Converting Multicast to Unicast

In my previous blogtorial "Converting unicast to multicast" we discussed how to convert unicast to multicast and what the benefits are. Suppose that for one reason or another we had to convert from multicast to unicast -- how would we go about doing that? Well in this blogtorial we'll do just that.

Let's get started.

In this scenario, R2 will convert multicast coming in on Fast1/0 and convert it to unicast on Fast1/1.

Complete configs can be found here.

Enabling TCP TimeStamp Linux and Windows

I've had a couple of comments from my previous TCP TimeStamp - Demystified post about how to enable TCP TimeStamp option on different operation systems. Therefore, this is a follow up post on how to enable TCP TimeStamp option on Linux and Windows.

Since I am pro-Linux, we will start with Linux. 

Linux:

In Linux, TCP TimeStamp is enabled by default. You can check this by running this command. 

Converting Unicast to Multicast

Imagine that you had to do a presentation in front of an audience. Would it make sense to stand on a stage and give the presentation or sit with each individual and repeat the presentation multiple times? Well obviously standing on the stage and giving the presentation once to many audiences is much more efficient – this concept in networking is referred to as one-to-many multicast. One stream distributed to multiple receivers is just one of the advantages of running multicast on your network. If there are many receivers listening for one stream, there is no need for the server to send the same stream to multiple destinations – just use multicast.

But what if the server is running an outdated software and can not do multicast? No worries, today we are going to see how we can convert unicast into multicast. This blogtorial assumes that the reader is somewhat familiar with multicast concepts and configurations such RP, IGMP and PIM.

Here is our objective:

• Software BuiBui residing on Comp1 is sending unicast data.
• Instead of Comp1 wasting bandwidth and sending the same data to Comp4 (C4) and Comp5 (C5), we need to convert the unicast to multicast data and forward it to Comp4 (C4) and Comp5 (C5).

Consider the topology below and let’s get started.

Complete configs can be found here.

TCP Timestamp - Demystified

What controls you? Some may argue that it’s their jobs, their bosses or their parents but only a selected few will say time. In reality time controls all of us -- what/when/how we do anything is all dictated by time. We all understand how important time is and TCP is no exception which is why RFC 1323 implements a TCP option known as “TIMESTAMP”. This optional 10 byte (1B Kind + 1B Length + 4B TSVal + 4B TSecr) field allows us to time stamp at the TCP level which can be used for TCP RTT calculations and PAWS (Protect Against Wrapped Sequence numbers). I was curious about the TCP TIMESTAMP option so I took a packet capture to investigate it further. However, I was unable to determine how to interpret the fields or how to utilize it to calculate TCP RTT. So I did what most of you would have done – googled it. Much to my dismay, I couldn't really find anything other than RFCs and sites stating the same definition that is already published in the RFC. So I decided to write a blogtorial about it so my fellow searchers/googlers can easily understand on how to utilize TSVal and TSecr to calculate the TCP RTT.

Timestamp packet capture can be downloaded here.

Let’s get started.

Show run/copy run start on Cisco takes forever?

Are you frustrated that "Show run", "Show run interface <something>, "write mem" or "copy run start" is taking forever on Cisco routers or switches? Rest assure that you are not alone, there are many of us who feel your pain. It even takes longer to return these results on a system containing numerous lines in the running configuration. Why? Because the NVGEN process needs to query everything about your router and then output these results. It's painstakingly long especially when you are in the middle of troubleshooting something. 30 seconds may as well be 30 years. Not to mention that it almost results in a CPU spike sending false alerts everywhere and to everyone. To return the results of the aforementioned commands much faster enable the configuration performance enhancement by typing "parser config cache interface" in the global config mode.

Understanding TCP Window Size / Window Scaling

The easiest way to understand TCP Window size is to observe two people having a conversation. Every so often, the talker will wait for the listener to acknowledge that they have heard everything up to that point. Once the listener acknowledges then the talker begins to talk again. The amount of words spoken before waiting for an acknowledgement from the listener is much like the TCP window size. The official definition of the window size is "the amount of octets that can be transmitted without receiving an acknowledgement from the other side".

BGP - Maximum-path - hidden command

Two is better than one -- More is better or is it? Well I guess we can ruminate on semantics but I think we would rather see how we can implement equal cost multi-path (ECMP) routing using eBGP. By default BGP only installs THE BEST PATH after going through the BGP Bestpath selection algorithm (Cisco).

Consider the simple topology and let's dive in.

Complete config can be found here.

BGP - Configuring mBGP (Multicast BGP)

Do you influence or do you manipulate people to get what you want? What exactly is the difference? I mean in the end, you end up getting what you want right? Wrong, The difference lies in loyalty, if you influence someone then you get them to want to do what you want them to do. If you coerce or manipulate you may achieve short term success, however in the long term you will loose their trust and they will perceive you as someone who violated their trust rather than a leader. Therefore a great leader will influence others to achieve long term success. Although, sometimes you have no choice but to manipulate, for example my wife wants to influence me to do the dishes. Well that's just not going to happen -- she's never going to convince me that I want to do dishes, so she settles for manipulation :). Now that we've gotten my daily tidbit out of the way let's get into the topic at hand which is -- mBGP (Multicast BGP) not to be confused with Multi-protocol BGP which is used by MPLS, IPv6 etc.

Imagine you have Unicast Servers and Multicast Sources on the same network. Furthermore, imagine that you have 2 paths to reach that network, however you want to separate Unicast and Multicast traffic between different paths. How can we achieve this? Well there are a couple of options.

One, we can add static mroutes downstream or you could run mBGP and since the title of this blogtorial is configuring mBGP we'll choose the latter option. 

Consider this simple topology and let's get started. 

Complete configs can be found here.

BGP - Neighbor Allowas-in

My apologies -- It's been a while since I have posted, although I been pondering upon a few topics. I have been extremely busy with work, family, studies... -- Yes that's right I am going for my M.S in C.S :). In any case, enough about my boring personal life and excuses lets get into this action packed blogtorial. Here is a simple problem that I ran into the other night. I get a call from my colleague asking me if I would take a look and see why the routes from an eBGP neighbor are not being put into the routing table. After a couple of minutes of troubleshooting I pin-pointed the issue to a BGP loop prevention mechanism "called AS_Path: If you see your own AS in an update, drop it". Fortunately, there is a way to get around this in case we need to.

RFC 1771 

Section 9.3 states "If the local AS appears in the AS path of the new route being considered, then that new route cannot be viewed as better than any other route.  If such a route were ever used, a routing loop    would result."


To illustrate this in action, let's follow this simple topology.

Complete configurations can be found here.

Securing SSH - Tips & Tricks

Strong Usernames/Passwords
To most of us, this comes as a no-brainer.  To others, not so much...  Regardless, the strength of username/password combinations is extremely important.  If the password being used is a dictionary word or could be derived from the username, there may as well be no password at all...  Ideally, passphrases should be used.  A passphrase is just like a password except for instead of using a word, a phrase would be used.  Passwords and passphrases alike should also be mangled.

iPhone Home - Remote Access to iPhone

Often I have wanted a reliable way to access the contents of my phone remotely (incase I misplace my phone or if my phone gets stolen).  While there are other apps to determine the location of the phone, remotely lock or wipe, etc...  But I still want MORE!  So I decided to try this on my own.

Lets start by simply SSHing into the iPhone...  NOPE!  Wait, you mean to say that you can’t SSH directly into an iPhone connected only to mobile broadband? Yes, it’s sad but true.  Fortunately, we already know how to bypass those pesky firewalls using Reverse SSH!

By following the tutorial “Bypassing Firewalls - Reverse SSH Tunneling” the iPhone can be forced to phone home.  On jailbroken iPhones, this can be achieved manually by running the following command in the terminal or by running the script provided previously.  Currently, there is no way to accomplish such a task on a non-jailbroken device.

Configuring Cisco ZFW - Cisco Zone Based Firewall

The concept of Cisco Zone Based Firewall (ZFW) is very simple yet can quickly turn into a giant two headed dog if you don't understand how to design it. ZFW basically classifies interfaces into security zones and Intra-zone interfaces can pass traffic freely between each other however traffic between Inter-zone interfaces is restricted by default. A quick example can shed more light on this concept.

Consider the simple topology below and let's get started.
  

Configuring CBAC - Context Based Access Control

When it comes to security, I think you should always implement an actual firewall such as an ASA. However if you are a small business and you needed to get a stateful firewall up and running then Cisco Context Based Access Control is the way to go. It's lightweight, easy to configure and it gets the job done.

Consider this topology below and let's see how easily we can get it configured.

Configuring BGP - ORF (Outbound Route Filtering)

Outbound route filtering (ORF) in BGP reminds me of SPAM which I get in my mail everyday. Even though, I end up throwing (filtering) most of it away in the garbage, I still have to spend time looking at it, opening it and/or reading it which in turns wastes my time and my brain cycles. Wouldn't it be much more efficient if I can just tell the post office not to even send it? Well in BGP we can actually do this. We can tell our BGP neighbor what to filter-out before sending updates so we do not have to waste (CPU) time processing it. Ideally this would be implemented in ISPs peering so ISPs do not have to deal with customer requests on what needs to be advertised and what needs to be filtered.

For example, if you are BGP peered with an ISP and you had a route-map to filter all the routes except the default route, the ISP is still sending you the whole internet routing table and your CPU is processing the entire internet table before filtering it down to the default route.

Consider this topology and let's see how we can efficiently perform BGP filtering and conserve our router's resource.