Category: Network

ARP (Address Resolution Protocol) is the method for finding a host’s hardware address when only its IP address is known. ARP is a Link Layer protocol (Layer 2) because it only operates on the local area network.

When you migrate an IP from a VM or an hypervisor to another one, you can sometime encounter strange network problems (like no traffic received to this IP for a while). The cause of theses problems is that some network equipment (router or firewall) on the path have a ‘expired’ ARP entry in their cache.

Refresh ARP cache

For a GNU/Linux or BSD host, check the current arp table with arp -a.
Then purge the value with arp -d <hostname>

For Cisco iOS use show arp for checking arp table and clear ip arp <ip> to purge an entry.

For equipment you don’t have the hand on, the solution is a little more tricky. You need to broadcast from your VM the correct ARP ‘value’, in order to make the remote device invalidate its existing cache entry. For this use the arping command:

arping -S <ip> -B

In order to use a linux host as a router/firewall, you first need to enable IP Forwarding:

# sysctl -w net.ipv4.ip_forward=1

To make the change permanent insert or edit the following line in edit /etc/sysctl.conf:

net.ipv4.ip_forward = 1

Active and passive are the two modes that FTP can run in. FTP is kind of a weird protocol because it use two ports, one for the command channel (by default TCP 21) and one for actual data transfer (TCP 20). It’s a nifty way of sending commands to the server without having to wait for the current data transfer to finish, but it’s make thing pretty difficult when you have NAT and firewall on the way.

Active mode

In active mode the client connects from a random unprivileged port (N > 1023) to the server’s command port (TCP 21). Then the client starts listening to port N+1 and sends the FTP command PORT N+1 to the server. The server will connect “back” to the client’s specified data port from its local data port (TCP 20).

If both host are on the same network, this mode work great. If you have a firewall and/or a router on the way, that a different story. For a firewall/router it appear that an outside host is initiating a connection to an “internal” client which is generally forbidden. And even if it wasn’t forbidden, the router doing NAT doesn’t have any idea to which host forwarding the connection.

Passive mode

In passive mode the client is responsible for initiating both connections to the server, solving the problem of firewalls/routers filtering. It work like this: when opening an FTP connection the client opens two random unprivileged ports locally (N > 1023 and N+1). Then it contact the server on port TCP 21, but instead of issuing a PORT N+1 command it use the PASV command. In respond the server opens a random unprivileged port (P > 1023) and sends the port number back to the client. Then the client initiates the second connection from its second port (N+1) to the specified server’s data port (P).

Which mode should i use ?

Short anwser: passive mode. There are three reasons for that:

• pretty much everybody is doing NAT
• many people use their web browser as an FTP client, and browsers only support passive mode
• It’s true that passive mode opens up a whole new range of problems on the server side, but you are on the server side 😉

Further Reading and sources

• http://slacksite.com/other/ftp.html

Sometime people does changes on switches and forget to use the write command. Then you login, make your changes and before making wr tape the following:

show archive config differences nvram:startup-config system:running-config

Because you’re a conscientious admin 😉
Lines preceded with “+” are only found in the running-config. Lines preceded with “-” are absent from the running-config.

The route command is used to show/manipulate the IP routing table. It is primarily used to setup static routes to specific host or networks via an interface.

Display existing routes

# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.2.8.1        0.0.0.0         UG    0      0        0 eth0
10.2.8.0        *               255.255.252.0   U     0      0        0 eth0
10.10.16.0      10.10.32.53     255.255.240.0   UG    0      0        0 tun0

Change default gateway

# route del default
route add default gw 10.2.0.4

Add a route for a given network

route add -net 172.17.255.0/24 gw 195.54.62.1

Remove a route for a given network

route del -net 172.17.255.0/24 gw 195.54.62.1

Reject routing for a given network

route add -net 192.168.1.0/24 reject