Network/Tools - Revision history

Eadam: /* netstat */

2012-04-24T13:15:47Z

netstat

Eadam: /* br0 creation from eth0 */

2012-03-25T13:28:25Z

br0 creation from eth0

Eadam: /* br0 creation from eth0 */

2012-03-25T13:14:43Z

br0 creation from eth0

Eadam at 13:07, 25 March 2012

2012-03-25T13:07:30Z

Eadam: /* Nice commands */

2012-03-21T11:07:35Z

Nice commands

Eadam: Created page with "== Nice commands == taken from: - [http://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html] - [http://www.cyberciti.biz/tips/netstat-command-tutori..."

2012-03-21T10:49:00Z

Created page with "== Nice commands == taken from: - [http://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html] - [http://www.cyberciti.biz/tips/netstat-command-tutori..."

New page

== Nice commands ==

taken from:
- [http://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html]
- [http://www.cyberciti.biz/tips/netstat-command-tutorial-examples.html]

useful to find out if your server is under attack or not. You can also list abusive IP address using this method.

# netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n

Dig out more information about a specific ip address:

# netstat -nat |grep {IP-address} | awk '{print $6}' | sort | uniq -c | sort -n

To print list of all unique IP address connected to server, enter:

# netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq

If you think your Linux box is under attack, print out a list of open connections on your box and sorts them by according to IP address, enter:

# netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n

@@ Line 6: / Line 6: @@
 #!/bin/bash
-#CFGPATH=/etc/sysconfig/network-scripts
+CFGPATH=/etc/sysconfig/network-scripts
-CFGPATH=/root
+#CFGPATH=/root
 REFCFGPATH=/root
@@ Line 20: / Line 20: @@
 # build br0
-grep -v -E '(HWADDR)' $REFCFGPATH/ifcfg-eth0.ref | sed 's/eth0/br0/g' | sed 's/BOOTPROTO=["]*none["]*/BOOTPROTO=static/g' | sed 's/TYPE=["]*Ethernet["]*/TYPE="Bridge"/g' > $CFGPATH/ifcfg-br0
+grep -v -E '(HWADDR|UUID)' $REFCFGPATH/ifcfg-eth0.ref | sed 's/eth0/br0/g' | sed 's/BOOTPROTO=["]*none["]*/BOOTPROTO=static/g' | sed 's/TYPE=["]*Ethernet["]*/TYPE="Bridge"/g' | sed 's/NM_CONTROLLED=["a-z]*/NM_CONTROLLED="no"/g' > $CFGPATH/ifcfg-br0
 </pre>

@@ Line 10: / Line 10: @@
 REFCFGPATH=/root
 if [ ! -f "$REFCFGPATH/ifcfg-eth0.ref" ]; then
    cp $CFGPATH/ifcfg-eth0 $REFCFGPATH/ifcfg-eth0.ref
 fi
 grep -E '(DEVICE|HWADDR|ONBOOT)' $REFCFGPATH/ifcfg-eth0.ref > $CFGPATH/ifcfg-eth0
 echo "BRIDGE=br0" >> $CFGPATH/ifcfg-eth0
-grep -v -E '(HWADDR)' $REFCFGPATH/ifcfg-eth0.ref > $CFGPATH/ifcfg-br0
+# build br0
-sed -i 's/eth0/br0/g' $CFGPATH/ifcfg-br0
+grep -v -E '(HWADDR)' $REFCFGPATH/ifcfg-eth0.ref | sed 's/eth0/br0/g' | sed 's/BOOTPROTO=["]*none["]*/BOOTPROTO=static/g' | sed 's/TYPE=["]*Ethernet["]*/TYPE="Bridge"/g' > $CFGPATH/ifcfg-br0
 </pre>
 == Nice commands ==

← Older revision		Revision as of 13:07, 25 March 2012
Line 1:		Line 1:
		+	== Scripts ==
		+
		+	=== br0 creation from eth0 ===
		+
		+	<pre>
		+	#!/bin/bash
		+
		+	#CFGPATH=/etc/sysconfig/network-scripts
		+	CFGPATH=/root
		+	REFCFGPATH=/root
		+
		+	if [ ! -f "$REFCFGPATH/ifcfg-eth0.ref" ]; then
		+	cp $CFGPATH/ifcfg-eth0 $REFCFGPATH/ifcfg-eth0.ref
		+	fi
		+
		+	grep -E '(DEVICE\|HWADDR\|ONBOOT)' $REFCFGPATH/ifcfg-eth0.ref > $CFGPATH/ifcfg-eth0
		+	echo "BRIDGE=br0" >> $CFGPATH/ifcfg-eth0
		+
		+	grep -v -E '(HWADDR)' $REFCFGPATH/ifcfg-eth0.ref > $CFGPATH/ifcfg-br0
		+	sed -i 's/eth0/br0/g' $CFGPATH/ifcfg-br0
		+	sed -i 's/BOOTPROTO=none/BOOTPROTO=static/g' $CFGPATH/ifcfg-br0
		+	sed -i 's/TYPE="Ethernet"/TYPE="Bridge"/g' $CFGPATH/ifcfg-br0
		+	sed -i 's/HWADDR=/# HWADDR/g' $CFGPATH/ifcfg-br0
		+	</pre>
		+
		+
	== Nice commands ==		== Nice commands ==

@@ Line 28: / Line 28: @@
   - [http://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html]
   - [http://www.cyberciti.biz/tips/netstat-command-tutorial-examples.html]
 === netstat ===

@@ Line 4: / Line 4: @@
   - [http://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html]
   - [http://www.cyberciti.biz/tips/netstat-command-tutorial-examples.html]
 useful to find out if your server is under attack or not. You can also list abusive IP address using this method.
@@ Line 20: / Line 22: @@
   # netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n