Advanced Linux Networking Tools

Some of the more common tools for advanced networking include: tcpdump, netstat, wireshark, and tshark.

A previous article covered Basic Linux Networking Tools.

Discover Switch Information

Now for the advanced stuff. We use tcpdump, and write it to a file pkt.cap. Then we use tshark to read the file.

How to check the router to which the linux host is connected.

# tcpdump -nvi eth0 -c 1 -s 1500 -w pkt.cap ether proto 0xaa and ether dst 01:00:0c:cc:cc:cc and ether\[20\] \=\= 0x20 and ether\[21\] \=\= 0x00
# tshark -V -r pkt.cap

# tcpdump -nvi eth0 -c 1 -s 1500 -w pkt.cap ether proto 0xaa and ether dst 01:00:0c:cc:cc:cc and ether\[20\] \=\= 0x20 and ether\[21\] \=\= 0x00;tshark -V -r pkt.cap
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 1500 bytes
1 packets captured
1 packets received by filter
0 packets dropped by kernel
Running as user "root" and group "root". This could be dangerous.
Frame 1 (416 bytes on wire, 416 bytes captured)
 Arrival Time: Aug 26, 2011 12:49:00.909559000
 [Time delta from previous captured frame: 0.000000000 seconds]
 [Time delta from previous displayed frame: 0.000000000 seconds]
 [Time since reference or first frame: 0.000000000 seconds]
 Frame Number: 1
 Frame Length: 416 bytes
 Capture Length: 416 bytes
 [Frame is marked: False]
 [Protocols in frame: eth:llc:cdp:data]
IEEE 802.3 Ethernet
 Destination: CDP/VTP/DTP/PAgP/UDLD (01:00:0c:cc:cc:cc)
     Address: CDP/VTP/DTP/PAgP/UDLD (01:00:0c:cc:cc:cc)
     .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
     .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
 Source: 00:27:0c:b0:5d:87 (00:27:0c:b0:5d:87)
     Address: 00:27:0c:b0:5d:87 (00:27:0c:b0:5d:87)
     .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
     .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
 Length: 402
Logical-Link Control
 DSAP: SNAP (0xaa)
 IG Bit: Individual
 SSAP: SNAP (0xaa)
 CR Bit: Command
 Control field: U, func=UI (0x03)
     000. 00.. = Command: Unnumbered Information (0x00)
     .... ..11 = Frame type: Unnumbered frame (0x03)
 Organization Code: Cisco (0x00000c)
 PID: CDP (0x2000)
Cisco Discovery Protocol
 Version: 2
 TTL: 180 seconds
 Checksum: 0xde0a [correct]
     [Good: True]
     [Bad : False]
 Device ID: example-lab-switch.example.com
     Type: Device ID (0x0001)
     Length: 33
     Device ID: example-lab-switch.example.com
 Software Version
     Type: Software version (0x0005)
     Length: 190
     Software Version: Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 12.2(44)SE6, RELEASE SOFTWARE (fc1)
                       Copyright (c) 1986-2009 by Cisco Systems, Inc.
                       Compiled Mon 09-Mar-09 18:10 by gereddy
 Platform: cisco WS-C2960G-24TC-L
     Type: Platform (0x0006)
     Length: 26
     Platform: cisco WS-C2960G-24TC-L
 Addresses
     Type: Addresses (0x0002)
     Length: 17
     Number of addresses: 1
     IP address: 10.10.5.7
         Protocol type: NLPID
         Protocol length: 1
         Protocol: IP
         Address length: 4
         IP address: 10.10.5.7
 Port ID: GigabitEthernet0/7
     Type: Port ID (0x0003)
     Length: 22
     Sent through Interface: GigabitEthernet0/7
 Capabilities
     Type: Capabilities (0x0004)
     Length: 8
     Capabilities: 0x00000028
         .... .... .... .... .... .... .... ...0 = Not a Router
         .... .... .... .... .... .... .... ..0. = Not a Transparent Bridge
         .... .... .... .... .... .... .... .0.. = Not a Source Route Bridge
         .... .... .... .... .... .... .... 1... = Is  a Switch
         .... .... .... .... .... .... ...0 .... = Not a Host
         .... .... .... .... .... .... ..1. .... = Is  IGMP capable
         .... .... .... .... .... .... .0.. .... = Not a Repeater
 Protocol Hello: Cluster Management
     Type: Protocol Hello (0x0008)
     Length: 36
     OUI: 0x00000C (Cisco)
     Protocol ID: 0x0112 (Cluster Management)
     Cluster Master IP: 0.0.0.0
     UNKNOWN (IP?): 0xFFFFFFFF (255.255.255.255)
     Version?: 0x01
     Sub Version?: 0x02
     Status?: 0x21
     UNKNOWN: 0xFF
     Cluster Commander MAC: 00:00:00:00:00:00
     Switch's MAC: 00:27:0c:b0:5d:80
     UNKNOWN: 0xFF
     Management VLAN: 0
 VTP Management Domain:
     Type: VTP Management Domain (0x0009)
     Length: 4
     VTP Management Domain:
 Native VLAN: 205
     Type: Native VLAN (0x000a)
     Length: 6
     Native VLAN: 205
 Duplex: Full
     Type: Duplex (0x000b)
     Length: 5
     Duplex: Full
 Trust Bitmap: 0x00
     Type: Trust Bitmap (0x0012)
     Length: 5
     Trust Bitmap: 00
 Untrusted port CoS: 0x00
     Type: Untrusted Port CoS (0x0013)
     Length: 5
     Untrusted port CoS: 00
 Management Addresses
     Type: Management Address (0x0016)
     Length: 17
     Number of addresses: 1
     IP address: 10.10.5.7
         Protocol type: NLPID
         Protocol length: 1
         Protocol: IP
         Address length: 4
         IP address: 10.10.5.7
 Power Available: 0 mW, 4294967295 mW
     Type: Power Available (0x001a)
     Length: 16
     Request-ID: 0
     Management-ID: 1
     Power Available: 0 mW
     Power Available: 4294967295 mW

Netstat

Another valuable tool is netstat

netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships

To find out what port a service, such as sshd is listening on, use something like this:

# netstat -alp |grep ssh

tcp        0      0 *:ssh                       *:*                         LISTEN      3002/sshd        

unix  2      [ ACC ]     STREAM     LISTENING     27251  4387/ssh-agent      /tmp/ssh-tOqWgf4348/agent.4348

Note that some of these commands require root, or sudo. If you are not logged in as root, use sudo in front of the command. Also, most of the utilities are found in /sbin, or /usr/sbin.



Network Drivers

Another advanced topic is network drivers. The last time I checked, http://tldp.org/HOWTO/Ethernet-HOWTO.html discussed /etc/modules.conf, but in newer versions of redhat variants the file has changed to /etc/modprobe.conf or /etc/modprobe.d/modprobe.conf.dist. Any of those files should have basically the same information:

alias eth0 module_name
options module_name option1=value1 option2=value2 ...

It may look something like this:

alias eth0 e1000

or

alias eth0 tg3

depending on the type of network card or module that is installed on the system.

Other Advanced Networking Topics

There are more topics to be covered, such as how to configure multiple NICs, how to use network configuration utilities, other tools, such as nmap, and configuration for other linux distributions.

For more advanced networking tips, check out http://tldp.org/HOWTO/Adv-Routing-HOWTO

For more basic networking info, see this article: http://systemnotesorg.blogspot.com/2011/08/basic-linux-networking-tools.html