Boot Cisco router from rommon
I work with some legacy Cisco routers that will occasionally boot into rommon after a power outage or scheduled reboot. It's almost as if the router can't locate the flash memory to load the correct IOS. Luckily I have out-of-band console access so I can tell it where to find the IOS.bin:
rommon 5 > boot flash:IOS_file.bin
dump packets with tcpdump
I always forget the parameters for this and have to look them up in the man page, so enough of that:
tcpdump -nnXSs 0 host hostname (or IP)
- "-nn" makes it not lookup hostnames in DNS and service names (in /etc/services) for respectively faster and cleaner output.
- "-X" makes it print each packet in hex and ascii; that's really the useful bit for tracking headers and such
- "-S" print absolute rather than relative TCP sequence numbers - If I remember right this is so you can compare tcpdump outputs from multiple users doing this at once
- "-s 0" by default tcpdump will only capture the beginning of each packet, using 0 here will make it capture the full packets.
Cisco IOS Keyboard Shortcuts
Below the complete list of the IOS shortcuts:
Ctrl+T: Swap the current character with the one before it
Ctrl+K: Erase all characters from the current cursor position to the end of the line
Ctrl+X: Erase all characters from the current cursor position to the beginning of the line
Ctrl+L: Reprint the line
Ctrl+C: Exit configuration mode
Ctrl+A: Moves the cursor to the beginning of the current line
Ctrl+E: Moves the cursor to the end of the current line
Ctrl+F: Moves forward one character
Ctrl+B: Moves backwards one character
Ctrl+R: Redisplays a line (starts a new line, with the same command shown)
Ctrl+U: Erases a line
Ctrl+W: Erases a word
Ctrl+Z: Exits configuration mode, returning you to privileged EXEC mode
Ctrl+P (or up arrow): Displays the last command entered
Ctrl+N (or down arrow): Displays previous commands entered
Tab: Completes a partial command
Esc, F: Moves forward one word
Esc, B: Moves backwards one word
The Alteration Operator
Using egrep, the following will match all lines from the 9th, 10th, 11th, and 12th hours of Sunday April 10th in the log file eventdump.txt:
$ egrep Sun\ Apr\ 10\ \('09|10|11|12'\)\: eventdump.txt
(I always forget to escape the parenthesis.)