Three powerful tools for Linux Network Analysis

Analyze the Linux network analysis tool-Linux Enterprise Application-Linux server application information. For more information, see the following. Author: Yang Peng
　　
With the rapid development of the Internet, the network is everywhere, but it may be attacked by all parties at any time. It is necessary for network administrators to know who is accessing resources, who is enjoying services, and who is sending a large amount of junk data. Using the common network analysis tools Tcpdump, Nmap, and Netstat in Linux, you can make network management easier.
Tcpdump mainly intercepts data through the local network interface for analysis. Nmap is a powerful port scanning tool that can scan any host or network. Netstat can be used to check the current service and status of the local machine. These three have their own strengths. By combining them, you can have a thorough understanding of the network situation.
　　
　　
　　 Tcpdump
　　
　　
Tcpdump can intercept all current packets through the local Nic. It has a flexible filtering mechanism to ensure the desired data is obtained. Since Tcpdump can only collect data from the local machine, its applications are limited, most of which are used for gateway or Server Self-detection. For example, if you want to know that the host with the IP address 192.168.0.5 in the local network is currently communicating with the outside world, you can use the following command:
　　
Tcpdump-I eth0 src host 192.168.0.5
　　
　　
　　
By default, Tcpdump outputs data to the screen. If the data size is too large, you may not be able to see the specific content at all. In this case, we can redirect it to the file for analysis. If you have a good eye, you can clearly understand what this guy did:
　　
Visited xinlang Homepage
20:05:32. 473388 192.168.0.5.1872> www.sina.com. http:
S 1372301404: 1372301404 (0) win 64240 (DF)
......
Netbios broadcast for name query
20:05:33. 823388 192.168.0.5.netbios-dgm>
192.168.0.20.netbios-dgm: nbt udp packet (138)
......
Send emails to the POP3 server of Xinhuanet
20:05:41. 953388 192.168.0.5.1878> pop.xinhuanet.com. pop3: S
1374956462: 1374956462 (0) win 64240 (DF)
......
Receive emails to Shenzhen 963
20:05:45. 633388 192.168.0.5.1881> szptt154.szptt.net.cn. pop3:
P 34: 40 (6) ack 146 win 64095 (DF)
......
　　
　　
　　
For example, the above information indicates that at 20:05:45, 192.168.0.5 connects to the POP3 port of the 1881 email Post Office through the 963 source port. This information is sufficient for common network analysis. This is the basic function of Tcpdump. Other advanced functions are refined and enhanced on this basis.
　　
For example, if I only want to know which Web sites 192.168.0.5 is currently accessing, run the following command:
　　
Tcpdump-I eth0 src host 192.168.0.5 and dst port 80
　　
　　
　　
The purpose of this command is to intercept all packets from the host (host) with the source address (src) 192.168.0.5 and the destination (dst) port (port) of the (and) port 80. The data obtained is as follows:
　　
20:05:32. 473388 192.168.0.5.1872> www.sina.com. http:
S 1372301404: 1372301404 (0) win 64240 (DF)
......
20:06:33. 42344 192.168.0.5.1873> www.sohu.com. http:
S 1374301404: 1374301404 (0) win 64245 (DF)
......
20:07:31. 343248 192.168.0.5.1874> www.21cn.com. http:
S 1377301404: 1377301404 (0) win 64241 (DF)
......
　　
　　
　　
Obviously, specific data can be obtained through the logical combination of and or not. Tcpdump can also listen to different data types (such as TCP and UDP) to use different network ranges (such as Host and Net network), and even use Ether to directly specify the physical address.
　　
Using Tcpdump to get information in the network is so clear, is there a clear view. It is precisely because Tcpdump is too powerful, and the protection of personal privacy and sensitive data becomes a problem. Therefore, only root users can use this tool.
　　
　　
　　 Nmap
　　
　　
The Nmap design was originally designed to allow the system administrator to easily understand their network running conditions, such as how many hosts are running and what services are provided separately. Therefore, it scans quickly, especially for large networks. During network scanning, Nmap mainly uses ICMP echo to detect whether the host is enabled. Anyone who knows the TCP/IP protocol knows that the host will respond to the requests sent from a TCP port no matter whether or not the firewall is used for filtering. Therefore, even if strict firewall rules are configured, nmap can still find these hosts. For example, run the following command on a Linux host whose IP address is 192.168.0.1:
　　
Echo 1>/proc/sys/net/ipv4/icmp_echo_ignore_all
　　
　　
　　
The function is to ignore all ICMP echo, that is, to invalidate the Ping command that is usually used to test the network. This can at least defend against POD (Ping of Death) attacks. When you Ping this host on any machine, the request times out, for example:
　　
Pinging 192.168.0.1 with 32 bytes of data:
Request timed out.
Request timed out.
Ping statistics for 192.168.0.1:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)
　　
　　
　　
Is this host offline? Try Nmap:
　　
Nmap-sP 192.168.0.1
Starting nmap V. 2.54BETA22 (www.insecure.org/nmap /)
Host gw.somewhere.net (192.168.0.1) appears to be up.
　　
　　
　　
It seems that the host is still on! Here,-sP specifies to use Ping echo for scanning ).
　　
With this feature, you can quickly know how many hosts are running on the target network:
　　
Nmap-sP 192.168.0.0/24 // 24 indicates that the target is a network, not a single host.
Starting nmap V. 2.54BETA22 (www.insecure.org/nmap /)
Host (192.168.0.2) appears to be up.
Host www.somesite.net (192.168.0.5) appears to be up.
Host (192.168.0.8) appears to be up.
......
Host (192.168.0.253) appears to be up.
Host fake.somesite.net (192.168.0.254) appears to be up.
Nmap run completed -- 256 IP addresses (19 hosts up) scanned in 6 seconds
　　
　　
　　
Now that you know which hosts are on, You can further test the host information, such as the opened ports, services, and operating system types. The scan result shows that the machine 192.168.0.5 is running. To learn more about the host, run the following command:
　　
Nmap 192.168.0.5
　　
　　
　　
The following content will be displayed later:
　　
Starting nmap V. 2.54BETA22 (www.insecure.org/nmap /)
Interesting ports on www.somewhere.net (192.168.0.5 ):
(The 1537 ports scanned but not shown below are in state: closed)
Port State Service
80/tcp open http
135/tcp open loc-srv
139/tcp open netbios-ssn
443/tcp open https
1031/tcp open iad2
1433/tcp open ms-SQL-s
Nmap run completed -- 1 IP address (1 host up) scanned in 0 seconds
　　
　　
　　
It can be determined from the above that this is a host running the Windows operating system, because it enables the dedicated port 1433 of ms SQL Server, and also provides HTTP Services. If such information is obtained by malicious people, the corresponding attack methods can be used. In fact, the powerful Nmap itself can guess the operating system used by the other Party based on the fingerprint characteristics of TCP/IP. We can enable this option with-O:
　　
Nmap-O 192.168.0.5
　　
　　
　　
The result is:
　　
Starting nmap V. 2.54BETA22 (www.insecure.org/nmap /)
Interesting ports on www.somewhere.net (192.168.0.5 ):
(The 1536 ports scanned but not shown below are in state: closed)
Port State Service
80/tcp open http
135/tcp open loc-srv
139/tcp open netbios-ssn
443/tcp open https
1032/tcp open iad3
1433/tcp open ms-SQL-s
Remote operating system guess: Microsoft NT 4.0 Server SP5 2047 Hotfixes
Nmap run completed -- 1 IP address (1 host up) scanned in 2 seconds
　　
　　
　　
It guessed that the remote host type is Microsoft NT 4.0 Server SP5 2047 Hotfixes, which is quite accurate and detailed.
　　
　　
　　 Netstat
　　
　　
Netstat is mainly used for Linux/Unix hosts to view their network conditions, such as the ports enabled, the user services and service statuses. It also displays the system route table and network interface status. It can be said that it is a comprehensive network status check tool, but the rule is moderate.
　　
For example, if you run Netstat on a common Linux server, the display may look like this:
　　
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
Tcp 0 0 xxx.net. http-alt xxx.net: 1209 ESTABLISHED
Tcp 0 0 xxx.net. http-alt xxx.net: 1509 ESTABLISHED
Tcp 0 0 xxx.net. ssh whoami.net: 1867 ESTABLISHED
Tcp 0 0 xxx.net: 1209 xxx.net. http-alt ESTA