Basics to GDB Debugging

 

●      1. We see that there is a core dump happening:

●      

●      2. We see what the core dump tells:

●      

●      3. Disassemble

●      The arrow tells us the instruction where the core dump was generated

●      

●      4. Print address

●      

●      5. Print address

●      

●      6. Print the character at address (if it was a character)

●      

●      7. To see the contents of registers- info registers

●      

●      8. To see which function called which function and so on till the current function- use ‘backtrace (bt)’ or ‘info stack’ or ‘where’

●      

●      :

●      :

●      :

●      

●      10. To see the frame info of the latest stack frame from above- info frame

●      

 

Now,

ESP is the current stack pointer. EBP is the base pointer for the current stack frame.

When you call a function, typically space is reserved on the stack for local variables. This space is usually referenced via EBP (all local variables and function parameters are a known constant offset from this register for the duration of the function call.) ESP, on the other hand, will change during the function call as other functions are called, or as temporary stack space is used for partial operation results.

 

●      We need to know who had called us and what were the parameters given to me (the current function)

●      

○      So, ebp+ 0 will give us the previous ebp

○      We can know the ebp address from the info registers

○      Usually the value of ebp in info registers (which is the current value of the ebp) will be same as the info frame since it will be pointing to the local variables of current function.

●      Now, ebp + 4 contains the return instruction where we have come from

○      Example: 

○      

○      To see the above output to print 10 addresses, in hexadecimal format and in word length(.ie. 4 bytes, 8 bytes, …):

○      Example:

○      

○       

○      In that example, we see who has called us is this:

○      

●      In example, we can tell that the current function has been called from connect() function using:

○      

●      Now, we can do disassemble connect+176:

○      

○      So, we see that the instruction before 176 has a function call to mystrcpy()

[BGP] Significant Changes to BGP in Recent Years

Border Gateway Protocol (BGP) is a fundamental routing protocol that is responsible for routing Internet traffic between Autonomous Systems (ASes). BGP is used to exchange routing information between routers on the Internet, and it determines the best path for network traffic to follow. In recent years, BGP has undergone several changes, with new features added to improve its performance and security. In this article, we will discuss some of the newer features added to BGP in recent years.

One of the most significant changes to BGP is the addition of BGPsec. BGPsec is a security extension to BGP that provides secure routing by adding digital signatures to BGP updates. This ensures that BGP routing information is authentic and has not been tampered with, preventing attackers from hijacking traffic or redirecting it to a malicious destination. BGPsec is now widely deployed, and it is essential in ensuring the security and integrity of BGP routing information.

Another important addition to BGP is the support for Multiprotocol BGP (MP-BGP). MP-BGP allows BGP to support routing information for multiple protocols, such as IPv4 and IPv6, as well as other network layer protocols like MPLS. This provides greater flexibility and scalability in routing, allowing BGP to handle the increasing demands of modern networks.

BGP Flowspec is another feature that has been added to BGP in recent years. BGP Flowspec is a traffic filtering mechanism that allows network operators to specify how traffic should be treated based on specific characteristics, such as the source or destination IP address, the type of traffic, or the application used. This allows network operators to block or rate-limit traffic that is considered undesirable, such as traffic from known sources of DDoS attacks.

BGP Large Communities is another recent addition to BGP. BGP Large Communities is an extension to BGP that allows network operators to attach additional metadata to BGP routing updates. This metadata can be used for a wide range of purposes, such as filtering, traffic engineering, or monitoring. BGP Large Communities is particularly useful in large networks where the routing table can be very large, and it provides a more efficient way to manage routing updates.

BGP Link State is another recent addition to BGP that provides a more scalable way to handle routing information. BGP Link State is based on the same principles as the OSPF and IS-IS routing protocols, where routers maintain a database of link-state information, and routing decisions are made based on this information. BGP Link State can handle larger networks with more complex routing requirements, providing better scalability and efficiency in routing.

BGP Add-Path is a feature that allows BGP to advertise multiple paths for the same destination prefix. This provides greater redundancy and load balancing, allowing traffic to be distributed more evenly across multiple paths. BGP Add-Path is particularly useful in networks with high traffic volumes or where link failures are common.

Finally, BGP Route Refresh is a feature that allows BGP routers to refresh their routing tables without tearing down BGP sessions. This provides a more efficient way to handle routing updates, as BGP sessions do not need to be reset each time the routing table is updated. BGP Route Refresh is particularly useful in large networks with many BGP sessions, where resetting BGP sessions can be a time-consuming and disruptive process.

In conclusion, BGP has evolved over the years to become a more robust, secure, and flexible protocol, thanks to the addition of new features and improvements. Network operators can now benefit from advanced features like BGP Flowspec, BGP-LS, and BGPsec, to enhance their network's security, scalability, and resiliency. The combination of BGP with SDN technologies can further enhance network automation and programmability, making it easier to manage large-scale networks.

OSPF vs ISIS- Which Routing Protocol for your needs?

OSPF and ISIS are two popular link-state routing protocols used in large-scale networks. Both protocols have similarities and differences in terms of their design, features, and operation.

OSPF (Open Shortest Path First) is a well-established protocol that has been in use for over 30 years. It operates at the Internet layer (Layer 3) and uses a hierarchical design that partitions the network into areas. Each area has its own topology database, which reduces the size of the network's routing table and enhances scalability. OSPF also supports multiple paths to a destination, allowing for load balancing and redundancy.

ISIS (Intermediate System to Intermediate System) is a protocol that operates at the Network layer (Layer 2) and is used in large-scale Service Provider networks. It also uses a hierarchical design similar to OSPF, but instead of areas, it uses levels. Each level has its own link-state database, which reduces the size of the network's routing table and improves scalability. ISIS is also known for its fast convergence and support for large networks with high-speed links.

One significant difference between OSPF and ISIS is their underlying protocol. OSPF uses IP packets to exchange routing information, while ISIS uses a protocol called CLNS (Connectionless Network Service). This difference can impact the protocol's behavior and performance, depending on the network's architecture and requirements.

Another difference is the way they handle metric calculations. OSPF uses a metric called cost, which is based on the link's bandwidth. In contrast, ISIS uses a metric called metric value, which is based on the link's speed and delay. This difference can affect how the protocol selects the best path to a destination and can impact network performance and behavior.

Additionally, OSPF and ISIS have different default behavior for load balancing. OSPF supports equal-cost multipath (ECMP) by default, which allows for multiple paths to a destination with the same cost. In contrast, ISIS does not support ECMP by default, and network operators must configure it manually. This difference can impact how network operators design their network for load balancing and redundancy.

Furthermore, OSPF and ISIS have different mechanisms for network convergence. OSPF uses a process called Dijkstra's algorithm to calculate the shortest path to a destination, while ISIS uses a technique called SPF (Shortest Path First) calculation. Both mechanisms ensure network convergence and path selection, but their implementation and performance can vary based on network topology and traffic patterns.

In terms of security, both OSPF and ISIS support authentication to prevent unauthorized access and attacks. OSPF supports several types of authentication, including plaintext, MD5, and IPsec, while ISIS supports only plaintext authentication. This difference can impact network security and how network operators secure their network.

Finally, OSPF and ISIS have different deployment and support options. OSPF is widely supported by many vendors and is commonly used in enterprise networks, while ISIS is primarily used in Service Provider networks and is supported by fewer vendors. This difference can impact how network operators choose their routing protocol based on their network's architecture and requirements.

In conclusion, OSPF and ISIS are both link-state routing protocols that offer similar features and benefits but have significant differences in their design, behavior, and operation. Network operators must carefully evaluate their network's requirements and architecture to choose the best protocol for their needs.

ISIS Series- Part 8: ISIS Configuration

 

Configuration

In this lab we will configure IS-IS to carry IP routes. The IS-IS Lab Files include the initial and final configs for the topology.

The router R2 will summarise the IP’s of the loopback interfaces into a /22 network.

The topology is as follows:

The first step is to enable the IS-IS process. Each IS-IS area uses a separete process. In the example below, the System-ID uses the IP address of Loopback 0 in the NET value. This could be any value, but reformatting a loopback IP makes troubleshooting easier.

The use of passive-interface is the same as with any other routing protocol.

The first IS-IS process on Cisco routers are set to Level 1-2. All later processes are Level 1 by default. Change this with the is-type command.

Following this, enable IS-IS on an interface.



[rtbs name=”isis_intro-configure”]



Show clns neighbours 

confirms that neighbour relationships have been established.

Show isis database 

shows the LSDB. 

This is router reachability information.

Show clns interface 

shows the IS-IS settings for the interface.



[rtbs name=”isis_intro-adjacency”]



We can see that IS-IS has learned routes, and installed them into the routing table.


[rtbs name=”isis_intro-routingtable”]



Under the IS-IS process, a summary address can be configured.

If a default route were required, it could be advertised with default-information originate.

Configure Summarization

R2(config)#router isis 
R2(config-router)#summary-address 10.0.0.0 255.255.252.0 level-2

You can see that R3 is now learning the summary address, rather than each individual network.

Verify R3 Routing Table

R3#show ip route isis
Gateway of last resort is not set

      10.0.0.0/22 is subnetted, 1 subnets
i L2     10.0.0.0 [115/20] via 192.168.20.1, 00:03:15, GigabitEthernet0/1
      172.16.0.0/32 is subnetted, 3 subnets
i L2     172.16.0.1 [115/20] via 192.168.20.1, 00:19:51, GigabitEthernet0/1
i L2     172.16.10.1 [115/10] via 192.168.20.1, 00:19:51, GigabitEthernet0/1
      192.168.10.0/30 is subnetted, 1 subnets
i L2     192.168.10.0 [115/20] via 192.168.20.1, 00:19:51, GigabitEthernet0/1

ISIS Series- Part 7: ISIS Adjacencies

Adjacancies

IS-IS uses Protocol Data Units, or PDU’s to communicate. This is like a packet in OSPF terminology.

An IS-IS Hello PDU, or IIH, is like OSPF hello packets. Routers exchange IIH’s to form neighbour relationships, and share area addresses.

IS-IS sends IIH PDU’s at layer-2, using a multicast MAC address. This is why there is only a need for a single address (the NET or NSAP) per router. Addresses aren’t required per interface. This also shows that IP addresses on interfaces are irrelevant to IS-IS.

Level 1 routers need the Area-ID to match. Additionally, level 2 routers will ignore IIH’s from Level 1 routers. Authentication and network type must also match for neighbours to form.

Level 2 and Level 1-2 routers do not need level 2 IIH’s to have the same Area-ID


A Link State PDU, or LSP, contains routing information, and is flooded to neighbours. LSP’s are like OSPF’s LSA’s. There are two types of LSP’s; Level 1 LSP’s and Level 2 LSP’s. Level 1-2 routers send and receive both types.

The LSP contains a header and TLV fields. The TLV fields contain the information that is being advertised, such as IP routes. Extra TLV’s contain other data, like neighbour information, and authentication information.

When there are network changes, the router floods LSP’s out. Other routers receive these LSPs, and used them to build their Link State Database (LSDB). IS-IS is more efficient at this than OSPF. It combines several networks into an LSP, rather than sending many small LSA’s. This adds to the scalability of IS-IS, as more routers can exist on the network without over flooding.




When IS-IS is on broadcast media, one router is the Designated Intermediate System, or DIS. The DIS will flood LSP’s out, instead of having all routers flood the segment. This is like the Designated Router in OSPF.

Routers hold an election to select the DIS. The router with the highest priority on the segment wins the election and becomes the DIS. If there is a tie, the router with the highest MAC wins. DIS uses preemption, so if a router with a better priority comes along, it will become the new DIS.

There is no backup DIS. This is different to OSPF, which has a BDR role.