iptraf & tcpdump

The iptraf command is interactive colorful IP LAN monitor. It is an ncurses-based IP LAN monitor that generates various network statistics including TCP info, UDP counts, ICMP and OSPF information, Ethernet load info, node stats, IP checksum errors, and others. It can provide the following info in easy to read format:

1. Network traffic statistics by TCP connection
2. IP traffic statistics by network interface
3. Network traffic statistics by protocol
4. Network traffic statistics by TCP/UDP port and by packet size
5. Network traffic statistics by Layer2 address

Exercise : Ip Traffic Monitor ---> eth1 [ethernet] network interface  

----------------------------------------------------------------------------------------------------------------------------------

The tcpdump is simple command that dump traffic on a network. However, you need good understanding of TCP/IP protocol to utilize this tool. For.e.g to display traffic info about DNS, enter:

# tcpdump -i eth1 'udp port 53'

Packages were kept back

Sometimes you'll run 'apt-get upgrade' in Debian or Ubuntu and you'll get a message stating that "the following packages have been kept back" which is annoying but here is a way to get around it.


The reason the packages were kept back is because they violate the below constraint. "dist-upgrade" is the correct method.

From the apt-get man page regarding: "`upgrade` under no circumstances are currently installed packages removed, or packages not already installed retrieved and installed. New versions of currently installed packages that cannot be upgraded without changing the install status of another package will be left at their current version."

"dist-upgrade intelligently handles changing dependencies with new versions of packages; apt-get has a "smart" conflict resolution system, and it will attempt to upgrade the most important packages at the expense of less important ones if necessary. So, dist-upgrade command may remove some packages."


Solution 1 : as root  apt-get dist-upgrade


Solution 2 : apt-get install [packages that are keep back]

Internet protocol suite

From Wikipedia, the free encyclopedia

IPTABLES

nmap being used by Trinity in The Matrix to detect ssh running on a vulnerable node before launching an attack on the sshv1 CRC32 flaw and gaining root to shut down the power grid.



Rule1 : Target REJECT do with a TCP-RESET

-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j REJECT --reject-with tcp-reset

result : 443/tcp closed https

nmon performance: A free tool to analyze AIX and Linux performance

debian apt-get install nmon 

http://www.cyberciti.biz/faq/nmon-performance-analyzer-linux-server-tool/

Java Nmon Analyser

http://sourceforge.net/projects/jnmonanalyser/files/