Lucca's Wiki - User contributions [en]

Anti-AI Scraper Tarpits

2026-04-02T23:30:35Z

209.87.206.13:

Some website hosts are having issues with scrapers hammering their sites. Below are tools and information that they are using to combat this:

https://en.wikipedia.org/wiki/Tarpit_(networking)#Anti-AI_tarpits

https://vercel.com/blog/the-rise-of-the-ai-crawler

https://zadzmo.org/code/nepenthes/

https://anubis.techaro.lol/

Anti-AI Scraper Tarpits

2026-04-02T23:07:17Z

209.87.206.13:

Some website hosts are having issues with scrapers hammering their sites. Below are tools and information that they are using to combat this:

https://en.wikipedia.org/wiki/Tarpit_(networking)#Anti-AI_tarpits

https://zadzmo.org/code/nepenthes/

https://anubis.techaro.lol/

Anti-AI Scraper Tarpits

2026-04-02T23:07:11Z

209.87.206.13: Created page with "Some website hosts are having issues with scrapers hammering their sites. Below are tools and information that they are using to combat this: https://en.wikipedia.org/wiki/Tarpit_(networking)#Anti-AI_tarpits https://zadzmo.org/code/nepenthes/ https://anubis.techaro.lol/"

Some website hosts are having issues with scrapers hammering their sites. Below are tools and information that they are using to combat this:

https://en.wikipedia.org/wiki/Tarpit_(networking)#Anti-AI_tarpits
https://zadzmo.org/code/nepenthes/
https://anubis.techaro.lol/

Main Page

2026-04-02T23:06:28Z

209.87.206.13:

Welcome to Lucca's Knowledgebase

(use ctrl+shift+t to change theme settings)
<hr>

Windows: |
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]] | [[TLS Setting in Internet Options]]

<hr>

Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf (pdf)] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf (pdf)] | [[Perform actions based on notification content]]

<hr>

Pentesting: | [https://www.exploit-db.com/ Exploit-DB] | [[Performing a SYN flood attack]] | [https://attack.mitre.org/matrices/enterprise/ Mitre Att&ck] | [https://en.wikipedia.org/wiki/Christmas_tree_packet Christmas Tree Packet]

<hr>

MacOS: | [[OSX Commands]]

<hr>

Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]

<hr>

Python: | [[Math Operators]] | [[Python Examples|Examples]]

<hr>

Networking/Cisco: | [[Cisco Commands]] | [[Cisco Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]] | [https://en.wikipedia.org/wiki/VLAN_hopping Wikipedia - Vlan Hopping] | [[Console Port Access]] | [[Anti-AI Scraper Tarpits]]

<hr>

Robotics: | [[Nao Robot]]

<hr>

Retro Tech: |
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf (pdf)]

<hr>

Digital Archives: |
[https://archive.org archive.org] | [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes kirb.feels archive] | [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis] | [https://en.wikipedia.org/wiki/Anna's_Archive Anna's Archive]

<hr>

Open Source Intelligence: |
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]

<hr>

[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]

<hr>

Tech & Vulnerability News: | [https://lwn.net/ LWN.net] | [https://news.ycombinator.com/ Hacker News]

Main Page

2026-04-02T22:59:30Z

209.87.206.13:

Welcome to Lucca's Knowledgebase

(use ctrl+shift+t to change theme settings)
<hr>

Windows: |
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]] | [[TLS Setting in Internet Options]]

<hr>

Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf (pdf)] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf (pdf)] | [[Perform actions based on notification content]]

<hr>

Pentesting: | [https://www.exploit-db.com/ Exploit-DB] | [[Performing a SYN flood attack]] | [https://attack.mitre.org/matrices/enterprise/ Mitre Att&ck] | [https://en.wikipedia.org/wiki/Christmas_tree_packet Christmas Tree Packet]

<hr>

MacOS: | [[OSX Commands]]

<hr>

Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]

<hr>

Python: | [[Math Operators]] | [[Python Examples|Examples]]

<hr>

Networking/Cisco: | [[Cisco Commands]] | [[Cisco Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]] | [https://en.wikipedia.org/wiki/VLAN_hopping Wikipedia - Vlan Hopping] | [[Console Port Access]] | [https://en.wikipedia.org/wiki/Tarpit_(networking)#Anti-AI_tarpits Anti-Ai Scraper Tarpits]

<hr>

Robotics: | [[Nao Robot]]

<hr>

Retro Tech: |
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf (pdf)]

<hr>

Digital Archives: |
[https://archive.org archive.org] | [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes kirb.feels archive] | [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis] | [https://en.wikipedia.org/wiki/Anna's_Archive Anna's Archive]

<hr>

Open Source Intelligence: |
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]

<hr>

[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]

<hr>

Tech & Vulnerability News: | [https://lwn.net/ LWN.net] | [https://news.ycombinator.com/ Hacker News]

Main Page

2026-04-02T22:58:25Z

209.87.206.13:

Welcome to Lucca's Knowledgebase

(use ctrl+shift+t to change theme settings)
<hr>

Windows: |
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]] | [[TLS Setting in Internet Options]]

<hr>

Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf (pdf)] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf (pdf)] | [[Perform actions based on notification content]]

<hr>

Pentesting: | [https://www.exploit-db.com/ Exploit-DB] | [[Performing a SYN flood attack]] | [https://attack.mitre.org/matrices/enterprise/ Mitre Att&ck] | [https://en.wikipedia.org/wiki/Christmas_tree_packet Christmas Tree Packet]

<hr>

MacOS: | [[OSX Commands]]

<hr>

Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]

<hr>

Python: | [[Math Operators]] | [[Python Examples|Examples]]

<hr>

Networking/Cisco: | [[Cisco Commands]] | [[Cisco Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]] | [https://en.wikipedia.org/wiki/VLAN_hopping Wikipedia - Vlan Hopping] | [[Console Port Access]]

<hr>

Robotics: | [[Nao Robot]]

<hr>

Retro Tech: |
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf (pdf)]

<hr>

Digital Archives: |
[https://archive.org archive.org] | [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes kirb.feels archive] | [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis] | [https://en.wikipedia.org/wiki/Anna's_Archive Anna's Archive]

<hr>

Open Source Intelligence: |
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]

<hr>

[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]

<hr>

Tech & Vulnerability News: | [https://lwn.net/ LWN.net] | [https://news.ycombinator.com/ Hacker News]

Commands

2026-03-19T23:08:38Z

209.87.206.13:

<hr>This page includes both cmd and powershell commands, realistically, all of them should run from powershell anyway.<hr>

<hr>ipconfig<hr>

The ipconfig command is a command-line utility used to display and manage the IP address assigned to a machine. It provides information about the current TCP/IP network configuration, including the IP address, subnet mask, and default gateway for all adapters . In Windows, typing ipconfig without any parameters displays the computer's currently assigned IP, subnet mask, and default gateway addresses. Additional parameters can be used to perform various actions, such as releasing and renewing IP addresses, flushing the DNS cache, and displaying DNS information.

<code>ipconfig</code>

Displays the basic TCP/IP configuration for all adapters.

<code>ipconfig /all</code>

Displays the full TCP/IP configuration for all adapters.

<code>ipconfig /release</code>

Releases the IP address assigned to the computer.

<code>ipconfig /renew</code>

Renews the IP address assigned to the computer.

<code>ipconfig /flushdns</code>

Purges the DNS resolver cache.

<code>ipconfig /registerdns</code>

Refreshes all DHCP leases and re-registers DNS names.

<code>ipconfig /displaydns</code>

Displays the contents of the DNS cache.

<code>ipconfig /showclassid</code>

Displays the DHCP class ID for network adapters.

<code>ipconfig /setclassid</code>

Sets the DHCP class ID for network adapters.

<code>ipconfig /allcompartments</code>

Displays the full TCP/IP configuration for all adapters, including all compartments.

<code>ipconfig /release6</code>

Releases the IPv6 address assigned to the computer.

<code>ipconfig /renew6</code>

Renews the IPv6 address assigned to the computer.

<code>ipconfig /showclassid6</code>

Displays the IPv6 DHCP class ID for network adapters.

<code>ipconfig /setclassid6</code>

Sets the IPv6 DHCP class ID for network adapters.

<code>ipconfig /flushdns6</code>

Purges the IPv6 DNS resolver cache.

<hr>

USE THIS IF WINDOWS IS ACTING UP HELLA WEIRD

The <code>DISM /Online /Cleanup-Image /RestoreHealth</code> command is used to scan for corruption in the Windows image and repair any issues found. DISM stands for Deployment Image Servicing and Management, and it is a command-line tool used to service and prepare Windows images for deployment, recovery, and setup.

When you run the <code>DISM /Online /Cleanup-Image /RestoreHealth</code> command, it performs the following tasks:

Scans the Windows image for corruption and identifies any issues.
Verifies the integrity of the system file backups in the Component Store by comparing them against known good copies from the Windows Update servers.
Attempts to repair any corruption found in the Windows image by replacing the corrupted files with the known good copies.

It's important to note that running this command requires administrative privileges, and it may take some time to complete, depending on the system and the extent of the corruption.

-open cmd in admin

<code>DISM /Online /Cleanup-Image /RestoreHealth</code>

-after running DISM, run this right after, if errors are found, it will fix it, reboot pc

<code>SFC /scannow</code>

-after reboot, run CMD as admin and run again

<code>SFC /scannow</code>

<hr>

-Let's not forget the G.O.A.T., Use in Run to reset internet settings especially if you are having connecting MS app online or if Sonicwall Netextender breaks the connection

<code>RunDll32.exe InetCpl.cpl,ResetIEtoDefaults</code>
<hr>

<hr>
How to find mapped drives on cmd:

Open the Run dialog box by pressing the Windows <code>key + R.</code>

Type "cmd" and press Enter to open the Command Prompt.

Type <code>net use</code> and press Enter to see a list of all mapped network drives.

Find the drive you want to reconnect and take note of its name.

Type <code>net use <drive letter>: /delete</code> and press Enter to delete the mapping.

Type <code>net use <drive letter>: \server\share /persistent:yes</code> and press Enter to
recreate the mapping with the "persistent" option, which should keep the mapping
alive even after a disconnect.
<hr>

Create a Local user with CMD and make it into Admin, IF The username has a period in between please use the quotations.

<code>net user "user.name" password /add</code>

then

<code>net localgroup administrators "user.name" /add</code>

If you need to remove Admin creds

<code>net localgroup administrators "user.name" /delete</code>

if you need to delete the local account

<code>net user "user.name" /delete</code>

Disable builtin Administrator and Guest accounts:

<code>net user "Administrator" /active:no</code>

<code>net user "Guest" /active:no</code>

<hr>

Disable hibernation file to resolve issues with shutdown and free up some disk space.

<code>powercfg.exe /Hibernate off</code>

<hr>
Log off someone from a desktop session

List all sessions:

<code>query session</code>

Logoff the corresponding session:

<code>logoff {number}</code>

<hr>
Fix right click on Windows 11, doesn't need admin:

reg.exe add "HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" /f /ve</code>

<hr>
Fix alt key opening hamburger menu on ms edge [needs admin]:

reg add HKLM\SOFTWARE\Policies\Microsoft\Edge /v ConfigureKeyboardShortcuts /d {\"disabled\":[\"focus_settings_and_more\"]}

<hr>
Disable Widgets button on the taskbar.
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v TaskbarDa /t REG_DWORD /d 0

<hr>
Check if the Password is Expired

Get-ADUser -identity INSERTclientUSERNAMEHERE -properties PasswordLastSet, PasswordExpired, PasswordNeverExpires | ft Name, PasswordLastSet, PasswordExpired, PasswordNeverExpires
<hr>
Force the DC to sync the password

start-adsyncsynccycle -policytype delta
<hr>
Join a domain

add-computer -domainname "YourDomainName" -restart

<hr>
Getting New Teams to install when it refuses to [Needs Admin]

Add-ProvisionedAppPackage -Online -PackagePath "MSTeams-x64.msix" -SkipLicense

<hr>
List Services and their running status

Get-Service

<hr>
Set a service to autostart

Set-Service -Name {servicename} -StartupType 'Automatic'

<hr>
Start/Stop a service

Start-Service {servicename}
Stop-Service {servicename}
Restart-Service {servicename}

<hr>
Install OpenSSH-Server

<nowiki>Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0</nowiki>

<hr>
Remove all default gateways from a network adapter

Remove-NetRoute -InterfaceAlias "{get this name from Get-NetAdapter}" -DestinationPrefix 0.0.0.0/0

<hr>
Set an IP Address

Get-NetAdapter -Name '{get this name from Get-NetAdapter}' | New-NetIPAddress -IPAddress {newIP} -PrefixLength {subnet mask [cidr]}

<hr>
Allow inbound Ipv4 Pings
netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow

<hr>
Show all WiFi Passwords [CMD Only]
for /f "skip=9 tokens=1,2 delims=:" %i in ('netsh wlan show profiles') do @if "%j" NEQ "" (echo SSID: %j & netsh wlan show profiles %j key=clear | findstr "Key Content")

<hr>
Install server manager on a Non-Windows-Server OS
Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online

<hr>
Force update Group Policy (apply group policy changes)
gpupdate.exe /force

<hr>
Resize a VHD [Virtual Hard Disk]
resize-vhd -path "f:\Shares\profiledisks" -Sizebytes 30GB

<hr>
Persistently map a drive
net use /persistent:yes h: \\VBoxSvr\Win11\Documents

<hr>
Switch to compact os mode to save space
Compact.exe /CompactOS:always

<hr>
Migrate a folder from one drive to the other preserving permissions and logging everything to the D:\ drive
robocopy "C:\users\awesome.guy" "D:\users\awesome.guy" /E /COPYALL /zb /r:10 /w:10 /tee /unilog+:"D:\robocopylog.txt"

<hr>
Add a domain to the global dns search list
Set-DnsClientGlobalSetting -SuffixSearchList @("corp.mariocorp.com")

<hr>
Fix windows update not showing in the settings page (some RMM's do this by design to handle patching themselves)
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /f

<hr>
Disable Wi-Fi searching. This allows for more stable wi-fi performance at the cost of being able to see networks that pop up in realtime.
netsh wlan set autoconfig enabled=no interface="Wi-Fi"

<hr>
Enable Wi-Fi searching. This reverts the above command.
netsh wlan set autoconfig enabled=yes interface="Wi-Fi"

<hr>
Install Vim One-liner (Powershell only) (SYSTEM WIDE, NEEDS ADMIN)
mkdir vim-install; cd vim-install; $ProgressPreference = 'SilentlyContinue'; Invoke-Webrequest -UseBasicParsing https://github.com/vim/vim-win32-installer/releases/download/v9.1.0/gvim_9.1.0_x86_signed.zip -o gvim.zip; Expand-Archive -Path gvim.zip -DestinationPath .; cp .\vim\vim91\vim.exe C:\windows\system32\vim.exe

<hr>
Install Vim One-liner (Powershell only) (user only)
mkdir vim-install; cd vim-install; $ProgressPreference = 'SilentlyContinue'; Invoke-Webrequest -UseBasicParsing https://github.com/vim/vim-win32-installer/releases/download/v9.1.0/gvim_9.1.0_x86_signed.zip -o gvim.zip; Expand-Archive -Path gvim.zip -DestinationPath .; cp .\vim\vim91\vim.exe %localappdata%\Microsoft\WindowsApps\vim.exe

<hr>
Install Git One-liner
winget install --id Git.Git -e --source winget --scope user

<hr>
Set Hostname
Rename-Computer -NewName "YourNewHostname"

Run Firefox with the profile selector screen
"C:\Program Files\Mozilla Firefox\firefox.exe" --ProfileManager

<hr>
Delete all drive mappings / remove all network drives
net use * /delete

Ping with timestamp (Powershell only)
ping google.com -t | % { "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') $_" }

Infared Reciever w/ Alpine on the Bulldozer Datto

2026-03-18T18:54:49Z

209.87.206.13:

Had some issues with the bootloader after installing alpine originally, ended up using ventoy's "Local Boot" option to get into my alpine install and then manually installed grub using:
<code>grub-install</code>

<hr>
Now we need to get wifi working: [https://wiki.alpinelinux.org/wiki/NetworkManager]

<code>vim /etc/apk/repositories</code> and uncomment the community repo

We'll be needing these packages:

<code>apk add networkmanager networkmanager-wifi wpa_supplicant networkmanager-tui networkmanager-cli</code>

Networkmanager needs udev to work for wifi:

<code>setup-devd udev</code>

<hr>
Getting infared working:

Looks like alpine has some infared tools in a package called:

<code>v4l-utils</code> and <code>ir_keytable</code>

<code>ir-ctl -d /dev/lirc0 -r</code>

running this gets me data when i click ir buttons on some remotes

<hr>

Figured out LIRC, on alpine the config is in <code>/usr/etc/lirc/</code>

first we need to install it:
apk install lirc

lirc_options.conf:
# These are the default options to lircd, if installed as
# /etc/lirc/lirc_options.conf. See the lircd(8) and lircmd(8)
# manpages for info on the different options.
#
# Some tools including mode2 and irw uses values such as
# driver, device, plugindir and loglevel as fallback values
# in not defined elsewhere.
[lircd]
nodaemon = True
driver = default
device = auto
output = /var/run/lirc/lircd
pidfile = /var/run/lirc/lircd.pid
plugindir = /usr/lib/lirc/plugins
permission = 666
allow-simulate = No
repeat-max = 600
#effective-user =
#listen = [address:]port
#connect = host[:port]
#loglevel = 6
#release = true
#release_suffix = _EVUP
#logfile = ...
#driver-options = ...
[lircmd]
uinput = False
nodaemon = False
# [modinit]
# code = /usr/sbin/modprobe lirc_serial
# code1 = /usr/bin/setfacl -m g:lirc:rw /dev/uinput
# code2 = ...
# [lircd-uinput]
# add-release-events = False
# release-timeout = 200
# release-suffix = _EVUP

<hr>

Make a folder called lircd.conf.d, place this file inside: https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/infared%20project/BN59-01175B.lircd.conf

(you can get additional remote configs [https://lirc-remotes.sourceforge.net/remotes-table.html here])

lirc will detect the file automatically when it is opened

Now we need to run lirc daemon: <code>lircd</code>

below is a script that will allow you to execute bash commands based on remote presses, taking advantage of <code>irw</code>'s output:
#!/bin/bash
irw |
while
read;
do
if echo "$REPLY" | fgrep "01 KEY_0"; then echo "this is button 0"; fi
if echo "$REPLY" | fgrep "01 KEY_1"; then echo "this is button 1"; fi
if echo "$REPLY" | fgrep "01 KEY_2"; then echo "this is button 2"; fi
if echo "$REPLY" | fgrep "00 KEY_3"; then echo "this is button 3"; fi
done

Commands

2026-02-26T17:42:55Z

209.87.206.13:

<hr>This page includes both cmd and powershell commands, realistically, all of them should run from powershell anyway.<hr>

<hr>ipconfig<hr>

The ipconfig command is a command-line utility used to display and manage the IP address assigned to a machine. It provides information about the current TCP/IP network configuration, including the IP address, subnet mask, and default gateway for all adapters . In Windows, typing ipconfig without any parameters displays the computer's currently assigned IP, subnet mask, and default gateway addresses. Additional parameters can be used to perform various actions, such as releasing and renewing IP addresses, flushing the DNS cache, and displaying DNS information.

<code>ipconfig</code>

Displays the basic TCP/IP configuration for all adapters.

<code>ipconfig /all</code>

Displays the full TCP/IP configuration for all adapters.

<code>ipconfig /release</code>

Releases the IP address assigned to the computer.

<code>ipconfig /renew</code>

Renews the IP address assigned to the computer.

<code>ipconfig /flushdns</code>

Purges the DNS resolver cache.

<code>ipconfig /registerdns</code>

Refreshes all DHCP leases and re-registers DNS names.

<code>ipconfig /displaydns</code>

Displays the contents of the DNS cache.

<code>ipconfig /showclassid</code>

Displays the DHCP class ID for network adapters.

<code>ipconfig /setclassid</code>

Sets the DHCP class ID for network adapters.

<code>ipconfig /allcompartments</code>

Displays the full TCP/IP configuration for all adapters, including all compartments.

<code>ipconfig /release6</code>

Releases the IPv6 address assigned to the computer.

<code>ipconfig /renew6</code>

Renews the IPv6 address assigned to the computer.

<code>ipconfig /showclassid6</code>

Displays the IPv6 DHCP class ID for network adapters.

<code>ipconfig /setclassid6</code>

Sets the IPv6 DHCP class ID for network adapters.

<code>ipconfig /flushdns6</code>

Purges the IPv6 DNS resolver cache.

<hr>

USE THIS IF WINDOWS IS ACTING UP HELLA WEIRD

The <code>DISM /Online /Cleanup-Image /RestoreHealth</code> command is used to scan for corruption in the Windows image and repair any issues found. DISM stands for Deployment Image Servicing and Management, and it is a command-line tool used to service and prepare Windows images for deployment, recovery, and setup.

When you run the <code>DISM /Online /Cleanup-Image /RestoreHealth</code> command, it performs the following tasks:

Scans the Windows image for corruption and identifies any issues.
Verifies the integrity of the system file backups in the Component Store by comparing them against known good copies from the Windows Update servers.
Attempts to repair any corruption found in the Windows image by replacing the corrupted files with the known good copies.

It's important to note that running this command requires administrative privileges, and it may take some time to complete, depending on the system and the extent of the corruption.

-open cmd in admin

<code>DISM /Online /Cleanup-Image /RestoreHealth</code>

-after running DISM, run this right after, if errors are found, it will fix it, reboot pc

<code>SFC /scannow</code>

-after reboot, run CMD as admin and run again

<code>SFC /scannow</code>

<hr>

-Let's not forget the G.O.A.T., Use in Run to reset internet settings especially if you are having connecting MS app online or if Sonicwall Netextender breaks the connection

<code>RunDll32.exe InetCpl.cpl,ResetIEtoDefaults</code>
<hr>

<hr>
How to find mapped drives on cmd:

Open the Run dialog box by pressing the Windows <code>key + R.</code>

Type "cmd" and press Enter to open the Command Prompt.

Type <code>net use</code> and press Enter to see a list of all mapped network drives.

Find the drive you want to reconnect and take note of its name.

Type <code>net use <drive letter>: /delete</code> and press Enter to delete the mapping.

Type <code>net use <drive letter>: \server\share /persistent:yes</code> and press Enter to
recreate the mapping with the "persistent" option, which should keep the mapping
alive even after a disconnect.
<hr>

Create a Local user with CMD and make it into Admin, IF The username has a period in between please use the quotations.

<code>net user "user.name" password /add</code>

then

<code>net localgroup administrators "user.name" /add</code>

If you need to remove Admin creds

<code>net localgroup administrators "user.name" /delete</code>

if you need to delete the local account

<code>net user "user.name" /delete</code>

Disable builtin Administrator and Guest accounts:

<code>net user "Administrator" /active:no</code>

<code>net user "Guest" /active:no</code>

<hr>

Disable hibernation file to resolve issues with shutdown and free up some disk space.

<code>powercfg.exe /Hibernate off</code>

<hr>
Log off someone from a desktop session

List all sessions:

<code>query session</code>

Logoff the corresponding session:

<code>logoff {number}</code>

<hr>
Fix right click on Windows 11, doesn't need admin:

reg.exe add "HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" /f /ve</code>

<hr>
Fix alt key opening hamburger menu on ms edge [needs admin]:

reg add HKLM\SOFTWARE\Policies\Microsoft\Edge /v ConfigureKeyboardShortcuts /d {\"disabled\":[\"focus_settings_and_more\"]}

<hr>
Disable Widgets button on the taskbar.
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v TaskbarDa /t REG_DWORD /d 0

<hr>
Check if the Password is Expired

Get-ADUser -identity INSERTclientUSERNAMEHERE -properties PasswordLastSet, PasswordExpired, PasswordNeverExpires | ft Name, PasswordLastSet, PasswordExpired, PasswordNeverExpires
<hr>
Force the DC to sync the password

start-adsyncsynccycle -policytype delta
<hr>
Join a domain

add-computer -domainname "YourDomainName" -restart

<hr>
Getting New Teams to install when it refuses to [Needs Admin]

Add-ProvisionedAppPackage -Online -PackagePath "MSTeams-x64.msix" -SkipLicense

<hr>
List Services and their running status

Get-Service

<hr>
Set a service to autostart

Set-Service -Name {servicename} -StartupType 'Automatic'

<hr>
Start/Stop a service

Start-Service {servicename}
Stop-Service {servicename}
Restart-Service {servicename}

<hr>
Install OpenSSH-Server

<nowiki>Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0</nowiki>

<hr>
Remove all default gateways from a network adapter

Remove-NetRoute -InterfaceAlias "{get this name from Get-NetAdapter}" -DestinationPrefix 0.0.0.0/0

<hr>
Set an IP Address

Get-NetAdapter -Name '{get this name from Get-NetAdapter}' | New-NetIPAddress -IPAddress {newIP} -PrefixLength {subnet mask [cidr]}

<hr>
Allow inbound Ipv4 Pings
netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow

<hr>
Show all WiFi Passwords [CMD Only]
for /f "skip=9 tokens=1,2 delims=:" %i in ('netsh wlan show profiles') do @if "%j" NEQ "" (echo SSID: %j & netsh wlan show profiles %j key=clear | findstr "Key Content")

<hr>
Install server manager on a Non-Windows-Server OS
Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online

<hr>
Force update Group Policy (apply group policy changes)
gpupdate.exe /force

<hr>
Resize a VHD [Virtual Hard Disk]
resize-vhd -path "f:\Shares\profiledisks" -Sizebytes 30GB

<hr>
Persistently map a drive
net use /persistent:yes h: \\VBoxSvr\Win11\Documents

<hr>
Switch to compact os mode to save space
Compact.exe /CompactOS:always

<hr>
Migrate a folder from one drive to the other preserving permissions and logging everything to the D:\ drive
robocopy "C:\users\awesome.guy" "D:\users\awesome.guy" /E /COPYALL /zb /r:10 /w:10 /tee /unilog+:"D:\robocopylog.txt"

<hr>
Add a domain to the global dns search list
Set-DnsClientGlobalSetting -SuffixSearchList @("corp.mariocorp.com")

<hr>
Fix windows update not showing in the settings page (some RMM's do this by design to handle patching themselves)
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /f

<hr>
Disable Wi-Fi searching. This allows for more stable wi-fi performance at the cost of being able to see networks that pop up in realtime.
netsh wlan set autoconfig enabled=no interface="Wi-Fi"

<hr>
Enable Wi-Fi searching. This reverts the above command.
netsh wlan set autoconfig enabled=yes interface="Wi-Fi"

<hr>
Install Vim One-liner (Powershell only) (SYSTEM WIDE, NEEDS ADMIN)
mkdir vim-install; cd vim-install; $ProgressPreference = 'SilentlyContinue'; Invoke-Webrequest -UseBasicParsing https://github.com/vim/vim-win32-installer/releases/download/v9.1.0/gvim_9.1.0_x86_signed.zip -o gvim.zip; Expand-Archive -Path gvim.zip -DestinationPath .; cp .\vim\vim91\vim.exe C:\windows\system32\vim.exe

<hr>
Install Vim One-liner (Powershell only) (user only)
mkdir vim-install; cd vim-install; $ProgressPreference = 'SilentlyContinue'; Invoke-Webrequest -UseBasicParsing https://github.com/vim/vim-win32-installer/releases/download/v9.1.0/gvim_9.1.0_x86_signed.zip -o gvim.zip; Expand-Archive -Path gvim.zip -DestinationPath .; cp .\vim\vim91\vim.exe %localappdata%\Microsoft\WindowsApps\vim.exe

<hr>
Install Git One-liner
winget install --id Git.Git -e --source winget --scope user

<hr>
Set Hostname
Rename-Computer -NewName "YourNewHostname"

Run Firefox with the profile selector screen
"C:\Program Files\Mozilla Firefox\firefox.exe" --ProfileManager

<hr>
Delete all drive mappings / remove all network drives
net use * /delete

Ping with timestamp [powershell]
ping google.com -t | % { "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') $_" }

Cisco Commands

2026-02-25T02:10:08Z

209.87.206.13: /* Configuration Files */

= Cisco IOS Command Reference =

A quick-reference guide for common Cisco IOS commands on switches and routers.

----

== Device & System Information ==

=== Show MAC Address Table ===
<pre>
show mac address-table
</pre>

=== Show OS and Device Version ===
<pre>
show version
</pre>

=== Show Logged-in Users ===
<pre>
show users
</pre>

=== Show Files ===
<pre>
dir
dir nvram:
</pre>

----

== Configuration Files ==

=== Erase Configurations ===
erase startup-config
delete flash:vlan.dat

=== Show Configurations ===
<pre>
show running-config
show startup-config
</pre>

=== Show Interface Config ===
<pre>
show run interface g0/0
</pre>

=== Filter Running Config (grep-like) ===
<pre>
show run | include {searchterm}
show run | exclude {searchterm}
show run | begin {searchterm}
show run | section {section-name}
</pre>

=== Save Running Config ===
<pre>
copy running-config startup-config
copy run start
wr
</pre>

----

== User Privileges & Security ==

=== Enter Privileged Mode ("elevate to root") ===
<pre>
enable
</pre>

=== Set Encrypted Enable Password ===
<pre>
enable secret ThisisaSecret
</pre>

=== Encrypt Plaintext Passwords (Weak Encryption) ===
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7
<pre>
service password-encryption
</pre>

----

== Interface & Network Status ==

=== Interface IP Summary ===
<pre>
show ip interface brief
show ipv6 interface brief
</pre>

=== Interface IP Summary (filtered to only interfaces with IPs) ===
<pre>
show ip interface brief | exclude unassigned
</pre>
== VLAN & Switching ==

=== Show VLANs ===
<pre>
show vlan brief
</pre>

=== Show Interface VLAN Details ===
<pre>
show interface g0/1 switchport
</pre>

=== Show Trunk Interfaces ===
<pre>
show int trunk
</pre>

=== Clear Tables ===
<pre>
clear mac address-table
clear arp-cache
</pre>

----

== Telnet & Remote Access ==

=== Connect via Telnet ===
<pre>
connect {DeviceName}
</pre>

=== Show Hosts & Sessions ===
<pre>
show hosts
show sessions
</pre>

=== Disconnect Session ===
<pre>
disconnect {DeviceName}
</pre>

=== Suspend Active Session ===
<pre>
Ctrl+Shift+6, then x
</pre>

----

== SSH Configuration ==

=== Basic SSH Setup ===
<pre>
ip domain-name cisco.com
crypto key generate rsa
ip ssh version 2
</pre>

=== Generate RSA Keys (1-liner) ===
crypto key generate rsa general-keys modulus 1024

=== Remove RSA Keys ===
<pre>
crypto key zeroize rsa
</pre>

=== Create Local User ===
<pre>
username admin secret ccna
</pre>

=== Set Default Gateway (switch) ===
<pre>
ip default-gateway 192.168.10.1
</pre>

=== Enable SSH on VTY Lines ===
<pre>
line vty 0 15
transport input ssh
login local
exit
</pre>

----

== Global Configuration Mode ==

=== Enter Global Config ===
<pre>
configure terminal
</pre>

=== Disable DNS Lookup on Typos ===
<pre>
no ip domain-lookup
</pre>

=== Set MOTD Banner ===
<pre>
banner motd MESSAGEHERE
</pre>

=== Set Hostname ===
<pre>
hostname HOSTNAME
</pre>

----

== Line Configuration ==

=== Console Line ===
<pre>
line con 0
password itsasecret
login
</pre>

=== VTY Lines ===
<pre>
line vty 0 15
password itsasecret
login
</pre>

----

== Interface Configuration ==

=== Interface Selection ===
interface vlan 1
interface fa0/1
interface range fa0/2-3
interface range fa0/2-3,g0/1

=== Enable Interface ===
no shutdown

=== Assign IPv4 Address ===
ip address 192.168.0.1 255.255.255.0

=== Assign IPv4 Default Gateway (Switch) ===
ip default-gateway 192.168.0.254

== Interface IPv6 Configuration ==

=== Assign IPv6 Address ===
<pre>
ipv6 address 2001:DB8:CAFE:1::1/64
</pre>

=== Assign Link-Local Address ===
<pre>
ipv6 address fe80::1 link-local
</pre>

=== Remove IPv6 Addresses ===
<pre>
no ipv6 address 2001:DB8:CAFE:1::1/64
no ipv6 address
</pre>

=== IPv6 ND Other-Config Flag ===
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages.
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.

ipv6 nd other-config-flag
</pre>

----

== VLAN Configuration ==

=== Create / Configure VLAN ===
<pre>
vlan 10
name MyAwesomeVlan
</pre>

----

== Access / Trunk Switchport Configuration ==

=== Access Port ===
Configures the interface as an access port and assigns it to VLAN 10.
switchport mode access
switchport access vlan 10

=== Trunk Port ===
Configures the interface as a trunk port using 802.1Q encapsulation.
switchport trunk encapsulation dot1q
switchport mode trunk

=== Trunk Allowed VLANs ===
Specifies which VLANs are allowed to traverse the trunk link.
switchport trunk allowed vlan 10,20,33,99

=== Trunk Native VLANs ===
Sets the native VLAN for untagged traffic on the trunk.
switchport trunk native vlan 99

=== Trunk Nonegotiate ===
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.
switchport nonegotiate

== EtherChannel Configuration ==

=== Create EtherChannel (LACP Active) ===
Configures interfaces to actively negotiate EtherChannel using LACP.
interface range g0/1 - 2
channel-group 1 mode active

=== Create EtherChannel (LACP Passive) ===
Configures interfaces to respond to LACP negotiation.
interface range g0/1 - 2
channel-group 1 mode passive

=== Create EtherChannel (On Mode) ===
Forces EtherChannel without negotiation protocol.
interface range g0/1 - 2
channel-group 1 mode on

=== Configure Port-Channel as Access Port ===
Applies access configuration to the logical Port-Channel interface.
interface port-channel 1
switchport mode access
switchport access vlan 10

=== Configure Port-Channel as Trunk ===
Applies trunk configuration to the logical Port-Channel interface.
interface port-channel 1
switchport trunk encapsulation dot1q
switchport mode trunk

=== Verify EtherChannel ===
Displays EtherChannel status and summary information.
show etherchannel summary

=== Verify Port-Channel Interface ===
Displays detailed information about the Port-Channel interface.
show interfaces port-channel 1

== DHCP ==

=== Configure a DHCP Server on a Cisco Router ===
Assigns IP addresses automatically to clients on a network.

<pre>
ip dhcp excluded-address 192.168.1.1 192.168.1.10
! Exclude addresses that should not be assigned dynamically

ip dhcp pool LAN_POOL
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 8.8.8.8 8.8.4.4
lease 7
</pre>

* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers).
* ''network'': Defines the subnet for DHCP clients.
* ''default-router'': Sets the gateway IP for clients.
* ''dns-server'': Specifies DNS servers for clients.
* ''lease'': Duration the IP is valid (in days).

=== Configure DHCP Relay (IP Helper) ===
Forwards DHCP requests from clients to a remote DHCP server.

<pre>
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip helper-address 192.168.2.100
</pre>

* ''ip helper-address'': IP of the DHCP server to forward requests to.
* Needed when the server is on a different subnet.

=== Verify DHCP Status ===
<pre>
show ip dhcp binding ! Shows assigned IP addresses
show ip dhcp pool ! Shows pool usage and statistics
show running-config ! Check DHCP configuration
</pre>

=== Best Practices ===
* Exclude static IP addresses from DHCP pools.
* Use ''DHCP relay'' when clients and server are on different subnets.
* Monitor DHCP bindings to prevent IP conflicts.

== Spanning Tree ==

=== Enable PortFast on an interface ===
Use PortFast on edge/access ports that connect to end devices.

interface GigabitEthernet0/1
spanning-tree portfast

=== Enable PortFast globally ===
Enables PortFast on all access ports.

spanning-tree portfast default

=== Enable PortFast on a trunk (use with caution) ===
Only use when the trunk connects to a single end device (not another switch).

interface GigabitEthernet0/1
spanning-tree portfast trunk

=== Verify PortFast status ===

show spanning-tree interface GigabitEthernet0/1 detail

=== Disable PortFast on an interface ===

interface GigabitEthernet0/1
no spanning-tree portfast

=== Best Practice: Enable BPDU Guard with PortFast ===
Shuts down the port if a BPDU is received, protecting against loops.

Per interface:
interface GigabitEthernet0/1
spanning-tree portfast
spanning-tree bpduguard enable

Globally:
spanning-tree portfast default
spanning-tree bpduguard default

=== Set the Root Bridge ===
The root bridge is the central switch in the spanning tree topology. It is chosen based on the lowest bridge priority. A lower priority value increases the likelihood of a switch becoming the root bridge.

Set priority to influence root bridge selection:
* The default priority value is **32768** for all switches.
* Priority is set in increments of **4096**, and this value is added to the VLAN ID (e.g., for VLAN 1, the default bridge priority would be 32768).

To influence the root bridge selection, change the priority value:
interface GigabitEthernet0/1
spanning-tree vlan 1 priority 4096
(Sets a lower priority value, increasing the likelihood of this switch becoming the root bridge for VLAN 1)

Set the root bridge for a specific VLAN:
* To make the current switch the root bridge:
spanning-tree vlan 1 root primary
(This automatically sets the priority lower than the default value, typically to 24576, to ensure this switch becomes the root bridge)

* To make the current switch the backup root bridge:
spanning-tree vlan 1 root secondary
(This sets the priority higher than the primary root, typically to 28672, making it the backup root bridge)

Alternatively, manually set the root bridge priority:
interface GigabitEthernet0/1
spanning-tree vlan 1 priority 24576
(Sets this switch with a higher priority, making it more likely to become the root bridge)

=== Verify Root Bridge ===

show spanning-tree vlan 1
(Shows the current root bridge and its priority, along with other STP details)

=== Notes ===
* Do '''not''' enable PortFast on ports connected to other switches (this can cause network loops).
* PortFast should only be used on access/edge ports that connect to end devices like PCs, printers, or phones.
* Incorrect use of PortFast can cause Layer 2 loops.
* The default priority value is **32768**, and it is adjusted in increments of **4096**.
* Lower priority values increase the likelihood of becoming the root bridge.
* The priority value combined with the MAC address (if priorities are equal) is used to determine the root bridge.

== DHCP Snooping ==

=== Enable DHCP Snooping globally ===
Enable DHCP Snooping for the switch.

ip dhcp snooping

=== Enable DHCP Snooping on a VLAN ===
DHCP Snooping only operates on specified VLANs.

ip dhcp snooping vlan 10
ip dhcp snooping vlan 20

=== Configure trusted interfaces ===
Mark uplinks or ports connected to legitimate DHCP servers as trusted.

interface GigabitEthernet0/1
ip dhcp snooping trust

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. DHCP server responses are blocked.

interface GigabitEthernet0/2
no ip dhcp snooping trust

=== Configure DHCP Snooping rate limiting ===
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.

interface GigabitEthernet0/2
ip dhcp snooping limit rate 15

=== Verify DHCP Snooping status ===

show ip dhcp snooping
show ip dhcp snooping binding

=== Disable DHCP Snooping ===

no ip dhcp snooping
no ip dhcp snooping vlan 10

=== Notes ===
* Only trusted ports can send DHCP server messages
* Access ports should remain untrusted
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''
* Requires correct VLAN configuration to function properly

== Dynamic ARP Inspection (DAI) ==
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.

=== Enable DAI globally ===
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).

ip arp inspection

=== Enable DAI on a VLAN ===
Specify which VLANs should be protected.

ip arp inspection vlan 10
ip arp inspection vlan 20
ip arp inspection vlan 10,20 (alternative: range)

=== Configure trusted interfaces ===
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.

interface GigabitEthernet0/1
ip arp inspection trust

Trusted ports forward ARP packets without validation.

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. Invalid ARP packets are dropped.

interface GigabitEthernet0/2
no ip arp inspection trust (optional; this is the default)

=== Configure ARP rate limiting ===
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).

interface GigabitEthernet0/2
ip arp inspection limit rate 15 (example: 15 packets per second)
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)

=== Additional Validation Checks ===
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).

ip arp inspection validate src-mac
ip arp inspection validate src-mac dst-mac ip (common: enable all three)

Options:
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.

Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.

To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code>

=== Verify DAI status ===
show ip arp inspection
show ip arp inspection vlan 10
show ip arp inspection interfaces
show ip arp inspection statistics (shows drops, rate limit violations)
show ip arp inspection log (logs of dropped packets)

=== Disable DAI ===
no ip arp inspection
no ip arp inspection vlan 10

=== Notes ===
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).
* Access ports should remain '''untrusted''' to enforce checks.
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.
* DAI is ingress-only (checks incoming packets on untrusted ports).

== Port Security ==

=== View status of port security on an interface ===
show port-security interface f0/1

=== Activate Port Security on an interface ===
The port cannot be a dynamic port:
switchport mode access
Enable Port Security
switchport port-security

=== Set the maximum number of mac addresses that can be used on that port ===
switchport port-security maximum 1

=== Whitelist a specific mac address ===
switchport port-security mac-address 0001.6311.E7BC

=== Enable sticky mode to automatically learn mac addresses ===
switchport port-security mac-address sticky

=== Port Security Violation Modes ===
==== Protect ====
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.
switchport port-security violation protect

==== Restrict ====
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.
switchport port-security violation restrict

==== Shutdown ====
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.
switchport port-security violation shutdown

=== Port Security Aging ===
==== Enable static aging on an interface ====
switchport port-security aging static

==== Enable timed aging on an interface (5 minutes) ====
switchport port-security aging time 5

= Routing =

Routing is the process of forwarding packets between different networks using routing tables and routing protocols.

=== Enable IP Routing (Layer 3 Switch) ===
Required on multilayer switches to allow routing between VLANs.

ip routing

=== Enable IPv6 Routing (Routers) ===

ipv6 unicast-routing

== Static Routing ==

=== Configure a Static Route ===
Manually define a path to a remote network. Here's an example using the default administrative distance value.

ip route 192.168.2.0 255.255.255.0 192.168.1.1

Manually define a path to a remote network and specify the administrative distance.

ip route 192.168.2.0 255.255.255.0 192.168.1.1 10

Format:

ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative-distance (optional)>

=== Configure a Fully Specified Static Route ===
A fully specified static route includes both the next-hop IP address and the exit interface. This is commonly used on multi-access networks.

Example:

ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1

You can also specify the administrative distance:

ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1 10

Format:

ip route <destination-network> <subnet-mask> <exit-interface> <next-hop-ip> <administrative-distance (optional)>

=== Configure a Default Route / Default Gateway ===
Route used when no specific route matches the destination.

ip route 0.0.0.0 0.0.0.0 192.168.1.1

ipv6 route ::/0 2001:ABC:33:44::1

== Administrative Distance ==

Determines which route is preferred when multiple routes to the same destination exist.

Common values:
Connected – 0
Static – 1
EIGRP – 90
OSPF – 110
RIP – 120

Chart pulled from https://en.wikipedia.org/wiki/Administrative_distance#Default_administrative_distances
{| class="wikitable" style="text-align:center"
! Routing protocol !! Administrative distance
|-
| Directly connected interface || 0 (Only the interface itself has an administrative distance of 0, since a route cannot have a distance of less than 1.)
|-
| Static route || 1
|-
| Dynamic Mobile Network Routing (DMNR) || 3
|-
| EIGRP summary route || 5
|-
| External BGP || 20
|-
| EIGRP internal route || 90
|-
| IGRP || 100
|-
| Open Shortest Path First (OSPF) || 110
|-
| Intermediate System to Intermediate System (IS-IS) || 115
|-
| Routing Information Protocol (RIP) || 120
|-
| Exterior Gateway Protocol (EGP) || 140
|-
| On Demand Routing (ODR) || 160
|-
| EIGRP external route || 170
|-
| Internal BGP || 200
|-
| Next Hop Resolution Protocol (NHRP) || 250
|-
| Default static route learned via DHCP || 254
|-
| Unknown and unused || 255 (An administrative distance of 255 causes the router to remove the route from the routing table and not use it.)
|}

== Dynamic Routing ==

Dynamic routing protocols automatically exchange routing information between routers.

=== Configure RIP v2 ===
Uses hop count as metric (maximum 15 hops).

router rip
version 2
no auto-summary
network 192.168.1.0

=== Configure EIGRP ===
Uses bandwidth and delay as composite metric.

router eigrp 100
no auto-summary
network 192.168.1.0 0.0.0.255

=== Configure OSPF ===
Link-state protocol using cost as metric.

router ospf 1
network 192.168.1.0 0.0.0.255 area 0

== Route Summarization ==

Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.

Example networks:
192.168.0.0/24
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24

Can be summarized as:
192.168.0.0/22

=== Configure Manual Summarization (EIGRP) ===
Applied on the outgoing interface.

interface GigabitEthernet0/0
ip summary-address eigrp 100 192.168.0.0 255.255.252.0

=== Configure Manual Summarization (OSPF ABR) ===
Configured under the OSPF process (on an ABR).

router ospf 1
area 0 range 192.168.0.0 255.255.252.0

== Show Routing Information ==

=== View Routing Table ===

show ip route

=== View Specific Route ===

show ip route 192.168.1.0

=== View Routing Protocol Information ===

show ip protocols

Cisco Commands

2026-02-25T01:52:15Z

209.87.206.13: /* Spanning Tree */

= Cisco IOS Command Reference =

A quick-reference guide for common Cisco IOS commands on switches and routers.

----

== Device & System Information ==

=== Show MAC Address Table ===
<pre>
show mac address-table
</pre>

=== Show OS and Device Version ===
<pre>
show version
</pre>

=== Show Logged-in Users ===
<pre>
show users
</pre>

=== Show Files ===
<pre>
dir
dir nvram:
</pre>

----

== Configuration Files ==

=== Show Configurations ===
<pre>
show running-config
show startup-config
</pre>

=== Show Interface Config ===
<pre>
show run interface g0/0
</pre>

=== Filter Running Config (grep-like) ===
<pre>
show run | include {searchterm}
show run | exclude {searchterm}
show run | begin {searchterm}
show run | section {section-name}
</pre>

=== Save Running Config ===
<pre>
copy running-config startup-config
copy run start
wr
</pre>

----

== User Privileges & Security ==

=== Enter Privileged Mode ("elevate to root") ===
<pre>
enable
</pre>

=== Set Encrypted Enable Password ===
<pre>
enable secret ThisisaSecret
</pre>

=== Encrypt Plaintext Passwords (Weak Encryption) ===
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7
<pre>
service password-encryption
</pre>

----

== Interface & Network Status ==

=== Interface IP Summary ===
<pre>
show ip interface brief
show ipv6 interface brief
</pre>

=== Interface IP Summary (filtered to only interfaces with IPs) ===
<pre>
show ip interface brief | exclude unassigned
</pre>
== VLAN & Switching ==

=== Show VLANs ===
<pre>
show vlan brief
</pre>

=== Show Interface VLAN Details ===
<pre>
show interface g0/1 switchport
</pre>

=== Show Trunk Interfaces ===
<pre>
show int trunk
</pre>

=== Clear Tables ===
<pre>
clear mac address-table
clear arp-cache
</pre>

----

== Telnet & Remote Access ==

=== Connect via Telnet ===
<pre>
connect {DeviceName}
</pre>

=== Show Hosts & Sessions ===
<pre>
show hosts
show sessions
</pre>

=== Disconnect Session ===
<pre>
disconnect {DeviceName}
</pre>

=== Suspend Active Session ===
<pre>
Ctrl+Shift+6, then x
</pre>

----

== SSH Configuration ==

=== Basic SSH Setup ===
<pre>
ip domain-name cisco.com
crypto key generate rsa
ip ssh version 2
</pre>

=== Generate RSA Keys (1-liner) ===
crypto key generate rsa general-keys modulus 1024

=== Remove RSA Keys ===
<pre>
crypto key zeroize rsa
</pre>

=== Create Local User ===
<pre>
username admin secret ccna
</pre>

=== Set Default Gateway (switch) ===
<pre>
ip default-gateway 192.168.10.1
</pre>

=== Enable SSH on VTY Lines ===
<pre>
line vty 0 15
transport input ssh
login local
exit
</pre>

----

== Global Configuration Mode ==

=== Enter Global Config ===
<pre>
configure terminal
</pre>

=== Disable DNS Lookup on Typos ===
<pre>
no ip domain-lookup
</pre>

=== Set MOTD Banner ===
<pre>
banner motd MESSAGEHERE
</pre>

=== Set Hostname ===
<pre>
hostname HOSTNAME
</pre>

----

== Line Configuration ==

=== Console Line ===
<pre>
line con 0
password itsasecret
login
</pre>

=== VTY Lines ===
<pre>
line vty 0 15
password itsasecret
login
</pre>

----

== Interface Configuration ==

=== Interface Selection ===
interface vlan 1
interface fa0/1
interface range fa0/2-3
interface range fa0/2-3,g0/1

=== Enable Interface ===
no shutdown

=== Assign IPv4 Address ===
ip address 192.168.0.1 255.255.255.0

=== Assign IPv4 Default Gateway (Switch) ===
ip default-gateway 192.168.0.254

== Interface IPv6 Configuration ==

=== Assign IPv6 Address ===
<pre>
ipv6 address 2001:DB8:CAFE:1::1/64
</pre>

=== Assign Link-Local Address ===
<pre>
ipv6 address fe80::1 link-local
</pre>

=== Remove IPv6 Addresses ===
<pre>
no ipv6 address 2001:DB8:CAFE:1::1/64
no ipv6 address
</pre>

=== IPv6 ND Other-Config Flag ===
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages.
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.

ipv6 nd other-config-flag
</pre>

----

== VLAN Configuration ==

=== Create / Configure VLAN ===
<pre>
vlan 10
name MyAwesomeVlan
</pre>

----

== Access / Trunk Switchport Configuration ==

=== Access Port ===
Configures the interface as an access port and assigns it to VLAN 10.
switchport mode access
switchport access vlan 10

=== Trunk Port ===
Configures the interface as a trunk port using 802.1Q encapsulation.
switchport trunk encapsulation dot1q
switchport mode trunk

=== Trunk Allowed VLANs ===
Specifies which VLANs are allowed to traverse the trunk link.
switchport trunk allowed vlan 10,20,33,99

=== Trunk Native VLANs ===
Sets the native VLAN for untagged traffic on the trunk.
switchport trunk native vlan 99

=== Trunk Nonegotiate ===
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.
switchport nonegotiate

== EtherChannel Configuration ==

=== Create EtherChannel (LACP Active) ===
Configures interfaces to actively negotiate EtherChannel using LACP.
interface range g0/1 - 2
channel-group 1 mode active

=== Create EtherChannel (LACP Passive) ===
Configures interfaces to respond to LACP negotiation.
interface range g0/1 - 2
channel-group 1 mode passive

=== Create EtherChannel (On Mode) ===
Forces EtherChannel without negotiation protocol.
interface range g0/1 - 2
channel-group 1 mode on

=== Configure Port-Channel as Access Port ===
Applies access configuration to the logical Port-Channel interface.
interface port-channel 1
switchport mode access
switchport access vlan 10

=== Configure Port-Channel as Trunk ===
Applies trunk configuration to the logical Port-Channel interface.
interface port-channel 1
switchport trunk encapsulation dot1q
switchport mode trunk

=== Verify EtherChannel ===
Displays EtherChannel status and summary information.
show etherchannel summary

=== Verify Port-Channel Interface ===
Displays detailed information about the Port-Channel interface.
show interfaces port-channel 1

== DHCP ==

=== Configure a DHCP Server on a Cisco Router ===
Assigns IP addresses automatically to clients on a network.

<pre>
ip dhcp excluded-address 192.168.1.1 192.168.1.10
! Exclude addresses that should not be assigned dynamically

ip dhcp pool LAN_POOL
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 8.8.8.8 8.8.4.4
lease 7
</pre>

* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers).
* ''network'': Defines the subnet for DHCP clients.
* ''default-router'': Sets the gateway IP for clients.
* ''dns-server'': Specifies DNS servers for clients.
* ''lease'': Duration the IP is valid (in days).

=== Configure DHCP Relay (IP Helper) ===
Forwards DHCP requests from clients to a remote DHCP server.

<pre>
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip helper-address 192.168.2.100
</pre>

* ''ip helper-address'': IP of the DHCP server to forward requests to.
* Needed when the server is on a different subnet.

=== Verify DHCP Status ===
<pre>
show ip dhcp binding ! Shows assigned IP addresses
show ip dhcp pool ! Shows pool usage and statistics
show running-config ! Check DHCP configuration
</pre>

=== Best Practices ===
* Exclude static IP addresses from DHCP pools.
* Use ''DHCP relay'' when clients and server are on different subnets.
* Monitor DHCP bindings to prevent IP conflicts.

== Spanning Tree ==

=== Enable PortFast on an interface ===
Use PortFast on edge/access ports that connect to end devices.

interface GigabitEthernet0/1
spanning-tree portfast

=== Enable PortFast globally ===
Enables PortFast on all access ports.

spanning-tree portfast default

=== Enable PortFast on a trunk (use with caution) ===
Only use when the trunk connects to a single end device (not another switch).

interface GigabitEthernet0/1
spanning-tree portfast trunk

=== Verify PortFast status ===

show spanning-tree interface GigabitEthernet0/1 detail

=== Disable PortFast on an interface ===

interface GigabitEthernet0/1
no spanning-tree portfast

=== Best Practice: Enable BPDU Guard with PortFast ===
Shuts down the port if a BPDU is received, protecting against loops.

Per interface:
interface GigabitEthernet0/1
spanning-tree portfast
spanning-tree bpduguard enable

Globally:
spanning-tree portfast default
spanning-tree bpduguard default

=== Set the Root Bridge ===
The root bridge is the central switch in the spanning tree topology. It is chosen based on the lowest bridge priority. A lower priority value increases the likelihood of a switch becoming the root bridge.

Set priority to influence root bridge selection:
* The default priority value is **32768** for all switches.
* Priority is set in increments of **4096**, and this value is added to the VLAN ID (e.g., for VLAN 1, the default bridge priority would be 32768).

To influence the root bridge selection, change the priority value:
interface GigabitEthernet0/1
spanning-tree vlan 1 priority 4096
(Sets a lower priority value, increasing the likelihood of this switch becoming the root bridge for VLAN 1)

Set the root bridge for a specific VLAN:
* To make the current switch the root bridge:
spanning-tree vlan 1 root primary
(This automatically sets the priority lower than the default value, typically to 24576, to ensure this switch becomes the root bridge)

* To make the current switch the backup root bridge:
spanning-tree vlan 1 root secondary
(This sets the priority higher than the primary root, typically to 28672, making it the backup root bridge)

Alternatively, manually set the root bridge priority:
interface GigabitEthernet0/1
spanning-tree vlan 1 priority 24576
(Sets this switch with a higher priority, making it more likely to become the root bridge)

=== Verify Root Bridge ===

show spanning-tree vlan 1
(Shows the current root bridge and its priority, along with other STP details)

=== Notes ===
* Do '''not''' enable PortFast on ports connected to other switches (this can cause network loops).
* PortFast should only be used on access/edge ports that connect to end devices like PCs, printers, or phones.
* Incorrect use of PortFast can cause Layer 2 loops.
* The default priority value is **32768**, and it is adjusted in increments of **4096**.
* Lower priority values increase the likelihood of becoming the root bridge.
* The priority value combined with the MAC address (if priorities are equal) is used to determine the root bridge.

== DHCP Snooping ==

=== Enable DHCP Snooping globally ===
Enable DHCP Snooping for the switch.

ip dhcp snooping

=== Enable DHCP Snooping on a VLAN ===
DHCP Snooping only operates on specified VLANs.

ip dhcp snooping vlan 10
ip dhcp snooping vlan 20

=== Configure trusted interfaces ===
Mark uplinks or ports connected to legitimate DHCP servers as trusted.

interface GigabitEthernet0/1
ip dhcp snooping trust

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. DHCP server responses are blocked.

interface GigabitEthernet0/2
no ip dhcp snooping trust

=== Configure DHCP Snooping rate limiting ===
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.

interface GigabitEthernet0/2
ip dhcp snooping limit rate 15

=== Verify DHCP Snooping status ===

show ip dhcp snooping
show ip dhcp snooping binding

=== Disable DHCP Snooping ===

no ip dhcp snooping
no ip dhcp snooping vlan 10

=== Notes ===
* Only trusted ports can send DHCP server messages
* Access ports should remain untrusted
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''
* Requires correct VLAN configuration to function properly

== Dynamic ARP Inspection (DAI) ==
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.

=== Enable DAI globally ===
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).

ip arp inspection

=== Enable DAI on a VLAN ===
Specify which VLANs should be protected.

ip arp inspection vlan 10
ip arp inspection vlan 20
ip arp inspection vlan 10,20 (alternative: range)

=== Configure trusted interfaces ===
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.

interface GigabitEthernet0/1
ip arp inspection trust

Trusted ports forward ARP packets without validation.

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. Invalid ARP packets are dropped.

interface GigabitEthernet0/2
no ip arp inspection trust (optional; this is the default)

=== Configure ARP rate limiting ===
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).

interface GigabitEthernet0/2
ip arp inspection limit rate 15 (example: 15 packets per second)
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)

=== Additional Validation Checks ===
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).

ip arp inspection validate src-mac
ip arp inspection validate src-mac dst-mac ip (common: enable all three)

Options:
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.

Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.

To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code>

=== Verify DAI status ===
show ip arp inspection
show ip arp inspection vlan 10
show ip arp inspection interfaces
show ip arp inspection statistics (shows drops, rate limit violations)
show ip arp inspection log (logs of dropped packets)

=== Disable DAI ===
no ip arp inspection
no ip arp inspection vlan 10

=== Notes ===
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).
* Access ports should remain '''untrusted''' to enforce checks.
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.
* DAI is ingress-only (checks incoming packets on untrusted ports).

== Port Security ==

=== View status of port security on an interface ===
show port-security interface f0/1

=== Activate Port Security on an interface ===
The port cannot be a dynamic port:
switchport mode access
Enable Port Security
switchport port-security

=== Set the maximum number of mac addresses that can be used on that port ===
switchport port-security maximum 1

=== Whitelist a specific mac address ===
switchport port-security mac-address 0001.6311.E7BC

=== Enable sticky mode to automatically learn mac addresses ===
switchport port-security mac-address sticky

=== Port Security Violation Modes ===
==== Protect ====
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.
switchport port-security violation protect

==== Restrict ====
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.
switchport port-security violation restrict

==== Shutdown ====
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.
switchport port-security violation shutdown

=== Port Security Aging ===
==== Enable static aging on an interface ====
switchport port-security aging static

==== Enable timed aging on an interface (5 minutes) ====
switchport port-security aging time 5

= Routing =

Routing is the process of forwarding packets between different networks using routing tables and routing protocols.

=== Enable IP Routing (Layer 3 Switch) ===
Required on multilayer switches to allow routing between VLANs.

ip routing

=== Enable IPv6 Routing (Routers) ===

ipv6 unicast-routing

== Static Routing ==

=== Configure a Static Route ===
Manually define a path to a remote network. Here's an example using the default administrative distance value.

ip route 192.168.2.0 255.255.255.0 192.168.1.1

Manually define a path to a remote network and specify the administrative distance.

ip route 192.168.2.0 255.255.255.0 192.168.1.1 10

Format:

ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative-distance (optional)>

=== Configure a Fully Specified Static Route ===
A fully specified static route includes both the next-hop IP address and the exit interface. This is commonly used on multi-access networks.

Example:

ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1

You can also specify the administrative distance:

ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1 10

Format:

ip route <destination-network> <subnet-mask> <exit-interface> <next-hop-ip> <administrative-distance (optional)>

=== Configure a Default Route / Default Gateway ===
Route used when no specific route matches the destination.

ip route 0.0.0.0 0.0.0.0 192.168.1.1

ipv6 route ::/0 2001:ABC:33:44::1

== Administrative Distance ==

Determines which route is preferred when multiple routes to the same destination exist.

Common values:
Connected – 0
Static – 1
EIGRP – 90
OSPF – 110
RIP – 120

Chart pulled from https://en.wikipedia.org/wiki/Administrative_distance#Default_administrative_distances
{| class="wikitable" style="text-align:center"
! Routing protocol !! Administrative distance
|-
| Directly connected interface || 0 (Only the interface itself has an administrative distance of 0, since a route cannot have a distance of less than 1.)
|-
| Static route || 1
|-
| Dynamic Mobile Network Routing (DMNR) || 3
|-
| EIGRP summary route || 5
|-
| External BGP || 20
|-
| EIGRP internal route || 90
|-
| IGRP || 100
|-
| Open Shortest Path First (OSPF) || 110
|-
| Intermediate System to Intermediate System (IS-IS) || 115
|-
| Routing Information Protocol (RIP) || 120
|-
| Exterior Gateway Protocol (EGP) || 140
|-
| On Demand Routing (ODR) || 160
|-
| EIGRP external route || 170
|-
| Internal BGP || 200
|-
| Next Hop Resolution Protocol (NHRP) || 250
|-
| Default static route learned via DHCP || 254
|-
| Unknown and unused || 255 (An administrative distance of 255 causes the router to remove the route from the routing table and not use it.)
|}

== Dynamic Routing ==

Dynamic routing protocols automatically exchange routing information between routers.

=== Configure RIP v2 ===
Uses hop count as metric (maximum 15 hops).

router rip
version 2
no auto-summary
network 192.168.1.0

=== Configure EIGRP ===
Uses bandwidth and delay as composite metric.

router eigrp 100
no auto-summary
network 192.168.1.0 0.0.0.255

=== Configure OSPF ===
Link-state protocol using cost as metric.

router ospf 1
network 192.168.1.0 0.0.0.255 area 0

== Route Summarization ==

Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.

Example networks:
192.168.0.0/24
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24

Can be summarized as:
192.168.0.0/22

=== Configure Manual Summarization (EIGRP) ===
Applied on the outgoing interface.

interface GigabitEthernet0/0
ip summary-address eigrp 100 192.168.0.0 255.255.252.0

=== Configure Manual Summarization (OSPF ABR) ===
Configured under the OSPF process (on an ABR).

router ospf 1
area 0 range 192.168.0.0 255.255.252.0

== Show Routing Information ==

=== View Routing Table ===

show ip route

=== View Specific Route ===

show ip route 192.168.1.0

=== View Routing Protocol Information ===

show ip protocols

Cisco Commands

2026-02-25T01:50:58Z

209.87.206.13: /* Spanning Tree */

= Cisco IOS Command Reference =

A quick-reference guide for common Cisco IOS commands on switches and routers.

----

== Device & System Information ==

=== Show MAC Address Table ===
<pre>
show mac address-table
</pre>

=== Show OS and Device Version ===
<pre>
show version
</pre>

=== Show Logged-in Users ===
<pre>
show users
</pre>

=== Show Files ===
<pre>
dir
dir nvram:
</pre>

----

== Configuration Files ==

=== Show Configurations ===
<pre>
show running-config
show startup-config
</pre>

=== Show Interface Config ===
<pre>
show run interface g0/0
</pre>

=== Filter Running Config (grep-like) ===
<pre>
show run | include {searchterm}
show run | exclude {searchterm}
show run | begin {searchterm}
show run | section {section-name}
</pre>

=== Save Running Config ===
<pre>
copy running-config startup-config
copy run start
wr
</pre>

----

== User Privileges & Security ==

=== Enter Privileged Mode ("elevate to root") ===
<pre>
enable
</pre>

=== Set Encrypted Enable Password ===
<pre>
enable secret ThisisaSecret
</pre>

=== Encrypt Plaintext Passwords (Weak Encryption) ===
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7
<pre>
service password-encryption
</pre>

----

== Interface & Network Status ==

=== Interface IP Summary ===
<pre>
show ip interface brief
show ipv6 interface brief
</pre>

=== Interface IP Summary (filtered to only interfaces with IPs) ===
<pre>
show ip interface brief | exclude unassigned
</pre>
== VLAN & Switching ==

=== Show VLANs ===
<pre>
show vlan brief
</pre>

=== Show Interface VLAN Details ===
<pre>
show interface g0/1 switchport
</pre>

=== Show Trunk Interfaces ===
<pre>
show int trunk
</pre>

=== Clear Tables ===
<pre>
clear mac address-table
clear arp-cache
</pre>

----

== Telnet & Remote Access ==

=== Connect via Telnet ===
<pre>
connect {DeviceName}
</pre>

=== Show Hosts & Sessions ===
<pre>
show hosts
show sessions
</pre>

=== Disconnect Session ===
<pre>
disconnect {DeviceName}
</pre>

=== Suspend Active Session ===
<pre>
Ctrl+Shift+6, then x
</pre>

----

== SSH Configuration ==

=== Basic SSH Setup ===
<pre>
ip domain-name cisco.com
crypto key generate rsa
ip ssh version 2
</pre>

=== Generate RSA Keys (1-liner) ===
crypto key generate rsa general-keys modulus 1024

=== Remove RSA Keys ===
<pre>
crypto key zeroize rsa
</pre>

=== Create Local User ===
<pre>
username admin secret ccna
</pre>

=== Set Default Gateway (switch) ===
<pre>
ip default-gateway 192.168.10.1
</pre>

=== Enable SSH on VTY Lines ===
<pre>
line vty 0 15
transport input ssh
login local
exit
</pre>

----

== Global Configuration Mode ==

=== Enter Global Config ===
<pre>
configure terminal
</pre>

=== Disable DNS Lookup on Typos ===
<pre>
no ip domain-lookup
</pre>

=== Set MOTD Banner ===
<pre>
banner motd MESSAGEHERE
</pre>

=== Set Hostname ===
<pre>
hostname HOSTNAME
</pre>

----

== Line Configuration ==

=== Console Line ===
<pre>
line con 0
password itsasecret
login
</pre>

=== VTY Lines ===
<pre>
line vty 0 15
password itsasecret
login
</pre>

----

== Interface Configuration ==

=== Interface Selection ===
interface vlan 1
interface fa0/1
interface range fa0/2-3
interface range fa0/2-3,g0/1

=== Enable Interface ===
no shutdown

=== Assign IPv4 Address ===
ip address 192.168.0.1 255.255.255.0

=== Assign IPv4 Default Gateway (Switch) ===
ip default-gateway 192.168.0.254

== Interface IPv6 Configuration ==

=== Assign IPv6 Address ===
<pre>
ipv6 address 2001:DB8:CAFE:1::1/64
</pre>

=== Assign Link-Local Address ===
<pre>
ipv6 address fe80::1 link-local
</pre>

=== Remove IPv6 Addresses ===
<pre>
no ipv6 address 2001:DB8:CAFE:1::1/64
no ipv6 address
</pre>

=== IPv6 ND Other-Config Flag ===
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages.
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.

ipv6 nd other-config-flag
</pre>

----

== VLAN Configuration ==

=== Create / Configure VLAN ===
<pre>
vlan 10
name MyAwesomeVlan
</pre>

----

== Access / Trunk Switchport Configuration ==

=== Access Port ===
Configures the interface as an access port and assigns it to VLAN 10.
switchport mode access
switchport access vlan 10

=== Trunk Port ===
Configures the interface as a trunk port using 802.1Q encapsulation.
switchport trunk encapsulation dot1q
switchport mode trunk

=== Trunk Allowed VLANs ===
Specifies which VLANs are allowed to traverse the trunk link.
switchport trunk allowed vlan 10,20,33,99

=== Trunk Native VLANs ===
Sets the native VLAN for untagged traffic on the trunk.
switchport trunk native vlan 99

=== Trunk Nonegotiate ===
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.
switchport nonegotiate

== EtherChannel Configuration ==

=== Create EtherChannel (LACP Active) ===
Configures interfaces to actively negotiate EtherChannel using LACP.
interface range g0/1 - 2
channel-group 1 mode active

=== Create EtherChannel (LACP Passive) ===
Configures interfaces to respond to LACP negotiation.
interface range g0/1 - 2
channel-group 1 mode passive

=== Create EtherChannel (On Mode) ===
Forces EtherChannel without negotiation protocol.
interface range g0/1 - 2
channel-group 1 mode on

=== Configure Port-Channel as Access Port ===
Applies access configuration to the logical Port-Channel interface.
interface port-channel 1
switchport mode access
switchport access vlan 10

=== Configure Port-Channel as Trunk ===
Applies trunk configuration to the logical Port-Channel interface.
interface port-channel 1
switchport trunk encapsulation dot1q
switchport mode trunk

=== Verify EtherChannel ===
Displays EtherChannel status and summary information.
show etherchannel summary

=== Verify Port-Channel Interface ===
Displays detailed information about the Port-Channel interface.
show interfaces port-channel 1

== DHCP ==

=== Configure a DHCP Server on a Cisco Router ===
Assigns IP addresses automatically to clients on a network.

<pre>
ip dhcp excluded-address 192.168.1.1 192.168.1.10
! Exclude addresses that should not be assigned dynamically

ip dhcp pool LAN_POOL
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 8.8.8.8 8.8.4.4
lease 7
</pre>

* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers).
* ''network'': Defines the subnet for DHCP clients.
* ''default-router'': Sets the gateway IP for clients.
* ''dns-server'': Specifies DNS servers for clients.
* ''lease'': Duration the IP is valid (in days).

=== Configure DHCP Relay (IP Helper) ===
Forwards DHCP requests from clients to a remote DHCP server.

<pre>
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip helper-address 192.168.2.100
</pre>

* ''ip helper-address'': IP of the DHCP server to forward requests to.
* Needed when the server is on a different subnet.

=== Verify DHCP Status ===
<pre>
show ip dhcp binding ! Shows assigned IP addresses
show ip dhcp pool ! Shows pool usage and statistics
show running-config ! Check DHCP configuration
</pre>

=== Best Practices ===
* Exclude static IP addresses from DHCP pools.
* Use ''DHCP relay'' when clients and server are on different subnets.
* Monitor DHCP bindings to prevent IP conflicts.

== Spanning Tree ==

=== Enable PortFast on an interface ===
Use PortFast on edge/access ports that connect to end devices.

interface GigabitEthernet0/1
spanning-tree portfast

=== Enable PortFast globally ===
Enables PortFast on all access ports.

spanning-tree portfast default

=== Enable PortFast on a trunk (use with caution) ===
Only use when the trunk connects to a single end device (not another switch).

interface GigabitEthernet0/1
spanning-tree portfast trunk

=== Verify PortFast status ===

show spanning-tree interface GigabitEthernet0/1 detail

=== Disable PortFast on an interface ===

interface GigabitEthernet0/1
no spanning-tree portfast

=== Best Practice: Enable BPDU Guard with PortFast ===
Shuts down the port if a BPDU is received, protecting against loops.

Per interface:
interface GigabitEthernet0/1
spanning-tree portfast
spanning-tree bpduguard enable

Globally:
spanning-tree portfast default
spanning-tree bpduguard default

=== Set the Root Bridge ===
Define a root bridge to control the topology and ensure consistent path selection.

Set priority to influence root bridge selection:
interface GigabitEthernet0/1
spanning-tree vlan 1 priority 4096

Set the root bridge for a specific VLAN:
spanning-tree vlan 1 root primary
(This sets the local switch as the root bridge)

Alternatively, set it to secondary:
spanning-tree vlan 1 root secondary
(This sets the local switch to be the backup root bridge)

=== Verify Root Bridge ===

show spanning-tree vlan 1

=== Notes ===
* Do '''not''' enable PortFast on ports connected to other switches
* Recommended for access/edge ports
* Incorrect use can cause Layer 2 loops
* Root Bridge selection can impact the STP topology and performance
* Lower priority values increase the chance of becoming the root bridge

== DHCP Snooping ==

=== Enable DHCP Snooping globally ===
Enable DHCP Snooping for the switch.

ip dhcp snooping

=== Enable DHCP Snooping on a VLAN ===
DHCP Snooping only operates on specified VLANs.

ip dhcp snooping vlan 10
ip dhcp snooping vlan 20

=== Configure trusted interfaces ===
Mark uplinks or ports connected to legitimate DHCP servers as trusted.

interface GigabitEthernet0/1
ip dhcp snooping trust

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. DHCP server responses are blocked.

interface GigabitEthernet0/2
no ip dhcp snooping trust

=== Configure DHCP Snooping rate limiting ===
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.

interface GigabitEthernet0/2
ip dhcp snooping limit rate 15

=== Verify DHCP Snooping status ===

show ip dhcp snooping
show ip dhcp snooping binding

=== Disable DHCP Snooping ===

no ip dhcp snooping
no ip dhcp snooping vlan 10

=== Notes ===
* Only trusted ports can send DHCP server messages
* Access ports should remain untrusted
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''
* Requires correct VLAN configuration to function properly

== Dynamic ARP Inspection (DAI) ==
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.

=== Enable DAI globally ===
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).

ip arp inspection

=== Enable DAI on a VLAN ===
Specify which VLANs should be protected.

ip arp inspection vlan 10
ip arp inspection vlan 20
ip arp inspection vlan 10,20 (alternative: range)

=== Configure trusted interfaces ===
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.

interface GigabitEthernet0/1
ip arp inspection trust

Trusted ports forward ARP packets without validation.

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. Invalid ARP packets are dropped.

interface GigabitEthernet0/2
no ip arp inspection trust (optional; this is the default)

=== Configure ARP rate limiting ===
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).

interface GigabitEthernet0/2
ip arp inspection limit rate 15 (example: 15 packets per second)
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)

=== Additional Validation Checks ===
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).

ip arp inspection validate src-mac
ip arp inspection validate src-mac dst-mac ip (common: enable all three)

Options:
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.

Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.

To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code>

=== Verify DAI status ===
show ip arp inspection
show ip arp inspection vlan 10
show ip arp inspection interfaces
show ip arp inspection statistics (shows drops, rate limit violations)
show ip arp inspection log (logs of dropped packets)

=== Disable DAI ===
no ip arp inspection
no ip arp inspection vlan 10

=== Notes ===
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).
* Access ports should remain '''untrusted''' to enforce checks.
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.
* DAI is ingress-only (checks incoming packets on untrusted ports).

== Port Security ==

=== View status of port security on an interface ===
show port-security interface f0/1

=== Activate Port Security on an interface ===
The port cannot be a dynamic port:
switchport mode access
Enable Port Security
switchport port-security

=== Set the maximum number of mac addresses that can be used on that port ===
switchport port-security maximum 1

=== Whitelist a specific mac address ===
switchport port-security mac-address 0001.6311.E7BC

=== Enable sticky mode to automatically learn mac addresses ===
switchport port-security mac-address sticky

=== Port Security Violation Modes ===
==== Protect ====
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.
switchport port-security violation protect

==== Restrict ====
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.
switchport port-security violation restrict

==== Shutdown ====
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.
switchport port-security violation shutdown

=== Port Security Aging ===
==== Enable static aging on an interface ====
switchport port-security aging static

==== Enable timed aging on an interface (5 minutes) ====
switchport port-security aging time 5

= Routing =

Routing is the process of forwarding packets between different networks using routing tables and routing protocols.

=== Enable IP Routing (Layer 3 Switch) ===
Required on multilayer switches to allow routing between VLANs.

ip routing

=== Enable IPv6 Routing (Routers) ===

ipv6 unicast-routing

== Static Routing ==

=== Configure a Static Route ===
Manually define a path to a remote network. Here's an example using the default administrative distance value.

ip route 192.168.2.0 255.255.255.0 192.168.1.1

Manually define a path to a remote network and specify the administrative distance.

ip route 192.168.2.0 255.255.255.0 192.168.1.1 10

Format:

ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative-distance (optional)>

=== Configure a Fully Specified Static Route ===
A fully specified static route includes both the next-hop IP address and the exit interface. This is commonly used on multi-access networks.

Example:

ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1

You can also specify the administrative distance:

ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1 10

Format:

ip route <destination-network> <subnet-mask> <exit-interface> <next-hop-ip> <administrative-distance (optional)>

=== Configure a Default Route / Default Gateway ===
Route used when no specific route matches the destination.

ip route 0.0.0.0 0.0.0.0 192.168.1.1

ipv6 route ::/0 2001:ABC:33:44::1

== Administrative Distance ==

Determines which route is preferred when multiple routes to the same destination exist.

Common values:
Connected – 0
Static – 1
EIGRP – 90
OSPF – 110
RIP – 120

Chart pulled from https://en.wikipedia.org/wiki/Administrative_distance#Default_administrative_distances
{| class="wikitable" style="text-align:center"
! Routing protocol !! Administrative distance
|-
| Directly connected interface || 0 (Only the interface itself has an administrative distance of 0, since a route cannot have a distance of less than 1.)
|-
| Static route || 1
|-
| Dynamic Mobile Network Routing (DMNR) || 3
|-
| EIGRP summary route || 5
|-
| External BGP || 20
|-
| EIGRP internal route || 90
|-
| IGRP || 100
|-
| Open Shortest Path First (OSPF) || 110
|-
| Intermediate System to Intermediate System (IS-IS) || 115
|-
| Routing Information Protocol (RIP) || 120
|-
| Exterior Gateway Protocol (EGP) || 140
|-
| On Demand Routing (ODR) || 160
|-
| EIGRP external route || 170
|-
| Internal BGP || 200
|-
| Next Hop Resolution Protocol (NHRP) || 250
|-
| Default static route learned via DHCP || 254
|-
| Unknown and unused || 255 (An administrative distance of 255 causes the router to remove the route from the routing table and not use it.)
|}

== Dynamic Routing ==

Dynamic routing protocols automatically exchange routing information between routers.

=== Configure RIP v2 ===
Uses hop count as metric (maximum 15 hops).

router rip
version 2
no auto-summary
network 192.168.1.0

=== Configure EIGRP ===
Uses bandwidth and delay as composite metric.

router eigrp 100
no auto-summary
network 192.168.1.0 0.0.0.255

=== Configure OSPF ===
Link-state protocol using cost as metric.

router ospf 1
network 192.168.1.0 0.0.0.255 area 0

== Route Summarization ==

Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.

Example networks:
192.168.0.0/24
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24

Can be summarized as:
192.168.0.0/22

=== Configure Manual Summarization (EIGRP) ===
Applied on the outgoing interface.

interface GigabitEthernet0/0
ip summary-address eigrp 100 192.168.0.0 255.255.252.0

=== Configure Manual Summarization (OSPF ABR) ===
Configured under the OSPF process (on an ABR).

router ospf 1
area 0 range 192.168.0.0 255.255.252.0

== Show Routing Information ==

=== View Routing Table ===

show ip route

=== View Specific Route ===

show ip route 192.168.1.0

=== View Routing Protocol Information ===

show ip protocols

Cisco Commands

2026-02-20T01:55:36Z

209.87.206.13: /* DHCP */

Cisco Commands

2026-02-20T01:04:20Z

209.87.206.13: /* Assign IPv4 Default Gateway (Router) */

Cisco Commands

2026-02-20T01:04:08Z

209.87.206.13: /* Assign IPv4 Default Gateway (Router) */

Cisco Commands

2026-02-20T01:03:45Z

209.87.206.13: /* Configure a Default Route */

Cisco Commands

2026-02-20T01:00:05Z

209.87.206.13: /* Interface Configuration */

Cisco Commands

2026-02-20T00:59:36Z

209.87.206.13: /* Assign IPv4 Default Gateway */

Cisco Commands

2026-02-20T00:18:18Z

209.87.206.13: /* Interface Configuration */

Cisco Commands

2026-02-20T00:17:41Z

209.87.206.13: /* Interface IPv4 Configuration */

Cisco Commands

2026-02-20T00:17:27Z

209.87.206.13: /* IPv6 Interface Configuration */

Cisco Commands

2026-02-20T00:17:10Z

209.87.206.13: /* Interface Configuration */

Cisco Commands

2026-02-20T00:16:29Z

209.87.206.13:

Cisco Commands

2026-02-20T00:15:44Z

209.87.206.13: /* Interface Configuration */

Cisco Commands

2026-02-18T00:57:52Z

209.87.206.13: /* Enter Privileged Mode */

Cisco Commands

2026-02-18T00:56:59Z

209.87.206.13: /* Filter Running Config (grep-like) */

Cisco Commands

2026-02-18T00:55:12Z

209.87.206.13: /* Routing */

Cisco Commands

2026-02-18T00:54:48Z

209.87.206.13: /* Routing */

Cisco Commands

2026-02-18T00:54:21Z

209.87.206.13:

Cisco Commands

2026-02-18T00:47:59Z

209.87.206.13: /* Routing */

Cisco Commands

2026-02-18T00:47:06Z

209.87.206.13: /* Routing */

Cisco Commands

2026-02-18T00:45:14Z

209.87.206.13: Undo revision 1086 by 209.87.206.13 (talk)

Cisco Commands

2026-02-18T00:44:29Z

209.87.206.13: /* Routing */

Cisco Commands

2026-02-18T00:42:32Z

209.87.206.13:

Cisco Commands

2026-02-18T00:39:46Z

209.87.206.13: /* Routing Table */

Cisco Commands

2026-02-18T00:29:34Z

209.87.206.13: /* Enable IP Routing (Layer 3 Switch) */

Cisco Commands

2026-02-18T00:29:15Z

209.87.206.13: /* System & Routing Basics */

Cisco Commands

2026-02-18T00:27:58Z

209.87.206.13: /* Port Security */

= Cisco IOS Command Reference =

A quick-reference guide for common Cisco IOS commands on switches and routers.

----

== System & Routing Basics ==

=== Enable IPv4 Routing (Layer 3 Switches) ===
<pre>
ip routing
</pre>

=== Enable IPv6 Routing (Routers) ===
<pre>
ipv6 unicast-routing
</pre>

----

== Device & System Information ==

=== Show MAC Address Table ===
<pre>
show mac address-table
</pre>

=== Show OS and Device Version ===
<pre>
show version
</pre>

=== Show Logged-in Users ===
<pre>
show users
</pre>

=== Show Files ===
<pre>
dir
dir nvram:
</pre>

----

== Configuration Files ==

=== Show Configurations ===
<pre>
show running-config
show startup-config
</pre>

=== Show Interface Config ===
<pre>
show run interface g0/0
</pre>

=== Filter Running Config (grep-like) ===
<pre>
show run | include {searchterm}
show run | begin {searchterm}
show run | section {section-name}
</pre>

=== Save Running Config ===
<pre>
copy running-config startup-config
copy run start
wr
</pre>

----

== User Privileges & Security ==

=== Enter Privileged Mode ===
<pre>
enable
</pre>

=== Set Encrypted Enable Password ===
<pre>
enable secret ThisisaSecret
</pre>

=== Encrypt Plaintext Passwords (Weak Encryption) ===
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7
<pre>
service password-encryption
</pre>

----

== Interface & Network Status ==

=== Interface IP Summary ===
<pre>
show ip interface brief
show ipv6 interface brief
</pre>

=== Interface IP Summary (filtered to only interfaces with IPs) ===
<pre>
show ip interface brief | exclude unassigned
</pre>
=== Routing Table ===
<pre>
show ip route
</pre>

----

== VLAN & Switching ==

=== Show VLANs ===
<pre>
show vlan brief
</pre>

=== Show Interface VLAN Details ===
<pre>
show interface g0/1 switchport
</pre>

=== Show Trunk Interfaces ===
<pre>
show int trunk
</pre>

=== Clear Tables ===
<pre>
clear mac address-table
clear arp-cache
</pre>

----

== Telnet & Remote Access ==

=== Connect via Telnet ===
<pre>
connect {DeviceName}
</pre>

=== Show Hosts & Sessions ===
<pre>
show hosts
show sessions
</pre>

=== Disconnect Session ===
<pre>
disconnect {DeviceName}
</pre>

=== Suspend Active Session ===
<pre>
Ctrl+Shift+6, then x
</pre>

----

== SSH Configuration ==

=== Basic SSH Setup ===
<pre>
ip domain-name cisco.com
crypto key generate rsa
ip ssh version 2
</pre>

=== Remove RSA Keys ===
<pre>
crypto key zeroize rsa
</pre>

=== Create Local User ===
<pre>
username admin secret ccna
</pre>

=== Set Default Gateway ===
<pre>
ip default-gateway 192.168.10.1
</pre>

=== Enable SSH on VTY Lines ===
<pre>
line vty 0 15
transport input ssh
login local
exit
</pre>

----

== Global Configuration Mode ==

=== Enter Global Config ===
<pre>
configure terminal
</pre>

=== Disable DNS Lookup on Typos ===
<pre>
no ip domain-lookup
</pre>

=== Set MOTD Banner ===
<pre>
banner motd MESSAGEHERE
</pre>

=== Set Hostname ===
<pre>
hostname HOSTNAME
</pre>

----

== Line Configuration ==

=== Console Line ===
<pre>
line con 0
password itsasecret
login
</pre>

=== VTY Lines ===
<pre>
line vty 0 15
password itsasecret
login
</pre>

----

== Interface Configuration ==

=== Interface Selection ===
<pre>
interface vlan 1
interface fa0/1
interface range fa0/2-3
interface range fa0/2-3,g0/1
</pre>

=== Enable Interface ===
<pre>
no shutdown
</pre>

=== Assign IPv4 Address ===
<pre>
ip address 192.168.0.1 255.255.255.0
</pre>

----

== VLAN Configuration ==

=== Create / Configure VLAN ===
<pre>
vlan 10
name MyAwesomeVlan
</pre>

----

== Switchport Configuration ==

=== Access Port ===
<pre>
switchport mode access
switchport access vlan 10
</pre>

=== Trunk Port ===
<pre>
switchport trunk encapsulation dot1q
switchport mode trunk
</pre>

=== Trunk Allowed VLANs ===
switchport trunk allowed vlan 10,20,33,99

=== Trunk Native VLANs ===
switchport trunk native vlan 99

----

== IPv6 Interface Configuration ==

=== Assign IPv6 Address ===
<pre>
ipv6 address 2001:DB8:CAFE:1::1/64
</pre>

=== Assign Link-Local Address ===
<pre>
ipv6 address fe80::1 link-local
</pre>

=== Remove IPv6 Addresses ===
<pre>
no ipv6 address 2001:DB8:CAFE:1::1/64
no ipv6 address
</pre>

=== IPv6 ND Other-Config Flag ===
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages.
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.

ipv6 nd other-config-flag
</pre>

----

== DHCP ==

=== Configure a DHCP Server on a Cisco Router ===
Assigns IP addresses automatically to clients on a network.

<pre>
ip dhcp excluded-address 192.168.1.1 192.168.1.10
! Exclude addresses that should not be assigned dynamically

ip dhcp pool LAN_POOL
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 8.8.8.8 8.8.4.4
lease 7
</pre>

* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers).
* ''network'': Defines the subnet for DHCP clients.
* ''default-router'': Sets the gateway IP for clients.
* ''dns-server'': Specifies DNS servers for clients.
* ''lease'': Duration the IP is valid (in days).

=== Configure DHCP Relay (IP Helper) ===
Forwards DHCP requests from clients to a remote DHCP server.

<pre>
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip helper-address 192.168.2.100
</pre>

* ''ip helper-address'': IP of the DHCP server to forward requests to.
* Needed when the server is on a different subnet.

=== Verify DHCP Status ===
<pre>
show ip dhcp binding ! Shows assigned IP addresses
show ip dhcp pool ! Shows pool usage and statistics
show running-config ! Check DHCP configuration
</pre>

=== Best Practices ===
* Exclude static IP addresses from DHCP pools.
* Use ''DHCP relay'' when clients and server are on different subnets.
* Monitor DHCP bindings to prevent IP conflicts.

== Spanning Tree ==

=== Enable PortFast on an interface ===
Use PortFast on edge/access ports that connect to end devices.

interface GigabitEthernet0/1
spanning-tree portfast

=== Enable PortFast globally ===
Enables PortFast on all access ports.

spanning-tree portfast default

=== Enable PortFast on a trunk (use with caution) ===
Only use when the trunk connects to a single end device (not another switch).

interface GigabitEthernet0/1
spanning-tree portfast trunk

=== Verify PortFast status ===

show spanning-tree interface GigabitEthernet0/1 detail

=== Disable PortFast on an interface ===

interface GigabitEthernet0/1
no spanning-tree portfast

=== Best Practice: Enable BPDU Guard with PortFast ===
Shuts down the port if a BPDU is received, protecting against loops.

Per interface:
interface GigabitEthernet0/1
spanning-tree portfast
spanning-tree bpduguard enable

Globally:
spanning-tree portfast default
spanning-tree bpduguard default

=== Notes ===
* Do '''not''' enable PortFast on ports connected to other switches
* Recommended for access/edge ports
* Incorrect use can cause Layer 2 loops

== DHCP Snooping ==

=== Enable DHCP Snooping globally ===
Enable DHCP Snooping for the switch.

ip dhcp snooping

=== Enable DHCP Snooping on a VLAN ===
DHCP Snooping only operates on specified VLANs.

ip dhcp snooping vlan 10
ip dhcp snooping vlan 20

=== Configure trusted interfaces ===
Mark uplinks or ports connected to legitimate DHCP servers as trusted.

interface GigabitEthernet0/1
ip dhcp snooping trust

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. DHCP server responses are blocked.

interface GigabitEthernet0/2
no ip dhcp snooping trust

=== Configure DHCP Snooping rate limiting ===
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.

interface GigabitEthernet0/2
ip dhcp snooping limit rate 15

=== Verify DHCP Snooping status ===

show ip dhcp snooping
show ip dhcp snooping binding

=== Disable DHCP Snooping ===

no ip dhcp snooping
no ip dhcp snooping vlan 10

=== Notes ===
* Only trusted ports can send DHCP server messages
* Access ports should remain untrusted
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''
* Requires correct VLAN configuration to function properly

== Dynamic ARP Inspection (DAI) ==

=== Enable DAI globally ===
Dynamic ARP Inspection requires DHCP Snooping to be enabled.

ip arp inspection

=== Enable DAI on a VLAN ===
Specify which VLANs should be protected.

ip arp inspection vlan 10
ip arp inspection vlan 20

=== Configure trusted interfaces ===
Trust uplinks and ports connected to other switches or routers.

interface GigabitEthernet0/1
ip arp inspection trust

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. Invalid ARP packets are dropped.

interface GigabitEthernet0/2
no ip arp inspection trust

=== Configure ARP rate limiting ===
Protect against ARP flooding attacks.

interface GigabitEthernet0/2
ip arp inspection limit rate 15

=== Verify DAI status ===

show ip arp inspection
show ip arp inspection vlan
show ip arp inspection interfaces

=== Disable DAI ===

no ip arp inspection
no ip arp inspection vlan 10

=== Notes ===
* Requires '''DHCP Snooping''' to build the ARP binding table
* Only trusted ports can send unlimited ARP replies
* Access ports should remain untrusted
* Commonly deployed with '''PortFast + BPDU Guard'''

== Port Security ==

=== Activate Port Security on an interface ===
The port cannot be a dynamic port:
switchport mode access
Enable Port Security
switchport port-security

=== Set the maximum number of mac addresses that can be used on that port ===
switchport port-security maximum 1

=== Whitelist a specific mac address ===
switchport port-security mac-address 0001.6311.E7BC

=== Enable sticky mode to automatically learn mac addresses ===
switchport port-security mac-address sticky

=== Port Security Violation Modes ===
==== Protect ====
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.
switchport port-security violation protect

==== Restrict ====
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.
switchport port-security violation restrict

==== Shutdown ====
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.
switchport port-security violation shutdown

=== Port Security Aging ===
==== Enable static aging on an interface ====
switchport port-security aging static

==== Enable timed aging on an interface (5 minutes) ====
switchport port-security aging time 5

== Routing ==

Routing is the process of forwarding packets between different networks using routing tables and routing protocols.

=== Enable IP Routing (Layer 3 Switch) ===
Required on multilayer switches to allow routing between VLANs.

ip routing

== Static Routing ==

=== Configure a Static Route ===
Manually define a path to a remote network.

ip route 192.168.2.0 255.255.255.0 192.168.1.1

Format:
ip route <destination-network> <subnet-mask> <next-hop-ip>

=== Configure a Default Route ===
Route used when no specific route matches the destination.

ip route 0.0.0.0 0.0.0.0 192.168.1.1

== Dynamic Routing ==

Dynamic routing protocols automatically exchange routing information between routers.

=== Configure RIP v2 ===
Uses hop count as metric (maximum 15 hops).

router rip
version 2
no auto-summary
network 192.168.1.0

=== Configure EIGRP ===
Uses bandwidth and delay as composite metric.

router eigrp 100
no auto-summary
network 192.168.1.0 0.0.0.255

=== Configure OSPF ===
Link-state protocol using cost as metric.

router ospf 1
network 192.168.1.0 0.0.0.255 area 0

== Route Summarization ==

Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.

Example networks:
192.168.0.0/24
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24

Can be summarized as:
192.168.0.0/22

=== Configure Manual Summarization (EIGRP) ===
Applied on the outgoing interface.

interface GigabitEthernet0/0
ip summary-address eigrp 100 192.168.0.0 255.255.252.0

=== Configure Manual Summarization (OSPF ABR) ===
Configured under the OSPF process (on an ABR).

router ospf 1
area 0 range 192.168.0.0 255.255.252.0

== Administrative Distance ==

Determines which route is preferred when multiple routes to the same destination exist.

Common values:
Connected – 0
Static – 1
EIGRP – 90
OSPF – 110
RIP – 120

== Show Routing Information ==

=== View Routing Table ===

show ip route

=== View Specific Route ===

show ip route 192.168.1.0

=== View Routing Protocol Information ===

show ip protocols

== Configure Route Summarization (EIGRP Example) ==
Reduces routing table size by advertising a single summary route instead of multiple specific networks.

interface GigabitEthernet0/0
ip summary-address eigrp 100 192.168.0.0 255.255.252.0

Replace **100** with your EIGRP AS number, and adjust the network address and subnet mask to match your summary range.

Cisco Commands

2026-02-18T00:26:23Z

209.87.206.13: /* Configure Route Summarization (EIGRP Example) */

= Cisco IOS Command Reference =

A quick-reference guide for common Cisco IOS commands on switches and routers.

----

== System & Routing Basics ==

=== Enable IPv4 Routing (Layer 3 Switches) ===
<pre>
ip routing
</pre>

=== Enable IPv6 Routing (Routers) ===
<pre>
ipv6 unicast-routing
</pre>

----

== Device & System Information ==

=== Show MAC Address Table ===
<pre>
show mac address-table
</pre>

=== Show OS and Device Version ===
<pre>
show version
</pre>

=== Show Logged-in Users ===
<pre>
show users
</pre>

=== Show Files ===
<pre>
dir
dir nvram:
</pre>

----

== Configuration Files ==

=== Show Configurations ===
<pre>
show running-config
show startup-config
</pre>

=== Show Interface Config ===
<pre>
show run interface g0/0
</pre>

=== Filter Running Config (grep-like) ===
<pre>
show run | include {searchterm}
show run | begin {searchterm}
show run | section {section-name}
</pre>

=== Save Running Config ===
<pre>
copy running-config startup-config
copy run start
wr
</pre>

----

== User Privileges & Security ==

=== Enter Privileged Mode ===
<pre>
enable
</pre>

=== Set Encrypted Enable Password ===
<pre>
enable secret ThisisaSecret
</pre>

=== Encrypt Plaintext Passwords (Weak Encryption) ===
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7
<pre>
service password-encryption
</pre>

----

== Interface & Network Status ==

=== Interface IP Summary ===
<pre>
show ip interface brief
show ipv6 interface brief
</pre>

=== Interface IP Summary (filtered to only interfaces with IPs) ===
<pre>
show ip interface brief | exclude unassigned
</pre>
=== Routing Table ===
<pre>
show ip route
</pre>

----

== VLAN & Switching ==

=== Show VLANs ===
<pre>
show vlan brief
</pre>

=== Show Interface VLAN Details ===
<pre>
show interface g0/1 switchport
</pre>

=== Show Trunk Interfaces ===
<pre>
show int trunk
</pre>

=== Clear Tables ===
<pre>
clear mac address-table
clear arp-cache
</pre>

----

== Telnet & Remote Access ==

=== Connect via Telnet ===
<pre>
connect {DeviceName}
</pre>

=== Show Hosts & Sessions ===
<pre>
show hosts
show sessions
</pre>

=== Disconnect Session ===
<pre>
disconnect {DeviceName}
</pre>

=== Suspend Active Session ===
<pre>
Ctrl+Shift+6, then x
</pre>

----

== SSH Configuration ==

=== Basic SSH Setup ===
<pre>
ip domain-name cisco.com
crypto key generate rsa
ip ssh version 2
</pre>

=== Remove RSA Keys ===
<pre>
crypto key zeroize rsa
</pre>

=== Create Local User ===
<pre>
username admin secret ccna
</pre>

=== Set Default Gateway ===
<pre>
ip default-gateway 192.168.10.1
</pre>

=== Enable SSH on VTY Lines ===
<pre>
line vty 0 15
transport input ssh
login local
exit
</pre>

----

== Global Configuration Mode ==

=== Enter Global Config ===
<pre>
configure terminal
</pre>

=== Disable DNS Lookup on Typos ===
<pre>
no ip domain-lookup
</pre>

=== Set MOTD Banner ===
<pre>
banner motd MESSAGEHERE
</pre>

=== Set Hostname ===
<pre>
hostname HOSTNAME
</pre>

----

== Line Configuration ==

=== Console Line ===
<pre>
line con 0
password itsasecret
login
</pre>

=== VTY Lines ===
<pre>
line vty 0 15
password itsasecret
login
</pre>

----

== Interface Configuration ==

=== Interface Selection ===
<pre>
interface vlan 1
interface fa0/1
interface range fa0/2-3
interface range fa0/2-3,g0/1
</pre>

=== Enable Interface ===
<pre>
no shutdown
</pre>

=== Assign IPv4 Address ===
<pre>
ip address 192.168.0.1 255.255.255.0
</pre>

----

== VLAN Configuration ==

=== Create / Configure VLAN ===
<pre>
vlan 10
name MyAwesomeVlan
</pre>

----

== Switchport Configuration ==

=== Access Port ===
<pre>
switchport mode access
switchport access vlan 10
</pre>

=== Trunk Port ===
<pre>
switchport trunk encapsulation dot1q
switchport mode trunk
</pre>

=== Trunk Allowed VLANs ===
switchport trunk allowed vlan 10,20,33,99

=== Trunk Native VLANs ===
switchport trunk native vlan 99

----

== IPv6 Interface Configuration ==

=== Assign IPv6 Address ===
<pre>
ipv6 address 2001:DB8:CAFE:1::1/64
</pre>

=== Assign Link-Local Address ===
<pre>
ipv6 address fe80::1 link-local
</pre>

=== Remove IPv6 Addresses ===
<pre>
no ipv6 address 2001:DB8:CAFE:1::1/64
no ipv6 address
</pre>

=== IPv6 ND Other-Config Flag ===
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages.
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.

ipv6 nd other-config-flag
</pre>

----

== DHCP ==

=== Configure a DHCP Server on a Cisco Router ===
Assigns IP addresses automatically to clients on a network.

<pre>
ip dhcp excluded-address 192.168.1.1 192.168.1.10
! Exclude addresses that should not be assigned dynamically

ip dhcp pool LAN_POOL
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 8.8.8.8 8.8.4.4
lease 7
</pre>

* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers).
* ''network'': Defines the subnet for DHCP clients.
* ''default-router'': Sets the gateway IP for clients.
* ''dns-server'': Specifies DNS servers for clients.
* ''lease'': Duration the IP is valid (in days).

=== Configure DHCP Relay (IP Helper) ===
Forwards DHCP requests from clients to a remote DHCP server.

<pre>
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip helper-address 192.168.2.100
</pre>

* ''ip helper-address'': IP of the DHCP server to forward requests to.
* Needed when the server is on a different subnet.

=== Verify DHCP Status ===
<pre>
show ip dhcp binding ! Shows assigned IP addresses
show ip dhcp pool ! Shows pool usage and statistics
show running-config ! Check DHCP configuration
</pre>

=== Best Practices ===
* Exclude static IP addresses from DHCP pools.
* Use ''DHCP relay'' when clients and server are on different subnets.
* Monitor DHCP bindings to prevent IP conflicts.

== Spanning Tree ==

=== Enable PortFast on an interface ===
Use PortFast on edge/access ports that connect to end devices.

interface GigabitEthernet0/1
spanning-tree portfast

=== Enable PortFast globally ===
Enables PortFast on all access ports.

spanning-tree portfast default

=== Enable PortFast on a trunk (use with caution) ===
Only use when the trunk connects to a single end device (not another switch).

interface GigabitEthernet0/1
spanning-tree portfast trunk

=== Verify PortFast status ===

show spanning-tree interface GigabitEthernet0/1 detail

=== Disable PortFast on an interface ===

interface GigabitEthernet0/1
no spanning-tree portfast

=== Best Practice: Enable BPDU Guard with PortFast ===
Shuts down the port if a BPDU is received, protecting against loops.

Per interface:
interface GigabitEthernet0/1
spanning-tree portfast
spanning-tree bpduguard enable

Globally:
spanning-tree portfast default
spanning-tree bpduguard default

=== Notes ===
* Do '''not''' enable PortFast on ports connected to other switches
* Recommended for access/edge ports
* Incorrect use can cause Layer 2 loops

== DHCP Snooping ==

=== Enable DHCP Snooping globally ===
Enable DHCP Snooping for the switch.

ip dhcp snooping

=== Enable DHCP Snooping on a VLAN ===
DHCP Snooping only operates on specified VLANs.

ip dhcp snooping vlan 10
ip dhcp snooping vlan 20

=== Configure trusted interfaces ===
Mark uplinks or ports connected to legitimate DHCP servers as trusted.

interface GigabitEthernet0/1
ip dhcp snooping trust

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. DHCP server responses are blocked.

interface GigabitEthernet0/2
no ip dhcp snooping trust

=== Configure DHCP Snooping rate limiting ===
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.

interface GigabitEthernet0/2
ip dhcp snooping limit rate 15

=== Verify DHCP Snooping status ===

show ip dhcp snooping
show ip dhcp snooping binding

=== Disable DHCP Snooping ===

no ip dhcp snooping
no ip dhcp snooping vlan 10

=== Notes ===
* Only trusted ports can send DHCP server messages
* Access ports should remain untrusted
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''
* Requires correct VLAN configuration to function properly

== Dynamic ARP Inspection (DAI) ==

=== Enable DAI globally ===
Dynamic ARP Inspection requires DHCP Snooping to be enabled.

ip arp inspection

=== Enable DAI on a VLAN ===
Specify which VLANs should be protected.

ip arp inspection vlan 10
ip arp inspection vlan 20

=== Configure trusted interfaces ===
Trust uplinks and ports connected to other switches or routers.

interface GigabitEthernet0/1
ip arp inspection trust

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. Invalid ARP packets are dropped.

interface GigabitEthernet0/2
no ip arp inspection trust

=== Configure ARP rate limiting ===
Protect against ARP flooding attacks.

interface GigabitEthernet0/2
ip arp inspection limit rate 15

=== Verify DAI status ===

show ip arp inspection
show ip arp inspection vlan
show ip arp inspection interfaces

=== Disable DAI ===

no ip arp inspection
no ip arp inspection vlan 10

=== Notes ===
* Requires '''DHCP Snooping''' to build the ARP binding table
* Only trusted ports can send unlimited ARP replies
* Access ports should remain untrusted
* Commonly deployed with '''PortFast + BPDU Guard'''

== Port Security ==

=== Activate Port Security on an interface ===
The port cannot be a dynamic port:
switchport mode access
Enable Port Security
switchport port-security

=== Set the maximum number of mac addresses that can be used on that port ===
switchport port-security maximum 1

=== Whitelist a specific mac address ===
switchport port-security mac-address 0001.6311.E7BC

=== Enable sticky mode to automatically learn mac addresses ===
switchport port-security mac-address sticky

=== Port Security Violation Modes ===
==== Protect ====
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.
switchport port-security violation protect

==== Restrict ====
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.
switchport port-security violation restrict

==== Shutdown ====
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.
switchport port-security violation shutdown

=== Port Security Aging ===
==== Enable static aging on an interface ====
switchport port-security aging static

==== Enable timed aging on an interface (5 minutes) ====
switchport port-security aging time 5

== Configure Route Summarization (EIGRP Example) ==
Reduces routing table size by advertising a single summary route instead of multiple specific networks.

interface GigabitEthernet0/0
ip summary-address eigrp 100 192.168.0.0 255.255.252.0

Replace **100** with your EIGRP AS number, and adjust the network address and subnet mask to match your summary range.

Cisco Commands

2026-02-18T00:26:12Z

209.87.206.13:

= Cisco IOS Command Reference =

A quick-reference guide for common Cisco IOS commands on switches and routers.

----

== System & Routing Basics ==

=== Enable IPv4 Routing (Layer 3 Switches) ===
<pre>
ip routing
</pre>

=== Enable IPv6 Routing (Routers) ===
<pre>
ipv6 unicast-routing
</pre>

----

== Device & System Information ==

=== Show MAC Address Table ===
<pre>
show mac address-table
</pre>

=== Show OS and Device Version ===
<pre>
show version
</pre>

=== Show Logged-in Users ===
<pre>
show users
</pre>

=== Show Files ===
<pre>
dir
dir nvram:
</pre>

----

== Configuration Files ==

=== Show Configurations ===
<pre>
show running-config
show startup-config
</pre>

=== Show Interface Config ===
<pre>
show run interface g0/0
</pre>

=== Filter Running Config (grep-like) ===
<pre>
show run | include {searchterm}
show run | begin {searchterm}
show run | section {section-name}
</pre>

=== Save Running Config ===
<pre>
copy running-config startup-config
copy run start
wr
</pre>

----

== User Privileges & Security ==

=== Enter Privileged Mode ===
<pre>
enable
</pre>

=== Set Encrypted Enable Password ===
<pre>
enable secret ThisisaSecret
</pre>

=== Encrypt Plaintext Passwords (Weak Encryption) ===
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7
<pre>
service password-encryption
</pre>

----

== Interface & Network Status ==

=== Interface IP Summary ===
<pre>
show ip interface brief
show ipv6 interface brief
</pre>

=== Interface IP Summary (filtered to only interfaces with IPs) ===
<pre>
show ip interface brief | exclude unassigned
</pre>
=== Routing Table ===
<pre>
show ip route
</pre>

----

== VLAN & Switching ==

=== Show VLANs ===
<pre>
show vlan brief
</pre>

=== Show Interface VLAN Details ===
<pre>
show interface g0/1 switchport
</pre>

=== Show Trunk Interfaces ===
<pre>
show int trunk
</pre>

=== Clear Tables ===
<pre>
clear mac address-table
clear arp-cache
</pre>

----

== Telnet & Remote Access ==

=== Connect via Telnet ===
<pre>
connect {DeviceName}
</pre>

=== Show Hosts & Sessions ===
<pre>
show hosts
show sessions
</pre>

=== Disconnect Session ===
<pre>
disconnect {DeviceName}
</pre>

=== Suspend Active Session ===
<pre>
Ctrl+Shift+6, then x
</pre>

----

== SSH Configuration ==

=== Basic SSH Setup ===
<pre>
ip domain-name cisco.com
crypto key generate rsa
ip ssh version 2
</pre>

=== Remove RSA Keys ===
<pre>
crypto key zeroize rsa
</pre>

=== Create Local User ===
<pre>
username admin secret ccna
</pre>

=== Set Default Gateway ===
<pre>
ip default-gateway 192.168.10.1
</pre>

=== Enable SSH on VTY Lines ===
<pre>
line vty 0 15
transport input ssh
login local
exit
</pre>

----

== Global Configuration Mode ==

=== Enter Global Config ===
<pre>
configure terminal
</pre>

=== Disable DNS Lookup on Typos ===
<pre>
no ip domain-lookup
</pre>

=== Set MOTD Banner ===
<pre>
banner motd MESSAGEHERE
</pre>

=== Set Hostname ===
<pre>
hostname HOSTNAME
</pre>

----

== Line Configuration ==

=== Console Line ===
<pre>
line con 0
password itsasecret
login
</pre>

=== VTY Lines ===
<pre>
line vty 0 15
password itsasecret
login
</pre>

----

== Interface Configuration ==

=== Interface Selection ===
<pre>
interface vlan 1
interface fa0/1
interface range fa0/2-3
interface range fa0/2-3,g0/1
</pre>

=== Enable Interface ===
<pre>
no shutdown
</pre>

=== Assign IPv4 Address ===
<pre>
ip address 192.168.0.1 255.255.255.0
</pre>

----

== VLAN Configuration ==

=== Create / Configure VLAN ===
<pre>
vlan 10
name MyAwesomeVlan
</pre>

----

== Switchport Configuration ==

=== Access Port ===
<pre>
switchport mode access
switchport access vlan 10
</pre>

=== Trunk Port ===
<pre>
switchport trunk encapsulation dot1q
switchport mode trunk
</pre>

=== Trunk Allowed VLANs ===
switchport trunk allowed vlan 10,20,33,99

=== Trunk Native VLANs ===
switchport trunk native vlan 99

----

== IPv6 Interface Configuration ==

=== Assign IPv6 Address ===
<pre>
ipv6 address 2001:DB8:CAFE:1::1/64
</pre>

=== Assign Link-Local Address ===
<pre>
ipv6 address fe80::1 link-local
</pre>

=== Remove IPv6 Addresses ===
<pre>
no ipv6 address 2001:DB8:CAFE:1::1/64
no ipv6 address
</pre>

=== IPv6 ND Other-Config Flag ===
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages.
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.

ipv6 nd other-config-flag
</pre>

----

== DHCP ==

=== Configure a DHCP Server on a Cisco Router ===
Assigns IP addresses automatically to clients on a network.

<pre>
ip dhcp excluded-address 192.168.1.1 192.168.1.10
! Exclude addresses that should not be assigned dynamically

ip dhcp pool LAN_POOL
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 8.8.8.8 8.8.4.4
lease 7
</pre>

* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers).
* ''network'': Defines the subnet for DHCP clients.
* ''default-router'': Sets the gateway IP for clients.
* ''dns-server'': Specifies DNS servers for clients.
* ''lease'': Duration the IP is valid (in days).

=== Configure DHCP Relay (IP Helper) ===
Forwards DHCP requests from clients to a remote DHCP server.

<pre>
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip helper-address 192.168.2.100
</pre>

* ''ip helper-address'': IP of the DHCP server to forward requests to.
* Needed when the server is on a different subnet.

=== Verify DHCP Status ===
<pre>
show ip dhcp binding ! Shows assigned IP addresses
show ip dhcp pool ! Shows pool usage and statistics
show running-config ! Check DHCP configuration
</pre>

=== Best Practices ===
* Exclude static IP addresses from DHCP pools.
* Use ''DHCP relay'' when clients and server are on different subnets.
* Monitor DHCP bindings to prevent IP conflicts.

== Spanning Tree ==

=== Enable PortFast on an interface ===
Use PortFast on edge/access ports that connect to end devices.

interface GigabitEthernet0/1
spanning-tree portfast

=== Enable PortFast globally ===
Enables PortFast on all access ports.

spanning-tree portfast default

=== Enable PortFast on a trunk (use with caution) ===
Only use when the trunk connects to a single end device (not another switch).

interface GigabitEthernet0/1
spanning-tree portfast trunk

=== Verify PortFast status ===

show spanning-tree interface GigabitEthernet0/1 detail

=== Disable PortFast on an interface ===

interface GigabitEthernet0/1
no spanning-tree portfast

=== Best Practice: Enable BPDU Guard with PortFast ===
Shuts down the port if a BPDU is received, protecting against loops.

Per interface:
interface GigabitEthernet0/1
spanning-tree portfast
spanning-tree bpduguard enable

Globally:
spanning-tree portfast default
spanning-tree bpduguard default

=== Notes ===
* Do '''not''' enable PortFast on ports connected to other switches
* Recommended for access/edge ports
* Incorrect use can cause Layer 2 loops

== DHCP Snooping ==

=== Enable DHCP Snooping globally ===
Enable DHCP Snooping for the switch.

ip dhcp snooping

=== Enable DHCP Snooping on a VLAN ===
DHCP Snooping only operates on specified VLANs.

ip dhcp snooping vlan 10
ip dhcp snooping vlan 20

=== Configure trusted interfaces ===
Mark uplinks or ports connected to legitimate DHCP servers as trusted.

interface GigabitEthernet0/1
ip dhcp snooping trust

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. DHCP server responses are blocked.

interface GigabitEthernet0/2
no ip dhcp snooping trust

=== Configure DHCP Snooping rate limiting ===
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.

interface GigabitEthernet0/2
ip dhcp snooping limit rate 15

=== Verify DHCP Snooping status ===

show ip dhcp snooping
show ip dhcp snooping binding

=== Disable DHCP Snooping ===

no ip dhcp snooping
no ip dhcp snooping vlan 10

=== Notes ===
* Only trusted ports can send DHCP server messages
* Access ports should remain untrusted
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''
* Requires correct VLAN configuration to function properly

== Dynamic ARP Inspection (DAI) ==

=== Enable DAI globally ===
Dynamic ARP Inspection requires DHCP Snooping to be enabled.

ip arp inspection

=== Enable DAI on a VLAN ===
Specify which VLANs should be protected.

ip arp inspection vlan 10
ip arp inspection vlan 20

=== Configure trusted interfaces ===
Trust uplinks and ports connected to other switches or routers.

interface GigabitEthernet0/1
ip arp inspection trust

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. Invalid ARP packets are dropped.

interface GigabitEthernet0/2
no ip arp inspection trust

=== Configure ARP rate limiting ===
Protect against ARP flooding attacks.

interface GigabitEthernet0/2
ip arp inspection limit rate 15

=== Verify DAI status ===

show ip arp inspection
show ip arp inspection vlan
show ip arp inspection interfaces

=== Disable DAI ===

no ip arp inspection
no ip arp inspection vlan 10

=== Notes ===
* Requires '''DHCP Snooping''' to build the ARP binding table
* Only trusted ports can send unlimited ARP replies
* Access ports should remain untrusted
* Commonly deployed with '''PortFast + BPDU Guard'''

== Port Security ==

=== Activate Port Security on an interface ===
The port cannot be a dynamic port:
switchport mode access
Enable Port Security
switchport port-security

=== Set the maximum number of mac addresses that can be used on that port ===
switchport port-security maximum 1

=== Whitelist a specific mac address ===
switchport port-security mac-address 0001.6311.E7BC

=== Enable sticky mode to automatically learn mac addresses ===
switchport port-security mac-address sticky

=== Port Security Violation Modes ===
==== Protect ====
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.
switchport port-security violation protect

==== Restrict ====
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.
switchport port-security violation restrict

==== Shutdown ====
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.
switchport port-security violation shutdown

=== Port Security Aging ===
==== Enable static aging on an interface ====
switchport port-security aging static

==== Enable timed aging on an interface (5 minutes) ====
switchport port-security aging time 5

== Configure Route Summarization (EIGRP Example) ==
Reduces routing table size by advertising a single summary route instead of multiple specific networks.

interface GigabitEthernet0/0
ip summary-address eigrp 100 192.168.0.0 255.255.252.0

Replace **100** with your EIGRP AS number, and adjust the network address and subnet mask to match your summary range.

Main Page

2026-02-18T00:15:00Z

209.87.206.13:

Welcome to Lucca's Knowledgebase
<hr>

Windows: |
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]]

<hr>

Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf pdf] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf pdf] | [[Perform actions based on notification content]]

<hr>

Pentesting: | [[Performing a SYN flood attack]]

<hr>

MacOS: | [[OSX Commands]]

<hr>

Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]

<hr>

Python: | [[Math Operators]] | [[Python Examples|Examples]]

<hr>

Cisco: | [[Cisco Commands|Commands]] | [[Cisco Keyboard Shortcuts|Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]]

<hr>

Robotics: | [[Nao Robot]]

<hr>

Retro Tech: |
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf pdf]

<hr>

Digital Archives: |
[https://archive.org archive.org] | [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes kirb.feels archive] [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis]

<hr>

Open Source Intelligence: |
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]

<hr>

[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]

<hr>

WAP Arrangement

2026-02-04T02:32:03Z

209.87.206.13: Created page with "= Wi-Fi Access Point Placement for 2.4 GHz and 5 GHz = This page provides guidelines for placing Wi-Fi access points (APs) to optimize coverage and performance for both 2.4 GHz and 5 GHz bands. == Overview == Wi-Fi networks commonly operate on two frequency bands: 2.4 GHz and 5 GHz. Each band has different characteristics: {| class="wikitable" ! Feature !! 2.4 GHz !! 5 GHz |- | Range || Long, penetrates walls better || Short, limited range |- | Speed |..."

= Wi-Fi Access Point Placement for 2.4 GHz and 5 GHz =

This page provides guidelines for placing Wi-Fi access points (APs) to optimize coverage and performance for both 2.4 GHz and 5 GHz bands.

== Overview ==
Wi-Fi networks commonly operate on two frequency bands: 2.4 GHz and 5 GHz. Each band has different characteristics:

{| class="wikitable"
! Feature !! 2.4 GHz !! 5 GHz
|-
| Range || Long, penetrates walls better || Short, limited range
|-
| Speed || Slower, more crowded || Faster, less interference
|-
| Interference || Common (Wi-Fi, Bluetooth, microwaves) || Less crowded
|-
| Best Use || General coverage || High-speed connections nearby
|}

---

== General Placement Guidelines ==
# Place APs in a **central location** within the coverage area.
# Mount APs **high on walls or ceilings** for better signal distribution.
# Avoid obstacles such as **metal, mirrors, thick walls, and microwaves**.
# Consider **band steering** or separate coverage planning for 2.4 GHz and 5 GHz.

---

== Band-Specific Guidelines ==

=== 2.4 GHz ===
* Longer range; fewer APs needed.
* 10–15% coverage overlap is sufficient for roaming.
* Works well through walls and floors.
* Suitable for broad coverage areas.

=== 5 GHz ===
* Shorter range; APs should be closer to users.
* Direct line-of-sight provides best performance.
* 20–30% overlap recommended for seamless roaming.
* Ideal for high-density areas requiring fast connections.

---

== Channel Planning ==
* 2.4 GHz: Use channels **1, 6, or 11** (non-overlapping).
* 5 GHz: Use available channels avoiding DFS if devices do not support them.
* Proper channel planning reduces interference and improves performance.

---

== Practical Layout Tips ==
* **Small home**: One centrally located AP can cover both bands.
* **Medium home / small office**: Place one AP per floor; 2.4 GHz covers distant rooms, 5 GHz covers nearby rooms.
* **Large office / multi-floor building**: Conduct a site survey; place 5 GHz APs ~25–30 feet apart, 2.4 GHz APs further apart.

---

== References ==
* [Wi-Fi Alliance – Wi-Fi 6](https://www.wi-fi.org/discover-wi-fi)
* [Cisco – Wireless LAN Design Guidelines](https://www.cisco.com/c/en/us/solutions/enterprise-networks/wireless.html)

Main Page

2026-02-04T02:29:05Z

209.87.206.13:

Welcome to Lucca's Knowledgebase
<hr>

Windows: |
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]]

<hr>

Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf pdf] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf pdf] | [[Perform actions based on notification content]]

<hr>

Pentesting: [[Performing a SYN flood attack]]

<hr>

MacOS: | [[OSX Commands]]

<hr>

Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]

<hr>

Python: | [[Math Operators]] | [[Python Examples|Examples]]

<hr>

Cisco: | [[Cisco Commands|Commands]] | [[Cisco Keyboard Shortcuts|Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]]

<hr>

Robotics: | [[Nao Robot]]

<hr>

Retro Tech: |
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf pdf]

<hr>

Digital Archives: |
[https://archive.org archive.org] | [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes kirb.feels archive] [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis]

<hr>

Open Source Intelligence: |
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]

<hr>

[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]

<hr>

Cisco Commands

2026-02-04T01:01:13Z

209.87.206.13: /* Configure DHCP Snooping rate limiting */

Cisco Commands

2026-02-04T00:57:10Z

209.87.206.13:

Cisco Commands

2026-02-04T00:55:05Z

209.87.206.13:

Cisco Commands

2026-02-04T00:44:37Z

209.87.206.13: /* Spanning Tree */

Cisco Commands

2026-02-04T00:41:29Z

209.87.206.13: /* Encrypt Plaintext Passwords (Weak Encryption) */

Cisco Commands

2026-02-04T00:39:01Z

209.87.206.13:

Cisco Commands

2026-02-04T00:27:54Z

209.87.206.13: /* Port Security */