# nw * [Mesh - 802.11s](#mesh---80211s) * [Roaming - 802.11k/r/v](#roaming---80211krv) * [Open Source Software for Routing](#open-source-software-for-routing) * [BGP](#bgp) * [Private AS](#private-as) * [Virtual networking modes](#virtual-networking-modes) * [Tools for Windows](#tools-for-windows) * [Tools for All platforms](#tools-for-all-platforms) * [Router OSes](#router-oses) * [NAT](#nat) * [NAT Hairpin + DDNS](#nat-hairpin--ddns) * [Mikrotik](#mikrotik) * [OSPF](#ospf) * [Mikrotik](#mikrotik-1) * [MPLS](#mpls) * [Mikrotik](#mikrotik-2) * [VPLS](#vpls) * [Mikrotik](#mikrotik-3) * [OpenBSD](#openbsd) * [Linux](#linux) * [L7 filters](#l7-filters) * [Subnet Helper](#subnet-helper) * [MAC addresss <-> Vendor](#mac-addresss---vendor) * [Tuning](#tuning) * [TCP congestion control](#tcp-congestion-control) * [BBR](#bbr) * [Introspectable tunnels to localhost](#introspectable-tunnels-to-localhost) * [Load Balancing](#load-balancing) * [Transparent Proxy](#transparent-proxy) * [mitmproxy](#mitmproxy) * [V2Ray - Go](#v2ray---go) * [redsocks - C](#redsocks---c) * [Tinyproxy - C](#tinyproxy---c) * [moproxy - Rust](#moproxy---rust) * [Any Proxy - Go](#any-proxy---go) * [avege - Go port of redsocks](#avege---go-port-of-redsocks) * [NetFlow Software](#netflow-software) \* * [Private](#private) * [IPV6](#ipv6) * [Guide](#guide) * [Monitoring](#monitoring) * [mikrotik](#mikrotik-4) * [datadoghq](#datadoghq) ## Mesh - 802.11s extends the IEEE 802.11 MAC standard Hybrid Wireless Mesh Protocol (HWMP) defined in IEEE 802.11s, is a basic routing protocol for a wireless mesh network. ## Roaming - 802.11k/r/v * 802.11r - Fast Basic Service Set Transition (FT) to authenticate PSK/802.1X more quickly * 802.11k - search APs; creating an optimized list of channels * 802.11v - exchange network topology * BSS transition management + Disassociation Imminent => influence client roaming behavior by providing it the load information of nearby access points. * Directed Multicast Service (DMS): optimizes multicast * BSS Max Idle Service: how long to remain associated when no traffic * needs both the AP and the station to support * ESS = all BSSID(MAC) of same SSID * mobility domain = subset of ESS that allows station to roam around * R0KH: controller as the PMK-R0 key holder * R1KH: APs as the PMK-R1 key holder * S0KH and S1KH, S for supplicant: station are the PMK-S0 key holder and PMK-S1 key holder [openwrt.md](https://book.ferro.pro/openwrt/wireless#80211kvr) ## Open Source Software for Routing ## BGP implement SDN by transforming BGP messages into friendly plain text or JSON BGP-based VPNs as a backend for Neutron ### Private AS * 64512 - 65534 * 4200000000 - 4294967294 ## Virtual networking modes ![](https://cdn.thenewstack.io/media/2017/02/7a021d86-virtual-networking-1024x380.png) ## Tools for Windows Microsoft Message Analyzer: Microsoft Network Monitor(2010): BTest: Force socks: ## Tools for All platforms Wireshark: ## Router OSes ## NAT ## NAT Hairpin + DDNS ### Mikrotik ``` /ip firewall address-list add address=192.168.88.0/24 comment=Management list=LANs add address=10.0.0.0/8 comment=Lab list=LANs add address=my.ddns.domain list=WANs add address=192.168.1.0/24 list=WANs /ip firewall nat add action=dst-nat chain=dstnat dst-address-list=WANs dst-port=4430-4431 protocol=tcp to-addresses=192.168.88.19 ``` ref: ## OSPF ### Mikrotik v6: ``` /routing ospf instance set [ find default=yes ] redistribute-connected=as-type-1 /routing ospf network add area=backbone network=192.168.1.0/24 ``` v7: ``` /routing ospf instance add disabled=no name=ospf-instance-1 redistribute=connected /routing ospf interface-template add area=ospf-area-1 disabled=no interfaces=br-wan /routing ospf area add area-id=192.168.99.0 disabled=no instance=ospf-instance-1 name=ospf-area-1 ``` ## MPLS ### Mikrotik Targeted LDP session is session that is established between two routers that are not direct neighbors. Multiprotocol Label Switching Architecture / Obsoletes: 3036 LDP Specification ## VPLS ### Mikrotik VPLS Using BGP for Auto-Discovery and Signaling\ VPLS Using LDP Signaling\ (cisco-style Signaling)\ PWE3 Fragmentation and Reassembly ### OpenBSD ``` RFC4447: - Section 6.2: control word negotiation - Section 5.4.3: pseudowire status negotiation - PWid group wildcard ``` ### Linux TODO： PWE3 Control Word for Use over an MPLS PSN （diff with 4623?） ## L7 filters ## Subnet Helper E.g.: .96-127/27: #2^5 .0-127/25: #2^7 ## MAC addresss <-> Vendor ## Tuning ## TCP congestion control ### BBR ## Introspectable tunnels to localhost last update @ 2021 Oct : * ./npc nat # p2p will not work if server/client both Symmetric Nat source /dev/stdin ehang-io/nps <<< "$(curl -fsSL )" | grep linux | grep amd64 openssl genrsa -out server.key 2048 openssl rsa -in server.key -outform PEM -pubout -out server.pem ( Jan 12 2020: p2p/xtcp under dev) ## Load Balancing * [mwan](https://book.ferro.pro/nw/mwan) * Reverse proxying (AKA Layer-7 switching) Varnish Cache Nginx Squid Apache mod\_proxy Relayd TCP connection redirection (AKA Layer-4 switching) IPVS, part of the LVS suite Ha-proxy Relayd ## Transparent Proxy ### mitmproxy ### V2Ray - Go ``` "inboundDetour": [ { "protocol": "dokodemo-door", "port": 20088, "settings": { "network": "tcp,udp", // TPROXY required for UDP "timeout": 10, "followRedirect": true // Linux support only } } ], ``` ### redsocks - C Linux/iptables, OpenBSD/pf and FreeBSD/ipfw are supported. Use on Mac: ### Tinyproxy - C ### moproxy - Rust ### Any Proxy - Go TCP CONNECTION ``` ./any_proxy -l :7777 -p "proxy_ip:1080" ``` ### avege - Go port of redsocks ## NetFlow Software ### * ## Private * RFC1918 private range for IPv4 networks * 10.0.0.0/8 * 172.16.0.0/12： 172.16.0.0 - 172.31.255.255 255.240.0.0 qty:1048576 * 192.168.0.0/16 * RFC4193 range for IPv6 networks (fd00/8). ## IPV6 ## Guide ## Monitoring ### mikrotik dude server : ### datadoghq Network Device Monitoring | $7+/m :