Contents

Topics

• Network Administration Overview
• Obvious Things
• Configuring Hardware
• Configuring Software
• Managing Network Services
• Other Issues
• Configuration Utilities
• Routing in 50 Minutes

Assignment

Network Administration Overview

• System administration is becoming network administration
• Networks == TCP/IP for Unix
• Issues
  • Configuring interfaces - drivers, hardware interfacing
  • Configuring IP
  • Configuring name resolution
  • Configuring network services
  • Configuring security
  • Managing and troubleshooting network problems
  • Applications - NFS, FTP, HTTP, News

Assignment: On your machine (or any Unix host) execute the following commands, look at the man pages and try to figure out what is going on.
• /sbin/ifconfig -a
• /sbin/route -n
• /sbin/netstat -r
• /sbin/netstat -a
• /sbin/netstat -i
• /usr/sbin/arp

Obvious Things

IP Addresses

 
    0       7                       31
   |---------|-----------------------|
   |0  Net   |        Host           |  Class A
   |---------|-----------------------|

    0            15                 31
   |---------------|-----------------|
   |10    Net      |     Host        |  Class B
   |---------------|-----------------|

    0                     23        31
   |------------------------|--------|
   |110   Net               |  Host  |  Class C
   |------------------------|--------|

    0                               31
   |---------------------------------|
   |1110       Multicast Address     |  Multicast
   |---------------------------------|
   



• 0.0.1.1 - 127.255.255.254 = Class A
• 128.0.0.1 - 191.255.255.254 = Class B
• 192.0.0.1 - 223.255.255.254 = Class C
• 224.0.0.1 - 239.254.254.254 = Multicast
  
• All zeros for net or host means "this"
• All ones for net or host means all - broadcast

Getting an IP address

• www.internic.net - see DNS registration below

Network Submasks

• Ones in the mask represent the network part, zeros are the host part
• 255.255.248.0 = 11111111 11111111 11111000 000000
  turns the first 5 bits of the third byte into part of the network address for routers.
• For example, using 255.255.248.0

  Address	Binary Form	Network part
  153.90.192.5	10011001 01011010 11000000 00000101	10011001 01011010 11000
  153.90.195.5	10011001 01011010 11000011 00000101	10011001 01011010 11000
  153.90.199.5	10011001 01011010 11000111 00000101	10011001 01011010 11000
  153.90.200.5	10011001 01011010 11001000 00000101	10011001 01011010 11001

  
  

• In 153.90, there is room for 32 subnets, each with 2048 hosts, using an address mask of 255.255.248.0.

  Assignment

  • What is the network part of 163.12.167.34?
  • What is the network part of 163.12.167.34 if the subnet mask is 255.255.252.0?
  • Suppose a router has the following routing table:

    Subnet Address	Subnet Mask	Port A
    142.17.120.0	255.255.252.0	Port B
    142.17.124.0	255.255.252.0	Port C
    142.17.128.0	255.255.252.0	Port D

    Where will it send a packet with the destination address 142.17.126.18? Suppose the following entry is added to the table. What is the result and what does it mean?

    142.17.124.0	255.255.248.0	Port E

  • For the address space 153.90, devise a two level hierarchy where the upper level (level 1) has four major subnets, and each subnet can have 3 sub-subnets (level 2). What would be the subnet masks for each part of the network. Give an example of a router table for a level 1 and a level 2 router.

Domain Name System Names

• Scheme for storing and accessing IP Address/Name mappings
• Berkeley Internet Name Domain (BIND)
  
  

  Setting up a domain

  • Go to www.internic.net and then to one of the registrars, of which there are dozens.
  • Register the domain (e.g. dogbreath.com)
  • Provide the IP address of two primary domain name servers or the registrar may provide domain services for you.
  • Pay whatever they ask, possibly as low as $5 per year depending on the provider and services provided.

  Setting up a subdomain

  • Assign address space segments and names and set up domain name servers. For example, establish fleas.dogbreath.com as one of your subdomains and specify one or more domain name servers. One could be the primary for the dogbreath.com domain.

  Setting up a host

  • Assign and IP address and name. They must be unique over the connected network.
  • Put it into the domain name table.

  Assignment

Configuring Hardware

              |-----------------------|
              |     Kernel Code       | - read, write, open, etc.
              |-----------------------|
                        ^
                        |
                        V
              |-----------------------|
              |   Interface - device  | - network (char and block are others)
              |-----------------------| - eth0, lo0, etc.
                        ^
                        |
                        V
              |-----------------------|
              |       Driver          | - device specific
              |-----------------------|
                        ^
                        |   I/O Addresses, IRQ
                        V
              |-----------------------|
              |      Adapter          |
              |-----------------------|
   



• Lucky??? - install will add the drivers. On boot up, look for an indication that the system has found and configured your adapter.
  
• Unlucky??? - you will find the drivers and compile them into the kernel, rebuild the kernel and install it.
• Or, obtain the modules and install them.
  • devices in /dev
    • In /dev, MAKEDEV eth0 (interface to mknod)
    • eth0, eth1 - Ethernet cards
    • other systems vary widely
    • lo - local loopback, very important in debugging things
    • slX - slip serial line interfaces
    • pppX - ppp serial line interfaces
    • plipX - parallel line interfaces

Configuring Software

Selecting the IP Address

• For isolated networks or hosts
  • 10.0.0.0
  • 172.16.0.0 through 172.31.0.0
  • 192.168.0.0 through 192.168.255.0
• Go to your sysadmin, DO NOT JUST GRAB ONE or ping for one that's not in use.

Setup

• Lucky - already configured
• Unlucky or more than one card
  

  Interface Configuration

  • ifconfig interface/device options
    
  • ifconfig lo 127.0.0.1
  • ifconfig lo 127.0.0.1
    
  • ifconfig eth0 netmask 255.255.248.0 broadcast 153.90.255.255 153.90.199.47
    
  • Check it out with "ifconfig -a". Example
• ifconfig options (major ones)
  • ifconfig interface -- display the interface configuration
  • ifconfig interface options address -- to modify the configuration

    Option	Use
    -a	display all
    up/down	enable/disable
    mtu N	set interace MTU to N bytes
    netmask N	set the netmask
    broadcast addr	set the broadcast address
    pointtopoint	set point-to-point mode

  Configuring the Hostname

  • hostname [name]
  • dnsdomainname [domain]
  • nisdomainname [domain]

  Configuring DNS

  Configuring DNS is a matter of configuring the DNS resolver, which is a part of the standard internet library, and maps domain system names to ip addresses and vice versa. There are two files that are used to configure this process

  • resolv.conf

    This file provides the addresses of the name servers to use and some basic rules for performing searches. For example,

             domain cs.montana.edu
             search csnet.montana.edu
             nameserver 153.90.192.10
             nameserver 153.90.2.15
             

    • domain - what is the local domain
    • search - list of domains to search (up to 6) for a match
      This presents a problem performance and security-wise. It is best to limit this to local networks - e.g. coe.montana.edu and montana.edu.
    • nameserver - IP address of a nameserver; taken in order (up to 3)
  • host.conf

    This gives the resolver some specific information about how to perform the searches. For example:

             order hosts,bind   
             multi on           
             trim montana.edu
             

  • order = order to try various services (hosts, bind, nis); hosts only means no name services, just a hosts file.
  • multi = can hosts be multihomed (more than one IP address), so return all addresses.
  • nospoof on/off = thwart attempts to fake name/address mappings; it does this by doing a lookup and then a reverse lookup and comparing the results.
  • spoofalert - write a syslog message is anyone tries to spoof
  • trim string = remove the string from all addresses before looking in /etc/hosts. Multiple trims can be used so that multiple domains can be searched. This is not particularly good.

  Initial Routing

  • You will need some initial routing types of things to get started. Your local host knows by looking at addresses which things are local and which aren't. For example, if your local address is 153.90.192.1 and your netmask is 255.255.248.0, then 153.90.195.16 is a local address, but 152.90.204.10 is not. It can't handle remote addresses unless it has a gateway or default router to send them to. Examples
  • Use netstat -r to view the routing table.
    Example

    Flags

    • U = up
    • G = gateway route
    • H = host route
    • S = static route
    • D = redirect created route
  • Refs = current number of active uses for the route
  • Use = Number of packets sent

  Verifying That It Works

  • /sbin/ping ip-address
  • /sbin/ping localhost - will test the interface
  • /sbin/ping remote - will test gateway
  • /sbin/ping local - will test local network access

  Planning Subnets

  You can't just invent subnets and route to them arbitrarily. When performing the routing function, a host ands the netmask for a subnet with the address. If the result matches the entry in the routing table it sends it there. For example,

  /etc/hosts

  • Specific name-address mappings for hosts, routers, printers, etc. These are things you want to be able to find no matter what. For example,

          127.0.0.1       localhost
          153.90.199.40   harkin.cs.montana.edu       harkin local
    
          153.90.192.1    esus.cs.montana.edu         esus
          153.90.192.16   panda.cs.montana.edu        panda
          153.90.192.10   pdq.coe.montana.edu         pdq    # nameserver
          

  
  

  /etc/networks

  • Networks that you want to refer to by name rather than number in configuration and routing primarily.

          loopback     127.0.0.1
          localnet     153.90.192.0
          eps-lab      153.90.200.0      lab1 EPS999
          

  /etc/sysconfig/network

  This file is used to configure the basic information necessary to configure information at boot time. This is usually done automatically at install, or through linuxconf or netcfg.

  NETWORKING=yes	Enable networking
  FORWARD_IPV4=false	This host is routing or not
  HOSTNAME="bigtop.clowns.org"	What is the local name
  GATEWAY=153.90.192.254	What is the gateway
  GATEWAYDEV=eth0	What device connects to the gateway

  /etc/sysconfig/network-scripts

  A directory of scripts that provide data and logic for various parts of the networking configuration. ifcfg-eth0, ifup, ifdown

Managing Network Services

Typical Problems

• No network at all - check ifconfig, make sure the network device exists. Try pinging the localhost device (127.0.0.1) to see if it works. Maybe the kernel doesn't have the right software installed. If there's no device eth0 (or whatever) in /dev, create one. If its there, but doesn't show up under ifconfig, check /proc/devices to see if it shows up under netlink. If the device is there, try an ifconfig to see if it comes up.
• Local works, but nothing else. Check ifconfig. If not configured, do it now. If configured, try pinging with an IP address. If this works, but pinging a domain name doesn't, its a DNS resolver problem. Make sure that resolv.conf and host.conf are configured properly.
• If you can ping locally, but not off the local network, make sure you have a gateway set up. If not, add a default gw route.
• If the message is NO PATH TO ..., make sure you have a gateway (netstat -r).
• Can't get there from here. Some sort of network problem, maybe not local.
• If you have to reconfigure everytime you boot, check /etc/sysconfig/network and make sure that everything is properly configured.

Troubleshooting and just checking

netstat

Useful network activity analysis tool
• Options
  • -a - display socket state
  • -d - number of dropped packets
  • -H - current ARP table (like arp -a)
  • -i - ifconfig -a Example
  • -l - listening sockets Example
  • -M - multicast routing information
  • -o print timer information
  • -p - print program pid's Example
  • -r - routing tables
  • -s - statistics Example
  • -u - domain sockets
  • -z - zero the counters (root only)
  • --tcp Example
  • --udp
  • --ip
  • --inet (or -A inet)
  • --unix (or -A unix)
• Qualifiers
  • -c print continuously every second
  • -n print numeric addresses
  • -v verbose

traceroute

• traceroute [options] host [packetsize]
• Sends probe packets out to determine the route and time at each hop of a route.
• -m = max hops to live
• -n = use dotted decimal notation
• -p n = number of probes to send at each hop
• -r = skips normal routing and sends directly to a host on an attached network. e.g. an unrouted ping
• -s ip = use this ip rather than a host name
• -v = verbose
• -w t = sets the time to wait for a response

Examples

traceroute example

ripquery

Queries RIP gateways for their routing table. This has mostly been replaced by SNMP, the Simple Network Management Protocol.
• ripquery [options] gateway
  Requires access privileges to the router

tcpdump

tcpdump [options] expression
• Can help detect problems with local networks
• expression
  Which packets to dump - type direction protocol
  • type = host, net or port (default is host)
  • direction = src, dst, src or dst, src and dest
  • proto = ether, fddi, ip, arp, rarp, decnet, lat, sca, moprc mopdl, tcp or udp (default = ip, arp, rarp)
  • special = gateway, broadcast, less, greater
• options (partial)
  • -a = attempt to convert addresses to names
  • -c = exit after c packets
  • -e = print link level headers
  • -i = which interface if more than one
  • -l = show stdout line buffered, which is useful if you are trying to look at the data;

    tcpdump -l | more

  • -q = short printout
• Example Output
  • timestamp
  • interface
  • direction, > or <
  • host[.port]
  • protocol [(DF)] - DF = don't fragment
  • protocol specific data
• Examples

  Command	Action
  tcpdump -a dst host barnaby	dump all packets destined for host barnaby on the local network
  tcpdump -q src host barnaby	using the short format, dump all packets originating at host barnaby
  tcpdump -a ether src host barnaby.clowns.org	dump all Ethernet packets originating at the given host
  tcpdump dst net csnet.montana.edu - dump all packets with the given network as their destination
  tcpdump net 192.168.1.0 mask 255.255.255.0 - dump all packets that has a source or destination on the given network.
  tcpdump gateway gtway5.clowns.org - dump all packets that used the given address as a gateway.
  tcpdump port 80 - dump all packets that had a source or destination port that equalled 80.
  tcpdump src tcp - dump all packets that originated as icmp packets.
  tcpdump -q tcp and src net 192.168.1.0/255.255.255.0 - dump all packets that are protocol tcp and have the given source network

ethereal

Ethereal is a gui interface to tcpdump which can make it easier to perform the tasks you need analyze network traffic.

DNS Utilities

• nslookup [host or ip address]     - direct lookup
• nslookup     - interactive
  • host [server]     - lookup host on (optionally) server
  • server domain     - change the server to the authoritative server for the given domain
  • root -     - change server to the root server (ns.internic.net)
  • ls domain [option] [> filename]     - list domain
    • -t querytype     - specify the query type (A, CNAME, HINFO, MINFO, MX, NS, PTR, SOA, TXT, UINFO, WKS) A is the default.
  • set keyword [=value]     - change state information for lookups
    • all     - print current values
    • debug     - turn on debugging
    • domain=name     - set the default domain name
    • type=value     - set type of query (see querytype)

• dig @server domain query-type query-class

• server = the name of a domain server or ip address (optional)
• domain = dns name
• query type =
  • a = network address
  • any = all info
  • mx = mail records
  • ns = name server records
  • soa = SOA records
  • hinfo = Host info records
  • axfr = All records
  • txt = Text records
• query class =
  • in = Internet
  • any = any domain

• dig @153.90.2.15 esus.cs.montana.edu a in

  ; <<>> DiG 8.2 <<>> @153.90.2.15 esus.cs.montana.edu a in
  ; (1 server found)
  ;; res options: init recurs defnam dnsrch
  ;; got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6
  ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4
  ;; QUERY SECTION:
  ;;      esus.cs.montana.edu, type = A, class = IN
  
  ;; ANSWER SECTION:
  esus.cs.montana.edu.    1D IN A         153.90.192.1
  ;; AUTHORITY SECTION:
  cs.montana.edu.         1D IN NS        dns1.msu.montana.edu.
  cs.montana.edu.         1D IN NS        coesrv.coe.montana.edu.
  cs.montana.edu.         1D IN NS        dns2.msu.montana.edu.
  cs.montana.edu.         1D IN NS        terra.oscs.montana.edu.
  
  ;; ADDITIONAL SECTION:
  dns1.msu.montana.edu.   1D IN A         153.90.2.15
  coesrv.coe.montana.edu.  1D IN A  153.90.192.10
  dns2.msu.montana.edu.   2H IN A         153.90.2.80
  terra.oscs.montana.edu.  2H IN A  153.90.2.1
  
  ;; Total query time: 19 msec
  ;; FROM: harkin.cs.montana.edu to SERVER: 153.90.2.15
  ;; WHEN: Wed Nov  8 14:47:51 2000
  ;; MSG SIZE  sent: 37  rcvd: 223
           

• dig esus.cs.montana.edu
  Same as above
• dig @153.90.2.15 cs.montana.edu mx

     .
     .
  ;; ANSWER SECTION:
  cs.montana.edu.         1D IN MX        0 esus.cs.montana.edu.
     .
     .
           

A simple DNS lookup program:

host [-aCdlnrTwv] [-c class] [-N ndots] [-R number] [-t type] [-W wait] name [server]

name is the domain name to be looked up and server is the optional server to use.

Important Options:

• -c class = in for Internet class
• -t type = CNAME, NS, SOA, SIG, KEY, AXFR, etc.
• -a = all records

Other Issues

Configuration Utilities

redhat-config-network

linuxconf

Now disappearing from Red Hat distributions

Basic Client Networking



Adapter Configuration



DNS Configuration

Routing in 50 Minutes

Routing is normally not an issue, since it is usually handled by routers and not hosts. However, in some instances, you may have to set up a host as a router. This means that it has multiple network interfaces (LAN adapters, modems, T1, ATM or other connections.

The issues are:

• Configure the interfaces
• Select a routing method compatible with your neighboring routers
• Configure and set up the routing software

Assignment

1. Given that the netmask is 255.255.248.0, what is the range of addresses that your machine will see as local?
2. Use ifconfig to take your network connection down, and then use it to bring the connection up. Try some commands while it is
3. Delete the default gateway for your host and try to send a message to something off the local network. What happens? Then reinstall the gateway.
4. Think of a way that netstat could be used to measure network performance. Part of this might be figuring out how to extract the useful information, which we will discuss under shell programming.
5. Similarly, think of a way that netstat could be used to detect an intruder that is using a network socket to connect to your machine.
6. Check your DNS name resolver configuration and make sure that it is what you want.
7. Using dig and/or nslookup, try doing some lookups of sites on the Internet. For example, try:
   • dig selway.umt.edu
   • dig selway.umt.edu A
   • dig selway.umt.edu MX
   • dig selway.umt.edu SOA