I work from home so I depend on my Internet connection to be at least consistent without much delay and downtime. As well my job is to set people up to work remotely so we are always at the mercy of the Internet Service Provider (or ISP) and with the Internet there is no guarantee of being up 24 hours a day unless you pay for a dedicated business line. Having a regular consumer Internet connection is really a “best effort” from the ISP to be available to you as a consumer.

When you do experience issues and call the ISP helpdesk it is usually a painful experience to which they will usually give you standard response to self correct your connection by “reset/repower your modem” or “disconnect and reconnect your coax cable” or ultimately, they want you to replace the modem itself. That said it is a good practice to disconnect/re-connect your modem or perform a power reset on occasion as this does seem to help keep your connection stay optimal. However, its also helps to know some trouble shooting tips before calling into support so at least you can tell them something other than “yes, I restarted my modem”

Testing Using the “Ping” command

One of the basic tools you can use to test with your computer is called the “Ping” command. This command allows you to send data from your computer to a destination to which hopefully you will receive a response. If you don’t receive a response this could be an indication there is trouble between you and the remote device.

Geeking Out – How it works.

If you want to know a little about how your router works then continue reading. Otherwise skip down to “Test Using Ping”.

In my case I am speaking about cable modems but this could apply to any Internet Provider as any Modem/Router will work in the same way. Your modem is technically a “router” and is just a piece of the puzzle when you connect to the internet. What you should also understand is that your modem/router has to talk to other routers both inside the your ISP network and outside their network to get to the webpage you are looking for. When we cannot get to a webpage, open FaceBook, or Stream NetFlix a ping test will potentially give you some insight as to where an issue may be happening beyond your modem/Router.

Your smart phone, laptop, or computer communicates with your modem/router either through a wireless (WiFi) or with a Ethernet cable connection. Once connected to the modem/router it directs or forwards the data traffic to other routers to get to your destination.

Test Using Ping

I will be describing the Ping test on a Windows based Computer. For Mac, Linux, or smart phone users I will have write a “how to” separately as Ping is not readily available to use as a test, especially in smart phones where one usually needs an “app” or is used in a different manner.

First you need to open a Command Prompt by right mouse clicking on the Start menu | Click on Run

Type the word cmd…..Click OK

First lets find out what your “default gateway” is. Your default gateway is the Modem/router from your ISP. From the black command prompt type in

IPConfig /all

As you can see there the default gateway (Modem/router) is 192.168.233.1.

The first test we will do is “Ping” the default gateway. From the same command prompt type

ping 192.168.233.1 –t (the –t means continuous as we want to keep it running)

Let the ping run. As you can see we are getting a reply with every “ping” which is a good thing. As well the time is 1 millisecond which means the response is fast with little delay. What this is telling is the computer I am on is speaking to the modem/router without any issues.

Now lets try to ping beyond our modem/router. A side note is that Ping is blocked from being used by many different ISP’s, Security teams, firewalls, routers etc. I won’t go into why but some people use ping for bad purposes. The one website I know of today that responds to pings is www.cbc.ca. But instead of doing a ping to www.cbc.ca, we will first look at all the routes along the way before we get to CBC

Open another command prompt like we did earlier. This time type the command

tracert www.cbc.ca

The result is we can see all the routers that are being used to get to www.cbc.ca including the “next hops” or the remote routers….

What we do now is ping the first Router in the path which is 70.67.160.1

type ping 70.67.160.1 -t

As we see that we are not always getting a response from the far router. This is an indication something is wrong with the connection between our modem/router and the indicated hop. In this case the connection is dropping within the ISP network.

If we let the ping run continuous and look side by side we see the packets are being lost on the left which is the far router. On the right is my connection to my default gateway and not losing any packets so we are definitely having issues beyond our modem/router.

If the first router responded without issue then continue to ping the other “hops” that were displayed in the previous screen cap. Look to see where the packets are not responding. This way the next time you call into support you can explain that you performed these tests and try to convince them it may be more that just “resetting my router” for the fix.

.\trevor

Although I consider my self a Citrix admin I continue to administer Active Directory along with my daily Citrix duties and consultant work. I have been doing this so long that it dates back to the NT 4/W2K days. How a Windows administrator approached AD security back in those days was different and seemed much simpler to manage. The Internet and Enterprise email were in it’s infancy and most security threats would come from inside your network. 

Today there is an endless daily onslaught facing every Enterprise I.T shop when it comes to security infiltration. Many companies go through incredible lengths to protect themselves, however, what is surprising is that these same companies still use methods to manage Active Directory based on the “old days”. These methods and practices (or what I call “lazy practices”) expose Enterprises who use Windows AD to great risk. I call it lazy practices as it is easier to give administrator credentials than to delegate it or plan it properly.

Even when I was heavily engaged in my MCSE exam studies back in the day I cannot recall Microsoft ever mentioning phrases such as “credential theft” or “Pass-the-hash”. If you still have not heard of this and you manage an AD domains then you really need to educate yourself. Microsoft has published a few versions of how to mitigate these threats

Here is the link to v2 of the document

https://download.microsoft.com/download/7/7/A/77ABC5BD-8320-41AF-863C-6ECFB10CB4B9/Mitigating-Pass-the-Hash-Attacks-and-Other-Credential-Theft-Version-2.pdf

What is Pass-the-Hash?

Again, I highly recommend reading and learning this document. The concept of credential theft in an Active Directory domain really means “exposing elevated user credential passwords on a compromised windows operating system”. Meaning if one logs into a compromised computer with an admin account (local administrator to that endpoint, or domain/enterprise administrator) your password is saved in memory as clear text. This gives the “bad guys” keys to unlock your domain. I am of course over simplifying the explanation but you get the point that this is not a good thing and you can see where this could go sideways in a quick way.

What are the main causes of being exposed to credential theft?

I mentioned earlier historically windows AD administrators used “lazy practices” in many IT shops and unfortunately it continues today. Examples of such practices are:

• Misuse of privileged accounts is the primary concern (using domain admin as a daily account)
• Administrator Accounts are often over-allocated
• Over use of local administrative rights on endpoints
• Non standard endpoints and procedures
• Not using AD delegation rights to it’s full potential

My main bread and butter is a Citrix administrator/consultant but all Citrix admins generally get deep involved in administering AD in some way. Look for upcoming Blogs in which I will speak to some of these points to generate some “good habits” or good practice to combat credential theft.

.\trevor