Recently I tried editing my Cisco’s ACL at home on the train. It went something like this: I logged in I started updating the ACL I hit a blackspot in my 3g coverage My command stops at “router(config)#access-” I get an alert saying my home internet was down Although it is simple enough to just ask her to “flip the switch on the black box”, I still don’t like doing it. Plus, if she’s not home, I’m stuck. This accident immediately reminded me of one of a trait of the ‘reload’ command: it can be scheduled.

A normal internet connection gets attacked, a lot. The majority of attacks are of the form “hello, anybody there?” – where most people just don’t answer. But sometimes, just sometimes, the question gets an answer. Depending on the answer, the attacker will start to explore. A few weeks back I was a little bored and started fiddling. I wanted to play with my Cisco, but also wanted to play with OSSEC, but also has a GIS craving. In the end I decided to create a map of the people who ask, “hello”.

I’ve been side-tracked on another little project, and keep coming back to NetFlow. For this project I’ll need to access NetFlow data with Django, but this is a bit tricky. First, I’m sort of lazy when it comes to my own project; maybe not lazy, I just like taking the most direct route. The most up-to-date NetFlow collector I noticed was flow-tools, and there is even a switch to export the information into MySQL. Sweet! However, I wanted to insert the flows into MySQL automatically, or at least on a regular basis. I first started writing a python script that would do the job, but after a few minutes noticed flow-capture had a rotate_program switch, and started investigating. Since I somehow …

I’m always forgetting the exact string to enter at the CLI for updating the IOS on a wireless Cisco AP, so I’ll just put it here to end my future searches: Chimp# archive download-sw /force-reload /overwrite tftp://192.168.83.150/c1100-k9w7-tar.123-8.JEC1.tar 192.168.83.150 obviously being your tftp server, and the .tar file sitting in the root of the tftp server. I suppose if you wanted to backup your IOS you could do something along the lines of:

Information is power, or so many of us think. As an I.T. administrator, no matter what the level, it is of my opinion that knowing what your network is doing is important. This includes regular operation, what it could do in the event of a disaster, or when it is just slightly not functioning. Editor’s note: This 2006 post describes an old monitoring workflow at a high level. Identifying details are intentionally omitted or obscured.

The following sites might be helpful to configure IPSec again, or on a more complex basis: http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_60/ipsec/conipsec.htm http://www.cisco.com/warp/public/707/overload_private.shtml