I wanted to do something with a Ras Pi Zero that would incorporate my love for red-teaming/offensive security, and I wanted it to take as many paths of least resistance as possible, and it couldn’t be super expensive ($50-ish USD). Now that I had the basic (albeit arbitrary) parameters in place, all I had to do was come up with the problem to solve. Think, think, think…
One of the problems installers run into on a few networks we manage is having the right tools to properly test a new install. Sure, an installer can run a test to speedtest.net to verify customers are getting their speed. Anyone who has done this long enough knows speedtest.net can be unreliable and produce inconsistent results. So, what then? Or what happens if you need to by-pass customer equipment easily? Most installers break out their laptop, spend a few minutes messing with settings and then authenticating themselves onto the network. Sometimes this can be easy, other times it can be challenging.
In steps the Mikrotik mAP.
What you are about to read is based on a MUM presentation by Lorenzo Busatti from http://routing.wireless.academy/ with my own spin on it. You can read his entire presentation on the mAP in PDF at : https://mum.mikrotik.com//presentations/US16/presentation_3371_1462179397.pdf . The meat of what we are talking about in this article starts on Page 50. If you want to watch the video you can do so at https://www.youtube.com/watch?v=VeZetH9uX_Y . The focus of this article starts around 21:00.
I have taken Lorenzo’s idea and have several different versions based upon the network. In most of our scenarios, the ethernet ports are what plug into the CPE or the customer’s equipment, and the technician connects to the mAP over wifi. This post covers using the mAP as an installer tool, not a traveling router. Lorenzo covers the travel option quite well in his presentation.
In this post, we focus on networks which use PPPoE. PPPoE networks usually are the ones who take much time to set up to diagnose. What we have done is set up an uncapped user profile that is available on every tower. Authentication can be done with local secrets or via radius. Depending on your IP design the user can get the same IP across the network, or have an IP that assigned to this user on each tower/routed segment. We could do an entire article on IP design.
On our Mikrotik, we setup ether1 to have a PPPoE client running on it. When the installer plugs this into the customers CPE the mAP will automatically “dial-out” and authenticate using the technician user we talked about earlier. Once this connection has is established, the mAP is set to turn on the red “PoE out” light on the mAP using the following code.
/system leds add interface=pppoe-out1 leds=user-led type=interface-status
Note. Our PPPoE interface is the default “pppoe-out1″ name. If you modify this, you will need to modify the led setup as well to match.
The red light gives the technician a visual indicator they have authenticated and should have internet. At the very least their mAP has authenticated with PPPoE. There are netwatch scripts mentioned in the above presentation which can kick on another LED indicating true internet reachability or other functions. In our case, we can assume if the unit authenticates with the tower, then internet to the tower is up. While this isn’t always the case if the Internet is down to the tower you quickly know or the NOC quickly knows. At least you hope so. We chose the PoE out led because we are not using POE on this setup and a red light is noticeable.
Once the technician has a connection they can connect to an SSID set aside for testing. In our case, we have set aside a “COMPANY_TECH” SSID. The tech connects to this on their laptop, and they are online. Since this is a static profile, you can set it up just like a typical customer, or you can give the tech user access to routers, APs or other devices. Our philosophy is you set up this SSID to mimic what a customer account experiences as closely as possible. It goes through the same firewall rules and ques just like a typical customer.
To further enhance our tool we can set up a VPN. This VPN can is accessible from the laptop with a second SSID named “COMPANY_VPN”. Once the technician switches over to this SSID they have access, over a preconfigured VPN on the mAP, to the network, from where they can access things customers can not, or at least should not be able to access. Many modern networks put APs, and infrastructure on separate VLANs not reachable from customer subnets. The VPN comes in handy here. You can access these things without changing security. If you plan on using this router internally, the type of VPN you choose is not as important as if you plan to modify the config so you can travel as is the case with the above MUM presentation. If you plan to travel an SSTP VPN is the most compatible. If it’s just inside your network, I would suggest an l2tp connection with IPsec.
Our third configuration on this is to set up the second ethernet port to be a DHCP client. This setup is handy for plugging into the customer router for testing or for places where DHCP is the method of access, for example, behind a Baicells UE. If your network does not use PPPoE, you could have one ethernet be a DHCP client, and the other be a DHCP server. We have found having the technicians connect wirelessly makes their lives easier. They can plug the unit in and not have to worry about cables being too short, or getting behind a desk several times to plug and unplug things.
So why go through all this trouble?
One of the first things you learn in troubleshooting is to eliminate as many variables as you can. By plugging this into your CPE, you have a known baseline to do testing. You eliminate things such as customer routers, customer PCs, and premise wiring. The mAP is plugged directly in CPE, whether it be wired or wireless. Experience has shown us many of the troubles customers experience are traced back to their router. Even if you provide the router, this can eliminate or point to that router as being a source of the problem if a technician needs to visit the customer.
Secondly, the mAP allows us to see and do more than your typical router. From the mAP we can run the Mikrotik bandwidth test tool from it to the closest router, to the next router inlines, all the way out to the internet. A while back I did an article titled “The Problem with Speedteststs“. This article explains many of the issues testing just using speedtest.net or other sites. Being able to do these kinds of tests is invaluable. If there are four Mikrotik routers between the customer and the edge of your network all four of them can be tested independently. If you have a known good host outside your network, such as the one we provide to our clients, then you can also test against that.
Having a Mikrotik test tool like this also allows you access to better logging and diagnostics. You can easily see if the ethernet is negotiating at 100 meg or a Gig. You can do wireless scans to see how noisy or busy 2.4GHZ is. You have easy to understand ping and traceroute tools. You also have a remote diagnostic tool which engineers can remote into easily to perform tests and capture readings.
Thirdly, the mAP allows the installer to establish a good known baseline at the time of install. You are not reliant on just a CPE to AP test, or a speedtest.net test.
How do we make this portable?
You may have noticed in my above pictures I have an external battery pack hooked up to my mAP. I am a fan of the Anker battery packs
Distributors such as ISP Supplies and CTIconnect have the mAP.
Finally, you will need a USB to MicroUSB cable
If you want you can add some double sided tape to hold the mAP to the battery pack for a neat package. I like the shorter cable referenced above in order to have a neat and manageable setup.
No matter what gear you use for delivering Internet to your customers, the mAP can be an invaluable troubleshooting tool for your field staff. I will be posting configs for Patreon and subscribers to download and configure their mAPs for this type of setup, as well as a road warrior setup. In the meantime, we do offer a setup service for $200, which includes the mAP, battery, USB cable and customized configuration for you.
For those of you who don’t know about MTR traceroute it can be a very helpful diagnostic tool. MTR is a visual application that combines the functionality of the traceroute and ping in a single network diagnostic tool.
If you are a Mac user like me MTR is available through homebrew.
Wiremap including shield
Check whether pins on RJ45 jacks have been crimped in the correct order. Pockethernet as well tests the shield for continuity.
Advanced cable testing with only one end connected to Pockethernet. Determine how long a cable is and if it contains any short circuits, split pairs or bad terminations. Pockethernet also detects if a cable is connected to a switched-off computer or switch.
Generate a graph of signal reflections throughout the entire cable length. You can view the length of connected cables and any imperfections they may have (such as extenders or patch panels).
Set the VLAN tags, PCP and DEI for outgoing DNS, DHCP, HTTP and Ping requests. View tagged and untagged traffic with the traffic monitor.
Network discovery (CDP, LLDP)
View the content of CDP and LLDP messages to identify network ports more easily. If the switch port supports it, you can instantly view the connected chassis and port ID as well as the native VLAN.
Find out if any pairs have a phone line or passive PoE connected to them. This allows you to detect services and to protect your network equipment.
PoE supply detection
Measure the presence and voltage of Power over Ethernet to ensure a sufficient power supply for your PoE devices.
Cable toner with customizable tones
Determine the location of cables in a wall and identify single cables in batches or at patch panels. You can set different tones and even control their volume to keep signals separate.
Bit error rate test (10/100/1000)
Real-world cable quality measurement at gigabit speeds. Measure packet length, payload and configure the number of test packets.
Let Pockethernet toggle the Link LED on switches and routers to easily find the cable you are looking for. Set the link speed to toggle a change of color for the port LED.
Link speed and duplex identification (10/100/1000)
Find out the Ethernet capabilities of that unused port you’re wondering about and rule out duplex conflicts.
Link establishment test (10/100/1000)
Determine whether a link can be established at different speeds and make sure the wiring is up to date for gigabit.
DHCP, DNS, Ping, HTTP tests (10/100)
Test the network connection to see if you are able to get an IP address on a port, and connect to internal servers or the Internet.
Traffic detection (10/100)
View which other devices are reachable on a specific port, as well as the type and amount of traffic that is being directed there.
Generate PDF reports
Keep a detailed, up-to-date database and log of your work just by noting locations and port IDs.
Export your results
Email reports for your own records, or share them through a phone’s OS’s native share menu with the press of a button. No more lost reports, tedious downloads from the device or manual editing.
Recently I came across this nifty, and inexpensive, precision screwdriver set. If you want to order your own: http://www.amazon.com/gp/product/B07CMVYDQ2
Being an I.T. guy and an avid G.I.joe collector I am always in need of a smaller sized screwdriver set for various reasons. ANyone who has been at a Data Center trying to get the rack ears on or off a Mikrotik cloud core router knows what I mean. Let’s dive into some uses of this particular kit.
First of all the kit comes with the following bits.
10 x “✡” (Star hexagon Screwdrivers) (T2/T3/T4/T5/T6/T7/T8/T9/T10/T15)
5 x “+” (Cross Screwdrivers) (1.0/1.2/1.5/2.0/3.0)
4 x “-” (Flat-blade Screwdrivers) (1.0/1.5/2.0/3.0)
2 x “★”(Pentagon Screwdriver) (0.8/1.2)
1 x “Y” (Y-type Screwdriver) (2.0)
1 x “▲” (Triangle Screwdriver) (2.3)
1 x “⊙” (Point Screwdriver)(0.8)
1 x Screwdriver Handle
This covers most of the small things I come across on a regular basis. For my purposes, the cross and flat bits are what I use the most. The rest are nice to have for those one-offs.
One of the problems I always have in the GI Joe World is the back screws on the “o-ring” figures. For those of you who don’t know there is a little screw in the back which basically holds the entire figure together.
G.I. Joe was released in 1982 and the screw can rust or otherwise become almost impossible to get out. With this set I am able to get several screws out I have been unable to get out with other kits.
Once the screws are out you can get replacements, but getting them out is the hard part. If the screwdriver doesn’t work you have to go to extreme measures if you don’t want to damage the figure.
The handle is easy to grip. I like the flared design to it. Some of the other small screwdrivers don’t allow me to leverage I need. On a small screwdriver, you might not think you need leverage, because, well it’s small. Well, there are cases where you need that extra bit of “bite”.
The bits are held in but a unique system. I both like this and am annoyed by it at the same time. What I like is the bits are pretty secure. However, getting them back into the holder can be a little of a pain.
The case is small enough to have in your go bag or laptop bag. Close up, the case is about the size of a credit card. I will be adding one into the tool bag I carry with me.