RSS

Category Archives: Uncategorized

Capturing 802.11 management frames on Windows using Acrylic WiFi Pro

Studying for CWAP, I embarked on a mission to capture 802.11 management frames using my Windows laptop. For those with MacBooks that do this natively, read no further, just keep on perfecting that smug look of disdain with a slight hint of pity for the rest of us Microsoft peasants.

For those whose laptops aren’t fruit branded, but you still want to capture 802.11 frames in promiscuous mode, this is the post for you.  Especially if you can’t quite justify the cost an AirPcap adapter for study purposes.

While researching alternatives to pricey AirPcap adapters, I came across this Acrylic WiFi Professional post on their option for an NDIS driver. This driver allows you to capture in promiscuous mode, so you can capture all that management frame goodness, but without the AirPcap adapter.  I checked out the supported USB wireless options, ordered one off the list from Amazon (I picked the NETGEAR A6200), and downloaded a free trial of Acrylic WiFi Pro to get started.

The installation of Acrylic Pro is straightforward, as is turning on Monitor Mode when you know where to look. By default, Monitor Mode is turned off and the NDIS driver is not installed.  Just click the menu in the right corner, and select Change to get to the Monitor Mode settings.

mode

 

Select Monitor Mode On and select Install the NDIS driver.  You’ll get a warning message that you might crash your system and you’ll need to acknowledge that you are completely okay with this*.

NDIS warning message

 

Once the driver is installed you can swap over to the Packet Viewer using the icon in the top tool bar or by clicking Packet Viewer from the menu.  You will also see that you are in Monitor Mode and can select to change out of Monitor Mode if so desired.

Packet Viewer Window

 

While all of this is really super cool, I was extremely  interested in capturing these frames inside of my most familiar tool of packet sniffing choice, Wireshark.

Unfortunately, I didn’t see the NDIS driver as an available capture interface when I launched the Wireshark application. This post by Acrylic reminded me why. I needed to launch Wireshark with Run As Administrator, even though I am a local administrator on the laptop**.   Once I did this, I could select the Acrylic NDIS NETGEAR A6200 WiFi Adapter and start capturing wireless management frames.

Wireshark Capture Interfaces

 

I could also select the Wireless Toolbar in Wireshark and see that the NDIS driver emulating an AirPcap adapter.

wiresharkwirelessmenu

wiresharkwirelesstoolbar

 

Unfortunately, I still had one tiny problem at this point.  Every time I launched the Wireshark application, my built-in wireless card immediately quit passing all traffic. Not exactly ideal for productivity.

Easy fix, though, if you encounter this issue.  Head over to the settings for the Network Adapter, uncheck the Tarlogic NDIS Monitor Driver for the built-in adapter, and the problem is solved.

Change Adapter Settings

I would be remiss not to point out that there are limitations to this NDIS driver. For instance, there is no support for 40 or 80 MHz channels at this time.  But for my CWAP study purposes, this is working quite well and saves me a bit of cash.  Also, Ben Miller did a great write up on this very same subject, which, of course, I found just AFTER I went through this process and drafted this post. The universe has quite the sense of humor like that.

 

Published 2/7/2017

*Do this at your own risk, please don’t blame me for your system crash, there’s a good chance I’ll just point and laugh…

**If you need to know how to set a program to always run as administrator in Windows 10, look here.

 

 

Tags: , , , , , , , , , , ,

2016 Cisco Live, US – Geeks for life.

Putting together a wrap up post on Cisco Live US always makes me smile, and 2016 is no exception.  As many of you know, this CLUS marked 5 years since Tom and a small group of engineers first bonded over networking nerdiness and an addiction to 140 characters.

We’ve followed and helped each other through upgrades, outages, career changes, certifications, and a plethora of engineering challenges. We’ve commiserated with the suck that sometimes is our jobs, we’ve championed the hard-fought successes of our peers, and as a bonus, we’ve managed to provide an ever flowing stream of hilarious commentary along the way.

I’m thrilled to be part of a networking community that just keeps growing larger, and I’m continually impressed with the engineering talent this group represents.  I’m also pleased to have been part of Tech Field Day at CLUS as well, which continues to do an amazing job bringing great content and engineers together.

Just check out this awesomeness. Could there be anything better? No, no there could not.

 

Tags: ,

The 8945 firmware upgrade dance

For awhile now I’ve been hitting the fabulous issue mentioned in this Cisco forum post for 8945 phones in which the phone basically stops incrementing the time display. Being as I only had a few of these deployed and unplugging/plugging them would fix the issue, I had put off upgrading them. I had plan to put off upgrading the firmware until the proverbial upgrade cows came home and sat around my desk mooing their demands for attention, but unfortunately my plans were udderly derailed*.

I discovered while reading various release notes that the usually cumbersome but predictable upgrade process would be a bit more involved and would need to be done before I started major version upgrades, otherwise my phones would be shiny dialtone-less bricks with no usable firmware to make their happy little phone lives better.

Cutting to the chase, here’s what you have to do if you happen to be in the same series of release boats that I’m paddling around in.  Keep in mind that in this particular situation I am starting with 8945 phones with SCCP894x.9-2-3-5 installed and CUCM version 8.6.2.20000-2, your mileage may vary:

  • You must have the minimum Device Package 8.6.2(22030-1), which in this case I didn’t have. 8941 and 8945 phones won’t register at all if you try to install 9.3(1) or later without this device pack installed first. Yay.
  • Next, you’ve gotta do a step upgrade from 9.3(4) to 9.4(x) because in the grand tradition of voice upgrades being about as much fun as root canals, you can’t just upgrade straight from a 9.2 release to a 9.4 release. Double Yay.

There are a few key things to keep in mind when doing device pack and firmware installations.  First and foremost, always always always read the release notes. If something doesn’t seem clear or make sense, open a TAC case to clarify. This is way better than blowing up your server or phones because you assumed something the release notes didn’t cover or explain properly.

It should go without saying that you should always confirm you have a good backup before doing any file installations at all. I’m saying it anyway, check your backups, never assume they ran. Trust but verify, the emphasis being on verify.

Remember to copy down the values on the Device Defaults page before the upload of the files and to paste in old values if necessary directly after the upload. Check out this previous post for why you will thank me for this later.

Lastly, always remember to reboot after device package installs and to stop/start the TFTP service after firmware file installs.  These processes will save you some heartache and potentially a bruised skull from repeated head-desks when you finally realize you never did stop and start that service and the last 45 minutes of troubleshooting was for nothing.

*Anyone with a beef about my cow puns probably shouldn’t follow me on twitter either, the puns only get worse more fabulous from here… 

Published: 10/23/2014

 

Tags: , , , , , ,

You built a data center, out of a DeLorean?!

Big thanks to Juniper Networks not only for the opportunity to build my dream data center, but to build it out of Legos!  The contest to build the best Lego data center couldn’t have been more fun to participate in, now I shall show off my outstanding results!

Behold, the data center of the future! Make that the data center from the future!

IMG_3062

As you can see, my dream data center has full wireless access, comprehensive monitoring, and brings data center mobility to a whole new level.

IMG_3061

Fully stocked with Juniper gear and a top of the line Flux Capacitor, this data center means no more worrying about pesky outages & restores, it really can be like they never happened. Please use caution when implementing roll back features using the space-time continuum module, I take no responsibility should you make it like *you* never existed either…

IMG_3070

My dream data center is staffed with only the most qualified professionals willing to go out on a limb, literally, to meet customer demands.

IMG_3060

IMG_3052

And I can’t this of a better way to close this post than this image, note the next generation exhaust system solution, top of the line construction, and down right awesomeness factor!

IMG_3088

Please consider going green and purchasing the Mr. Fusion upgrade kit to assist in generating that required 1.21 gigawatts of power, clean energy is the future after all!

 
1 Comment

Posted by on 2013/10/23 in Uncategorized

 

The analog mixup…

While it is perfectly acceptable to have a shared line that is assigned to both a voip phone and an analog device, there is no guarantee things won’t get wonky.*  Let me demonstrate with a recent example I came across.

Users were reporting that occasionally when calling an extension they would get fast busy.  A quick look up in CUCM showed that the directory number was assigned to several phones and two ATAs. Cue huge sigh.  For those not familiar, ATAs all provide the excruciating pains of troubleshooting analog, in a tiny, fits-in-a-bread-box, device.

Immediately suspecting one of the ATAs, each connected to a classic 5.8 GHz cordless analog phone, I did a quick check to be sure the tiny boxes of evil darkness (TBEDs?) were registered. After confirming ports on both ATA devices were up basic settings in check, I decided my time would be best served with some log file collection.

For those who find themselves needing to examine CUCM trace files, I highly recommend Translator X.  It’s free, easy to use, and super helpful.  After looking through the Call Manager trace file results in Translator X, I could see clearly that each time the busy occurred, the call had been sent to one specific ATA, and logs showed a corresponding Disconnect Cause of “(47) Resource unavailable, unspecified.”

ATA

“Unspecified.” Yep, vague error messages are my favorite. Not able to find anything tangible in the CUCM configuration, I opted for an onsite visit.

My complicated troubleshooting plan was to just unplug the troublesome ATA and let the good times ring in.  After locating and confirming the MAC address of the ATA, I pulled the plug.  Like any good network/voice engineer, I started to make a test call to confirm whether I had indeed fixed the situation without breaking anything else – an art form we constantly strive to perfect.  Fully expecting that all would be well, I was quite disappointed when greeted once again by a fast busy.

Time to pull out Tippy.

photo1

Tippy, (yes, a reference to tip and ring, I am still that much a voice geek), happens to be my reliable test analog phone and every one should have a Tippy.  Reliable test equipment will save yourself time and sanity, and you should always be weary of results from equipment you haven’t base-lined.

Since Tippy and I go way back, I knew after making a successful test call with Tippy plugged into the ATA, that something was wrong with the cordless analog phone itself, or possibly in its wiring back to the closet.

I then found that plugging Tippy into the wall jack of the problem phone resulted in a successful call as well, so my conclusion was that the cordless phone at hand had shuffled off its mortal coil. I opted for moving the other cordless phone to replace the bad one, the models being identical and the other one being in a location that wasn’t being utilized.

Swap complete, time to test again, and still getting a fast busy. A girl cannot catch a break.

On a hunch, I decide to press the handset locator button on the cordless phone base station.  Oddly, the handset on the charger station in front of me was not the handset that was beeping.

Then it hit me, the users had mixed up the handsets.

The base station didn’t have a working handset, but was still alive and would take the call the ATA presented it, but the handset couldn’t communicate because it was around the corner, down the hall, and IN THE OTHER ROOM!

Like I said, wonky.

*Yes, that is in fact a technical term, just ask any voice (or former voice) engineer.  

Bonus material:
If you have never had to manage an ATA, (lucky you), you might not know that typically you can reach the ATA device via a web page by entering ://[the ip address]/dev.  You will see a web gui that I am certain was coded by a developer with absolutely no sense of web design. Seriously, not even a bit.

ATAConfig

Published 6/19/2013

 
6 Comments

Posted by on 2013/06/19 in Analog, ATA, Uncategorized

 

Tags: , , , , ,

Voice Girl Goes to Storage Day

Who has two thumbs and got to attend the last Tech Field Day?  This girl!

In case you don’t know what Tech Field Day is, go here and check it out:  http://techfieldday.com/   In case you don’t care what Tech Field Day is, I suggest you stop reading or make sure you have copious amounts of alcohol handy.  Actually, that last suggestion could improve the reading of any of my posts, so feel free to get started, you have my blessing.

Now, I’m sure we’ve all had that friend who goes on a vacation and brings back 10,000 pictures and insists on narrating them all in great, painstaking detail.  Fear not – I want to smack that guy as much as you do – so I will just be hitting the highlights of this expedition in this post.

So, without further ado, awesome thing number 1: hanging out with server admins.  I know, I know, for network and/or voice guys this hardly sounds like something that would make the list of awesome- unless that list were titled Ways In Which My Day Could Awesomely Suck – but it’s true and let me tell you why.

With roles in IT becoming less and less siloed, it’s clear us folks guarding the layer 2 and 3 keys to the castle are going to have to make nice with those folks rocking the upper layer data center knowledge.  As distasteful as that may initially sound to both parties involved, we all earn huge rewards.

Think about it- do you really want that server guy vMotioning all those production boxes across your precious WAN without any clue as to the implications?  I’m certain that server guy with the ponytail doesn’t want us well-intentioned network junkies screwing with SAN infrastructure when he/she thinks we don’t even know what random IO is. Of course do we do know what it is, but not the point…

Contrary to popular sysadmin belief, we network folks are capable of reading and do in fact know what a manual looks like.  Contrary to network admin belief, server guys do know what they are doing and don’t just break crap on purpose.  Given shrinking IT budgets, device consolidation, and technology overlap, our tiny sandbox has only gotten tinier and now it looks like we’re going to have to share the dump truck and not just the buckets.  (the dump truck was always my favorite)

So awesome thing number two:  presentations! Companies solving problems I was vaguely aware existed in ways I only wish I had imaged because retirement would be nice about now.  The quality of presentations was generally high and the technical level generally deep.  Perfect combination.

Let me offer a few brief take-aways from what I saw, you can catch the presentations here http://vimeo.com/groups/techfieldday:

  • Nutanix: Putting your VMs and storage on the same devices, have them utilize the same resources.  It has a kind of eggs in one basket feel – but the basket is really nice.  Interesting implications on the necessity for SAN administrator. http://www.nutanix.com/
  • Nasuni: If you ever want tips on how to deliver a presentation, watch this one. The send-your-files-in-the-cloud-and-see-them-at-your-other-sites product was wicked cool. Matt Simmons had the product up and running during the time of the demo. Sweet. http://www.nasuni.com/
  • Symantec Storage Foundation 6.0: Least favorite presentation style. So. many. power. point. slides. Clearly this product has some significant improvements over the previous version but the demo certainly wasn’t showing off this products nice curves, so to speak. http://www.symantec.com/business/storage-foundation
  • Data Direct Web Object Scaler: large-scale cloud storage wow-ness.  Keeping track of your massive amounts of cloud data using custom filing system to store and replicate data. Demo was super neat, product super fast.   http://www.ddn.com/products/web-object-scaler-wos
  • Pure Storage- all SSD storage, forget tiering.  They wrote their own software to talk/write to SSD drives in a way that makes SSD drives very happy. In fact, drives never fail for Pure Storage, or so was said- a concept our little group of skeptics had some trouble with. Pure Storage held to their guns though and a promise was made to tweet the first drive failure. http://www.purestorage.com/
  • Arista EOS:  Command line goodness. In the demo, the guy added the XMPP package to the Linux-based software running the switch, then chatted with the switch. Totally cool. Who doesn’t want to ask a switch how it’s day is going? http://www.aristanetworks.com/
  • SolidFire- All SSD storage, optimized for providers who want to limit compute and/or storage on a per customer basis. If you are a cloud provider of storage, being able to establish very specific SLAs for customers I’m sure is extremely appealing.  http://solidfire.com/
  • Arekia- backup goodness.  Presentation went into detail on their particular brand of deduplication which provides quite a lot of benefit when backing up large amounts of data. http://www.arkeia.com/

Last but not least, awesome thing number three: Stephen Foskett and Matt Simmons are freaking fantastic!  As the organizers, they coordinated every intricate detail and then made it look easy to the rest of us.  A very special thanks to those guys for making all of this happen, wishing them happy times in therapy as they attempt to recover.

For links to all things Tech Field Day 8: http://techfieldday.com/2011/tfd8/

 
3 Comments

Posted by on 2011/09/19 in Tech Field Day, Uncategorized

 

Tags: