Create Interface Descriptions from CDP Neighbor Output

Most customers want interface descriptions on core switch ports that are connected to edge switches and edge switch ports that are connected to access points or other critical devices. When you are doing a green field design this is usually pretty easy and you can include the descriptions in your spreadsheet data and they are automatically inserted when you run the template.

But there are times when you are in the field and need to create a lot of descriptions. Doing this manually is tedious, time-consuming and error-prone. To work around this I wrote a simple Python script to create the interface descriptions. Here are the instructions to use it.

Quick Steps

Download the script from my Github page 

Log onto the switch and run

sh cdp ne det | i  Dev|Interface

This will display the device name and interface for each neighbor

Copy the output and save it in a text file called interface.txt in the same folder as the script

Run the script. This will output the code needed on the screen.
Note: this isn't a double click to run script, you need to run the script from the terminal or command line. If you want to double click to run it add
input('Press <ENTER> to continue') to the very end. Make sure the statement isn't indented, it should start at column 1. 

Copy the code and paste it into the switches 

Detailed Steps

If you haven’t used Github before don’t worry. It’s simple to download the script, just click the “Clone or download” button once you are on the page. 

Click the “Download Zip” link. If you have Git installed you can also copy the link and use git clone to download the file.

Log onto the switch you want to update.

Type sh cdp ne det | i Dev|Interface to display the neighbors and their interfaces

Copy from the first Device ID to the last interface

Paste this into a text editor and save it as interface.txt in the same folder as the script. If you don’t want DNS suffixes included do a search and replace before saving the file.

Run the script using python3 interface.txt. This will display the code needed to update the descriptions. Copy from the screen and paste into the switch.

mhubbard@1S1K-SYS76:~/Dropbox/Python/Scripts$ python3 interface.py 

Interface GigabitEthernet1/0/1

des < ISHS-IDFG-GDAT-G1 >

exit

Interface GigabitEthernet1/0/3

des < ISHS-IDFG-GDAT-G3 >

exit

Interface GigabitEthernet1/0/2

des < ISHS-IDFG-GDAT-G2 >

exit

Interface GigabitEthernet1/0/4

des < ISHS-IDFG-GDAT-G4 >

exit

Interface GigabitEthernet1/0/49

des < ISHS-6880X.sbc-district.local >

exit

That does it for this simple script, I hope you find it useful!

Remember - Automate or perish!

Using arp-scan to find an available IP address

If you are running Linux, as a VM or on hardware, there is a very useful tool called arp-scan written by Roy Hill. I have links in the reference section to several pages that have in depth articles on other ways to use arp-scan.

In this short blog I want to show you a simple way find an available IP address on a LAN. Most of this is taken from the Pentestmonkey blog in the reference section.

If you are connected to a LAN that doesn't have DHCP enabled you will need to manually assign one. But how can you be sure that the IP isn't actually in use? Running Angry IP or some other ping scanning tool won't list devices that have firewalls that block ping. The last thing you want to do is pick an IP address that conflicts with a critical piece of equipment.

The first step is to figure out what the LAN IP address scheme is if you don't know that. Fire up Wirehark and set the display filter to "arp". In a few minutes you should see an arp request from a device on the network. The IP address can be found in the info column. You won't know the mask  start with a /24. The arp-scan user guide has a section on determining the mask - Determining the interface netmask.

If you found this site on my Github page you should already have the python script I wrote. The script makes it easy to create the arp-scan commands. If you need to download the script click the GitHub link above. Save the arpscan.py file to a folder.

Once you run the script use the commands to find devices that didn't respond to ping. In the example below I have a Windows 10 VM with the firewall on and set to block all incoming packets. The IP address of the VM is 192.168.10.164. A ping fails and would make you think that 192.168.10.164 is available!

ping 192.168.10.164
PING 192.168.10.164 (192.168.10.164) 56(84) bytes of data.
^C
--- 192.168.10.164 ping statistics ---
116 packets transmitted, 0 received, 100% packet loss, time 115220ms

Now run arp-scan. In this case both 0.0.0.0 and 1.0.0.1 returned all the mac addresses on the network.
You can clearly see that 192.168.10.164 is in use and you can't assign it to your laptop.

sudo arp-scan -I eth0 --arpspa=1.0.0.1 192.168.10.0/24

Interface: eth0, datalink type: EN10MB (Ethernet)

Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)

192.168.10.13 64:52:99:69:fd:30 (Unknown)

192.168.10.20 c0:3f:d5:68:3c:cc (Unknown)

192.168.10.151 08:66:98:45:3f:86 (Unknown)

192.168.10.152 30:52:cb:20:3d:c1 (Unknown)

192.168.10.155 98:f1:70:7e:3f:6c (Unknown)

192.168.10.156 70:81:eb:55:23:a8 (Unknown)

192.168.10.157 84:b8:02:01:33:58 (Unknown)

192.168.10.158 04:db:56:ed:3d:58 (Unknown)

192.168.10.159 00:0c:29:99:43:b2 VMware, Inc.

192.168.10.161 00:0c:29:33:73:00 VMware, Inc.

192.168.10.164 00:0c:29:40:39:97 VMware, Inc.

192.168.10.165 00:1e:06:30:43:65 WIBRAIN

192.168.10.166 34:64:a9:03:33:f1 (Unknown)

192.168.10.167 b8:78:2e:08:23:05 (Unknown)

192.168.10.169 24:77:03:8f:f3:24 Intel Corporate

192.168.10.175 b8:8d:12:08:63:aa (Unknown)

192.168.10.221 00:0c:29:4c:a3:4e VMware, Inc.

192.168.10.239 10:1f:74:63:31:f8 (Unknown)

192.168.10.250 50:06:04:cb:83:40 (Unknown)

19 packets received by filter, 0 packets dropped by kernel

Ending arp-scan 1.8.1: 256 hosts scanned in 1.818 seconds (140.81 hosts/sec). 19 responded

127.0.0.1 returned three mac addresses.

sudo arp-scan -I eth0 --arpspa=127.0.0.1 192.168.10.0/24

[sudo] password for mhubbard: 

Interface: eth0, datalink type: EN10MB (Ethernet)

Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)

192.168.10.13 64:52:99:69:fd:20 (Unknown)

192.168.10.20 c0:3f:d5:68:0c:cc (Unknown)

192.168.10.167 b8:78:2e:08:28:05 (Unknown)

3 packets received by filter, 0 packets dropped by kernel

Ending arp-scan 1.8.1: 256 hosts scanned in 1.680 seconds (152.38 hosts/sec). 3 responded

References

arp-scan homepage

The science of safely finding an unused ip address

use arp-scan to find hidden devices in your network

Arp-scan User Guide

A Simple Python 3 Script for my Favorite nmap Scripts

There are a few nmap scripts I use all the time. I can't always remember the syntax so I wrote a simple Python 3 script to list them.

If an IP address is required you are prompted to enter one. You can put in any valid IP address or address range in nmap format. There is no error checking so if you put in an invalid address you will get an invalid script output.

If an SNMP community string is required you will be prompted to enter it. Again, there is no error checking so enter carefully.

Example Usage

Trouble shooting NTP on Cisco devices can be time consuming. The first step I take is to run the nmap script for ntp info. It quickly tells me if the ip address I'm pointing "ntp server" to is actually serving up NTP.

mhubbard@1S1K-SYS76:~/Dropbox/Python/Scripts$ python3 nmap3.py

0 Download Cisco Configs using SNMP
1 Checking Server Cipher Suites using ports 443, 465, 993 and 995
2 Display SSH fingerprint (Host Keys)
3 Troubleshooting DHCP with the NMAP Broadcast-DHCP-Discover script
4 Troubleshooting DHCP with the NMAP DHCP-Discover script
5 Troubleshooting IPv6 DHCP with a broadcast discover
6 Brute Forcing SNMP with NMAP - Requires a text file of guesses in c: ftp-root\snmp-string.txt
7 BACNET - scripts from https://github.com/digitalbond/Redpoint#enip-enumeratense
8 DNS Broadcast Discover
9 Banner Grab using banner-plus from HD Moore
10 NTP Monlist - Pull down NTP server information
11 NTP INFO - Pull down general NTP information
12 DNS Brute - Uses nselib/data/dns-srv-names for list of SRV records to try, nselib/data/vhosts-full.lst for hosts
13 SMB - Various scripts for SMB servers
14 SNMP on Windows
15 Basic Script Scan the -vv option includes more detail
16 SQL nmap --script smb-os-discovery.nse -p445 192.168.10.221
17 - Check for SSH V1


3.4.3 (default, Nov 17 2016, 01:08:31)
[GCC 4.8.4]


Input a number to select 11
Enter the IP Address 192.168.10.221
nmap -sU -p 123 --script ntp-info 192.168.10.221
mhubbard@1S1K-SYS76:~/Dropbox/Python/Scripts$ sudo nmap -sU -p 123 --script ntp-info 192.168.10.221

Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-19 18:23 PDT
Nmap scan report for 192.168.10.221
Host is up (0.0013s latency).
PORT    STATE SERVICE
123/udp open  ntp
| ntp-info:
|_  receive time stamp: 2017-03-20T01:23:57
MAC Address: 00:0C:29:4C:AA:4E (VMware)

Nmap done: 1 IP address (1 host up) scanned in 10.31 seconds

If you don't see a time stamp the server you are using won't work.

Environmental Monitoring Systems

Here is a more involved example. I do a lot of core switch and edge switch replacements. It's important to know if any Environmental Monitoring Systems (EMS) are in place. Choice 7 in the script will return each of the Digital Bond ISC nmap scripts. Luckily most of my customers have a dedicated EMS vlan so I just scan that vlan.

BUT, I have found EMS devices on GUEST networks (oops!) and on user LAN segments so you may need to scan a lot of networks.

Since there are a lot of different EMS vendors the script outputs 11 different nmap scripts.

mhubbard@1S1K-SYS76:~/Dropbox/Python/Scripts$ python3 nmap3.py

0 Download Cisco Configs using SNMP
1 Checking Server Cipher Suites using ports 443, 465, 993 and 995
2 Display SSH fingerprint (Host Keys)
3 Troubleshooting DHCP with the NMAP Broadcast-DHCP-Discover script
4 Troubleshooting DHCP with the NMAP DHCP-Discover script
5 Troubleshooting IPv6 DHCP with a broadcast discover
6 Brute Forcing SNMP with NMAP - Requires a text file of guesses in c: ftp-root\snmp-string.txt
7 BACNET - scripts from https://github.com/digitalbond/Redpoint#enip-enumeratense
8 DNS Broadcast Discover
9 Banner Grab using banner-plus from HD Moore
10 NTP Monlist - Pull down NTP server information
11 NTP INFO - Pull down general NTP information
12 DNS Brute - Uses nselib/data/dns-srv-names for list of SRV records to try, nselib/data/vhosts-full.lst for hosts
13 SMB - Various scripts for SMB servers
14 SNMP on Windows
15 Basic Script Scan the -vv option includes more detail
16 SQL nmap --script smb-os-discovery.nse -p445 192.168.10.221
17 - Check for SSH V1


3.4.3 (default, Nov 17 2016, 01:08:31)
[GCC 4.8.4]


Input a number to select 7
Enter the IP Address 10.23.200.0/24
nmap -sU -p 47808 -n --script bacnet-info.nse 10.23.200.0/24
nmap -sU -p 47808 -n --script BACnet-discover-enumerate 10.23.200.0/24
nmap -sU -p 47808 -n --script BACnet-discover-enumerate --script-args full=yes 10.23.200.0/24
nmap -p 44818 --script enip-enumerate 10.23.200.0/24
nmap -p 1911 --script fox-info 10.23.200.0/24
nmap -p 502 --script modicon-info.nse -sV 10.23.200.0/24
nmap -p 9600 --script omrontcp-info 10.23.200.0/24
nmap -sU -p 9600 --script omronudp-info 10.23.200.0/24
nmap -p 1962 --script pcworx-info -sV 10.23.200.0/24
nmap -p 20547 --script proconos-info -sV 10.23.200.0/24
nmap -p 102 --script s7-enumerate -sV 10.23.200.0/24
sudo nmap -sU -p 47808 -n --script BACnet-discover-enumerate 10.23.200.0/24
sudo nmap -sU -p 47808 -n --script BACnet-discover-enumerate --script-args full=yes 10.23.200.0/24
sudo nmap -p 1911 --script fox-info 10.23.200.0/24
nmap -p 9600 --script omrontcp-info 10.23.200.0/24
sudo nmap -sU -p 9600 --script omronudp-info 10.23.200.0/24
nmap -p 1962 --script pcworx-info -sV 10.23.200.0/24
nmap -p 20547 --script proconos-info -sV 10.23.200.0/24
sudo nmap -p 102 --script s7-enumerate -sV 10.23.200.0/24
sudo nmap -p 44818 --script enip-enumerate 10.23.200.0/24
sudo nmap -p 502 --script modicon-info.nse -sV 10.23.200.0/24
mhubbard@1S1K-SYS76:~/Dropbox/Python/Scripts$

The Script

You can download the script on github at nmap-python

Southern California Linux Expo Scale 15x

I decided to go big this year, get a hotel and make the most of the Southern California Linux Expo or Scale 15x. This is the fifteenth Scale and the second year that it has been in Pasadena. The conference opened on Thursday March 2^nd and ran through Sunday March 5^th. Here is the home page for scale 15x if you want to review the show.

The talks are being uploaded to Youtube. It's odd but the title on youtube doesn't have the talk's name in it. You need to know what room the talk was in and what day it was given. I have a link to the daily schedules in the references below.

How did Scale 15x compare to Scale 14x?

Last year I only went on Saturday so I didn't get to do nearly as much. But my impression is that 15 was quite different. Last year the expo floor had several HAM radio and Maker booths along with a few local Linux Users Groups. In addition there were several booths with small projects dedicated to TOR and anonymity on the web. There was definitely a "Snowden" effect going on. HPE purchased 4 booths and had a huge group of products and people talking about them.

The Scale 15x expo floor seemed much more like a typical tech show. The only LUG I saw was the San Gabriel Valley LUG and I didn't see any Maker or Ham booths. But there were a lot more companies showing products. The expo floor was still excellent and well worth my time but it was a different feeling.

I wasn’t able to make the Thursday or Friday talks but I got there in time on Friday to pick up my badge and hit the expo floor. I purchased a System76 Gazelle last summer and love it. I went with the fastest i7 6700 processor, 16GB of RAM and a Samsung Evo 850 SSD. The laptop supports m.2 NVME drives but my wallet didn’t!

System76 was one of the first booths and I got to meet James from tech support and see the new Oryx Pro laptop. As always, I learned something new from James and loved the Oryx. It supports up to 64GB of RAM, two NVME drives and an NVIDIA 1060 or 1070 GPU. The GPU drives a beautiful 4k display. I definitely need to get an Oryx Pro!

I also spent some time at the Libre Office booth. A very nice guy demoed Draw for me. I obviously have Libre Office installed since I’m running Ubuntu but I hadn’t noticed the Draw application. It is well done and after a quick search he found several networking icon packs. I need to spend some time to see what all is available for Draw.

Gentoo had a booth and I spent a lot of time with them. I learned a lot about Gentoo (and Pentoo) that I think will be useful as I continue learning about Linux. Gentoo is a distro that does a minimal install and then you can add the packages you need. Sounds like a great distro for a couple older quad core Core Duo desktops that I have at home.

The big change though was the demographics of the crowd. There were still a lot of old gray beards but there were a lot of high school students. This wasn't just luck, the organizers made a push to get younger people involved.  

Speaking of Getting Involved

I attended Luis Hernandez's talk on “Open Source Role in Cyber Competitions” and it was great. Luis is working hard to get middle and high schools to start security classes. Here is a link to the description of his talk - Open Source Role in Cyber Competitions. The page has a PDF of his slides. If you have any spare time and want to help start a program at a local school please contact Luis.

Capture that Flag!

On Saturday,  the inaugural “Capture the Flag” event for the Cyber Patriot program was held. The first hour of the competition was hardening an Ubuntu system. The next section was based on the Facebook CTF and involved a lot of decrypting of coded messages.

Don't know anything about Linux?

That's no problem! There were full day classes on Saturday and Sunday for beginners. There was an installfest along with the training so you could bring your own older PC and get help installing Linux on it. See the references below for more information.

The Security Track   

Obviously this is the track I followed, who needs to know what Kubernetes is! Both Saturday and Sunday were filled with talks. I even scored a brand new Yubikey 4 at the “Hardening PGP keys with the Yubikey" talk. I have wanted a Yubikey for some time but just hadn’t bought one yet so I was very excited! I can’t wait to get my SSH keys setup and to start using it for 2 factor Authentication. Most of the cloud services that I use support the Yubikey for 2FA. Here is a link to the Security Track page.

Open Source Role in Cyber Competitions

As mentioned above, I sat in on a talk focused on getting IT security training set up in middle and high schools. The instructor, Luis hernandez, was very passionate and successful! He had students from North Hollywood HS that had successfully competed in national competition. Here is the summary from the talk - “The overall purpose is to show how Linux has helped prepare students for sysadmin roles in the real world as this is what they need to do during competition.” If you work in a school or have a desire to volunteer Luis would be the guy to contact!

The Web of Trust

I have had a PGP key pair for quite a while but never attended a key signing party before. Over thirty of us showed up after the expo on Saturday night and after a couple hours we each had verified everyone’s key fingerprint and two forms of ID. Now I have thirty signatures in my web of trust. It was a really cool thing to do and I met a lot of hard core Linux fans.

My HAM radio License

I have wanted to get my FCC HAM radio license for a couple years now but never took the time. I was a 2841 Field Radio Technician in the Corps and have a degree in electronics so I figured the technical part of the exam wouldn’t be too hard but the regulation part always scared me off.

At Scale the exam was being offered on both Saturday and Sunday but I hadn’t realized it so I hadn’t prepared. One of the guys at the Key signing party was member of the test staff. He encouraged me to download the guide from dc408 ham radio guide, study and take the exam on Sunday. It was already after 21:00 and it had been long day but I went back to the hotel and plowed through the guide. I passed the exam on Sunday!!

The Dark Arts of SSH

The last talk I attended was right after I passed my HAM license exam. I got there a bit early and there was a kid in the row ahead of me. He looked to be about 13 and was glued to his phone. I assumed that he was playing a game but it turns out he was studying for the Ham exam! Unfortunately it was too late to take the exam but he was preparing for next year!

This was a pretty good talk. I have been studying from Michael Lucas's great book “SSH Mastery” but I still picked up a few tips. I can't recommend SSH Mastery enough. It's $10 and Michael self publishes it.

What about Next Year?

Scale is a really good event. The ticket is $87.50 and the Howard Johnson hotel was only $125 per night so compared to a VMworld or Cisco Live it's practically free. Next year I hope to be able to take Friday off and go all day. This year I was too tired to go the the Friday after party, next year I'm making it is my goal!

References

• Scale 15x Homepage
• Security Track page
• Capture the Flag
• The Key Signing Party
• Beginner Linux Training at Scale
• Scale 15 Schedules