ngrep, tcpdump, and other debugging tools

Trying to find a misbehaving script on a web server which has multiple sites on it...

"Linux Malware Detect (LMD) is a malware scanner for Linux" - https://www.rfxn.com/projects/linux-malware-detect/
"lsof" will also help you to find open files that create network sockets
ngrep -
- tries to provide grep for the network stack
- ngrep -n -q port 80
- ngrep -q -s 240 'GET|POST' port 80". Adjust the 240 up or down if you want to see more or less of the request

---------

tcpdump is a cool way to debug a network problem in Linux (and Windows, with the right port of the tool).

another tool, half-way between ping and traceroute is "mtr"

Message: 11
Date: Thu, 5 Feb 2004 19:52:21 -0500 (EST)
From: *****
To: ****
cc: ****
Subject: Re: [Ltsp-discuss] Re: [K12OSN] delay in printing to terminal attached printers

On Thu, 5 Feb 2004, Les Mikesell wrote:

> On Thu, 2004-02-05 at 17:17, **** wrote:
>
> > If he's doing printing to an LTSP workstation, it does the same thing as
> > a jetdirect interface...

[snip]

I suggest running tcpdump, watching port 9100, to see what kind of
traffic is flowing when he hits the PRINT key.

something like this:

tcpdump -i eth0 port 9100 or 53

That should catch any print or dns packets. at least this will show at what point the first connection is made between the spooler running on
the server, and the lp_server running on the workstation. If it spews out too much info, then you could run:

tcpdump -i eth0 -s 1520 -w /tmp/tcpdump.out port 9100 or 53

and that will capture the packet stream to a file. That file can then be viewed with ethereal using:

ethereal -r /tmp/tcpdump.out

Then, you can browse through the file looking at timestamps and packet types. It might show exactly what is happing (or trying to happen).

Jim.

----------------------

______________________

tags: tcpdump, linux, winxp, trace, security,