untitled

Size: px

Start display at page:

Download "untitled"

羸柳陈
5 years ago
Views:

1 路流量 1. 利 OSS Open Source Software 路流量行 2. Linux ntop Iptraf Sniffit 3. 料 ntop ntop 利 Pisa Luca Deri 1997 年 GNU GPL 精神路路理 ntop 路狀 unix top 令狀 top 見錄路理路流量路路流量 1. 料不 IP 料量數量 2. IP multicast 錄量數量 3. TCP 連錄立路連流量料 4. UDP 料量 5. TCP UDP 6. IP 7. 率 ntop 路流量行類列流量路路路路 1

2 路路流量 IP IP 類路料類料量路路路理路理 ntop 流量列 1. IP 2. 路路 3. 路例 outlook ntop 浪 4. 路濫例 proxy 行 HTTP FTP 5. 不例 Novell IPX 6. 度例 Iptraf Iptraf Linux console 錄路 TCP/UDP 錄連狀錄路狀 Fedora Linux 裡了行 root]#wget ftp://linux.sinica.edu.tw/fedora/linux/core/1/i386/os/fedora/rpms/iptraf i386. rpm root]rpm -ivh iptraf i386.rpm Iptraf IP 路列來了 TCP ICMP 錄 OSPF 路 IP TCP UDP ICMP non-ip IP 錄了 IP checksum errors interface activity packet size counts 錄了 TCP UDP 錄路 2

3 濾 TCP UDP 列來理錄 Ethernet FDDI ISDN SLIP PPP loopback 利 Linux 路 Iptraf Iptraf 了 IP TCP UDP ICMP IGMP IGP IGRP OSPF ARP RARP 令來行錄 iptraf { [ -f ] [ -q ] [ { -i iface -g -d iface -s iface -z iface -l iface } [ -t timeout ] [ -B [ -L logfile ] ] ] [ -h ] } -i iface Iptraf 來路 -i all 來路 -g Iptraf 易數量 -d iface Iptraf 數量 -s iface Iptraf 數類來類 -z iface 來行類 -l iface -i 不利 MAC 來行 -t timout Iptraf -B /dev/null 行 3

4 -L logifle 錄 detail 易 general 路來 /var/log/iptraf 錄 -f 數參數來復 -h 令 Sniffit Sniffit 利來 shareware TCP/IP 不行 TCP/IP 行兩錄來行 sniffit 行句說 sniffit 來行不 4. ntop 列 ntop search net-snmp tar.gz ntop i386.rpm rrdtool ntop.i386.rpm root]# wget 4

5 root]# wget root]# wget net-snmp root]#tar xvfz net-snmp tar.gz root]# cd net-snmp net-snmp-5.0.9]#./configure ; make; make install rrdtool ntop [root@net122 root]#rpm -ivh --nodeps rrdtool ntop.i386.rpm [root@net122 root]#rpm -ivh --nodeps ntop i386.rpm [root@net122 root]# ln -sf /lib/libssl.so.0.9.7a /lib/libssl.so.2 [root@net122 root]# ln -sf /lib/libcrypto.so.0.9.7a /lib/libcrypto.so.2 [root@net122 root]# mkdir /var/ntop [root@net122 -A 理 web 料理 admin Please enter the password for the admin user: xxxxxxx Please enter the password again: xxxxxxx 17/Feb/ :59:09 Admin user password has been set ntop [root@net122 init.d]# /etc/rc.d/init.d/ntop restart ntop port 3000 若 SSL 連 /etc/ntop.conf ntop port 3001 SSL 5

6 連行連 ntop 連 ntop ntop /etc/ntop.conf 錄 6

7 # ntop 行 Sets the user that ntop runs as. # 來說都 ntop --user ntop # ntop 錄 --db-file-path /usr/share/ntop # 路 eth0 若 NAT eth1 # ip 流量 #--interface eth0 # port mirroring SPAN ntop 不 MAC #--no-mac # syslog 錄 #--use-syslog # ntop Hub #--track-local-hosts # HTTP webserver 連 port port http-server 3000 # HTTPS webserver 連 port http https 來連 --https-server 3001 # 路 #--local-subnets xx.xx.xx.xx/yy # domain. #--domain mydomain.com # rrd # --reuse-rrd-graphics # ntop daemon 行 --daemon 7

ntop Total All Protocol 列路流量 192.192.73.0/24 ee.oit.edu.tw /etc/ntop.

8 ntop Total All Protocol 列路流量 /24 ee.oit.edu.tw /etc/ntop.conf interface eth0 狀列 Host Domain Data TCP UDP ICMP DLC IPX Decnet (R)ARP AppleTalk OSPF NetBios IGMP OSI IPv6 STP Other /etc/ntop.conf interface eth1 狀 IP 兩

9 濾 ntop 列串流量 filter expression 濾 Admin ChangeFilter 裡 user admin net /24 列 net /24 流量濾參 tcpdump filter expression host 列流量 net /24 列 /24 流量 port ftp-data 列 ftp 流量 9

數了不什不 192.192.73.0/24 連列來 192.192.73.119 ftp.nsysu.edu.

10 數了不什不 /24 連列來 ftp.nsysu.edu.tw FTP 料 38.2MB Host 更狀說狀狀率 10

11 率 Throughput ftp.nsysu.edu.tw 率 11

數來度 550 Kbps Host Domain Data Packets Current Avg Peak Current Avg Peak 192.192.73.119 9.2 Kbps 550.5 Kbps 5.4 Mbps 6.8 Pkts/sec 76.2 Pkts/sec 778.

12 數來度 550 Kbps Host Domain Data Packets Current Avg Peak Current Avg Peak Kbps Kbps 5.4 Mbps 6.8 Pkts/sec 76.2 Pkts/sec Pkts/sec ftp.nsysu.edu.tw 0.0 bps Kbps 5.4 Mbps 0.0 Pkts/sec 72.5 Pkts/sec Pkts/sec Host Activity 流量狀來狀狀 Status Traffic 數 TTL 路狀 12

13 路 Status Network Load 類 MRTG 流量 00:57~01:07 01:29~01:27 兩路流量 ftp.nsysu.edu.tw ISO 來流量 13

14 流量錄 Admin Reset Stats 流量零 ntop 了路流量了流量連 http 料 ftp 都錄例連 digital.oit.edu.tw ftp baym-gw33.msgr.hotmail.com http 連 MSN 14

行 Iptraf 料都說來行 iptraf 令 [root@net122 /]#

15 行 Iptraf 料都說來行 iptraf 令 /]# iptraf 數 IP traffic monitor All interfaces 15

16 易路流 General interface statistics 16

17 流 Detailed interface statistics eth0 來行類 Statistical breakdowns... By packet size 17

18 來行類 Statistical breakdowns... By TCP/UDP port 18

19 若 MAC Address 來 LAN station monitor 19

20 Filters TCP 立 TCP Define new filter... IP test 來 Enter CTRL + X Apply filter... test 了來都

21 TCP 都 UDP 來行 Configure... TCP/UDP service names TCP UDP Logging 行錄行都 21

Activity mode kbytes/s kbits/s Timers Iptraf Additional ports... Delete port/range... 1024 port 狀 Iptraf Iptraf 不路路理了路流量連狀不了 Sniffit sniffit Freshmeat http://freshmeat.net/ 連 http://reptile.

22 Activity mode kbytes/s kbits/s Timers Iptraf Additional ports... Delete port/range port 狀 Iptraf Iptraf 不路路理了路流量連狀不了 Sniffit sniffit Freshmeat 連來 sniffit 令 root]#wget root]# tar zxvf sniffit beta.tar.gz sniffit beta 錄錄都了 sniffit 令來 sniffit sniffit beta]#./configure sn_structs.h 行 _32_bit short source_port, destination_port; short 離 32_bit source_port, destination_port; 22

23 來行 make 令 sniffit beta]#make sniffit 行令來 sniffit -v -t <IP nr/name> 行 sniffit IP -i -c <File> 來 sniffit -F <device> sniffit 路 -n ARP RARP 不 IP 來來令 -i 參數 -d 16 -a ASCII -A <char> 不識 <char> -P protocol TCP IP TCP ICMP UDP -p <port> port 0 -l 300bytes 行來行例例./sniffit -p 21 -t 說連 ftp port 行來錄 [root@net122 sniffit beta]# less USER linul PASS SYST 例 23

$See it anyway? SSH-2.0-OpenSSH_3.5p1 ^@^@^B^\ ^T? z) ^A?$

24 ./sniffit -p 22 -l 1000-t 說連 ssh port 行 1000bytes 來錄 sniffit beta]# less " " may be a binary file. See it anyway? SSH-2.0-OpenSSH_3.5p1 ^@^@^B^\ ^T? z) ^A?G@^@^@=diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 ^@^@^@^Ossh-rsa,ssh-dss^@^@^@f aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndae l-cbc@lysator.liu.se^@^@^@faes128-cbc,3des-cbc,blo 60@openssh.com,hmac-sha1-96,hmac-md5- ssh 行亂例./sniffit -p 21 -d -t 說連 ftp port 行連狀連行 sniffit 來行令./sifferit -c 24

25 select from host select to host select both port port 錄來錄 port22 讀 README.FIRST 行 sniffit -i 令 sniffit beta]#./sniffit -i 路 IP 了 port 令列 q: 離 r: 連 n: TCP IP ICMP UDP 流量 25

26 g: F1: 來 IP ALL F2: IP ALL F3: 來 port ALL F4: port ALL 5. 論 1. 利 ntop 來 2. 參 24 ntop 3000, ntop MRTG 異 4. Iptraf 料 5. Snffit 料 6. 流量 26

1

論諸零易量零路車行不年行行年行金行年率流率行論識不易年行年行兩不兩兩行便了識易度行流識年金量更不良不便良不不行度參度度參臨數益數來行行流識率若例量度立行參行識不易料料類料論年流率益行料來度度利度度年料料