dargnet-networks

 AP in sniffer mode in Cisco 9800 When a Cisco AP joins a WLC it can work in several modes, one of those being the "sniffer". In this mode, the AP will be passively listening to wireless traffic which can be sent to a device that can capture and analyze this traffic using an application like Wireshark. Setting the AP in Sniffer mode Converting the AP to Sniffer mode On our Cisco 9800 WLC we have to navigate to Configuration->Wireless->Access Points From the list of APs we will select the Access Point we want to be in Sniffer Mode, then in the " General " tab, we will select " Sniffer " and " Update and apply to device ". The AP will then reboot and re-join the WLC after a few minutes Setting parameters in Sniffer mode Once the AP has re-joined, we can verify its current mode. We will also notice that no channel is configured to be "sniffed"  For configuring what channels are going to be sniffed, we have to individually go to each ...

TIP - Cisco 9800: Baselining MAC filtering and PSK failures MAC Filtering Failure Some times is good to leverage a quick call to solve an issue to baseline the behaviour of both correct authentication or failures. This time is an SSID with WPA2 Personal, with MAC filtering for Dynamic VLAN asignment via Cisco ISE.  A field engineer called me because one RF Gun was not authenticating to the SSID. Knowing there is a MAC filtering on the SSID (for Dynamic Vlan Assignment) in addition to a PSK, I quickly checked the exclusion reason on the 9800: And also on ISE it was clear that the MAC address was not added to the allowed list : Although I didn´t used the Cisco Wireless Debug Analyzer until this was solved, this is the output for the current issue: Solution : The solution was easy, just add the MAC address to the authorized list. PSK Failure While I was adding the MAC address, the field engineer informed me, he re-entered the PSK on the RF Gun thinking that maybe that was the error ¬¬...

TCL Shell in Cisco IOS XE The TCL Shell for Cisco IOS has been around since Release 12.3(2)T, so it's been around for quite some time now. Still, it remains a very useful scripting utility in certain scenarios. I do a lot of network migrations or upgrades, so I often need to do multiple tests to make sure that everything that worked before that migration still works after it. Here you can find the references: https://www.cisco.com/c/en/us/td/docs/routers/ios/config/17-x/ntw-servs/b-network-services/m_nm-script-tcl-xe.html Ping to different destinations: One of the simplest scripts you can make, and which is very useful when you have to verify that you reach several destinations, is the following: tclsh foreach VAR { A.A.A.A B.B.B.B C.C.C.C } {ping $VAR} I think it is a self-descriptive script, for each of the variables that we will introduce after the loop, ping will be executed. Below I show what output we would see in our switch: For very easy scripts like the previous one, you c...

  Some time ago, in the 38th session of "Tesos" with Ferney Muñoz I shared some tips on how to perform multi channel OTA captures with a Kali Linux VM. Before I just used a Live Kali Linux USB, and from there I was able to set any wireless NIC in monitor mode, but with the security restrictions of Windows, I had to use this method some time after. Although some processes have changed a bit since then, I hope it can help :)

 Some time ago, in the 21st session of "Tesos" with Ferney Muñoz I shared some tips on how to analyze 802.11 captures, creating buttons, filters, colums etc (in spanish) Although some processes have changed a bit since then, I hope it can help :)