Debian
Administrators Network Tools
ipfm - a bandwidth analysis tool
IPFM counts how much data was sent and received by specified
hosts through an Internet link.
Install ipfm in debian
#apt-get install ipfm
After installation you will see the below message now you need
to tune /etc/ipfm.conf config page for your setup
Starting IP Flow Meter: disabled, please tune /etc/ipfm.conf.
If you want more options and how to use ipefm check
man page
ipgrab - Tcpdump-like utility that
prints detailed header information
Ipgrab is a network debugging utility not unlike tcpdump except
that it prints out detailed header field information for data
link, network and transport layers.
Install ipgrab in debian
#apt-get install ipgrab
This will complete the installation.If you want to run ipgrab
run the following command
#ipgrab
Output looks like below
--------------------------------------------------------------------------
IP Header
--------------------------------------------------------------------------
Version: 4
Header length: 5 (20 bytes)
TOS: 0x00
Total length: 40
Identification: 61408
Fragmentation offset: 0
Unused bit: 0
Don't fragment bit: 1
More fragments bit: 0
Time to live: 125
Protocol: 6 (TCP)
Header checksum: 39480
Source address: 17.2.22.2
Destination address: 17.9.5.13
--------------------------------------------------------------------------
TCP Header
--------------------------------------------------------------------------
Source port: 2319 (unknown)
Destination port: 22 (SSH)
Sequence number: 4203153703
Acknowledgement number: 3693124827
Header length: 5 (20 bytes)
Unused: 0
Flags: A
Window size: 64807
Checksum: 47397
Urgent: 0
**************************************************************************
Ethernet (1153393310.927926)
--------------------------------------------------------------------------
Hardware source: 00:60:83:7c:da:49
Hardware destination: 00:11:43:33:b3:ef
Type / Length: 0x800 (IP)
Media length: 60
--------------------------------------------------------------------------
If you want more options and how to use ipgrab check ipgrab
man page
ipip - IP over IP Encapsulation Daemon
This daemon provides an alternative to the kernel-resident
support for IP encapsulation links. It is better suited for
situations where there are many encapsulation connections to be
managed, such as is the case for amateur radio interconnection
of network 44. Also, because the daemon is outside the kernel,
it provides an excellent environment for experimenting with
alternate mechanisms for distributing encapsulation routing
updates.
If you need one encapsulation link, use the kernel's built-in
support. If you need a lot of encapsulation links, give this
daemon a try.
Install ipip in debian
#ipip
This will complete the installation with the following message
Starting /usr/sbin/ipip...
No interfaces defined
Now you need to go to /etc/ipip/ directory you need to configure
the files config and routes for your environment
ipsc - IP Subnet Calculator for console
The IP Subnet Calculator is a tool that allows network
administrators to make calculations that will assist in
subnetting a network. You give the network class and subnet bits
and you get back the maximum number of subnets, maximum number
of hosts per subnet, a bimap showing the breakdown of network
bits, subnet bits, and host bits, the decimal and hexadecimal
class netmask, the decimal and hexadecimal subnet mask and lists
subnets and host information. CIDR support and reverse engineer
the network information for a particular interface (e.g. eth0,
ppp0).
Install ipsc in debian
#apt-get install ipsc
If you want to use ipsc you need to follow this syntax
usage: ipsc [options] <addr/mask | addr/offset | addr>
If you want more options and how to use check ipsc
man page
iptraf - Interactive Colorful IP LAN
Monitor
IPTraf is an ncurses-based IP LAN monitor that generates various
network statistics including TCP info, UDP counts, ICMP and OSPF
information, Ethernet load info, node stats, IP checksum errors,
and others.
Install iptraf in debian
#apt-get install iptraf
This will complete the installation now you need to run this
program using the following command
#iptraf
this will disply a GUI for this program just follow the
instructions on the screen to see your network interface
statistics iputils-tracepath - Tools to trace the network path
to a remote host
The tracepath utility is similar to the traceroute utility, but
also attempts to discover the MTU of the path.
This package also includes tracepath6 and traceroute6 utilities,
which may be used on IPv6 networks.
Install iputils-tracepath in debian
#apt-get install iputils-tracepath
This will complete the installation now you need to run this
program with the following command
#tracepath
Usage: tracepath [-n] <destination>[/<port>]
Example
# tracepath6 3ffe:2400:0:109::2
1?: [LOCALHOST] pmtu 1500
1: dust.inr.ac.ru 0.411ms
2: dust.inr.ac.ru asymm 1 0.390ms pmtu 1480
2: 3ffe:2400:0:109::2 463.514ms reached
Resume: pmtu 1480 hops 2 back 2
iputils-arping - Tool to send ICMP echo
requests to an ARP address
The arping command acts like the standard ping command except it
pings a machine by its ARP address instead of its IP address. It
is typically used to locate a machine if its hardware address is
known but its IP address is unknown
Install iputils-arping in debian
#apt-get install iputils-arping
This will complete the installation now you need to run this
program with the following command
#arping
Usage: arping [-fqbDUAV] [-c count] [-w timeout] [-I device] [-s
source] destination
For more options and how to use arping check arping
man page
iputils-ping - Tools to test the
reachability of network hosts
The ping command sends ICMP ECHO_REQUEST packets to a host in
order to test if the host is reachable via the network.
This package includes a ping6 utility which supports IPv6
network connections.
Install iputils-ping in debian
#apt-get install iputils-ping
This will complete the installation now you need to run this
program with the following command
#ping
For more options and how to use ping check ping
man page
jnettop - View
hosts/ports taking up the most network traffic
jNettop captures traffic comming across the host it is running
on and displays streams sorted by bandwidth they use. Result is
a nice listing of communication on network by host and port, how
many bytes went through this transport and the bandwidth it is
consuming.
Install jnettop in debian
#apt-get install jnettop
This will complete the installation now you need to run this
program with the following command
#jnettop
This will display a GUI with all the network traffic comming
across the host
knocker - a simple
and easy to use TCP security port scanner
Knocker is a new, simple, and easy to use TCP security port
scanner written in C, using threads. It is able to analyze hosts
and the network services which are running on them.
The URL for this project is http://knocker.sourceforge.net/
Install knocker in debian
#apt-get install knocker
This will complete the installation now you need to run this
program with the following command
#knocker -H 192.168.0.1 -SP 1 -EP 1024
Output looks like below
+-----------------------------------------------------------------------------+
|--=| k n o c k e r -- t h e -- n e t -- p o r t s c a n n e r
|=-=[ 0.7.1 ]=-|
+-----------------------------------------------------------------------------+
- started by user root on Fri Jul 21 10:16:00 2006
- hostname to scan: 192.168.0.1
- resolved host ip: 192.168.0.1
- - scan from port: 1
- - - scan to port: 1024
- - - - scan type: tcp connect
+=- - - - - - - - - - - - - - - - - - - - - - - - - - - - - s c
a n n i n g -
-=[ 21/tcp, ftp ]=- * OPEN *
-=[ 22/tcp, ssh ]=- * OPEN *
-=[ 80/tcp, www ]=- * OPEN *
-=[ 111/tcp, sunrpc ]=- * OPEN *
-=[ 113/tcp, auth ]=- * OPEN *
-=[ 199/tcp, smux ]=- * OPEN *
-=[ 607/tcp, nqs ]=- * OPEN *
+=- - - - - - - - - - - - - - - - - - - - - - - - - - - - c o m
p l e t e d -
- scanned host name: 192.168.0.1 IP: 192.168.0.1
- found 7 open ports in a total of 1024 ports scanned.
- port scan completed in 0.10 seconds.
knockd - small port-knock daemon
A port-knock server that listens to all traffic on a given
network interface (only Ethernet and PPP are currently
supported), looking for a special "knock" sequences of
port-hits. A remote system makes these port-hits by sending a
TCP (or UDP) packet to a port on the server. When the server
detects a specific sequence of port-hits, it runs a command
defined in its configuration file. This can be used to open up
holes in a firewall for quick access.
Install knockd in debian
#apt-get install knockd
If you want how to use knockd and for examples check knockd
man page
labrea - a "sticky" honeypot and IDS
LaBrea takes over unused IP addresses, and creates virtual
servers that are attractive to worms, hackers, and other
denizens of the Internet. The program answers connection
attempts in such a way that the machine at the other end gets
"stuck", sometimes for a very long time.
Install labrea in debian
#apt-get install labrea
How to use labrea and for configuration options check labrea
man page
