Follow me on GitHub

记一次在黑盒环境下使用网络设备(华为)寻找主机

记一次在黑盒环境下使用网络设备寻找主机

一、前记

目前就职于某政府单位。最近接到公安的探针报警,说我们机房内有机器挖矿。

问题在于,我现在只有一台核心交换机。怎么找到这台干坏事的机器呢?

二、材料

目前我手上有的各种网络设备的密码,核心交换机,以及出问题的机器 10.120.10.200

三、干活

1. 核心交换机查询

[~C05_35U_6881_MGBU01]dis ip int br
*down: administratively down
!down: FIB overload down
^down: standby
(l): loopback
(s): spoofing
(d): Dampening Suppressed
The number of interface that is UP in Physical is 20
The number of interface that is DOWN in Physical is 1
The number of interface that is UP in Protocol is 20
The number of interface that is DOWN in Protocol is 1
Interface                   IP Address/Mask    Physical Protocol VPN           
MEth0/0/0                   unassigned         down     down     --            
NULL0                       unassigned         up       up(s)    --            
Vlanif3                     10.120.10.254/24   up       up       --            
Vlanif4                     10.120.12.62/26    up       up       --            
Vlanif5                     10.120.12.126/26   up       up       --            
Vlanif8                     10.120.11.254/24   up       up       --            
Vlanif9                     10.120.12.190/26   up       up       --            
Vlanif10                    11.125.0.129/28    up       up       --            
Vlanif12                    10.120.14.190/26   up       up       --            
Vlanif13                    192.168.0.97/28    up       up       --            
Vlanif14                    192.168.0.113/28   up       up       --            
Vlanif15                    11.125.0.145/28    up       up       --    
[~C05_35U_6881_MGBU01]dis ip routing-table 
Proto: Protocol        Pre: Preference
Route Flags: R - relay, D - download to fib, T - to vpn-instance, B - black hole route
------------------------------------------------------------------------------
Routing Table : _public_
         Destinations : 66       Routes : 70        

Destination/Mask    Proto   Pre  Cost        Flags NextHop         Interface

        0.0.0.0/0   Static  60   0             RD  10.120.14.1     Vlanif44
    10.120.0.28/32  Static  60   0             RD  192.168.0.114   Vlanif14
                    Static  60   0             RD  192.168.0.115   Vlanif14
    10.120.0.32/32  Static  60   0             RD  192.168.0.114   Vlanif14
                    Static  60   0             RD  192.168.0.115   Vlanif14
    10.120.0.62/32  Static  60   0             RD  192.168.0.114   Vlanif14
                    Static  60   0             RD  192.168.0.115   Vlanif14
    10.120.10.0/24  Direct  0    0             D   10.120.10.254   Vlanif3
  10.120.10.254/32  Direct  0    0             D   127.0.0.1       Vlanif3
  10.120.10.255/32  Direct  0    0             D   127.0.0.1       Vlanif3
    10.120.11.0/24  Direct  0    0             D   10.120.11.254   Vlanif8
  10.120.11.254/32  Direct  0    0             D   127.0.0.1       Vlanif8
  10.120.11.255/32  Direct  0    0             D   127.0.0.1       Vlanif8
    10.120.12.0/26  Direct  0    0             D   10.120.12.62    Vlanif4
   10.120.12.62/32  Direct  0    0             D   127.0.0.1       Vlanif4

可见,该主机所属网段是 VLAN 3 的接口。由于该接口的特殊性,需要做进一步的检查。

[~C05_35U_6881_MGBU01]display vlan 3
--------------------------------------------------------------------------------
U: Up;         D: Down;         TG: Tagged;         UT: Untagged;
MP: Vlan-mapping;               ST: Vlan-stacking;
#: ProtocolTransparent-vlan;    *: Management-vlan;
MAC-LRN: MAC-address learning;  STAT: Statistic;
BC: Broadcast; MC: Multicast;   UC: Unknown-unicast;
FWD: Forward;  DSD: Discard;
--------------------------------------------------------------------------------

VID          Ports                                                          
--------------------------------------------------------------------------------
   3         TG:Eth-Trunk3(U)   Eth-Trunk4(U)   10GE1/0/38(D)                   
                                                                                
VID  Type     Status  Property  MAC-LRN STAT    BC  MC  UC  Description
--------------------------------------------------------------------------------
   3 common   enable  default   enable  disable FWD FWD FWD VLAN 0003  

可见,接口为 TG:Eth-Trunk3(U) Eth-Trunk4(U) 10GE1/0/38(D)

<C05_35U_6881_MGBU01>dis arp
ARP Entry Types: D - Dynamic, S - Static, I - Interface, O - OpenFlow, RD - Redirect
EXP: Expire-time VLAN:VLAN or Bridge Domain

IP ADDRESS      MAC ADDRESS    EXP(M) TYPE/VLAN       INTERFACE        VPN-INSTANCE
----------------------------------------------------------------------------------------
10.120.10.200   1418-7763-3173   11   D/3             Eth-Trunk4       

除去 10GE1/0/38(D) 本身只是单接口,另外 Trunk 都有汇聚可能。

[~C05_35U_6881_MGBU01]dis interface Eth-Trunk 4
Eth-Trunk3 current state : UP (ifindex: 141)
Line protocol current state : UP 
Last line protocol up time : 2020-03-27 10:31:51
Description: 
Switch Port, PVID :    1, TPID : 8100(Hex), Hash Arithmetic : profile default, Maximal BW : 20Gbps, Current BW : 20Gbps, The Maximum Frame Length is 9216
Internet protocol processing : disabled
IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is acb3-b535-f411
Current system time: 2021-02-24 14:43:32
Physical is ETH_TRUNK
    Last 300 seconds input rate 961 bits/sec, 0 packets/sec
    Last 300 seconds output rate 957 bits/sec, 0 packets/sec
    Input: 59177804 packets,28146780073 bytes
           39604781 unicast,2299 broadcast,19570724 multicast
           0 errors,0 drops
    Output:40692923 packets,8376191683 bytes
           27765438 unicast,8061080 broadcast,4866405 multicast
           0 errors,0 drops
    Last 300 seconds input utility rate:  0.01%
    Last 300 seconds output utility rate: 0.01%
----------------------------------------------------------
PortName                      Status              Weight   
----------------------------------------------------------
10GE1/0/33                    UP                  1        
10GE2/0/33                    UP                  1        
----------------------------------------------------------
The Number of Ports in Trunk : 2
The Number of Up Ports in Trunk : 2

结论:本地 10GE1/0/33 与下层设备互联

2. 下层设备

再由于该设备是核心交换机,也就是说底下一定有其他设备连接。

[~C05_35U_6881_MGBU01]dis lldp neighbor brief  
Local Interface         Exptime(s) Neighbor Interface      Neighbor Device     
-------------------------------------------------------------------------------
100GE1/0/1                    109  100GE2/0/1              C05_35U_6881_MGBU01
100GE1/0/2                    109  100GE2/0/2              C05_35U_6881_MGBU01
100GE2/0/1                     95  100GE1/0/1              C05_35U_6881_MGBU01
100GE2/0/2                     95  100GE1/0/2              C05_35U_6881_MGBU01
10GE1/0/32                    112  10GE1/0/2               C07_33U_5855_BMC01
10GE1/0/33                    101  10GE1/0/2               c07_35U_5855_BMC02
10GE1/0/47                    112  Ten-GigabitEthernet2/0/40H3C
10GE2/0/32                    112  10GE1/0/1               C07_33U_5855_BMC01
10GE2/0/33                    101  10GE1/0/1               c07_35U_5855_BMC02
10GE2/0/47                     91  Ten-GigabitEthernet1/0/40H3C

我们看到 10GE1/0/1 与我互联,再查询单个接口的 IP 地址

[~C05_35U_6881_MGBU01]dis lldp neighbor interface 10GE2/0/33 
10GE2/0/32 has 1 neighbor(s):

Neighbor index                     :1
Chassis type                       :MAC Address
Chassis ID                         :acb3-b53e-b3b1
Port ID subtype                    :Interface Name
Port ID                            :10GE1/0/1
Port description                   :--
System name                        :C07_33U_5855_BMC01            
System description                 :Huawei Versatile Routing Platform Software
VRP (R) software, Version 8.180 (CE5855EI V200R005C10SPC800)
Copyright (C) 2012-2018 Huawei Technologies Co., Ltd.
HUAWEI CE5855-48T4S2Q-EI

System capabilities supported      :bridge router
System capabilities enabled        :bridge router
Management address type            :IPv4
Management address                 :10.120.10.106
Expired time                       :116s

Port VLAN ID(PVID)                 :1
Port and Protocol VLAN ID(PPVID)   :unsupported         
VLAN name of VLAN 1                :VLAN1
Protocol identity                  :--
Auto-negotiation supported         :No
Auto-negotiation enabled           :No
OperMau                            :speed (10000) /duplex (Full)
Link aggregation supported         :Yes
Link aggregation enabled           :Yes
Aggregation port ID                :1
Maximum frame Size                 :9216
Port Identity                      :--
Discovered time                    :2020-04-17 10:26:45

EEE support                        :No
Transmit Tw                        :65535
Receive Tw                         :65535
Fallback Receive Tw                :0
Echo Transmit Tw                   :0
Echo Receive Tw                    :0

Network Card ID                    :--

对端 ip 地址为 10.120.10.106

<C05_35U_6881_MGBU01>telnet 10.120.10.106
Trying 10.120.10.106 ...
Press CTRL+K to abort
Connected to 10.120.10.106 ...
Warning: Telnet is not a secure protocol, and it is recommended to use Stelnet.

Username:huawei
Password:
Warning: The initial password poses security risks.
The password needs to be changed. Change now? [Y/N]:n
Info: The max number of VTY users is 5, the number of current VTY users online is 1, and total number of terminal users online is 1.
      The current login time is 2021-02-24 15:24:36.
      The last login time is 2021-02-24 13:16:59 from 10.120.10.254 through Telnet.
<c07_35U_5855_BMC02>

访问一下对端主机,获取 arp 地址。

<c07_35U_5855_BMC02>ping 10.120.10.200
  PING 10.120.10.200: 56  data bytes, press CTRL_C to break
    Reply from 10.120.10.200: bytes=56 Sequence=1 ttl=64 time=9 ms
    Reply from 10.120.10.200: bytes=56 Sequence=2 ttl=64 time=2 ms
    Reply from 10.120.10.200: bytes=56 Sequence=3 ttl=64 time=4 ms
    Reply from 10.120.10.200: bytes=56 Sequence=4 ttl=64 time=4 ms
    Reply from 10.120.10.200: bytes=56 Sequence=5 ttl=64 time=4 ms

  --- 10.120.10.200 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 2/4/9 ms
 
<c07_35U_5855_BMC02>dis arp
ARP Entry Types: D - Dynamic, S - Static, I - Interface, O - OpenFlow
EXP: Expire-time

IP ADDRESS      MAC ADDRESS    EXP(M) TYPE/VLAN INTERFACE       VPN-INSTANCE
------------------------------------------------------------------------------
10.120.10.106   acb3-b53e-b365        I         Vlanif3          
10.120.10.26    b405-5d07-94ec   15   D/3       GE1/0/1          
10.120.10.27    b405-5d05-e9b6    9   D/3       GE1/0/2          
10.120.10.28    b405-5d07-937e    9   D/3       GE1/0/3          
10.120.10.101   acb3-b535-f430   16   D/3       Eth-Trunk1       
10.120.10.105   acb3-b53e-b3b5    4   D/3       Eth-Trunk1       
10.120.10.180   74ea-c82f-21c8    8   D/3       GE1/0/20         
10.120.10.184   943b-b0b0-5df6    5   D/3       GE1/0/18         
10.120.10.186   542b-de51-b36c   12   D/3       GE1/0/22         
10.120.10.187   c400-ada2-18fc   20   D/3       GE1/0/17         
10.120.10.200   1418-7763-3173   20   D/3       GE1/0/13         
10.120.10.254   acb3-b535-f415   20   D/3       Eth-Trunk1       
----------------------------------------------------------------------------------------
Total:12         Dynamic:11       Static:0    Interface:1    OpenFlow:0


得知 GE1/0/13 接口进来的流量,再次判断看是否还有其他网络设备以确定是否是主机。

Local Interface         Exptime(s) Neighbor Interface      Neighbor Device     
-------------------------------------------------------------------------------
10GE1/0/1                     101  10GE2/0/33              C05_35U_6881_MGBU01
10GE1/0/2                     116  10GE1/0/33              C05_35U_6881_MGBU01
GE1/0/18                      101  943b-b0b0-5df6          
GE1/0/20                      109  GigabitEthernet1/0/0    H3C
GE1/0/21                      114  80e4-559d-427f          
GE1/0/22                      111  542b-de51-b36c     

无该记录,主机无误。

四、机房判断

由于没有巡线仪,只能通过最简单的拔掉交换机上的口子来判断哪台主机失去网络。

最终找到了,这台干坏事的主机。

五、感谢

  1. 感谢戴老板的 lldp 命令
  2. 感谢余星星的 arp 思路
  3. 感谢共事的其他人
posted @ 2021-02-24 15:10  季文康  阅读(64)  评论(0编辑  收藏  举报