Tag Info

Hot answers tagged

22

You can use nmap 5.0 with --traceroute option. You will also get a portscan for free :). If you want to test a specific port, you can use -p port option. (You should also use -Pn option so that nmap doesn't try to do a regular ICMP probe first). This is an example: $ sudo nmap -Pn --traceroute -p 8000 destination.com PORT STATE SERVICE 8000/tcp open ...


14

Given an IP address, you should be able to find the MAC address of the corresponding host. arp -a On both Windows and Linux will show you the arp cache of that host, mapping IPs to MAC addresses. (Note that this will need to be run on a machine that is on the same IP subnet as the machine you are trying to find). Once you have the MAC address, log on to ...


13

You don't need any third party software. You need to turn on object access auditing and set the auditing options on the file(s) and or folder(s) you want to monitor. This article explains the process for Windows XP but it's the same for W2K3. http://support.microsoft.com/kb/310399


12

Yep, that'll about do it for you. Using the -T{traceflag} startup parameter, that is.


9

This is the way I use these words. Others may have additional or different usages. Depending on the job at hand, I will use the terms differently. Development teams and operations teams have different needs an usage. Monitoring is monitoring. Usually it is ongoing, and preferably automated. Open source tools like Munin, Nagios, and MRTG fall into this ...


8

If you have CDP enabled and a recent IOS, a nice, fast way to find where a PC is plugged into is by MAC. Use this command on the Cisco router's CLI: traceroute mac xxxx.xxxx.xxxx xxxx.xxxx.xxxx Where xxxx.xxxx.xxxx is the MAC address of the PC. If you don't know the MAC, I would look in the arp-cache for the IP and find the MAC that way. You may want ...


7

It looks like gmail won't show the IP if the message was sent from the web interface, but messages sent from an email program, using gmail's SMTP server will have the sending IP in the mail headers.


5

Looking at an email from y'day sent from Gmail I'm not seeing the sender's IP anywhere in the transport header (just one Gmail server). Google has it, no doubt, but it would probably take getting a subpoena involved to get it.


5

If you've got a non-Windows machine, whois <ip> is your first step. This will tie the IP to a network and possibly even supply you with an 'abuse' contact, usually an email address. You can email an abuse report there. You can also try nslookup <ip> to get a domain name, and look that up on abuse.net. If you're running Windows start with ARIN's ...


5

Something that I learned the hard way is that you have to have semicolons before each trace flag. For example, if you were enabling logging of deadlock info to file, your example would become... -dD:\MSSQL10.MSSQLSERVER\MSSQL\DATA\master.mdf;- eD:\MSSQL10.MSSQLSERVER\MSSQL\Log\ERRORLOG;- lD:\MSSQL10.MSSQLSERVER\MSSQL\DATA\mastlog.l ...


5

In 99% of cases, the penultimate hop of a traceroute will not be the default gateway of the destination host. This is because of the way that traceroute works. All IP packets have a -somewhat misnamed- time-to-live (TTL) field. This field is decremented by one by every router that forwards a packet. If a router decrements the TTL to 0, it drops the packet ...


5

Seems like a job for SystemTap, the SystemTap beginners guide by Red Hat has some disk and IO sample scripts to get you started as does sourceware.org.


4

Not quite a dupe, but there's a similar question here, which has some suggestions about mapping an IP address to a switch port. In this case, it sounds like the best option is to identify all switch ports that are connected to devices you know about. My suggestions for this (assuming Cisco managed routers/switches): Identify known devices From your first ...


4

I found the answer myself after digging around some more. The directory C:\Windows\System32\LogFiles\WMI\RtBackup stores ETW trace files (extension .etl) for real time event trace sessions. Looking into the RtBackup directory is a little difficult because by default only System has permissions, but my application SetACL Studio can display the contents ...


4

As others have mentioned, there is no direct way to determine what IP is connected to a certain switch port. The reason is that an Ethernet switch works at L2 of the OSI Model, and typically does not inspect higher level layers (Layer 3 -> IP Address). (There are some exceptions in newer hardware) One important note, to use the ping / ARP trick you'll ...


3

If using dig: dig +trace .... otherwise, run Wireshark to capture the packets.


3

Check the ARP cache on your switch(es) to find the MAC and Switch Port associated with that IP of the device. This articles should help you: http://www.petri.co.il/csc_arp_cache.htm http://ccnpsecurity.blogspot.com/2011/11/using-mac-address-table-and-arp-cache.html


3

The ISP that owns the IP is the only group that really know the identity of the person registered to an IP. The best info you can hope for is what you can get from dnsstuff. If the matter is serious and you want something done about it, then your only option would be to report it to the police. You could drop everything from that IP address in your ...


3

Mail servers hide their senders addresses, especially if they use 'web mail'. In email exchange its server to server and the client always retrieves their email from their server. When they send an email they don't send it directly to googles mail server but it gets sent to their mail server who than hands it off to google. Here is an example of an exchange ...


3

Spiceworks is free and will automatically create a nice map of all components on your network, complete with name, IP, and traffic. Its very easy to use also. http://www.spiceworks.com/


3

CiscoWorks, or whatever they call it now, will definitely do this for you. There are also SNMP OIDs that can enumerate the ports, the port status, and the CAM table. This will, at the very least, tell you which switchport a MAC address is on. Depending on your switch model you may also be able to view the ARP table. I would start out by searching for ...


3

All sorts of things -- what OS your machine (or router -- whatever's directly connected to that IP address) is running, what services might be running on there, anything that can be determined by talking to the services provided on that IP address (Windows file sharing is the best one, but even a mailserver or FTP server can provide all sorts of info). More ...


2

A TCP trace works in much the same way as a more traditional trace, except that instead of sending out ICMP ECHO or UDP packets (which are often blocked by firewalls and load balancers) with an increasing TTL (time-to-live) in each subsequent batch of packets, it sends out TCP SYN packets, again with an ever-increasing TTL until a response is received from ...


2

Okay, well it looks to me like the latency comes in with the TATA communications network. So your provider KEMS Peers only with TATA communications. If another ISP peers with a different provider in your area (Kuwait?) then maybe you will get better performance. If the other ISPs still peer with TATA it looks like you won't do any better with them unless ...


2

I was hoping this would be an easy answer, but I guess I would have to force a read/write of the file or know when it is happening. In any event, this is what I tried hoping for a quick one-off. You will need the handle utility from SysInternals. \path\to\handle.exe | find /i "etl" Good luck and happy hunting.


2

The Directory Service team blog has an article on configuring netmon to make LDAP more readable but it talks more specifically about ADLDS. It may suffice? http://blogs.technet.com/b/askds/archive/2011/05/27/viewing-adlds-traffic-with-netmon-where-is-my-ldap.aspx Basically packet capturing seems to be the "free" way of doing this. -Lewis


2

This suggests you are running your database server and your web server on the same box and they are connecting using the socket rather than via the network. To achieve what is shown in that article, you will need to change your web-app's connection string so that it uses the network.


2

It's not necessarily Apache's configuration that's doing this - is Apache handing the request off to a dynamic content generator? Look for two things in your Apache config; Redirect, and RewriteRule directives that have an R flag. If those aren't in place, then Apache isn't doing the redirect (with the exception of /directoryname redirecting to ...


2

You do not give a lot of information what equipment is used. If the switch is a managed switch, you can use the cli, web app, or management software to obtain the MAC addresses detected on a port. These identify the network cards connected to the particular port. Hope this helps.



Only top voted, non community-wiki answers of a minimum length are eligible