Db/2 LUW – Listening Port Using OS Tools

Background

Wanted to quickly review network ports that are being used by our DB/2 Instance.

Outline

  1. netstat
  2. lsof

Tools

netstat

Sample


netstat -anp | grep LISTEN | grep -i DB2

Output

netstat_linux_20181006_1141AM

lsof

Syntax


lsof

Sample – Usage


lsof -i | grep -i 'TCP' | grep 'LISTEN'

Output

lsof.linux.20181006.1201PM

Sample – Get Title


lsof 2>&1 | head -n 1

Output

lsof.linux.head.20181006.1159AM

Get Network Address using VBScript

Background

Like everyone else took a boat load of CISCO Networking classes.  Took night classes at the local community college.

Forgot about it.

But, then last week a Network Engineer asked me what is my network address and I just did not know.

Yes, I know how to issue ipconfig and get my IP Address and Subnet mask.

Or on Linux, issue ifconfig.

But, to think one step ahead and get the Network Address and CIDR, my mind just did not want to go down that step.

 

Code

Opportunity to code…

 

VBScript



REM *********************************************************************************************

'   1a) http://chris.wastedhalo.com/2014/05/more-binarybitwise-functions-for-vbscript/
    
'   2a) http://www.robvanderwoude.com/vbstech_network_ip.php

'   3a) http://powerasp.net/content/new/vbscript-constants.asp
    
REM *********************************************************************************************

option explicit

Dim strLog

Dim strIPAddress
Dim strIPSubnet
Dim strCIDR
Dim strNetworkAddress
    
Dim strAguments

Dim objAguments
Dim iNumberofArgs 


Const CHAR_PERIOD = "."
    
function getIPAddress

    REM *****************************************************************************
    REM Rob van der Woude's Scripting Page
    REM Win32_NetworkAdapterConfiguration
    REM http://www.robvanderwoude.com/vbstech_network_ip.php
    REM *****************************************************************************
    
    Const strQueryNAC = "select * from Win32_NetworkAdapterConfiguration where MACAddress > ''"
    Const WMISERVICE = "winmgmts://./root/CIMV2"

    Dim objWMISvc
    Dim  objRS
    
    set objWMISvc = GetObject(WMISERVICE)
    
    if objWMISvc is Nothing then
    
        strLog = "Unable to Get Object " & WMISERVICE

        WScript.Echo strLog

        WScript.Quit (-1)
    
    end if

    Set objRS  = objWMISvc.ExecQuery( strQueryNAC, "WQL", 48 )
    
    Dim objItem
    
    For Each objItem In objRS
    
        'IP Address
        If IsArray( objItem.IPAddress ) Then
        
            If UBound( objItem.IPAddress ) = 0 Then
            
                strIPAddress = objItem.IPAddress(0)
        
            Else
            
                strIPAddress = Join( objItem.IPAddress, "," )
            
            End If
        
        End If

    
        'IP Subnet
        If IsArray( objItem.IPSubnet ) Then
        
            If UBound( objItem.IPSubnet ) = 0 Then
            
                strIPSubnet = objItem.IPSubnet(0)
        
            Else
            
                strIPSubnet = Join( objItem.IPSubnet, "," )
            
            End If
        
        End If
        
    Next
    
    
    
end function

'*******************************************************************************
'*     bitMask(BitNumber)
'*         Returns a number with all bits set to 0 except for the specified bit
'*     http://chris.wastedhalo.com/2014/05/more-binarybitwise-functions-for-vbscript/
'*******************************************************************************
Function bitMask(pBit)

    If pBit < 32 Then 

        bitMask = 2 ^ (pBit - 1) 
    
    Else
    
        bitMask = "&H80000000"

    End If
    
End Function



Function Dec2Bin(pValue)

    '*************************************************************************************
    '*     Dec2Bin(AnyNumber)
    '*         Returns a string representing the number in binary.
    '*     http://chris.wastedhalo.com/2014/05/more-binarybitwise-functions-for-vbscript/
    '*************************************************************************************
    Dim TotalBits, i
    
    strLog = VarType(pValue)
    
    Select Case VarType(pValue)
        
        Case vbLong: 
            TotalBits = 32
 
        Case vbString: 
            TotalBits = 32
 
 
        Case vbInteger: 
            TotalBits = 16
        
        Case vbByte: 
            TotalBits = 8
        
        Case Else: 
        
            strLog = "In Function Dec2Bin:: Value passed is " & pValue & vbCrLf
            strLog = strLog + "VarType(pValue) :- " & CSTR(VarType(pValue)) & vbCrLf

            Wscript.Echo strLog
            
            Err.Raise 13 ' Not a supported type
    
            WScript.Quit
            
    End Select

    For i = TotalBits to 1 Step -1
    
        If pValue And bitMask(i) Then
        
            Dec2Bin = Dec2Bin + "1" 
        
        Else 
        
            Dec2Bin = Dec2Bin + "0"
        
        End if
        
    Next

End Function

Function countSpecficChar( strText, chChar)

    Dim iPos
    Dim iLen
    Dim iCharFound
    Dim iCount
    Dim chCharAtPos
    
    iPos = 1
    iCount = 0

    iLen = len(strText)
    
    for iPos = 1 to ILen

        'Get character at position
        chCharAtPos = mid(strText, iPos, 1)

        if (chCharAtPos = chChar) then
        
            iCount = iCount + 1
            
        end if
        
    Next
    
    countSpecficChar = iCount

End Function
    
function getCIDR(strIPSubnet)

    Dim objArr
    Dim strNumber
    Dim iNumber

    Dim strNumberBin
    

    Dim iNumberofOnes
    Dim iNumberofOnesTotal
    
    objArr = Split(strIPSubnet, ".")

    iNumberofOnesTotal = 0
    
    
    for each strNumber in objArr
    
        iNumber = CInt(strNumber)
        
        strNumberBin = Dec2Bin(iNumber)
        
        iNumberofOnes = countSpecficChar(strNumberBin, "1")
        
        iNumberofOnesTotal = iNumberofOnesTotal + iNumberofOnes
        
    next

    getCIDR = iNumberofOnesTotal
    
end function


function getNetworkAddress(strIPAddress, strIPSubnet)

    Dim objArrIPAddress
    Dim objArrIPSubnet

    Dim iIPAddress
    Dim iIPSubnet
    
    Dim strNetworkAddress

    Dim id
    
    Dim idLowerBound
    
    Dim idUpperBound
    
    Dim strLogicalAND
    
    strNetworkAddress = ""

    'Split Numbers into Array   
    objArrIPAddress = Split(strIPAddress, CHAR_PERIOD)
    objArrIPSubnet = Split(strIPSubnet, CHAR_PERIOD)

    id = 0
    
    'Get Number of Octets
    idLowerBound = LBOUND(objArrIPAddress)
    idUpperBound = UBOUND(objArrIPAddress) 

    'Transverse Numbers
    for id = idLowerBound to idUpperBound
    
        iIPAddress = CInt(objArrIPAddress(id))
        
        iIPSubnet = CInt(objArrIPSubnet(id))
        
        strLogicalAND = ( iIPAddress AND iIPSubnet )
        
        'If this is not the first number then add delimeter
        if (strNetworkAddress <> "") Then
        
            strNetworkAddress = strNetworkAddress + CHAR_PERIOD
        
        end if
        
        strNetworkAddress = strNetworkAddress + CSTR(strLogicalAND)
    
    next

    getNetworkAddress = strNetworkAddress
    
end function


'Get List of Arguments 
set objAguments = WScript.Arguments

iNumberofArgs = objAguments.Count

if (iNumberofArgs >0) and (iNumberofArgs <> 2)  Then

    set objAguments = Nothing

    Wscript.Echo "Expected two arguments IP Address & Subnet Mask"
    Wscript.Quit

elseif (iNumberofArgs =2) Then

    strIPAddress = objAguments(0)
    
    strIPSubnet = objAguments(1)
    
else

    call getIPAddress
    
end if


set objAguments = Nothing


strNetworkAddress = getNetworkAddress(strIPAddress, strIPSubnet)

strCIDR = getCIDR(strIPSubnet)

WScript.Echo "IP Address :- " & strIPAddress

WScript.Echo "IP Subnet  :- " & strIPSubnet

WScript.Echo "Network Address :- " & CSTR(strNetworkAddress)

WScript.Echo "CIDR :- " & CSTR(strCIDR)

Invocation

There are two type of invocation.

The first one is to pass along the IP Address and Subnet mask.

And, the other is not pass in any arguments and have the script query the system for its IP Address and subnet mask.

Automatic


cscript networkAddress.vbs

Manual



set _IPAddress=10.0.4.101
set _IPSubnet=255.255.255.128

cscript networkAddress.vbs %_IPAddress% %_IPSubnet%

Output

 

Source Control

GitHub

Link

Netbios Over TCP/IP – Yea Or Nay

Background

Had an insomnia night last week.  And, so took to the laptop and wanted to troubleshoot an issue.

As part of that troubleshooting exercise I knew Network Traffic Pattern might be pertinent.

Wireshark

Network Traffic

Here is sample of some of what I noticed through capturing Network Traffic.

Image

 

Explanation

Noticed a lot of Name Resolution Traffic.

Inclusive of protocols that line up with Network Resolution issues are DNS & NBNS.

DNS stands for Domain Name Server and NBNS Stand for Netbios Name Server.

 

Netbios Name Server ( NBNS )

Though running Windows. it is no longer a Netbeui World.

Strictly TCP/IP.

Review Configuration

Let us review our Network Configuration on specific adapters.

As I am currently on wireless, let us focus on just the Wireless Adapter.

GUI

Here is how to do so through the GUI.

Wireless Network Connection 2

Advanced TCP/IP Settings – WINS
Image

 

Explanation

Currently, we are set to receive NetBIOS Settings from the DHCP Server; that appears to be the default MS Windows Setting.

 

Command Line Shell

And, here are a couple of options to do so via the Command Line Shell.

ipconfig

Script

ipconfig /all

Output

Explanation

NetBIOS over Tcpip is Enabled

WMI – Query – Win32_NetworkAdapterConfiguration

Script


set _hostname="."

set _propList="DHCP*,IPAddress,DefaultIPGateway,DNSDomainSuffixSearchOrder,DNSEnabledForWINSResolution,DNSServerSearchOrder,TcpipNetbiosOptions"

set _command="Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter IPEnabled=TRUE -ComputerName %_hostname% | Select-Object -Property %_propList% "

powershell -Command %_command% 

Output

Explanation

  1. TcpipNetbiosOptions
    • 0
      • Default Setting; and we remember default settings is to get the setting from the DHCP Server

 

WMI – Set – Win32_NetworkAdapterConfiguration

Let us use wmic and pass along the nicconfig verb; calling the SetTcpipNetbios method and sending along argument 2.

Remember 2 mean Netbeui disabled.

Please pass along the right index, as well.

Each NIC Card has an index and it is displayed when one queries the Network Configuration.

Script

REM - Use NetBIOS setting from the DHCP server
set _netBiosSettingDHCPServer=0

REM - Enable NetBIOS over TCP/IP
set _netbiosSettingEnabled=1    

REM - Disable NetBIOS over TCP/IP
set _netbiosSettingDisabled=2  

set _hostname="."
set _index=15

wmic nicconfig where index=%_index% call SetTcpipNetbios %_netbiosSettingEnabled%

Image

 

Confirmed Change

GUI
Image

Console
Image – ipconfig /all

Wireshark – Take 2

Network Traffic

Went back to Wireshark and took another trace.

Image

Explanation

Noticed a slew of NBNS Traffic targeted at our DNS Server.

BTW, our local DNS Server are set for “Recursion Desired“.

That way they can forward unresolved Name Resolution traffic to our ISP…Which will be most of the requests we get.

 

Remediation

Connected to each of our internal DNS Servers and disabled Netbeui Name Resolution on the NIC Cards, as well.

 

Windows DHCP

If we had a Windows DHCP Server, would have disabled that option on the DHCP Scope, as well.

 

Wireless Access Point ( WAP )

I doubt that our Wireless Access Point supports DHCP and so will skip that step for now.

 

References

  1. Client Configuration
    • Script
      • HOW TO DISABLE NETBIOS VIA COMMAND LINE ON WINDOWS
        Link
      • Configuring NetBIOS over TCP/IP
        Link
    • Tim Dunn
      • Tim Dunn – Is NetBIOS over TCP/IP Enabled?
        Posted On :- 2011-June-29th
        Link
    • Scripting Guy
      • Use PowerShell to Identify Your Real Network Adapter
        Posted On :- 2011-Oct-7th
        Link
    • T.dejesus
      • Simple powershell help
        Posted On :- 2014-April-14th
        Link
    • Dan Stolts, ITProGuru
      • Using PowerShell to Get or Set NetworkAdapterConfiguration-View and Change Network Settings Including DHCP, DNS, IP Address and More (Dynamic AND Static) Step-By-Step
        Link
    • Q/A
      • Slow Cross-Domain login to StoreFront site
        Link
    • Visual
      • Jim Boyce
        • Get IT Done: Improve network performance by disabling NetBIOS over TCP/IP
          Published On : -2002-Nov-5th
          Link
  2. Server Configuration
    • How to disable NetBIOS over TCP/IP by using DHCP server options
      Link

 

Auditing Home Network using MS Windows Based Tools

Prelude

Here I am having gone crazy troubleshooting my home network.  And, so let us write down the little bit I found out.

 

Tools

Address Resolution Protocol ( ARP )

Get all entries in the ARP Pool

Syntax:


arp -a

Output:

arp-allinterface

 

In ARP Pool, get entries for Specific Interface

As we are only interested in the local network, let us get a bit more specific and restrict our search to only our intranet IP Address.

Syntax:


  arp -a -N [IP-Address]

Sample:


  arp -a -N 10.0.4.100

Output:

arp-interface-intranet

 

In ARP Pool, using Specific Interface, perform network sweep

Let us do a network sweep; by adding -v

Syntax:


  arp -a -v -N [interface]

Sample:


  arp -a -v -N 10.0.4.100

Output:

arp-interface-intranet-networksweep

 

Explanation:

  1. When no host
    • Physical Address :- 00-00-00-00-00-00
    • Type – invalid
  2. When internal host
    • Physical Address :- MAC Address
    • Type :- dynamic
  3. When Internet host
    • Physical Address :- MAC Address
    • Type :- Static
  4. Network broadcast
    • Physical Address :- MAC Address – ff-ff-ff-ff-ff-ff
    • Type :- Static

 

Ping -a

Syntax:


  ping -a [IP-Address]

Sample -1 :


  arp -a -N 10.0.4.6

Output:

ping-a-6

 

 

Sample -2 :


  arp -a -N 10.0.4.7

Output:

ping-a-7

 

Sample -3:


  arp -a -N 10.0.4.94

Output:

ping-a-94

Explanation:

So here I am going crazy.  How come I can’t figure out the hostname bearing 10.0.4.94

 

Angry IP Scanner

Downloaded Angry IP Scanner and Java’s JRE 

Ran it and got this back.

AngryIPScanner

So again, though we received back a ping’s response for 10.0.4.94, no corresponding hostname.

 

MAC Address Lookup

Took to the internet to find out who is the manufacturer for the MAC Address corresponding to the IP Address 10.0.4.94

Web Sites:

 

CheckMacAddress

So entered our MAC Address, but got back a vendor that I am still not that familiar with; specifically Azurewave Technologies, Inc., TAIWAN

Lookup

 

Wireless Access Point

Connected to our WAP and using the DHCP Client Table, here is what we received back:

DCHPClientTable

Finally, we have a match for IPAddress 10.0.4.94 /MAC Address 6C…..

Our match is the ChromeCast device that my brother brought us to be able to view youtube videos on the TV.

 

Summary

No country for old men!

Automatic Web Proxy Discovery and Client Configuration in MS Windows Environment

 

Background

For most of us that work in Corporate MS Windows Environment, our Internet Gateway \ Proxy configuration is pretty hidden.

At home, we either have direct connections to the Internet, have a gateway assigned to us by our ISP, or get on the Internet through our own Router or Wireless Access Point (WAP).

 

Corporate Environment

On the other hand, while at work in a Corporate Environment, when we do the following:

  • Access Control Panel
  • Access Internet Options
  • In the “Internet Properties” window, access the “Connections” tab
  • Within the “Local Access Networks (LAN) settings” group box, click the “LAN Settings” button
  • In the “Local Access Network (LAN) settings” window, you will be able to review your Proxy settings

Our available choices are

    • Automatically detect settings
    • Use automatic configuration script
    • Use a single Proxy Server
    • Access to configure proxy server based on traffic type ( HTTP/FTP, etc)

 

InternetProperties-LocalAreaNetworkSettings-AutomaticConfiguration-AutomaticallyDetectSettings

 

Inquiry Mind

So to put it subtly an Inquiry mind wants to know.  Which server is proxy-ing our web traffic.

Well that is where WPAD comes in?

 

Honorable Mentions

Richard Hicks

His article “Configuring Web Proxy Automatic Discovery (WPAD) in Forefront Threat Management Gateway (TMG) 2010” knocks the topic out of the park.  It stimulates my thinking, and notice that I did not say it stimulated my thinking.

Richard is a Microsoft’s Enterprise Security MVP; and he does that acknowledgement well.

 

Web Proxy Automatic Discovery

There are a couple of ways that a machine acquires its Internet’s Client Configuration

  • DHCP
    • For machines that do not have fixed IP Addresses, the network’s DHCP server can return the Internet Proxy Server as part of the initial Network Configuration configuration.  That is, when returning other Client Configuration data such as the Assigned IP Address, Gateway Address, and Subnet mask.
    • As Richard’s article pointed out, for bigger networks with a stable of Proxy Servers, we are able to designate specific Proxy Servers on subnet basis.  That is we specify Proxy Server T1 for Building A, and another Proxy Server, Proxy T1, for Building D.
  • DNS
    • DNS Server Configuration
      • Create “A” DNS records for each Proxy Server
      • Create “C” records that point to the various “A” records.
      • The C records will bear the name WPAD
    • Client Configuration/Requests
      • DNS Clients issues requests for WPAD
      • The DNS Server will return the IP Address for one of the “A” records

Which One are we using?

DHCP

I honestly can not say for sure whether we are getting Internet proxy configuration via DHCP.

I will have to use a Network Traffic Tool and review its requests and the response from the DHCP to answer affirmatively.

DNS

But, I can say that we are using DNS; solely or in addition

Query DNS for WPAD Records

  • Access Console
  • Issue DNS Query


Query Syntax

nslookup WPAD

wpad

 

Explanation:

When we use nslookup and issue WPAD query against our default DNS Server, we get back

  • DNS Server
    • Server :- The name of the responding DNS Server
    • Its IP Address
  • WPAD
    • Name :- The name of the WPAD Server
    • Addresses :- The A records IP Addresses
    • Aliases :- The “C” records

Network Connections

Let us review our current network connections and see if we indeed have traffic going to our stated Proxy Server: 

Syntax:
netstat -anb | find [Proxy-Server]
Sample:
netstat -anb | find "10.4."

 

Image:
netstat--anb

 

Application

Configuration

Most Web Browsers have been coded to able to work with WPAD.

On the other hand, 3rd Vendors might not have augmented their applications likewise.

 

Notepad++

Here we configure Notepad++ with our Proxy Server, its IP Address and Port Number.  And, later our Network username and password.

Plugin Manager Settings

PluginManagerSettings

Proxy Credentials:

ProxyCredential

 

 

Installation Failure

But, sadly our installation of our plugin failed.

InstallationError-InstallationOfPowerShellLexerFailed

 

 

Why you ask me:

To determine why our install failed, we have to dig a bit deeper and see if there are log files created by Notepad++.

Notepad++ developers are good ones and you know they are smart.

Here is where Update Log files are and where they are not:

  • C:\Program Files (x86)\Notepad++\plugins = No
  • C:\Users\[username]\AppData\Roaming\Notepad++\plugins\config\plugin_install_temp\plugin1 = Yes

Here is our Proxy Log:

installFailed

 

The identifying error is:

  • Error Code: 407 Proxy Authentication Required. Forefront TMG requires authorization to fulfill the request. Access to the Web Proxy filter is denied. (12209).

 

Conclusion:

  • Yes, I wish we had a WIN
  • But, our corporate security is a bit complex
    • We do not have traditional username/password, but smart badge and accompanying pin
    • Yes, I have Internet access for my regular user tied into the Smart Badge
    • But, it is very unlikely that I have Internet access on my Admin Account

 

Listening

Kenny Chesney & Kid Rock – LuckenBach Texas

Videos

  1. Link
    • Striked Through on 2017-Oct-6th
  2. Link
    • Published On :- 2013-Jan-7th
    • Added On :- 2017-Oct-6th

At the end of the song there is an exchange between Kenny & Kid Rock; it reads

How they did it in 80 ….
If you listen to this song, you are listening to something real

Don’t listen to something else
At 4:00 O’Clock in the morning

Thank God, they get to stay up till 4 O’Clock in the morning, doing what they are happy doing.

And, as for me, thank Goodness for Richard Hicks and other MVPS.

I will take the advice of the singers here; as I am unlikely to listen to anyone else.

 

References

Security Vendors

  • Configuring Web Proxy Automatic Discovery (WPAD) for Forefront Threat Management Gateway
    Link
  • SafeSquid – Configure WPAD through DNS Windows Server 2003/2008
    Link

Additionally Information is needed to connect …

 

Warning

When I come in each morning and occasionally through the day, I get the message pasted below:

 

Image:

additionalInformationIsNeededToConnect_v2

 

Text:

Additionally Information is needed to connect ….

 

Troubleshooting

Review Network Connections

  • Access Control Panel \ Network and Internet \ Network Connections

Our display looks like this:

AttemptingToAuthenticate

On the Wireless Network Connection, we can see the message “Attempting to authenticate”.

 

Review Wireless Networks

  • Access Control Panel \ Network and Internet \ Manage Wireless Networks
  • Select the Wireless Network (that we are being prompted to connect to )
  • Review the Network

 

Manage Wireless Networks

maangeWirelessNetworks

 

 

 

Wireless Network Properties – Connection

wirelessNetworkProperties-Before

 

Wireless Network Properties – Security

wirelessNetworkProperties-Security

 

Problem Identification

The problem is the we are currently setup to auto connect to the Wireless Network.

As background, systems continually poll to see whether automatically configured Networks are nearby.

And, of course, it is once I come to work and dock my laptop each morning.

The auto-connect will happen in most cases.  But, in our case, we are setup with two-factor authentication; smart card and pin.

And, that is the source of the message “Additional Information is needed ….”

 

Remediation

Un-check “Connect automatically when this network is in range”.

 

wirelessNetworkProperties-After