Tag Info

Hot answers tagged

22

What exactly do you need? wireshark - network sniffer/analyzer iftop - bandwidth usage darkstat - traffic analyzer nmap - network port scanner nessus - vulnerability scanner metasploit - penetration testing


18

There's a WIKI Entry about exactly this issue on the wireshark homepage. They also mention specifics about the loopback interface regarding Windows - you could be running just into that.


17

These are my general suggestions for this kind of process. I appreciate you'll have covered some of them already but its better to be told something twice than miss something important. These notes are orientated towards malware that's spreading on a LAN but could easily be scaled back to deal with more minor infections. Stopping the rot, and finding the ...


15

For a general sense of the scale of your problem netstat -s will track your total number of retransmissions. # netstat -s | grep retransmited 368644 segments retransmited For a deeper dive, you'll probably want to fire up Wireshark. In Wireshark set your filter to tcp.analysis.retransmission to see retransmissions by flow. That's the best option I ...


13

You can use one of the Sysinternals tools PSinfo: http://technet.microsoft.com/en-us/sysinternals/bb897550 PsInfo v1.77 - Local and remote system information viewer Copyright (C) 2001-2009 Mark Russinovich Sysinternals - www.sysinternals.com PsInfo returns information about a local or remote Windows NT/2000/XP system. Usage: psinfo [-h] ...


12

Zabbix works great and his extremely flexible and scalable, you may distribute nodes or proxies among your sites


12

As 3molo says. If you're intercepting the traffic, then port 443 is the filter you need. If you have the site's private key, you can also decrypt that SSL . (needs an SSL-enabled version/build of Wireshark.) See http://wiki.wireshark.org/SSL


12

I would setup a copy of smokeping on some system on your network. It doesn't ping every second, and you probably don't need it do. Instead it will periodically send out a burst of ~20 pings at the same time, and then count how many respond, and how fast each returns. The results are graphed. Here is results for my a system at home, over my Comcast ...


11

netstat -ptu will give you the owning process ids (along with standard netstat info) for all tcp and udp conections. (Normal users will not be able to id all processes.) If something is sending out a fair amount of constant traffic you should see it on Recv-Q or Send-Q columns 2 and 3 respectively. Examples: Recv-Q sudo watch -n .1 'netstat -tup | grep -E ...


10

It's an unsupported scenario because of the way PST files work: http://support.microsoft.com/kb/297019 Have you looked in Computer Management | Shared Folders yet? It might help identifying the culprit.


10

I watched this a while ago. It's 'A day in the life of Facebook operations'. They use cfengine2 (deployment), nagios (monitoring), ganglia (monitoring and trending) plus a lot of in-house tools. Funny to see some of the tools we use are used in such a massive scale (+60.000 servers)


10

4. Configure a switch port to be a monitoring port. This way you will get all traffic on that port. This Netgear model has this configuration option. It's called "port mirroring" on Netgear switches.


9

If you do have a spare PC smoothwall/ipcop is an excellent solution and the configuration/installation is a 10 minute job. I'd also recommend the advanced proxy add on.


9

Microsoft says pst files should not be stored on network drives, so the long term fix is move them off the network drives. In the sort term, you can configure a mirror port on your switch, and then run wireshark on a computer attached to that port for a packet analysis. The switch might also be able to show bandwidth usage per port on a web interface ...


9

You see the "incorrect" checksums due to a feature called TCP checksum offloading. The checksum fields for outgoing TCP packets are not pre-calculated by the operating system but set to 0 and left for calculation by the NIC processor. The Wireshark FAQ has a more detailed explanation.


9

On an rpm-based Linux distribution, you could run the following: ssh <user-who-can-run-rpm>@<remote.host> 'rpm -qa | sort' For a deb-based distribution, pass this to the ssh command: 'dpkg-query -l | sort' For Gentoo (per a supplied comment from Monksy): 'qpkg -I | sort' For Solaris: 'pkginfo -i | sort' And on AIX: 'lslpp -a all | ...


9

I prefer nethogs. It's a small ncurses-based console program that displays per-process network traffic status in a convenient way.


8

Try "The dude" - it's free and works... I'd recommend installing it on a VMware machine, as I find it leaves quite a footprint behind. Mike


8

You can use Computer Management to see who has the file open. On the server with the PST files, right click My Computer, Click Manage. Under Shared Files select Open Files. Quick and easy


8

You could use an application like wireshark and monitoring what network traffic is going between you and your database


8

How about MTR? # mtr -r serverfault.com HOST: gentoo Loss% Snt Last Avg Best Wrst StDev 1.|-- 192.168.0.1 0.0% 10 0.9 1.2 0.9 1.6 0.3 2.|-- 192.168.1.1 0.0% 10 1.9 2.2 1.6 4.1 0.7 3.|-- localhost 20.0% 10 28.3 48.5 6.5 98.6 30.0 | `|-- ...


8

Ifstat: rilindo@ubuntu:~$ sudo apt-get install ifstat [sudo] password for rilindo: Reading package lists... Done Building dependency tree Reading state information... Done The following NEW packages will be installed: ifstat 0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded. Need to get 23.4kB of archives. After this operation, 94.2kB ...


8

Another good one to look into is called iftop - which will show connections and bps and has some pretty decent features.


8

Yes, they can. And this question is off-topic and very unwelcome here. We are those administrators you try to circumvent.


8

Hostgroups and templates. Templates let you define classes for your hosts and services, e.g. "normal service", "critical service", "low-priority host". They also serve as a useful way to divide responsibilities if you've got multiple teams with different responsibilities, so you can have a "linux host" template and a "windows host" template, with each one ...


7

I'd recommend Smoothwall, which can handle reporting (through log files and/or its Web GUI) the sites visited and who visited them. Add on the bandwidthd plugin, and you can see what machine(s) is(are) using the most bandwidth, and what protocol they're using (HTTP, FTP, P2P, etc.).


7

I have had great success with the following packages. You do need to know about your network and some linux basics to get everything logged. You will need to log traffic for the ips on your network using the firewall to be able to get graphs for each of them. Cacti: http://www.cacti.net/ MRTG: http://oss.oetiker.ch/mrtg/ Zabbix: http://www.zabbix.com/ ...


7

Use the host_name directive in the service definition with an exclamation before the name of the host. For example: define service{ service_description CPU Stats servicegroups sysres use generic hostgroup_name linux host_name !server1 check_command check_iostat }


7

Maybe also the Nagios Fork Icinga is worth a look.


7

DHCP and DNS can be handled (and should be, if you're migrating) by AD. First things first...I think your question is kind of a jumble. You need to sit down, analyze the state of your network, identify what needs to be done, and break the tasks down into manageable chunks. No one here knows your specific needs and configuration, so we can't just design a ...



Only top voted, non community-wiki answers of a minimum length are eligible