DELL RAC使用指南

DELL RAC使用指南
2006.04.11

Dell Remote Access Card III(DRAC III)、DRAC III/XT、DRAC 4、
Dell Embedded Remote Access Controller(ERA)和嵌入式远程访问选件
(ERA/O),以上控制器将被统称为"RAC".RAC用于为Dell PowerEdge系统提
供远程管理功能.

本例是Dell PowerEdge 2650,具体RAC就是ERA,为方便以后用RAC来替代ERA

安装或嵌入了RAC的系统将被称为管理型系统.
远程访问RAC的系统将被称为Management Station.
术语系统控制台是指系统的键盘、鼠标和显示器.

可以使用控制台重定向将带有RSC系统的显示器、键盘和鼠标重定向至
Management Station.方法如下:

打开或重新启动系统,出现F2相关信息时立即按F2键,
向下滚动并选择"Console Redirection"(控制台重定向),
将"Console Redirection"(控制台重定向)屏幕设置为以下设置:

"Console Redirection"(控制台重定向)RAC或COM2(视BIOS而定,其中一个选项可用)
"Remote Terminal Type"(远程终端类型)为ANSI或VT100/VT 220,视特定需要而定
"Redirection After Boot"(引导之后重定向)为"Disabled"(已禁用)

如果管理型系统是PowerEdge 1750,请执行以下附加步骤来启用串行/远程登录
控制台重定向;否则,按Esc键退出"System Setup"(系统设置)程序,并完成您系
统的BIOS串行/远程登录文本控制台配置.

向下滚动选择"Integrated Devices"(集成设备).
在子菜单中,向下滚动至"Serial Port 1"(串行端口 1)并设置为"Off"(关).
按Esc键退出系统设置程序以便完成系统设置程序配置.

一些型号的Dell PowerEdge系统(800,1425SC,1800,1850,1855,2800,2850,6800,
6850)上RAC的功能是由BMC来实现的.Dell PowerEdge系统底板管理控制器(BMC)
通过与主机板上的不同传感器通信来监视系统是否有严重事件,并在某些参数超
出其预置阈值时发出警报和日志事件.BMC支持工业标准的Intelligent Platform
Management Interface(IPMI)规范,可以实现远程配置、监测和恢复系统.

RAC通过与系统的ESM通信,可报告有关电压、温度和风扇速率的警告或错误.

此外,RAC可以记录系统崩溃的可能原因,并保存最新的崩溃屏幕(仅限于运行
Microsoft Windows操作系统的系统).

如果系统停机,RAC可以发出警报,并可以远程启动已关闭的系统.

可以通过集成网络适配器(从机器背面看在右下脚)将电子邮件信息或SNMP Trap发
送至Management Station,发出有关管理型系统中潜在问题的警报.

RAC网口(从机器背面看在右下脚网口)的默认IP地址是192.168.20.1/24,网关是
192.168.20.1,默认用户密码为root:calvin.可以在开机BIOS界面出现之后有个
Ctrl+D的提示符下修改RAC固件网口的IP配置.

RAC的网络功能包括SNMP Trap通知,电子邮件通知,RAC Web服务器,支持racadm的
服务端程序(监听tcp端口5869),ftp服务器.

可以使用racadm命令行公用程

序(RAC的命令行状态和配置公用程序,可以编写脚本)
来配置RAC并更新RAC固件.

查看RAC网口的网络配置
C:\WINNT\system32>racadm -r192.168.0.120 -uroot -pcalvin getconfig -g cfgLanNetworking
cfgNicEnable=1
cfgNicIpAddress=192.168.0.120
cfgNicNetmask=255.255.255.0
cfgNicGateway=192.168.0.1
cfgNicUseDhcp=0

查看RAC网口当前的网络配置
C:\WINNT\system32>racadm -r192.168.0.120 -uroot -pcalvin getconfig -g cfgCurrentLanNetworking
# cfgNicCurrentIpAddress=192.168.0.120
# cfgNicCurrentNetmask=255.255.255.0
# cfgNicCurremtGateway=192.168.0.1
# cfgNicCurrentDhcpWasUsed=0

修改RAC网口的网络配置
C:\WINNT\system32>racadm -r192.168.0.120 -uroot -pcalvin config -g cfgLanNetworking
-o cfgNicIpAddress 10.40.95.2
Object value successfully modified

C:\WINNT\system32>racadm -r192.168.0.120 -uroot -pcalvin config -g cfgLanNetworking
-o cfgNicGateway 10.40.95.254
Object value successfully modified

修改RAC网口当前的网络配置不成功
C:\WINNT\system32>racadm -r192.168.0.120 -uroot -pcalvin config -g cfgCurrentLanNetworking
-o cfgNicCurrentIpAddress 10.40.95.2
ERROR: cannot write to a read only object

重置RAC固件,使刚才修改的网络配置生效,默认racreset为软重置
C:\WINNT\system32>racadm -r192.168.0.120 -uroot -pcalvin racreset

查看RAC网口当前的网络配置
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin getconfig -g cfgCurrentLanNetworking
# cfgNicCurrentIpAddress=10.40.95.2
# cfgNicCurrentNetmask=255.255.255.0
# cfgNicCurremtGateway=10.40.95.254
# cfgNicCurrentDhcpWasUsed=0

查看RAC网口的网络配置
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin getconfig -g cfgLanNetworking
cfgNicEnable=1
cfgNicIpAddress=10.40.95.2
cfgNicNetmask=255.255.255.0
cfgNicGateway=10.40.95.254
cfgNicUseDhcp=0

修改设置使RAC固件串口生效,串口为COM2或RAC,这样就可以通过超级终端连上
COM2口或者RAC口
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin config -g
cfgSerial -o cfgSerialConsoleEnable 1
Object value successfully modified

修改设置使RAC固件网口远程Telnet服务生效,这样就可以telnet到RAC的网口地址了,
这个telnet服务程序特别不安全,任何随意的用户(包括root)和密码都可以登录(新的
RAC固件(3.35)已经改正了这个问题):
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin config -g cfgSerial
-o cfgSerialTelnetEnable 1
Object value successfully modified

查看RAC固件Serial配置组的信息,注意这里默认的速率为115200bps:
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin getconfig -g cfgSerial
cfgSerialBaudRate=115200
cfgSerialConsoleEnable=1
cfgSerialConsoleQuitKey=~.
cfgSerialConsoleIdleTimeout=0x12c
cfgSerialConsoleShellType=0x2
cfgSerialConsoleNoAuth=0
cfgSerialConsoleCommand=
cfgSerialTelnetEnable=1
cfgSerialConsoleColor=1
cfgSerialConsoleAnsi=1

硬重置RAC固件,使刚才修改的Serial配置生

效
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin racreset hard

Warning: Hard reset will destroy the PCI configuration space in the RAC.
A server reboot will be required in order to reconfigure this space
to allow normal activity.
Are you sure you want to proceed? (Yes/No) = Yes

为RAC固件Email报告设置远程SMTP服务器
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin config -g cfgRemoteHosts -
o cfgRhostsSmtpServerIpAddr 10.40.95.27
Object value successfully modified

使RAC固件中root用户的Email报告生效,并发往pupil@
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin config -g cfgUserAdmin -i 1 -o cfgUserAdminEmailEnable 1
Object value successfully modified

C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin config -g cfgUserAdmin -i 1 -o cfgUserAdminEmailAddress pupil@
Object value successfully modified

C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin config -g cfgUserAdmin -i 1 -o cfgUserAdminEmailCustomMsg Dell2650
Object value successfully modified

查看RAC固件中远程主机的配置
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin getconfig -g cfgRemoteHosts
cfgRhostsSmtpEmailEnable=1
cfgRhostsFloppyTftpEnable=0
cfgRhostsFwUpdateTftpEnable=1
cfgRhostsSmtpServerIpAddr=10.40.95.27
cfgRhostsFloppyTftpIpAddr=192.168.0.3
cfgRhostsFloppyTftpPath=bootimg.bin
cfgRhostsFwUpdateIpAddr=192.168.0.4
cfgRhostsFwUpdatePath=

查看RAC固件中root用户的配置
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin getconfig -g cfgUserAdmin -i 1
# cfgUserAdminIndex=1
cfgUserAdminUserName=root
cfgUserAdminPrivilege=0
cfgUserAdminAlertFilterRacEventMask=0x300000
cfgUserAdminAlertFilterSysEventMask=0x77777
cfgUserAdminPageNumericEnable=0
cfgUserAdminPageNumericNumber=
cfgUserAdminPageNumericMessage=SE
cfgUserAdminPageNumericHangupDelay=0x0
cfgUserAdminPageAlphaEnable=0
cfgUserAdminPageAlphaNumber=
cfgUserAdminPageAlphaProtocol=8N1
cfgUserAdminPageAlphaBaudRate=0x4b0
cfgUserAdminPageAlphaCustomMsg=
cfgUserAdminPageAlphaModemConnectTimeout=0x3c
cfgUserAdminPageAlphaPagerId=
cfgUserAdminPageAlphaPassword=
cfgUserAdminEmailEnable=1
cfgUserAdminEmailAddress=pupil@
cfgUserAdminEmailCustomMsg=Dell2650
cfgUserAdminPageModemInitString=AT+GCI=B5
cfgUserAdminPageModemPort=0x8

测试Email报告
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin testemail -i 1

本机10.40.95.27上显示,其中220 helo,250 helo,354 helo,250 helo为本人输入
C:\WINNT\system32>nc -vvnLp 25
listening on [any] 25 ...
connect to [10.40.95.27] from (UNKNOWN) [10.40.95.2] 4096
220 helo
HELO 10.40.95.2
250 helo
MAIL FROM:<>
250 helo
RCPT TO:
250 helo
DATA
354 helo
Subject: Alert from ERA: 10.40.95.2
To: pupil@
Reply-To: postmaster@10.40.95.27

Message: TEST PAGE Dell2650
Event: Email paging test to user 1
Date: 17-feb-2006
Time: 13:04:22
Severity: Info/Normal
Syst

em ID: 2101h
Model: PowerEdge 2650
BIOS version: A10
Asset tag:
Service tag: 3DXV71X
OS Type: 32-bit Windows 2000
Hostname: UNIC_DELL_3
OS Name: Microsoft Windows 2000 version 5.0, Build Number 2195 Service
Pack 4
ESM Version: 2.10

.
250 helo
QUIT
sent 54, rcvd 543
listening on [10.40.95.27] 25 ...

查看SNMP Trap的配置,注意此项在getconfig -fC:\rsc.txt中不存在,只有设置之后才会存在
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin getconfig -g cfgTraps -i 1
# cfgTrapsIndex=1
cfgTrapsDestIpAddr=
cfgTrapsEnable=0
cfgTrapsSnmpCommunity=
cfgTrapsFilterRacEventMask=0x300000
cfgTrapsFilterSysEventMask=0x77777

设置SNMP Trap生效,并发往主机10.40.95.27
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin config -g cfgTraps -i 1 -o cfgTrapsEnable 1
Object value successfully modified

C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin config -g cfgTraps -i 1 -o cfgTrapsDestIpAddr 10.40.95.27
Object value successfully modified

C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin config -g cfgTraps -i 1 -o cfgTrapsSnmpCommunity DRAC
Object value successfully modified

查看SNMP Trap报警的配置是否生效
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin getconfig -g cfgOobSnmp
cfgOobSnmpTrapsEnable=1
cfgOobSnmpAgentEnable=0

查看SNMP Trap的配置
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin getconfig -g cfgTraps -i 1
# cfgTrapsIndex=1
cfgTrapsDestIpAddr=10.40.95.27
cfgTrapsEnable=1
cfgTrapsSnmpCommunity=DRAC
cfgTrapsFilterRacEventMask=0x300000
cfgTrapsFilterSysEventMask=0x77777

测试SNMP Trap报警信息
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin testtrap -i 1

本机10.40.95.27上显示
C:\WINNT\system32>snmputil trap
snmputil: listening for traps...
Incoming Trap:
generic = 6
specific = 1001
enterprise = .dod.internet.private.enterprises.674.10892.2
agent = 10.40.95.2
source IP = 10.40.95.2
community = DRAC
variable = .dod.internet.private.enterprises.674.10892.2.5000.10.1.0
value = String UNIC_DELL_3
variable = .dod.internet.private.enterprises.674.10892.2.5000.10.2.0
value = ObjectID 0.0
variable = .dod.internet.private.enterprises.674.10892.2.5000.10.3.0
value = String Test Message: TEST TRAP
variable = .dod.internet.private.enterprises.674.10892.2.5000.10.4.0
value = Integer32 3
variable = .dod.internet.private.enterprises.674.10892.2.5000.10.5.0
value = Integer32 2
variable = .dod.internet.private.enterprises.674.10892.2.5000.10.6.0
value = String

打开RAC固件的snmp服务,字符串默认为public (这一项在新的RAC固件(3.35)中已经不存在,因此
RAC3.35不提供snmp服务):
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin config -g cfgOobSnmp -o cf
gOobSnmpAgentEnable 1
Object value successfully modified

查看RAC固件SNMP服务

的配置
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin getconfig -g cfgOobSnmp
cfgOobSnmpTrapsEnable=1
cfgOobSnmpAgentEnable=1

远程关闭系统(包括操作系统和BIOS系统)
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin serveraction powerdown

远程启动系统
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin serveraction powerup

将RAC固件中的配置导出到本地机器C:\rac.txt文件中
C:\WINNT\system32>racadm -v 0x3 -r10.40.95.2 -uroot -pcalvin getconfig -fC:\rac.txt
Generating configuration file, please wait...
Configuration file created successfully

可与racadm -v 0x3 -r10.40.95.2 -uroot -pcalvin config -fC:\rac.txt配合使用

查看系统信息
C:\WINNT\system32>racadm -v 0x3 -r10.40.95.2 -uroot -pcalvin getsysinfo

RAC Information:
RAC Date/Time = DSU+19:08:07
Firmware Version = 2.10 (Build 02.21)
Firmware Updated =
Hardware Version = A02
Current IP Address = 10.40.95.2
Current IP Gateway = 10.40.95.254
Current IP Netmask = 255.255.255.0
DHCP enabled = FALSE
PCMCIA Card Info = N/A

System Information:
System ID = 2101h
System Model = PowerEdge 2650
BIOS Version = A10
Asset Tag =
Service Tag = 3DXV71X
Hostname = UNIC_DELL_3
OS name = Microsoft Windows 2000 version 5.0, Build Number 2195 Service Pack 4
ESM Version = 2.10

Watchdog Information:
Recovery Action = No Action
Present countdown value = 0
Initial countdown value = 6553

RAC Firmware Status Flags:
Global Reset Pending Flag = 0

查看RAC dump信息
C:\WINNT\system32>racadm -v 0x3 -r10.40.95.2 -uroot -pcalvin racdump

/*******************************************************************
*
* racdump command
*
********************************************************************/

/*******************************************************************
* getsysinfo
********************************************************************/

RAC Information:
RAC Date/Time = DSU+19:09:08
Firmware Version = 2.10 (Build 02.21)
Firmware Updated =
Hardware Version = A02
Current IP Address = 10.40.95.2
Current IP Gateway = 10.40.95.254
Current IP Netmask = 255.255.255.0
DHCP enabled = FALSE
PCMCIA Card Info = N/A

System Information:
System ID = 2101h
System Model = PowerEdge 2650
BIOS Version = A10
Asset Tag =
Service Tag = 3DXV71X
Hostname = UNIC_DELL_3
OS name = Microsoft Windows 2000 version 5.0, Build Number 2195 Service Pack 4
ESM Version = 2.10

Watchdog Information:
Recovery Action = No Action
Present countdown value = 0
Initial countdown value = 6553

RAC Firmware Status Flags:
Global Reset Pending Flag = 0

/*******************************************************************
* coredump
********************************************************************/
FW d_cmdCoreDump: No CORE dump available
NEXTRECORD=0x00000000

/***********************************************

********************
* memmap
********************************************************************/

0x02000000 = MemoryLimit (top of memory)
Base Addr Size
0x01f00000 0x00100000 = RamDiskTmpBase
0x01b80000 0x00380000 = RamDiskFWUpdateBase
0x01a00000 0x00180000 = RamDiskRemoteFloppyBase(RamDiskBase)
0x01980000 0x00080000 = SharedMemBase
0x01970000 0x00010000 = ExpansionRomBase
0x01950000 0x00020000 = UartGsBlkBase
0x01910000 0x00040000 = MacBufferBase
0x01900000 = MemoryBaseNonCacheable
0x0139b9ac = MemoryBaseFree
0x01200000 = MemoryBaseWriteable
0x01000000 = MemoryBaseReadonly
0x01000000 = RAM_size

Gap of unused memory between MemoryBaseNonCacheable and MacBufferBase
0x00010000 = MemoryBaseNonCacheable base, up to MacBufferBase

Data Base Stats
0x0000644a 03286272 = number of used blocks/flash space
0x00002b92 01427712 = number of free blocks/flash space
0x0000065e = number of valid database objects/

/*******************************************************************
* netstat
********************************************************************/

Current IP: 10.40.95.2

Specify NI number for more details

Routing table:
==============

Destination Gateway Netmask Flags Interface

default 10.40.95.254 0.0.0.0 UG 1
10.40.95.0 10.40.95.2 255.255.255.0 U 1
127.0.0.1 127.0.0.1 0.0.0.0 U 20
192.168.234.235 192.168.234.236 0.0.0.0 U 2

/*******************************************************************
* getssninfo
********************************************************************/

Session table summary status:
0 Valid
16 Available


通过超级终端连上COM2口时候的信息:
Dell Embedded Remote Access Controller (ERA)
Firmware Version 2.10 (Build 02.21)
Login: root
Password:
[root]# help
?
help -- displays the commands with a one-line description
help -- displays usage statement for specified command
logout
quit
exit -- logs the user out and then prints a new login prompt
getsysinfo -- display general RAC and system information
serveraction -- execute a graceful or hard server reset or power-on/off/cycle
connect -- connect to com2 serial port or video text console
racadm -- excute a racadm subcommand (allowed only for username:root)
[root]# getsysinfo

RAC Information:
RAC Date/Time = DSU+10:14:48
Firmware Version = 2.10 (Build 02.21)
Firmware Updated =
Hardware Version = A02
Current IP Address = 10.40.95.2
Current IP Gateway = 10.40.95.254
Current IP Netmask = 255.255.255.0
DHCP enabled = FALSE
PCMCIA Card Info = N/A

System Information:
System ID = 2101h
System Model = PowerEdge 2650
BIOS Version = A10
Asset Tag =
Service Tag

= 3DXV71X
Hostname = UNIC_DELL_3
OS name = Microsoft Windows 2000 version 5.0, Build Number 2195 Service Pack 4
ESM Version = 2.10

Watchdog Information:
Recovery Action = No Action
Present countdown value = 0
Initial countdown value = 6553

RAC Firmware Status Flags:
Global Reset Pending Flag = 0

[root]# serveraction powerup
[root]# quit

这是telnet连上去时候的信息:
Dell Embedded Remote Access Controller (ERA)
Firmware Version 2.10 (Build 02.21)
Login: root
Password:
[root]# help
?
help -- displays the commands with a one-line description
help -- displays usage statement for specified command
logout
quit
exit -- logs the user out and then prints a new login prompt
getsysinfo -- display general RAC and system information
serveraction -- execute a graceful or hard server reset or power-on/off/cycle
connect -- connect to com2 serial port or video text console
racadm -- excute a racadm subcommand (allowed only for username:root)
[root]#connect com2

这时会出现新的界面:
Connected to com2. To end, use the key sequence "~.".


Press the spacebar to pause...

按~.回退到telnet界面
B[root]#

下面是nmap扫描的结果
C:\WINNT\system32>nmap -vvn -sT -p 1-65535 10.40.95.2

Starting nmap 3.50 ( /nmap ) at 2006-02-17 15:27
中国标准时间
Host 10.40.95.2 appears to be up ... good.
Initiating Connect() Scan against 10.40.95.2 at 15:27
Adding open port 5900/tcp
Adding open port 23/tcp
Adding open port 5859/tcp
Adding open port 21/tcp
Adding open port 5901/tcp
Adding open port 443/tcp
Adding open port 5869/tcp
Adding open port 80/tcp
Adding open port 5860/tcp
The Connect() Scan took 16564 seconds to scan 65535 ports.
Interesting ports on 10.40.95.2:
(The 65526 ports scanned but not shown below are in state: filtered)
PORT STATE SERVICE
21/tcp open ftp
23/tcp open telnet
80/tcp open http
443/tcp open https
5859/tcp open unknown
5860/tcp open unknown
5869/tcp open unknown
5900/tcp open vnc
5901/tcp open vnc-1

Nmap run completed -- 1 IP address (1 host up) scanned in 16570.453 seconds

C:\WINNT\system32>nmap -vvn -sU -p 1-65535 10.40.95.2

Starting nmap 3.50 ( /nmap ) at 2006-02-17 15:47
中国标准时间
Host 10.40.95.2 appears to be up ... good.
Initiating UDP Scan against 10.40.95.2 at 15:47
The UDP Scan took 382 seconds to scan 65535 ports.
Adding open port 161/udp
Interesting ports on 10.40.95.2:
(The 65534 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
161/udp open snmp

Nmap run completed -- 1 IP address (1 host up) scanned in 388.625 seconds


C:\WINNT\system32>nmap -vvn -O 10.40.95.2

Starting nmap 3.50 ( /nmap ) at 2006-02-17 15:29
中国标准时间
Host 10.40.95.2 appears to be up ... good.
Initiating SYN Stealth

Scan against 10.40.95.2 at 15:29
Adding open port 21/tcp
Adding open port 23/tcp
Adding open port 5901/tcp
Adding open port 80/tcp
Adding open port 443/tcp
Adding open port 5900/tcp
The SYN Stealth Scan took 10 seconds to scan 1659 ports.
For OSScan assuming that port 21 is open and port 1 is closed and neither are firewalled Interesting ports on 10.40.95.2:
(The 1653 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
21/tcp open ftp
23/tcp open telnet
80/tcp open http
443/tcp open https
5900/tcp open vnc
5901/tcp open vnc-1
Device type: telecom-misc|switch|hub|remote management
Running: Nortel embedded, NTT embedded, 3Com embedded, Cisco embedded, Enterasys
embedded, HP embedded
OS details: Nortel CallPilot 100 voicemail system, 3Com Superstack 3 switch, Ent
erasys switch, HP TopTools remote control card, or Cisco 1538M hub
OS Fingerprint:
TSeq(Class=64K%IPID=I%TS=U)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)

TCP Sequence Prediction: Class=64K rule
Difficulty=1 (Trivial joke)
TCP ISN Seq. Numbers: 3443E201 3444DC01 3445D601 3446D001 3448C401 3449BE01
IPID Sequence Generation: Incremental

Nmap run completed -- 1 IP address (1 host up) scanned in 16.812 seconds

升级RAC固件的方法
首先自己机器开启tftpd服务,然后tftpd主目录下放DRAC固件文件firmimg.bm1
然后使用racadm来升级
C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin fwupdate -g -u -a 10.40.95.27 -d /
Loading file from TFTP server. Please wait...
Firmware update completed successfully

C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin racreset hard

Warning: Hard reset will destroy the PCI configuration space in the RAC.
A server reboot will be required in order to reconfigure this space
to allow normal activity.
Are you sure you want to proceed? (Yes/No) = yes

C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin getsysinfo

RAC Information:
RAC Date/Time = DSU+09:32:53
Firmware Version = 3.35 (Build 11.15)
Firmware Updated = DSU+10:25:06
Hardware Version = A02
Current IP Address = 10.40.95.2
Current IP Gateway = 10.40.95.254
Current IP Netmask = 255.255.255.0
DHCP enabled = FALSE
Current DNS Server 1 = 10.30.1.9
Current DNS Server 2 = 10.30.1.10
DNS Servers from DHCP = FALSE
PCMCIA Card Info = N/A

System Information:
System ID = 2101h
System Model = PowerEdge 2650
BIOS Version = A10
Asset Tag =
Service Tag = 3DXV71X
Hostname = UNIC_DELL_3
OS name = Microsoft Windows 2000 version 5.0, Build Number 2195 Servic

e Pa
ck 4
ESM Version = 3.35

Watchdog Information:
Recovery Action = No Action
Present countdown value = 0
Initial countdown value = 6553

RAC Firmware Status Flags:
Global Reset Pending Flag = 0

C:\WINNT\system32>racadm -r10.40.95.2 -uroot -pcalvin getconfig -fC:\rac3.35.txt

Generating configuration file, please wait...
Configuration file created successfully

更新完RAC固件后telent进系统看一看
Dell Embedded Remote Access Controller (ERA)
Firmware Version 3.35 (Build 11.15)
Login: root
Password:
[root]# help
?
help -- displays the commands with a one-line description
help -- displays usage statement for specified command
logout
quit
exit -- logs the user out and then prints a new login prompt
setled -- set the state of the LEDs on a module
getled -- display the LED settings on a module
getsysinfo -- display general RAC and system information
getmodinfo -- get module config and status information
getsensors -- display RAC sensor readings and information >
getsensorinfo-- get sensor status for the specified sensors
serveraction -- execute a graceful or hard server reset or power-on/off/cycle
getraclog -- display RAC Log entries
getraclog -i -- display the total number of entries in the RAC Log
gettracelog -- display Trace Log entries
gettracelog -i -- display numbers of entries in the Trace Log
settracelog -- set Trace Log flags
settracelog -s -- display the current Trace Log setting
getsel -- displays SEL entries
getsel -i -- displays the total number of entries in the system event log
connect -- connect to com2 serial port or video text console
racadm -- execute a racadm subcommand
[root]#

然后用nmap再扫描一下RAC系统

C:\WINNT\system32>nmap -vvn -sT -p 1-65535 10.40.95.2

Starting nmap 3.50 ( /nmap ) at 2006-02-25 14:29
中国标准时间
Host 10.40.95.2 appears to be up ... good.
Initiating Connect() Scan against 10.40.95.2 at 14:30
Adding open port 5860/tcp
Adding open port 443/tcp
Adding open port 5900/tcp
Adding open port 5869/tcp
Adding open port 23/tcp
Adding open port 5901/tcp
Adding open port 5859/tcp
Adding open port 80/tcp
Bumping up senddelay by 10000 (to 10000), due to excessive drops
Bumping up senddelay by 20000 (to 30000), due to excessive drops
The Connect() Scan took 90352 seconds to scan 65535 ports.
Interesting ports on 10.40.95.2:
(The 65527 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
23/tcp open telnet
80/tcp open http
443/tcp open https
5859/tcp open unknown
5860/tcp open unknown
5869/tcp open unknown
5900/tcp open vnc
5901/tcp open vnc-1

C:\WINNT\system32>nmap -vvn -sU -p 1-65535 10.40.95.2

Starting nmap 3.50 ( /nmap ) at 2006-02-25 14:

30
中国标准时间
Host 10.40.95.2 appears to be up ... good.
Initiating UDP Scan against 10.40.95.2 at 14:30
The UDP Scan took 315 seconds to scan 65535 ports.
Adding open port 35343/udp
Adding open port 65173/udp
Interesting ports on 10.40.95.2:
(The 65533 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
35343/udp open unknown
65173/udp open unknown

Nmap run completed -- 1 IP address (1 host up) scanned in 323.000 seconds


C:\WINNT\system32>nmap -vvn -O 10.40.95.2

Starting nmap 3.50 ( /nmap ) at 2006-02-25 14:30
中国标准时间
Host 10.40.95.2 appears to be up ... good.
Initiating SYN Stealth Scan against 10.40.95.2 at 14:30
Adding open port 5901/tcp
Adding open port 443/tcp
Adding open port 80/tcp
Adding open port 5900/tcp
Adding open port 23/tcp

The SYN Stealth Scan took 15 seconds to scan 1659 ports.
For OSScan assuming that port 23 is open and port 1 is closed and neither are firewalled
Interesting ports on 10.40.95.2:
(The 1635 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
23/tcp open telnet
36/tcp filtered unknown
80/tcp open http
273/tcp filtered unknown
389/tcp filtered ldap
443/tcp open https
473/tcp filtered hybrid-pop
565/tcp filtered whoami
650/tcp filtered unknown
743/tcp filtered unknown
869/tcp filtered unknown
958/tcp filtered unknown
986/tcp filtered unknown
987/tcp filtered unknown
1366/tcp filtered netware-csp
1664/tcp filtered netview-aix-4
2025/tcp filtered ellpack
2064/tcp filtered dnet-keyproxy
2766/tcp filtered listen
4132/tcp filtered nuts_dem
4480/tcp filtered proxy-plus
5632/tcp filtered pcanywherestat
5900/tcp open vnc
5901/tcp open vnc-1
No exact OS matches for host (If you know what OS is running on it, see /cgi-bin/nmap-submit.cgi).
TCP/IP fingerprint:
SInfo(V=3.50%P=i686-pc-windows-windows%D=2/25%Time=43FFF99C%O=23%C=1)
TSeq(Class=TR%IPID=RD%TS=U)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T1(Resp=Y%DF=N%W=1000%ACK=O%Flags=AS%Ops=M)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)


TCP Sequence Prediction: Class=truly random
Difficulty=9999999 (Good luck!)
TCP ISN Seq. Numbers: 7650C216 C076D750 3D400B77 193D7440 F119B03D
IPID Sequence Generation: Randomized

Nmap run completed -- 1 IP address (1 host up) scanned in 31.796 seconds