Network Security Wiki

Cheatsheet: Difference between revisions

Page Discussion

Cheatsheet (view source)

Revision as of 22:34, 31 August 2022

5,721 bytes removed ,  1 year ago
→‎Redirect Stderr
 
(87 intermediate revisions by the same user not shown)
Line 5:
 
 
= ARP vs MAC Table vs CAM Table =
 
{{notice|Need to confirm if MAC Table is same as CAM table}}
 
<center>
{| class="wikitable"
|-
! ARP Table !! MAC Table (or CAM Table) ||CAM Table
|-
| Layer3 address to Layer2 address resolution || Layer2 address to Interface binding
Line 149 ⟶ 152:
|}
 
 
*;ARP Header
Hardware type
Protocol type
Hardware address length
Protocol address length
Operation
Source MAC
Source IP
Dest MAC
Dest IP
<br />
{| class="wikitable" style="margin: 0 auto; text-align:center; width:80%;"
|+DNS Headers
|-
| colspan="16"| Identification || colspan="1"| QR || colspan="4"| Opcode || cellpadding="1"|<tt>A<br>A</tt>|||<tt>T<br>C</tt>|||<tt>R<br>D</tt>|||<tt>R<br>A</tt>|||<tt>Z</tt>|||<tt>A<br>D</tt>|||<tt>C<br>D</tt>|| colspan="4"| RCode
|-
| colspan="16"| Total Questions || colspan="16"| Total Answers
|-
| colspan="16"| Total Authority Resource Records || colspan="16"| Total Additional Resource Records
|}
<br />
 
*AD Authentic Data
*CD Checking Disabled
 
<center>
{| class="wikitable" style="text-align: center; width: 30em;" border=1
|+ARP Headers
|-
| colspan="16"| Hardware type <small>(Ethernet = 1</small>)
|-
| colspan="16"| Protocol type <small>(IPv4 = 0x0800)</small>
|-
| colspan="8"| Hardware address length (Ethernet size is 6)
| colspan="8"| Protocol address length (IPv4 size is 4.)
|-
| colspan="16"| Operation ( 1 for request; 2 for reply)
|-
| colspan="16" style="background:#f0fff0"| Source MAC
|-
| colspan="16" style="background:#d0ffd0"| Source IP
|-
| colspan="16" style="background:#f0f0ff"| Dest MAC
|-
| colspan="16" style="background:#d0d0ff"| Dest IP
|}
</center>
 
 
;<center>GARP</center>
[[File:GARP.png|center]]
 
 
Line 167 ⟶ 201:
Rest of Header
<br />
 
= DNS =
 
;Record Types
 
A Address record Returns a 32-bit IPv4 address,
AAAA IPv6 address record
CNAME Canonical name record Alias of one name to another, DNS lookup will continue by retrying the lookup with the new name.
LOC Location record Specifies a geographical location associated with a domain name
MX Mail exchange record Maps a domain name to a list of message transfer agents for that domain
NS Name server record Delegates a DNS zone to use the given authoritative name servers
PTR Pointer record Pointer to a canonical name. Unlike a CNAME, DNS processing stops and just the name is returned. The most common use is for implementing reverse
DNS lookups.
SOA Start of [a zone of] authority record Specifies authoritative information about a DNS zone, including the primary name server, the email of the domain administrator, the domain serial
number,etc
SRV Service locator Generalized service location record, used for newer protocols instead of creating protocol-specific records such as MX.
TXT Text record Originally for arbitrary human-readable text in a DNS record. Now more often carries machine-readable data, opportunistic encryption, Sender Policy
Framework, etc.
* All cached records Returns all cached records of all types known to the name server. If the name server does not have any information on the name, the request will be
forwarded on.
AXFR Authoritative Zone Transfer Transfer entire zone file from the master name server to secondary name servers.
IXFR Incremental Zone Transfer Requests a zone transfer of the given zone but only differences from a previous serial number.
<br />
 
;Glue Record
 
* A glue record is a term for a record that's served by a DNS server that's not authoritative for the zone, to avoid a condition of impossible dependencies for a DNS zone.
* What glue records do is to allow the TLD's servers to send extra information in their response to the query for the example.com zone - to send the IP address that's configured for the name servers.
* It's not authoritative, but it's a pointer to the authoritative servers, allowing for the loop to be resolved.
 
= TCP =
 
*Parameters determined during Handshake:
MSS (default is 536)
MSS
WSF
SACK Permitted
Line 179 ⟶ 242:
 
[[File:Mtu mss.png|center]]
 
* '''RTO:''' Four ACKs acknowledging the same packet, which are not piggybacked on data and do not change the receiver's advertised window.
 
*Fast Retransmission
- If RTO has a larger value
- If sender receives four acknowledgments with same value (three duplicates)
- Segment expected by all of these Ack is resent immediately
 
*Fast Recovery:
-
-
 
*Congestion Control
 
;Slow Start - Exponential Increase
- Sender starts with cwnd = 1 MSS, Size increases 1 MSS each time one Ack arrives, Increases the rate exponentially(1,2,4,8....) until a threshold is reached
Line 201 ⟶ 276:
- Starts the Congestion Avoidance phase
- This is called fast transmission and fast recovery
 
----
 
* Both consider RTO and Duplicate ACKs as packet loss events.
* Behavior of Tahoe and Reno differ primarily in how they react to duplicate ACKs.
 
<center>
{| class="wikitable"
|-
! Event !! Tahoe !! Reno
|-
| 3 Dup Acks || Performs a fast retransmit<br>Sets the slow start threshold to half of the current congestion window<br>Reduces the congestion window to 1 MSS<br>Resets to slow start state || Perform a fast retransmit<br>Skip the slow start phase by instead halving the congestion window<br>(instead of setting it to 1 MSS like Tahoe)<br>Setting the slow start threshold equal to the new congestion window<br>Enter a phase called fast recovery.
|-
| RTO (Ack time out) || Slow start is used<br>Reduce congestion window to 1 MSS || Slow start is used<br>Reduce congestion window to 1 MSS
|}
</center>
 
*Silly Window Syndrome: Sender creates data slowly or Receiver consumes slowly or both.
Line 211 ⟶ 302:
- '''Delayed Acknowledgment''': Segment not acknowledged immediately, Sender TCP does not slide its window, reduces traffic, sender may unnecessarily retransmit, Not delay more than 500 ms.
 
*Fast Retransmission
- If RTO has a larger value
- If sender receives four acknowledgments with same value (three duplicates)
- Segment expected by all of these Ack is resent immediately
 
*Persistence Timer
Line 225 ⟶ 312:
 
= VPN Messages =
<div style="column-count:3;-moz-column-count:3;-webkit-column-count:3">
 
*;Phase 1 - Main Mode
Line 239 ⟶ 325:
ID,Accepted Proposal,DH Key,Nonce,ID Hash
ID Hash
 
*;Phase 2 - Quick Mode
Ph1 Hash,Message ID,Proposal List,Nonce, DH Key,Proxy-ID
Ph1 Hash,Message ID,Accepted Proposal,Nonce,DH Key,Proxy-ID
Ph1 Hash,Message ID,Nonce
</div>
 
= HTTP =
 
=;HTTP Error Codes=
 
<center>
Line 276 ⟶ 354:
</center>
 
;HTTP1.0 vs HTTP1.1
= HTTP Request Methods=
 
HTTP/1.0:
 
* Uses a new connection for each request/response exchange
* Closed connections after every request.
* Supports GET, POST, HEAD request methods
 
HTTP/1.1:
 
* Connection may be used for one or more request/response exchanges
* Uses persistent connections, save bandwidth & reduces latency as it does not require to do TCP Handshake again for every file download (like images, css, etc.)
* HTTP Pipeline feature in which client sends multiple requests before waiting for each response.
* Supports OPTIONS, PUT, DELETE, TRACE, CONNECT request methods
<br />
 
;HTTP/1.1 vs HTTP/2
 
* HTTP/2 Supports Page load speed improvements through:
'''Compression of request headers'''
'''Binary protocol'''
'''HTTP/2 Server Push''': capability allows the server to send additional cacheable information to the client that isn’t requested but is anticipated in future requests.
'''Request multiplexing over a single TCP connection'''
'''Request pipelining'''
'''HOL blocking (Head-of-line) — Package blocking'''
 
;HTTP Request Methods
GET: Retrieve Data
HEAD: Header only without Response Body
Line 285 ⟶ 389:
OPTIONS: Returns the HTTP methods that the server supports for the specified URL
TRACE: Performs a message loop back test to see what (if any) changes or additions have been made by intermediate servers
PATCH: Applies partial modifications to a resource.
PATCH:
 
; PUT vs PATCH
PUT method only allows a complete replacement of a document.
PATCH is used to make changes to part of the resource at a location.
 
== Cookie ==
 
 
*Session cookie
*Persistent cookie
*Secure cookie
*Http-only cookie
*Same-site cookie
*Third-party cookie
*Supercookie
Other uses
*Zombie cookie
 
== HTTP Headers ==
{|class="wikitable"
|-
! Header !! Uses
|-
|Set-cookie ||
|-
|Location ||1) Used to ask a web browser to load a different web page<br/>Client request:<br/>''GET /index.html HTTP/1.1''<br/>''Host: www.example.com''<br/>Server response:<br/>''HTTP/1.1 302 Found''<br/>''Location: http://www.example.org/index.php.''<br/>
2) To provide info about location of a newly created resource, the Location header should be sent with an HTTP status code of 201 or 202.
|-
|Host||The host Header tells the webserver which virtual host to use if same virtual host is using several aliases
|-
|Accept||
|-
|User-Agent||
|-
|content-type||
|-
|content-length||
|-
|date||
|-
|expires||
|-
|Authorization||Basic access authentication is used to provide a user name and password when making a request.<br/>Credentials are the base64 encoding of id and password joined by a single colon<br/>Base64-encoding of 'Aladdin:OpenSesame' is 'QWxhZGRpbjpPcGVuU2VzYW1l'<br/>''Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l''<br/>''https://Aladdin:OpenSesame@www.example.com/index.html'' ==> This will not ask for the credentials; deprecated now
|-
|Referrer||When a user clicks a hyperlink in a web browser, the browser sends a request to the server holding the destination webpage.<br/>
The request may include the referer field, which indicates the last page the user was on (the one where they clicked the link).
|-
|X-Forwarded-For (XFF)||Used for identifying the originating IP address of a client connecting to a Web Server through an HTTP Proxy or Load Balancer.
|}
 
= FTP =
 
[[File:Active-Passive_FTP.JPG|centre]]
 
= SSL Handshake =
 
[[File:SSL Handshake.png|center]]
 
--> Client Hello
<-- Server Hello, Certificate, Server Hello Done
--> Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message(Finished)
<-- Change Cipher Spec, Encrypted Handshake Message(Finished)
--> Application Data(GET)
<-- Encrypted Handshake Message(Hello Request)
 
 
#Client sends the supported parameters
#Server chooses the parameters; Sends the certificate; And first half of the Diffie-Hellman key exchange
#Client sends the second half of the Diffie-Hellman exchange, Computes the session keys; Switches to encrypted communication
#Server computes the session keys; Switches to encrypted communication.
<br>
 
; SSLv1 vs TLS 1.0 vs TLS1.3
SSL 2.0 - Deprecated
SSL 3.0 - Deprecated
TLS 1.0 - Deprecated
TLS 1.1 - Deprecated
TLS 1.2 -
TLS 1.3 -
 
= NetScaler =
 
*LB Methods:
Least Connection = Service with fewest active connections
Round Robin = Rotates a list of services
Least Response time(LRTM) = Fewest active connections & lowest average response time
Least Bandwidth = Service serving least amount of traffic measured in mbps
Least Packets = Service that received fewest packets
Line 303 ⟶ 482:
 
*Persistence Methods:
SOURCE IP =
COOKIE Insert = Connections having same HTTP Cookie inserted by Set-Cookie directive from server belong to same persistence session.
SSL Session = Connections having same SSL session ID
Line 322 ⟶ 501:
 
= OSPF =
 
<div style="column-count:4;-moz-column-count:4;-webkit-column-count:4">
*; States
Down
Attempt
Init Hello sent out all int
Init
2-Way Hello rcvd cont own RID in ngbr list
2-Way
ExStart Determine master slave
Exchange Master sends DBD first, then Slave
Exchange
Loading Comp DBDs, send LSR for missing LSAs
Loading
Full LSDB of ngbr are fully syncd
Full
 
*; LSA Type
Type 1 - Router LSAs Sent from router to other routers in the same area, has info reg router's int in the same area, int IPs, adjacent routers
Type 1 - Router LSAs
Type 2 - Network LSAs Generated by the DR on a multi access segment, similar to LSA Type 1
Type 3 - Network Summary LSA Generated by ABRs, contain the subnets & costs
Type 4 - ASBR summary LSA Same as summary LSA except the destination advertised by ABR is ASBR, ABR in same area as the ASBR will originate the Type 4 LSA.
Type 4 - ASBR summary LSA
Type 5 - AS external LSA Generated by ASBRs, Flooded throughout the AS to advertise a route external to OSPF
Type 7 - NSSA External LSA Generated by the ASBR in an NSSA area, Converted into a type 5 LSA by the ABR when leaving the area
 
* Packet Types
*;Packet Types
Type 1 - Hello
Type 2 - Database Description (DBD)
Type 3 - Link-State request (LSR)
Type 4 - LSU (Contain LSAs)
Type 5 - LSAck
 
* Neighbor Requirements:
*;Neighbor Requirements:
Same area
Same authentication config
Line 357 ⟶ 533:
Same hello/dead interval
Matching stub flags
 
* LSA Details
</div>
 
[[File:OSFF LSA 2.png|center]]
 
* OSPF path selection: O > O*IA > O*E1 > O*E2 > N1 > N2.
* “area range” summarize type 3 LSA’.
* “summary-address” summarize type 5 & 7 LSA’s.
Line 371 ⟶ 545:
= BGP =
 
* Route Selection Criteria
<div style="column-count:2;-moz-column-count:2;-webkit-column-count:2">
 
*Route Selection Criteria
<center>
{| class="wikitable"
|-
! Attribute !! Which is better !! Type
|-
|Next Hop reachable || Route cannot be used if next hop is unreachable || Well-known Mandatory
|-
|Weight || Bigger; value local to the router; Cisco proprietary; default is 0 for all routes not originated by local router ||
|Weight || Bigger
|-
|Local Preference || Bigger; used within AS and exchanged bw iBGP routers; default is 100 || Well-known discretionary
|-
|Locally Injected (Originate) || LocallyPrefer injectedpath islocal betterrouter thanoriginated; Locally injected > iBGP/eBGP learned; In BGP table it will hv next hop 0.0.0.0 ||
|-
|AS Path Length || Smaller; e.g: AS path 1 2 3 is preferred over AS path 1 2 3 4 5 || Well-known Mandatory
|-
|Origin || Prefer IIGP(advertised overby Enetwork &cmd E- overi) Unknown> EGP > INCOMPLETE - '?'(reditributed) || Well-known Mandatory
|-
|MED(Metric) || Smaller; used to advertise to neighbors how they should enter your AS; propagated to all routers within the neighbor AS but not passed along any other AS || Optional non-transitive
|MED || Smaller
|-
|Neighbor Type || Prefer eBGP over iBGP ||
|-
|IGP Metric to Next Hop || Smaller; Prefer the path within the AS with the lowest IGP metric to the BGP next hop ||
|-
|Oldest path || Prefer the path that we received first ||
|-
|Router ID || Prefer the path with the lowest BGP neighbor router ID (Manually conf > Highest Loopback IP address > Highest Interface IP address) ||
|-
|Neighbor IP address || Prefer the path with the lowest neighbor IP address ||
|}
<br /center>
<br />
 
Line 412 ⟶ 593:
Notification Always indicate something is wrong
<br />
 
</div>
* Directions
'''Aspath prepend:''' Applied outwardly.
Impacts incoming path.
Shorter the as-path length higher the preference
As-path prepend is the way to add AS number to the list of subnet u want to advertise.
This is a way to route poisoning.
Tell the outside world not to follow the path.
 
'''Local preference:''' Applied while the traffic coming inside.
Impacts traffic while going out.
Non transitive.
Propagates within the same as-path.
Higher the local preference value higher the preference
 
'''MED:''' Multiexitdescriptor
When your router has connection with two other routers with same AS.
Let's say you have 2 subnets behind your router.
You can use MED value to mention which networks should be accessed through which links.
It is advertised outwards.
Impacts the incoming traffic.
Semi transitive.
Propagates to one AS.
Lower the MED value higher the preference.
MED should be used carefully as it reduces network resiliency.
 
=VPN Monitor vs DPD vs IKE Heartbeat =
Line 499 ⟶ 704:
The range is 0–50s; default is 20s
 
= LinuxFlows =
 
*Complete Flow of PC opening a Website:
== Linux Booting ==
 
#Check NW config
= Linux Booting Process =
#DHCP if not configured
Source: [http://technochords.com/linux-booting-process-6-steps/ technochords.com]
#Check Domain name in Browser Cache
#Check Domain name in OS Cache
#Check if an entry exists in Hosts File
#If not Found in any cache, Prepare to send UDP DNS query to DNS Server
#If DNS Server configured is in same Network Check MAC address in ARP Table
#If not found, send ARP for MAC Address
#Forward DNS Query to DNS Server and wait for reply containing IP address of Website
#If DNS server configured is not in same subnet, check Gateway config(IP & MAC address)
#If MAC address not found in ARP Table, send ARP request
#After getting reply, fwd the DNS query to gateway
#After getting DNS response, start TCP 3-way handshake S-SA-A.
#Start SSL Handshake if SSL/TLS configured
#Send GET Request
#Client sends ACK [200 OK] & Body containing HTML Data
#If HTTP 1.0, Server sends FIN & CLoses connection
#Client send FIN-ACK
#Server sends Ack
 
The following are the 6 high level stages of a typical Linux boot process:
 
*Complete Flow of DNS Traffic
#BIOS
#MBR
#GRUB
#Kernel
#Init
#Runlevel programs
 
#Check NW config
;BIOS(Basic Input/Output System) - loads and executes the MBR boot loader.
#DHCP if not configured
*Performs some system integrity checks (POST-Power On Self Test)
#Check Domain name in Browser Cache
*Searches, loads, and executes the boot loader program.
#Check Domain name in OS Cache
*It looks for boot loader in floppy, cd-rom, or hard drive.
#Check if an entry exists in Hosts File
*You can press a key (typically F12 of F2, but it depends on your system) during the BIOS startup to change the boot sequence.
#If not Found in any cache, Prepare to send UDP DNS query to DNS Server
*Once the boot loader program is detected and loaded into the memory, BIOS gives the control to it.
#If DNS Server configured is in same Network Check MAC address in ARP Table
#If not found, send ARP for MAC Address
#Forward DNS Query to DNS Server and wait for reply containing IP address of Website
#If DNS server configured is not in same subnet, check Gateway config(IP & MAC address)
#If MAC address not found in ARP Table, send ARP request
#After getting reply, fwd the DNS query to gateway
#DNS Server ??
#DNS Server ?? Iterative? Recursive? TLD? Authoritative
#DNS Server ??
#After getting DNS response, start TCP 3-way handshake S-SA-A.
 
;MBR (Master Boot Record) - loads and executes the GRUB boot loader.
*It is located in the 1st sector of the bootable disk.
*Typically /dev/hda, or /dev/sda
*MBR is less than 512 bytes in size.
*This has three components:
#primary boot loader info in 1st 446 bytes,
#partition table info in next 64 bytes(16,16,16,16) 4 partitions,
#magic numbers as mbr validation check in last 2 bytes.
*It contains information about GRUB (or LILO in old systems).
 
;GRUB (Grand Unified Bootloader) - loads and executes Kernel and initrd images.
*It is a Multiboot boot loader.
*If you have multiple kernel images installed on your system, you can choose which one to be executed.
*GRUB displays a splash screen, waits for few seconds, if you don’t enter anything, it loads the default kernel image as specified in the grub configuration file.
*GRUB has the knowledge of the filesystem (the older Linux loader LILO didn’t understand filesystem).
*Grub configuration file is /boot/grub/grub.conf (/etc/grub.conf is a link to this).
<pre>
#boot=/dev/sda
default=0
timeout=5
splashimage=(hd0,0)/boot/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.18-194.el5PAE)
root (hd0,0)
kernel /boot/vmlinuz-2.6.18-194.el5PAE ro root=LABEL=/
initrd /boot/initrd-2.6.18-194.el5PAE.img
</pre>
*As you notice from the above info, it contains kernel and initrd image.
 
;Kernel
*Once the control is given to kernel which is the central part of all your OS and act as a mediator between hardware and software.
*Kernel once loaded into to RAM it always resides on RAM until the machine is shutdown.
*Once the Kernel starts its operations the first thing it do is executing INIT process.
 
*Complete Flow of Traffic passing through below scenario:
;Init (initialization)
[PC1]-----[Hub]-----[Switch]-----[Router]------[Router]------[PC2]
*Looks at the /etc/inittab file to decide the Linux run level.
*Following are the available run levels
0 – halt
1 – Single user mode
2 – Multiuser, without NFS
3 – Full multiuser mode
4 – unused
5 – X11
6 – reboot
 
#Check NW config
*Init identifies the default initlevel from /etc/inittab and uses that to load all appropriate program.
#DHCP if not configured
*Execute ‘grep initdefault /etc/inittab’ on your system to identify the default run level
#Check if PC2 in same Subnet(not in this scenario as routers present)
*Typically you would set the default run level to either 3 or 5.
#If in Same Subnet, check if MAC address is there in ARP Table
#Else send ARP Request
#Once MAC address is known, directly send Packet to PC2
#If PC2 is in Different Subnet(True for above scenario), Check Gateway IP address & MAC address
#If MAC address is not known, send an ARP request.
#Hub is directly connected, will receive & Flood packet on all Ports.
#Switch will receive packet and check its CAM Table for the MAC to Port bindings
#If MAC entry is not found in CAM table, Switch will Flood the ARP packet on all ports.
#Other destinations will drop the ARP Request packet as they do not have the IP address requested in ARP Header.
#Only Router will accept the packet as it has the requested IP address matching its own MAC address.
#It will reply with an ARP Reply message.
#Switch will add an entry of this MAC address & port number in its CAM Table once the reply packet pass through it.
#Hub will flood the packet through all ports.
#ARP Reply will reach PC1, it will add entry to its ARP Table
#Then send a packet destined to PC2 with destintion MAC address as Router's Interface's MAC address received in ARP reply.
 
;Runlevel programs
*When the Linux system is booting up, you might see various services getting started.
*For example, it might say “starting sendmail …. OK”.
*Those are the runlevel programs, executed from the run level directory as defined by your run level.
*Depending on your default init level setting, the system will execute the programs from one of the following directories.
Run level 0 – /etc/rc.d/rc0.d/
Run level 1 – /etc/rc.d/rc1.d/
Run level 2 – /etc/rc.d/rc2.d/
Run level 3 – /etc/rc.d/rc3.d/
Run level 4 – /etc/rc.d/rc4.d/
Run level 5 – /etc/rc.d/rc5.d/
Run level 6 – /etc/rc.d/rc6.d/
 
= Linux =
*Please note that there are also symbolic links available for these directory under /etc directly.
 
*So, /etc/rc0.d is linked to /etc/rc.d/rc0.d.
== Linux Booting ==
*Under the /etc/rc.d/rc*.d/ directories, you would see programs that start with S and K.
 
#Programs starts with S are used during startup. S for startup.
#BIOS(Basic Input/Output System) - POST, Loads and executes the MBR boot loader.
#Programs starts with K are used during shutdown. K for kill.
#MBR (Master Boot Record) - Loads and executes the GRUB boot loader.
#There are numbers right next to S and K in the program names.
#GRUB (Grand Unified Bootloader) - Loads and executes Kernel and Initrd images.
#Those are the sequence number in which the programs should be started or killed.
#Kernel - Heart of OS; Memory, Process mgmt; Executes INIT process.
#For example, S12syslog is to start the syslog deamon, which has the sequence number of 12.
#Init (initialization) - Decides the Linux run level; default run level to either 3 or 5.
#S80sendmail is to start the sendmail daemon, which has the sequence number of 80.
#Runlevel programs - Executes programs like sendmail, etc from the run level directory as defined by the run level.
#So, syslog program will be started before sendmail.
 
== Manually Boot using Grub ==
Line 629 ⟶ 819:
/var – Variable Files
 
== ProcFS ==
 
=== CURL ===
*Procfs or /proc is a special FS under Linux used to present process information and kernel processes.
curl -I http://domain.com Get HTTP header information
*Much of the information for kernel level of 2.6 & above have been moved to "sysfs" generally mounted under /sys.
curl -i http://domain.com Get HTTP header + Body information
*/proc is stored in memory.
curl -L http://domain.com Handle URL redirects
curl -v http://domain.com Debug level details
curl -x proxy.sr.com:3128 http://domain.com Using proxy to download a file
curl -k https://domain.com Ignoring the ssl certificate warning
curl -A "Mozilla/5.0" http://domain.com Spoofing user agent:
curl -L -H "user-agent: Mozilla/5.0" https://aman.info.tm Custom Headers
curl smtp://example.com:2525
curl ftp://example.com
curl example.com:21
curl example.com:7822 Troubleshooting SSH: SSH-2.0-OpenSSH_5.3
time curl google.com
curl -i https://site1.lab.com --cert /root/ca/domains/ubnsrv01-cert.pem --key /root/ca/domains/ubnsrv01-key.pem
curl -v -X OPTIONS https://site3.lab.com
curl -v -X TRACE https://site3.lab.com
curl --sslv2 https://yoururl.com
curl --tlsv1 https://yoururl.com
curl -H 'X-My-Custom-Header: 123' https://httpbin.org/get Using httpbin tool; shows header info
curl -e google.com yoururl.com Referrer
curl --data "name=bool&last=word" https://httpbin.org/post Post data
curl -X POST https://httpbin.org/post Empty Post Request
curl -H 'Host: aman.info.tm' 128.199.139.216 If Server using Virtual Hosting
 
*On multi-core CPUs, /proc/cpuinfo contains the fields for "siblings" and "cpu cores":
"siblings" = (HT per CPU package) * (# of cores per CPU package)
"cpu cores" = (# of cores per CPU package)
 
Post Json Data
*A CPU package means physical CPU which can have multiple cores (single core for one, dual core for two, quad core for four).
curl --data '{"email":"test@example.com", "name": ["Boolean", "World"]}' -H 'Content-Type: application/json' https://httpbin.org/post
*This allows a distinction between hyper-threading and dual-core, i.e. the number of hyper-threads per CPU package can be calculated by siblings / CPU cores.
*If both values for a CPU package are the same, then hyper-threading is not supported.
*For instance, a CPU package with siblings=2 and "cpu cores"=2 is a dual-core CPU but does not support hyper-threading.
 
Time Breakdown
curl https://www.booleanworld.com/ -sSo /dev/null -w 'namelookup:\t%{time_namelookup}\nconnect:\t%{time_connect}\nappconnect:\t%{time_appconnect}\npretransfer:\t%{time_pretransfer}\nredirect:\t%{time_redirect}\nstarttransfer:\t%{time_starttransfer}\ntotal:\t\t%{time_total}\n'
 
=== IPtables ===
/proc/cmdline – Kernel command line information.
/proc/consoles – Information about current consoles including tty.
/proc/crypto – list of available cryptographic modules
/proc/devices – Device drivers currently configured for the running kernel.
/proc/diskstats –
/proc/dma – Info about current DMA channels.
/proc/fb – Framebuffer devices.
/proc/filesystems – Current filesystems supported by the kernel.
/proc/iomem – Current system memory map for devices.
/proc/ioports – Registered port regions for input output communication with device.
/proc/kmsg – holding messages output by the kernel
/proc/loadavg – System load average.
/proc/locks – Files currently locked by kernel.
/proc/meminfo – Summary of how the kernel is managing its memory.
/proc/misc – Miscellaneous drivers registered for miscellaneous major device.
/proc/modules – Currently loaded kernel modules.
/proc/mounts – List of all mounts in use by system.
/proc/partitions – Detailed info about partitions available to the system.
/proc/pci – Information about every PCI device.
/proc/scsi – Information about any devices connected via a SCSI or RAID controller
/proc/stat – Record or various statistics kept from last reboot.
/proc/swap – Information about swap space.
/proc/tty – Information about the current terminals
/proc/uptime – Uptime information (in seconds).
/proc/version – Kernel version, gcc version, and Linux distribution installed.
 
iptables -L ==> List rules
/proc/PID/cmdline – Command line arguments.
iptables -F ==> Stop iptables
/proc/PID/cpu – Current and last cpu in which it was executed.
iptables -nvL ==> Check Stats
/proc/PID/cwd – Link to the current working directory.
iptables --flush MYCHAIN ==> Flush Chain
/proc/PID/environ – Values of environment variables.
iptables -X MYCHAIN ==> Delete Empty Chain
/proc/PID/exe – Link to the executable of this process.
iptables -A INPUT -p tcp --dport ssh -j ACCEPT ==> Allow SSH
/proc/PID/fd – Directory, which contains all file descriptors.
iptables -A INPUT -p tcp --dport 80 -j ACCEPT ==> Allow incoming web traffic
/proc/PID/maps – Memory maps to executables and library files.
iptables -A INPUT -j DROP ==> Blocking Traffic
/proc/PID/mem – Memory held by this process.
iptables -A INPUT -i ens160 -s 10.140.198.7 -j DROP ==> Blocking Traffic
/proc/PID/root – Link to the root directory of this process.
iptables -I INPUT 1 -i lo -j ACCEPT ==> Allow loopback
/proc/PID/stat – Process status.
iptables -I INPUT 5 -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 ==> Logging
/proc/PID/statm – Process memory status information.
/proc/PID/status – Process status in human readable form (eg: GID, UID, etc)
/proc/PID/limits – Contains information about the limits of the process
 
 
=== TCPDump ===
Usage:
ls -l /proc/$(pgrep -n python)/exe
 
sudo tcpdump -s 0 -i ens160 host 10.1.1.1 -v -w /tmp/packet_capture.cap
sudo tcpdump -s 0 -i ens160 host 10.1.1.1 and port 22 -v -w /tmp/packet_capture.cap
sudo tcpdump -s 0 -i ens160 host 10.1.1.1 and port not 22 and port not 80 -v -w /tmp/packet_capture.cap
sudo tcpdump -s 0 -i ens160 host 10.1.1.1 and tcp port not 22 and tcp port not 80 -v -w /tmp/packet_capture.cap
 
for i in `find . -type f | egrep "All.pcap"`; do echo $i; tcpdump -r $i '((host 1.1.1.1 or host 2.2.2.2) and host 3.3.3.3) and port 445' ; echo -e "\n"; done
== Inode Number ==
 
Source: [https://linoxide.com/linux-command/linux-inode/ linoxide.com]
 
=== MTR ===
* Inode is entry in inode table containing metadata about a regular file and directory.
* An inode is a data structure on a traditional Unix-style file system such as ext3 or ext4.
* Linux extended filesystems such as ext2 or ext3 maintain an array of these inodes: the inode table.
* This table contains list of all files in that filesystem.
* The individual inodes in inode table have a unique number (unique to that filesystem) - the inode number.
* There are some data about files, such as their size, ownership, permissions, timestamp etc.
* This meta-data about a file is managed with a data structure known as an inode (index node).
 
Provides the functionality of both the ping and traceroute commands.
* There is no entry for file name in the Inode, file name is kept as a separate entry parallel to Inode number.
Prints information about the entire route.
* This is for maintaining hard-links to files.
 
mtr google.com
* Copy file: cp allocates a free inode number and placing a new entry in inode table.
mtr -g google.com Display Numeric IP addresses
* Move or Rename a file: if destination is same filesystem as the source, Has no impact on inode number, it only changes the time stamps in inode table.
mtr -b google.com Both hostnames and numeric IP addresses
* Delete a file: Deleting a file in Linux decrements the link count and freeing the inode number to be reused.
mtr --tcp google.com Use TCP SYN packets
mtr --udp google.com UDP datagrams
 
=== Traceroute ===
* A Directory cannot hold two files with same name because it cannot map one name with two different inode numbers.
* The inode number of / directory is fixed, and is always 2.
 
traceroute 4.2.2.2 ==> Uses UDP
* There exists an algorithm which is used to create number of Inodes in a file system.
traceroute -n 4.2.2.2 ==> Do not resolve hostnames
* This algorithm takes into consideration the size of the file system and average file size.
sudo traceroute -nI 4.2.2.2 ==> Use ICMP Packets
* The user can tweak the number of Inodes while creating the file system.
sudo traceroute -nT 4.2.2.2 ==> Use TCP Syn (Port 80)
 
=== Netstat ===
*Inode number (or index number) consists following attributes:
 
netstat -s
File type: Regular file, directory, pipe etc.
netstat -a Listing all ports (both TCP and UDP)
Permissions: Read, write, execute
netstat -at Listing TCP Ports connections
Link count: The number of hard link relative to an inode
netstat -au Listing UDP Ports connections
User ID: Owner of file
netstat -l Listing all LISTENING Connections
Group ID: Group owner
netstat -lt Listing all TCP Listening Ports
Size of file: or major/minor number in case of some special files
netstat -s Showing Statistics by Protocol
Time stamp: Access time, modification time and (inode) change time
netstat -st Showing Statistics by TCP Protocol
Attributes: Immutable' for example
netstat -tp Displaying Service name with PID
Access control list: Permissions for special users/groups
netstat -r Displaying Kernel IP routing
Link to location of file
Other metadata about the file
 
*Check info:
df -i ==> Inodes on Filesystem
df -i /dev/vda1 ==> Inodes on Filesystem
ls -il myfile.txt ==> Show inode no of file
find /home/rahul -inum 1150561 ==> Find file using inode no
stat unetbootin.bin ==> Show all details of file
stat --format=%i unetbootin.bin ==> Shows only inode no
 
* Manipulate the filesystem meta data
List the contents of the filesystem superblock
tune2fs -l /dev/sda6 | grep inode
 
Make sure files on the file system are not being accessed:
mount -o remount /yourfilesystem
 
debugfs /dev/sda1 ==> Manipulate FS here
 
You can use debugfs to undelete a file by using its inode and indicating a file
 
* Free Inodes on Filesystem
In the case of inodes are full, You need to remove unused files from the filesystem to make Inode free.
There is no option to increase/decrease inodes on disk.
Its only created during the creation of filesystem on any disk.
 
== Sort links vs Hard link ==
 
;Links and index number in Linux
* In the output of ls -l, the column following the permissions and before owner is the link count.
drwxr-xr-x '''6''' aman aman 4096 Mar 30 11:50 Documents
drwxr-xr-x '''3''' aman aman 4096 Sep 15 19:11 Downloads
^
* Link count is the number of Hard Links to a file.
* A link is a pointer to another file.
* There are two types of links:
<br />
 
;Symbolic links (or Soft Links)
* A separate file whose contents point to the linked-to file.
* When creating a Sym link, first refer to the name of the original file and then to the name of the link:
ln -s /home/bob/sync.sh filesync
 
* Editing Sym link is like directly edit the original file.
* If we delete or move the original file, the link will be broken and our filesync file will not be longer available.
 
* The ls -l command shows that the resulting file is a symbolic link:
ls -l filesync
lrwxrwxrwx 1 root root 20 Apr 7 06:08 filesync -> /home/bobbin/sync.sh
 
* The contents of a symbolic link are the name of target file only.
* The permissions on the symbolic link are completely open.
* This is because the permissions are not managed
* The original file is just a name that is connected directly to the inode, and the symbolic link refers to the name.
* The size of the symbolic link is the number of bytes in the name of the file it refers to, because no other information is available in the symbolic link.
<br />
 
;Hard links
 
* The identity of a file is its inode number, not its name.
* A hard link is a name that references an inode.
* It means that if file1 has a hard link named file2, then both of these files refer to same inode.
* So, when you create a hard link for a file, all you really do is add a new name to an inode.
*there is no difference between the original file and the link: they are just two names connected to the same inode.
 
* Create a Hard link:
ln /home/bob/sync.sh synchro
 
*Compare:
ls -il /home/bob/sync.sh synchro
517333 -rw-r----- 2 root root 5 Apr 7 06:09 /home/bob/sync.sh
517333 -rw-r----- 2 root root 5 Apr 7 06:09 synchro
 
*The directories cannot be hard linked as Linux does not permit this to maintain the acyclic tree structure of directories.
*A hard link cannot be created across filesystems. Both the files must be on the same filesystems, because different filesystems have different independent inode tables (two files on different filesystems, but with same inode number will be different).
 
*How to find hard link in Linux
# find / -inum 517333
/home/bob/sync.sh
/root/synchro
 
;Remove files
* When rm command is issued, first it checks the link count of the file.
* If the link count is greater than 1, then it removes that directory entry and decreases the link count.
* Still, data is present, nor is the inode affected.
* And when link count is 1, the inode is deleted from the inode table, inode number becomes free, and the data blocks that this file was occupying are added to the free data block list.
 
== Hosts file ==
 
* All operating systems with network support have a hosts file in order to translate hostnames to IP addresses.
* The file /etc/hosts started in the old days of DARPA as the resolution file for all the hosts connected to the internet (before DNS existed).
* It has the maximum priority ahead of any other name system
 
* Order of name resolution is actually defined in /etc/nsswitch.conf, which usually has this entry:
hosts: files dns
 
* This means "try files (/etc/hosts); and if it fails, try DNS."
* i.e. If the host name is not found there, then consult the remote DNS name servers identified by the /etc/resolv.conf file.
* This order could be changed or expanded.
 
* As a single file, it doesn't scale well: the size of the file becomes too big very soon.
* That is why the DNS system was developed, a hierarchical distributed name system.
* It allows any host to find the numerical address of some other host efficiently.
 
* On Linux and Mac OS it is located here: /etc/hosts
* On Windows it is under: Windows\System32\drivers\etc\
 
* The hosts file contains lines of text consisting of an IP address field followed by One or More Host names.
* Each field is separated by white space – tabs or spaces.
* Comment lines are indicated by an octothorpe (#) in the first position.
* Entirely blank lines in the file are ignored.
* One name may resolve to several addresses (192.168.0.8 10.0.0.27).
* However which one is used depends on the routes (and their priorities) set for the computer.
 
* By editing the hosts files, you can achieve:
Block a website
Handle an attack or resolve a prank
Create an alias for locations on your local server
Override addresses that your DNS server provides
Control access to network traffic
 
* IP-to-hostname conversion usually display only the first name found:
 
192.168.10.12 server.example.com myftp.example.com myhost myftp
 
$ ping myftp
PING myhost.example.com (192.168.10.12) 56(84) bytes of data.
64 bytes from myhost.example.com (192.168.10.12): icmp_seq=1 ttl=64 time=0.023 ms
64 bytes from myhost.example.com (192.168.10.12): icmp_seq=2 ttl=64 time=0.028 ms
 
Note that we pinged myftp but results come from host myhost. This is a reliable hint that you are addressing an alias, not the actual host.
 
== Check IP and DNS info ==
 
== Adding Vlan in Linux ==
 
== File permission ==
 
;Linux File Permission Basics
 
* The first character represents the type of file.
* The remaining nine bits in groups of three represent the permissions for the user, group, and global respectively.
 
File Type User Group Global
d Directory rwx r-x r-x
- Regular file rw- r-- r--
l Symbolic Link rwx rwx rwx
 
* Permissions Meaning
Permission On a file On a directory
r (read) read file content (cat) read directory content (ls)
w (write) change file content (vi) create file in directory (touch)
x (execute) execute the file enter the directory (cd)
 
* Targeted Users:
Who (Letter) Meaning
u user
g group
o others
a all
 
*Permissions Table:
Binary Octal Permission
000 0 —
001 1 –x
010 2 -w-
011 3 -wx
100 4 r–
101 5 r-x
110 6 rw-
111 7 rwx
 
;chmod Command Syntax and Options
chmod [who][+,-,=][permissions] filename
 
*Example:
chmod g+w ~/group-project.txt
 
* The + operator grants permissions whereas the - operator takes away permissions.
* Copying permissions is also possible:
chmod g=u ~/group-project.txt
 
* The parameter g=u means grant group permissions to be same as the user’s.
 
* Multiple permissions can be specified by separating them with a comma, as in the following example:
chmod g+w,o-rw,a+x ~/group-project-files/
 
* Owner of the file is referred to as the user (e.g. u+x).
 
* The -R option applies the modification to the permissions recursively to the directory specified:
chmod -R +w,g=rw,o-rw, ~/group-project-files/
 
* Restrict File Access: Remove all Group and World PermissionsPermalink
chmod 600 .msmtprc
chmod g-rwx,o-rwx .fetchmail
 
;Octal Notation for File Permissions:
 
* The permissions to be set for file:
chmod u=rwx,g=rx,o= group-project.txt
chmod 750 group-project.txt
 
* Disregarding the first bit, each bit that is occupied with a - can be replaced with a 0 while r, w, or x is represented by a 1:
111 101 000
- rwx r-x ---
 
* This is called octal notation because the binary numbers are converted to base-8 by using the digits 0 to 7
 
* Typical default permission: 744
Allows R,W,X permissions for the owner
R permissions for the group and “world” users
* Other default permissions are 600 or 644
* For executable files, the equivalent settings would be 700 and 755
 
;umask
* Known as User Mask or User File creation MASK.
* While creating a file or directory, by default a set of permissions are applied.
* These default permissions are viewed by umask command.
* For safety reasons all Unix systems doesn't provide execution permission to newly created files.
* The 'mkdir -m' command can be used to set the mode.
 
mkdir -m 777 dir1
mkdir -m 000 dir2
 
* Preserves the permissions and time stamps from source file:
cp -p list dupli.txt
 
== Commands ==
 
=== CPU ===
 
; CPU Info
lscpu
lshw -C CPU
hardinfo ==> sudo apt install hardinfo
nproc
sudo dmidecode -t 4
cpuid
cat /proc/cpuinfo
cat /proc/cpuinfo | grep processor | wc -l
 
* The number of processors shown by /proc/cpuinfo might not be the actual number of cores on the processor.
* For example a processor with 2 cores and hyperthreading would be reported as a processor with 4 cores.
* If there are 4 different core ids, this indicates that there are 4 actual cores.
 
# cat /proc/cpuinfo | grep 'core id'
core id : 0
core id : 2
core id : 1
core id : 3
 
; CPU Usage
top -o %CPU
htop
vmstat
sar 1 3 ==> yum install sysstat
iostat ==> yum install sysstat
 
; Top Command
<pre>
top - 01:07:37 up 2:40, 1 user, load average: 0.37, 0.37, 0.39
Tasks: 286 total, 1 running, 285 sleeping, 0 stopped, 0 zombie
%Cpu(s): 4.7 us, 1.6 sy, 0.0 ni, 93.8 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st
MiB Mem : 15935.7 total, 9403.3 free, 3045.2 used, 3487.1 buff/cache
MiB Swap: 4100.0 total, 4100.0 free, 0.0 used. 11720.3 avail Mem
 
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
6865 aman 20 0 982620 85280 53716 S 6.2 0.5 2:52.77 Xorg
10082 aman 20 0 3537624 285448 118848 S 6.2 1.7 5:45.24 gnome-shell
</pre>
 
CPU Section
 
us user cpu time % CPU time spent in user space
sy system cpu time % CPU time spent in kernel space
ni user nice cpu time % CPU time spent on low priority processes
id idle cpu time % CPU time spent idle
wa io wait cpu time % CPU time spent in wait (on disk)
hi hardware irq % CPU time spent servicing/handling hardware interrupts
si software irq % CPU time spent servicing/handling software interrupts
st steal time % CPU time stolen from a virtual machine
 
 
Main Section:
%MEM directly related to RES, percentage use of total physical memory by the process.
VIRT total memory that this process has access to shared memory, mapped pages, swapped out pages, etc.
RES total physical memory used shared or private that the process has access to.
SHR total physical shared memory that the process has access to.
 
RES is most close to the memory used by the process in memory, excluding what’s swapped out.
This includes the SHR (shared physical memory) which mean it could have been used by some other process as well.
 
;Obtain the PID:
pgrep -n python
pidof chrome - return all PIDs
pidof -s chrome - return only 1 PID
ps -C chrome -o pid= - C = CMD
 
 
=== Memory ===
 
;Info
dmidecode -t 17
 
;Usage
cat /proc/meminfo ==> egrep --color 'Mem|Cache|Swap' /proc/meminfo
top -o %MEM
free -m
total used free shared buff/cache available
Mem: 15935 3046 9470 767 3418 11787
Swap: 4099 0 4099
 
vmstat
vmstat -s ==> More detailed
htop
 
;Per Process usage check
ps -o pid,user,%mem,command ax | sort -b -k3 -r
sudo pmap 917 ==> Libraries, other files, etc usage of memory
sudo pmap 917 | tail -n 1 ==> Total used by this process
 
 
=== HDD ===
 
du -h ==> space by dir including all subdir in dir tree
du -sh /etc/ ==> total disk space used by dir and suppress subdir
du -ah /etc/ ==> see all files, not just directories:
 
df -h
Filesystem Type Size Used Avail Use% Mounted on
/dev/sda4 ext4 77G 51G 22G 71% /
df -T -h ==> List Filesystem type as well
df -t ext4 ==> Only see ext4 file system
df -a ==> List all filesystems that have a size of zero blocks as well
df -i ==> Display File System Inodes
 
lsblk ==> Lists out all the storage blocks, which includes disk partitions and optical drives
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 1.8T 0 disk
├─sda1 8:1 0 500M 0 part /boot/efi
├─sda2 8:2 0 128M 0 part
 
sudo fdisk -l ==> Partition & FS Type details
parted ==> List out partitions and modify them
 
=== IP DNS Info ===
 
; IP
ip addr show (ip a)
ifconfig
hostname -I
ip route get 8.8.8.8 | head -1 | awk '{print $7}'
ip route get 8.8.8.8 | head -1 | cut -d' ' -f7
 
; DNS
cat /etc/resolv.conf
nmcli dev show | grep DNS
systemd-resolve --status
resolvectl status | grep -1 'DNS Server'
 
; DNS of Domains
 
Host Command:
host google.com
host -t a google.com
host -t mx google.com
host -t soa cyberciti.biz
host -t cname files.cyberciti.biz
host -t txt cyberciti.biz
host google.com ns2.google.com ==> Query a particular host
host -t any google.com
 
DIG Command:
dig cyberciti.biz a
dig cyberciti.biz mx
dig cyberciti.biz ns
dig cyberciti.biz txt
dig @ns1.nixcraft.net cyberciti.biz a
dig @4.2.2.2 google.com soa
 
=== Misc ===
 
*Netstat
netstat -s
netstat -anp
netstat -ant
 
=== PS ===
*ps
ps -aux Display all processes in BSD format
 
ps -eo pid,ppid,user,cmd
ps -aux
ps -e --forest Print Process Tree
ps -ant
ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head
ps -anp
ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu | head
 
=== LS ===
*ls
 
Append a character to each file name indicating the file type:
Line 1,143 ⟶ 939:
</pre>
 
=== Redirect Stderr ===
 
0 stdin – Use to get input (keyboard)
*curl
1 stdout – Use to write information (screen) 1> >
2 stderr – Use to write error message (screen) 2>
 
Redirect Stderr into Stdout:
*wget
2>&1
ls > file.log 2>&1 OR ls &> file.log
ls > file.log 2> /dev/null
 
=== System Calls ===
*nslookup
{{UC}}
 
= Sorting Algorithms =
*dig
 
*mtr
 
* Quicksort
*Find Sym Links:
It is a good default choice.
find . -type l -ls
It tends to be fast in practice with some small tweaks its dreaded O(n2)O(n^2)O(n2) worst-case time complexity becomes very unlikely.
ls -la | grep "\->"
A tried and true favorite.
 
* Heapsort
= Flows =
It is a good choice if you can't tolerate a worst-case time complexity of O(n2)O(n^2)O(n2) or need low space costs.
The Linux kernel uses heapsort instead of quicksort for both of those reasons.
 
* Merge sort
*Complete Flow of PC opening a Website:
It is a good choice if you want a stable sorting algorithm.
It can easily be extended to handle data sets that can't fit in RAM where the bottleneck cost is reading and writing the input on disk, not comparing and swapping individual items.
 
* Radix sort
#Check NW config
It looks fast, with its O(n)O(n)O(n) worst-case time complexity.
#DHCP if not configured
If you're using it to sort binary numbers, then there's a hidden constant factor that's usually 32 or 64 (depending on how many bits your numbers are).
#Check Domain name in Browser Cache
That's often way bigger than O(lg⁡(n))O(\lg(n))O(lg(n)), meaning radix sort tends to be slow in practice.
#Check Domain name in OS Cache
* Counting sort
#Check if an entry exists in Hosts File
It is a good choice in scenarios where there are small number of distinct values to be sorted.
#If not Found in any cache, Prepare to send UDP DNS query to DNS Server
This is pretty rare in practice, and counting sort doesn't get much use.
#If DNS Server configured is in same Network Check MAC address in ARP Table
#If not found, send ARP for MAC Address
#Forward DNS Query to DNS Server and wait for reply containing IP address of Website
#If DNS server configured is not in same subnet, check Gateway config(IP & MAC address)
#If MAC address not found in ARP Table, send ARP request
#After getting reply, fwd the DNS query to gateway
#After getting DNS response, start TCP 3-way handshake S-SA-A.
#Start SSL Handshake if SSL/TLS configured
#Send GET Request
#Client sends ACK & Body containing HTML Data
#If HTTP 1.0, Server sends FIN & CLoses connection
#Client send FIN-ACK
#Server sends Ack
 
* Which sorting algorithm has best asymptotic run time complexity?
 
= Python =
*Complete Flow of DNS Traffic
 
* Regex
#Check NW config
re.match() => Matches Beginning
#DHCP if not configured
re.search() => Matches Anywhere
#Check Domain name in Browser Cache
re.findall() => All Matching Objects
#Check Domain name in OS Cache
re.sub('[ES]', 'a', s) => Substitute
#Check if an entry exists in Hosts File
#If not Found in any cache, Prepare to send UDP DNS query to DNS Server
#If DNS Server configured is in same Network Check MAC address in ARP Table
#If not found, send ARP for MAC Address
#Forward DNS Query to DNS Server and wait for reply containing IP address of Website
#If DNS server configured is not in same subnet, check Gateway config(IP & MAC address)
#If MAC address not found in ARP Table, send ARP request
#After getting reply, fwd the DNS query to gateway
#DNS Server ??
#DNS Server ?? Iterative? Recursive? TLD? Authoritative
#DNS Server ??
#After getting DNS response, start TCP 3-way handshake S-SA-A.
 
* Lists
 
* Dictionary
 
* File operations
Using Open:
f = open('/etc/passwd')
f.read(5)
f.close()
 
Using With Open(better, auto closes the file):
*Complete Flow of Traffic passing through below scenario:
with open('/etc/passwd') as f:
[PC1]-----[Hub]-----[Switch]-----[Router]------[Router]------[PC2]
for line in f:
print(line)
 
* Class
 
* OS Interaction:
 
import os
os.system("date")
 
import os
#Check NW config
f = os.popen('date')
#DHCP if not configured
now = f.read()
#Check if PC2 in same Subnet(not in this scenario as routers present)
print("Today is ", now)
#If in Same Subnet, check if MAC address is there in ARP Table
 
#Else send ARP Request
import subprocess
#Once MAC address is known, directly send Packet to PC2
subprocess.call(["ls", "-l", "/etc/resolv.conf"])
#If PC2 is in Different Subnet(True for above scenario), Check Gateway IP address & MAC address
 
#If MAC address is not known, send an ARP request.
import subprocess
#Hub is directly connected, will receive & Flood packet on all Ports.
p = subprocess.Popen("date", stdout=subprocess.PIPE, shell=True)
#Switch will receive packet and check its CAM Table for the MAC to Port bindings
(output, err) = p.communicate()
#If MAC entry is not found in CAM table, Switch will Flood the ARP packet on all ports.
print("Today is", output)
#Other destinations will drop the ARP Request packet as they do not have the IP address requested in ARP Header.
 
#Only Router will accept the packet as it has the requested IP address matching its own MAC address.
= SMTP =
#It will reply with an ARP Reply message.
 
#Switch will add an entry of this MAC address & port number in its CAM Table once the reply packet pass through it.
HELO or EHLO (Hello)
#Hub will flood the packet through all ports.
MAIL FROM
#ARP Reply will reach PC1, it will add entry to its ARP Table
250 OK reply code
#Then send a packet destined to PC2 with destintion MAC address as Router's Interface's MAC address received in ARP reply.
RCPT TO (Recipient To)
250 OK reply code
DATA
345 reply code
250 OK code
QUIT
221 code
 
RSET (Reset)
 
SMTP errors:
4.X.X Persistent Transient Failure
5.X.X Permanent Error:
Retrieved from "https://aman.awiki.org/wiki/Special:MobileDiff/3664...4668"