Network tools
|
For other network related things, see:
Also: |
| This article/section is a stub — probably a pile of half-sorted notes, is not well-checked so may have incorrect bits. (Feel free to ignore, fix, or tell me) |
Low-level tools
Download tools
You probably already know wget or curl. In that context, lftp is also interesting.
- wget is a HTTP and FTP downloader, with some neat features geared towards those protocols
- curl is like wget, with a different feature set and supporting some more protocols
- lftp is a useful (mass) downloading tool that does HTTP, FTP, SFTP, and others
See also this comparison table
Watching traffic
Connections:
- netstat (lists current connections) (see also its mention on Linux_admin_notes_-_health_and_statistics#Networking)
Speed totals (per interface):
- bmon (speed per interface, and shows traffic shaping aggregates)
- nload (graphs)
- vnStat (also summarizes per day, etc.; collects via background service)
- iptraf (per connection / interface / protocol / MAC)
- ibmonitor (speed per interface)
- (slurm(verify))
Speed per program:
- nethogs (speeds per program; by default only TCP)
Speed per established connection:
- iptraf (per connection / interface / protocol / MAC)
- iftop (connections, speeds) - graphical feedback of speeds
- tcptrack (connections, speeds)
- jnettop (connections, speeds)
Packet-level
- tcpdump takes packets from the network stack, and (with default options) gives you a short description. Also allows you to filter, write packets to the tcpdump file format (various utilities can read this). See also tcpdump notes.
- Wireshark (previousy ethereal; which still exists but isn't being developed anymore) is similar but has a GUI, some more filter options (a different filter system), and more advanced packet decoding.
- ssldump lets you notice SSL traffic (and decrypt it, given the right keys)
- tcpflow: instead of storing packets, this stores TCP connection interchanges in whole, each each in a separate file (or optionally only to screen). Doesn't write a standard file format, but is useful to snoop on protocols at their level (layer 5).
- (can be useful to split interchanges from a tcpdump file)
Content-geared:
- ngrep greps packets for contents. Can e.g. be used as a content-aware tcpdump alternative, in a pipe, or to filter tcpdump files after the fact.
- driftnet picks out images from HTTP transfers and either saves them or displays them in X.
- chaosreader interprets packet log files and snoops out files, emails, etc. from the common protocols that carry them (HTTP, FTP, SMTP)
- dsniff is like chaosreader, but a little lower-level.
Reports and statistics
| This article/section is a stub — probably a pile of half-sorted notes, is not well-checked so may have incorrect bits. (Feel free to ignore, fix, or tell me) |
System/traffic reports
- darkstat (standalone: snoops off interface, reports via embedded web server and simple graphs)
- ntop does traffic analyses and rrd-style graphs (host-focused)
- RRDTool-related utilities, including:
See also this list
Availability/health monitoring
Log analysis
- awstats (web, mail, ftp, streaming, some others)
- webalizer (web)
- analog (web)
- calamaris (web proxies)
(See also Web log analysis notes)
Lower level tools
| This article/section is a stub — probably a pile of half-sorted notes, is not well-checked so may have incorrect bits. (Feel free to ignore, fix, or tell me) |
(relatively lower, or very-specific-purpose)
Utilities
- traceroute [1]
- lft ('layer four traceroute') [2]
- arping [3]
- mtr [4]
- bing
- dnstracer
- nmap [5]
netcat
There are two distinct things called netcat
The idea is the same but some behaviour differs, e.g. when things are output.
(Note that nc is sometimes symlink to mc, the midnight commander, because it's an imitation of norton commander)
Uses of netcat include talking to your web server:
# the -e is there so that \n gets interpreted as a newline echo -e 'GET / HTTP/1.0\n' | netcat localhost 80
The utility can also create a listening (-l) TCP server (default) or UDP server (-u option) on a port, say 1111 (-p 1111):
netcat -l -p 1111 netcat -l -u -p 1111
These will echo what they get. Since this uses stdin/stdout, this can be used for simple network pipes.
netcat servers can be useful to see whether connections are getting through, and see what's happening on them (try a lot of verbosity through -vv), which can be useful e.g. in protocol testing and testing whether your firewall is being overly protective.
You can do some basic port scanning, for example with a one-second timeout after connect, port 10-500)
netcat -v -w 1 localhost -z 10-500
things like netcat
Variations on netcat include:
- socat [8]
- generalized in that it can connect to a file, pipe, device, socket (Unix, IP4, IP6, raw, UDP, TCP), SSL, and some proxies
- and can relate between these
- http://freshmeat.sourceforge.net/projects/socat/
- nmap's ncat
- pnetcat - python implementation of netcat
- the /dev/tcp device, see e.g. [9]
More specialized
- cryptcat
- adds (twofish) encryption, so that you can transfer data without it being easily snoopable(verify)
- http://cryptcat.sourceforge.net/
- netcopy & netsend - plain file sending
- packet sender
- hping
Dead homepage?
- sbd
- sometimes noted to be a trojan, mostly because it allows remote execution
- http://www.cycom.se/dl/sbd
- emcast (sort of a multicast netcat)
Packet creation
- scapy [10]
- SendIP [11]
Speed limit/stress testing
IP-to-location lookup
hostip
Looks interesting and detailed, though it seems that you'll have to your own indexing.
Maxmind GeoIP
Has decent-resolution free (requires attribution) data sets, GeoLite:
There are better-resolution versions for pay.
Caching options:
- None: GEOIP_STANDARD: reads everything from disk
- Index only: GEOIP_INDEX_CACHE: index stored in memory, record read form disk: faster than standard, less memory usage than full. Often the smart choice for the more detailed datasets (like city)
- Full: GEOIP_MEMORY_CACHE: Everything is loaded once and ket in memory and GEOIP_CHECK_CACHE same, but check the filesystem whether the db has changed and reload if so
IP2Location
Seems annoyingly paid-for.
