Network Traffic Analysis
ntec93:/tmp> ftp ntec94
Connected to ntec94.
220 ntec94 FTP server (Version wu-2.6.0(1) Mon Feb 28 10:30:36 EST 2000) ready.
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (ntec94:root): user1
331 Password required for user1.
Password:
230 User user1 logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd /tmp
250 CWD command successful.
ftp> bin
200 Type set to I.
ftp> get pkg.tar /dev/null
local: /dev/null remote: pkg.tar
200 PORT command successful.
150 Opening BINARY mode data connection for pkg.tar (41922560 bytes).
226 Transfer complete.
41922560 bytes received in 5.3 seconds (7.7e+03 Kbytes/s)
You may just use the ttcp to measure network throughput between two points.
The location of the ttcp is at /usr/local2/bin/ttcp
At the receive side,
ttcp -r -s
At the send side,
ttcp -t -s receive_side_host_name
For example,
ntec94:/root> ttcp -t -s ntec93 ttcp-t: buflen=8192, nbuf=2048, align=16384/0, port=5001 tcp -> ntec93 ttcp-t: socket ttcp-t: connect ttcp-t: 16777216 bytes in 2.05 real seconds = 7978.76 KB/sec +++ ttcp-t: 2048 I/O calls, msec/call = 1.03, calls/sec = 997.35 ttcp-t: 0.0user 0.4sys 0:02real 22% 0i+0d 0maxrss 0+2pf 0+0cswWe can define the buffer length and number of buffer too.
ntec94:/root> ttcp -t -s -n 2048 -l 65535 ntec93 ttcp-t: buflen=65535, nbuf=2048, align=16384/0, port=5001 tcp -> ntec93 ttcp-t: socket ttcp-t: connect ttcp-t: 134215680 bytes in 16.03 real seconds = 8177.26 KB/sec +++ ttcp-t: 2048 I/O calls, msec/call = 8.01, calls/sec = 127.77 ttcp-t: 0.0user 2.3sys 0:16real 14% 0i+0d 0maxrss 0+16pf 0+0cswDo several ftp and ttcp testing with your partner hosts and post the results on your web pages.
Here are some basic examples:
| tcpdump | dump all packets |
| tcpdump -e | dump the packet header too |
| tcpdump -ex | dump the packet header and the packet content in hex |
| tcpdump -exa | dump the packet header and the packet content in hex and ascii |
| tcpdump -c 500 | dump 500 packets and exit |
| tcpdump -c 500 -w dump.log | dump 500 packets and write it to dump.log file |
| tcpdump -r dump.log | read the packets from dump.log rather than the network interface |
| tcpdump tcp | dump tcp packets only |
| tcpdump udp | dump udp packets only |
| tcpdump -ex broadcast | dump broadcast packets only with packet header and content |
| tcpdump -exs 500 | dump packets header and content with packet length up to 500 bytes.
The defualt display packet length is 64 |
| tcpdump greater 512 | dump packets whose packet length greater than 512 |
| tcpdump less 512 | dump packets whose packet length lesser than 512 |
| tcpdump host ntec23 | dump packets from and to ntec23 host only |
| tcpdump port 21 | dump ftp packets only |
tcpdump has many filter funtions to dump packets that you are interested in. For more infomration, please "man tcpdump". If you want to dump the content in the better ascii code, you may try "tcpdump -xl|tcpf" where tcpf is located at /usr/local2/bin/tcpf.
As you access your host through remote rlogin, please exclude the gateway host that you use to login your host. (e.g. tcpdump host not ntec4)
Please use the tcpdump at /usr/local2/bin/tcpdump which is more updated than /usr/sbin/tcpdump
The output of tcpdump is protocol dependent. Let's discuss the most three common protocols.
ARP
e.g. csh> tcpdump -e arp 11:37:13.054714 0:50:56:49:0:63 Broadcast arp 60: arp who-has ntec3-36 tell ntec1-36 11:37:13.051355 0:50:56:49:0:62 0:50:56:49:0:63 arp 60: arp reply ntec3-36 is-at 0:50:56:49:0:62The first field is time stamp (11:37:13.054714)
The second field is the hardware addrress of the source hosts
The third field is the hardware addrress of the destination hosts
The first line ntec1-36 broadcast the arp to ask for ntec3-36 hardware address. While the hardware address of ntec1-36 is 0:50:56:49:0:63
The second line ntec3-36 (with the hardware address 0:d0:9:28:f9:f9) tell ntec1-36 its hardware address 0:50:56:49:0:62
TCP
Flags are some combination of S (SYN), F (FIN), P (PUSH) or R (RST) or a single `.' (no flags).
Data-seqno describes the portion of sequence space covered by the data in this packet. The notation is `first:last(nbytes)' which means `sequence numbers first up to but not including last which is nbytes bytes of user data
Ack is sequence number of the next data expected the other direction on this connection.
Window is the number of bytes of receive buffer space available the other direction on this connection.
Urg indicates there is `urgent' data in the packet.
Options are tcp options enclosed in angle brackets
(e.g.,< mss 1024 >).
The (DF) at the end stands for don't fragement flag
Src, dst and flags are always present. The other fields depend on the contents of the packet's tcp protocol header and are output only if appropriate.
UDP
Assignment
tcpdump -er dumpfile broadcast >> dump.html tcpdump -r dumpfile host your_partner_host and port finger >> dump.html tcpdump -r dumpfile host your_partner_host and port ftp >> dump.html tcpdump -r dumpfile host your_partner_host and port telnet >> dump.html tcpdump -r dumpfile port 53 >> dump.html tcpdump -r dumpfile udp and port 2049 >> dump.html tcpdump -r dumpfile port smtp >> dump.html
tcpdump -s 1600 -c 1000 -w 1000dump
/usr/local2/bin/snort -qvr 1000dump | tail -50