Networking bookmarks (updated)

• TCP/IP Illustrated Vol I (The protocols) / W Richard Stevens
• STD's (Internet Protocal Standards)
• IPv6 adoption and IPv4 depletion
• DNS root servers
• NTP
• NTP server pool Belgium 
• Blueprints
1. Intro
2. Administration
3. Troubleshooting

Solaris 11 networking enhancements

As of Solaris 11 Express 2010.11 these enhancements are included:

• Network automagic (NWAM): dynamically configure fixed or wireless network depending on discovery and profiles

  

  Network automagic

• sockets no longer use STREAMS
• Solaris can work as a (L2) bridge (IETF TRILL)
• unified handling of different types of network interfaces (project Clearview)
• dladm extended (project Brussels)
• virtual interfaces, IP tunnels and IPMP can now be accessed as generic IP interfaces. They can now be sniffed (e.g. lo0, traffic between zones...) , asssigned as an exlusive stack to a zone...
• use virtual network interfaces (VNIC), virtual switches (etherstubs) and virtual routers, bridges and servers (zones) to siumulate an entire network on a single system (project Crossbow)
• zones can exclusivly own an IP stack without a dedicated physical interface (NIC)
• Link protection: limit ability of NIC to send spoofed packets
• VRRP  (Virtual Router Redundancy protocol)

Earlier Solaris 10 networking enhancements.

Solaris 10 networking enhancements by release overview (updated)

Overview of most important changes for networking in solaris 10 releases.
3/5 (base)

• specify source IP by (virtual) interface. Example:

  # ifconfig eri0 usesrc vni0
  The virtual IP vni interface is not associated with any physical hardware and is thus immune to hardware failures. If vni0 has address 10.0.0.1 assigned to it, the system will prefer 10.0.0.1 as the source address for any packets originated by local connections that are sent through eri0.

• RIPv2, BGP, and OSPF through GNU Zebra (adapted for Solaris)
• /usr/lib/mail -> /etc/mail/cf
• routeadm command
• rdisc wrapped into in.routed
• use ifconfig to configure ipforwarding for individual interfaces
• IP quality of service (IPQoS)
• WAN boot installation
• SSH 3.5p1 (adapted for Solaris)
• Stream Control Transmission Protocol (SCTP)

1/6 (u1)

• SMTP over TLS
• source address filtering on multicast traffic
• dladm command for data link (layer 2) configuration, link aggregation (ethernet trunk)
• IGMPv3 and MLDv2 (IPv6) routing support

6/6 (u2)

• IPFilter for IPv6

11/6 (u3)

• Mandatory Access Control (from Trusted Solaris) for networking and other functions
• Set secure by default network profile during installation

8/7 (u4)

• SMF based routing services (svcadm in addition to routeadm)
• merge /etc/inet/ipnodes (for IPv6) into /etc/inet/hosts
• GNU Quagga routing suite replaces GNU Zebra
• Key Management Framework for PKI
• encryption kit included + MD4, MD5, SHA1, and SHA2
• exclusive access to physical network interfaces by non-global zones
• DHCPv6 client
• IPFilter firewall enhancements
  
  • pfil driver/daemon removed (replaced by packet filter hooks)
  • IPv6 support
  • loopback interface support
    

5/9 (u7)

• SHA2 512bit, Diffie-Hellman 4096 bit

10/9 (u8)

• NTP 4.1.2
  

9/10 (u9)

• The client queue runner is now a separate daemon (svc:/network/smtp:sendmail-client). It used to be part of sendmail  (svc:/network/smtp:sendmail).
• The net_access privilege has been added to the basic privilege set. Denying this privilege, cuts network access.

Internet map

routing components / Solaris 10

• Commands
  • route: manage routing table
  • netstat -rn: view routing table
  • routeadm: enable/disable routing services
  • svcadm: enable/disable routing services (in addition to routeadm from Solaris 10 8/7)
    • route
    • ipv4-forwarding
  • traceroute: test and show route to system
• Daemons
  
  • /usr/sbin/in.routed
    
    • RIPv1
    • RIPv2
    • RDISC
• Files
  • /etc/defaultrouter: default route for static routing
  • /etc/gateways: in.routed configuration file
  • /etc/routing.conf: routeadm persistent state. From Solaris 10 8/7 this information moves to SMF.
  • /etc/inet/static.routes: route command persistent state (subject to change)
    

IPMP components / Solaris 10

• Commands
• ifconfig: configure interfaces
• if_mpadm: change interface state
• -d detach
• -r reattach
• Daemons (SMF network/initial)
• /usr/lib/inet/in.mpathd
  
• -a alert to syslog daemon.error (undocumented)
• Files
• /etc/default/mpathd: boot time defaults
  
• /etc/hostname.interface: per interface configuration file for ifconfig

solaris stealth sniffing

A network interface that is sniffing the network is in promiscuous mode: it accepts packets that are not destined for its ethernet address.
You can try to detect a promiscuous interface by tricking it into replying to a packet that is not sent to its ethernet address (e.g. a malformed packet).

In Solaris you can make all such attempts fail by bringing the interface down.

# ifconfig bge0 down
# snoop -d bge0

Still you can sniff on that interface!

Ethernet Media

• 10Base5: 10 mm diameter (thick)

• 10Base2: 5 mm diameter (thin), BNC (Bayonet Neill-Concelman) connector

• 10BASE-T: twisted pair, 2 mm diameter, RJ45 plug
  • UTP (unshielded twisted pair)

• STP (shielded twisted pair)

• S/UTP (shielded calbe with UTP wires)

• thin /thick /twisted pair sockets

• 1000BASE-X: Fibre optic

ISO/OSI - TCP/IP network layers