Author: subnetwork

Filtering LLDP and CDP packets with Wireshark

I have written an update to this post, which can be found here. It has better information, better filters, and a better attitude.

We’ve all seen the picture of the IDF which looks like a tornado has ripped through it, with cables hanging everywhere. Generally there are two reactions. The type A people in the room shudder and wonder how anyone could work in that environment. The type B people shrug, and think about all of the ways that it could be worse.

Sadly, we don’t always have control of the cable management in the places we work. Whether it is a customer’s site, or we have managers that don’t care about organization, we will eventually find ourselves entangled in cable, trying to trace a wire from patch-panel to switch.

What if it was easier than that? Anyone who has ever had the pleasure of using a Fluke Optiview, knows that it happily displays CDP info right there on the home screen. The problem there exist when management sees the price point of a Fluke Optiview and begins laughing uncontrollably. There is a better cheaper way though!

With the proper Wireshark filters, it’s quite easy to find the port ID using either CDP or LLDP for those non-Cisco devices.

The best CDP Wireshark filter that I have found and used for years is this:

ether[12:2] <= 1500 && ether[14:2] == 0xAAAA && ether[16:1] == 0x03 && ether[17:2] == 0x0000 && ether[19:1] == 0x0C && ether[20:2] == 0x2000

Sadly, I don’t remember where I found this, to give credit, it was a long time ago.

For LLDP, I’ve found a much simpler capture filter that seems to work well:

ether proto 0x88cc

Yes, that is it. I found this on Wireshark’s website.

Hopefully, this will help you like it has helped me to identify ports without doing the IDF Tango.

Is Cisco getting back on track?

Cisco’s big-man-in-charge, John Chambers, sent out an email to all employees this week, which outlined a few important things:

-Cisco has lost focus
-Cisco was caught off guard by certain movements within the Networking community (openflow, new products from other vendors, etc)
-Cisco makes it difficult for new product to make it to market
-Cisco has to focus on the core business components, rather than continuing to diversify into low margin consumer markets
-Most importantly, Cisco shareholders, employees, and customers are not happy with the current direction that Cisco has taken

The message is a great read, and gives me hope that Cisco can get back on the ball, and address some of it’s core issues. Kudos to the Cisco team for taking a hard look at where they are, and making decisions to correct their wandering trajectory. Here’s hoping they follow through!

http://blogs.cisco.com/news/message-from-john-chambers-where-cisco-is-taking-the-network/

Microsoft meets the first snag in plan to purchase IPv4 addresses

As you should now be aware of, Microsoft is planning on hoarding purchasing a large huge block of IP addresses from Nortel. Now ARIN chief, John Curran, has made it clear that if the plan does not meet the current ARIN requirements for transfers, the IP address space can be reassigned. Here are a couple of relevant quotes:

Companies that are allocating their address to a third party can ask for compensation if they want to, he said. However, the acquiring party is required to show an immediate and appropriate need for the addresses, he said.

Existing transfer policies allow up to 12-months worth of address space to be transferred from one entity to another, he said.

So, that brings up the question, can Microsoft show a need for 666,000 in the next 12 months?

Link: http://www.computerworld.com/s/article/9215091/IPv4_address_transfers_must_meet_policy_ARIN_chief_says

Microsoft sets the price of IPv4 space post IPocalypse.

The resellers market for IPv4 address space has just heated up. Microsoft has puchased 666,624 IPv4 addresses from the burned out shell of Nortel for the tidy sum of $7.5 million dollars. That works out to a little over $11 per IP address. That’s pretty expensive when you consider how much Nortel paid originally. This also make me worry about how quickly prices will inflate on the remaining address space that is floating around out there.

On another note, I guess Microsoft realized that since they had built poor, if any IPv6 support into their products for so many years, they better make certain they have enough v4 addresses.

via http://downloadsquad.switched.com/2011/03/25/microsoft-buys-666-624-ipv4-addresses-from-nortel-for-7-5-milli/

RSA hacked? No, really.

In an open letter to customers, Art Coviello from RSA admitted that attackers had gained access to some of their internal information regarding the RSA SecurID products. While there was no customer information lost, it says that RSA is working with customers to provide “immediate steps for them to take to strengthen their SecurID implementations.”

I think I’ll go for a walk now…

Thoughts on the new job…

First, what were they thinking, hiring me?
Really, I’m a Cisco network engineer, with loads of Microsoft experience. Cisco wired, wireless, voice, security, you name it, I’ve done it. Microsoft NT, 2000, 2003, 2008, IIS, SQL, AD, yep, yep.

The new job:
HP.
Juniper.
Linux.

I haven’t felt lost in IT in a long time. I will say, I LOVE to learn new things, so I think I can become a very effective team member in short order.

Next, what a cool company!
From the Company Concierge, workout center, free drinks, masseuse appointments, to my own four walls and the “fun room”; everywhere I look I see things that make me laugh at my experience while working at Honda. I’m working with a strong team of individuals, who know what they are doing, and care about the future of the company. In fact, after working at Honda for 4 years, I’m not quite certain what to do: listen to the silence that comes with having a private office, or listen to PacketPushers, some other podcast, or even music * gasp* since I can do so without incurring the rath of those around me.

Finally, what I’m learning.
Luckily, I learn well under pressure. I’ll continue to post here about the things that I’m learning through these new challenges. Maybe I can help another Cisco or Microsoft engineer break free in the process.

For example, no matter what, DO NOT press CTRL+ALT+DEL while at a Linux machine to lock the station. This is not Windows.