9
votes
How can I filter https when monitoring traffic with Wireshark?
You can use the "tls" filter:
TLS stands for Transport Layer Security, which is the successor to the SSL protocol. If you're trying to inspect an HTTPS request, this filter may be what you're ...
- 191
8
votes
Accepted
Why is the iptables byte count for raw PREROUTING 0?
I have been able to reproduce zeros in the counters on the first run of iptables --list --verbose -t raw. And the reason in my case simply was that the iptable_raw had not been loaded until I ran the ...
- 30.9k
6
votes
Do you trust LACP?
To tell the true, LACP was born exactly to solve a dangerous problem itself caused by LAG (Link aggregation Group).
When used between directly attached interface, LAG is not dangerous. In such a ...
- 51.4k
3
votes
Accepted
Get network data transfer rate / throughput for use in Wireshark
You can run TShark with these options:
tshark -i 1 -a duration:30 -q -z io,stat,0
Meaning:
-i 1 : Listen on your first interface. Adjust as needed for your desired interface. (You can use tshark -D ...
- 1,936
3
votes
Domain Controllers Experiencing Heavy Network Load From Almost All Machines In the Domain
TCP 445 is SMB, i.e. Windows file sharing.
You should monitor the SMB activity on your DCs; you can do that graphically from the Computer Management MMC or via PowerShell using the various Get-SmbXYX ...
- 72k
3
votes
Minimum bandwidth limit on Linux systems
Yes it is the right tool.
In fact the traffic shaping is implemented on kernel level. tc is the userland interface tool to control it. It is part of the iproute2 package.
http://lartc.org/ has good ...
- 2,017
3
votes
How to reproduce http traffic of a real site in another environment (e.g. VM)
You can use tcptrace to convert the pcap file into separate requests which can then be replayed using netcat. Here is an example:
tcpdump -s 0 port http -i en0 -w dump.pcap
tcptrace -e dump.pcap
cat *...
- 131
3
votes
Accepted
What amount of inbound traffic is considered as normal for a small blog?
The exact amount of traffic is usually less important than the relative change. 300 MB is not big incoming traffic but it is an anomaly for your blog. Whenever an anomaly is encountered, steps should ...
- 3,848
2
votes
Do you trust LACP?
Yes, I trust LACP. I prefer LACP over all other link aggregation methods because it's so reliable, flexible, and is an IEEE standard so vendor interop is guaranteed.
If you think your virtual ...
- 3,566
2
votes
monitor traffic at the scale of millisecond
You can actually do this, but you'll need to use the NF_LOG iptables target and write a program that specifically covers your needs.
NF_LOG will send packets to a receiving application which (given ...
- 23.9k
2
votes
Accepted
Process names in MS Message Analyzer
It seems to require Windows_Kernel_Trace messages to provide process names. I had the same problem that you did where I applied a session filter before the session start including an IP Address filter....
- 36
2
votes
Accepted
Http traffic using 127.0.0.1 or LAN IPv4 IP
No, the connections do not go to the router and back.
If the IP address of your machine is 10.1.2.3, and you are opening a connection to 10.1.2.3 from that machine the connection is handled ...
- 25.7k
2
votes
Accepted
Extracting TCP application data from pcap file
If you must do this manually, you need to remove the headers of the encapsulating protocols. However, there are some subtleties to them and it may not be trivial:
Ethernet (L2): The Ethernet header (...
- 12.6k
1
vote
Both incoming and outgoing packets is delayed even though i target incoming only with tc command
You need to use tc together with ingress and ifb
https://gist.githubusercontent.com/dogbunny/fda68f21784025876c57a4dfc3fb6bcc/raw/bfb19da28152364340f2d3f7ef179ee5371fd447/TC_ingress_port_filtering.txt
...
- 2,782
1
vote
Both incoming and outgoing packets is delayed even though i target incoming only with tc command
With TC you are only dealing with outgoing packets. To match ongoing ones you need to setup an ifb.
Also, your connections are chatting, for example if you send a message over TCP, the responder has ...
- 1,390
1
vote
Daily overview of traffic with information on what processes consumed how much of the traffic on a Linux server
I think Datadog might be what you are looking for. Datadog is very rich and according to Gartner one of the market leaders. It also allows you to create custom dashboards. But it also offers a lot ...
- 2,782
1
vote
Word translator tool tracing
If you have some network monitoring tool in place then you can check what traffic is being generated related to what you're looking for. For the translation feature you mention investigate what ...
1
vote
NAT: Figuring out IP of broken down machine
You could try wireshark (windows, mac, linux) or the CLI version tcpdump (linux, Mac etc)
Connect the listening host to an ethernet port on the ISP router, and try to access with ssh to the NATed TCP ...
- 531
1
vote
How to get size of HTTP request and response including protocol overhead?
I know that this question has been asked long time ago.
In theory to get size of HTTP request and response including protocol overhead:
When application data is sent by a protocol, the data is ...
- 11
1
vote
How to get size of HTTP request and response including protocol overhead?
For Linux, and other unix(like) OSses you may use iftop utility. For example: Monitoring my router web interface: sudo iftop -f 'port 80 and host 172.19.76.1' -iwlan0
-f -- filter: port 80 -- monitor ...
- 126
1
vote
Linux ping command getting rtt
Here is how you can get median and 95th percentile rtt from regular ping output with datamash:
ping -c 5 1.1.1.1 | sed -rn 's|.*=([0-9]+\.?[0-9]+?) ms|\1|p' | LC_ALL=C datamash median 1 perc 1
This ...
- 111
1
vote
Accepted
Linux ping command getting rtt
Round trip time(RTT) is the length of time it takes for a signal to be sent plus the length of time it takes for an acknowledgement of that signal to be received. This time therefore consists of the ...
1
vote
Get network data transfer rate / throughput for use in Wireshark
Here is a solution in Python that will parse Linux interface data for RX (received data). It seems to closely match the output of nload, however, it sometimes reports higher than the nload max by a ...
- 232
1
vote
What's the caculation for network speed reported with sar-n DEV output?
Since you requested one sample at the interval of one second, sar gave you the instant speed. It means it shows the speed in one second, while it was measuring it.
As about the question "does this ...
- 8,961
1
vote
How to reproduce http traffic of a real site in another environment (e.g. VM)
GoReplay is designed for capturing production traffic and replaying that in test environments. See https://goreplay.org/ or https://github.com/buger/goreplay/wiki for more information.
- 211
1
vote
Linux: How to measure daily/montly network traffic?
some data-visualization and system monitoring tools...
see also awesome-monitoring
netdata - heavyweight by default, monitors hundreds of parameters
grafana + prometheus + prometheus-node-exporter
...
- 111
1
vote
Linux: How to measure daily/montly network traffic?
Today I am using telegraf + influxdb to do this. All the magic is in making a decent graph though, which I haven't done for monthly usage specifically yet.
Here's the telegraf plugin with some ...
- 111
Only top scored, non community-wiki answers of a minimum length are eligible