Tag Info

Hot answers tagged

23

You can use nmap 5.0 with --traceroute option. You will also get a portscan for free :). If you want to test a specific port, you can use -p port option. (You should also use -Pn option so that nmap doesn't try to do a regular ICMP probe first). This is an example: $ sudo nmap -Pn --traceroute -p 8000 destination.com PORT STATE SERVICE 8000/tcp open ...


14

Given an IP address, you should be able to find the MAC address of the corresponding host. arp -a On both Windows and Linux will show you the arp cache of that host, mapping IPs to MAC addresses. (Note that this will need to be run on a machine that is on the same IP subnet as the machine you are trying to find). Once you have the MAC address, log on to ...


13

You don't need any third party software. You need to turn on object access auditing and set the auditing options on the file(s) and or folder(s) you want to monitor. This article explains the process for Windows XP but it's the same for W2K3. http://support.microsoft.com/kb/310399


13

Yep, that'll about do it for you. Using the -T{traceflag} startup parameter, that is.


9

This is the way I use these words. Others may have additional or different usages. Depending on the job at hand, I will use the terms differently. Development teams and operations teams have different needs an usage. Monitoring is monitoring. Usually it is ongoing, and preferably automated. Open source tools like Munin, Nagios, and MRTG fall into this ...


8

If you have CDP enabled and a recent IOS, a nice, fast way to find where a PC is plugged into is by MAC. Use this command on the Cisco router's CLI: traceroute mac xxxx.xxxx.xxxx xxxx.xxxx.xxxx Where xxxx.xxxx.xxxx is the MAC address of the PC. If you don't know the MAC, I would look in the arp-cache for the IP and find the MAC that way. You may want ...


7

Something that I learned the hard way is that you have to have semicolons before each trace flag. For example, if you were enabling logging of deadlock info to file, your example would become... -dD:\MSSQL10.MSSQLSERVER\MSSQL\DATA\master.mdf;- eD:\MSSQL10.MSSQLSERVER\MSSQL\Log\ERRORLOG;- lD:\MSSQL10.MSSQLSERVER\MSSQL\DATA\mastlog.l ...


7

It looks like gmail won't show the IP if the message was sent from the web interface, but messages sent from an email program, using gmail's SMTP server will have the sending IP in the mail headers.


6

I found the answer myself after digging around some more. The directory C:\Windows\System32\LogFiles\WMI\RtBackup stores ETW trace files (extension .etl) for real time event trace sessions. Looking into the RtBackup directory is a little difficult because by default only System has permissions, but my application SetACL Studio can display the contents ...


5

Seems like a job for SystemTap, the SystemTap beginners guide by Red Hat has some disk and IO sample scripts to get you started as does sourceware.org.


5

Not quite a dupe, but there's a similar question here, which has some suggestions about mapping an IP address to a switch port. In this case, it sounds like the best option is to identify all switch ports that are connected to devices you know about. My suggestions for this (assuming Cisco managed routers/switches): Identify known devices From your first ...


5

Looking at an email from y'day sent from Gmail I'm not seeing the sender's IP anywhere in the transport header (just one Gmail server). Google has it, no doubt, but it would probably take getting a subpoena involved to get it.


5

If you've got a non-Windows machine, whois <ip> is your first step. This will tie the IP to a network and possibly even supply you with an 'abuse' contact, usually an email address. You can email an abuse report there. You can also try nslookup <ip> to get a domain name, and look that up on abuse.net. If you're running Windows start with ARIN's ...


5

In 99% of cases, the penultimate hop of a traceroute will not be the default gateway of the destination host. This is because of the way that traceroute works. All IP packets have a -somewhat misnamed- time-to-live (TTL) field. This field is decremented by one by every router that forwards a packet. If a router decrements the TTL to 0, it drops the packet ...


4

As others have mentioned, there is no direct way to determine what IP is connected to a certain switch port. The reason is that an Ethernet switch works at L2 of the OSI Model, and typically does not inspect higher level layers (Layer 3 -> IP Address). (There are some exceptions in newer hardware) One important note, to use the ping / ARP trick you'll ...


3

If using dig: dig +trace .... otherwise, run Wireshark to capture the packets.


3

Check the ARP cache on your switch(es) to find the MAC and Switch Port associated with that IP of the device. This articles should help you: http://www.petri.co.il/csc_arp_cache.htm http://ccnpsecurity.blogspot.com/2011/11/using-mac-address-table-and-arp-cache.html


3

The ISP that owns the IP is the only group that really know the identity of the person registered to an IP. The best info you can hope for is what you can get from dnsstuff. If the matter is serious and you want something done about it, then your only option would be to report it to the police. You could drop everything from that IP address in your ...


3

Mail servers hide their senders addresses, especially if they use 'web mail'. In email exchange its server to server and the client always retrieves their email from their server. When they send an email they don't send it directly to googles mail server but it gets sent to their mail server who than hands it off to google. Here is an example of an exchange ...


3

Spiceworks is free and will automatically create a nice map of all components on your network, complete with name, IP, and traffic. Its very easy to use also. http://www.spiceworks.com/


3

CiscoWorks, or whatever they call it now, will definitely do this for you. There are also SNMP OIDs that can enumerate the ports, the port status, and the CAM table. This will, at the very least, tell you which switchport a MAC address is on. Depending on your switch model you may also be able to view the ARP table. I would start out by searching for ...


3

All sorts of things -- what OS your machine (or router -- whatever's directly connected to that IP address) is running, what services might be running on there, anything that can be determined by talking to the services provided on that IP address (Windows file sharing is the best one, but even a mailserver or FTP server can provide all sorts of info). More ...


3

It's not necessarily Apache's configuration that's doing this - is Apache handing the request off to a dynamic content generator? Look for two things in your Apache config; Redirect, and RewriteRule directives that have an R flag. If those aren't in place, then Apache isn't doing the redirect (with the exception of /directoryname redirecting to ...


2

I was hoping this would be an easy answer, but I guess I would have to force a read/write of the file or know when it is happening. In any event, this is what I tried hoping for a quick one-off. You will need the handle utility from SysInternals. \path\to\handle.exe | find /i "etl" Good luck and happy hunting.


2

This suggests you are running your database server and your web server on the same box and they are connecting using the socket rather than via the network. To achieve what is shown in that article, you will need to change your web-app's connection string so that it uses the network.


2

From the man page of ntptrace: ntptrace is a perl script that uses the ntpq utility program to follow the chain of NTP servers from a given host back to the primary time source. For ntptrace to work properly, each of these servers must implement the NTP Control and Monitoring Protocol specified in RFC 1305 and enable NTP Mode 6 packets.


2

A TCP trace works in much the same way as a more traditional trace, except that instead of sending out ICMP ECHO or UDP packets (which are often blocked by firewalls and load balancers) with an increasing TTL (time-to-live) in each subsequent batch of packets, it sends out TCP SYN packets, again with an ever-increasing TTL until a response is received from ...


2

Okay, well it looks to me like the latency comes in with the TATA communications network. So your provider KEMS Peers only with TATA communications. If another ISP peers with a different provider in your area (Kuwait?) then maybe you will get better performance. If the other ISPs still peer with TATA it looks like you won't do any better with them unless ...


2

The .trc files are safe to delete. .trc files generated by SQL Server in process of saving events to a physical file without using the Profiler client tool. Server-side tracing is enabled and controlled by using SQL Server system-supplied stored procedures and functions. With these system-supplied processes, you can identify what to trace, when to start ...


2

The Directory Service team blog has an article on configuring netmon to make LDAP more readable but it talks more specifically about ADLDS. It may suffice? http://blogs.technet.com/b/askds/archive/2011/05/27/viewing-adlds-traffic-with-netmon-where-is-my-ldap.aspx Basically packet capturing seems to be the "free" way of doing this. -Lewis



Only top voted, non community-wiki answers of a minimum length are eligible