Tag Info

Hot answers tagged

34

No, this is not normal. Contact your provider to resolve this issue. When they can't, switch away ASAP.


28

Ping packets should use an ICMP type of 8 (echo) or 0 (echo reply), so you could use a capture filter of: icmp and a display filter of: icmp.type == 8 || icmp.type == 0 For HTTP, you can use a capture filter of: tcp port 80 or a display filter of: tcp.port == 80 or: http Note that a filter of http is not equivalent to the other two, which will ...


22

The exact procedure depends on the type of networks, the topology, and the equipment. I will attempt to describe the process with regard to most Ethernet networks. Terms: MAC Address: Like a Social Security Number. It doesn't change as you move IP Address: Like an address, when you move (over long distances), it changes. TCP Packet: Data with TCP Port ...


17

Linux auditing can help. It will at least locate users and processes making datagram network connections. UDP packets are datagrams. First, install the auditd framework on your platform and ensure that auditctl -l returns something, even if it says that no rules are defined. Then, add a rule to watch the system call socket() and tag it for easy finding ...


15

Both of those sets of rules have problems, and I wouldn't use either of them as-is. In the first set, the first rule allows new incoming traffic to destination port 22 from anywhere. This isn't a problem. The first problem is that the second rule allows new incoming traffic to destination port 22 from a specific subnet. This is completely redundant since ...


13

One single socket quad-core Xeon with a PCIe x8 based 10Gbps ethernet NIC will be able to deliver that 2.2Gbps easily using either Windows or Linux without breaking a sweat. Of course that's if you have more than 1Gbps of bandwidth - you've limited yourself in this scenario by only having 1Gbps available so that's the wall you'll hit. The complex bit comes ...


13

You can use netstat, but you need the right flags, and it only works if the process that is sending the data is still alive. It won't find the traces of something that came briefly to life, sent UDP traffic, then went away. It also requires local root privileges. That said: Here's me starting an ncat on my local host, sending UDP traffic to port 2345 on ...


12

I'm sure there's a way to better interpret the info coming from your ISA server, but in case everything fails: "In wireshark we trust" It runs on Windows too: http://www.wireshark.org/download.html


11

Cache as much as you can. Any pages that are dynamically created should be cached so that users will get a static version. In page components that query the db should also be cached. Try using an external service like Amazon S3 to serve images and multimedia (or have it ready to use if the site suddenly gets hit with a ton of traffic). Going live ...


11

It has been a while since I consulted to the telecom industry so I am going off of what is still likely. For DSL, this is sub-par. You should never see traffic destined for another IP address. I would check with your provider. This is not a standard configuration and it is likely that there are some settings in the RedBack that are not right. Each ...


11

I think this would be far better done with logtail and grep. Even if it's possible to do with lua inline, you don't want that overhead for every request and you especially don't want it when you have been Slashdotted. Here's a 5-second version. Stick it in a script and put some more readable text around it and you're golden. 5 * * * * logtail -f ...


10

I think your best bet is going to be a mixture of Cacti and Ntop. ntop is going to provide you information about the traffic on your network, like the hosts that are consuming the most... what traffic is causing slowdowns, etc... Cacti is going to give long term trends about your bandwidth consumption so you can tell how you networks traffic has changed ...


10

I'm assuming you have a commercial router/switch, it most likely has SNMP which you can combine with MRTG for a nice traffic graph.


8

There is no hard limit, but most sites do not run more than 5 or 10 mirrors. Mirroring through DNS round robin is most useful if the sites are geographically separate so that there is redundancy in addition to load sharing. As the number of mirrors increases, the efficiency of using DNS round robin as load sharing decreases because DNS round robin does not ...


8

One thing to bear in mind is that by default, DNS lookups use UDP. If the response is larger than can fit in a single datagram, as many as will fit are returned and the TC (truncated) bit is set in the header. The requester can choose to work with what was returned, or re-attempt the query using TCP. Caching DNS servers are not supposed to cache truncated ...


8

I also suggest using VnStat vnStat 1.6 by Teemu Toivola <tst at iki dot fi> -q, --query query database -h, --hours show hours -d, --days show days -m, --months show months -w, --weeks show weeks -t, --top10 show top10 -s, --short use short output ...


7

Alternatively you can use 'rsync' to transfer just the files you need, drop that onto a Linux system located at your home, fix up things like the Master Boot Record (MBR) which will not be correctly transferred and then fire it up under a virtualization technology. You will be looking for something like; rsync -vaHPS --numeric-ids --exclude=/proc ...


7

Can be any traffic be generated, as long the server load is 0.00?? Absolutally. It takes virtually no CPU effort to generate a ping flood to other servers, or to download giantic amounts of traffic. Especially if it's a proper server with TCP Offload. However, if you're not the administrator, then you need to ask the admin to tell you what's wrong, ...


6

At that volume you are asking the wrong question. The question you should be asking is: what questions do I need to answer with the information I capture? From that you can answer the question of storage engines. Do you really need every byte? Do you need it structured to answer ad-hoc questions, or to answer some very structured, specific questions? ...


6

It Depends No, seriously - there is no straight cut-and-dry answer for this question. Constantly transferring multiple gigabytes every minute? That's high-traffic. Constantly handling several million requests per second? That's high-traffic. A perfume retailer's site that gets one request a day... except the week before Mother's Day and St. Valentine's ...


6

I'd call it "load testing via session replaying", personally. I don't know of any simple catch-all term for this kind of testing technique. The basic strategy that I've seen employed for this kind of load testing is to ingest log files from the production system and replay them on a test system. You can use tools like JMeter or Apache Bench to replay ...


6

You can use tcpdump or wireshark to see what kind of traffic it is. But it's probably some level 2 traffic like ARP, it seems totaly normal.


6

I have actually had to solve such a problem recently. We have 8Mbit/s for 150 PCs. The problem was not so much regular bandwidth use but people who would download big ISO files and kill the bandwidth for everyone else. We handled this by inserting a caching web proxy (Squid on Pfsense) that allows for 2 bandwith limiting parameters. First one is max global ...


6

I would recommend against using wireshark to monitor traffic. You'll just get too much data, but you have a hard time analyzing the data. If you need to look at/troubleshoot the interaction between a couple machines, wireshark is great. As a monitoring tool, IMHO, wireshark is not quite the tool you need. Profile the network traffic. Try out some actual ...


6

You can add an iptables rule for each IP and use it to count the traffic that passed through the rule. Just add 2 rules for each IP: iptables -A FORWARD -s <ip> iptables -A FORWARD -d <ip> And then you can get the results with iptables -nv -L FOWARD that will return something like this: # iptables -nvL FORWARD Chain FORWARD (policy ACCEPT 0 ...


5

I don't know of a tool that does this directly, but you could always just use tcpdump on the bsd gateway to sniff DNS requests and responses, and then compare requests to responses. The tcp dump would be something like: tcpdump -i interface 'udp port 53' -o dumpfile It is possible they would be tcp too, so you can capture both if you want. You can then ...


5

nethogs


5

Manipulate the OnBeforeRequest function using the following syntax: if (!oSession.HostnameIs("domainIcareabout.com") && !oSession.HostnameIs("anotherDomainIcareabout.com")) { oSession["ui-hide"] = "Hiding other domains"; // String value not important } This page on fiddlertool.com contains some script samples. Search for "Hide requests ...


5

How much planning went into your data model ? Have you designed a schema that will allow you to ramp up your query volume without expensive sorts, binary columns, or complex joins ? Have you tuned your database backend (assuming you have one) ? How are you serving your 'big images' ? Can you split that out into a separate web server process, even a separate ...


5

You can use Google to do this type of math for you: 20Mbps x 1 month Google says: 6.26979788 terabytes or 20Mbps x 7 days Google says: 1.44195557 terabytes Google has some neat features like this. You can also use it to convert: 1.44195557 terabytes to MB gives you: 1 512 000 megabytes



Only top voted, non community-wiki answers of a minimum length are eligible