Wireshark Filtering

Posted on October 27, 2022 by admin

Filter to show DHCP packets

You can find detailed info here. https://wiki.wireshark.org/DHCP

But you should be able to filter out the DHCP request with either

dhcp

bootp

Filter by IP Address

ip.addr == 192.168.1.1

Filter by Mac Address

eth.dst == 01:00:5e:7f:ff:fa

Better way to Filter

Wireshark has a robust set of options for filtering items.

From the Packet Details pane you can select any piece of information you want to filter, right click -> Apply As Filter -> Selected

You can also copy it and then past it in the filter bar. Right click -> Copy -> As Filter

Get list of IP DHCP Leases from Mikrotik RouterOS Command Line

Posted on November 11, 2021 by admin

Sometimes it is nice to have a list of just the IP addresses and the hostname or mac address. Can be especially helpful when you are trying to get a list of devices to do a bulk update in LibreNMS. Helpful LibreNMS links for renaming and showing down devices

we are going to run the command to pull the DHCP information and then use Unix utilities to parse the data out.

Replace dhcp8 with the correct dhcp server in the mikrotik.

First, SSH into your Mikrotik router.

ssh user@mikrotik

Next we’ll want to go to the ip dhcp-server lease directory

/ip dhcp-server lease

Now we can run the following command to loop through and pull out all the info we need.
You can change the info like “mac-address” for something like “status”. You can use Tab to see what options are available. Just delete mac-address and hit tab twice.

:foreach i in=[find] do={ :put ([get $i address].",".[get $i mac-address].",".[get $i server].",".[get $i host-name ])}

Found the above helpful info from the following pdf file.

https://mum.mikrotik.com/presentations/PH18/presentation_5113_1516612695.pdf

Change IP Address for VMware ESXI Host from Command Line

Posted on September 29, 2021 by admin

We can use the the built in esxcli command to change the IP address for a server

First we need to get the interface name. We can get the info with the following command.

esxcli network ip interface ipv4 get

Name  IPv4 Address   IPv4 Netmas   IPv4 Broadcast  Address Type  DHCP DNS 
----  ------------  -------------  --------------  ------------  -------- 
vmk0  192.168.0.4   255.255.255.0  192.168.0.0     STATIC           false

The text in bold is our interface name.

Set the interface to pull DHCP

The following command will set the interface to use DHCP. If your interface name is different, then you will want to change that.

esxcli network ip interface ipv4 set -i vmk0 -t dhcp

Set a static IP

We can set a static IP address with the following command. Change the IP and Subnet for the appropriate IP address and Subnet.

esxcli network ip interface ipv4 set -i -I IP -N Subnet vmk0 -t static

Changes take affect immediately so you’ll need to re ssh into the server.

http://virtuallystable.com/2019/08/14/how-to-change-the-ip-address-of-an-esxi-host-via-esx-cli/

Ubuntu 16.04 Set Static IP address using Network Manager

Posted on October 12, 2020 by admin

Replace ens160 with the connection name. “vmcli con show”

sudo nmcli connection mod ens160 ipv4.method auto

Should be able to restart the networking service or reboot the server

Mikrotik RouterOS – VLAN notes

Posted on January 22, 2020 by admin

https://wiki.mikrotik.com/wiki/Manual:Interface/VLAN

VLAN successfully passes through regular Ethernet bridges

https://wiki.mikrotik.com/wiki/Manual:Basic_VLAN_switching

https://wiki.mikrotik.com/wiki/Manual:Layer2_misconfiguration

DHCP offering lease without success issue with Mikrotik on the far side of Ubiquiti device.

Make sure that radio does not have the VLAN configured on just the WAN interface. Easiest way would be to put it in bridge mode and use the management VLAN.

UniFi Cameras – configure static IP or DHCP from command line

Posted on January 8, 2020 by admin

The UniFi cameras are different then the AirMax line in how the configuration works. There is a “/tmp/system.cfg” file, but it does not contain most of the configuration option. In the default directory there are some files which appear to handle the device configuration.

The network configuration file is “ubnt_networkd.conf”

Edit the file by opening it up in vi or a different text editor.

Static IP config

{
     "cfgver": 2,
     "dhcp": {
         "fallbackIP": "192.168.1.20",
         "fallbackNetmask": "255.255.255.0",
         "status": 0  <-- 0=Static 1=DHCP
     },
     "dns": {
         "ns1": {
             "ip": "8.8.8.8",
             "status": 1
         },
         "ns2": {
             "ip": "4.2.2.2",
             "status": 1
         }
     },
     "routes": {
         "gateway": "192.168.5.1"
     },
     "statik": {
         "ip": "192.168.5.11",
         "netmask": "255.255.255.0"
     }
}

If you want to set the static address, you should be able to edit the settings in this config and leave DHCP status disabled.

DHCP config

To set the Camera to use DHCP, under dhcp change “”status”: 0″ to “”status”: 1″

{
     "cfgver": 2,
     "dhcp": {
         "fallbackIP": "192.168.1.20",
         "fallbackNetmask": "255.255.255.0",
         "status": 1
     },
     "dns": {
         "ns1": {
             "ip": "8.8.8.8",
             "status": 1
         },
         "ns2": {
             "ip": "4.2.2.2",
             "status": 1
         }
     },
     "routes": {
         "gateway": "192.168.5.1"
     },
     "statik": {
         "ip": "192.168.5.11",
         "netmask": "255.255.255.0"
     }
}

After the settings are applied the camera will use use DHCP regardless of the statik ip settings.

Save changes

Use the following command to write the changes to persistent storage

ubnt_cmd_persist.sh

And reboot the camera.

reboot

Camera should pull a DHCP address when it boots up

Ubiquiti set DHCP from command line

Posted on January 7, 2020 by admin

Edit the “/tmp/system.cfg”

Change the line that contains “dhcpc.status=disabled” to

dhcpc.status=enabled

add the following lines

dhcpc.1.devname=br0         
dhcpc.1.fallback=192.168.1.20
dhcpc.1.fallback_netmask=255.255.255.0
dhcpc.1.status=enabled

Save and exit and save changes

/usr/etc/rc.d/rc.softrestart save

Log into the GUI and verify everything looks correct. Under the network tab it was still showing that it had a static address, although it pulled a DHCP IP.

Linux, Send USR1 signal to pid

Posted on December 25, 2019 by admin

In Linux you can send signals to a process id to trigger actions for the program. Useful scenario for this is to renew an IP address on a device that uses udhcpc. You should be able to change udhcpc for other programs, you’ll just need to read the help for that specific program.

In the udhcpc help it says

Signals:
         USR1    Renew lease
         USR2    Release lease

But how do we send those signals to udhcpc? Answer, use the kill command.

kill: kill [-s sigspec | -n signum | -sigspec] pid | jobspec … or kill -l [sigspec]
     Send a signal to a job.

Send the processes identified by PID or JOBSPEC the signal named by SIGSPEC or SIGNUM.  If neither SIGSPEC nor SIGNUM is present, then SIGTERM is assumed. 

Options:   
-s sig    SIG is a signal name   
-n sig    SIG is a signal number   
-l        list the signal names; if arguments follow `-l' they are             
          assumed to be signal numbers for which names should be listed   
-L        synonym for -l 

Kill is a shell builtin for two reasons: it allows job IDs to be used instead of process IDs, and allows processes to be killed if the limit on processes that you can create is reached.
Exit Status:
Returns success unless an invalid option is given or an error occurs.

We see from above that we can pass a signal name in using the -s option.

So to send USR1 signal to udhcp we do the following

kill -s USR1 pid_of_udhcpc

Replace pid_of_udhcpc with the actual pid or use the following command to find the pid

kill -s USR1 $(pgrep udhcpc)

“pgrep udhcpc” prints the pid of the searched for process.

Helpful links
https://www.thegeekstuff.com/2011/02/send-signal-to-process/
https://www.linux.org/threads/kill-signals-and-commands-revised.11625/

Ubiquiti – Renewing DHCP client lease from command line

Posted on December 25, 2019 by admin

AirOS uses udhcpc for the DHCP client on Ubiquiti Radios. To renew the DHCP address you can kill the udhcpc process and it’ll automatically restart and get a new address.

Renew DHCP lease

Kill udhcpc with the following command.

killall udhcpc

Other info

Print info about the DHCP lease. May need to change “info.br1” to “info.eth0” or some other interface.

cat /etc/udhcpc/info.eth0

Example output.

XW.v6.2.0# cat /etc/udhcpc/info.br1 
u_interface="br1"
u_broadcast=""
u_subnet="255.255.255.0"
u_ip="10.93.0.10"
u_router="10.93.0.1"
u_dns="8.8.8.8 1.1.1.1"
u_hostname=""
u_serverid="10.93.0.1"
u_domain=""
u_leasetime=600
u_timestamp="1143249941"
u_started=1142593
u_pid=936
XW.v6.2.0#

Command arguments that udhcp is run with. Info was collected by running the “ps | grep udhcp” command. Note that the interface “eth0” can be different if the device is in bridge mode.

/sbin/udhcpc -f -i eth0 -s /etc/udhcpc/udhcpc -p /var/run/udhcpc.eth0.pid -h device_name

udhcpc help output

XW.v6.2.0# udhcpc --help
BusyBox v1.24.2 (2019-07-03 11:13:35 EEST) multi-call binary.

Usage: udhcpc [-fbqvRB] [-t N] [-T SEC] [-A SEC/-n]
        [-i IFACE] [-s PROG] [-p PIDFILE]
        [-oC] [-r IP] [-V VENDOR] [-F NAME] [-x OPT:VAL]... [-O OPT]...

        -i,--interface IFACE    Interface to use (default eth0)
        -s,--script PROG        Run PROG at DHCP events (default /usr/share/udhcpc/default.script)
        -p,--pidfile FILE       Create pidfile
        -B,--broadcast          Request broadcast replies
        -t,--retries N          Send up to N discover packets (default 3)
        -T,--timeout SEC        Pause between packets (default 3)
        -A,--tryagain SEC       Wait if lease is not obtained (default 20)
        -n,--now                Exit if lease is not obtained
        -q,--quit               Exit after obtaining lease
        -R,--release            Release IP on exit
        -f,--foreground         Run in foreground
        -b,--background         Background if lease is not obtained
        -S,--syslog             Log to syslog too
        -r,--request IP         Request this IP address
        -o,--no-default-options Don't request any options (unless -O is given)
        -O,--request-option OPT Request option OPT from server (cumulative)
        -x OPT:VAL              Include option OPT in sent packets (cumulative)
                                Examples of string, numeric, and hex byte opts:
                                -x hostname:bbox - option 12
                                -x lease:3600 - option 51 (lease time)
                                -x 0x3d:0100BEEFC0FFEE - option 61 (client id)
        -F,--fqdn NAME          Ask server to update DNS mapping for NAME
        -V,--vendorclass VENDOR Vendor identifier (default 'udhcp VERSION')
        -C,--clientid-none      Don't send MAC as client identifier
        -v                      Verbose
Signals:
        USR1    Renew lease
        USR2    Release lease
XW.v6.2.0#

Note that you can also send a signal to the PID of udhcpc and have it renew the address. To do that use the following command, replacing pidofudhcpc to pid of udhcp.

kill -s USR1 pidofudhcpc

or use the following command to find the pid for you.

kill -s SIGUSR1 $(pgrep udhcpc)

Ubiquiti AirMax – Set radio to use DHCP from command line

Posted on November 11, 2019 by admin

Gain access to radio via ssh

ssh ubnt@192.168.1.20

open up the /tmp/system.cfg

vi /tmp/system.cfg

Delete the following line. To move the cursor to the following line and type “dd” and vi will delete the whole line.

dhcpc.status=disabled

Add the following 5 lines. Hit “i” to enter vi insert mode.
br0 should be correct interface in most scenarios.

dhcpc.1.devname=br0          
dhcpc.1.fallback=192.168.1.20         
dhcpc.1.fallback_netmask=255.255.255.0
dhcpc.1.status=enabled      
dhcpc.status=enabled

Save the file by hitting esc and then “:wq” followed by Return/Enter

Save the config changes and reboot the radio so it pulls an address.

/usr/etc/rc.d/rc.softrestart save && reboot

Incredigeek

Tag Archives: dhcp