Wake-up over LAN - networking

By sending so-called the Magic Packet, I'm trying to wake-up a PC over LAN - no luck.
Target PC BIOS settings: Power Management > Wake on LAN: LAN only.
Target PC NIC settings: Power Management > Allow this device to wake
the computer CHECKED. Target PC NIC settings: Power Management > Only
allow a magic packet to wake the computer CHECKED. Target PC NIC
settings: Advanced > System Idle Power Saver - DISABLED. Target PC
NIC settings: Advanced > Wake on Magic Packed - ENABLED. Target PC
NIC settings: Advanced > Wake on Pattern Match - ENABLED.
The packet does arrive at destination; tried ports 0,1,7,9.
What else should I be looking at?

The problem turned out to be windows updater - it was constantly running some kinda super setup to unsuccessfully install the 20H2 update and that was an infinite loop of try-and-fail. Killing that setup in task manager and disabling automatic updates solved the problem. Further investigation proved the faulty setup did not allow PC to go into S0 power mode, but its NIC (and BIOS) has firmware to perform WoL from S0 only. Note: both, motherboard and BIOS are proprietary so I can't add anything else about the system but my frustration with DELL.

Related

Snort / Suricata Network Topology - Is this acceptable?

I run a small business network with around a 500mbit Internet connection and want to introduce an NIPS (network intrusion prevention system). I have identified SNORT or SURICATA as the software of choice (and maybe Zeek which I know less about). Perhaps with PFSense etc. TBD.
Wifi is heavily used in the business, as is standard Windows LAN-cable PCs. Currently our basic Router/Modem handles everything.
CURRENT network topology:
INTERNET ==> Existing ADSL-like Router/Modem (with DHCP + wifi) ==> Office network infrastructure etc
I want to insert a basic Linux box with 2 or four cores + 4GB of ram and a basic 1gbps network card for this SNORT/SURICATA box, before the Internet router.
I want to confirm the following is a good means to go about introducing NIPS:
DESIRED network topology:
INTERNET ==> Existing ADSL-like Router/Modem (disable wifi) ==> SNORT/SURICATA Linux Box ==> Spare Standard ADSL-like Router/Modem with DHCP + Wifi enabled ==> Office network infrastructure etc.
Question: Will this setup allow the SNORT/SURICATA box (given default settings / nothing fancy enabled) to:
Track LAN source IP address of WAN traffic, both outgoing and incoming. I.e. Torrent connection between "Local Computer LAN IP and Remote IP" -, not "Router IP and Remote IP"
Ability to login to SNORT/SURICATA box (no subnet craziness - at least not super hard to resolve problems)
Any gotchas here?
Note this is for a small business with 20 employees, not 300 etc. Conforming to every best practice is impractical at this size.
I am not keen on adding a WIFI network card to said Linux box. The reason is, in a crisis, I want to be able to unplug the snort box and connect the two routers together and immediately provide Internet to the office in case the box goes down for whatever reason (bad snort rules, hard drive dies etc). Also, router/modems need clicks to get connectivity going - I don't need to load up Putty, which would be very hard for anyone else to deal with, if I am not available.
Thanks for the help!
The setup that you are trying to accomplish can easily be done by install a pfSense box (2-4 cores and 4 GB RAM). You can choose the hardware spec from the below link:
https://docs.netgate.com/pfsense/en/latest/book/hardware/index.html
Configure suricata to run in inline IPS mode and you will be good to go. You can anytime ask for assistance while configuring suricata.

Clock synchronization

I have 2 computers running windows 7.
There are simply networked via LAN cable. One is Master and the other Slave. No Internet connection is available.
WHAT I NEED TO DO:
Each time both windows logged in and connected via LAN to each other, the Slave one sets its clock according to the Master's clock without third party user interference. How to implement this scenario?
Thanks in advance.
Having a LAN connection you can setup a synchronized clock among your machines using NTP. It is a protocol which works with great classifiers to keep count of the clock.
Here's a small client that might help you to keep up with the clocks of a few computers running windows, NetTime.

Magic packet for Wake on Wireless LAN?

How to construct & send the magic packet for Wake on Wireless LAN?
The Wikipedia article on the subject only describes the standard Wake-on-LAN magic packet. However the same article describes that a supplementary standard would need to be used for waking up wireless hosts.
... If the computer being woken up is communicating via Wi-Fi, a supplementary standard called Wake on Wireless LAN (WoWLAN) must be employed....
Unfortunately I can't seem to find an authoritative source / method on how to implement Wake-on-LAN that for waking up nodes on WiFi.
The blog that wikipedia linked to say:
The simple fact is that there is not enough industry support for WoWLAN to make it feasible for most organizations.
From TCP/IP Illustrated volume 1:
using PSM (power save mode) can affect throughput performance significantly as idle periods are added between frame transmissions and time is spent switching modes
So I am not sure you really want this feature.
I am not sure if there is a RFC standard about WoWLAN, but there exists PSM in 802.11, which make station into a limited power state and can be woke up by AP. In order to wake the station that in PSM, you just need to send your data message to it, and AP will notify that station in next Beacon frame.
Update:
Some notice:
Only newer Macs support Wake-On-Lan over Wifi. If your Mac is a 2012 or older model, it probably does not support this feature.
You cannot wake from off or hibernate mode the way you can on a PC. You can only wake it from sleep mode. Also note that after a certain amount of time sleeping they will hibernate automatically. You can check this with the pmset -g command. I believe it's the StandbyDelay setting.
Some steps:
Configure your Mac to allow wake from Wi-Fi in the power adapter section of Energy Saver
Use Remote Desktop or an equivalent tool to send the Wake-on-lan (WOL) packet to your router that will then deliver it to your sleeping Mac.
Use some tools like wireshark to view the magic packet structure and protocol, then you can try it through WiFi.
Ref:
wake-on-lan-wol-over-wifi-not-working-on-mac
how-do-i-remotely-wake-my-mac-over-wi-fi
Apart from the above links pointed by Tony, I think the below link for WOL (wake on lan) works for Wake on Wifi as well. If you are not using iphone as a client to wake up as mentioned in the article, you can use any other WOL apps for your client machine:
http://osxdaily.com/2013/12/14/wake-on-lan-mac-iphone/
Hope it helps!

Serial Port not working on Surface Book

I have a Microsoft Surface Book that I've dual booted Linux Mint on. I'm writing a program that needs to read in data from a serial port, but my serial ports don't seem to be working. The behavior is consistent across Mint and Windows (Testing done through Cygwin). It gets a bit of data the first 2-5 seconds that the device is plugged in (viewing the data through screen, same thing happens if I just use pyserial to print data incoming from serial port), then nothing.
What could be happening? I think I've isolated the problem to the serial ports - the Surface Book has 2 USB ports and the same thing happens on both of them, and I've tested the hardware that I'm plugging into it on 2 other computers (One Linux and one Mac OS), and it works fine on both of those.
Your MS Surface, seemingly, has a yellow triangle exclamation mark icon (over the adapter icon) without any driver to install/download. And properties in the device status box window say This device cannot start. (Code 10) or A device which does not exist was specified. Right?
If it's so you should wait for an update from MS. It's notorious problem.
I ended up getting the computer replaced on warranty for an unrelated issue months later, and what do you know, on the new computer the serial ports work fine. That indicates to me some sort of hardware problem, given that the issue persisted across OS's.
maybe this will help:
see Arduino examples for serial port communication - search google:
arduino serial c++
arduino serial c#
arduino serial c++ linux
the point is to open port properly you need to open a file, not a port. not with usual c - assembly write to port code.
another option you are using an unintentionally bought fake USB to serial cable with a Fake PL2303 chip
then you need to install the old version of the driver.
search in google:
Fake PL2303 + your os name:
install driver Fake PL2303 windows 10
another option is maybe it conserves energy and closes the port because it feels it is unused.
in windows> device manager,> properties of a device - usually USB root hub > power management - allow the computer to turn off this device to save power - uncheck it.
https://superuser.com/questions/408683/why-my-usb-mouse-gets-suspended-after-3-seconds-of-inactivity
https://blogs.msdn.microsoft.com/usbcoreblog/2013/11/08/help-after-installing-windows-8-1-my-usb-device-doesnt-charge-or-it-disconnects-and-reconnects-frequently/
also, you could look in windows events - to see what happens. usually, failures like this are registered in the events log.
an unlikely option is it consumes too much current, like a short circuit. and the device protection circuit shuts the chip off. also probably it does not have such circuit. one possibility is to try with an external powered hub.
the most probable of these is the power saving mechanism
I was experiencing the same problem - came across the solution on another site. The USB 3 ports on Surface Book aren't compatible with something or other to do with Com Port but running the device through a cheap USB hub solved my problem straight away and it was instantly recognised by the Arduino IDE

Will Netmap bridging break ipfw rule on FreeBSD

I am working on setup a netmap enabled (high performance bridging firewall).
The question is if i am using netmap's bridging tools to bridge em0 and em1,
and setup ipfw rules to block some kinds traffic on one em0, will it works?
the kernel bridging is works fine with ipfw but its slow(not netmap enabled), my worry is if it short circle the firewall rules, if i look at the implementation, it doesn't do anything about packet filtering, just once em0 received packets it will forward to em1 immediately
the netmap bridging tools is bridge.c
https://www.freebsd.org/cgi/man.cgi?query=netmap&sektion=4
While a NIC is in netmap mode, the OS will still believe the interface
is up and running. OS-generated packets for that NIC end up into a
netmap ring, and another ring is used to send packets into the
OS network stack. A close(2) on the file descriptor removes the
binding, and returns the NIC to normal mode (reconnecting the data
path to the host stack), or destroys the virtual port.
NICs without native support can still be used in netmap mode through emu-
lation. Performance is inferior to native netmap mode but still signifi-
cantly higher than sockets, and approaching that of in-kernel solutions
such as Linux's pktgen.
PS:
You can do bridging and filtering with ng_ipfw + ng_bridge - it's a fast kernel based solution

Resources