Cheatsheet: Difference between revisions
Content added Content deleted
(→ProcFS) |
|||
(138 intermediate revisions by the same user not shown) | |||
Line 5: | Line 5: | ||
= ARP vs MAC Table = |
= ARP vs MAC Table vs CAM Table = |
||
{{notice|Need to confirm if MAC Table is same as CAM table}} |
|||
<center> |
<center> |
||
{| class="wikitable" |
{| class="wikitable" |
||
|- |
|- |
||
! ARP Table !! MAC Table (or CAM Table) |
! ARP Table !! MAC Table (or CAM Table) ||CAM Table |
||
|- |
|- |
||
| Layer3 address to Layer2 address resolution || Layer2 address to Interface binding |
| Layer3 address to Layer2 address resolution || Layer2 address to Interface binding |
||
Line 149: | Line 152: | ||
|} |
|} |
||
*;ARP Header |
|||
Hardware type |
|||
Protocol type |
|||
Hardware address length |
|||
Protocol address length |
|||
Operation |
|||
Source MAC |
|||
Source IP |
|||
Dest MAC |
|||
Dest IP |
|||
<br /> |
<br /> |
||
{| class="wikitable" style="margin: 0 auto; text-align:center; width:80%;" |
|||
|+DNS Headers |
|||
|- |
|||
| colspan="16"| Identification || colspan="1"| QR || colspan="4"| Opcode || cellpadding="1"|<tt>A<br>A</tt>|||<tt>T<br>C</tt>|||<tt>R<br>D</tt>|||<tt>R<br>A</tt>|||<tt>Z</tt>|||<tt>A<br>D</tt>|||<tt>C<br>D</tt>|| colspan="4"| RCode |
|||
|- |
|||
| colspan="16"| Total Questions || colspan="16"| Total Answers |
|||
|- |
|||
| colspan="16"| Total Authority Resource Records || colspan="16"| Total Additional Resource Records |
|||
|} |
|||
<br /> |
|||
*AD Authentic Data |
|||
*CD Checking Disabled |
|||
<center> |
|||
{| class="wikitable" style="text-align: center; width: 30em;" border=1 |
|||
|+ARP Headers |
|||
|- |
|||
| colspan="16"| Hardware type <small>(Ethernet = 1</small>) |
|||
|- |
|||
| colspan="16"| Protocol type <small>(IPv4 = 0x0800)</small> |
|||
|- |
|||
| colspan="8"| Hardware address length (Ethernet size is 6) |
|||
| colspan="8"| Protocol address length (IPv4 size is 4.) |
|||
|- |
|||
| colspan="16"| Operation ( 1 for request; 2 for reply) |
|||
|- |
|||
| colspan="16" style="background:#f0fff0"| Source MAC |
|||
|- |
|||
| colspan="16" style="background:#d0ffd0"| Source IP |
|||
|- |
|||
| colspan="16" style="background:#f0f0ff"| Dest MAC |
|||
|- |
|||
| colspan="16" style="background:#d0d0ff"| Dest IP |
|||
|} |
|||
</center> |
|||
;<center>GARP</center> |
|||
[[File:GARP.png|center]] |
|||
Line 167: | Line 201: | ||
Rest of Header |
Rest of Header |
||
<br /> |
<br /> |
||
= DNS = |
|||
;Record Types |
|||
A Address record Returns a 32-bit IPv4 address, |
|||
AAAA IPv6 address record |
|||
CNAME Canonical name record Alias of one name to another, DNS lookup will continue by retrying the lookup with the new name. |
|||
LOC Location record Specifies a geographical location associated with a domain name |
|||
MX Mail exchange record Maps a domain name to a list of message transfer agents for that domain |
|||
NS Name server record Delegates a DNS zone to use the given authoritative name servers |
|||
PTR Pointer record Pointer to a canonical name. Unlike a CNAME, DNS processing stops and just the name is returned. The most common use is for implementing reverse |
|||
DNS lookups. |
|||
SOA Start of [a zone of] authority record Specifies authoritative information about a DNS zone, including the primary name server, the email of the domain administrator, the domain serial |
|||
number,etc |
|||
SRV Service locator Generalized service location record, used for newer protocols instead of creating protocol-specific records such as MX. |
|||
TXT Text record Originally for arbitrary human-readable text in a DNS record. Now more often carries machine-readable data, opportunistic encryption, Sender Policy |
|||
Framework, etc. |
|||
* All cached records Returns all cached records of all types known to the name server. If the name server does not have any information on the name, the request will be |
|||
forwarded on. |
|||
AXFR Authoritative Zone Transfer Transfer entire zone file from the master name server to secondary name servers. |
|||
IXFR Incremental Zone Transfer Requests a zone transfer of the given zone but only differences from a previous serial number. |
|||
<br /> |
|||
;Glue Record |
|||
* A glue record is a term for a record that's served by a DNS server that's not authoritative for the zone, to avoid a condition of impossible dependencies for a DNS zone. |
|||
* What glue records do is to allow the TLD's servers to send extra information in their response to the query for the example.com zone - to send the IP address that's configured for the name servers. |
|||
* It's not authoritative, but it's a pointer to the authoritative servers, allowing for the loop to be resolved. |
|||
= TCP = |
= TCP = |
||
*Parameters determined during Handshake: |
*Parameters determined during Handshake: |
||
MSS (default is 536) |
|||
MSS |
|||
WSF |
WSF |
||
SACK Permitted |
SACK Permitted |
||
Line 179: | Line 242: | ||
[[File:Mtu mss.png|center]] |
[[File:Mtu mss.png|center]] |
||
* '''RTO:''' Four ACKs acknowledging the same packet, which are not piggybacked on data and do not change the receiver's advertised window. |
|||
*Fast Retransmission |
|||
- If RTO has a larger value |
|||
- If sender receives four acknowledgments with same value (three duplicates) |
|||
- Segment expected by all of these Ack is resent immediately |
|||
*Fast Recovery: |
|||
- |
|||
- |
|||
*Congestion Control |
*Congestion Control |
||
;Slow Start - Exponential Increase |
;Slow Start - Exponential Increase |
||
- Sender starts with cwnd = 1 MSS, Size increases 1 MSS each time one Ack arrives, Increases the rate exponentially(1,2,4,8....) until a threshold is reached |
- Sender starts with cwnd = 1 MSS, Size increases 1 MSS each time one Ack arrives, Increases the rate exponentially(1,2,4,8....) until a threshold is reached |
||
Line 201: | Line 276: | ||
- Starts the Congestion Avoidance phase |
- Starts the Congestion Avoidance phase |
||
- This is called fast transmission and fast recovery |
- This is called fast transmission and fast recovery |
||
---- |
|||
* Both consider RTO and Duplicate ACKs as packet loss events. |
|||
* Behavior of Tahoe and Reno differ primarily in how they react to duplicate ACKs. |
|||
<center> |
|||
{| class="wikitable" |
|||
|- |
|||
! Event !! Tahoe !! Reno |
|||
|- |
|||
| 3 Dup Acks || Performs a fast retransmit<br>Sets the slow start threshold to half of the current congestion window<br>Reduces the congestion window to 1 MSS<br>Resets to slow start state || Perform a fast retransmit<br>Skip the slow start phase by instead halving the congestion window<br>(instead of setting it to 1 MSS like Tahoe)<br>Setting the slow start threshold equal to the new congestion window<br>Enter a phase called fast recovery. |
|||
|- |
|||
| RTO (Ack time out) || Slow start is used<br>Reduce congestion window to 1 MSS || Slow start is used<br>Reduce congestion window to 1 MSS |
|||
|} |
|||
</center> |
|||
*Silly Window Syndrome: Sender creates data slowly or Receiver consumes slowly or both. |
*Silly Window Syndrome: Sender creates data slowly or Receiver consumes slowly or both. |
||
Line 211: | Line 302: | ||
- '''Delayed Acknowledgment''': Segment not acknowledged immediately, Sender TCP does not slide its window, reduces traffic, sender may unnecessarily retransmit, Not delay more than 500 ms. |
- '''Delayed Acknowledgment''': Segment not acknowledged immediately, Sender TCP does not slide its window, reduces traffic, sender may unnecessarily retransmit, Not delay more than 500 ms. |
||
*Fast Retransmission |
|||
- If RTO has a larger value |
|||
- If sender receives four acknowledgments with same value (three duplicates) |
|||
- Segment expected by all of these Ack is resent immediately |
|||
*Persistence Timer |
*Persistence Timer |
||
Line 225: | Line 312: | ||
= VPN Messages = |
= VPN Messages = |
||
<div style="column-count:3;-moz-column-count:3;-webkit-column-count:3"> |
|||
*;Phase 1 - Main Mode |
*;Phase 1 - Main Mode |
||
Line 239: | Line 325: | ||
ID,Accepted Proposal,DH Key,Nonce,ID Hash |
ID,Accepted Proposal,DH Key,Nonce,ID Hash |
||
ID Hash |
ID Hash |
||
*;Phase 2 - Quick Mode |
*;Phase 2 - Quick Mode |
||
Ph1 Hash,Message ID,Proposal List,Nonce, DH Key,Proxy-ID |
Ph1 Hash,Message ID,Proposal List,Nonce, DH Key,Proxy-ID |
||
Ph1 Hash,Message ID,Accepted Proposal,Nonce,DH Key,Proxy-ID |
Ph1 Hash,Message ID,Accepted Proposal,Nonce,DH Key,Proxy-ID |
||
Ph1 Hash,Message ID,Nonce |
Ph1 Hash,Message ID,Nonce |
||
</div> |
|||
= HTTP = |
|||
;HTTP Error Codes |
|||
<center> |
<center> |
||
Line 276: | Line 354: | ||
</center> |
</center> |
||
;HTTP1.0 vs HTTP1.1 |
|||
= HTTP Request Methods= |
|||
HTTP/1.0: |
|||
* Uses a new connection for each request/response exchange |
|||
* Closed connections after every request. |
|||
* Supports GET, POST, HEAD request methods |
|||
HTTP/1.1: |
|||
* Connection may be used for one or more request/response exchanges |
|||
* Uses persistent connections, save bandwidth & reduces latency as it does not require to do TCP Handshake again for every file download (like images, css, etc.) |
|||
* HTTP Pipeline feature in which client sends multiple requests before waiting for each response. |
|||
* Supports OPTIONS, PUT, DELETE, TRACE, CONNECT request methods |
|||
<br /> |
|||
;HTTP/1.1 vs HTTP/2 |
|||
* HTTP/2 Supports Page load speed improvements through: |
|||
'''Compression of request headers''' |
|||
'''Binary protocol''' |
|||
'''HTTP/2 Server Push''': capability allows the server to send additional cacheable information to the client that isn’t requested but is anticipated in future requests. |
|||
'''Request multiplexing over a single TCP connection''' |
|||
'''Request pipelining''' |
|||
'''HOL blocking (Head-of-line) — Package blocking''' |
|||
;HTTP Request Methods |
|||
GET: Retrieve Data |
GET: Retrieve Data |
||
HEAD: Header only without Response Body |
HEAD: Header only without Response Body |
||
Line 285: | Line 389: | ||
OPTIONS: Returns the HTTP methods that the server supports for the specified URL |
OPTIONS: Returns the HTTP methods that the server supports for the specified URL |
||
TRACE: Performs a message loop back test to see what (if any) changes or additions have been made by intermediate servers |
TRACE: Performs a message loop back test to see what (if any) changes or additions have been made by intermediate servers |
||
PATCH: Applies partial modifications to a resource. |
|||
PATCH: |
|||
; PUT vs PATCH |
|||
PUT method only allows a complete replacement of a document. |
|||
PATCH is used to make changes to part of the resource at a location. |
|||
== Cookie == |
|||
*Session cookie |
|||
*Persistent cookie |
|||
*Secure cookie |
|||
*Http-only cookie |
|||
*Same-site cookie |
|||
*Third-party cookie |
|||
*Supercookie |
|||
Other uses |
|||
*Zombie cookie |
|||
== HTTP Headers == |
|||
{|class="wikitable" |
|||
|- |
|||
! Header !! Uses |
|||
|- |
|||
|Set-cookie || |
|||
|- |
|||
|Location ||1) Used to ask a web browser to load a different web page<br/>Client request:<br/>''GET /index.html HTTP/1.1''<br/>''Host: www.example.com''<br/>Server response:<br/>''HTTP/1.1 302 Found''<br/>''Location: http://www.example.org/index.php.''<br/> |
|||
2) To provide info about location of a newly created resource, the Location header should be sent with an HTTP status code of 201 or 202. |
|||
|- |
|||
|Host||The host Header tells the webserver which virtual host to use if same virtual host is using several aliases |
|||
|- |
|||
|Accept|| |
|||
|- |
|||
|User-Agent|| |
|||
|- |
|||
|content-type|| |
|||
|- |
|||
|content-length|| |
|||
|- |
|||
|date|| |
|||
|- |
|||
|expires|| |
|||
|- |
|||
|Authorization||Basic access authentication is used to provide a user name and password when making a request.<br/>Credentials are the base64 encoding of id and password joined by a single colon<br/>Base64-encoding of 'Aladdin:OpenSesame' is 'QWxhZGRpbjpPcGVuU2VzYW1l'<br/>''Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l''<br/>''https://Aladdin:OpenSesame@www.example.com/index.html'' ==> This will not ask for the credentials; deprecated now |
|||
|- |
|||
|Referrer||When a user clicks a hyperlink in a web browser, the browser sends a request to the server holding the destination webpage.<br/> |
|||
The request may include the referer field, which indicates the last page the user was on (the one where they clicked the link). |
|||
|- |
|||
|X-Forwarded-For (XFF)||Used for identifying the originating IP address of a client connecting to a Web Server through an HTTP Proxy or Load Balancer. |
|||
|} |
|||
= FTP = |
|||
[[File:Active-Passive_FTP.JPG|centre]] |
|||
= SSL Handshake = |
= SSL Handshake = |
||
[[File:SSL Handshake.png|center]] |
[[File:SSL Handshake.png|center]] |
||
--> Client Hello |
|||
<-- Server Hello, Certificate, Server Hello Done |
|||
--> Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message(Finished) |
|||
<-- Change Cipher Spec, Encrypted Handshake Message(Finished) |
|||
--> Application Data(GET) |
|||
<-- Encrypted Handshake Message(Hello Request) |
|||
#Client sends the supported parameters |
|||
#Server chooses the parameters; Sends the certificate; And first half of the Diffie-Hellman key exchange |
|||
#Client sends the second half of the Diffie-Hellman exchange, Computes the session keys; Switches to encrypted communication |
|||
#Server computes the session keys; Switches to encrypted communication. |
|||
<br> |
|||
; SSLv1 vs TLS 1.0 vs TLS1.3 |
|||
SSL 2.0 - Deprecated |
|||
SSL 3.0 - Deprecated |
|||
TLS 1.0 - Deprecated |
|||
TLS 1.1 - Deprecated |
|||
TLS 1.2 - |
|||
TLS 1.3 - |
|||
= NetScaler = |
= NetScaler = |
||
*LB Methods: |
*LB Methods: |
||
Least Connection = Service with fewest active connections |
Least Connection = Service with fewest active connections |
||
Round Robin = Rotates a list of services |
Round Robin = Rotates a list of services |
||
Least Response time |
Least Response time = Fewest active connections & lowest average response time |
||
Least Bandwidth = Service serving least amount of traffic measured in mbps |
Least Bandwidth = Service serving least amount of traffic measured in mbps |
||
Least Packets = Service that received fewest packets |
Least Packets = Service that received fewest packets |
||
Line 303: | Line 482: | ||
*Persistence Methods: |
*Persistence Methods: |
||
SOURCE IP = |
SOURCE IP = |
||
COOKIE Insert = Connections having same HTTP Cookie inserted by Set-Cookie directive from server belong to same persistence session. |
COOKIE Insert = Connections having same HTTP Cookie inserted by Set-Cookie directive from server belong to same persistence session. |
||
SSL Session = Connections having same SSL session ID |
SSL Session = Connections having same SSL session ID |
||
Line 322: | Line 501: | ||
= OSPF = |
= OSPF = |
||
<div style="column-count:4;-moz-column-count:4;-webkit-column-count:4"> |
|||
* |
* States |
||
Down |
Down |
||
Attempt |
Attempt |
||
Init Hello sent out all int |
|||
Init |
|||
2-Way Hello rcvd cont own RID in ngbr list |
|||
2-Way |
|||
ExStart |
ExStart Determine master slave |
||
Exchange Master sends DBD first, then Slave |
|||
Exchange |
|||
Loading Comp DBDs, send LSR for missing LSAs |
|||
Loading |
|||
Full LSDB of ngbr are fully syncd |
|||
Full |
|||
* |
* LSA Type |
||
Type 1 - Router LSAs Sent from router to other routers in the same area, has info reg router's int in the same area, int IPs, adjacent routers |
|||
Type 1 - Router LSAs |
|||
Type 2 - Network LSAs |
Type 2 - Network LSAs Generated by the DR on a multi access segment, similar to LSA Type 1 |
||
Type 3 - Network Summary LSA |
Type 3 - Network Summary LSA Generated by ABRs, contain the subnets & costs |
||
Type 4 - ASBR summary LSA Same as summary LSA except the destination advertised by ABR is ASBR, ABR in same area as the ASBR will originate the Type 4 LSA. |
|||
Type 4 - ASBR summary LSA |
|||
Type 5 - AS external LSA |
Type 5 - AS external LSA Generated by ASBRs, Flooded throughout the AS to advertise a route external to OSPF |
||
Type 7 - NSSA External LSA |
Type 7 - NSSA External LSA Generated by the ASBR in an NSSA area, Converted into a type 5 LSA by the ABR when leaving the area |
||
* Packet Types |
|||
*;Packet Types |
|||
Type 1 - Hello |
Type 1 - Hello |
||
Type 2 - Database Description (DBD) |
Type 2 - Database Description (DBD) |
||
Type 3 - Link-State request (LSR) |
Type 3 - Link-State request (LSR) |
||
Type 4 - LSU |
Type 4 - LSU (Contain LSAs) |
||
Type 5 - LSAck |
Type 5 - LSAck |
||
* Neighbor Requirements: |
|||
*;Neighbor Requirements: |
|||
Same area |
Same area |
||
Same authentication config |
Same authentication config |
||
Line 357: | Line 533: | ||
Same hello/dead interval |
Same hello/dead interval |
||
Matching stub flags |
Matching stub flags |
||
* LSA Details |
|||
</div> |
|||
[[File:OSFF LSA 2.png|center]] |
[[File:OSFF LSA 2.png|center]] |
||
* OSPF path selection: O > O*IA > O*E1 > O*E2. |
* OSPF path selection: O > O*IA > O*E1 > O*E2 > N1 > N2. |
||
* “area range” summarize type 3 LSA’. |
* “area range” summarize type 3 LSA’. |
||
* “summary-address” summarize type 5 & 7 LSA’s. |
* “summary-address” summarize type 5 & 7 LSA’s. |
||
Line 371: | Line 545: | ||
= BGP = |
= BGP = |
||
* Route Selection Criteria |
|||
<div style="column-count:2;-moz-column-count:2;-webkit-column-count:2"> |
|||
*Route Selection Criteria |
|||
<center> |
|||
{| class="wikitable" |
{| class="wikitable" |
||
|- |
|- |
||
! Attribute !! Which is better |
! Attribute !! Which is better !! Type |
||
|- |
|- |
||
|Next Hop reachable || Route cannot be used if next hop is unreachable |
|Next Hop reachable || Route cannot be used if next hop is unreachable || Well-known Mandatory |
||
|- |
|- |
||
|Weight || Bigger; value local to the router; Cisco proprietary; default is 0 for all routes not originated by local router || |
|||
|Weight || Bigger |
|||
|- |
|- |
||
|Local Preference || Bigger |
|Local Preference || Bigger; used within AS and exchanged bw iBGP routers; default is 100 || Well-known discretionary |
||
|- |
|- |
||
|Locally Injected || |
|Locally Injected (Originate) || Prefer path local router originated; Locally injected > iBGP/eBGP learned; In BGP table it will hv next hop 0.0.0.0 || |
||
|- |
|- |
||
|AS Path Length || Smaller |
|AS Path Length || Smaller; e.g: AS path 1 2 3 is preferred over AS path 1 2 3 4 5 || Well-known Mandatory |
||
|- |
|- |
||
|Origin || Prefer |
|Origin || Prefer IGP(advertised by network cmd - i) > EGP > INCOMPLETE - '?'(reditributed) || Well-known Mandatory |
||
|- |
|- |
||
|MED(Metric) || Smaller; used to advertise to neighbors how they should enter your AS; propagated to all routers within the neighbor AS but not passed along any other AS || Optional non-transitive |
|||
|MED || Smaller |
|||
|- |
|- |
||
|Neighbor Type || Prefer eBGP over iBGP |
|Neighbor Type || Prefer eBGP over iBGP || |
||
|- |
|- |
||
|IGP Metric to Next Hop || Smaller |
|IGP Metric to Next Hop || Smaller; Prefer the path within the AS with the lowest IGP metric to the BGP next hop || |
||
|- |
|||
|Oldest path || Prefer the path that we received first || |
|||
|- |
|||
|Router ID || Prefer the path with the lowest BGP neighbor router ID (Manually conf > Highest Loopback IP address > Highest Interface IP address) || |
|||
|- |
|||
|Neighbor IP address || Prefer the path with the lowest neighbor IP address || |
|||
|} |
|} |
||
< |
</center> |
||
<br /> |
<br /> |
||
Line 412: | Line 593: | ||
Notification Always indicate something is wrong |
Notification Always indicate something is wrong |
||
<br /> |
<br /> |
||
</div> |
|||
* Directions |
|||
'''Aspath prepend:''' Applied outwardly. |
|||
Impacts incoming path. |
|||
Shorter the as-path length higher the preference |
|||
As-path prepend is the way to add AS number to the list of subnet u want to advertise. |
|||
This is a way to route poisoning. |
|||
Tell the outside world not to follow the path. |
|||
'''Local preference:''' Applied while the traffic coming inside. |
|||
Impacts traffic while going out. |
|||
Non transitive. |
|||
Propagates within the same as-path. |
|||
Higher the local preference value higher the preference |
|||
'''MED:''' Multiexitdescriptor |
|||
When your router has connection with two other routers with same AS. |
|||
Let's say you have 2 subnets behind your router. |
|||
You can use MED value to mention which networks should be accessed through which links. |
|||
It is advertised outwards. |
|||
Impacts the incoming traffic. |
|||
Semi transitive. |
|||
Propagates to one AS. |
|||
Lower the MED value higher the preference. |
|||
MED should be used carefully as it reduces network resiliency. |
|||
=VPN Monitor vs DPD vs IKE Heartbeat = |
=VPN Monitor vs DPD vs IKE Heartbeat = |
||
Line 498: | Line 703: | ||
Timeout Value is maximum time before a half-completed connection is dropped from the queue |
Timeout Value is maximum time before a half-completed connection is dropped from the queue |
||
The range is 0–50s; default is 20s |
The range is 0–50s; default is 20s |
||
= Flows = |
|||
*Complete Flow of PC opening a Website: |
|||
#Check NW config |
|||
#DHCP if not configured |
|||
#Check Domain name in Browser Cache |
|||
#Check Domain name in OS Cache |
|||
#Check if an entry exists in Hosts File |
|||
#If not Found in any cache, Prepare to send UDP DNS query to DNS Server |
|||
#If DNS Server configured is in same Network Check MAC address in ARP Table |
|||
#If not found, send ARP for MAC Address |
|||
#Forward DNS Query to DNS Server and wait for reply containing IP address of Website |
|||
#If DNS server configured is not in same subnet, check Gateway config(IP & MAC address) |
|||
#If MAC address not found in ARP Table, send ARP request |
|||
#After getting reply, fwd the DNS query to gateway |
|||
#After getting DNS response, start TCP 3-way handshake S-SA-A. |
|||
#Start SSL Handshake if SSL/TLS configured |
|||
#Send GET Request |
|||
#Client sends ACK [200 OK] & Body containing HTML Data |
|||
#If HTTP 1.0, Server sends FIN & CLoses connection |
|||
#Client send FIN-ACK |
|||
#Server sends Ack |
|||
*Complete Flow of DNS Traffic |
|||
#Check NW config |
|||
#DHCP if not configured |
|||
#Check Domain name in Browser Cache |
|||
#Check Domain name in OS Cache |
|||
#Check if an entry exists in Hosts File |
|||
#If not Found in any cache, Prepare to send UDP DNS query to DNS Server |
|||
#If DNS Server configured is in same Network Check MAC address in ARP Table |
|||
#If not found, send ARP for MAC Address |
|||
#Forward DNS Query to DNS Server and wait for reply containing IP address of Website |
|||
#If DNS server configured is not in same subnet, check Gateway config(IP & MAC address) |
|||
#If MAC address not found in ARP Table, send ARP request |
|||
#After getting reply, fwd the DNS query to gateway |
|||
#DNS Server ?? |
|||
#DNS Server ?? Iterative? Recursive? TLD? Authoritative |
|||
#DNS Server ?? |
|||
#After getting DNS response, start TCP 3-way handshake S-SA-A. |
|||
*Complete Flow of Traffic passing through below scenario: |
|||
[PC1]-----[Hub]-----[Switch]-----[Router]------[Router]------[PC2] |
|||
#Check NW config |
|||
#DHCP if not configured |
|||
#Check if PC2 in same Subnet(not in this scenario as routers present) |
|||
#If in Same Subnet, check if MAC address is there in ARP Table |
|||
#Else send ARP Request |
|||
#Once MAC address is known, directly send Packet to PC2 |
|||
#If PC2 is in Different Subnet(True for above scenario), Check Gateway IP address & MAC address |
|||
#If MAC address is not known, send an ARP request. |
|||
#Hub is directly connected, will receive & Flood packet on all Ports. |
|||
#Switch will receive packet and check its CAM Table for the MAC to Port bindings |
|||
#If MAC entry is not found in CAM table, Switch will Flood the ARP packet on all ports. |
|||
#Other destinations will drop the ARP Request packet as they do not have the IP address requested in ARP Header. |
|||
#Only Router will accept the packet as it has the requested IP address matching its own MAC address. |
|||
#It will reply with an ARP Reply message. |
|||
#Switch will add an entry of this MAC address & port number in its CAM Table once the reply packet pass through it. |
|||
#Hub will flood the packet through all ports. |
|||
#ARP Reply will reach PC1, it will add entry to its ARP Table |
|||
#Then send a packet destined to PC2 with destintion MAC address as Router's Interface's MAC address received in ARP reply. |
|||
= Linux = |
= Linux = |
||
Line 503: | Line 778: | ||
== Linux Booting == |
== Linux Booting == |
||
#BIOS(Basic Input/Output System) - POST, Loads and executes the MBR boot loader. |
|||
*BIOS |
|||
#MBR (Master Boot Record) - Loads and executes the GRUB boot loader. |
|||
*MBR |
|||
#GRUB (Grand Unified Bootloader) - Loads and executes Kernel and Initrd images. |
|||
*GRUB |
|||
#Kernel - Heart of OS; Memory, Process mgmt; Executes INIT process. |
|||
*Kernel |
|||
#Init (initialization) - Decides the Linux run level; default run level to either 3 or 5. |
|||
*Init |
|||
#Runlevel programs - Executes programs like sendmail, etc from the run level directory as defined by the run level. |
|||
0 – halt |
|||
1 – Single user mode |
|||
2 – Multiuser, without NFS |
|||
3 – Full multiuser mode |
|||
4 – unused |
|||
5 – X11 |
|||
6 – reboot |
|||
*Runlevel programs |
|||
== Manually Boot using Grub == |
== Manually Boot using Grub == |
||
Line 551: | Line 819: | ||
/var – Variable Files |
/var – Variable Files |
||
== ProcFS == |
|||
=== CURL === |
|||
curl -I http://domain.com Get HTTP header information |
|||
curl -i http://domain.com Get HTTP header + Body information |
|||
curl -L http://domain.com Handle URL redirects |
|||
curl -v http://domain.com Debug level details |
|||
curl -x proxy.sr.com:3128 http://domain.com Using proxy to download a file |
|||
curl -k https://domain.com Ignoring the ssl certificate warning |
|||
curl -A "Mozilla/5.0" http://domain.com Spoofing user agent: |
|||
curl -L -H "user-agent: Mozilla/5.0" https://aman.info.tm Custom Headers |
|||
curl smtp://example.com:2525 |
|||
curl ftp://example.com |
|||
curl example.com:21 |
|||
curl example.com:7822 Troubleshooting SSH: SSH-2.0-OpenSSH_5.3 |
|||
time curl google.com |
|||
curl -i https://site1.lab.com --cert /root/ca/domains/ubnsrv01-cert.pem --key /root/ca/domains/ubnsrv01-key.pem |
|||
curl -v -X OPTIONS https://site3.lab.com |
|||
curl -v -X TRACE https://site3.lab.com |
|||
curl --sslv2 https://yoururl.com |
|||
curl --tlsv1 https://yoururl.com |
|||
curl -H 'X-My-Custom-Header: 123' https://httpbin.org/get Using httpbin tool; shows header info |
|||
curl -e google.com yoururl.com Referrer |
|||
curl --data "name=bool&last=word" https://httpbin.org/post Post data |
|||
curl -X POST https://httpbin.org/post Empty Post Request |
|||
curl -H 'Host: aman.info.tm' 128.199.139.216 If Server using Virtual Hosting |
|||
/proc/cmdline – Kernel command line information. |
|||
/proc/console – Information about current consoles including tty. |
|||
/proc/crypto – list of available cryptographic modules |
|||
/proc/devices – Device drivers currently configured for the running kernel. |
|||
/proc/diskstats – |
|||
/proc/dma – Info about current DMA channels. |
|||
/proc/fb – Framebuffer devices. |
|||
/proc/filesystems – Current filesystems supported by the kernel. |
|||
/proc/iomem – Current system memory map for devices. |
|||
/proc/ioports – Registered port regions for input output communication with device. |
|||
/proc/kmsg – holding messages output by the kernel |
|||
/proc/loadavg – System load average. |
|||
/proc/locks – Files currently locked by kernel. |
|||
/proc/meminfo – Summary of how the kernel is managing its memory. |
|||
/proc/misc – Miscellaneous drivers registered for miscellaneous major device. |
|||
/proc/modules – Currently loaded kernel modules. |
|||
/proc/mounts – List of all mounts in use by system. |
|||
/proc/partitions – Detailed info about partitions available to the system. |
|||
/proc/pci – Information about every PCI device. |
|||
/proc/scsi – Information about any devices connected via a SCSI or RAID controller |
|||
/proc/stat – Record or various statistics kept from last reboot. |
|||
/proc/swap – Information about swap space. |
|||
/proc/tty – Information about the current terminals |
|||
/proc/uptime – Uptime information (in seconds). |
|||
/proc/version – Kernel version, gcc version, and Linux distribution installed. |
|||
Post Json Data |
|||
/proc/PID/cmdline – Command line arguments. |
|||
curl --data '{"email":"test@example.com", "name": ["Boolean", "World"]}' -H 'Content-Type: application/json' https://httpbin.org/post |
|||
/proc/PID/cpu – Current and last cpu in which it was executed. |
|||
/proc/PID/cwd – Link to the current working directory. |
|||
/proc/PID/environ – Values of environment variables. |
|||
/proc/PID/exe – Link to the executable of this process. |
|||
/proc/PID/fd – Directory, which contains all file descriptors. |
|||
/proc/PID/maps – Memory maps to executables and library files. |
|||
/proc/PID/mem – Memory held by this process. |
|||
/proc/PID/root – Link to the root directory of this process. |
|||
/proc/PID/stat – Process status. |
|||
/proc/PID/statm – Process memory status information. |
|||
/proc/PID/status – Process status in human readable form. |
|||
Time Breakdown |
|||
curl https://www.booleanworld.com/ -sSo /dev/null -w 'namelookup:\t%{time_namelookup}\nconnect:\t%{time_connect}\nappconnect:\t%{time_appconnect}\npretransfer:\t%{time_pretransfer}\nredirect:\t%{time_redirect}\nstarttransfer:\t%{time_starttransfer}\ntotal:\t\t%{time_total}\n' |
|||
=== IPtables === |
|||
Usage: |
|||
ls -l /proc/$(pgrep -n python)/exe |
|||
iptables -L ==> List rules |
|||
== Commands == |
|||
iptables -F ==> Stop iptables |
|||
iptables -nvL ==> Check Stats |
|||
iptables --flush MYCHAIN ==> Flush Chain |
|||
iptables -X MYCHAIN ==> Delete Empty Chain |
|||
iptables -A INPUT -p tcp --dport ssh -j ACCEPT ==> Allow SSH |
|||
iptables -A INPUT -p tcp --dport 80 -j ACCEPT ==> Allow incoming web traffic |
|||
iptables -A INPUT -j DROP ==> Blocking Traffic |
|||
iptables -A INPUT -i ens160 -s 10.140.198.7 -j DROP ==> Blocking Traffic |
|||
iptables -I INPUT 1 -i lo -j ACCEPT ==> Allow loopback |
|||
iptables -I INPUT 5 -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 ==> Logging |
|||
*netstat |
|||
=== TCPDump === |
|||
netstat -s |
|||
sudo tcpdump -s 0 -i ens160 host 10.1.1.1 -v -w /tmp/packet_capture.cap |
|||
sudo tcpdump -s 0 -i ens160 host 10.1.1.1 and port 22 -v -w /tmp/packet_capture.cap |
|||
sudo tcpdump -s 0 -i ens160 host 10.1.1.1 and port not 22 and port not 80 -v -w /tmp/packet_capture.cap |
|||
sudo tcpdump -s 0 -i ens160 host 10.1.1.1 and tcp port not 22 and tcp port not 80 -v -w /tmp/packet_capture.cap |
|||
for i in `find . -type f | egrep "All.pcap"`; do echo $i; tcpdump -r $i '((host 1.1.1.1 or host 2.2.2.2) and host 3.3.3.3) and port 445' ; echo -e "\n"; done |
|||
=== MTR === |
|||
Provides the functionality of both the ping and traceroute commands. |
|||
Prints information about the entire route. |
|||
mtr google.com |
|||
mtr -g google.com Display Numeric IP addresses |
|||
mtr -b google.com Both hostnames and numeric IP addresses |
|||
mtr --tcp google.com Use TCP SYN packets |
|||
mtr --udp google.com UDP datagrams |
|||
=== Traceroute === |
|||
traceroute 4.2.2.2 ==> Uses UDP |
|||
traceroute -n 4.2.2.2 ==> Do not resolve hostnames |
|||
sudo traceroute -nI 4.2.2.2 ==> Use ICMP Packets |
|||
sudo traceroute -nT 4.2.2.2 ==> Use TCP Syn (Port 80) |
|||
=== Netstat === |
|||
netstat -s |
|||
netstat -a Listing all ports (both TCP and UDP) |
|||
netstat -at Listing TCP Ports connections |
|||
netstat -au Listing UDP Ports connections |
|||
netstat -l Listing all LISTENING Connections |
|||
netstat -lt Listing all TCP Listening Ports |
|||
netstat -s Showing Statistics by Protocol |
|||
netstat -st Showing Statistics by TCP Protocol |
|||
netstat -tp Displaying Service name with PID |
|||
netstat -r Displaying Kernel IP routing |
|||
netstat -anp |
netstat -anp |
||
netstat -ant |
netstat -ant |
||
=== PS === |
|||
*ps |
|||
ps -aux Display all processes in BSD format |
|||
ps -eo pid,ppid,user,cmd |
|||
ps -e --forest Print Process Tree |
|||
ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head |
|||
ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu | head |
|||
=== LS === |
|||
ps -aux |
|||
ps -ant |
|||
ps -anp |
|||
*top |
|||
<pre> |
|||
us - user cpu time (or) % CPU time spent in user space |
|||
sy - system cpu time (or) % CPU time spent in kernel space |
|||
ni - user nice cpu time (or) % CPU time spent on low priority processes |
|||
id - idle cpu time (or) % CPU time spent idle |
|||
wa - io wait cpu time (or) % CPU time spent in wait (on disk) |
|||
hi - hardware irq (or) % CPU time spent servicing/handling hardware interrupts |
|||
si - software irq (or) % CPU time spent servicing/handling software interrupts |
|||
st - steal time % CPU time in involuntary wait by virtual cpu while hypervisor is servicing another processor (or) % CPU time stolen from a virtual machine |
|||
</pre> |
|||
*ls |
|||
Append a character to each file name indicating the file type: |
Append a character to each file name indicating the file type: |
||
ls -F or ls --classify |
ls -F or ls --classify |
||
* Executable files |
|||
/ Directories |
|||
@ Symbolic links |
|||
<nowiki>|</nowiki> FIFOs |
|||
= Sockets |
|||
> Doors |
|||
Nothing for Regular Files |
|||
List Symoblic Links: |
List Symoblic Links: |
||
Line 646: | Line 939: | ||
</pre> |
</pre> |
||
=== Redirect Stderr === |
|||
*free |
|||
0 stdin – Use to get input (keyboard) |
|||
*du |
|||
1 stdout – Use to write information (screen) 1> > |
|||
2 stderr – Use to write error message (screen) 2> |
|||
Redirect Stderr into Stdout: |
|||
*df |
|||
2>&1 |
|||
ls > file.log 2>&1 OR ls &> file.log |
|||
ls > file.log 2> /dev/null |
|||
=== System Calls === |
|||
*curl |
|||
{{UC}} |
|||
= Sorting Algorithms = |
|||
*wget |
|||
*smem |
|||
* Quicksort |
|||
*nslookup |
|||
It is a good default choice. |
|||
It tends to be fast in practice with some small tweaks its dreaded O(n2)O(n^2)O(n2) worst-case time complexity becomes very unlikely. |
|||
A tried and true favorite. |
|||
* Heapsort |
|||
*dig |
|||
It is a good choice if you can't tolerate a worst-case time complexity of O(n2)O(n^2)O(n2) or need low space costs. |
|||
The Linux kernel uses heapsort instead of quicksort for both of those reasons. |
|||
* Merge sort |
|||
*mtr |
|||
It is a good choice if you want a stable sorting algorithm. |
|||
It can easily be extended to handle data sets that can't fit in RAM where the bottleneck cost is reading and writing the input on disk, not comparing and swapping individual items. |
|||
* Radix sort |
|||
*Misc |
|||
It looks fast, with its O(n)O(n)O(n) worst-case time complexity. |
|||
If you're using it to sort binary numbers, then there's a hidden constant factor that's usually 32 or 64 (depending on how many bits your numbers are). |
|||
That's often way bigger than O(lg(n))O(\lg(n))O(lg(n)), meaning radix sort tends to be slow in practice. |
|||
* Counting sort |
|||
It is a good choice in scenarios where there are small number of distinct values to be sorted. |
|||
This is pretty rare in practice, and counting sort doesn't get much use. |
|||
* Which sorting algorithm has best asymptotic run time complexity? |
|||
Find Sym Links: |
|||
find . -type l -ls |
|||
ls -la | grep "\->" |
|||
= Python = |
|||
CPU Info: |
|||
lscpu |
|||
nproc |
|||
grep 'model name' /proc/cpuinfo | wc -l |
|||
* Regex |
|||
Obtain the PID with a utility: |
|||
re.match() => Matches Beginning |
|||
pgrep -n python |
|||
re.search() => Matches Anywhere |
|||
pidof chrome - return all PIDs |
|||
re.findall() => All Matching Objects |
|||
pidof -s chrome - return only 1 PID |
|||
re.sub('[ES]', 'a', s) => Substitute |
|||
ps -C chrome -o pid= - C = CMD |
|||
* Lists |
|||
= Flows = |
|||
* Dictionary |
|||
*Complete Flow of PC opening a Website: |
|||
* File operations |
|||
#Check NW config |
|||
Using Open: |
|||
#DHCP if not configured |
|||
f = open('/etc/passwd') |
|||
#Check Domain name in Browser Cache |
|||
f.read(5) |
|||
#Check Domain name in OS Cache |
|||
f.close() |
|||
#If not Found in any cache, Prepare to send UDP DNS query to DNS Server |
|||
#If DNS Server configured is in same Network Check MAC address in ARP Table |
|||
#If not found, send ARP for MAC Address |
|||
#Forwards DNS Query to DNS Server and wait for reply containing IP address of Website |
|||
#If DNS server configured is not in same subnet, check Gateway config(IP & MAC address) |
|||
#If MAC address not found in ARP Table, send ARP request |
|||
#After getting reply, fwd the DNS query to gateway |
|||
#After getting DNS response, start TCP 3-way handshake S-SA-A. |
|||
#Start SSL Handshake if SSL/TLS configured |
|||
#Send GET Request |
|||
#Client sends ACK & Body containing HTML Data |
|||
#If HTTP 1.0, Server sends FIN & CLoses connection |
|||
#Client send FIN-ACK |
|||
#Server sends Ack |
|||
Using With Open(better, auto closes the file): |
|||
with open('/etc/passwd') as f: |
|||
for line in f: |
|||
print(line) |
|||
* Class |
|||
*Complete Flow of DNS Traffic |
|||
* OS Interaction: |
|||
import os |
|||
os.system("date") |
|||
import os |
|||
*Complete Flow of Traffic passing through below scenario: |
|||
f = os.popen('date') |
|||
[PC]-----[Hub]-----[Switch]-----[Router]------[Router]------[Server] |
|||
now = f.read() |
|||
print("Today is ", now) |
|||
import subprocess |
|||
subprocess.call(["ls", "-l", "/etc/resolv.conf"]) |
|||
import subprocess |
|||
p = subprocess.Popen("date", stdout=subprocess.PIPE, shell=True) |
|||
(output, err) = p.communicate() |
|||
print("Today is", output) |
|||
= SMTP = |
|||
HELO or EHLO (Hello) |
|||
MAIL FROM |
|||
250 OK reply code |
|||
RCPT TO (Recipient To) |
|||
250 OK reply code |
|||
DATA |
|||
345 reply code |
|||
250 OK code |
|||
QUIT |
|||
221 code |
|||
RSET (Reset) |
|||
SMTP errors: |
|||
4.X.X Persistent Transient Failure |
|||
5.X.X Permanent Error: |
Latest revision as of 22:34, 31 August 2022
ARP vs MAC Table vs CAM Table
Need to confirm if MAC Table is same as CAM table |
ARP Table | MAC Table (or CAM Table) | CAM Table |
---|---|---|
Layer3 address to Layer2 address resolution | Layer2 address to Interface binding | |
Matches IP addresses to MAC addresses | Maps Ports to MAC addresses | |
Needed to forward packets at layer 3 | Used to Switch frames to the right output interface | |
Kept by L3 devices | Kept only by L2 devices | |
No entry for dest IP address, machine will send ARP request | If no entry, switch will flood the frame | |
Default timeout is 4 hours | Default timeout is 5 minutes | |
Filled by each ARP reply | Filled by source MAC of each frame passing through switch |
Fragmentation
- Before fragmentation
Sequence | Identifier | Total Length | DF Flag | MF Flag | Fragment offset |
---|---|---|---|---|---|
0 | 345 | 5140 | 0 | 0 | 0 |
- After fragmentation
Sequence | Identifier | Total Length | DF Flag | MF Flag | Fragment offset |
---|---|---|---|---|---|
0-0 | 345 | 1500 | 0 | 1 | 0 |
0-1 | 345 | 1500 | 0 | 1 | 185 |
0-2 | 345 | 1500 | 0 | 1 | 370 |
0-3 | 345 | 700 | 0 | 0 | 555 |
Headers
Version | HLEN | DSCP | ECN | Total Length | |||||||||||||||||||||||||||
Identification | Flags(DF,MF) | Fragment Offset | |||||||||||||||||||||||||||||
Time To Live | Protocol | Header Checksum | |||||||||||||||||||||||||||||
Source IP Address | |||||||||||||||||||||||||||||||
Destination IP Address | |||||||||||||||||||||||||||||||
Options (if HLEN > 5) |
Source port | Destination port | ||||||||||||||||||||||||||||||
Sequence number | |||||||||||||||||||||||||||||||
Acknowledgment number (if ACK set) | |||||||||||||||||||||||||||||||
Data offset | Reserved 0 0 0 |
N S |
C W R |
E C E |
U R G |
A C K |
P S H |
R S T |
S Y N |
F I N |
Window Size | ||||||||||||||||||||
Checksum | Urgent pointer (if URG set) | ||||||||||||||||||||||||||||||
Options (if data offset > 5. Padded at the end with "0" bytes if necessary.) ... |
Source port | Destination port |
Length | Checksum |
Identification | QR | Opcode | A A |
T C |
R D |
R A |
Z | A D |
C D |
RCode | |||||||||||||||||||||
Total Questions | Total Answers | ||||||||||||||||||||||||||||||
Total Authority Resource Records | Total Additional Resource Records |
- AD Authentic Data
- CD Checking Disabled
Hardware type (Ethernet = 1) | |||||||||||||||
Protocol type (IPv4 = 0x0800) | |||||||||||||||
Hardware address length (Ethernet size is 6) | Protocol address length (IPv4 size is 4.) | ||||||||||||||
Operation ( 1 for request; 2 for reply) | |||||||||||||||
Source MAC | |||||||||||||||
Source IP | |||||||||||||||
Dest MAC | |||||||||||||||
Dest IP |
GARP
- ICMP Header
Code Checksum Rest of Header
DNS
- Record Types
A Address record Returns a 32-bit IPv4 address, AAAA IPv6 address record CNAME Canonical name record Alias of one name to another, DNS lookup will continue by retrying the lookup with the new name. LOC Location record Specifies a geographical location associated with a domain name MX Mail exchange record Maps a domain name to a list of message transfer agents for that domain NS Name server record Delegates a DNS zone to use the given authoritative name servers PTR Pointer record Pointer to a canonical name. Unlike a CNAME, DNS processing stops and just the name is returned. The most common use is for implementing reverse DNS lookups. SOA Start of [a zone of] authority record Specifies authoritative information about a DNS zone, including the primary name server, the email of the domain administrator, the domain serial number,etc SRV Service locator Generalized service location record, used for newer protocols instead of creating protocol-specific records such as MX. TXT Text record Originally for arbitrary human-readable text in a DNS record. Now more often carries machine-readable data, opportunistic encryption, Sender Policy Framework, etc. * All cached records Returns all cached records of all types known to the name server. If the name server does not have any information on the name, the request will be forwarded on. AXFR Authoritative Zone Transfer Transfer entire zone file from the master name server to secondary name servers. IXFR Incremental Zone Transfer Requests a zone transfer of the given zone but only differences from a previous serial number.
- Glue Record
- A glue record is a term for a record that's served by a DNS server that's not authoritative for the zone, to avoid a condition of impossible dependencies for a DNS zone.
- What glue records do is to allow the TLD's servers to send extra information in their response to the query for the example.com zone - to send the IP address that's configured for the name servers.
- It's not authoritative, but it's a pointer to the authoritative servers, allowing for the loop to be resolved.
TCP
- Parameters determined during Handshake:
MSS (default is 536) WSF SACK Permitted
- MTU vs MSS
- RTO: Four ACKs acknowledging the same packet, which are not piggybacked on data and do not change the receiver's advertised window.
- Fast Retransmission
- If RTO has a larger value - If sender receives four acknowledgments with same value (three duplicates) - Segment expected by all of these Ack is resent immediately
- Fast Recovery:
- -
- Congestion Control
- Slow Start - Exponential Increase
- Sender starts with cwnd = 1 MSS, Size increases 1 MSS each time one Ack arrives, Increases the rate exponentially(1,2,4,8....) until a threshold is reached
- Congestion Avoidance - Additive Increase
- Increases the cwnd Additively, When a “window” is Ack cwnd is increased by 1, Window = No of segments transmitted during RTT - The increase is based on RTT, not on the number of arrived ACKs, Congestion window increases additively until congestion is detected
- Congestion Detection - Multiplicative Decrease
- If congestion occurs, Window size must be decreased, Sender knows about congestion via RTO or 3 Dup Acks received, Size of Threshold is dropped to half
- Tahoe
- If RTO occured, TCP Reacts Strongly - Reduces cwnd back to 1 Segment, starts the slow start phase again
- Reno
- If 3 Duplicate ACKs are received, TCP has a Weaker Reaction - Starts the Congestion Avoidance phase - This is called fast transmission and fast recovery
- Both consider RTO and Duplicate ACKs as packet loss events.
- Behavior of Tahoe and Reno differ primarily in how they react to duplicate ACKs.
Event | Tahoe | Reno |
---|---|---|
3 Dup Acks | Performs a fast retransmit Sets the slow start threshold to half of the current congestion window Reduces the congestion window to 1 MSS Resets to slow start state |
Perform a fast retransmit Skip the slow start phase by instead halving the congestion window (instead of setting it to 1 MSS like Tahoe) Setting the slow start threshold equal to the new congestion window Enter a phase called fast recovery. |
RTO (Ack time out) | Slow start is used Reduce congestion window to 1 MSS |
Slow start is used Reduce congestion window to 1 MSS |
- Silly Window Syndrome: Sender creates data slowly or Receiver consumes slowly or both.
Syndrome due to Sender:
- Nagle’s Algorithm: Send data initially, accumulate data in output buffer, Wait for Ack or till 1 MSS Data in Buffer
Syndrome due to Receiver:
- Clark’s Solution: Announce window size 0 till 1) enough space for 1 MSS in Buffer or Half Receive buffer is empty - Delayed Acknowledgment: Segment not acknowledged immediately, Sender TCP does not slide its window, reduces traffic, sender may unnecessarily retransmit, Not delay more than 500 ms.
- Persistence Timer
- Issue of Deadlock created by Lost Ack, used to reset Window size 0 advertized earlier, is resolved by this timer - Sending TCP sends a special segment(1 byte of new data) called Probe, causes the receiving TCP to resend Ack - If no reply, another probe is sent and value of persistence timer is doubled and reset - Sender continues sending probes, doubling, resetting value of persistence timer until it reaches a threshold(generally 60s) - After that the sender sends one probe segment every 60s until the window is reopened
VPN Messages
- Phase 1 - Main Mode
Cookie,Proposal List Cookie,Accepted Proposal DH Key,Nonce DH Key,Nonce ID,ID Hash ID,ID Hash
- Phase 1 - Aggressive Mode
ID,Proposal List,DH Key,Nonce ID,Accepted Proposal,DH Key,Nonce,ID Hash ID Hash
- Phase 2 - Quick Mode
Ph1 Hash,Message ID,Proposal List,Nonce, DH Key,Proxy-ID Ph1 Hash,Message ID,Accepted Proposal,Nonce,DH Key,Proxy-ID Ph1 Hash,Message ID,Nonce
HTTP
- HTTP Error Codes
Category | Type | Code |
---|---|---|
1XX | Informational | 100 = Continue |
2XX | Successful | 200 = OK 201 = Created (URL) 202 = Accepted (request accepted but not acted upon immediately) 203 = Non-authoritative Information(info in header is from local or third-party copy, not from original server) 204 = No Content (in body) |
3XX | Re-directional | 301 = Moved Permanently 302 = Found (temporary redirect) 304 = Not Modified 305 = Use Proxy (URL must be accessed through the proxy mentioned in the Location header) 307 = Temporary Redirect (requested page has moved temporarily to a new url) |
4XX | Client Error | 400 = Bad Request 401 = Unauthorized 402 = Payment Required 403 = Forbidden 404 = Not Found 405 = Method Not Allowed |
5XX | Server Error | 500 = Internal Server Error 501 = Not Implememted 502 = Bad Gateway or Proxy 503 = Service Unavailable 504 = Gateway or Proxy Timeout 505 = HTTP Version Not Supported |
- HTTP1.0 vs HTTP1.1
HTTP/1.0:
- Uses a new connection for each request/response exchange
- Closed connections after every request.
- Supports GET, POST, HEAD request methods
HTTP/1.1:
- Connection may be used for one or more request/response exchanges
- Uses persistent connections, save bandwidth & reduces latency as it does not require to do TCP Handshake again for every file download (like images, css, etc.)
- HTTP Pipeline feature in which client sends multiple requests before waiting for each response.
- Supports OPTIONS, PUT, DELETE, TRACE, CONNECT request methods
- HTTP/1.1 vs HTTP/2
- HTTP/2 Supports Page load speed improvements through:
Compression of request headers Binary protocol HTTP/2 Server Push: capability allows the server to send additional cacheable information to the client that isn’t requested but is anticipated in future requests. Request multiplexing over a single TCP connection Request pipelining HOL blocking (Head-of-line) — Package blocking
- HTTP Request Methods
GET: Retrieve Data HEAD: Header only without Response Body POST: Submits Data to DB, web forum, etc PUT: Replaces target resource with the uploaded content DELETE: Removes target resource given by URI CONNECT: Used when the client wants to establish a transparent connection to a remote host, usually to facilitate SSL-encrypted communication (HTTPS) through an HTTP proxy OPTIONS: Returns the HTTP methods that the server supports for the specified URL TRACE: Performs a message loop back test to see what (if any) changes or additions have been made by intermediate servers PATCH: Applies partial modifications to a resource.
- PUT vs PATCH
PUT method only allows a complete replacement of a document. PATCH is used to make changes to part of the resource at a location.
Cookie
- Session cookie
- Persistent cookie
- Secure cookie
- Http-only cookie
- Same-site cookie
- Third-party cookie
- Supercookie
Other uses
- Zombie cookie
HTTP Headers
Header | Uses |
---|---|
Set-cookie | |
Location | 1) Used to ask a web browser to load a different web page Client request: GET /index.html HTTP/1.1 Host: www.example.com Server response: HTTP/1.1 302 Found Location: http://www.example.org/index.php. 2) To provide info about location of a newly created resource, the Location header should be sent with an HTTP status code of 201 or 202. |
Host | The host Header tells the webserver which virtual host to use if same virtual host is using several aliases |
Accept | |
User-Agent | |
content-type | |
content-length | |
date | |
expires | |
Authorization | Basic access authentication is used to provide a user name and password when making a request. Credentials are the base64 encoding of id and password joined by a single colon Base64-encoding of 'Aladdin:OpenSesame' is 'QWxhZGRpbjpPcGVuU2VzYW1l' Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l https://Aladdin:OpenSesame@www.example.com/index.html ==> This will not ask for the credentials; deprecated now |
Referrer | When a user clicks a hyperlink in a web browser, the browser sends a request to the server holding the destination webpage. The request may include the referer field, which indicates the last page the user was on (the one where they clicked the link). |
X-Forwarded-For (XFF) | Used for identifying the originating IP address of a client connecting to a Web Server through an HTTP Proxy or Load Balancer. |
FTP
SSL Handshake
--> Client Hello <-- Server Hello, Certificate, Server Hello Done --> Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message(Finished) <-- Change Cipher Spec, Encrypted Handshake Message(Finished) --> Application Data(GET) <-- Encrypted Handshake Message(Hello Request)
- Client sends the supported parameters
- Server chooses the parameters; Sends the certificate; And first half of the Diffie-Hellman key exchange
- Client sends the second half of the Diffie-Hellman exchange, Computes the session keys; Switches to encrypted communication
- Server computes the session keys; Switches to encrypted communication.
- SSLv1 vs TLS 1.0 vs TLS1.3
SSL 2.0 - Deprecated SSL 3.0 - Deprecated TLS 1.0 - Deprecated TLS 1.1 - Deprecated TLS 1.2 - TLS 1.3 -
NetScaler
- LB Methods:
Least Connection = Service with fewest active connections Round Robin = Rotates a list of services Least Response time = Fewest active connections & lowest average response time Least Bandwidth = Service serving least amount of traffic measured in mbps Least Packets = Service that received fewest packets Source IP Hash = Destination IP Hash =
- Persistence Methods:
SOURCE IP = COOKIE Insert = Connections having same HTTP Cookie inserted by Set-Cookie directive from server belong to same persistence session. SSL Session = Connections having same SSL session ID RULE = All connection matching a user defined rule URL Passive = requests having same server ID(Hexadecimal of Server IP & Port) of service to which request is to be fwded Dest IP = SRC IP DST IP = CALL ID = Same Caller ID in SIP Header
- What is Stateful & Stateless Persistence? Which one is more scalable/Efficient?
Stateless Session Persistence: Cookie inserted by ADC is more efficient because no need to create a table, NS will insert cookie & forget, with reply, it will read cookie value, decrypt it & fwd request. State-full Session Persistence: Server will insert cookie, NS will hash it & fwd based on Hash value but will need to keep a table in memory with all hashes & IP Addresses. Same is true for Source IP based Persistence, Also inefficient behind NAT Using Set-cookie-header = by Server - insert Name & Value Fields Client sends cookie in Cookie Header Who ever generates cookie, will be able to read it
OSPF
- States
Down Attempt Init Hello sent out all int 2-Way Hello rcvd cont own RID in ngbr list ExStart Determine master slave Exchange Master sends DBD first, then Slave Loading Comp DBDs, send LSR for missing LSAs Full LSDB of ngbr are fully syncd
- LSA Type
Type 1 - Router LSAs Sent from router to other routers in the same area, has info reg router's int in the same area, int IPs, adjacent routers Type 2 - Network LSAs Generated by the DR on a multi access segment, similar to LSA Type 1 Type 3 - Network Summary LSA Generated by ABRs, contain the subnets & costs Type 4 - ASBR summary LSA Same as summary LSA except the destination advertised by ABR is ASBR, ABR in same area as the ASBR will originate the Type 4 LSA. Type 5 - AS external LSA Generated by ASBRs, Flooded throughout the AS to advertise a route external to OSPF Type 7 - NSSA External LSA Generated by the ASBR in an NSSA area, Converted into a type 5 LSA by the ABR when leaving the area
- Packet Types
Type 1 - Hello Type 2 - Database Description (DBD) Type 3 - Link-State request (LSR) Type 4 - LSU (Contain LSAs) Type 5 - LSAck
- Neighbor Requirements:
Same area Same authentication config Same subnet Same hello/dead interval Matching stub flags
- LSA Details
- OSPF path selection: O > O*IA > O*E1 > O*E2 > N1 > N2.
- “area range” summarize type 3 LSA’.
- “summary-address” summarize type 5 & 7 LSA’s.
- Auto-cost reference BW (Default = 100mb), formula = 100000000/Int-Bw.
BGP
- Route Selection Criteria
Attribute | Which is better | Type |
---|---|---|
Next Hop reachable | Route cannot be used if next hop is unreachable | Well-known Mandatory |
Weight | Bigger; value local to the router; Cisco proprietary; default is 0 for all routes not originated by local router | |
Local Preference | Bigger; used within AS and exchanged bw iBGP routers; default is 100 | Well-known discretionary |
Locally Injected (Originate) | Prefer path local router originated; Locally injected > iBGP/eBGP learned; In BGP table it will hv next hop 0.0.0.0 | |
AS Path Length | Smaller; e.g: AS path 1 2 3 is preferred over AS path 1 2 3 4 5 | Well-known Mandatory |
Origin | Prefer IGP(advertised by network cmd - i) > EGP > INCOMPLETE - '?'(reditributed) | Well-known Mandatory |
MED(Metric) | Smaller; used to advertise to neighbors how they should enter your AS; propagated to all routers within the neighbor AS but not passed along any other AS | Optional non-transitive |
Neighbor Type | Prefer eBGP over iBGP | |
IGP Metric to Next Hop | Smaller; Prefer the path within the AS with the lowest IGP metric to the BGP next hop | |
Oldest path | Prefer the path that we received first | |
Router ID | Prefer the path with the lowest BGP neighbor router ID (Manually conf > Highest Loopback IP address > Highest Interface IP address) | |
Neighbor IP address | Prefer the path with the lowest neighbor IP address |
- BGP States
Idle Active Attempting to connect Connect TCP session established OpenSent Open message sent OpenConfirm Response received Established Adjacency established
- BGP Messages
Open Update Keepalive Sent every 60 seconds Notification Always indicate something is wrong
- Directions
Aspath prepend: Applied outwardly. Impacts incoming path. Shorter the as-path length higher the preference As-path prepend is the way to add AS number to the list of subnet u want to advertise. This is a way to route poisoning. Tell the outside world not to follow the path.
Local preference: Applied while the traffic coming inside. Impacts traffic while going out. Non transitive. Propagates within the same as-path. Higher the local preference value higher the preference
MED: Multiexitdescriptor When your router has connection with two other routers with same AS. Let's say you have 2 subnets behind your router. You can use MED value to mention which networks should be accessed through which links. It is advertised outwards. Impacts the incoming traffic. Semi transitive. Propagates to one AS. Lower the MED value higher the preference. MED should be used carefully as it reduces network resiliency.
VPN Monitor vs DPD vs IKE Heartbeat
VPN Monitor | DPD | IKE Heartbeat |
---|---|---|
Juniper Proprietary | RFC Standard | Juniper Proprietary |
Work with Non Juniper | Work with Non Juniper | Cannot work with Non Juniper |
Uses ICMP | Uses ICMP(encrypted IKE Phase 1 message(R-U-THERE)) | -- |
Goes inside the Phase 2 Tunnel | Goes through Phase 1 Tunnel | -- |
Implies VPN is UP | Implies peer is up and responding | Enhancement to detect tunnel availability |
Works if supported by one peer only | -- | Both ends must support |
Configured in Phase 2 | Configured in Phase 1 | Configured in Phase 1 |
SRX Architecture
- First Path
Screens Static NAT | Dest NAT Route ==> Forwarding Lookup Zones Policy Reverse Static NAT | Source NAT Service ALG Session
- Fast Path
Screens TCP NAT Service ALG
ScreenOS
- ScreenOS Flow order
Sanity Check Screening Session lookup Route Lookup Policy lookup Session creation ARP lookup
- Route preference order
Policy Based Routing Source Interface Based Routing Source Routing Destination Routing
- NAT Preference order
Mapped IP Virtual IP Policy Based NAT (NAT-Src & NAT-Dst) Interface Based NAT
SYN Flood Protection
Threshold = Proxy connections above this limit If Syn-cookie is enabled, no sessions established between client & firewall or firewall & server directly Alarm Threshold = Alarm/Alert (to log) Queue Size = The number of proxied connections held in queue After this the firewall starts rejecting new connection requests Timeout Value is maximum time before a half-completed connection is dropped from the queue The range is 0–50s; default is 20s
Flows
- Complete Flow of PC opening a Website:
- Check NW config
- DHCP if not configured
- Check Domain name in Browser Cache
- Check Domain name in OS Cache
- Check if an entry exists in Hosts File
- If not Found in any cache, Prepare to send UDP DNS query to DNS Server
- If DNS Server configured is in same Network Check MAC address in ARP Table
- If not found, send ARP for MAC Address
- Forward DNS Query to DNS Server and wait for reply containing IP address of Website
- If DNS server configured is not in same subnet, check Gateway config(IP & MAC address)
- If MAC address not found in ARP Table, send ARP request
- After getting reply, fwd the DNS query to gateway
- After getting DNS response, start TCP 3-way handshake S-SA-A.
- Start SSL Handshake if SSL/TLS configured
- Send GET Request
- Client sends ACK [200 OK] & Body containing HTML Data
- If HTTP 1.0, Server sends FIN & CLoses connection
- Client send FIN-ACK
- Server sends Ack
- Complete Flow of DNS Traffic
- Check NW config
- DHCP if not configured
- Check Domain name in Browser Cache
- Check Domain name in OS Cache
- Check if an entry exists in Hosts File
- If not Found in any cache, Prepare to send UDP DNS query to DNS Server
- If DNS Server configured is in same Network Check MAC address in ARP Table
- If not found, send ARP for MAC Address
- Forward DNS Query to DNS Server and wait for reply containing IP address of Website
- If DNS server configured is not in same subnet, check Gateway config(IP & MAC address)
- If MAC address not found in ARP Table, send ARP request
- After getting reply, fwd the DNS query to gateway
- DNS Server ??
- DNS Server ?? Iterative? Recursive? TLD? Authoritative
- DNS Server ??
- After getting DNS response, start TCP 3-way handshake S-SA-A.
- Complete Flow of Traffic passing through below scenario:
[PC1]-----[Hub]-----[Switch]-----[Router]------[Router]------[PC2]
- Check NW config
- DHCP if not configured
- Check if PC2 in same Subnet(not in this scenario as routers present)
- If in Same Subnet, check if MAC address is there in ARP Table
- Else send ARP Request
- Once MAC address is known, directly send Packet to PC2
- If PC2 is in Different Subnet(True for above scenario), Check Gateway IP address & MAC address
- If MAC address is not known, send an ARP request.
- Hub is directly connected, will receive & Flood packet on all Ports.
- Switch will receive packet and check its CAM Table for the MAC to Port bindings
- If MAC entry is not found in CAM table, Switch will Flood the ARP packet on all ports.
- Other destinations will drop the ARP Request packet as they do not have the IP address requested in ARP Header.
- Only Router will accept the packet as it has the requested IP address matching its own MAC address.
- It will reply with an ARP Reply message.
- Switch will add an entry of this MAC address & port number in its CAM Table once the reply packet pass through it.
- Hub will flood the packet through all ports.
- ARP Reply will reach PC1, it will add entry to its ARP Table
- Then send a packet destined to PC2 with destintion MAC address as Router's Interface's MAC address received in ARP reply.
Linux
Linux Booting
- BIOS(Basic Input/Output System) - POST, Loads and executes the MBR boot loader.
- MBR (Master Boot Record) - Loads and executes the GRUB boot loader.
- GRUB (Grand Unified Bootloader) - Loads and executes Kernel and Initrd images.
- Kernel - Heart of OS; Memory, Process mgmt; Executes INIT process.
- Init (initialization) - Decides the Linux run level; default run level to either 3 or 5.
- Runlevel programs - Executes programs like sendmail, etc from the run level directory as defined by the run level.
Manually Boot using Grub
- Locate where the vmlinuz and initrd.* files are located:
grub> ls (hd0) (hd0,msdos5) (hd1) (hd1,msdos0)
- Boot the system:
grub> linux (hd1,msdos1)/install/vmlinuz root=/dev/sdb1 grub> initrd (hd1,msdos1)/install/initrd.gz grub> boot
File system layout
/ – The Root Directory /bin – Essential command binaries /boot – Boot loader files /dev – Device Files /etc – Configuration Files /home – Home Directory /lib – Essential Libraries /lost+found – Recovering Files /media – Removable Media Devices /mnt – Temporarily mounted filesystems /opt – Optional software packages /proc – Kernel & Process Information /root – Root Home Directory /sbin – System binaries /selinux – Security-Enhanced Linux /srv – Service Data /sys – virtual filesystem /tmp – Temporary files /usr – binaries, documentation, source code, libraries /var – Variable Files
CURL
curl -I http://domain.com Get HTTP header information curl -i http://domain.com Get HTTP header + Body information curl -L http://domain.com Handle URL redirects curl -v http://domain.com Debug level details curl -x proxy.sr.com:3128 http://domain.com Using proxy to download a file curl -k https://domain.com Ignoring the ssl certificate warning curl -A "Mozilla/5.0" http://domain.com Spoofing user agent: curl -L -H "user-agent: Mozilla/5.0" https://aman.info.tm Custom Headers curl smtp://example.com:2525 curl ftp://example.com curl example.com:21 curl example.com:7822 Troubleshooting SSH: SSH-2.0-OpenSSH_5.3 time curl google.com curl -i https://site1.lab.com --cert /root/ca/domains/ubnsrv01-cert.pem --key /root/ca/domains/ubnsrv01-key.pem curl -v -X OPTIONS https://site3.lab.com curl -v -X TRACE https://site3.lab.com curl --sslv2 https://yoururl.com curl --tlsv1 https://yoururl.com curl -H 'X-My-Custom-Header: 123' https://httpbin.org/get Using httpbin tool; shows header info curl -e google.com yoururl.com Referrer curl --data "name=bool&last=word" https://httpbin.org/post Post data curl -X POST https://httpbin.org/post Empty Post Request curl -H 'Host: aman.info.tm' 128.199.139.216 If Server using Virtual Hosting
Post Json Data
curl --data '{"email":"test@example.com", "name": ["Boolean", "World"]}' -H 'Content-Type: application/json' https://httpbin.org/post
Time Breakdown
curl https://www.booleanworld.com/ -sSo /dev/null -w 'namelookup:\t%{time_namelookup}\nconnect:\t%{time_connect}\nappconnect:\t%{time_appconnect}\npretransfer:\t%{time_pretransfer}\nredirect:\t%{time_redirect}\nstarttransfer:\t%{time_starttransfer}\ntotal:\t\t%{time_total}\n'
IPtables
iptables -L ==> List rules iptables -F ==> Stop iptables iptables -nvL ==> Check Stats iptables --flush MYCHAIN ==> Flush Chain iptables -X MYCHAIN ==> Delete Empty Chain iptables -A INPUT -p tcp --dport ssh -j ACCEPT ==> Allow SSH iptables -A INPUT -p tcp --dport 80 -j ACCEPT ==> Allow incoming web traffic iptables -A INPUT -j DROP ==> Blocking Traffic iptables -A INPUT -i ens160 -s 10.140.198.7 -j DROP ==> Blocking Traffic iptables -I INPUT 1 -i lo -j ACCEPT ==> Allow loopback iptables -I INPUT 5 -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 ==> Logging
TCPDump
sudo tcpdump -s 0 -i ens160 host 10.1.1.1 -v -w /tmp/packet_capture.cap sudo tcpdump -s 0 -i ens160 host 10.1.1.1 and port 22 -v -w /tmp/packet_capture.cap sudo tcpdump -s 0 -i ens160 host 10.1.1.1 and port not 22 and port not 80 -v -w /tmp/packet_capture.cap sudo tcpdump -s 0 -i ens160 host 10.1.1.1 and tcp port not 22 and tcp port not 80 -v -w /tmp/packet_capture.cap
for i in `find . -type f | egrep "All.pcap"`; do echo $i; tcpdump -r $i '((host 1.1.1.1 or host 2.2.2.2) and host 3.3.3.3) and port 445' ; echo -e "\n"; done
MTR
Provides the functionality of both the ping and traceroute commands. Prints information about the entire route.
mtr google.com mtr -g google.com Display Numeric IP addresses mtr -b google.com Both hostnames and numeric IP addresses mtr --tcp google.com Use TCP SYN packets mtr --udp google.com UDP datagrams
Traceroute
traceroute 4.2.2.2 ==> Uses UDP traceroute -n 4.2.2.2 ==> Do not resolve hostnames sudo traceroute -nI 4.2.2.2 ==> Use ICMP Packets sudo traceroute -nT 4.2.2.2 ==> Use TCP Syn (Port 80)
Netstat
netstat -s netstat -a Listing all ports (both TCP and UDP) netstat -at Listing TCP Ports connections netstat -au Listing UDP Ports connections netstat -l Listing all LISTENING Connections netstat -lt Listing all TCP Listening Ports netstat -s Showing Statistics by Protocol netstat -st Showing Statistics by TCP Protocol netstat -tp Displaying Service name with PID netstat -r Displaying Kernel IP routing netstat -anp netstat -ant
PS
ps -aux Display all processes in BSD format ps -eo pid,ppid,user,cmd ps -e --forest Print Process Tree ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu | head
LS
Append a character to each file name indicating the file type:
ls -F or ls --classify
* Executable files / Directories @ Symbolic links | FIFOs = Sockets > Doors Nothing for Regular Files
List Symoblic Links:
ls -la
lrwxrwxrwx 1 root root 11 Sep 13 14:57 mounts -> self/mounts dr-xr-xr-x 3 root root 0 Sep 13 14:57 mpt -rw-r--r-- 1 root root 0 Sep 13 14:57 mtrr
Redirect Stderr
0 stdin – Use to get input (keyboard) 1 stdout – Use to write information (screen) 1> > 2 stderr – Use to write error message (screen) 2>
Redirect Stderr into Stdout:
2>&1 ls > file.log 2>&1 OR ls &> file.log ls > file.log 2> /dev/null
System Calls
This section is under construction. |
Sorting Algorithms
- Quicksort
It is a good default choice. It tends to be fast in practice with some small tweaks its dreaded O(n2)O(n^2)O(n2) worst-case time complexity becomes very unlikely. A tried and true favorite.
- Heapsort
It is a good choice if you can't tolerate a worst-case time complexity of O(n2)O(n^2)O(n2) or need low space costs. The Linux kernel uses heapsort instead of quicksort for both of those reasons.
- Merge sort
It is a good choice if you want a stable sorting algorithm. It can easily be extended to handle data sets that can't fit in RAM where the bottleneck cost is reading and writing the input on disk, not comparing and swapping individual items.
- Radix sort
It looks fast, with its O(n)O(n)O(n) worst-case time complexity. If you're using it to sort binary numbers, then there's a hidden constant factor that's usually 32 or 64 (depending on how many bits your numbers are). That's often way bigger than O(lg(n))O(\lg(n))O(lg(n)), meaning radix sort tends to be slow in practice.
- Counting sort
It is a good choice in scenarios where there are small number of distinct values to be sorted. This is pretty rare in practice, and counting sort doesn't get much use.
- Which sorting algorithm has best asymptotic run time complexity?
Python
- Regex
re.match() => Matches Beginning re.search() => Matches Anywhere re.findall() => All Matching Objects re.sub('[ES]', 'a', s) => Substitute
- Lists
- Dictionary
- File operations
Using Open:
f = open('/etc/passwd') f.read(5) f.close()
Using With Open(better, auto closes the file):
with open('/etc/passwd') as f: for line in f: print(line)
- Class
- OS Interaction:
import os os.system("date")
import os f = os.popen('date') now = f.read() print("Today is ", now)
import subprocess subprocess.call(["ls", "-l", "/etc/resolv.conf"])
import subprocess p = subprocess.Popen("date", stdout=subprocess.PIPE, shell=True) (output, err) = p.communicate() print("Today is", output)
SMTP
HELO or EHLO (Hello) MAIL FROM 250 OK reply code RCPT TO (Recipient To) 250 OK reply code DATA 345 reply code 250 OK code QUIT 221 code
RSET (Reset)
SMTP errors:
4.X.X Persistent Transient Failure 5.X.X Permanent Error: