Locate IP devices on the wrong vlan

When replacing switches, sometimes a device like a Building Automation Control (BACnet) controllers or fire alarm quits working. This is usually because they got patched into the wrong port and now the IP address doesn’t work.

Since these devices normally have static IP addresses and seldom send a packet outbound, their MAC addresses don't register on the switch. This can lead to lost time and aggravation trying to get them back online, especially if they are in a remote cabinet or a switch that is physically hard to reach. This blog will show a process to reduce the time needed to locate the port the device is connected to, so that the problem can be resolved.

Here are the steps to take before the cutover

On the core switch

 

First, ping all host addresses for subnets of interest on the core switch. This will refresh the arp cache so that devices like BACnet controllers and alarms that have timed out will be in the cache. To do that:

• Execute show run | i ^_ip address - The i means include, the ^ means start at the first character, the _ means look for one space, and ip address is the string to look for. This regex returns just IP addresses from the SVIs, not every instance of the string ip address.
• Copy the output to a text file named vlans.txt
• Run the python3 script pinger.py - You can download the script and read its documentation here. This script converts the subnet address into hosts and pings each host.
• Execute show ip arp
• Copy the output to a text file named arp.txt
• Run the python3 script arp.py - You can download the script and read its documentation here. This script creates a json database of the MAC address/IP address mappings and is used with the next script.

On each edge switch

• Execute show mac add int g1/0/1 | i Gi for each edge port on the switch.
• Copy the output to a text file named mac-addr.txt. I created a spreadsheet with the necessary commands for several Cisco models and Rukus (Brocade) switches. You can download it here.
• Run the python3 script macaddr.py  - You can download the script and read its documentation here.

The last step creates a listing of switch ports with the IP address, MAC address, Port and MAC Manufacture: 

Device Name: Test.MDF
Vlan   IP Address       MAC Address       Type       Interface   Vendor
--------------------------------------------------------------------------------
  16   172.16.16.9        0020.4adb.3e21    DYNAMIC    Gi1/0/5     Pronet
--------------------------------------------------------------------------------
  26   172.16.26.94       54ee.7505.86b5    DYNAMIC    Gi1/0/14    WistronI
--------------------------------------------------------------------------------
  23   172.16.23.117      5442.49a1.06c6    DYNAMIC    Gi1/0/47    Sony
--------------------------------------------------------------------------------
  20   172.16.20.153      000c.820d.007e    DYNAMIC    Gi2/0/24    NetworkT
--------------------------------------------------------------------------------
  20   172.16.20.96       0040.9d97.a3aa    DYNAMIC    Gi2/0/26    Digiboar
--------------------------------------------------------------------------------
  20   172.16.21.96       cc72.0fff.f6a5    DYNAMIC    Gi2/0/27    Viscount
--------------------------------------------------------------------------------
  20   172.16.25.96       0024.7900.095b    DYNAMIC    Gi2/0/30    OptecDis
--------------------------------------------------------------------------------

For this example, I have trimmed the list so it only shows devices that I know are static IP devices like Pronet which is a serial to IP device server, Sony, which in this case is a Surveillance camera, Digiboard which is a serial to IP console server, etc.  These are all devices that are critical to the company's operation and I want to make sure they work after the cut over. 

The macaddr.py script also creates a section with just the IP address and MAC address. Here is a snippet of it:

Device Name: Test.MDF
PingInfo Data
172.16.16.9 0020.4adb.3e21
172.16.26.94 54ee.7505.86b5

I take that information and save it to a text file named PingInfo-xxx, where xxx is something meaningful for the site. I use the text file with a free program PingInfoView from www.nirsoft.net to create a dashboard of live ping results. Below is an example of a PingInfo dashboard. PingInfo is Windows only!

PingInfoView continuously pings the addresses and any address that stops responding turns red. Obviously, we want all addresses to be green after the cut over!

After the cut over

The PingInfo dashboard should be all green. But what do you do if one of the static ip devices isn't live in the dashboard? Since many of these devices are Operational Technology (OT) versus IT they seldom send any traffic onto the network so immediately after a cut over the port they are connected to won't have a MAC address. If it got connected to a port on the wrong vlan you won't be able to ping it to populate the MAC address table.

There is a Linux tool called arp-scan by Roy Hill that you can use to send arp requests to a device. It can also send arp requests with an 802.1q vlan tag. This is the key to finding the lost device.

How to use arp-scan

 

Here is the network diagram for our example:

In my lab, I used a Kali VM to simulate an OT device. At a real customer site, you obviously wouldn't know what port the device is connected to.

First, you will need to install arp-scan on the Ubuntu box:

sudo apt install arp-scan

You can use arp-scan --help to see all of the options for arp-scan. It has a lot of uses, if you Google arp-scan examples, you will find a lot of good ones. I wrote a pyhton script that uses arp-scan to find open IP addresses on a subnet. It's useful when you need to connect to a subnet that doesn't have DHCP but you don't want to cause an IP address conflict. You can download it here.

To use arp-scan in our case, we need to know the interface on the Ubuntu box, the MAC address of the device (Destination MAC), the vlan ID of the switch port and the ip network the device is on. 

For the vlan ID, we select one from the vlans configured on the switch. You can use show vlan brief to see a list of vlans assigned to ports. If the switch has a lot of vlans defined you may have to run the command several times, iterating through different vlans.

In this example:

Linux interface - enp2s0f1
vlan ID - 46 (10.112.46.0/23)
Device MAC – 00:90:9e:9a:b5:3d
Device IP – 10.112.100.1
Device Subnet - 10.112.100.0/24

As you can see in the diagram, the simulated device is on port g1/0/48 which is configured as an access port on vlan 46. The Linux box with arp-scan is on a trunk port. The requirement here is that the trunk can pass vlan tags on vlan 46. 

It doesn't matter if the trunk has a native vlan with DHCP. Security best practices dictates that the native vlan nk on a trunk be an unused vlan. For our purposes, we don’t care if the interface has an IP address since we are using arp. You will see in the output that the IP address on the interface isn’t set.

Interface configuration for the Ubuntu laptop

sh run int g1/0/47
interface GigabitEthernet1/0/47
 switchport trunk encapsulation dot1q
 switchport mode trunk
end

On theUbuntu laptop connected to port g1/0/47

ip addr show enp2s0f1

 
2: enp2s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 80:fa:5b:31:de:85 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::6d35:51a0:cef:4475/64 scope link noprefixroute
       valid_lft forever preferred_lft forever

You can see that it doesn't have an IP address.

Interface configuration for the simulated device

sh run int g1/0/48
interface GigabitEthernet1/0/48
 switchport access vlan 46
 switchport mode access
end

SVI Interfaces

sh run int vl 46
interface Vlan46
 ip address 10.112.47.254 255.255.254.0
 ip helper-address 192.168.10.221
  no ip redirects
end

sh run int vl 100
interface Vlan100
 ip address 10.112.100.254 255.255.255.0
 ip helper-address 192.168.10.221
 no ip redirects
end

Run arp-scan

sudo arp-scan -I enp2s0f1 -Q 46 --destaddr=00:90:9e:9a:b5:3d 10.112.100.0/24
WARNING: Could not obtain IP address for interface enp2s0f1. Using 0.0.0.0 for
the source address, which is probably not what you want.
Either configure enp2s0f1 with an IP address, or manually specify the address
with the --arpspa option.
Interface: enp2s0f1, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
10.112.100.1    00:90:9e:9a:b5:3d    Critical IO, LLC (802.1Q VLAN=46)

1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9: 256 hosts scanned in 2.556 seconds (100.16 hosts/sec). 1 responded

You can see that arp-scan found the device by mac address and the device replied with its IP address.

Here is what it looked like in Wireshark on the Ubuntu box:

You can see that arp-scan sent 802.1q tag 46 even though I hadn't configured a subinterface on the Ubuntu box. I have a blog showing how to configure Ubuntu to use vlan tags. Here is a link to the blog - Bypass VTY access lists with Linux and Yersinia

Now on the switch, look for the mac address. 

sh mac add | i 0090.9e9a.b53d   
  46    0090.9e9a.b53d    DYNAMIC     Gi1/0/48

You can either move the device to the correct port or reconfigure the port for the correct vlan. If the customer allows it, I like to label this type of device's switch port like this:

des < BACnet 10.112.100.1 0090.9e9a.b53d>

That gives me the MAC and IP for future troubleshooting. 

Let's set up a lab to learn how to use arp-scan.

It's a simple setup, but there are few gotcha's if you are new to Linux or arp-scan. You will need a Linux machine, physical or virtual, and a Kali Linux virtual machine. The Kali VM will simulate our OT device because it is designed to be quiet on the network. The kali motto is "The quieter you are, the more you can hear".

We will use the same network layout as above so you can refer to that diagram.

On the Kali VM

Configure Kali with a static ip address. In this example:

10.112.100.1/24
255.255.255.0
NO GATEWAY - If you assign a gateway the Kali box will send ARP requests to the gateway and populate the switch's mac address table.

Connect the Kali VM to switch port g1/0/48

Check to see if the Kali box sent traffic that caused the switch to record it's MAC address:

sh mac add int g1/0/48                                               
          Mac Address Table                                                    
-------------------------------------------                                    
                                                                               
Vlan    Mac Address       Type        Ports                                    
----    -----------       --------    -----                                    
  46    0090.9e9a.b53d    DYNAMIC     Gi1/0/48                                 
Total Mac Addresses for this criterion: 1               

Kali did send some traffic and that populated the mac address table. For our purposes, we need to make sure the Kali box isn't sending any traffic. Normally, you do not want your pen test box to send traffic you didn't explicitly request. That is why Kali has DHCP and other services disabled by default. 

In this case, I had been using DHCP before switching to static so the dhclient service was still running.

On Kali run

ps -ef | grep dh
root      2500  2125  0 13:18 pts/0    00:00:00 dhclient -v

If you see the dhclient service, then run
dhclient -r


to stop the service. If you don't stop it, the dhclient service will do a discover which will populate the MAC-address table on the switch and invalidates the test we are about to try.

Next, run the following to clear the mac address on the switch port. Sometimes you need to run it a few times before the address is cleared.

clear mac address-table dynamic interface g1/0/48

Finally, you should see an empty mac table for interface g1/0/48

sh mac add int g1/0/48                        
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----

Try to ping the device

ping 10.112.100.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.112.100.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

Connect your laptop to port 1/0/47. I run the lldpd daemon (sudo apt install lldpd) so I can verify that the laptop is connected using the following.

sh lldp ne
Capability codes:
    (R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device
    (W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other

Device ID           Local Intf     Hold-time  Capability      Port ID
PROCURVE J9450A     Gi1/1/4        120        B               2
1S1K-SYS76          Gi1/0/47       120        B,W,R           80fa.5b31.de85

Total entries displayed: 2

Look at the interface that the laptop is connected to:

sh run int g1/0/47

interface GigabitEthernet1/0/47
 switchport trunk encapsulation dot1q
 switchport mode trunk
end

Look at the interface on the laptop after it's connected to the switch

ip addr show enp2s0f1 

2: enp2s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 80:fa:5b:31:de:85 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::6d35:51a0:cef:4475/64 scope link noprefixroute
       valid_lft forever preferred_lft forever

You can see that the interface is UP/UP but doesn't have an IP address.

Look at the SVIs

sh run int vl 46

interface Vlan46
 ip address 10.112.47.254 255.255.254.0
 ip helper-address 192.168.10.221
 no ip redirects
end

sh run int vl 100

interface Vlan100
 ip address 10.112.100.254 255.255.255.0
 ip helper-address 192.168.10.221
 no ip redirects
end

Now we are ready to run arp-scan and find the device:

sudo arp-scan -I enp2s0f1 -Q 46 --destaddr=00:90:9e:9a:b5:3d 10.112.100.0/24

WARNING: Could not obtain IP address for interface enp2s0f1. Using 0.0.0.0 for
the source address, which is probably not what you want.
Either configure enp2s0f1 with an IP address, or manually specify the address
with the --arpspa option.
Interface: enp2s0f1, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
10.112.100.1    00:90:9e:9a:b5:3d    Critical IO, LLC (802.1Q VLAN=46)

1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9: 256 hosts scanned in 2.556 seconds (100.16 hosts/sec). 1 responded

Verify that the mac-address table on the switch has been updated

sh mac add | i 0090.9e9a.b53d   
  46    0090.9e9a.b53d    DYNAMIC     Gi1/0/48

The tools on my Ubuntu 18.04 laptop

Update September 15, 2018: Ubuntu 18.04 has support for Snaps and Flatpaks. What are these? A new method for installing applications where everythimg is bundled into the package so you don’t have to deal with dependencies. I haven’t used Flatpaks yet but Snaps are great!  You go to https://snapcraft.io/store and find the app you want. Then you click a button, copy the link and paste it into a terminal.

So far I have used snaps for:

• Brave - A new browser that is much more privacy respecting than Chrome
• Corebird - A nice Twitter app
• fKill - Fabulously kill processes
• GHex - A graphical Hex editor from Canonical 
• Hiri - A Microsoft Exchange/Office 365
• Hollywood - Fill your console with Hollywood melodrama technobabble 
• KeepasXC - My preferred Keepas client
• Mailspring - A lretty good mail client for IMAP servers. I’m using it for gmail  
• Mumble - An open source voice chat client that is popular in Linux circles
• Notepadqq - A notepad++ like editor for Linux
• Powershell - Microsofts Opensource version of Powershel
• Skype
• Slack- The official Slack client
• Speedy Duplicate Finder - Blazingly fast duplicate finder for Windows, Mac and Linux
• Telegram - Official desktop client 
• Termius - A cross platform SSH client. I use it on IOS when I just need to make a few changes and don’t want to carry a laptop.

******************************************************************************

After the 2016 Southern California Linux Expo (SCALE15) I purchased a System76 Gazelle laptop. System76 sells laptop and desktops designed for Linux so there are no issues with drivers or hardware incompatibility.

I was thinking about buying a new Macbook to replace my aging Macbook Air but Apple dropped all ports except USB-C and that was just unacceptable for my work. Unlike the Macbook, the Gazelle has VGA, HDMI, three USB3-A, one USB2-A, Ethernet, and a full-size SD card slot.

Plus, System76 laptops are as open as you can get!  I purchased it with 8GB of RAM and a 250GB spinning disk. Not long after, I decided to go to 16GB of RAM and an m.2 NVME drive (The new Gazelle supports 32GB of RAM!). How hard was it? Removed a few screws, popped off the cover, added one 8GB stick, plugged in the NVME and reinstalled the cover.

I contacted System76 beforehand and they told me to buy the drive and RAM from Amazon because it would be less expensive than buying from them!!! That is great customer service.

I think the build quality is pretty good, I recently knocked it off the top of a 6-foot ladder. It was open at the time, the floor was concrete with a thin carpet. I didn't want to look at it. I was sure the LCD would be broken and there would be other damage. But it's been a week and I haven't noticed any damage, it's still working.

So, how hard was it switching from Windows/MAC to Linux?  Not much of a challenge actually. The Ubuntu 16.04 desktop uses the Super key (Windows key if you are on a Dell/Lenovo that you converted to Linux) to open up the search tool just like Windows. The file explorer, Nautilus, is very similar to Explorer in Window or finder in OSX.

What I am loving about Linux is no tracking of what I am doing, lots of free open source tools and updates happen almost daily. Updates seldom require a reboot and a typical update takes a few minutes, and if you do need to reboot there isn't a long delay with a message not to power off while the system is reconfigured.

I updated to Ubuntu 18.04 the week it came out. Normally I would do a nuke and pave because it’s so easy in Ubuntu.  Most of the configuration data for the apps is in your home folder so you back it up, nuke/pave and put the home folder back.  But I hadn’t been running 17.04 very long and just did an in place upgrade. It went off without any drama and now I’m using the Gnome desktop.

Ubuntu has decided to drop the Unity desktop and standardize on Gnome. I am loving 18.04, the Gnome desktop has been easy to transition to and 18.04 lets you setup the live update feature so kernel updates are automatic and you can postpone a reboot if one is needed. I installed the following Gnome extensions to replace functionality lost in the switch to Gnome:

Learning Linux

There are so many Linux sites with free tutorials and a lot of Kindle books for $.99 to $2.99. I had no problem finding answers to questions I had. Also, it seems that the old RTFM response om forums has gone away, I didn't get flamed anywhere! I purchased the Linux Professional Institute’s cert guide and took the Linux Essentials test. It’s not a system engineer level but I’m comfortable with the OS now.

I found the following podcasts for Linux and they have really helped my transition:

• Linux Unplugged
• The Ask Noah show
• Ubuntu podcast
• Linux in the ham shack
• Late Night Linux
• Linux Action News
• Destination Linux

The network stack on Linux is much better than Windows. You can create multiple network profiles and use them as needed. For example, I have a profile named Eth-DHCP that uses DHCP and one called Eth-con1 that uses static addressing.

It's easy to change the static settings and then just click it to use it. Another small advantage is that the boxes for IP, Mask, Gateway allow pasting. You don't have to type one octet, tab, next octet, tab, etc. And the gateway can be /24 or whatever you need.

Not earth-shattering, but if you change networks a lot it's more convenient. Plus, I haven't had issues changing networks many times per day. The stack just seems to work. It is much easier to query networks status than it is on Windows.

The tools iwlist, nm-tool, nmcli and ip let you quickly see what channels your wifi card supports, what SSIDs are available, what interfaces are up, the IP addresses, etc. This blog isn't going to go into how to use them but I do have a blog on some uses for the tools here.

Finally, you can do monitor mode captures without a special adapter like a Riverbed AirPcap. If you do a lot of wireless troubleshooting this is a big advantage.

The Tools

The great thing about Linux is all of the built-in and free open source networking tools.

Tools from the Ubuntu software store

Network Tools (gnome)- Graphical tool for ping, ifconfig, netstat, etc.

simplenote - free tool similar to Evernote.

PERL auto connect - SSH/RDP client. Install PAC-VS from the Ubuntu software store. This tool is really nice, you have RDP, SSH, Telnet all in one interface.

KeepassXC - A cross platform password manager. Supports Yubikey and other forms of two factor authentication.

unetbootin - Tool for creating live USB drives

FSLint - is a utility to find and clean various forms of lint on a filesystem, especially duplicate files and broken symlinks.

Disk Usage Analyzer - Similar to WinDirStat on windows. It's built into Ubuntu.

brasero - CD/DVD burner. I know, but my Gazelle has a DVD burner and occasionally I need to burn an archive.

cheese webcam - I use this with my Ebay.com endoscope for looking into tight spaces. An interesting story, I bought the scope and it said Windows only. I figured I would use it with my Windows VM.

When it came in it had a small CD with all Chinese on it. I used ClamAV to scan it and ClamAV found a virus. I plugged the Endoscope into the Gazelle and did an lsusb (list USB). It listed the endoscope and the hardware manufacturer. I did a quick Google and found an AskUbuntu.com post saying it is supported by the built-in Cheese webcam! No windows needed.

FBReader - eBook reader.

bleachbit - You too can be like Hillary.

Meld - A cross-platform file compare utility. I like it a lot better than notepad++ with the compare plugin

ClamTK - Graphical frontend for ClamAV.

shutter - A screenshot tool with rectangles, lines, etc. I have used the Windows Snipping tool for years and really like it. Shutter is even better. It can be used like MS Paint.net

etcher - A live usb tool. This tool is highly recommended in the Raspberry Pi and SoC communities.

smemstat - snap package memory tool.

Gnome Hex Editor - Inspect and edit binary files.

Remmina - Remote Desktop tool built into Ubuntu. Works great.

Tools installed from the terminal

Arpscan - A great tool from Roy Hill. Allows you to find devices that don’t respond to ping and much more. I wrote a Python wrapper for Arpscan. It’s on my github at https://github.com/rikosintie

https://github.com/royhills/arp-scan

Gnome Sushi file preview - Allows you to select a file in the file manager (Nautilus) and just press the spacebar to preview it. Install instructions are here - How to Geek

Docker - https://www.docker.com/community-edition

Clam AV - I use this to scan windows files before inserting a flash drive or running something on windows. Install from the synaptic package manager.

Python 2.7 - A fresh install of 18.04 doesn’t include Python 2.7, 3.x is now the default. 

Microsoft Visual Studio Code - A great open source IDE. Supports Python, Powershell and just about every other programming language.

https://code.visualstudio.com/

Microsoft Powershell Core - For those times when you need to pop a windows box but don’t want to fire up a Windows VM! Microsoft released PS Core as an open source project. I have to admit, it’s pretty convenient having Powershell native on Linux. 

https://blogs.msdn.microsoft.com/powershell/2018/01/10/powershell-core-6-0-generally-available-ga-and-supported/

FoxtrotGPS - I use this with my external USB GPS when I run wigle.net or want to track my trip on my laptop.

Sublime Text - $75.00 text editor. Has great support for Python. The site realpython.com sells a packege

sudo apt install minicom - Serial terminal emulator for use with USB to Serial adapters. It runs in the Linux terminal so it's very convenient.

sudo apt install smem - memory display tool

sudo apt-get install xsltproc - xml to html converter

sudo apt install traceroute - This is a legacy tool but I still like it.

sudo apt install gcc python-dev python-pip - Python installer and c compiler

sudo apt-get install xclip - copies files to the clipboard Ex. xclip -sel clip < ~/.ssh/id_rsa.pub

Hex editor - https://github.com/krpors/hx

Solaar - sudo apt install solaar - A tool for Logitech unify receivers.
https://github.com/pwr/Solaar

sudo apt install snmp - Allows you to run all the snmpget, snmpwalk, etc. tools

sudo apt install linssid - A tool similar to inSSIDer

sudo apt install aircrack-ng - Put wireless card into monitor mode.

sudo apt install apt-show-versions

https://www.insynchq.com/ - Google Drive sync tool.

Progress - Linux tool to show progress for cp, mv, dd, ... (formerly known as cv)
https://github.com/Xfennec/progress

sudo apt install apt-file - a software package that indexes the contents of packages in your available repositories and allows you to search for a particular file among all available packages.

sudo apt install cryptsetup - manage plain dm-crypt and LUKS encrypted volumes

sudo apt install procinfo - lsdev is installed with this.

sudo apt-get install network-manager-vpnc-gnome (Cisco VPN)

sudo apt install htop - an ncurses replacement for top. Has sorting capability.

sudo apt-get install joe - a super fast cli text editor. It can open and work with huge files. I use it for my password cracking dictionary files.

**************************************************
 IP Address calculator - Simple terminal program. Works great!
sudo apt install sipcalc

Example:
sipcalc 10.34.208.0/20
-[ipv4 : 10.34.208.0/20] - 0

[CIDR]
Host address - 10.34.208.0
Host address (decimal) - 170053632
Host address (hex) - A22D000
Network address - 10.34.208.0
Network mask - 255.255.240.0
Network mask (bits) - 20
Network mask (hex) - FFFFF000
Broadcast address - 10.34.223.255
Cisco wildcard - 0.0.15.255
Addresses in network - 4096
Network range - 10.34.208.0 - 10.34.223.255
Usable range - 10.34.208.1 - 10.34.223.254

*************************************************

Tool to locate files in the file system.
sudo apt install mlocate

run sudo updatedb after installing locate. It sets up the database and indexes all package files.

**************************************************
Moreutils - A small package with several useful utilities. See this page for more.
https://rentes.github.io/unix/utilities/2015/07/27/moreutils-package/#installing
sudo apt install moreutils

**************************************************
INXI is a great system information tool
https://github.com/smxi/inxi
sudo apt install inxi - inxi is a full featured CLI system information tool.
inxi -F -x -c13 -- all output with extra data
inxi -F -xx -c13 -- all output with extra, extra data
inxi -B -- Battery info
inxi -c13 -- use black output
inxi -C -- CPU information
inxi -D -- hard drive info
inxi -f -- all cpu flags
inxi -G -- graphics card info
inxi -i -- network interface info
inxi -I -- processes, uptime, memory, inxi version,
sudo inxi -m -c13 - list memory

********************************************************
LLDP client for Linux.
sudo apt-get install lldpd
sudo service lldpd restart
https://fnord.no/2016/04/28/lldp-on-linux/
Usage
lldpcli show neighbors

********************************************************
ssh-audit - A simple tool to pull down the crypto ciphers that an SSH server offers.
https://github.com/arthepsy/ssh-audit
usage: ssh-audit.py [-1246pbnvl]

-1, --ssh1 force ssh version 1 only
-2, --ssh2 force ssh version 2 only
-4, --ipv4 enable IPv4 (order of precedence)
-6, --ipv6 enable IPv6 (order of precedence)
-p, --port= port to connect
-b, --batch batch output
-n, --no-colors disable colors
-v, --verbose verbose output
-l, --level= minimum output level (info|warn|fail)

./ssh-audit.py 192.168.10.181

********************************************************
I-NEX - I-Nex is an application that gathers information for hardware components available on your system and displays it using an user interface similar to the popular Windows tool CPU-Z.
http://i-nex.linux.pl/install/

sudo add-apt-repository ppa:i-nex-development-team/daily
sudo add-apt-repository ppa:gambas-team/gambas3
sudo apt-get update
sudo apt-get install i-nex

********************************************************
sudo apt install sendip
SendIP is a command-line tool to send arbitrary IP packets.
http://www.ubuntugeek.com/sendip-tool-to-send-arbitrary-ip-packets.html

********************************************************
nmap scan report tool
https://blog.techorganic.com/2012/09/15/parsing-nmaps-output/
https://github.com/superkojiman/scanreport
https://github.com/superkojiman/onetwopunch

Example
cat targets.txt
192.168.81.171
192.168.81.182
192.168.81.143
192.168.81.119
192.168.81.190

nmap -sV -oG scan.txt -iL targets.txt
remove # from report
grep -v ^# scan.txt > report.txt

scanreport.sh -f report.txt
Host: 192.168.81.171 ()
22 open tcp ssh OpenSSH 5.3p1 Debian 3ubuntu4 (protocol 2.0)
80 open tcp http Apache httpd 2.2.14 ((Ubuntu))

Host: 192.168.81.182 ()
22 open tcp ssh OpenSSH 5.3p1 Debian 3ubuntu4 (protocol 2.0)
80 open tcp http Apache httpd 2.2.14 ((Ubuntu))
443 open tcp ssl|http Apache httpd 2.2.14 ((Ubuntu))

*************************************************************
Angry IP
http://angryip.org/download/#linux
dpkg -s ipscan_3.5.2_amd64.deb

**************************************************************
An extremely handy tool :: Incremental history searching
In terminal enter:
gedit ~/.inputrc
Then copy paste and save:
"\e[A": history-search-backward
"\e[B": history-search-forward
"\e[C": forward-char
"\e[D": backward-char

From now on, and many agree this is the most useful terminal tool, it saves you a
lot of writing/memorizing...

All you need to do to find a previous command is to enter say the first two or three letters and upward arrow will take you there quickly:

Say I want:

for f in *.mid ; do timidity "$f"; done
All I need to do is enter:

fo
And hit upward arrow command will soon appear.

*************************************************************************
Wireshark
On Ubuntu
sudo apt-get install wireshark libcap2-bin
sudo groupadd wireshark
sudo usermod -a -G wireshark $USER
sudo chgrp wireshark /usr/bin/dumpcap
sudo chmod 755 /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
(step 6 to make the interfaces visible)

*************************************************************************
Go language
sudo apt install golang-go

gotop - Another tool like htop
https://github.com/cjbassi/gotop

/home/mhubbard/bin/gotop
└─> $ ./gotop
************************************************************************
sudo apt-get install libncurses5-dev libncursesw5-dev
sudo apt install ncdu - an ncurses disk file display tool

************************************************************************
nmap 7.70
https://nmap.org/download.html

bzip2 -cd nmap-7.70.tar.bz2 | tar xvf -
cd nmap-7.70
./configure
make
sudo passwd root
Enter a strong password for the root user
sudo passwd -u root
to unlock the account
su root
make install
exit - logout as root

disable root account
sudo passwd -l root

Install HD Moore's banner-plus script
https://github.com/hdm/scan-tools/blob/master/nse/banner-plus.nse

*********************************************************

References
8 Ways to Maintain a Clean, Lean Ubuntu Machine
How To Make Gedit More Programmer Friendly

Upgrade Cisco 2960 firmware using SCP instead of TFTP

I recently needed to upgrade a couple dozen Cisco 2960-x switches located at several different sites. Obviously, I didn't want to drive to each site and insert flash drives to do the upgrade but I also didn't want to use TFTP and risk a failed transfer causing a reboot issue.

The solution was to use Secure Copy or SCP. Unlike TFTP, SCP is TCP based so you get the advantages of a TCP - Reliability, Flow Control, error checking and error recovery. SCP adds encryption. While encryption isn't so important for a firmware transfer it is important when transferring configurations so that the passwords aren't sent in plain text.

The drawback to SCP is that you need to set up an SCP server and create a username/password combination. For Windows, the Solarwinds SFTP/SCP server is free and works well. It supports secure FTP and secure copy protocols. You can download the server here. While free, it does require that you enter a valid email address. Once you have it installed, click on configure and create a new user/password.

On Ubuntu, you can use the OpenSSH server from the Ubuntu repository. For a How To on configuring the server click here.

Once you have the SCP server installed, download the tar file from Cisco and save it to the SCP servers root directory. For the Solarwinds server, the default is c:\sftp-root. For Ubuntu, you will specify the path after the IP address.

I recommend you check the hash of the firmware file after you download it from Cisco. To do that, simply click on the file name on the Cisco download page. You will see the MD5 hash on the popup, right click, copy and paste it into an editor.

On windows
From a cmd window run "certutil -hashfile <filename> -MD5.

Linux
From a terminal windows run md5sum <filename>.

Compare the result to the hash saved in the text file. If the hashes match, proceed to the next step.

On the switch

You will need to set up SCP first. See my blog Using Secure Copy (SCP) to Transfer Files for a tutorial on setting up SCP. 

Once that is complete, log in and go to enable mode.

Enter the following (substitute the appropriate IP address, filename, and credentials). The switch puts the password: prompt on the screen but the password will be passed automatically. Since I used the /reload switch no further intervention is required - the firmware will be upgraded and the switch will reload. You can kick off several switches in parallel as the load on the SCP server isn't too heavy. Using an Ubuntu desktop VM with the defaults set in ESXi I have upgraded 10 switches at once with no problems.

archive download-sw /overwrite /reload scp://mhubbard:hU9*b2Sis@192.168.10.221/c2960x-universalk9-tar.152-2.E7.tar
Password:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Password:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
examining image...
extracting info (109 bytes)
extracting c2960x-universalk9-mz.152-2.E7/info (786 bytes)
extracting info (109 bytes)

Stacking Version Number: 1.56

System Type:             0x00000000
  Ios Image File Size:   0x0144DA00
  Total Image File Size: 0x019ACA00
  Minimum Dram required: 0x08000000
  Image Suffix:          universalk9-152-2.E7
  Image Directory:       c2960x-universalk9-mz.152-2.E7
  Image Name:            c2960x-universalk9-mz.152-2.E7.bin
  Image Feature:         IP|LAYER_2|SSH|3DES|MIN_DRAM_MEG=128
  FRU Module Version:    No FRU Version Specified

References

Using Secure Copy (SCP) to Transfer Files
2960-X Switch System Management Command Reference, Cisco IOS Release 15.0(2)EX
Configuring Secure Shell (SSH)
Security Configuration Guide
10 SCP Commands to Transfer Files/Folders in Linux
Example syntax for Secure Copy (scp)