The command displays system commands information.
Syntax:
help
This command displays the list of all the device’s commands. It is executed automatically, if the user types an unknown command.
The command is used to review and update system parameters.
Syntax:
system [arguments]
Command arguments
Assigns new user name specified by system_name parameter. If the parameter is not specified, the current system name will be displayed.
Example,
system name revolution |
Optional character string describes the system location; used in SNMP protocol.
Example,
sys location On the Carlson’s rooftop |
Assigns a name under which the system administrator enters the router from the console or remotely, using telnet/http.
Example,
system user root |
Sets the system administrator's password.
Example,
system password qwerty |
Sets the geographical coordinates of the device (longitude, latitude).
Example,
system gpsxy 60.40056 56.82857 |
Specifies a keyword for entering a guest mode. The keyword is entered as a login, any password may be used. While in the guest mode, you cannot modify the router's configuration parameters, neither security-related parameters.
Example,
system guest for_members_only |
Replaces the prompt on the screen with the given any-word of a maximum length of 16 characters. The resulting prompt will look as "Prompt#ttyN>".
Example,
system prompt MyHost |
Instructs the unit to turn on RADIUS based authentication for accessing the management interface. To use the authentication the AAA module should be running (refer to chapter 19). Remember that the AAA authentication method has the highest priority and local login database is used only in case when the required account is not found on the RADIUS server.
If there is no local user account the management interface will be accessible with any credentials even if the AAA authentication is turned on.
Enables/disables LED status indicators on the unit case in order to mask the active device.
Enables/disables the fast routing mode. In this mode the router becomes invisible for traceroute network tracing procedures, while still performing all routing functions. It is not recommended to enable the fast routing mode simultaneously on several devices connected to the same cable Ethernet segment, because this may produce a tempest of IP packets.
Displays the duration of time elapsed since the system's last reset.
Sets the IP-address which will be used as a source IP-address in all outgoing connections of the unit.
Displays the software version.
Manages the system log operation. The optional IP_address parameter specifies the UNIX host where the system log is located to which messages are directed under the standard syslog protocol. The command has the following options:
Each unit has its unique factory access password that can be obtained via the tech-support. Once obtained this password stays the same for each factory login attempt. Setting the unit to otp mode tells it to ask for a new password each time the factory login is given (the unit will provide different sequences, that should be submitted to the tech-support in order to obtain a new password). Whenever the unit is set to single mode again, its unique factory access password is restored.
This command sets the limit to the number of out coming ICMP packets per second (0 by default, no limitation applied). It helps to avoid the device reboot while network scanning programs are working. Being set to 0 all limitations are turned off.
Enables (disables) the system to send icmp redirect messages for the packets source suppression if routing is incorrectly configured.
Enables (disables) the system to send icmp redirect messages for routing tables updating if routing is incorrectly configured.
Indicates current CPU load (in percent)
Enables/disables page splits in the console output.
This command forces all indication to blink for the one type devices search. By default, this mode turns off after 10 seconds.
Sets the reaction to appearance/disappearance of Carrier Detect (CD) signal on the diagnostics port (console).
The message of CD signal disappearance has an oid of 1.3.6.1.4.1.3942.0.103
The message of CD signal appearance has an oid of 1.3.6.1.4.1.3942.0.104
In order to send SNMP messages you need to run trapd service using trapd command (see trapd command).
The current remote log IP-address, if any, may be saved in the configuration file using the config save command.
The command is used for time zone settings manipulations. Starting from 3.36 version of firmware. Do not support automatic summer/winter time switching.
Syntax:
Example,
set TZ EST+5EDT,M4.1.0/2,M10.5.0/2 set TZ EKT+5 |
For more details on time zones please visit: http://en.wikipedia.org/wiki/Time_zone
This command is used to view, save, export, and import the router configuration.
Syntax:
config [show | save | clear]
config import | export login:password@host/file
Displays the current configuration of the system. Any change of the system parameters may be immediately viewed using the config show command. The optional parameter may contain a selection of WANFleX commands (abbreviated to their initial letters), as shown in the following examples; only those system parameters will then be displayed which relate to the commands selected.
Examples,
co show route rip |
will display parameter configuration for route command and RIP protocols.
co show r !rip |
will display parameter configuration for all commands starting with "r" except "rip".
Saves the current system configuration in the router's flash memory for subsequent permanent use. All modifications to the system parameters, if not saved by this command, are valid only during the current session (until the system reset).
Clears (resets to default) configuration in device flash. To take effect device should be rebooted without saving the configuration.
Saves the router configuration on a remote server and reloads it from a remote server. The information is transferred using FTP. The name of the file to or from which the information is transferred. The file name shall be specified in full, in the format of the remote server's file system.
Example,
config export user:secret@192.168.1.1/var/conf/test.cfg |
This command uploads a new version of software.
Syntax:
flashnet get|put login[:password]@host/file [-S src_addr]
File is the name of the file containing the information transferred. The file name shall be specified in full, in the format of the remote server's file system. Host is the IP_address of the remote FTP server.
By default, the sending interface's address is put in the "source address" field of the packets. Using the "-S" option, any other IP address (SourceAddress) may be substituted for this default address.
Example how to update the firmware from InfiNet ftp,
flashnet get ftp:ftp@ftp://91.191.225.246/pub/Firmware/H11/firmware.H11S01v1.6.6.bin |
here instead "H11S01v1.6.6" insert the latest firmware version in InfiNet ftp-server, and set:
Username: ftp
Password: ftp
The download process has two phases:
Both phases are indicated with symbol ".".
During installation process all system events should be observed in the system journal (command “sys log”). After firmware updating, restart the unit with the command "restart yes"
The command performs soft router reset.
Syntax:
restart [y]
restart SECONDS
restart stop
Full reset and re-initialization of a router. Equivalent to toggling the power switch off and on. May be used to restore initial configuration after a number of unsuccessful attempts to understand what exactly is done wrong, and after loading a new version of software. With the "y" option, RESTART command is executed immediately, without asking the operator for confirmation.
This command can be used for the postponed re-initialization (after certain number of seconds, e.g. restart 300). This option can be useful in case of dangerous manipulations with device's configuration when there is a risk to lose control over the device. The system will periodically inform the user about the time left to re-initialization by putting the corresponding message to the system log. Repeated call of this command will start the countdown from the beginning. Restart stop command will cancel a postponed re-initialization.
The command sends test packets.
Syntax:
ping IP [size|-s size_in_bytes] [count|-c count_packets] [source|-S IP]
Sends test packets (ICMP_ECHO_REQUEST) to the given IP-address. It allows estimating the attainability of a host and the destination response time. The command has the following parameters:
Example,
ping 192.168.1.1 size 20 count 7 |
Use telnet protocol to enter a remote host.
Syntax:
telnet IP-address
Sets up a connection with a remote host specified by the IP-address in the terminal emulation mode. The "telnet" command uses transparent symbols stream without any intermediate interpretation; therefore, the terminal type is defined by the terminal from which the command has been executed. To interrupt the terminal emulation session, press "Ctrl/D".
The command trace attainability of an IP-node.
Syntax:
tracert [-s SourceAddress] HostAddress
Traces the packet transmission path up to the IP node (host), specified by the "HostAddress" parameter. The command sends packets to the specified host, assigning different values to the "time to live" field in their IP headers, and analyzes "ICMP TIME_EXCEEDED" indications coming from different routers along the path to that host.
By default, the sending interface's address is put in the "source address" field of the packets. Using the "-s" option, any other IP address (SourceAddress) may be substituted for this default address.
Tracing is limited to a path with maximum 30 intermediate IP nodes. Trace packets are 36 bytes long. The trace procedure makes 3 attempts for every intermediate node.
Every trace result contains the IP-address of an intermediate node and the response time (in milliseconds) of every attempt. In addition, it may contain some special symbols corresponding to specific reply codes of the ICMP protocol:
Web-interface support module.
Syntax:
webcfg start|stop
webcfg –lang={en|ru|fr|it|cn}
This command enables/disables Web-interface support on the device. Web-interface allows easy graphical device configuration with the help of a Web-browser.
Example,
webcfg start |
Default web-interface locale can be set by using the "–lang" key with the "webcfg" command. Current locale set includes English, Russian, French, Italian and Chinese locales.
RSH (remote shell) protocol support module.
Syntax:
rshd enable | disable RemoteUSER RemoteHOST LocalUSER
rshd start | stop | flush
The built-in RSH server makes it possible remote command execution using the rsh program. Identification is based on using privileged TCP ports and a list of authorized hosts.
By default, the RSH server is disabled. To start and stop the server, the commands "rshd start" and "rshd stop" are executed. When started, the server ignores requests for command execution until at least one valid system entry is enabled.
A system entry is specified by an "rshd enable" command with three parameters:
A request for command execution is serviced only if for all three parameters it specifies the values corresponding to a valid entry.
Up to 6 independent entries may be defined.
The name of a local user is in no relation with the WANFleX main authorization system; it may be considered simply as a keyword.
To disable an entry, an "rshd disable" command is executed with parameters defining that entry.
The "rshd flush" command clears the "rsh" server configuration.
The RSH server may be conveniently used e.g. for periodic reading of a router statistics:
rsh -l mysecretuser RWR.domain.ru ipstat get |
Example,
rshd enable admin 195.38.44.1 mysecretuser rshd enable root 195.38.45.123 mysecret2 rshd start |
SSH (Secure Shell) protocol allows secure remote management of network devices. Its functionality is similar to Telnet protocol but, as opposed to Telnet, SSH encodes all protocol messages/datagrams including transmitted passwords. Moreover, SSH is a flexible protocol that allows requiring multiple forms of authentication for access and choosing different encoding algorithms.
For using SSH protocol SSH Server and SSH Client is needed. SSH Server accepts connections from client hosts (SSH Clients), performs their authentification and start serving the authorized clients. SSH Client is used for access and management of the remote device.
InfiNet Wireless devices has built-in SSH Server and SSH Client functionality.
Built-in SSH Server (SSH daemon) configuration is performed using “sshd” command.
Syntax:
sshd -window=SIZE
sshd -keepalive=TIME
sshd -banner=on | off
sshd -log-level={emerg | alert | crit | error | warning | notice | info | debug | LEVEL}
sshd -algo-list
sshd -kex-algos=ALGO-LIST
sshd -hostkey-algos=ALGO-LIST
sshd -cipher-algos=ALGO-LIST
sshd -hash-algos=ALGO-LIST
sshd -comp-algos=ALGO-LIST
sshd -auth-methods[=AUTH-METHODS-LIST]
sshd start
sshd stop
sshd newkeys
sshd pub[key] {sh[ow] | cl[ear] | de[lete] N}
sshd pub[key] {in[stall] | im[port] [LOGIN[:PASSWORD]@]HOST/FILE} [COMMENT]
By default, the SSH Server is disabled. To start/stop the server “sshd start”/ “sshd stop” commands are executed.
When first-time started SSH Server generates DSS and RSA Host Keys to be used for public key based authentication of the SSH Server. Compulsory Host Keys re-generation is possible at any time by typing “sshd newkeys” command.
When started, SSH Server accepts authorization requests from SSH Clients.
Access to the device via SSH protocol may be limited by using "$ACLOCAL" access control list. When "$ACLOCAL" list is configured on the device SSH Server rejects all connection attempts from SSH Clients with IP-address or networks that are not present in the list. More information about "$ACLOCAL" list can be achieved in Access Control Lists section of this manual.
The following SSH Server options are available for management:
Options for SSH algorithms management:
Authentication of SSH Clients
By default, SSH Clients are authorized by SSH Server after typing a valid password. However, password authentication may be not enough to provide the needed security level. InfiNet Wireless devices have several built-in SSH authentication methods that are managed by “sshd pubkey” and “sshd -auth-methods” commands.
“Sshd pubkey” command allows enabling public key based authentification of SSH Clients. In the Public key authentication mode SSH Server authorize SSH Client bypassing password login procedure. This mode is enabled automatically once a public key of the SSH Client is cached in SSH Server’s registry.
To upload SSH Client’s public key into the SSH Server registry from a remote FTP server use the following command:
sshd pubkey import [LOGIN[:PASSWORD]@]HOST/FILE [COMMENT] |
The other way to cash SSH Client’s public key in the SSH Server registry is to perform a password authentification of the SSH Client and then type the following command on the SSH Server:
sshd pubkey install [COMMENT] |
By doing this SSH Server will save a public key of the connected SSH Client. Usage of the “COMMENT” parameter here is the same as it is in the “sshd import” command described above.
To view all available authentification methods please type:
sshd -auth-methods |
To choose which of them to use:
sshd -auth-methods=AUTH-METHODS-LIST |
Where “AUTH-METHODS-LIST” is a list of authentification methods allowed for using. To enable all authentification methods you can use “all” value for “AUTH-METHODS-LIST” parameter (set by default).
Example,
The following command prohibits using password authentification allowing only “Public key” method.
sshd -auth-methods=publickey |
Built-in SSH Client configuration is performed using “sshc” command.
Syntax:
sshc [options] [LOGIN@]HOST [REMOTE-COMMAND]
To connect to the remote device (with SSH Server running on it) using SSH Client type the following command:
sshc [options] [LOGIN@]HOST [REMOTE-COMMAND] |
The following SSH Client «options» are available:
“Options” for Public key management:
sshc –pubkey-new=512 |
Options for SSH algorithms management:
For compulsory interruption of the SSH Client’s session (for example, if SSH Server is not responding to SSH Client’s requests) please use the following key sequence: <Enter>~. (on the keyboard, firstly, press «Enter» key, then «~» key, then «.» key).
Example,
sshc -C root@1.2.3.4 |
This command will try to connect SSH Client to the SSH Server located on the host with IP-address 1.2.3.4 under “root” login user name and enable compression of the data flow.
IP statistics gathering module.
Syntax:
ipstat enable [incoming|outgoing|full] [detail] [SLOTS] | disable
ipstat clear
ipstat traf [detail] [bytes | total_bytes]
ipstat fixit | fixget | fixclear
ipstat strict | -strict
ipstat add [intf] rule...
ipstat del N
ipstat rearrange [N]
The IP statistics gathering module provides for collecting information on data flows traversing the router, for further analysis and/or for accounting.
Information is accumulated in the router's RAM memory as a series of records having three fields: source address, destination address, number of bytes transferred. By default, only outgoing packets are counted, at the moment they are sent to a physical interface. One record takes 12 bytes.
The maximum number of records is specified by the “SLOTS” numeric parameter of an “ipstat enable SLOTS” command; it shall not exceed the size of memory available. By default the number of records is 1000; typically it's sufficient for recording 15 to 20 minutes of operation of a client unit.
Accumulated information is displayed on the current terminal (or rsh session) using the following commands:
If the record table in the router memory overflows, or if there is not enough memory currently available, an appropriate warning is written into the system log, and further statistical data are discarded. If the “ipstat strict” option has been specified, then at the overflow condition the transit routing is disabled, but the router still responds to any protocol.
To get the gathered statistic info remotely one can use the following commands:
The listing of statistical info provides:
The "ipstat add [ifname] rule" command makes it possible to filter packets for statistic gathering, taking into account only those packets which satisfy the rule. The syntax of the "rule" parameter is the same as defined in the "ipfw" command description.
The "ipstat del N" command deletes the N-th rule from the list of rules.
The "ipstat rearrange N" command renumbers all the ipstat rules with the given increment (default step is 1).
The "ipstat traf [detail] [bytes | total_bytes]" allows for visually inspecting statistics collection process in real time. Detail option switch on detailed ip statistics gathering including ports and protocols information. "Bytes(/total_bytes)" option sort ipstat output according to the number of transmittered bytes in the moment(/bytes transmitted for the whole period).
This is the script for the reliable device statistics receiving with "rsh" command usage:
#!/usr/bin/perl -w
for(;;)
{
my $stat;
do
{
$stat = system("rsh -t 30 -n -l root IWR_IP ips fixit >/dev/null");
if(int($stat) != 0) { sleep(5); }
} while (int($stat) != 0);
do
{
$stat = system("rsh -t 30 -n -l root IWR_IP ips fixget >stat.tmp");
if(int($stat) != 0) { sleep(5); }
} while (int($stat) != 0);
do
{
$stat = system("rsh -t 30 -n -l root IWR_IP ips fixclear >/dev/null");
if(int($stat) != 0) { sleep(5); }
} while (int($stat) != 0);
system("cat stat.tmp >>stat.txt");
sleep(300);
} |
Sflow Agent is a realization of a standard Sflow protocol agent.
Syntax:
Available commands are:
sta[rt] Start Sflow agent
sto[p] Stop Sflow agent
wi[pe] Stop Sflow agent and clean all configuration
add[instance] 'name' Add instance (default 'ipstat')
del[instance] 'name' Delete instance (default 'ipstat')
stat 'name' Show statistics for instance (default 'ipstat')
cl[earstat] 'name' Clear statistics for instance (default 'ipstat')
Available options are:
collector=IPaddress[:port] Set collector address
agent=IPaddress Set agent address (default 0.0.0.0)
maxpacket=size Set maximal datagram size (default 1500)
interval=number Set statistics recieve interval, in seconds (default 5)
datagrams=number Set datagrams per statistics interval (default 100)
rawheader={on|off} Sends original ipV4 headers (default off)
debug={on|off} Puts debug output to log (default off)
version -v Display Version
"Sflow" protocol for monitoring computer networks. It is commonly used by Internet Providers to capture traffic data in switched or routed networks. "Sflowagent" command allows configuration of Sflow agent on the device.
Command output
|
Example,
ipstat enable full detail 3000 # starting the process of gathering statisticssflow add ipstat # adding gathering component sflow -collector=1.2.3.4 start # starting process of processing the statistics |
Syntax:
acl add $NAME TYPE params...
acl del $NAME [params...]
acl ren $NAME1 $NAME2
acl flush
Possible TYPES: net num
Predefined ACL names: $ACLOCAL - Hosts (networks) permitted to configure the device.
Command description
While network planning you may often need to group similar parameters in lists which can be used for different filters (e.g. ipfw, qm, ipstat). Access control lists (ACL) can effectively solve this problem.
acl add command creates an access list of NAME title and TYPE type. Lists names MUST start with $ symbol and can include up to 7 letters, digits and other symbols excluding spaces and semicolon. At the same time the command can contain several parameters of TYPE type which will be included in the list. If the list with this name has been already created listed parameters will be attached to this list.
Accepted list types (TYPE):
Lists of net type optimize their parameters by excluding duplicates and by having the feature that enables bigger networks include smaller networks. For example, if the list contained 1.1.1.1 parameter, when you include 1.1.1.0/24 parameter in the list 1.1.1.1 will be excluded.
Example,
acl add $LIST1 net 10.0.0.0/8 192.168.0.0/16 5.5.5.5 acl del $LIST1 5.5.5.5 |
Reserved access lists:
Example,
acl add $ACLOCAL net 10.0.0.0/8 192.168.0.0/16 |
SNTP parameters management.
SNTP support developed in WANFleX lets the system to synchronize the time with configured NTP server using fourth version of SNTP protocol RFC 2030.
Client works in unicast server request mode in certain time range.
Syntax:
sntp [options] [command]
Commands are the following:
Options are the following:
Example,
sntp -interval=3600 -debug=on sntp -server=9.1.1.1 start |
Commands:
Make the process of time synchronization active.
Example,
sntp start |
Stop the process of time synchronization.
Example,
sntp stop |
Parameters:
The parameters can be set using any sequence with or without the command itself.
Using server parameter you can set the IP-address of your NTP server.
Example,
sntp -server=9.1.1.1 |
Using interval parameter one can set the time value (in seconds) defining client's periodicity of NTP server requesting. 3600 by default.
Example,
console> sntp -interval=5000 |
This parameter enables/disables printing of debugging information (packets) in the system log of WANFleX OS.
Example,
sntp -debug=on sntp -debug=off |
Date and time management.
This command shows or sets the date and time in WANFleX system. While setting the date and time not only kernel clock is being changed but hardware clock changes its value either (if the device supports this feature).
Syntax:
date [[[[[cc]yy]mm]dd]HH]MM[.ss]]
Example,
date 200402100530.04 Tue Feb 10 05:30:04 2004 |
date Tue Feb 10 05:30:10 2004 |
ERP (Emergency Repair Procedure) utility allows restoring lost system password to the device.
Syntax:
erp [options] [command]
How it works
To do Emergency Repair Procedure one needs two InfiNet Wireless devices. First device is a device which should be repaired (device “a”), second – device on which ERP utility will be run to repair the first device (device “b”). Both of the devices should be connected to the same Ethernet segment via their Ethernet interfaces. Device “b” should have no “switch local tag <х>” option configured on its Ethernet interface.
Procedure:
On the device “b” run ERP utility with “-serial <n>” option, where n – is a serial number of the device which should be repaired (device “a”)
erp –serial <n> |
Example,
erp –serial <36696> |
ERP will come to “hearing” mode waiting for device “a” to reboot.
On device “b” run the following ERP command:
erp –serial <n> -code <c> reset |
n – is a serial number of the device which should be repaired (device “a”)
c – is special ERP-code received from tech support
Login to device “a” with any non-blank username and password and issue the following command:
config save |
To change IP-address on Ethernet interface of a device “a” from device “b” without login to device “a”:
erp –serial <SERIAL> -ip <address> -mask <mask> ifup |
"aaa" module allows access control configuration on the device using remote RADIUS server.
Syntax:
aaa [options] [command]
"auth=ip[:port],secret[,identifier]" - sets parameters to access remote RADIUS server
"remove=ip[:port]" - removes information about a RADIUS server from the configuration of the unit
Whenever the debug mode is activated on a device that uses "aaa" access authentication via the remote RADIUS server, the authentication debug info is displayed on the local console to verify the settings.
The output has the following parameters:
|
This command manages operations with a license file on the device.
Syntax:
license [options]
File-name is the name of the file containing the information transferred. The file name shall be specified in full, in the format of the remote server's file system. IP-address is the IP_address of the remote server.
Examples,
li --export=ftp://ftp_login:ftp_password@192.168.145.1/license_file li --show |
Syntax:
dport BAUD
This command sets a bitrate of the console port. Available values are: 9600, 19200, 38400, 57600, 115200 Bit/sec. Default value is 38400 Bit/sec.
Syntax:
mem
This command show statistics for allocated device memory, network buffers, queues and drops on interfaces. Command output is described in the picture below.
|
Grep is a console output filtering utility. It filters a command output with lines containing a match to the given regular expression.
This command is not available on the H01/H02 platforms. |
Syntax:
grep [OPTIONS] [-e]PATTERN "command"
or
command | grep [OPTIONS] [-e]PATTERN
Grep utility searches the output of the given command for lines matching the given PATTERN and displays the result.
When used with “-e” option ("-e PATTERN" or "--regexp=PATTERN") allows searching a PATTERN that begins with dash sign (-).
To ignore case distinction between capital and lowercase letters while searching "–i" (or "--ignore-case") option is used.
To perform the invert filtering, i.e. find non-matching lines, "-v" (or "-invert-match") option is used.
To find and display only those lines that matches only the whole world (-w) or line (-x) the corresponding options are used.
To count the number of the result lines (matching or non-matching if used together with "–v" option) "–c" option is used. Result lines themselves are not displayed.
The "–m" option (-m NUM) stops search after the specified number of matching lines.
All the command output lines are index numbered starting from 1. To show the matching lines with their index numbers "–n" option is used.
The "–A NUM", "-B NUM" and "–C NUM" options are used to print the specified number (NUM) of nearby lines after, before or after and before the matching lines correspondingly. When using these options each matching line in the grep output will be printed together with the specified number of the nearby lines separated from other matching entries with a special line (---).
