HALP! Something is in my tubes! Part I by Jason Testart, IST

Overview OSI Model Review of Ethernet, IP and common transport protocols A quick look at DHCP & DNS Scenarios we’ll cover: No DHCP No DNS Routing Problems Problem accessing a specific service on a specific server WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

OSI Model Application Presentation Session Transport Network Data Link Physical WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes! 1000BASE-T Ethernet IP TCP SMTP SSL Layer 1 Layer 7

Our Focus Application Presentation Session Transport Network Data Link Physical WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes! 1000BASE-T Ethernet IP TCP SMTP SSL Layer 2 Layer 3 Layer 4

Ethernet Layer 2 Shared Medium Addressing using a 48-bit “MAC” address MAC address represented using 6 groups of 2 hex digits delimited by a ‘:’ or a ‘-’ WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

Internet Protocol Layer 3 Encapsulate data from a higher layer Routers are computers that span several layer 2 networks A router forwards packets from one network to another based on rules it has. It’s all about addressing. WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

One Layer-3 Network Four Layer-2 Networks (shown) WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes! We don’t care about what’s in the cloud.

Layer 4 protocols UDP TCP ICMP (ping/traceroute) IGMP (multicast group management) ESP (IPSec VPN) WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

UDP Connectionless Order not guaranteed Unreliable Uses ports, like TCP DNS, NTP, DHCP WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

TCP Connection oriented Ordered Reliable Uses ports (0 to 65535) SMTP, HTTP, IMAP WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

DHCP A means of getting an IP address assigned edgement edgement On Windows, use “ipconfig /all | more” On Unix/Linux, use “ifconfig –a | more” X.Y means trouble WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

Output of ifconfig (Linux) WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes! ~]$ /sbin/ifconfig -a eth0 Link encap:Ethernet HWaddr 00:50:56:80:17:EB inet addr: Bcast: Mask: inet6 addr: fe80::250:56ff:fe80:17eb/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets: errors:0 dropped:0 overruns:0 frame:0 TX packets: errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes: (976.6 MiB) TX bytes: (2.2 GiB) Interrupt:177 Base address:0x1424

Extract of ipconfig output WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes! Wireless LAN adapter Wireless Network Connection: Connection-specific DNS Suffix. : uwaterloo.ca Description : Intel(R) Wireless WiFi Link 4965AGN Physical Address : 00-1F-3B-7B-31-A1 DHCP Enabled : Yes Autoconfiguration Enabled.... : Yes Link-local IPv6 Address..... : fe80::d173:7c70:199c:98f1%10(Preferred) IPv4 Address : (Preferred) Subnet Mask : Lease Obtained : November :25:24 PM Lease Expires : November :45:24 PM Default Gateway : DHCP Server : DNS Servers : NetBIOS over Tcpip : Enabled

What if DHCP doesn’t work? Check the cable. Is there a link light? VLAN setting OK in ONA? Linux firewall too secure? Call for help. WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

DNS Name lookup can fail, but network is OK Check your DNS resolver settings Look for stale host table entries Clear any DNS caching Check connectivity using IP addresses WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

Handy IP addresses to memorize (nameserver) (nameserver) ( Your favourite off-campus site WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

Resolver settings On *nix: /etc/resolv.conf On Windows: Run nslookup (or ipconfig) WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes! C:\Users\jatestart>nslookup Server: UnKnown Address: Non-authoritative answer: Name: info.uwaterloo.ca Address: Aliases:

Hosts Table *nix: /etc/hosts Windows: hosts or lmhosts somewhere under System32 directory Vista: drivers\etc\hosts Keep only ‘localhost’ definitions in there, otherwise should be empty WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

DNS Caching Caching to improve performance Windows: “ipconfig /flushdns” *nix: Do you have “nscd” running? WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

What if DNS doesn’t work? Is the network OK? Can you ping “ ”? Can you ping your fav site? (they allow ping, right?) If network OK, complain that DNS is broken. WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

General Network Problems: Things to look for WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

Gateway Need a gateway (router) to access the big bad Internet. Does the computer know it? If so, is it the correct one? Can you ping the gateway? Check all interfaces (wired & wireless) WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

Routing tables WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes! ~]$ netstat -nr Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface U eth U eth UG eth0 IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric On-link On-link On-link On-link On-link On-link On-link On-link On-link On-link ===========================================================================

Multiple default gateways? Disable all but one network adapter Wireless + wired can be problematic WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

No default gateway? Are you sure DHCP is working? Reboot. If problem persists, call for help. WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

Can’t ping the gateway? Use “arp” command to see if you have communicated. WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes! ~]$ /sbin/arp -an ? ( ) at 00:0D:ED:C0:1F:C2 [ether] on eth0 C:\Users\jatestart>arp -a Interface: xa Internet Address Physical Address Type d-2d-0a-37 dynamic e static e fc static

Client-Server Issues: Can’t access a specific service on a specific server? WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

What about that service? Does the service use UDP or TCP? What ‘port’ does the service use on the server? Is there a specific port used on the client? What’s the IP address of the server? WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

A word about ports WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes! Privileged ports (1-1023) Most Operating systems won’t let just anyone bind to privileged ports Notice most “servers” are on privileged ports? Ephemeral ports (typically ) Ports that clients bind to when talking to servers Ephemeral port range varies from OS to OS and may be customized

What’s connected? Need to be privileged On Windows: netstat –bn On *nix: lsof -i -a -n WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

netstat on Windows WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes! C:\Windows\system32>netstat -bn Active Connections TCP : :993 ESTABLISHED [thunderbird.exe] TCP : :22 ESTABLISHED [SshClient.exe]

lsof on Linux WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes! COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME ntpd 5250 ntp 16u IPv UDP *:ntp sshd 6337 root 3u IPv TCP *:ssh (LISTEN) sshd root 3r IPv TCP :ssh- > :49347 (ESTABLISHED) sshd jatestar 3u IPv TCP :ssh- > :49347 (ESTABLISHED)

Can you connect to the port? Use telnet to try connecting Example: telnet outcomes possible WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

Connected You’re in! If there’s a problem, it’s likely something other than the network WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

Connection Refused You can connect to the host, but it’s telling you the service is not there. Service is likely not running Could be “tcp-wrapped” or application access control Don’t blame the firewall! WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

Timeout Connection attempt is hanging, or timed out If you know your network is OK, and the server is OK, then something might be blocking you! Host-based firewall? IPSec Local Security Policy? Router ACL? Network firewall? WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!

THANK YOU Turning it over to Mike.... WatITis | Making the Future | December 2, 2008 | HALP! Something is my tubes!