tcpdump

tcpdump -i eth0 #Capture Packets from Specific Interface

tcpdump -i any #Capture all packets in any interface

tcpdump -c 5 -i eth0 #Capture Only N Number of Packets

tcpdump -A -i eth0 #Print Captured Packets in ASCII

tcpdump -D #Display Available Interfaces

tcpdump -XX -i eth0 #Display Captured Packets in HEX and 

tcpdump -w 0001.pcap -i eth0 #Capture and Save Packets in a File

tcpdump -r 0001.pcap #Read Captured Packets File

tcpdump -n #show IP address replace name (disable name resolution) 

tcpdump -nn  #show port address replace name (disable port resolution with -nn

tcpdump  tcp #Capture only TCP Packets.

tcpdump port 22 #Capture Packet from Specific Port

tcpdump port 80 #capture packets related to a web (HTTP) service

tcpdump -i eth0 src 192.168.0.2 #Capture Packets from source IP

tcpdump -i eth0 dst 50.116.66.139 #Capture Packets from destination IP

tcpdump --number #show acket numbers in output

tcpdump -t #omit timestamp info from tcpdump outpu

tcpdump -v #show detailed output

tcpdump  icmp #capture ICMP packets only

tcpdump host 54.204.39.132 #only packets related to a specific host

tcpdump -i any -c5 -nn \

     src 192.168.122.98 and port 80 #filter packets from source IP address 192.168.122.98 and service HTTP only

tcpdump -i any -c5 -nn "port 80 \

     and (src 192.168.122.98 \

     or src 54.204.39.132)" #filtering packets for HTTP service only (port 80) and source IP addresses 192.168.122.98 or 54.204.39.132

URL

IP Command

 

 

Show address:

ip: show commands:

• ip help                                    ---> #Display ip commands and arguments
• ip -4 a                                     ---> #Only show TCP/IP IPv4
• ip -6 a                                     ---> #Only show TCP/IP IPv6
• ip a list eth0                           ---> #Only show eth0 interface
• ip a show dev eth0                 ---> #Only show eth0 interface
• ip a show eth0                        ---> #Only show eth0 interface

addr: Display IP Addresses and property information(abbreviation of address)

• ip addr                                    ---> #Show information for all addresses
• ip addr help                            ---> #Display address commands and arguments
• ip addr show dev eth0            ---> #Display information only for device

link: Manage and display the state of all network interfaces

• ip link help                             ---> #Display link commands and arguments
• ip link ls up                            ---> #Only show running interfaces
• ip link show dev eth0             ---> #Display information only for device eth0
• ip link                                     ---> #Show information for all interfaces
• ip -s link                                 ---> #Display interface statistics
• ip -s -s link ls eth0                  ---> #get information about a particular network interface
• ip link set eth0 up                   ---> #Bring eth0 online
• ip link set eth0 down              ---> #Bring eth0 offline
• ip link set eth0 promisc on     ---> #Enable promiscuous mode for eth0

 

Add or Delete Address:

• ip a add {ip_addr/mask} dev {interface}                             ---> #The syntax is as follows to add an IPv4/IPv6 address
• ip a del {ipv6_addr_OR_ipv4_addr} dev {interface}          ---> The syntax is as follows to remove an IPv4/IPv6 address:
• ip addr add 192.168.1.1/24 dev eth0                                   ---> #Add address 192.168.1.1 with netmask 24 to device eth0
• ip a add 192.168.1.200/255.255.255.0 dev eth0                   ---> To assign 192.168.1.200/255.255.255.0 to eth0
• ip a add 192.168.1.200/24 dev eth0                                     ---> To assign 192.168.1.200/255.255.255.0 to eth0
• ip addr del 192.168.1.1/24 dev eth0                                     ---> #Remove address 192.168.1.1/24 from device eth0
• ip a del 192.168.1.200/24 dev eth0                                       ---> To delete 192.168.1.200/24 from eth0

 

---

neigh

neigh : ARP, Show neighbour objects; also known as the ARP table for IPv4

• ip neigh                                                                                    ---> #Display neighbour objects(Show neighbour objects; also known as the ARP table for IPv4)
• ip neigh help                                                                           ---> #Display neighbour commands and arguments
• ip neighbour                                                                            ---> #View the MAC address of the devices connected in your LAN
• ip neigh show dev eth0                                                            ---> #Show the ARP cache for device eth0
• ip neigh add 192.168.1.1 lladdr 1:2:3:4:5:6 dev eth0              ---> #Add address 192.168.1.1 with MAC 1:2:3:4:5:6 to eth0
• ip neigh del 192.168.1.1 dev eth0                                            ---> #Invalidate the entry for 192.168.1.1 on eth0
• ip neigh replace 192.168.1.1 lladdr 1:2:3:4:5:6 dev eth0         ---> #Replace the entry for address 192.168.1.1 to use MAC 1:2:3:4:5:6 on eth0
• ip n show                                                                                  ---> #Display neighbour/arp cache
• ip neigh show                                                                            ---> #Display neighbour/arp cache

Sample outputs (note: masked out some data with alphabets):

74.xx.yy.zz dev eth1 lladdr 00:30:48:yy:zz:ww REACHABLE

10.10.29.66 dev eth0 lladdr 00:30:48:c6:0a:d8 REACHABLE

74.ww.yyy.xxx dev eth1 lladdr 00:1a:30:yy:zz:ww REACHABLE

10.10.29.68 dev eth0 lladdr 00:30:48:33:bc:32 REACHABLE

74.fff.uu.cc dev eth1 lladdr 00:30:48:yy:zz:ww STALE

74.rr.ww.fff dev eth1 lladdr 00:30:48:yy:zz:ww DELAY

10.10.29.65 dev eth0 lladdr 00:1a:30:38:a8:00 REACHABLE

10.10.29.74 dev eth0 lladdr 00:30:48:8e:31:ac REACHABLE

 

The last field show the the state of the “neighbour unreachability detection” machine for this entry:

STALE – The neighbour is valid, but is probably already unreachable, so the kernel will try to check it at the first transmission.

DELAY – A packet has been sent to the stale neighbour and the kernel is waiting for confirmation.

REACHABLE – The neighbour is valid and apparently reachable.

 

Add a new ARP entry:

• ip neigh add {IP-HERE} lladdr {MAC/LLADDRESS} dev {DEVICE} nud {STATE}     ---> #syntax is
• ip neigh add 192.168.1.5 lladdr 00:1a:30:38:a8:00 dev eth0 nud perm         ---> #add a permanent ARP entry for the neighbour 192.168.1.5 on the device eth0:

neighbour state (nud):

permanent The neighbour entry is valid forever and can be only be removed administratively

noarp The neighbour entry is valid. No attempts to validate this entry will be made but it can be removed when its lifetime expires.

stale The neighbour entry is valid but suspicious. This option to ip neigh does not change the neighbour state if it was valid and the address is not changed by this command.

reachable The neighbour entry is valid until the reachability timeout expires.

Delete a ARP entry:

• ip neigh del {IPAddress} dev {DEVICE}               ---> #Syntax
• ip neigh del 192.168.1.5 dev eth1                            ---> #invalidate or delete an ARP entry for the neighbour 192.168.1.5 on the device eth0

Change ARP state:

 

• ip neigh chg 192.168.1.100 dev eth1 nud reachable ---> #TO REACHABLE FOR THE NEIGHBOUR 192.168.1.100 ON THE DEVICE ETH1:

 

---

Route

Route:Display and alter the routing table

• ip route                                                                      ---> #List all of the route entries in the kernel[routing tables]
• ip route show                                                            ---> #check the routing table information of the system
• ip route add default via 192.168.1.1 dev eth0          ---> #Add a default route (for all addresses) via the local gateway 192.168.1.1 that can be reached on device eth0
• ip route add 192.168.1.0/24 via 192.168.1.1            ---> #Add a route to 192.168.1.0/24 via the gateway at 192.168.1.1
• ip route add 192.168.1.0/24 dev eth0                       ---> #Add a route to 192.168.1.0/24 that can be reached on device eth0
• ip route del default via 192.168.1.1                          ---> #delete default gateway                                     
• ip route delete 192.168.1.0/24 via 192.168.1.1        ---> #Delete the route for 192.168.1.0/24 via the gateway at 192.168.1.1
• ip route replace 192.168.1.0/24 dev eth0                  ---> #Replace the defined route for 192.168.1.0/24 to use device eth0
• ip route get 192.168.1.5                                            ---> #Display the route taken for IP 192.168.1.5
• ip r                                                                             ---> #display the contents of the routing tables
• ip r list                                                                       ---> #display the contents of the routing tables
• ip route list                                                                ---> #display the contents of the routing tables
• ip r list 192.168.1.0/24                                              ---> #Display routing for 192.168.1.0/24

output:192.168.1.0/24 dev eth1  proto kernel  scope link  src 192.168.1.10

 

Add a new route:

• ip route add {NETWORK/MASK} via {GATEWAYIP}               ---> #The syntax is
• ip route add {NETWORK/MASK} dev {DEVICE}                      ---> #The syntax is
• ip route add default {NETWORK/MASK} dev {DEVICE}          ---> #The syntax is
• ip route add default {NETWORK/MASK} via {GATEWAYIP}   ---> #The syntax is
• ip route add 192.168.1.0/24 via 192.168.1.254                               ---> #Add a plain route to network 192.168.1.0/24 via gateway 192.168.1.254
• ip route add 192.168.1.0/24 dev eth0                                              ---> #To route all traffic via 192.168.1.254 gateway connected via eth0 network interface

Delete a route:

• ip route del default                                                                           ---> #The syntax is[as follows to delete default gateway]
• ip route del 192.168.1.0/24 dev eth0                                                ---> #In this example, delete the route created in previous subsection:

 

---

Disable [or] flush:

This flush or f command flushes neighbour/arp tables, by specifying some condition.

• ip -s -s n f {IPAddress}                   ---> #The syntax is
• ip -s -s n f 192.168.1.5                    ---> #In this example, flush neighbour/arp table
• ip -s -s n flush 192.168.1.5             ---> #In this example, flush neighbour/arp table
• ip -4 addr flush label "ppp*"           ---> #disable IP address on all the ppp (Point-to-Point) interfaces
• ip -4 addr flush label "eth*"            ---> #Here is another example for all the Ethernet interfaces
• ip -s -s a f to 192.168.2.0/24           --->  #Delete all the IP addresses from the private network (For example) 192.168.2.0/24

output:

2: eth0    inet 192.168.2.201/24 scope global secondary eth0

2: eth0    inet 192.168.2.200/24 scope global eth0

*** Round 1, deleting 2 addresses ***

*** Flush is complete after 1 round ***

 

---

Txqueuelen

set the length of the transmit queue of the device using  ip command as follows:

• ip link set txqueuelen {NUMBER} dev {DEVICE}    --->   # Syntax
• ip link set txqueuelen 10000 dev eth0                           ---> #change the default txqueuelen from 1000 to 10000 for the eth0
• ip a list eth0

 

---

MTU

For gigabit networks, set maximum transmission units (MTU) sizes (JumboFrames) for better network performance. The syntax is:

• ip link set mtu {NUMBER} dev {DEVICE}          ---> #Syntax
• ip link set eth0 mtu 9000                                         ---> #Set the MTU on eth0 to 9000
• ip link set mtu 9000 dev eth0                                   ---> #To change the MTU of the device eth0 to 9000
• ip a list eth0

Sample outputs:

2: eth0:  mtu 9000 qdisc pfifo_fast state UP qlen 1000

    link/ether 00:08:9b:c4:30:30 brd ff:ff:ff:ff:ff:ff

    inet 192.168.1.10/24 brd 192.168.1.255 scope global eth1

    inet6 fe80::208:9bff:fec4:3030/64 scope link 

       valid_lft forever preferred_lft forever

 

---

Broadcast:

Notice:By default, the ip command does not set any broadcast address unless explicitly requested

• ip addr add brd {ADDDRESS-HERE} dev {interface}          ---> #ADDING THE BROADCAST ADDRESS ON THE INTERFACE
• ip addr add broadcast {ADDDRESS-HERE} dev {interface} ---> #ADDING THE BROADCAST ADDRESS ON THE INTERFACE
• ip addr add broadcast 172.20.10.255 dev eth0                           ---> #add 172.20.10.255 as broadcast on eth0

 

---

Multicast

 

maddr: Manage and display multicast IP addresses

• ip maddr                                   ---> #Display multicast information for all devices
• ip maddr show dev eth0           ---> #Display multicast information for device eth0

 

---

OLD and NEW Commands:

• arp -a                                                      -----> ip neigh
• arp -v                                                      -----> ip -s neigh
• arp -s 192.168.1.1 1:2:3:4:5:6                -----> ip neigh add 192.168.1.1 lladdr 1:2:3:4:5:6 dev eth1
• arp -i eth1 -d 192.168.1.1                       -----> ip neigh del 192.168.1.1 dev eth1
• ifconfig -a                                               -----> ip addr
• ifconfig eth0 down                                 -----> ip link set eth0 down
• ifconfig eth0 up                                      -----> ip link set eth0 up
• ifconfig eth0 192.168.1.1                       -----> ip addr add 192.168.1.1/24 dev eth0
• ifconfig eth0 netmask 255.255.255.0     -----> ip addr add 192.168.1.1/24 dev eth0
• ifconfig eth0 mtu 9000                           -----> ip link set eth0 mtu 9000
• ifconfig eth0:0 192.168.1.2                    -----> ip addr add 192.168.1.2/24 dev eth0
• netstat -g                                                 -----> ip maddr
• route                                                        -----> ip route
• route add -net 192.168.1.0 netmask 255.255.255.0 dev eth0              -----> ip route add 192.168.1.0/24 dev eth0
• route add default gw 192.168.1.1                                                        -----> ip route add default via 192.168.1.1

 

---

Abbreviation:

Object Abbreviated form Purpose

• link(l)                               ----> Network device.
• address(a [or] addr)         ----> Protocol (IP or IPv6) address on a device.
• addrlabel(addrl)               ----> Label configuration for protocol address selection.
• neighbour(n [or] neigh)   ----> ARP or NDISC cache entry.
• route(r)                             ----> Routing table entry.
• rule(ru)                             ----> Rule in routing policy database.
• maddress(m [or] maddr)  ----> Multicast address.
• mroute(mr)                       ----> Multicast routing cache entry.
• tunnel(t)                            ----> Tunnel over IP.
• xfrm(x)                              ----> Framework for IPsec protocol.

URL1

Gateway-all

1-show gateway(s):

 

• route
• route -n
• ip route show
• ip route list

 

Add route:

 

• route add default gw {IP-ADDRESS(router IP)} {INTERFACE-NAME}
• route add default gw 192.168.1.254 eth0                            #Route all traffic via 192.168.1.254 gateway connected via eth0 network interface:
• ip route add 192.168.1.0/24 dev eth0                                        #to route all traffic via 192.168.1.254 gateway connected via eth0 network interface:
• ip route add 192.168.1.0/24 via 192.168.1.254                         #to route all traffic via 192.168.1.254 gateway connected via eth0 network interface:

Delete rout

• ip route del default via 192.168.122.1 dev eth0

 

GUI(set configuration from ui)

 

• redhat-config-network                            #if your are using Red Hat/CentOS/Fedora core Linux type this
• network-admin #If you are using other Linux distribution use this

استفاده از netcat

توسط این برنامه می‌توان فایل یا متن از طریق شبکه منتقل نمود:

۱-ارسال متن:

در گیرنده دستور زیر زده شود:

nc -l -p PortNumber

در سمت فرستنده نیز دستور زیر زده شود:

echo "TEXT" | netcat  [Destination] PortNumber

2-ارسال فایل:

درسمت گیرنده دستور زیر زده شود

nc -l -p 1234 > out.file

در سمت فرستنده نیز دستور زیر زده شود

nc -w 3 [destination] 1234 < out.file

3-ارسال فایل-فشرده سازی

درسمت فرستنده دستور زیر زده شود

tar cfp - /some/dir | compress -c | nc -w 3 [destination] 1234

در سمت گیرنده نیز دستور زیر زده شود

nc -l -p 1234 | uncompress -c | tar xvfp -

4-ارسال فایل- محتویات یک هارد (پارتیشن)

درسمت فرستنده دستور زیر زده شود

dd if=/dev/hda3 | gzip -9 | nc -l 3333

در سمت گیرنده نیز دستور زیر زده شود

nc [destination] 3333 | pv -b > hdImage.img.gz

LINK

FTP-auto mount direction

روش زیر اتصا ل یک مسیر اف تی پی به یک فولدر در سروررا توضیح میدهد
ابتدا بسته curlftpfs  را نصب نمایید (نکته: اگر به مشکل خورد ابتدا بسته fuse را نصب نمایید)

vim /etc/init.d/mountftp
#!/bin/sh
#
# Run-level Startup script for curlftpfs
#
# chkconfig: 345 91 19
# description: Startup/Shutdown the curlftpfs
 
# FTP user, password, and host (you can specify the port also eg. ftp.example.com:2002)
ftpUser=user                    #نام کاربری از اف تی پی
ftpPass=password                #پسورد کاربر اف تی پی
ftpHost=ftp.example.com         #مسیر  اف تی پی مورد نظر که باید به  فولدر متصل شود
mPath="/var/mounted/ftp"      #فولدر مورد نظر در سرور فعلی که قرار است مسیر اف تی پی  به آن متصل شود
 
# Create the mounted to dir if doesn't exist
if [ ! -d $mPath ]; then
    mkdir -p $mPath
fi
 
case "$1" in
    start)
        curlftpfs $ftpHost $mPath -o user=$ftpUser:$ftpPass,allow_other
        ;;
    stop)
        fusermount -u $mPath      
        ;;
    reload|restart)
        $0 stop
        $0 start
        ;;
    *)
        echo "Usage: $0 start|stop|restart|reload"
        exit 1
esac
exit 0

سپس قرار دادن این اسکریپت در autostart به روش زیر:

chmod 755 /etc/init.d/mountftp
chkconfig mountftp on

 

دستورات قابل اجرا :

# Start

service mountftp start
 
# Restart and reload
service mountftp restart

service mountftp reload
 
# Stop
service mountftp stop

لینک مفید از این مطلب:  LINK

دستورات کلیدواژه ویندوز

باز شدن صفحه network adapter setting در ویندوز

ncpa.cpl

باز شدن system tools در computer managment در ویندوز

sysdm.cpl

باز شدن صفحه پاک کردن یک برنامه

appwiz.cpl

NFS (Network File System) - شناساندن storage در شبکه بعنوان پارتیشن لوکال

در این آموزش می‌خواهیم هارد سرور 192.168.200.3 را به کلاینت 192.168.200.2 بعنوان پارتیشن لوکالی معرفی نماییم.
نیازمندی:
در سرور: نصب بسته  nfs-kernel-server
در کلاینت :‌نصب بسته  nfs-common

در سرور (192.168.200.3):

1-$ sudo apt-get update
2-$ sudo apt-get install nfs-common
3- create one DIRECTORY to share
4- sudo chown nobody:nogroup DIRECTORY
5- sudo nano /etc/exports
6- DIRECTORY       192.168.200.2(rw,sync,no_root_squash,no_subtree_check)

directory_to_share       client(share_option1,...,share_optionN)

7- sudo exportfs -a
8- sudo service nfs-kernel-server start

در کلاینت (192.168.200.2)

1- sudo apt-get update
2- sudo apt-get install nfs-common
3-create MountPoint
4- sudo mount 192.168.200.3:DIRECTORY    #Directory on server 192.168.200.3
5- df -h
6- sudo mount -a
for permanently mount:
7-vim /etc/fstab
8- 192.168.200.3:DIRECTORY    MountPoint   nfs auto,noatime,nolock,bg,nfsvers=4,intr,tcp,actimeo=1800 0 0

LINK

Get hostname from ip

sudo nmblookup -A  IP | grep '<00' | grep -v GROUP | awk '{print $1}'