useful CLI commands for BeBox

[Battlestorm]

did a dns check and my 5.4.4.1 has
[quote]DNSServerSourceDomainMetric
87.194.0.6610
87.194.0.6715</CODE>

Bandwidth (Up/Down) [kbps/kbps]: 1,313 / 7,764
Line Attenuation (Up/Down) [dB]: 21.5 / 40.5
SN Margin (Up/Down) [dB]: 7.0 / 6.0

New copper soon

[DLMatthews]

Hmm, they look like static entries to me, as the 'Source' doesn't have a '*'. DHCP allocated DNS details normally have '*' as source. Manually entered records cannot have '*' set.

Example from my router:-
[quote]DNSServerSourceDomainMetricIntfState
87.194.0.66*1RoutedEthoAUP
87.194.0.67*1RoutedEthoAUP</CODE>


Do :dhcp client iflist
[quote]RoutedEthoA:[BOUND][0days,2:57:47]
flags=ucdomaindnsgwrt
IPaddress:87.194.[xxx].[xxx]
HWaddress:00:14:7f:01:33:b8
DHCPserver:87.194.[xxx].[xxx]
vendorclassidentifier:SpeedTouch716:5.4.0.11
metric:rt=1,DNS=1
Leaserenewalin0days,0:01:46
Leaserebindingin0days,0:09:16
Leaseexpiresin0days,0:11:46</CODE>

You see in my DHCP settings, that the metric for DNS records received is 1. And DHCP is requesting the DNS details (as indicated by the flag towards the top). Does your look the same as this?

DLMatthews
LNSTF Exchange Status Checker</font> SNR,Att,Time
Un limited</font> 24(17.5)Mbps/1.3Mbps 6, 22, 0yr
ex-Bulldog</font> 8Mbps/512Kbps 13, 16, 2mth
ex-plus</font>net</font> 2Mbps/256Kbps 30, 20, 1yr
ex-Virgin.net</font> 512Kbps, 5yr</font>

[Battlestorm]

I just checked my user.tpl
[quote]#if$DNS_serv1=''
#else
routeadddns=$DNS_serv1metric=10intf=RoutedEthoA
#endif
#if$DNS_serv2=''
#else
routeadddns=$DNS_serv2metric=15intf=RoutedEthoA
#endif
</CODE>
So even if I erase then they should come back as 10 and 15

[quote]VoIPEthoA:[SELECTING][0days,0:00:00]
flags=bcdomaindnsrt
IPaddress:0.0.0.0
HWaddress:00:14:7f:1e:7b:e6
DHCPserver:255.255.255.255
vendorclassidentifier:SpeedTouch716:5.4.4.1
metric:rt=1,DNS=10
tryingtogetaleasefor12days,5:52:22
transmissionofDISCOVERin0days,0:00:31
retransmissiontimeout:64
nbrofretransmissions:16795


Numberofleases:1</CODE>

Oops I forgot I'm running the static template lol, but it looks like I still request dns servers?

Edit: found where the tpl is pulling them from, it's a set variable inside the tpl

Bandwidth (Up/Down) [kbps/kbps]: 1,313 / 7,764
Line Attenuation (Up/Down) [dB]: 21.5 / 40.5
SN Margin (Up/Down) [dB]: 7.0 / 6.0

New copper soon

Post Edited (Battlestorm) : 25/05/2006 21:49:57 GMT

[DLMatthews]

You're not using DHCP (yes, the DNS flag is set, but its not using DHCP at all, so it doesn't matter).

P.S. You listed the DHCP details for the VoIP interface. You should have pasted the details under RoutedEthoA (which probably wasn't listed as you are on a static IP template).

DLMatthews
LNSTF Exchange Status Checker</font> SNR,Att,Time
Un limited</font> 24(17.5)Mbps/1.3Mbps 6, 22, 0yr
ex-Bulldog</font> 8Mbps/512Kbps 13, 16, 2mth
ex-plus</font>net</font> 2Mbps/256Kbps 30, 20, 1yr
ex-Virgin.net</font> 512Kbps, 5yr</font>

Post Edited (DLMatthews) : 22/06/2006 22:41:10 GMT

[woody2shooz]

that's all well and good, now where's that DNS list gone again?

it's ok, found it [img]/forum/emoticons/turn.gif[/img]

Post Edited (woody2shooz) : 20/06/2006 14:56:41 GMT

[TNW_NL]

yesyes said...
#disable telnet , HTTPs and FTP on WAN (close ports)

service system ifdelete name=TELNET group=wan
service system ifdelete name=FTP group=wan
service system ifdelete name=HTTPs group=wan

By default these services are disabled for the WAN... at least on a SpeedTouch with the generic firmware installed. Are you saying that these services were enabled by default when the modem is supplied by Be?

That would be really bad, Be engineers who intentionally leave these ports open!

However, leaving HTTPs open is quite safe with a strong password. I have configured a modem with that setting to be able to manage it remotely.

tnw_nl - uk/nl SpeedTouch support agent

[Irksome]

TNW_NL said...

By default these services are disabled for the WAN... at least on a SpeedTouch with the generic firmware installed. Are you saying that these services were enabled by default when the modem is supplied by Be?

That would be really bad, Be engineers who intentionally leave these ports open!

However, leaving HTTPs open is quite safe with a strong password. I have configured a modem with that setting to be able to manage it remotely.

Yes & Yes and you've missed the party on that whole debate.

Irksome
Forum Administrator
IT at Home

[Motu]

Hi,

I was hoping someone could give me some feedback on the suggestions in this post. I have looked up and cross referenced it all but I am still confused on a number of points.


'These 3 make your bebox poll a group of NTP servers to keep the time accurate'

Is there any point to this when you can set the BeBox to poll time servers through its configuration page?


#enable ping responder:

It is recommended elsewhere on this site that this is disabled. Why the recommendation to enable it?


#enable SNMP (e.g. for PRTG Traffic Grapher)

What does this do exactly?


#enable nat loopback (access external IP from inside):

Again, what does this do and when would you want to use it?


#fix against TCP timeouts

Why is a 'fix' needed here?



Thanks!

motu

[kurai]

Motu said...
'These 3 make your bebox poll a group of NTP servers to keep the time accurate'

Is there any point to this when you can set the BeBox to poll time servers through its configuration page?

Control and options are more fine-grained and complete in the CLI, as opposed to the minimal setup available from the GUI.

Motu said...
#enable ping responder:

It is recommended elsewhere on this site that this is disabled. Why the recommendation to enable it?

Depends how paranoid you are.
If you are a hysterical loon like Steve Gibson of ShieldsUp fame, then having a machine/device respond to a ping is considered tantamount to inviting hackers in for tea and biscuits while you personally hand them your credit cards and car keys.

The opposing point of view is that ping is a fundamental tool to use when diagnosing network problems/performance so not having it available cripples any attempt to manage/fix stuff.

Motu said...
#enable SNMP (e.g. for MRTG Traffic Grapher)

What does this do exactly?

Simple Network Management Protocol
This has to be one of the worst naming decisions made in the history of network communications - the last thing SNMP is is simple.
Despite how it may sound, trust me - I'm not being patronising but helping you out ... if you don't already know what SNMP is and how to use it, leave it alone and turn the service off.

Motu said...
#enable nat loopback (access external IP from inside):

Again, what does this do and when would you want to use it?

Say you were running a webserver on your internal NAT'ed LAN - you set up a port forward on the router so the outside world can get to it.
The problem is that from inside the LAN you can't, when using the external IP or DNS name - you can only get to it by using the internal LAN NAT address.
Turning NAT LOOPBACK on resolves this issue.

Motu said...
#fix against TCP timeouts

Why is a 'fix' needed here?

It's mostly just a complete waste of time and router CPU cycles checking the header of every qualifying TCP packet.
Sure, if you are experiencing related problems turn it on for troubleshooting diagnosis, but for every day use it's total overkill.

Hope that helps [img]/forum/emoticons/smilewinkgrin.gif[/img]

[Motu]

Kurai,

Your response is great. Thanks very much! Out of curiosity, if I'm running a webserver from a computer on my LAN, and I have a port forwarded to it so I can access it from outside, why is NAT Loopback necessary? I get that it makes it work, but I don't get why it wouldn't work in the first place. Some type of security measure?

Also, what purpose is the firewall serving if I'm using NAT anyway? As in, if no ports are forwarded, or only specific ports I've setup, what use is blocking ports that aren't routed to any computer beyond the router? I ask because I noticed that the firewall was set to 'off' when I setup my Bebox.

I had a problem where my Bebox started locking up. All the lights would go solid, and it would stop routing to the internet. It wouldn't respond to http://bebox, but it would respond to http://192.168.1.254, where everything would look normal, even though the internet was unreachable (despite the light being on on the router). I downloaded the latest firmware from the Be website (6.1.4.3 v4) for my Speedtouch 780, because it was doing this after I installed the 6.1.4.3 from this forum (to fix a problem where the router started having an identity crisis, losing the SSID name I had set for it and reverting to Bebox, then back again. Eventually the whole thing just reset itself back to factory defaults).

I've noticed that the firmware from Be has 'Premium Demo' written all over it when you login to the Bebox control panel. What's that about?

Could extremely intensive use of the Bebox (for Torrents, Slingbox, etc), cause it to lock-up? Mine seems to be suffering a LOT recently. Would Be replace it? I've been with them more than a year and can't be installing new firmware on it every week!

Sorry this has turned into a long Q&A... I appreciate any help, but it's not expected,

All the best,

Motu