arp -a
arp -s 10.1.1.50 00-0B-DB-AA-AA-AA
psloggedon \\10.1.1.50
nbtstat -a 10.1.1.50
Check DHCP
Run packet capture
Tuesday, 16 April 2013
Friday, 5 April 2013
tftp the config file off a cisco pix
TFTP'ing the config off an old PIX is a bit different
First setup your TFTP server:
#tftp-server inside 192.168.1.50 /pix-confg
inside - the interface to send the config out
192.168.1.50 - the IP address where I have a tftp server running (my desktop with tftpd)
/pix config - the destination file name
Run the TFTP
#write net 192.168.1.50:
First setup your TFTP server:
#tftp-server inside 192.168.1.50 /pix-confg
inside - the interface to send the config out
192.168.1.50 - the IP address where I have a tftp server running (my desktop with tftpd)
/pix config - the destination file name
Run the TFTP
#write net 192.168.1.50:
Thursday, 4 April 2013
How much RAM should I give my domain controller ?
I recommend installing physical and virtual DC’s.
The virtual DC’s should have the same resources as the physical
DC’s. This is in case your physical DC’s fail and your virtual DC’s have to
take over. Remember if you use virtual DC's time sync is really important so make sure you have NTP setup.
This documentation from Microsoft states that calculating the RAM requirements for a domain controller is complex because it will automatically adjust if it doesn’t have the required resources. However they recommend a basic plan to calculate the required RAM for domain controllers based on the following variables:
This documentation from Microsoft states that calculating the RAM requirements for a domain controller is complex because it will automatically adjust if it doesn’t have the required resources. However they recommend a basic plan to calculate the required RAM for domain controllers based on the following variables:
Base OS RAM
requirement + NTDS.dit size + SYSVOL size + Windows applications + 3rd
Party applications
NTDS.dit file is in C:\windows\system32
SYSVOL can be found by going to start -> run \\domain.local\SYSVOL
NTDS.dit file is in C:\windows\system32
SYSVOL can be found by going to start -> run \\domain.local\SYSVOL
Have a look at the appwiz.cpl (installed applications), services.msc (that are started), the scheduled tasks and the process currently running on the system. Also look at users logged in by RDP do they leave MMC's open often ? You can visit 3rd party vendor sites or contact the support for the RAM requirements.
Once you have done your calculation round up to allow for some wiggle room. If your calculation comes out as 3.5 GB, round that up to 4 or 6 GB.
Sample calculation:
Base OS requirment - Windows Sever 2008 R2: 2 GB
NTDS.dit: 1 GB
SYSVOL: 1GB
Windows apps: 1 GB
3rd party aps: 1 GB
Total: 6GB
Sample calculation:
Base OS requirment - Windows Sever 2008 R2: 2 GB
NTDS.dit: 1 GB
SYSVOL: 1GB
Windows apps: 1 GB
3rd party aps: 1 GB
Total: 6GB
Thursday, 28 March 2013
Timekeeping best practices for Windows, including NTP
Taken from http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1318
Timekeeping best practices for Windows, including NTP (1318)
Thursday, 7 March 2013
Issues connecting a VPN between Juniper SSG and Sonicwall
I was trying to connect a VPN between a Juniper SSG and Sonicwall firewall.
Phase 1 came up ok but I kept getting this message:
Received a notification message for DOI 0 18 INVALID-ID-INFORMATION.
Juniper support says this usually means there is a mismatch in the proxy id or the phase 2 proposal. I confirmed with screenshots that both matched on the other side. I logged a call with Juniper and found we needed to set a further option "Local ID". This was because my Juniper is behind a NAT. It is behind another firewall. We need to fill in the local ID with the public IP address of the Juniper. This was strange because I have other VPNs with other vendors (Cisco/Juniper) and this option is not filled in yet the VPNs work. It may be a specific issue related to Juniper <-> Sonicwall VPNs.
GUI
The setting can be found under VPNs -> AutoKey Advanced -> Gateway
Edit the gateway that is having the issue -> Advanced -> Local ID
Fill in the Public IP address of YOUR firewall
CLI
set ike gateway "GWName-12-34-56-789" address 12.34.56.789 Main local-id "200.100.100.100" outgoing-interface "ethernet0/2" preshare "*********" proposal "pre-g2-3des-sha-86400"
Phase 1 came up ok but I kept getting this message:
Received a notification message for DOI 0 18 INVALID-ID-INFORMATION.
Juniper support says this usually means there is a mismatch in the proxy id or the phase 2 proposal. I confirmed with screenshots that both matched on the other side. I logged a call with Juniper and found we needed to set a further option "Local ID". This was because my Juniper is behind a NAT. It is behind another firewall. We need to fill in the local ID with the public IP address of the Juniper. This was strange because I have other VPNs with other vendors (Cisco/Juniper) and this option is not filled in yet the VPNs work. It may be a specific issue related to Juniper <-> Sonicwall VPNs.
GUI
The setting can be found under VPNs -> AutoKey Advanced -> Gateway
Edit the gateway that is having the issue -> Advanced -> Local ID
Fill in the Public IP address of YOUR firewall
CLI
set ike gateway "GWName-12-34-56-789" address 12.34.56.789 Main local-id "200.100.100.100" outgoing-interface "ethernet0/2" preshare "*********" proposal "pre-g2-3des-sha-86400"
Tuesday, 5 March 2013
investigating RAM, CPU or disk space alerts on linux servers
First establish what is alerting, RAM CPU or disk usage and connect to the server.
press shift P - sorts
processes by highest CPU usage
press shift M - sort processes by highest Mem usage
press u type a username and press enter - shows only processes for that username (press u and enter to bring them all back)
press r and enter the PID to re-nice a process - sets a process to a higher or lower priority (be careful)
press shift R - this will sort by PID (shift R again to change it back)
press c - shows full command that was used to launch the process
press k and enter the PID - will kill the selected process (be careful)
press q - will quit the top application
If the alert is for RAM usage
Connect to the server and run the "top"
command (type "top" and press enter)
Top is similar to taskmgr on windows.
Press Shift and M to sort the processes by highest mem
usage
The command "free -m" can also be useful for
seeing how much memory is used/free.
You can see which process is using up all the memory. What
user is running the process. You may need to contact the customer, application
or DB team to find out if this is expected and what the next step should
be.
If the alert is for CPU usage
Connect to the server and run the "top"
command (like taskmgr on windows)
Press Shift and P to sort the processes by highest CPU
usage
You can see which process is using up all the CPU. What user
is running the process. You may need to contact the customer, application or DB
team to find out if this is expected and what the next step should
be.
If the alert is for disk
space usage
Connect to the server and run the "df -h"
command.
This will show you the percent usage on each partition/mount
To get further infromation on reads/writes to that partition run
"vmstat -p /mount/point" for example "vmstat -p
/dev/sda2"
If we run the "df -h" command and we discover that /home
is at 95% usage. We can see what is using up all the space by using the du
command. First "cd /home". You can use the following du
command:
"du -sm * | sort -nr | head -10" this will give the
results in MB, sort them with the largest at the top and only show the top 10
results.
You can contact the owners of large files and ask them if they are
required. You may find that log files grow to a large size or backup files are
building up. Best practice is to set up a script to remove old files.
Before assigning to N&S you should complete the steps above. With the
information provided you should be able to resolve the tag. If not take screen
shots of your output and attach them to the tag.
More on using the top
command
press shift M - sort processes by highest Mem usage
press u type a username and press enter - shows only processes for that username (press u and enter to bring them all back)
press r and enter the PID to re-nice a process - sets a process to a higher or lower priority (be careful)
press shift R - this will sort by PID (shift R again to change it back)
press c - shows full command that was used to launch the process
press k and enter the PID - will kill the selected process (be careful)
press q - will quit the top application
Script to list largest directory or
files
Just copy the script below onto the server you want to
check
It will give you the top 10 directories and then the top files
in those directories
You may need to make it executable
#!/bin/bash
# This will give the user back a listing of the largest files/dirs on the system
# make some tempfiles
mktemp1="/tmp/mktemp1"
# get overall 10 largest dirs
du -sm /* |sort -nr |head > $mktemp1
echo "Directory size listings for " $(hostname -s)
echo "Run date: "$(date)
echo "All sizes on left are in MB"
echo " "
echo "/ dir size list"
cat $mktemp1
echo " "
# for the largest 5 of the above get the sizes in them
top5=$(head -5 $mktemp1 |awk -F " " '{print $2}')
for dir in $top5
do
echo $dir dir size list
du -sm $dir/* |sort -nr |head
echo " "
done
rm $mktemp1
exit 0
Tuesday, 26 February 2013
finding the time to live TTL on a DNS record in windows
If you need to find the time to live on a DNS record in windows you can click
start -> administrative tools -> DNS
Click View -> Advanced
Now right click on your record and click properties
The TTL will be displayed
Alternatively
nslookup -q=a -debug www.mydomain.com
nslookup -q=mx -debug email.mydomain.com
nslookup -q=ns -debug ns.mydomain.com
In linux you can use the dig command
start -> administrative tools -> DNS
Click View -> Advanced
Now right click on your record and click properties
The TTL will be displayed
Alternatively
nslookup -q=a -debug www.mydomain.com
nslookup -q=mx -debug email.mydomain.com
nslookup -q=ns -debug ns.mydomain.com
In linux you can use the dig command
Subscribe to:
Posts (Atom)