System/Network Measuring/Monitoring Theory & Tools

See also: Network Hardware - Fiber: /fiber.
NMAP: /nmap.

Private IPv4 Network & Ranges #

• 10.0.0.0/8 ( 10.0.0.0 - 10.255.255.255 );
• 172.16.0.0/12 ( 172.16.0.0 - 172.31.255.255 );
• 192.168.0.0/16 ( 192.168.0.0 - 192.168.255.255 )

ref: 内网 IP 段有哪些

Tools #

trace route #

• mtr (my traceroute / traceroute 2.0)

real-time speed #

• bmon (graph)
  • multi-interface
• nload (graph)
  • unit : (k)bit
  • min, max, avg, total
  • (avg is the same as nethogs)
• slurm (graph);
  • slurm -i wlan0
• nethogs
  • sudo nethogs wlan0
  • pid, user, program
  • CPU-consuming
  • (stable, the same as avg of nload)
• ifstat
  • scrolling text
• iftop (current graph)
  • [speed per connection] nic is needed, otherwise wired by default.
  • sudo iftop -i wlan0
  • unit : (k)bit
  • Reverse-DNS (don’t like it , use ’n’ to toggl)
• dstat
  • scrolling text
  • // all stat of system
• ntop // TODO, how-to
• sar // all stat of system (cpu/net/ram/io) (see: sar )
• sudo nethogs // network [speed per rprogress & PID], like htop for progresses

network traffic capturing #

• tcpDump + tcpTrace (similar to wireshark)
• http://fasterdata.es.net/fasterdata/network-troubleshooting-tools/tcpdump-tcptrace/
• tcptrace.org
• ipTraf (looks better than tcpdump)
• nGrep //netGrep
• netsniff-ng.org (zero-copy, pacp)
• DAG + DPMI and sunny’s modified tools

For windows, use Wireshark. For localhost in windows, use RawCap+Wireshark.

tcpdump e.g. #

Capture MQTT messages and show contents: tcpdump 'tcp port 1883' -nvvvXi enx00e04c930799

tcpdump write to file and standard output #

tcpdump -w - -U | tee my_file.pcap | tcpdump -r - tcpdump <capture filter args here> -w - | tee $(date +%Y-%m-%d_%H%M%S).pcap | tcpdump -r - tcpdump -w somefile --print (v > 4.99.0)

-w - write binary data to stdout -U write each packet to stdout as it is received, rather than buffering them and outputting in chunks tee <a_file> write input to a_file AND to its own stdout -r - get data from stdin

ref

other #

• mrtg
• trafshow (trace traffic flow in hex mode) // requires X11 ???

ref:

1. http://blog.chinaunix.net/uid-14007815-id-107856.html
2. https://groups.google.com/forum/?fromgroups#!topic/shlug/HXwy5KxDbUs