47

For a general sense of the scale of your problem netstat -s will track your total number of retransmissions. # netstat -s | grep retransmitted 368644 segments retransmitted You can aso grep for segments to get a more detailed view: # netstat -s | grep segments 149840 segments received 150373 segments sent out 161 ...


31

tcp.port==443 in the filter window (mac)


31

You see the "incorrect" checksums due to a feature called TCP checksum offloading. The checksum fields for outgoing TCP packets are not pre-calculated by the operating system but instead set to 0 and left for calculation by the NIC processor. The Wireshark FAQ has a more detailed explanation.


19

You can use one of the Sysinternals tools PSinfo: http://technet.microsoft.com/en-us/sysinternals/bb897550 PsInfo v1.77 - Local and remote system information viewer Copyright (C) 2001-2009 Mark Russinovich Sysinternals - www.sysinternals.com PsInfo returns information about a local or remote Windows NT/2000/XP system. Usage: psinfo [-h] [-s]...


18

netstat -ptu will give you the owning process ids (along with standard netstat info) for all tcp and udp conections. (Normal users will not be able to id all processes.) If something is sending out a fair amount of constant traffic you should see it on Recv-Q or Send-Q columns 2 and 3 respectively. Examples: Recv-Q sudo watch -n .1 'netstat -tup | grep -E "...


18

These are my general suggestions for this kind of process. I appreciate you'll have covered some of them already but its better to be told something twice than miss something important. These notes are orientated towards malware that's spreading on a LAN but could easily be scaled back to deal with more minor infections. Stopping the rot, and finding the ...


16

I prefer nethogs. It's a small ncurses-based console program that displays per-process network traffic status in a convenient way.


14

Another good one to look into is called iftop - which will show connections and bps and has some pretty decent features.


12

These stats are in /proc/net/netstat and collectl will monitor them for you either interactively or written to disk for later playback: [root@poker ~]# collectl -st waiting for 1 second sample... #<------------TCP-------------> #PureAcks HPAcks Loss FTrans 3 0 0 0 1 0 0 0 Of course, if you'd like to see ...


12

I would setup a copy of smokeping on some system on your network. It doesn't ping every second, and you probably don't need it do. Instead it will periodically send out a burst of ~20 pings at the same time, and then count how many respond, and how fast each returns. The results are graphed. Here is results for my a system at home, over my Comcast ...


12

Hostgroups and templates. Templates let you define classes for your hosts and services, e.g. "normal service", "critical service", "low-priority host". They also serve as a useful way to divide responsibilities if you've got multiple teams with different responsibilities, so you can have a "linux host" template and a "windows host" template, with each one ...


11

On an rpm-based Linux distribution, you could run the following: ssh <user-who-can-run-rpm>@<remote.host> 'rpm -qa | sort' For a deb-based distribution, pass this to the ssh command: 'dpkg-query -l | sort' For Gentoo (per a supplied comment from Monksy): 'qpkg -I | sort' For Solaris: 'pkginfo -i | sort' And on AIX: 'lslpp -a all | sort'


11

Ifstat: rilindo@ubuntu:~$ sudo apt-get install ifstat [sudo] password for rilindo: Reading package lists... Done Building dependency tree Reading state information... Done The following NEW packages will be installed: ifstat 0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded. Need to get 23.4kB of archives. After this operation, 94.2kB ...


9

Somewhere in your NAGIOS config, you should have a definition of the command used to send email notifications. If it's anything like mine, this will say define command{ command_name notify-service-by-email command_line /usr/bin/printf "%b" "***** Nagios *****\n\nNotification Type: $NOTIFICATIONTYPE$\n\nService: $SERVICEDESC$\nHost: $...


8

Yes, they can. And this question is off-topic and very unwelcome here. We are those administrators you try to circumvent.


7

You've done all the things I would do (if I were still a Windows admin) -- The canonical steps are (or were, last time I was a Windows guy): Isolate the affected machines. Update anti-virus definitions Run AV/Malware/etc. scans on the whole network Blow away the affected machines (completely wipe the suckers out) and reinstall. Restore user data from ...


7

Look into the linux arp command. I hope windows has a similar command. "ARP stands for Address Resolution Protocol, which is used to find the media access control address of a network neighbour for a given IPv4 Address." You may need to run the arp command on each network the server is part of. If you have access to firewalls/routers those should have an ...


7

The problem source is likely in one of two places: The modem - someone is doing a large upload to a well-connected server and is saturating the upload link of the circuit, thereby slowing down all other traffic. Put in place some traffic shaping on the upload side of things to clear this up. The Sonicwall - perhaps you're exhausting the state tracking ...


6

There isn't one standard, at all. You need to define what you're monitoring for your clients and how you'll do it. If you're making sure their websites are up, a hosted solution (is that what you mean by "cloud") is probably best. The hosted monitor will hit the websites from one or multiple locations and measure the response times. If you're doing ...


6

WMIC can be used remotely, by default, with an account that is part of Administrators group. You can delegate read-only WMI access to a normal user. SNMP can be used too - you just need to configure a read-only community. You need to browse hrSWInstalled table: snamwalk -c public -v2c server_IP hrSWInstalled See also: http://technet.microsoft.com/en-us/...


6

Here is a PowerShell script that will connect to the HKLM\Software\Microsoft\Windows\Uninstall registry key, pull the keys, get their display names and send to a text file. $temparray=@() $MachineName = 'somecomputername' $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::'LocalMachine', $MachineName) #connect to the ...


6

In short, yes. Any unencrypted traffic is subject to being monitored at any point between your LAN edge (be it a cable modem, dsl modem, FIOS termination box, etc.) and the destination server. The fact that you have a dynamic IP offers no protection. The ISP keeps logs of which IP addresses were handed out to which customers, complete with timestamps of ...


6

You can use the ss tool to get detailed TCP statistics: $ /sbin/ss -ti Under Debian, use apt-get install iproute to get the binary.


6

If you have access to a linux machine then mtr may do what you want. mtr combines the functionality of the traceroute and ping programs in a single network diagnostic tool This is the kind of output you get when run in report mode. You could just leave it running and gather statistics over any period of time. mtr -r -c 10 google.com HOST: host1.lan ...


6

Make extensive use of service and hostgroups, and templating. Create hostgroups, and assign services to the hostgroups. Use servicegroups for dependencies, escalations, and logical grouping in the web UI. If you have groups for everything, adding a new host is just 3 or 4 lines: name, address, template(s), and (optionally) hostgroups. Everything can be ...


5

Don't use wireshark, you're getting way too much detail (unless you need that detail). Enable SNMP on the WAN device and use MRTG or cacti to get a graph of the traffic. If the WAN device doesn't support SNMP, then by all means use the hub and the laptop to get to the data. If you are unsure on how to use MRTG, put a comment here and I'll provide more detail....


5

You could use nping from nmap like: C:\>nping --tcp -p 80 192.168.1.1 where -p specifies the port to scan (here: 80). Furthermore you can use -H for hiding sent packets, in favor of showing only replies.


5

You might be able to use Netflow on the ASA 5505 to export traffic flow information to a Netflow collector. I think you need version 8.2 on the ASA in order to configure Netflow. Barring that, you could set up a SPAN port on your switch (if you have a switch that supports port mirroring/monitoring) to mirror/monitor the port that uplinks to your firewall/...


5

A more manual operation if you are looking for just a process sending/receiving data would be to run the lsof command. This will list all open files for each process which will include network connections as they are file descriptors to the o.s. Not sure if this is what you are looking for.


5

Take a look at SmokePing.


Only top voted, non community-wiki answers of a minimum length are eligible