untitled - PDF Free Download

路流量 1. 利 OSS Open Source Software 路流量行 2. Linux ntop http://www.ntop.org Iptraf http://iptraf.seul.org Sniffit http://reptile.rug.ac.be/~coder/sniffit/sniffit.html 3. 料 ntop ntop 利 Pisa Luca Deri 1997 年 GNU GPL 精神路路理 ntop 路狀 unix top 令狀 top 見錄路理路流量路路流量 1. 料不 IP 料量數量 2. IP multicast 錄量數量 3. TCP 連錄立路連流量料 4. UDP 料量 5. TCP UDP 6. IP 7. 率 ntop 路流量行類列流量路路路路 1

路路流量 IP IP 類路料類料量路路路理路理 ntop 流量列 1. IP 2. 路路 3. 路例 outlook ntop 浪 4. 路濫例 proxy 行 HTTP FTP 5. 不例 Novell IPX 6. 度例 Iptraf Iptraf Linux console 錄路 TCP/UDP 錄連狀錄路狀 Fedora Linux 裡了行 [root@net122 root]#wget ftp://linux.sinica.edu.tw/fedora/linux/core/1/i386/os/fedora/rpms/iptraf-2.7.0-8.i386. rpm [root@net122 root]rpm -ivh iptraf-2.7.0-8.i386.rpm Iptraf IP 路列來了 TCP ICMP 錄 OSPF 路 IP TCP UDP ICMP non-ip IP 錄了 IP checksum errors interface activity packet size counts 錄了 TCP UDP 錄路 2

濾 TCP UDP 列來理錄 Ethernet FDDI ISDN SLIP PPP loopback 利 Linux 路 Iptraf Iptraf 了 IP TCP UDP ICMP IGMP IGP IGRP OSPF ARP RARP 令來行錄 iptraf { [ -f ] [ -q ] [ { -i iface -g -d iface -s iface -z iface -l iface } [ -t timeout ] [ -B [ -L logfile ] ] ] [ -h ] } -i iface Iptraf 來路 -i all 來路 -g Iptraf 易數量 -d iface Iptraf 數量 -s iface Iptraf 數類來類 -z iface 來行類 -l iface -i 不利 MAC 來行 -t timout Iptraf -B /dev/null 行 3

-L logifle 錄 detail 易 general 路來 /var/log/iptraf 錄 -f 數參數來復 -h 令 Sniffit Sniffit 利來 shareware TCP/IP 不行 TCP/IP 行兩錄來行 sniffit 行句說 sniffit 來行不 4. ntop 列 ntop http://sourceforge.net/ search net-snmp-5.0.9.tar.gz ntop-2.2-0.i386.rpm rrdtool-1.0.41-1.8.0.ntop.i386.rpm [root@net122 root]# wget 4

http://heanet.dl.sourceforge.net/sourceforge/net-snmp/net-snmp-5.0.9.tar.gz [root@net122 root]# wget http://heanet.dl.sourceforge.net/sourceforge/ntop/rrdtool-1.0.41-1.8.0.ntop.i386.rpm [root@net122 root]# wget http://heanet.dl.sourceforge.net/sourceforge/ntop/ntop-2.2-0.i386.rpm net-snmp [root@net122 root]#tar xvfz net-snmp-5.0.9.tar.gz [root@net122 root]# cd net-snmp-5.0.9 [root@net122 net-snmp-5.0.9]#./configure ; make; make install rrdtool ntop [root@net122 root]#rpm -ivh --nodeps rrdtool-1.0.41-1.8.0.ntop.i386.rpm [root@net122 root]#rpm -ivh --nodeps ntop-2.2-0.i386.rpm [root@net122 root]# ln -sf /lib/libssl.so.0.9.7a /lib/libssl.so.2 [root@net122 root]# ln -sf /lib/libcrypto.so.0.9.7a /lib/libcrypto.so.2 [root@net122 root]# mkdir /var/ntop [root@net122 root]#/usr/bin/ntop @/etc/ntop.conf -A 理 web 料理 admin Please enter the password for the admin user: xxxxxxx Please enter the password again: xxxxxxx 17/Feb/2004 14:59:09 Admin user password has been set ntop [root@net122 init.d]# /etc/rc.d/init.d/ntop restart http://<your_ip>:3000 ntop port 3000 若 SSL 連 /etc/ntop.conf ntop port 3001 SSL 5

連 http://192.192.73.122:3000 行連 ntop 連 ntop ntop /etc/ntop.conf 錄 6

# ntop 行 Sets the user that ntop runs as. # 來說都 ntop --user ntop # ntop 錄 --db-file-path /usr/share/ntop # 路 eth0 若 NAT eth1 # ip 流量 #--interface eth0 # port mirroring SPAN ntop 不 MAC #--no-mac # syslog 錄 #--use-syslog # ntop Hub #--track-local-hosts # HTTP webserver 連 port port 3000 --http-server 3000 # HTTPS webserver 連 port http https 來連 --https-server 3001 # 路 #--local-subnets xx.xx.xx.xx/yy # domain. #--domain mydomain.com # rrd # --reuse-rrd-graphics # ntop daemon 行 --daemon 7

ntop Total All Protocol 列路流量 192.192.73.0/24 ee.oit.edu.tw /etc/ntop.conf interface eth0 狀列 Host Domain Data TCP UDP ICMP DLC IPX Decnet (R)ARP AppleTalk OSPF NetBios IGMP OSI IPv6 STP Other /etc/ntop.conf interface eth1 狀 IP 兩 192.168.1.119 192.168.1.254 8

濾 ntop 列串流量 filter expression 濾 Admin ChangeFilter 裡 user admin net 192.192.73.0/24 列 net 192.192.73.0/24 流量濾參 tcpdump filter expression host 192.192.73.122 列 192.192.73.122 流量 net 192.192.73.0/24 列 192.192.73.0/24 流量 port ftp-data 列 ftp 流量 9

數了不什不 192.192.73.0/24 連列來 192.192.73.119 ftp.nsysu.edu.tw FTP 料 38.2MB 192.192.73.119 Host 192.192.73.119 更狀說狀狀率 10

率 Throughput 192.192.73.119 ftp.nsysu.edu.tw 率 11

數來度 550 Kbps Host Domain Data Packets Current Avg Peak Current Avg Peak 192.192.73.119 9.2 Kbps 550.5 Kbps 5.4 Mbps 6.8 Pkts/sec 76.2 Pkts/sec 778.1 Pkts/sec ftp.nsysu.edu.tw 0.0 bps 541.8 Kbps 5.4 Mbps 0.0 Pkts/sec 72.5 Pkts/sec 756.4 Pkts/sec Host Activity 流量狀來狀狀 Status Traffic 數 TTL 路狀 12

路 Status Network Load 類 MRTG 流量 00:57~01:07 01:29~01:27 兩路流量 192.192.73.119 ftp.nsysu.edu.tw ISO 來流量 13

流量錄 Admin Reset Stats 流量零 ntop 了路流量了流量連 http 料 ftp 都錄例 192.192.73.120 連 digital.oit.edu.tw ftp baym-gw33.msgr.hotmail.com http 連 MSN 14

行 Iptraf 料都說來行 iptraf 令 [root@net122 /]# iptraf 數 IP traffic monitor All interfaces 15

易路流 General interface statistics 16

流 Detailed interface statistics eth0 來行類 Statistical breakdowns... By packet size 17

來行類 Statistical breakdowns... By TCP/UDP port 18

若 MAC Address 來 LAN station monitor 19

Filters... 192.192.73.122 TCP 立 TCP Define new filter... IP test 來 Enter CTRL + X Apply filter... test 了來都 192.192.73.122 20

TCP 都 192.192.73.122 UDP 來行 Configure... TCP/UDP service names TCP UDP Logging 行錄行都 21

Activity mode kbytes/s kbits/s Timers Iptraf Additional ports... Delete port/range... 1024 port 狀 Iptraf Iptraf 不路路理了路流量連狀不了 Sniffit sniffit Freshmeat http://freshmeat.net/ 連 http://reptile.rug.ac.be/~coder/sniffit/sniffit.html 來 sniffit 令 [root@net122 root]#wget http://reptile.rug.ac.be/~coder/sniffit/files/sniffit.0.3.7.beta.tar.gz [root@net122 root]# tar zxvf sniffit.0.3.7.beta.tar.gz sniffit.0.3.7.beta 錄錄都了 sniffit 令來 sniffit [root@net122 sniffit.0.3.7.beta]#./configure sn_structs.h 行 _32_bit short source_port, destination_port; short 離 32_bit source_port, destination_port; 22

來行 make 令 [root@net122 sniffit.0.3.7.beta]#make sniffit 行令來 sniffit -v -t <IP nr/name> 行 sniffit IP -i -c <File> 來 sniffit -F <device> sniffit 路 -n ARP RARP 不 IP 來來令 -i 參數 -d 16 -a ASCII -A <char> 不識 <char> -P protocol TCP IP TCP ICMP UDP -p <port> port 0 -l 300bytes 行來行例例./sniffit -p 21 -t 61.62.103.105 說連 61.62.103.105 ftp port 行來錄 [root@net122 sniffit.0.3.7.beta]# less 192.192.73.122.35989-61.62.103.105.21 USER linul PASS 123456 SYST 例 23

./sniffit -p 22 -l 1000-t 61.62.103.105 說連 61.62.103.105 ssh port 行 1000bytes 來錄 [root@net122 sniffit.0.3.7.beta]# less 192.192.73.122.35990-61.62.103.105.22 "192.192.73.122.35990-61.62.103.105.22" may be a binary file. See it anyway? SSH-2.0-OpenSSH_3.5p1 ^@^@^B^\ ^T? z) ^A?G@^@^@=diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 ^@^@^@^Ossh-rsa,ssh-dss^@^@^@f aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndae l-cbc@lysator.liu.se^@^@^@faes128-cbc,3des-cbc,blo wfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se^@ @^@Uhmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd1 60@openssh.com,hmac-sha1-96,hmac-md5- ssh 行亂例./sniffit -p 21 -d -t 61.62.103.105 說連 61.62.103.105 ftp port 行連狀連行 sniffit 來行令./sifferit -c 24

select from host 192.192.73.2 select to host 192.192.73.120 select both port 22 192.192.73.2 192.192.73.120 22 port 錄來錄 192.192.73.2 192.192.73.120 port22 讀 README.FIRST 行 sniffit -i 令 [root@net122 sniffit.0.3.7.beta]#./sniffit -i 路 IP 了 port 令列 q: 離 r: 連 n: TCP IP ICMP UDP 流量 25

g: F1: 來 IP ALL F2: IP ALL F3: 來 port ALL F4: port ALL 5. 論 1. 利 ntop 來 2. 參 24 ntop 3000,3001 3. ntop MRTG 異 4. Iptraf 料 5. Snffit 料 6. 流量 26