Transcription
Hey there. Greetings everyone. Daniel Lar with anti-ciphon training, and we are back with our last episode in the networking fundamentals series. Hopefully, you've enjoyed this as much as I have, and you've learned a little bit about networking and their fundamentals. It's been great, but all good things, as they say.
But today, we're going to take a look at troubleshooting. When things go wrong, when it's not all sunshine and rainbows, and the world is crumbling down around you, and you cannot access the glorious thing we call our network and the internet. What do we do? What are, what are some of our resources? Well, that's what our whole topic is today. And hopefully, I give you some things that you could try and get you back into the spirit of things. Get on those interwebs.
All right, let's start off with checking physical connections. This is where you got to start. You got to make sure that everything's plugged in and connected because if it's not, fun fact, you're not going to have any network connectivity. That's how that works. So, if you're on something like a wired network, you have Ethernet cables. There's things that plug into the back of your device. Well, you need to check those connections. These things happen where your network cables just kind of work themselves out. Maybe they get kicked, maybe they get snatched, maybe a vacuum cleaner or something runs over the cable and cuts it, and you don't even realize it. Sometimes you push a cart over these things and it breaks the cable inside. You don't see it on the outside, but they get broken. Maybe they've worked themselves back and forth too many times, and they've broken themselves on the inside, yet again. And no longer is it able to push any packets across that copper cable. That would be a problem, right? That is an issue. So, we have to check those things. We look at the back of the NIC. Are there any lights? If there's no lights, that's a good indicator that nothing's going on. So, you want to grab that little RJ45 connector. You want to unplug it and then you want to reseat it. Hearing that glorious clicking sound that it makes when it makes a good seat, and then do the lights come on? If they don't, guess what you're getting ready to do? You're getting ready to go find you another network cable and plug that in. You're going to take known good and replace suspected bad. If you plug that in, lights come on, everything starts working and grinding. You're like, "Oh, yay. We have internet again." That's good. If it doesn't, then maybe you got different worries.
Now, it could be on the device end. Maybe the NIC itself, the adapter has died. These happen, right? Power surges, things of that nature, they tend to kick over. Heck, there just comes a day in every NIC's life when it's got to push its last packet and say, "Well, I guess that's today. I'm going to the big bit bucket in the sky. It's been fun." And these things happen, right? The tool just stops working, and you need to replace it. But if you don't look and see with your two eyes and your two hands and check and make sure all those connections are right, well, you're going to be sitting there banging your head against the wall for no good reason inside of the operating system, going, "Why is this not working? It doesn't make any sense." So, always start off really quickly. Just check those cables. Make sure they're seated well. Make sure there are lights if that is a cabled connection, and get yourself back in business.
Now, there's also Wi-Fi, which is more common nowadays than not. And it's as simple as going into the wireless settings and making sure that you are actually connected to your wireless access point. Now, here's a fun fact. Every now and then, someone goes, "No, no, no. I'm connected." You, heck, you may have done this yourself. You may go, "You know what? I'm connected." Are you connected to the correct access point? You could be getting the wrong information because you just connected to the wrong access point. And that's why you're not able to connect to the fileshare, even though you can get to the internet, right? Sometimes it's not you're completely down. Sometimes it's just, "I'm unable to get to X, Y, or Z." Why is that? Well, if you connected to the wrong access point, maybe it doesn't have access to that. It's a different network. So, you got to make sure, oh, [laughter] that's that's my bad right there. I got the wrong AP. Let me go ahead and switch those SSIDs around. And now we're back in business. So, just checking those fundamental connections, making sure that they are correct in both the wired and wireless world that you live in, is going to go a long way to troubleshooting many, many of those issues.
Now that said, we have yet to touch a PC. Let's go in and start talking about PCs and what we can do with that. Now, we mentioned that the adapter itself might not be giving you any lights or any action. Guess what? You can disable your adapters, both wireless and wired. All you got to do is, uh, for me, I'm in Windows. I like to do the control panel. That's kind of my stick. That's where I go. And in there, I always like small icons, but again, that's just my stick. That's just how I go. And I look for the Network and Sharing Center. If you're in category view, I think this is going to be under Network and Internet, like that. And then from here, you can look for, oh, View network status and tasks. You can also, I think that's where you want to go. Yeah. And then Change adapter settings. That will take you to this lovely page. From here, we can actually look and see, is my adapter enabled? Now, you'll notice this says right here, "Disable this network device." By inference, that means it is enabled, and that's a good thing. But you might not see it. It could be grayed out, which is a good indication that it is disabled. You can right-click on this and click the status, and you can see in the status that it says right there, it is enabled. If you right-click and you see the status and it shows you that it is disabled, or you get all these lovely things like when you right-click and this says "Enable" and not "Disable." That's kind of your big flashing neon sign that this is not turned on, and you need to enable the device. So, that's a really easy way to get that going. You make that happen.
Another way, if you want to go a little more technical, if you want to have some more fun, bring open your terminal, your command line, and we'll, uh, make that like that, and we will use `netsh` commands. And for this, we're going to do `netsh` like that, `interface`, `show interface`. Give it a moment to do its thing. And now you can see here are all the interfaces. Ethernet zero, plus I got a VMware network adapter VMnet 1, and I've got another one for VMnet 8. Very cool. Excellent. And I can see right over here under the admin state that it is enabled, and under the state that it is connected. So, this is a great place to go if I needed to enable it. If one of these were disabled, I'm like, "Hey, that's a problem. I need that to be enabled." You can also use another `netsh` command. So, `netsh` and you do `interface` like so, `set interface` and then give it the interface name. So, this one is Ethernet zero. Wrap it in quotations. Ethernet zero, like that. And then do `admin=enable`. And that should get you going. Well, I'm already enabled, so I shouldn't have to do anything, but I'll hit that. "Requested operations elevation." That is a good point. I'm glad it reminded me of this. You need to be running as administrator to be able to perform these actions. So, you might run into that. Always remember to right-click and run as admin before you perform these types of administrative functions. Makes sense, doesn't it?
All right, let's talk about Linux a little bit. Let's go over there. I've got a Kali Linux up here. And if we need to take a look at our IPs in that system, we do `ip -br -c`. Actually, you can just do `ip addr`. Could start there. And we can see that there are some adapters here that show a down state. Right now, I've got like `eth1` here. And it shows fine. It doesn't, it will say down if it is down. And you can also, this is why I always like this command. If you do `ip -br`, that's for brief, `c` for color, all, and it shows me the state of each one of these things. I see `eth0` is up. I see my Docker is down. If `eth1` was down, it would show down. So, it's giving me all that information. You can also do `ifconfig` and you can look in here, and I think it tells you whether or not it is up or down. You know, that's something I don't remember. I've been using `ip` because `ifconfig` honestly has been deprecated for a little bit of time now, but we can look and see. We know that Docker is down. So, it should, you'll notice that nothing is happening here. Zero packets, zero errors, zero dropped, zero packets, zero bytes. Nothing is going on in those networks that are down. You see that there as well. For this one, you go to `eth0`, we get a lot of great information here. And we can see there's some transmit packets right there. Cool. That's how many bytes that has gone across this wire. And we can see that it's up. Not as many on `eth1`, but still doing some packet transfer. So, you kind of got to interpret this, but it is there. And if you're in Mac OS and you kind of know what your IP should be, or if you're in Linux and you want to see the specific adapter itself, you can always do `ifconfig` and give it like `eth0`. I'm sorry. Uh, `grep` if. Oh, I did `ifconfig`, [laughter] not Windows, Daniel. `ifconfig eth0` and it'll only give you that specific adapter. So, if you just want to look at those, you can do that as well.
Okay. So, um, yeah, we have looked at basically checking to make sure that everything is running, that everything is connected, everything is up, and it has the ability to actually work. If we've gone through all that, and we're still not getting connectivity to something like the internet or an internal resource, well, we've got some other things that we could possibly do. What are those other things, you ask? Well, let's start with checking our IP addresses, making sure that we can ping, making sure that we find where the breakdown is occurring. Starting with IP addressing is a great place to start. If you know your IP address scheme and everything, which you should if it's your system, [snorts] you need to know these things. Have it documented or whatever the case is so that you know, well, my IP should be this, my gateway should be that, my subnet mask is this, my so on and so forth. DNS should be that. Okay, you need to know all these bits of advice so that you can go in and check, is it corresponding with what it should be?
So let's get back to Linux here, right? If I want to check IPs, well, I can use `ifconfig` and I see I've got a 192.168.1.58. Excellent. I can also make sure that I can ping from one device to another. Now, I think I've got the firewall turned off over there. So let's give this a ping. Let's try, let's just try the gateway, right? That's a great thing to try to ping. Can I connect internally? And we use this ping utility. Actually, I'll clear the screen to actually send out a beacon. Hey, can you, do you get this? And if you do, can you respond? That's what ping does. Like a sonar ping kind of thing, right? So, you ping a device that you know is up and should respond. Something internal. 192.168.1.1. That should be my internal router. It does seem to be responding. Excellent. I have connectivity at least internally. Well, my problems with the internet. Okay. Well, let me ping out to the internet and see what happens. So, if I ping like 1.1.1.1, which is Cloudflare, if I'm not mistaken, I see I'm getting access to that. Excellent. If I get "host not found," you know, some other error, if it does not come back and tell me that I had 0% packet loss or something close to it, it's okay that a packet drops from time to time. Not a big deal. But as long as you get fairly robust packet transmission and reception, you should be good. And this is going to be your key tool for figuring out whether or not connectivity is actually happening. Okay, so pinging is a great connectivity test. There's another cool, and of course, that works in Windows as well. So, you know, we won't have to belabor that point.
There's another cool tool called `traceroute`. So, in, yes, in Linux, it is `traceroute` like that, if I'm not mistaken. We'll see if I get this right. Sometimes I get these things backwards because in Windows, I think it's `tracert`. Well, or it's the other way around. We're about to find out. `traceroute` and I can say, you know, `traceroute 1.1.1.1`, show me how I'm getting out and what stops I'm making along the way. Click that, and you can see it's showing me every single stop I made. And if there was ever a problem at accessing something, it would just show me stars. It'd say, "Hey, I couldn't see that." Now, sometimes that's a firewall, and it'll just, it just, it didn't respond. And that's fine. As long as it makes it to the intended destination and completes its traceroute, you're good to go. If it doesn't, if you get to a certain spot and it just starts like timing out and it never shows you the hops, each one of these hops are probably and should probably give you some information. If they don't, that's probably where communication is breaking down. And you can use that information to go, "Okay, I made it to our firewall and I couldn't get past that. I wonder if there's an ACL that's blocking me. I wonder if there's something in the firewall rules that's stopping me from getting out," and go on from there. So, something like that could help you out. Maybe the router is down. Maybe the gateway does not work right now. You get to the gateway hop, it doesn't respond. You ping the gateway, it doesn't respond. You go, "Okay, there's a problem here. This is the issue. I got to go check my router. I got to go see what's up. Maybe it needs to be rebooted." It could still be on, but maybe it just fell over. It's just, you know, it's a computer at the end of the day. And what happens sometimes to computers, they go, "Does not compute," and it freaks out and just stops working, even though the power's on, the connectivity lights are right, and it just needs a reboot. So, you reboot these things, you go test again. Oh, look, things have come back to normal. Now, if you retest and they don't come back, equipment might be bad, right? It might be a hardware issue. The software is running fine, but the hardware is not working, or the software has become corrupted in some way. Maybe you got a bad firmware update on something, right? This is a deeper troubleshooting issue that you got to kind of follow down, but at least you know where the problem is, and thank you, traceroute, for that work. So, great, great tool there.
So, another thing when it comes to your IP address, you might get an APIPA address. And this happens when DHCP stops working. So, because your device doesn't want to be without an IP address, there's a system that's built in called APIPA, which is the basically it gives you a private IP. And of course, I'm bad with acronyms, so I can't remember exactly what it is off the top of my head, and I didn't write it down because I'm a fool. But I'll let my, uh, lovely and talented editors out there throw the APIPA acronym out there. But it's a, it's a, a private IP addressing system that says, "I didn't get, I'm set up for DHCP and I didn't get DHCP." Automatic IP, right? Automatic Private IP Addressing. I think that might be it. There you go, brain. Kicking gear. It's early in the morning. What are you going to do? Uh, but it will assign an IP address of 169.254.254.something, right? It gives you an IP address itself. It automatically assigns this IP to you. So, you have something, and any other device that didn't get DHCP will also be on that network, and you guys can talk to each other. It typically doesn't work very well because that's not how we're designed to work anymore. But if you see a 169.254.254.something weird one. Yeah, some some one, if it starts with 169, you're looking at an APIPA address, and you're going, "Oh, I didn't get DHCP." So, now I need to look into what is going on with DHCP.
Now, let's get back into our PCs here. When it comes to Linux, clear, not with an EEO. Am I old English? Am I going to get a frilly shirt? Put that on. Uh, when it comes to this, you're going to want to use `dhclient`. You will need `sudo` for this. So, `dhclient` and you're going to do a `-r` to release your DHCP information and then give it your interface name. So, if it was for me, I would do like `eth0` or `eth1` or whatever. You would then hit that. I won't do that. I am connected over a network connection, and I will lose that connection. If I drop my IP right now, I don't want to do that. But that would be the command I would do to release any IP lease that I had from DHCP. And I can start a refresh once I'm ready and I've got that done. I do a `-v` for verbosity. I like verbosity to make this happen so I can see what's kind of going on there, and then give it that interface name, `eth0`, and it will re-request a new IP from the DHCP service. If it doesn't get it, if it errors out anywhere, you get another APIPA address, guess what? Something's wrong with DHCP. You got to go figure out what that is at that point in time. Or if that's not your area of responsibility, that's cool. You call the person that it is their area of responsibility and you say, "Hey, something's wrong with DHCP." If this is in your home network, maybe just restarting your access point because that's most likely where you're getting your DHCP information from is from your router/access point. But that's super cool. It's easily done. Go give that thing a reboot. Again, it's a network service. These things fall over from time to time. They freak out on you. Rebooting typically fixes these things. So, that could just be a reboot on your DHCP service, and then you're back into business. You go do a `dhclient release`, then you renew it. Wait for that magic to happen. Verify you got a good IP address again. Ping some things to make sure that's working, and then move on about your day. You should have that connectivity back up.
Now, let's get back into it for Windows because we do want to see that as well because it is a little bit different. Uh, let's see here. That is going to be here, and we are going to do for that, we'll need to do an `ipconfig /release`. I will not hit enter yet again because I am connected via a network connection, and that will drop that network connection. Once you release that information, it will let you know that you have successfully done that, and you can do a `renew`, which will re-query the DHCP service for new IP information. It should get all that stuff. If it gets an APIPA address again, why is DHCP not giving me my actual IP information? That should be, that's a problem. I need to go run that down, figure out what's going on, check DHCP, maybe restart the service, do some troubleshooting, do some testing there on this service specifically, make sure that I can get it. Is it this host or is it all hosts? Is everybody complaining? "Hey, I'm not able to get to the internet. I got this one weird 169 thing going on with IP." Gotcha. Could be a problem. DHCP services like that, DNS, and so on, they are our saviors in a lot of ways, but they can be the lynchpin to the whole operation. And if they go down, they do something weird, everybody suffers, and you got to go figure out what's going on and get that fixed.
Okay, so you got release, renew with that. Let's see here. What else we got to go over here? Ah, don't forget to check your subnet mask. You might actually have a correct IP address, right? So, let's just do an `ipconfig` here. Oh, you can't see that there. Yeah, do an `ipconfig` there. [laughter] And you want to check those subnet masks, right? Should it be 255.255.255.0, or is it something else? If it should be three 255s followed by a zero, then and you're seeing that, then good. If you're not seeing that for whatever reason, you need to find out why that's happening. Maybe you've accidentally set a static subnet mask, and it's wrong. Maybe you went in and set some static configurations. Maybe you made reservations and you accidentally fat-fingered the subnet mask. A lot of times these things populate with defaults. So, you might be using a 192.168.1 scheme for IP, but you wanted to give it a 255.255.0.0 subnet mask CIDR notation. Well, it filled out 255.255.255.0, and you didn't think. You just kind of worked your way through. This happens, and you go, "Ah, that's right. That's it's not the right thing. These static things are set correctly. DHCP is wrong or vice versa." And you got to fix these things. Man, I'm giving you a lifetime's worth of troubleshooting networks [laughter] at this level, all in one little package. We're already at 21 minutes. We got a few more things to go, but it's going to be a lot of, uh, good stuff. So, bear with me. Should give you some great tools and techniques.
All right, so let's see here. What else do we got to do? So, check that subnet mask. Also, check the gateway. If you got the wrong gateway, you'll probably be able to access things inside of your network, but not the internet itself, because the gateway is how you get to other networks, namely the internet. So, if that gateway is off or wrong in any way, shape, or form, you got to go fix those things. And of course, that just goes back to hitting up your control panel, going to Network and Internet, right? Hitting that Network status and tasks. Go to those Change adapter settings. Click on your tool, go to properties, and you can go into right here where it says IPv4 and click properties. You'll notice I have a preferred DNS server of 1.1.1.1. I don't want to use my ISP's. So, I have statically set that. But everything else is coming through DHCP. If I made a wrong move here, I would need to go and set that, or I would change it to DNS from DHCP. I would get that automatically over that DHCP response. Okay. So, that's how you would do that there. Really fun stuff. Don't forget that if this is wrong, you're going to have a hard time accessing things. You need to go do the hard work to getting that fixed and worked out.
That said, let's see here. Let's talk a little bit about DNS now that we're on the subject. We did mention it. So, check your DNS server and make sure that everything's good. If you do an `ipconfig /all`, you should get that information. And if I'm looking, let's find that lovely thing. Yeah, there it is. So, for this Ethernet adapter zero, I've got my DNS server, and you can see it's 1.1.1.1. It's another way that you can check that it is set properly without having to go through the control panel side of things. You can just do it through an `ipconfig /all`. Get all this wonderful information. And another thing you can do is test that DNS is actually working. So, if I ping `www.google.com`, I should get a reply. You'll notice that it is properly translating google.com to its IP address. If I do not get a reply from this, nothing happens. But I come in here and I ping one. Well, I'll just copy that because that'll be too much. Let's see if I can grab it. There we go. And then put that in there. If I can ping and that gives me a response, well, then DNS is broken. Something's wrong with DNS. It's not resolving the domain name to the IP address correctly because when I use the IP address, everything works. When I use the domain name, nothing works. So, that's a telltale sign that the culprit is DNS. And it's always DNS. It's always DNS. It's just how it is. DNS loves to hose us. I don't know why it hates us so much, but we need it so bad. [gasps] It is the thing.
So, some of the things that you can do to help. Maybe you got a bad DNS cache entry. So, the hostname to the IP has changed, but you still have it cached. You can do an `ipconfig /flushdns`. There you go. Flush the DNS resolver cache. You can then try to access that again. It will do all the DNS things the DNS things do to get the correct information so that you can access those things. If that doesn't work, you got deeper issues with your DNS server. Maybe it needs a reboot. Maybe that kind of thing is going on. Maybe you got a bad record in DNS itself. Maybe the site is just down. That does happen. You can use tools like, is it down, I think it's called. Um, and that kind of stuff to check if it's just you or if it's the world. Oh, what else can we do? We can, we can also do this in Linux land. It's probably unlikely that you'll do it, but I'll show it to you. Why not? It's a lot of fun. Let's go. Hi. Work with me here. I don't know why sometimes my computer loves to hate me, but it does. Uh, let's see here. Let's go to. Can you, can you work with me? Can you work with me? There we go. Thank you, computer. Fun stuff. Oh, what we can do here is if you need to flush your resolver cache, this doesn't work on all Linux distros, so your mileage may vary. I think this is specific to like Ubuntu or Debian flavored, but you'll use `sudo` and you'll need `sudo resolvectl flush cache` like that. Fire that off. Of course, you'll need your password. And then so I don't have resolve. It helps if you spell it correctly. Resolve. Yeah, I think. Yeah. Come on. [laughter] I feel like I'm spelling it correctly. R E S O L V C T L. I think that's it. I don't think that Kali has this built in. Again, your mileage may vary. It may be there, it may not. This could or could not be useful. Maybe just give your computer a good old-fashioned reboot. That never hurts anything.
That said, I know we're tipping the scales on time. I got two more things I'm going to show you specifically for Windows. Let's show you that. And that is if all else fails. Sometimes I've had these things work, and these are just because I've been in the trenches every now and then. So this one, this one is for Windows. Then we got one more Linux thing. So try a `netsh winsock reset`. `winsock reset` reset like that. If all else fails, try that. It kind of rebuilds your TCP/IP stack in your Windows system. Give yourself a little reboot. And I've had that fix many an issue when it comes to networking that I thought was unfixable. That could be a useful one right there. And in your Linux systems, again, mileage may vary. Sometimes you can do a `sudo systemctl restart network-manager` and just type in `network-manager`. Again, mileage may vary depending on what operating system you're running, your distro. And of course, I'm not going to run that because it would restart my networking altogether. But again, giving it a fresh restart, making sure that everything is working correctly is another cool little tool or trick, tip, technique, whatever you want to call it.
This has been a long episode, but hopefully, you got a lot out of this. There's a lot of really good information in there that could help you get back in the action, back in the fray when it comes to networking. Thanks for watching everyone, and if you like what you saw, you know what to do. Find that like and subscribe, comments as well. We love that stuff. Share with your friends, hit the notification bell, and follow us at anti-sipentraining.com. Check out, uh, powered by bhis.com to see everything that we are up to, and you can check out some cool things that are available for you that you can get signed up for. A lot of good stuff there. Hope you enjoyed this, and I've enjoyed doing it for you. Hopefully, I'll see you out there on the interwebs. And until next time, have a great day.