Using visual diagrams of networks asset for management and maintenance can improve the stability and performance of enterprise networks as well as creating network design information base. But, keeping networks topology updated can be a frustrated task that involved in daily maintenance and human resources. Using Visio 2007 that integrates visual display with network topology database can make this task quite easy.
Integrating network topology database
There are some nice tools that can be found on the net that provides network and equipment topology. Some of them provide database exporting capabilities like Lan-Secure Switch Center and Lan-Secure Security Center. Using the Visio 2007 link data to shapes capability provides database information for diagram visual shapes including asset equipment and asset connectors. The Visio 2007 database link feature enables importing data information from several sources including Microsoft Access Database and SQL database. Those capabilities integrated with topology database create a complete network topology diagram that can be maintained and updated automatically using a simple script.
Visio database integration script
The following Visio 2007 database integration script visualize network components asset from selected database information and creates physical connections between them. For simplicity, the script is using Microsoft Access database or SQL database and two record sets one for the components shapes and one for the physical connectors which needs to be filled in using the appropriate query string of the selected database structure.
VBScript (should be copied and saved as .vbs file after modifying brackets information):
'Select database provider connect string
'Const dbProvider = "Driver={Microsoft Access Driver (*.mdb)};DBQ=[Database File (*.mdb)];"
'Const dbProvider = "{SQL Server};SERVER=[Server Name];DATABASE=[Database Name];"
'Add new visio page
Set visioApplication = WScript.CreateObject("Visio.Application")
Set visioPeriphDoc = visioApplication.Documents.Open("PERIPH_M.VSS")
Set visioDocument = visioApplication.Documents.Add("")
Set visioPage = visioDocument.Pages(1)
'Load database to visio
Set Shapes = visioDocument.DataRecordsets.Add(dbProvider, "[Database shapes query string]", 0, "Shapes")
Set Connectors = visioDocument.DataRecordsets.Add(dbProvider, "[Database connectors query string]", 0, "Connectors")
'Set shapes
shapesIndex = 0
ReDim shapesArray(shapesIndex)
Set server = visioPeriphDoc.Masters("Server")
Set shapesRecordset = visioDocument.DataRecordsets(1)
shapesIDs = shapesRecordset.GetDataRowIDs("")
For shapesRow = LBound(shapesIDs) + 1 To UBound(shapesIDs) + 1
Set shapesArray(shapesIndex) = visioPage.DropLinked(server, 0, 0, shapesRecordset.ID, shapesRow, False)
shapeData = shapesRecordset.GetRowData(shapesRow)
shapesArray(shapesIndex).Text = shapeData(0)
shapesIndex = shapesIndex + 1
ReDim Preserve shapesArray(shapesIndex)
Next
'Set connectors
Set connectorsRecordset = visioDocument.DataRecordsets(2)
connectorsIDs = connectorsRecordset.GetDataRowIDs("")
For connectorsRow = LBound(connectorsIDs) + 1 To UBound(connectorsIDs) + 1
connectorData = connectorsRecordset.GetRowData(connectorsRow)
Set connector = visioPage.Drop(visioApplication.ConnectorToolDataObject, 1, 1)
connector.Text = connectorData(0)
childIndex = 0 'Search appropriate index from shapes array
parentIndex = 0 'Search appropriate index from shapes array
Set parentConnector = shapesArray(parentIndex).Cells("Connections.X1")
Set childConnector = shapesArray(childIndex).Cells("Connections.X1")
connector.Cells("BeginX").GlueTo parentConnector
connector.Cells("EndX").GlueTo childConnector
shapesArray(parentIndex).BringToFront
shapesArray(childIndex).BringToFront
Next
'Set layout
visioApplication.ActiveWindow.DeselectAll
visioPeriphDoc.Close
visioPage.Layout
Lan-Secure Network Security and Management Blog for real-time windows based monitoring and discovery software scanning tools.
USB detection using WMI script
USB flash drives are very common and can be found in almost every computerized environment for storing and transferring data between computers. These USB devices make it really easy for potential attacker to exploit unprotected computers with malicious virus and Trojan software and provide a gateway to the network for manipulating sensitive data.
Detecting USB storage devices
There are some nice tools that can be found on the net that will notify about USB devices on local and remote windows platforms. But most of them are not free and will require an installation of an agent on the remote windows platforms. Using the preinstalled Windows Management Instrumentation (WMI) on windows platforms is free and will not require any remote agent. It will only require a simple script that can be run manually from a privileged user account or from another network monitoring software like Lan-Secure Security Center and Lan-Secure Switch Center Protector network security scanners.
WMI notification event script
The following USB notification event script will send an event message in response to any operation of USB device on local or remote windows platform. For simplicity, the script is using a temporary event subscription, which exists only as long as the script is running. Some modifications will be needed for a permanent event subscription that will not require a perpetually running script:
VBScript (should be copied and saved as .vbs file):
strComputer = "." '(Any computer name or address)
Set wmi = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent within 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'")
While True
Set usb = wmiEvent.NextEvent()
Select Case usb.Path_.Class
Case "__InstanceCreationEvent" WScript.Echo("USB device found")
Case "__InstanceDeletionEvent" WScript.Echo("USB device removed")
Case "__InstanceModificationEvent" WScript.Echo("USB device modified")
End Select
Wend
JScript (should be copied and saved as .js file):
strComputer = "."; //(Any computer name or address)
var wmi = GetObject("winmgmts:\\\\" + strComputer + "\\root\\cimv2");
var wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent within 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'");
while(true) {
var usb = wmiEvent.NextEvent();
switch (usb.Path_.Class) {
case "__InstanceCreationEvent": {WScript.Echo("USB device found"); break;}
case "__InstanceDeletionEvent": {WScript.Echo("USB device removed"); break;}
case "__InstanceModificationEvent": {WScript.Echo("USB device modified"); break;}}}
Detecting USB storage devices
There are some nice tools that can be found on the net that will notify about USB devices on local and remote windows platforms. But most of them are not free and will require an installation of an agent on the remote windows platforms. Using the preinstalled Windows Management Instrumentation (WMI) on windows platforms is free and will not require any remote agent. It will only require a simple script that can be run manually from a privileged user account or from another network monitoring software like Lan-Secure Security Center and Lan-Secure Switch Center Protector network security scanners.
WMI notification event script
The following USB notification event script will send an event message in response to any operation of USB device on local or remote windows platform. For simplicity, the script is using a temporary event subscription, which exists only as long as the script is running. Some modifications will be needed for a permanent event subscription that will not require a perpetually running script:
VBScript (should be copied and saved as .vbs file):
strComputer = "." '(Any computer name or address)
Set wmi = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent within 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'")
While True
Set usb = wmiEvent.NextEvent()
Select Case usb.Path_.Class
Case "__InstanceCreationEvent" WScript.Echo("USB device found")
Case "__InstanceDeletionEvent" WScript.Echo("USB device removed")
Case "__InstanceModificationEvent" WScript.Echo("USB device modified")
End Select
Wend
JScript (should be copied and saved as .js file):
strComputer = "."; //(Any computer name or address)
var wmi = GetObject("winmgmts:\\\\" + strComputer + "\\root\\cimv2");
var wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent within 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'");
while(true) {
var usb = wmiEvent.NextEvent();
switch (usb.Path_.Class) {
case "__InstanceCreationEvent": {WScript.Echo("USB device found"); break;}
case "__InstanceDeletionEvent": {WScript.Echo("USB device removed"); break;}
case "__InstanceModificationEvent": {WScript.Echo("USB device modified"); break;}}}
MAC spoofing using windows platform
Every Network Interface Card (NIC) on any platform has unique MAC address that used to access Ethernet networks. The MAC address is hard coded by the network card manufacturer and on many security systems used as a platform identity for network access permission. Using the MAC address of a platform with network permission rights by an intruder or malicious software instead of its original address called MAC spoofing.
MAC address network access control
MAC address spoofing is quite an easy task for a potential intruder especially when using MAC address of network nodes that are inactive most of the time like network printers and networking time and attendance systems. This is the main reason for not using MAC address protection as a single network access control (NAC) mechanism but combining multiple protection methods to create safe and reliable security protection like Lan-Secure Security Center and Lan-Secure Switch Center Protector network security scanners.
MAC address spoofing
There are some nice tools and drivers that can be found on the net that will change MAC address of specific platform to any other MAC address. But it can be done easily on any windows platform using the windows built in registry editor. Here are the steps needed to change windows platform MAC address and gain access to the network as another platform MAC address:
Changing MAC address
1. Open windows registry editor by clicking the Start button selecting Run command and typing “RegEdit”.
2. Open registry folder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}.
3. Select the appropriate network card folder by viewing the data written on the folder DriverDesc value.
4. On the network card folder create new String Value named NetworkAddress and modify its data to the preferred MAC address using its 12 hexadecimal characters in a row.
5. Reset the network card adapter by disable and enable the card from windows Network Connections control panel.
6. Use IpConfig /all windows command to verify the new network card MAC address.
Clearing MAC address
1. Open windows registry editor by clicking the Start button selecting Run command and typing “RegEdit”.
2. Open registry folder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}.
3. Select the appropriate network card folder by viewing the data written on the folder DriverDesc value.
4. Delete the String Value named NetworkAddress.
5. Reset the network card adapter by disable and enable the card from windows Network Connections control panel.
MAC address network access control
MAC address spoofing is quite an easy task for a potential intruder especially when using MAC address of network nodes that are inactive most of the time like network printers and networking time and attendance systems. This is the main reason for not using MAC address protection as a single network access control (NAC) mechanism but combining multiple protection methods to create safe and reliable security protection like Lan-Secure Security Center and Lan-Secure Switch Center Protector network security scanners.
MAC address spoofing
There are some nice tools and drivers that can be found on the net that will change MAC address of specific platform to any other MAC address. But it can be done easily on any windows platform using the windows built in registry editor. Here are the steps needed to change windows platform MAC address and gain access to the network as another platform MAC address:
Changing MAC address
1. Open windows registry editor by clicking the Start button selecting Run command and typing “RegEdit”.
2. Open registry folder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}.
3. Select the appropriate network card folder by viewing the data written on the folder DriverDesc value.
4. On the network card folder create new String Value named NetworkAddress and modify its data to the preferred MAC address using its 12 hexadecimal characters in a row.
5. Reset the network card adapter by disable and enable the card from windows Network Connections control panel.
6. Use IpConfig /all windows command to verify the new network card MAC address.
Clearing MAC address
1. Open windows registry editor by clicking the Start button selecting Run command and typing “RegEdit”.
2. Open registry folder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}.
3. Select the appropriate network card folder by viewing the data written on the folder DriverDesc value.
4. Delete the String Value named NetworkAddress.
5. Reset the network card adapter by disable and enable the card from windows Network Connections control panel.
SNMP management of Ten Giga ports
Using SNMP is the ideal way for managing network performance and traffic. There are also some great tools on the net that will help to do it easily like Lan-Secure Switch Center multi vendor switch port scanner network monitoring software. Either doing it manually or using any preferred tool the exact port speed will be required for having accurate performance and traffic results.
SNMP standard port or interface speed
The standard SNMP port or interface speed can be resolved by using the MIB-II interface speed query (1.3.6.1.2.1.2.2.1.5). Using this query with SNMP Get command and the interface index will return the speed of the specific interface. Using this query with SNMP Get Next command will return the speed of all the interfaces that exist on the device that was queried. The value that will be returned from the query will be the interface bandwidth in bits per second units.
SNMP speed of Ten Giga port or interface
Trying to use the standard SNMP interface speed query on Ten Giga port will return a value of 4294967295 bits per second. This value is the maximum speed that the standard SNMP query will hold for any device interface and it is about 4.3G bits per second. Using this speed to manage the performance and traffic of a Ten Giga ports will return false and inaccurate results.
SNMP high speed port or interface
A solution for the Ten Giga ports speed problem that was described above will require using the MIB-II interface high speed query (1.3.6.1.2.1.31.1.1.1.15). Using this query will return the interface bandwidth in 1,000,000 bits per second units. Replacing the standard speed query with the high speed interface query will work for almost all SNMP devices that support Ten Giga ports and provide an accurate performance and traffic results.
SNMP standard port or interface speed
The standard SNMP port or interface speed can be resolved by using the MIB-II interface speed query (1.3.6.1.2.1.2.2.1.5). Using this query with SNMP Get command and the interface index will return the speed of the specific interface. Using this query with SNMP Get Next command will return the speed of all the interfaces that exist on the device that was queried. The value that will be returned from the query will be the interface bandwidth in bits per second units.
SNMP speed of Ten Giga port or interface
Trying to use the standard SNMP interface speed query on Ten Giga port will return a value of 4294967295 bits per second. This value is the maximum speed that the standard SNMP query will hold for any device interface and it is about 4.3G bits per second. Using this speed to manage the performance and traffic of a Ten Giga ports will return false and inaccurate results.
SNMP high speed port or interface
A solution for the Ten Giga ports speed problem that was described above will require using the MIB-II interface high speed query (1.3.6.1.2.1.31.1.1.1.15). Using this query will return the interface bandwidth in 1,000,000 bits per second units. Replacing the standard speed query with the high speed interface query will work for almost all SNMP devices that support Ten Giga ports and provide an accurate performance and traffic results.
Welcome to Lan-Secure Blog
Lan-Secure blog provides network security and management knowledge base information including technical articles on how to improve networks efficiency and reliability.
Subscribe to:
Posts
(
Atom
)