January contest answer

The contest is over! The IOS version running on the router at 172.16.232.10: 12.4(9)T1. A bit of crypto savvy was necessary to arrive at the answer...

Probably the first data everyone looked at are the painfully obvious Telnet packets, which carry cleartext console traffic to the router's virtual console (or VTY). Using a packet analyzer, a display filter can be applied to the capture to reconstruct the original data stream. In Wireshark, this is accomplished by right-clicking one of the Telnet packets and selecting Follow TCP Stream from the context menu.

The compiled data will show both directions of the TCP stream. Because the VTY echos back most keystrokes, this can look a bit messy. By filtering out only traffic from the host to the router (select the appropriate direction from the selection list toward the bottom of the window), we can more easily see exactly what was typed in the Telnet session.

It seems user jmcguirk configured a syslog server, created a standard access list, and enabled remote management of the router using SNMPv3. None of this directly helps us determine the IOS version running, so we'll have to look elsewhere in the capture.

Unfortunately, the only other packets of note contain OSPFv2, OSPFv3, PIMv2, IGMPv2, and some encrypted SNMPv3. The routing protocols and IGMP won't be of any help, but the SNMPv3 credentials we gleaned from the Telnet session can actually be used to decrypt the SNMPv3 requests and responses. Let's take another look at the command used to create user "admin" for SNMPv3 access:

snmp-server user admin default v3 auth md5 CISCOCISCO priv des
 MySecretKey access 40

The highlighted portions of the command specify the authentication credentials and privacy (encryption) key used. Specifically, an SNMPv3 agent can authenticate with the username "admin" and the password "CISCOCISCO", with MD5 selected as the hashing algorithm (versus SHA-1). Privacy is provided by DES encryption using the string "MySecretKey".

These values can be plugged into Wireshark to facilitate automatic decryption of eligible SNMPv3 traffic. Navigate to Edit > Preferences and select SNMP from the Protocols list at left.

Click the Edit button to modify the SNMP users table. If you haven't modified this table in the past, it should be empty. Create a new user and fill in the values from the IOS configuration command above (engine_id can be left blank).

Confirm out of the dialogs until you fall back to the main window, and be sure to remove the display filter (from the Telnet traffic) if you haven't already. The SNMP traffic starts at packet #804. With the SNMP credentials recorded in Wireshark, the SNMP packets are now automatically decrypted, allowing us to read the OIDs referenced and the values returned for each.

After decrypting the packets, we can see three OIDs were requested from the switch. Using Cisco's MIB browser, we can identify the purpose of each:

• 1.3.6.1.2.1.1.5.0 - System name
• 1.3.6.1.2.1.1.3.0 - System uptime
• 1.3.6.1.2.1.1.1.0 - System description

System description, eh? The response to this GET request can be found in the decrypted payload of packet #816, along with the contest answer:

Here's the payload exported as printed text for easier reading:

0000   43 69 73 63 6f 20 49 4f 53 20 53 6f 66 74 77 61  Cisco IOS Softwa
0010   72 65 2c 20 33 37 30 30 20 53 6f 66 74 77 61 72  re, 3700 Softwar
0020   65 20 28 43 33 37 32 35 2d 41 44 56 45 4e 54 45  e (C3725-ADVENTE
0030   52 50 52 49 53 45 4b 39 2d 4d 29 2c 20 56 65 72  RPRISEK9-M), Ver
0040   73 69 6f 6e 20 31 32 2e 34 28 39 29 54 31 2c 20  sion 12.4(9)T1, 
0050   52 45 4c 45 41 53 45 20 53 4f 46 54 57 41 52 45  RELEASE SOFTWARE
0060   20 28 66 63 32 29 0d 0a 54 65 63 68 6e 69 63 61   (fc2)..Technica
0070   6c 20 53 75 70 70 6f 72 74 3a 20 68 74 74 70 3a  l Support: http:
0080   2f 2f 77 77 77 2e 63 69 73 63 6f 2e 63 6f 6d 2f  //www.cisco.com/
0090   74 65 63 68 73 75 70 70 6f 72 74 0d 0a 43 6f 70  techsupport..Cop
00a0   79 72 69 67 68 74 20 28 63 29 20 31 39 38 36 2d  yright (c) 1986-
00b0   32 30 30 36 20 62 79 20 43 69 73 63 6f 20 53 79  2006 by Cisco Sy
00c0   73 74 65 6d 73 2c 20 49 6e 63 2e 0d 0a 43 6f 6d  stems, Inc...Com
00d0   70 69 6c 65 64 20 57 65 64 20 33 30 2d 41 75 67  piled Wed 30-Aug
00e0   2d 30 36 20 31 38 3a 34 38 20 62 79 20 70 72 6f  -06 18:48 by pro
00f0   64 5f 72 65 6c 5f 74 65 61 6d                    d_rel_team

Winners

Congratulations to the randomly-selected winners of Routing TCP/IP volume 2!

• Bry Ashman
• Daniel Percy
• Peter Myers

I'll be in contact shortly to arrange shipment of your books. Many thanks to Cisco Press for sponsoring these prizes!

So, thoughts on the contest? Too easy? Too hard? Let me know!