Selfnet Blog

Feb 08, 2015

Graphing interface errors with M R T G

If you ever want to graph interface errors with MRTG you'll find a few posts on mrtg related mailing lists, however none of them seemed to work with our installation of MRTG. There is no native support in MRTG but you can specify a template for interfaces via the experimental --if-template flag. The following code is based on an example by Tobias Oetiker, I have merely added support for multiple OIDs via a for loop. The code is ugly, but it works.

There is one kink to be aware of though: Since there is not always an evenly matched set of ifIN/ifOUT OIDs I've decided to graph all OIDs on their own. This is achieved by setting

1
Options[$target]: noo

for each OID and by that making sure that MRTG doesn't render 'outgoing' data.

To configure the template you have to fill the 3 arrays special_oid_name, special_oid and special_oid_desc according to your needs, I have included some example OIDs below.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
# Author: Tobias Oetiker <tobi@oetiker.ch>  
# Date: 2006-09-06  
# Purpose: Add an Error graph for each Traffic Graph  
# 02/07/2015: add juniper interface errors / Hannes Rist  
# i am soooo sorry for this  
# see http://www.oidview.com/mibs/2636/JUNIPER-IF-MIB.html  
my @special_oid_name = ('ifJnxInFrameErrors', 'ifJnxInQDrops','ifJnxInRunts');
my @special_oid = ('1.3.6.1.4.1.2636.3.3.1.1.10','1.3.6.1.4.1.2636.3.3.1.1.11','1.3.6.1.4.1.2636.3.3.1.1.12');
my @special_oid_desc = ('Framing Errors: The number of input packets which were misaligned.','Drops: The number of packets dropped by the input queue ofthe I/O Manager ASIC.','Runts: Frames received that are smaller than the runt threshold.');
#$target_lines = $default_target_lines."\n";
for (my $i = 0; $i < @special_oid_name; $i++) {
 my $el = $default_target_lines;
 $el =~ s/^(Target\S+:\s+).+/${1}$special_oid[$i]$if_ref&$special_oid[$i]$if_ref:$router_connect/m; # Error Target
 $el =~ s/^([^\s\]]+)/${1}.$special_oid_name[$i]/gm; # Filename for error log and graphs
 $el =~ s|</h1>| - $special_oid_name[$i]</h1><span style="color: white; background-color: black;">$special_oid_desc[$i]</span><br />|i;
 $el =~ s|^(Title\[.+)|$1 - $special_oid_name[$i]|mi;
 $el =~ s/Traffic/$special_oid_name[$i]/;
 $el =~ s/^(MaxBytes)(\S+)\s+\d+/$1$2 10000/m;  # more than 10'000 errors a second are BIG trouble anyway
 $el .= <<LEGEND;
YLegend$2 $special_oid_name[$i] per Minute
ShortLegend$2 e/min
Legend1$2 $special_oid_name[$i] per Minute
Legend3$2 Maximal 5 Minute $special_oid_name[$i]
LegendI$2 &nbsp;$special_oid_name[$i]:
Options$2 perminute,noo
LEGEND

  if (oid_pick($router_connect,$v3opt,"$special_oid[$i].$if_index")){
        $target_lines .= $el;
  }
  $target_lines =~ s{<tr>\s+<td>(.+?)</td>\s+<td>(.+?)</td>\s*</tr>}{<tr><td>$1</td>\t<td>$2</td></tr>}g;

}

If you want to use it the template has to be passed as an argument to cfgmaker like so (Line 13):

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
/usr/bin/cfgmaker \
    --global 'workdir: /var/www/mrtg-rrd' \
    --global 'Forks: 5' \
    --global 'LogFormat: rrdtool' \
    --global 'Options[_]: bits' \
    --global 'WithPeak[_]: ymw' \
    --no-down \
    --show-op-down \
    --ifref=name \
    --ifdesc=alias \
    --enable-ipv6 \
    --if-filter="$default && !($if_type ~~ [1, 53, 131])" \
    --if-template=if_errors.tmpl \
    public@$device:::::2 \
    >> $device_err.cfg

After that running MRTG with $device_err.cfg will create graphs like this one:

Picture of RRDTOOL Graph

I hope this article is of some help and spares you of many hours searching the web.

posted at 00:00 by hrist ·  · Monitoring MRTG interface errors

Jan 29, 2015

Plastikonf, new routers, new problems

To provide our members with the latest and greatest budget routers the market has to offer, we buy updated models when restocking. So it happened that procurement ordered some boxes of TP-Link Archer C2.

Since plastikonf writes the configuration to the router by creating a custom configuration file, the first thing to do is to get a configuration backup and decrypt it to base the custom configuration on. Fortunately other people already figured out the crypto stuff for all models we've had so far. But when trying to decrypt the new router's configuration file, the MD5 check failed. After disabling the MD5 check, we're left with garbled XML:

$ xxd cmpr | head -n 16
0000000: d186 bc52 606a da8c 8d2a abcc d855 f4b1  ...R`j...*...U..
0000010: fa80 0000 3c00 003f 786d 6c20 7665 7273  ....<..?xml vers
0000020: 696f 6e3d 2231 2e00 0030 223f 3e0a 3c44  ion="1...0"?>.<D
0000030: 736c 4370 6543 6f6e 6600 0069 673e 0a20  slCpeConf..ig>. 
0000040: 203c 496e 7465 726e 6574 4708 0061 7465   <InternetG..ate
0000050: 7761 7944 6576 6963 6500 0a19 2020 3c0c  wayDevice...  <.
0000060: 5375 6d6d 61af 0072 7920 7661 6c3d 2200  Summa..ry val=".
0000070: 002e 3a31 2e31 5b5d 2842 6173 656c 6960  ..:1.1[](Baseli`
0000080: 006e 653a 312c 2045 7468 564c 4160 014e  .ne:1, EthVLA`.N
0000090: 3a31 2922 202f 524c 4100 504e 554e 756d  :1)" /RLA.PNUNum
00000a0: 6265 724f 6687 0145 6e74 7269 6573 5d31  berOf..Entries]1
00000b0: 018a 2623 496e 666f 0040 3720 203c 4d61  ..&#Info.@7  <Ma
00000c0: 6e75 6661 63c0 0074 7572 6572 4f55 4930  nufac..turerOUI0
00000d0: 4538 4400 1c45 3237 3520 203c 5365 722b  E8D..E275  <Ser+
00000e0: 1469 616c 5b56 0021 4143 4445 3443 1400  .ial[V.!ACDE4C..
00000f0: 2748 6172 6477 6172 6556 00b0 1f2a 2241  'HardwareV...*"A

Looks as if they changed the crypto... Reverse engineering time :) Since the router knows how to decrypt the configuration file, we need to get its firmware for further investigation. Unfortunately, the firmware upgrade files are encrypted as well, so we somehow have to extract the firmware from the device itself. The guy who reverse engineered the crypto for the previous models did so by loading a custom build of openwrt into the RAM and then using openwrt to read out the firmware.

Since I'm a hardware guy and the Archer C2 seems to be unsupported by openwrt, let's open the case. This is what we're looking at: (Ignore the missing U18 for now, we'll get to that later)

Picture of C2-PCB with annotations

  • U11, U12, U14 and surrounding components: Voltage regulators
  • T2-T4: Ethernet isolation Transformers
  • U14: Realtek RTL8367RB Switch, one port is connected to the processor via (R)GMII link
  • U1: Mediatek MT7620 MIPS SoC, integrated 2.4GHz WLAN
  • U504: Winbond W9751G6KB-25 64MByte DDR2 SDRAM
  • U620: Mediatek MT7610 5GHz WLAN
  • U619: Skyworks SKY85703 5GHz WLAN Frontend
  • U18(missing): Winbond W25Q64BV 8MByte SPI Flash
  • J2: UART

The device containing the firmware is U18, as it's the only one with considerable amount of nonvolatile memory. It's commonplace for embedded systems like these routers to store the firmware in serial flash chips like we've got one here.

So I removed U18 in order to get hold of its contents. See the next post on how that has been accomplished.

posted at 23:00 by lukas ·  · tp-link wireless WH-Netz automatic router config

Jan 12, 2015

Plastikonf

Ever wondered where all these wifi networks with strange names like WH-Derki or WH-Bulu come from? These are the preconfigured wireless routers WH-Netz sells. During the last several years, one of our members has continously been developing and improving plastikonf, our custom solution for automatically configuring budget routers. Finally, it's available on Github! https://github.com/Selfnet/plastikonf

See upcoming posts for recent developments.

posted at 23:00 by lukas ·  · tp-link wireless WH-Netz automatic router config
← Previous Next → Page 10 of 11