('\x26')+3:btreceived1.index('\x26')+7]
   v12 = v11[3].encode('hex')+v11[2].encode('hex')+v11[1].encode('hex')+v11[0].encode('hex')
   print "..."
   print str(a1)+"mA"+" @ "+str(float(int(v12,16))/1000)+"V"+" - "+time.strftime("%Y-%m-%d %H:%M:%S")
   writettoofile = str(a1)+","+str(float(int(v12,16))/1000)+","+time.strftime("%Y%m%d%H%M%S")+"\n"
  #--- open/close file ---
   f1 = open(filename1,'a',0)
   f1.write(writettoofile)
   f1.close

#--- sleep ---
   time.sleep(1)

except:
 print "Something went wrong"
#--- sleep ---
 time.sleep(2)
#----- turn off -------
 a0 = 'AA';a1 = '00';a2 = '21';a3 = '00';a4 = '00';a5 = '00';a6 = '00'
 a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
 a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
 a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

 btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

 cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

 btsend1[25] = int(cksum1,16)

 s = bytearray(btsend1)

 ser.write(s)
 ser.write("\r\n")


#--------------Disable remote -------


 a0 = 'AA';a1 = '00';a2 = '20';a3 = '00';a4 = '00';a5 = '00';a6 = '00'
 a7 = '00';a8 = '00';a9 = '00';a10 = '00';a11 = '00';a12 = '00';a13 = '00'
 a14 = '00';a15 = '00';a16 = '00';a17 = '00';a18 = '00';a19 = '00';a20 = '00'
 a21 = '00';a22 = '00';a23 = '00';a24 = '00';a25 = '00'

 btsend1 = [int(a0,16),int(a1,16),int(a2,16),int(a3,16),int(a4,16),int(a5,16),int(a6,16),int(a7,16),int(a8,16),int(a9,16),int(a10,16),int(a11,16),int(a12,16),int(a13,16),int(a14,16),int(a15,16),int(a16,16),int(a17,16),int(a18,16),int(a19,16),int(a20,16),int(a21,16),int(a22,16),int(a23,16),int(a24,16),int('00',16)]

 cksum1 = hex(sum(btsend1))[len(hex(sum(btsend1)))-2:len(hex(sum(btsend1)))]

 btsend1[25] = int(cksum1,16)

 s = bytearray(btsend1)

 ser.write(s)
 ser.write("\r\n")

simplemediawiki edit example - python

 # ---------------- python code start ----------------------


from simplemediawiki import MediaWiki

wiki = MediaWiki('http://192.168.20.20/mediawiki/api.php')

myUserName = "xxx"
myPassword = "xxx"


#logs in
loginData = wiki.call({'action':'login', 'lgname': myUserName,'lgpassword': myPassword})

print loginData

#resubmission of the login token
personalLoginData = wiki.call({'action':'login', 'lgname': myUserName ,'lgpassword': myPassword,'lgtoken': loginData['login']['token'$

print "[][][]]"
print personalLoginData
print "[][][][]"
returnData = wiki.call({'action':'query','prop':'info', 'titles':'Main_Page','intoken':'edit'});

print returnData

  # get the edittoken:

edittoken = returnData['query']['pages']['1']['edittoken']
print "----"
print edittoken
print "----"

results = wiki.call({'action':'edit','title':"testwiki1_Page",'section':'new','text':"new page sample text",'token':edittoken})

print results


 # ---------------- python code end ----------------------

CISCO IPv6 PPPOE server

I have been trying to test a CPE router with IPv6 PPPoE client, and finally manage to setup a PPPoE server in a cisco 7K witch supports IPv6. Now the set-up seems to establish an IPv6 link local address in the ppp0 interface in the CPE router and the br0 interface in the router is obtaining a global IPv6 address using DHCPv6. I will update this post with more details soon  . CISCO running config is given below,


-----------------------

version 12.4
!
ipv6 unicast-routing
ipv6 cef
ipv6 dhcp pool Clients
 prefix-delegation pool DhcpPool
!
ipv6 dhcp pool dhcpv6
 prefix-delegation pool dhcpv6-pool1 lifetime 1800 600
 address prefix 2001:1::/64
 dns-server 2001:1::1
 domain-name dhcpv6.com
!
!
multilink bundle-name authenticated
!

memory-size iomem 0
username cisco password 0 cisco
archive
 log config
  hidekeys
!
bba-group pppoe GROUP
!
bba-group pppoe GROUPA
 virtual-template 1
!
!
interface Loopback0
 ip address 10.12.0.1 255.255.255.0
 ipv6 address 2001:6::1/64
 ipv6 enable
!
interface Loopback1
 no ip address
!
interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
 ipv6 address 2001:2::1/64
 ipv6 enable
 ipv6 nd managed-config-flag
 ipv6 dhcp server dhcpv6
 pppoe enable group GROUPA
!
interface FastEthernet0/1
 ip address dhcp
 duplex auto
 speed auto
 ipv6 address 2001:1::1/64
!
interface Virtual-Template1
 ip unnumbered Loopback0
 ipv6 unnumbered Loopback0
 ipv6 enable
 ipv6 nd managed-config-flag
 ipv6 nd other-config-flag
 ipv6 nd router-preference High
 no ipv6 nd ra suppress
 ipv6 dhcp server dhcpv6
 peer default ip address pool ppppool1
 peer default ipv6 pool dhcpv6-pool1
 ppp authentication pap chap callin
!
ip local pool ppppool1 10.12.0.50 10.12.0.254
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ipv6 local pool dhcpv6-pool1 2001:5::/32 48
!

----------------------------------------------

L2TP with MPPE

For my understanding L2TP usually use IPsec for security, but today I tested a cpe router which has a L2TP client which use MPPE. I was puzzled but then I figured out that CISCO ios support L2TP with MPPE. You just need to add the line "ppp encrypt mppe auto" to the virtual template,

---------------------------------------------------------------------

vpdn-group L2TP-pure

 accept-dialin

  protocol l2tp

  virtual-template 52

interface Virtual-Template52

 ip unnumbered Loopback1

 ip nat inside

 ip virtual-reassembly

 peer default ip address pool L2TP-POOL

ppp encrypt mppe auto

ip local pool L2TP-POOL 192.168.60.10 192.168.60.100

---------------------------------------------------------------------

IPv6 TFTPD and TOD servers

To enable IPv6 support for xinetd TFTP and TOD server, just add the bind statement in to the configuration file,

------------ TFTP -------------------------


service tftp
{
protocol = udp
port = 69
socket_type = dgram
wait = yes
user = nobody
server = /usr/sbin/in.tftpd
server_args = /tftpboot
disable = no
bind = 2001:0:130:1::24
}


------- TOD --------------------------

service time
{
disable = no
type = INTERNAL
id = time-dgram
socket_type = dgram
protocol = udp
user = root
wait = yes
bind = 2001:0:130:1::24
}