Analyse network traffic using tcpdump and tcpstat

The other day I was doing a set of system programming experiments which required me to generate graphs of network traffic per second between two hosts.

Though I knew wireshark was one reliable automated tool with a pretty GUI, I was in search of some better tool that could give me exact stats, rather exact distribution of the packets recieved per second by one host from the other host.

Searching over the net I tumbled upon '''tcpdump''', which has the capability to "sniff" packets over LAN or any localized network.

At first I tried running it by making it catch hold of all the packets that it could get a hand on. And that included network traffic of Office of the HOD of my college :P , and packets of some three or four other Professors. Though I didn't try and read the contents of the packets, i strongly believe tcpdump can be used to do that in verbose mode using vvv option. But thats something I'll try some other day.  

Well it was fun using it in amorous mode (yes thats the exact term given to listening to all the packets that are circulating in the network), but due to shortage of time and the perennial project advisor's pressure, I had to abstain myself from getting adventurous.

Comming back to tcpdump option - I used the following command to analyze the traffice between two hosts ::

tcpdump -f -n -S host $host1 and host $host2 -w file1.cap

This results in the generation of a binary file that can be read by tcpdump using the following command ::


tcpdump -r file1.cap

So far so good. But there was one problem. My intention was to give a comprehensive time varied traffic rate between two hosts. and tcpdump gave me a bunch of packets with their sizes. So creating a assorted list of packets and bandwidth usage per second would have required me to write a new script.

 This is when tcpstat came to the rescue. Using tcpstat, we can read the binary file (created above by the tcpdump command) and get a time sliced version of the network traffic using the following command

tcpstat -r file1.cap $timeslice

timeslice denotes the time scale on which packets are  analysed. for my purpose I set it to 5.

This blog in no means is comprehensive and I would strongly advise the reader to look at man page for tcpdump and tcpstat.

Notes::

How do we run tcpdump as a non-sudo user?

groupadd tcpdump

addgroup <username> tcpdump

chown root.tcpdump /usr/sbin/tcpdump

chmod 0750 tcpdump

setcap "CAP_NET_RAW+eip" /usr/sbin/tcpdump

==Don Jaffer==

UBUNTU ctrl key doesnt work on Vncviewer

its a gnome problem.

goto :  System -> Configuration tools ->  /desktop/gnome/peripherals/mouse/locate_pointer

unmark the checkbox. done.

Well for a strange reason sometimes this may not work.. So for that you need to install kde in Ubuntu.

This can be done using apt-get. No need to install kubuntu or anything.

Passwordless ssh into a server

You have a machine to which you have to login all the time. and that includes entering your password to authenticate yourself to the server. Taxing! isint it??

A simple quirk is to make yourself "known" to the server so that it doesnt ask you to authenticate yourself everytime you login to the server...

2 steps , thats all you need baby!

* ssh-keygen
* ssh-copy-id <servername>

Consider Host A and Host B. Host A is your local computer and Host B is your Server.

'''On Host A'''
 ssh-keygen
this will create two keys id_rsa and id_rsa.pub in your local machine.

'''On Host A'''
ssh-copy-id mcs112578@palasi.cse.iitd.ac.in
this will copy the id_rsa.pub file into the authenticate keys. Done!

Now try ssh ing into the Server... see the difference !! (No password required !!)

==Don Jaffer==

Linux Shortcuts : Open terminal - Maximize Terminal

<note>
I am mentioning the default keyboard shortcuts as available in Ubuntu, you can change it going into System > Preferences > Keyboard Shortcuts
</note>

Open the terminal using the shortcut
            Ctrl + Alt + T
Maximise by pressing the 3 keys in the following sequece (Note that timing and sequence is important here, you might take a little time to get a hang of it)

Press
             Alt + SpaceBar
one after the other in quick succession

Press
             'X'
after releasing Spacebar .

Vim Command to split the screen

To Split the screen in vim:

open the file in vim
   vim abc.txt

to split the screen

ESC
:sp

This is the default way to split the screen and results in the screen being split horizontally.

ESC
:vsp

This is used to split the screen vertically.
 
to switch Control between two screens

Ctrl + W +W (Hit W twice)

FIREBUG - Addon of Firefox to View WebPage Source

I just started developing a webpage for my college project and was browsing through the net for some really good web interfaces.
I even came across quite a few web-pages, and tried to get the source code from the standard Tools>> WebDeveloper >> Source Code Menu.

Though getting the code was easy, getting which part of the code corresponded to which part if the webpage was very taxing.

After racking my brain through a number of websites, one of my friends suggested an awesome addon of firefox that can help you to understand the code of a webpage.

its called FIREBUG!!

All you need to do is add the Add-On to firefox, and click on whichever object's code you wish to see in the webpage.

The code corresponding to the tool gets displayed at the bottom of the page, and even if there is .css associated with the page, you can view that in the other page that is opened.

Ill elaborate on my findings after exploring more on Firebug.

Till then ... bbye!