03-17-2011
extracting features of network traffic
hi all
i want to extract few
connection level features (
not packet level )of the internet traffic through ethernet card interface
the features are as follows
Timestamp Timestamp of paket captured
Duration duration of connection
ip_proto IP protocol type
src_IP source IP address
Dest_IP Destination Address
service Type of service on it such as http telnet
icmp_type type of ICMP service running
src_bytes No of bytes from source
dest_bytes No of bytes from destination
Flags whether SYN flag was used or not
is there any tool for this
or can it be done through any script with tcpdump ?
thanks in advance
Moderator's Comments:
|
|
Double post, continued here, thread closed
|
|
Last edited by pludi; 03-17-2011 at 09:06 AM..
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
there are commands to monitor the memory, paging, io... how about network traffic. i mean commands to see whether the network traffic (LAN) is congested? the closest i got is netstat
thanks (6 Replies)
Discussion started by: yls177
6 Replies
2. Cybersecurity
Hi,
Can someone give me the clue on how to capture network traffic at gateway.
Thanx (2 Replies)
Discussion started by: kayode
2 Replies
3. UNIX for Advanced & Expert Users
I want to monitor network traffic. For this purpose i use snoop command. But snoop command only show those packets which are broadcasted or those packets which recieved by host. But I want to examine whole network traffic. Please tell me how to use snoop for monitoring whole network traffic or if... (3 Replies)
Discussion started by: mansoorulhaq
3 Replies
4. Infrastructure Monitoring
Hi all,
Got a strange one here, well not so much strange, different :-)
I need to work out if a server is particulary chatty, whether its talking / communicating heavily to a particular server, as Im planning to physically move the server to a different server, over a link. Hence the... (6 Replies)
Discussion started by: sbk1972
6 Replies
5. HP-UX
I Colleagues,
Somebody can say me how to monitoring traffic in the network. also I am interested in monitoring memory. if somebody to know a guide with command advanced in unix welcome for me.
Thank you for adcanced. (0 Replies)
Discussion started by: systemoper
0 Replies
6. IP Networking
hi all
i want to extract few connection level features (not packet level )of the internet traffic through ethernet card interface
the features are as follows
Timestamp Timestamp of paket captured
Duration duration of connection
ip_proto IP... (0 Replies)
Discussion started by: vaibhavkorde
0 Replies
7. Shell Programming and Scripting
hi all
i want to extract few connection level features (not packet level )of the internet traffic through ethernet card interface
the features are as follows
Timestamp Timestamp of paket captured
Duration duration of connection
ip_proto IP... (2 Replies)
Discussion started by: vaibhavkorde
2 Replies
8. Infrastructure Monitoring
If I would like to know what connection , data , traffic in a network port ( eth0 ) , what can I do ?
ps. because I always found the network is very slow , so I would like what the network port is doing .
Thanks
Login ID ust3 is currently in read-only mode for multiple infractions. Creating... (0 Replies)
Discussion started by: ust03
0 Replies
9. UNIX for Advanced & Expert Users
Hi All
I am resilience testing an application that is spread across multiple servers.
One thing I will need to do soon is throttle the network traffic for specific interfaces within the test cluster. Specifically, maybe make a connection take twice or three times as long to respond....
I... (3 Replies)
Discussion started by: bbq
3 Replies
10. IP Networking
My son does homework on a school laptop. I was thinking about setting up a gateway on my home network, so that I can monitor web traffic and know if he is doing his homework without standing over his shoulder. Ideally I would like to use the Raspberry Pi Model b that I already have. However, I... (15 Replies)
Discussion started by: gandolf989
15 Replies
LEARN ABOUT DEBIAN
shorewall-tcfilters
SHOREWALL-TCFILTERS(5) [FIXME: manual] SHOREWALL-TCFILTERS(5)
NAME
tcfilters - Shorewall u32 classifier rules file
SYNOPSIS
/etc/shorewall/tcfilters
DESCRIPTION
Entries in this file cause packets to be classified for traffic shaping.
Beginning with Shorewall 4.4.15, the file may contain entries for both IPv4 and IPv6. By default, all rules apply to IPv4 but that can be
changed by inserting a line as follows:
IPV4
Following entries apply to IPv4.
IPV6
Following entries apply to IPv6
ALL
Following entries apply to both IPv4 and IPv6. Each entry is processed twice; once for IPv4 and once for IPv6.
The columns in the file are as follows (where the column name is followed by a different name in parentheses, the different name is used in
the alternate specification syntax).
CLASS - interface:class
The name or number of an interface defined in shorewall-tcdevices[1](5) followed by a class number defined for that interface in
shorewall-tcclasses[2](5).
SOURCE - {-|address}
Source of the packet. May be a host or network address. DNS names are not allowed.
DEST - {-|address}}
Destination of the packet. May be a host or network address. DNS names are not allowed.
You may exclude certain hosts from the set already defined through use of an exclusion (see shorewall-exclusion[3](5)).
PROTO - {-|protocol-number|protocol-name|all}
Protocol.
DEST PORT (dport) - [-|port-name-or-number]
Optional destination Ports. A Port name (from services(5)) or a port number; if the protocol is icmp, this column is interpreted as the
destination icmp-type(s).
SOURCE PORT (sport) - [-|port-name-or-number]
Optional source port.
TOS (Optional) - [-|tos]
Specifies the value of the TOS field. The tos value can be any of the following:
o tos-minimize-delay
o tos-maximuze-throughput
o tos-maximize-reliability
o tos-minimize-cost
o tos-normal-service
o hex-number
o hex-number/hex-number
The hex-numbers must be exactly two digits (e.g., 0x04)x.
LENGTH - [-|number]
Optional - Must be a power of 2 between 32 and 8192 inclusive. Packets with a total length that is strictly less than the specified
number will match the rule.
EXAMPLE
Example 1:
Place all 'ping' traffic on interface 1 in class 10. Note that ALL cannot be used because IPv4 ICMP and IPv6 ICMP are two different
protocols.
#CLASS SOURCE DEST PROTO DEST
# PORT
IPV4
1:10 0.0.0.0/0 0.0.0.0/0 icmp echo-request
1:10 0.0.0.0/0 0.0.0.0/0 icmp echo-reply
IPV6
1:10 ::/0 ::/0 icmp6 echo-request
1:10 ::/0 ::/0 icmp6 echo-reply
FILES
/etc/shorewall/tcfilters
SEE ALSO
http://shorewall.net/traffic_shaping.htm
http://shorewall.net/MultiISP.html
http://shorewall.net/PacketMarking.html
http://shorewall.net/configuration_file_basics.htm#Pairs
shorewall(8), shorewall-accounting(5), shorewall-actions(5), shorewall-blacklist(5), shorewall-ecn(5), shorewall-exclusion(5),
shorewall-hosts(5), shorewall_interfaces(5), shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
shorewall-netmap(5), shorewall-params(5), shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)
NOTES
1. shorewall-tcdevices
http://www.shorewall.net/manpages/shorewall-tcdevices.html
2. shorewall-tcclasses
http://www.shorewall.net/manpages/shorewall-tcclasses.html
3. shorewall-exclusion
http://www.shorewall.net/manpages/shorewall-exclusion.html
[FIXME: source] 06/28/2012 SHOREWALL-TCFILTERS(5)