Netstat in Linux

List all ports
# netstat -a | more

List all tcp ports using netstat -at
# netstat -at

List all udp ports using netstat -au
# netstat -au

List only listening ports
# netstat -l

List only listening TCP Ports using netstat -lt
# netstat -lt

List only listening UDP Ports using netstat -lu
# netstat -lu

List only the listening UNIX Ports using netstat -lx
# netstat -lx

Show statistics for all ports
# netstat -s

Show statistics for TCP/UDP ports
# netstat -st
# netstat -su

Display PID and program names
# netstat -pt

Don’t resolve host, port and user name
# netstat -an

Print netstat information continuously
# netstat -c

Find the non supportive Address families in your system
# netstat --verbose

Display the kernel routing information
# netstat -r

Find out on which port a program is running
# netstat -ap | grep ssh

Find out which process is using a particular port
# netstat -an | grep ':80'

Show the list of network interfaces
# netstat -i

Display extended information on the interfaces
# netstat -ie


How to install SendMailAnalyser in linux, centOS?

SendmailAnalyzer can work in any platform where Sendmail and Perl could run. What you need is a modern Perl distribution 5.8.x or more is good but older version should also work.

Download sendmailanalyzer-x.x.tar.gz and perform the following opertaions

# tar -zxvf sendmailanalyzer-x.x.tar.gz
# cd sendmailanalyzer-x.x/
# perl Makefile.PL
# make && make install

Start SendmailAnalyzer daemon:

# /usr/local/sendmailanalyzer/sendmailanalyzer -f

Add httpd configuratiosn for SendmailAnalyzer

Alias /sareport /usr/local/sendmailanalyzer/www

<Directory /usr/local/sendmailanalyzer/www>
Options ExecCGI
AddHandler cgi-script .cgi
DirectoryIndex sa_report.cgi
Order deny,allow
Deny from all
Allow from 127.0.0.1
Allow from ::1
# Allow from .example.com
</Directory>

Test:

http://server_ip_address/sareport

Additional tasks to be added in crontab

# SendmailAnalyzer log reporting daily cache
0 1 * * * /usr/local/sendmailanalyzer/sa_cache > /dev/null 2>&1
# On huge MTA you may want to have five minutes caching
#*/5 * * * * /usr/local/sendmailanalyzer/sa_cache -a > /dev/null 2>&1

Logrotate:

/etc/logrotate.d/syslog to restart SendmailAnalyzer when maillog is rotated or create a cron job.

For example:

/var/log/cron /var/log/debug /var/log/maillog /var/log/messages /var/log/secure /var/log/spooler /var/log/syslog
{
   sharedscripts
   postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2>/dev/null` 2>/dev/null || true
/PATH_TO/rc.sendmailanalyzer restart >/dev/null 2>&1 || true
# or /etc/rc.d/init.d/sendmailanalyzer restart >/dev/null 2>&1 || true
   endscript
}

How to install darkstat in linux, centOS?

Darkstat - Web Based Network Traffic & Bandwidth Monitoring Tool on Linux

# yum install darkstat

# darkstat -i eth0

Test:

http://ip-address:667

How to install Monitorix in linux, centOS?

-->Monitorix is a lightweight system monitoring tool that can track services and resources of a system. This is one of the best tool to track system activities in simple and easiest way.

It can monitor system attributes like
-->System load
-->Active processes
-->Memory allocation
-->Kernel usage
-->Context switches and forks
-->VFS usage
-->Kernel usage per processor
-->Filesystems usage
-->Disk I/O activity
-->Inode usage
-->Time spent in I/O activity
-->Network traffic and usage
-->IPv4 states
-->IPv6 states
-->Active close
-->Passive close
-->UDP statistics
-->System services demand
-->IMAP and POP3 services
-->SMTP service
-->Network port traffic (Ports: 21, 22, 25, 80, 110, 139, 3306, 53, 143)
-->Users using the system
-->Devices interrupt activity


Installation Procedure

# yum install httpd rrdtool rrdtool-perl perl-libwww-perl perl-MailTools perl-MIME-Lite perl-CGI perl-DBI

Note: Some times on updated package this may not be enough, use the following command to update and download more packages to support the configurations.

# yum -y install rrdtool rrdtool-perl perl-libwww-perl perl-MailTools perl-MIME-Lite perl-CGI perl-DBI perl-XML-Simple perl-Config-General perl-HTTP-Server-Simple perl-IO-Socket-SSL

Download monitorix and install

# rpm -ivh http://www.monitorix.org/monitorix-n.n.n-1.noarch.rpm

After successful installations

# service monitorix start
#chkconfig monitorix on  ----> Add to startup

Log file: /var/log/monitorix

Testing:

http://ip-address:8080/monitorix/


Thats all, comments and suggestions are welcome!!

Download whole website using command

# wget -r --level=0 -convert-links --page-requisites --no-parent www.website.com

The wget options:
-r
--recursive, perform recursive
-l
--level=,Use 0 for infinite depth level or use number greater than 0 for limited depth.
-k
-convert-links,Modify links inside downloaded files to point to local files.
-p
--page-requisites, Get all images, css, js files which make up the web page.
-np
--no-parent, Don't download parent directory contents.

Install Cacti in Linux

Cacti is a complete frontend to RRDTool, it stores all of the necessary information to create graphs and populate them with data in a MySQL database.

We need to install the following software to install cacti.

1) MySQL Server : Store cacti data
2) NET-SNMP server – SNMP (Simple Network Management Protocol) is a protocol used for network management.
3) PHP with net-snmp module – Access SNMP data using PHP.
4) Apache / lighttpd / ngnix webserver : Web server to display graphs created with PHP and RRDTOOL.

Install the software

# yum install mysql-server mysql php-mysql php-pear php-common php-gd php-devel php php-mbstring php-cli php-snmp php-pear-Net-SMTP php-mysql httpd

Configure MySQL server

Setting up root password:-
# mysqladmin -u root password NEWPASSWORD

Create cacti MySQL database
# mysql -u root -p -e ‘create database cacti’

Create a user name cacti with a password your password, then enter

Login to mysql
# mysql -u root –p

mysql> GRANT ALL ON cacti.* TO cacti@localhost IDENTIFIED BY ‘your password’;
mysql> FLUSH privileges;
mysql> \q

Intall snmpd

Type the following command to install net-snmpd
# yum install net-snmp-utils php-snmp net-snmp-libs

To configure snmpd, open the snmpd.conf configuration file.

# vi /etc/snmp/snmpd.conf and modify like the following

com2sec local     localhost           public
group MyRWGroup v1         local
group MyRWGroup v2c        local
group MyRWGroup usm        local
view all    included  .1                               80
access MyRWGroup “”      any       noauth    exact  all    all    none
syslocation Unknown (edit /etc/snmp/snmpd.conf)
syscontact Root  (configure /etc/snmp/snmp.local.conf)
pass .1.3.6.1.4.1.4413.4.1 /usr/bin/ucd5820stat

Save and closed the configuration file and start the snmp service. Type the following.

# /etc/init.d/snmpd start
# chkconfig snmpd on

Install cacti

Update the repository:

rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm

# yum install cacti

Install cacti tables

Type the following command to find out cacti.sql path:
# rpm -ql cacti | grep cacti.sql

Sample output:

/usr/share/doc/cacti-0.8.7d/cacti.sql

Type the following command to install cacti tables, use cacti user and password

# mysql -u cacti -p cacti < /usr/share/doc/cacti-0.8.7d/cacti.sql

Configure cacti database string, Open /var/www/cacti/include
# config.php

Modify the following changes as follows

/* make sure these values refect your actual database/host/user/password */

$database_type = “mysql”;
$database_default = “cacti”;
$database_hostname = “localhost”;
$database_username = “cacti”;
$database_password = “your password”;
$database_port = “3306″;

Configure httpd for cacti, Update allow from line, set to your LAN subnet to allow access to cacti

Open /etc/httpd/conf.d/cacti.conf file

# vi /etc/httpd/conf.d/cacti.conf

Alias /cacti/ /var/www/cacti/

<Directory /var/www/cacti/>
DirectoryIndex index.php
Options -Indexes
AllowOverride all
order deny,allow
allow from 172.16.0.0/16 #your network address
AddType application/x-httpd-php .php
php_flag magic_quotes_gpc on
php_flag track_vars on
</Directory>

Restart the httpd

# /etc/init.d/httpd  restart

Setup cacti cronjob

Open /etc/cron.d/cacti file

# vi /etc/cron.d/cacti

Uncomment the line:
*/5 * * * *     cacti   /usr/bin/php /usr/share/cacti/poller.php > /dev/null 2>&1

Save and close the file.

Now cacti is ready, you can run the cacti type the following

http://server-IP-address/cacti/

or http://localhost/cacti

Note: The default username and password for cacti is admin / admin.

Monitor Network Switch and Ports Using Nagios


1. Enable switch.cfg in nagios.cfg

Uncomment the switch.cfg line in /usr/local/nagios/etc/nagios.cfg as shown below.

cfg_file=/usr/local/nagios/etc/objects/switch.cfg

2. Add new hostgroup for switches in switch.cfg

Add the following switches hostgroup to the /usr/local/nagios/etc/objects/switch.cfg file.

define hostgroup
{
hostgroup_name  switches
alias           Network Switches
}

3. Add a new host for the switch to be monitered

In this example, I’ve defined a host to monitor the core switch in the /usr/local/nagios/etc/objects/switch.cfg file. Change the address directive to your switch ip-address accordingly.

define host
{
use             generic-switch
host_name       core-switch
alias           Cisco Core Switch
address         192.168.1.50
hostgroups      switches
}

4. Add common services for all switches

Displaying the uptime of the switch and verifying whether switch is alive are common services for all switches. So, define these services under the switches hostgroup_name as shown below.

# Service definition to ping the switch using check_ping

define service
{
use                     generic-service
hostgroup_name          switches
service_description     PING
check_command           check_ping!200.0,20%!600.0,60%
normal_check_interval   5
retry_check_interval    1
}

# Service definition to monitor switch uptime using check_snmp

define service
{
use                     generic-service
hostgroup_name          switches
service_description     Uptime
check_command           check_snmp!-C public -o sysUpTime.0
}

5. Add service to monitor port bandwidth usage

check_local_mrtgtraf uses the Multil Router Traffic Grapher – MRTG. So, you need to install MRTG for this to work properly. The *.log file mentioned below should point to the MRTG log file on your system.

define service
{
use        generic-service
host_name core-switch
service_description Port 1 Bandwidth Usage
check_command check_local_mrtgtraf!/var/lib/mrtg/192.168.1.11_1.log!AVG!1000000,2000000!5000000,5000000!10
}

6. Add service to monitor an active switch port

Use check_snmp to monitor the specific port as shown below. The following two services monitors port#1 and port#5. To add additional ports, change the value ifOperStatus.n accordingly. i.e n defines the port#.

# Monitor status of port number 1 on the Cisco core switch

define service
{
use                  generic-service
host_name            core-switch
service_description  Port 1 Link Status
check_command        check_snmp!-C public -o ifOperStatus.1 -r 1 -m RFC1213-MIB
}

# Monitor status of port number 5 on the Cisco core switch

define service
{
use                  generic-service
host_name            core-switch
service_description  Port 5 Link Status
check_command       check_snmp!-C public -o ifOperStatus.5 -r 1 -m RFC1213-MIB
}


7. Add services to monitor multiple switch ports together

Sometimes you may need to monitor the status of multiple ports combined together. i.e Nagios should send you an alert, even if one of the port is down. In this case, define the following service to monitor multiple ports.

# Monitor ports 1 - 6 on the Cisco core switch.

define service
{
use                   generic-service
host_name             core-switch
service_description   Ports 1-6 Link Status
check_command         check_snmp!-C public -o ifOperStatus.1 -r 1 -m RFC1213-MIB, -o ifOperStatus.2 -r 1 -m RFC1213-MIB, -o ifOperStatus.3 -r 1 -m RFC1213-MIB, -o ifOperStatus.4 -r 1 -m RFC1213-MIB, -o ifOperStatus.5 -r 1 -m RFC1213-MIB, -o ifOperStatus.6 -r 1 -m RFC1213-MIB
}


8. Validate configuration and restart nagios

Verify the nagios configuration to make sure there are no warnings and errors.

# /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

Total Warnings: 0
Total Errors:   0
Things look okay - No serious problems were detected during the pre-flight check

Restart the nagios server to start monitoring the VPN device.

# /etc/rc.d/init.d/nagios stop

Stopping nagios: .done.

# /etc/rc.d/init.d/nagios start

Starting nagios: done.

Check: http://Your-server-ip/nagios or http://localhost/nagios in browsers

Network Related Commands

# dhclient eth0   
active interface 'eth0' in dhcp mode

# ethtool eth0   
show network statistics of eth0

# host www.example.com   
lookup hostname to resolve name to ip address and viceversa

# hostname   
show hostname of system

# ifconfig eth0   
show configuration of an ethernet network card

# ifconfig eth0 192.168.1.1 netmask 255.255.255.0   
configure IP Address

# ifconfig eth0 promisc   
configure 'eth0' in promiscuous mode to gather packets (sniffing)

# ifdown eth0   
disable an interface 'eth0'

# ifup eth0   
activate an interface 'eth0'

# ip link show   
show link status of all network interfaces

# iwconfig eth1   
show wireless networks

# iwlist scan   
wifi scanning to display the wireless connections available

# mii-tool eth0   
show link status of 'eth0'

# netstat -tup   
show all active network connections and their PID

# netstat -tupl   
show all network services listening on the system and their PID

# netstat -rn   
show routing table alike "route -n"

# nslookup www.example.com   
lookup hostname to resolve name to ip address and viceversa

# route -n   
show routing table

# route add -net 0/0 gw IP_Gateway   
configure default gateway

# route add -net 192.168.0.0 netmask 255.255.0.0 gw 192.168.1.1   
configure static route to reach network '192.168.0.0/16'

# route del 0/0 gw IP_gateway   
remove static route

# echo "1" > /proc/sys/net/ipv4/ip_forward   
activate ip routing

# tcpdump tcp port 80   
show all HTTP traffic

# whois www.example.com   
lookup on Whois database

User and Group Related Commands

# chage -E 2005-12-31 user1   
set deadline for user password

# groupadd [group-name]   
create a new group

# groupdel [group-name]   
delete a group

# groupmod -n moon sun   
rename a group from moon to sun

# grpck   
check correct syntax and file format of '/etc/group' and groups existence

# newgrp - [group-name]   
log into a new group to change default group of newly created files

# passwd   
change password

# passwd user1   
change a user password (only by root)

# pwck   
check correct syntax and file format of '/etc/passwd' and users existence

# useradd -c "User Linux" -g admin -d /home/user1 -s /bin/bash user1   
create a new user "user1" belongs "admin" group

# useradd user1   
create a new user

# userdel -r user1   
delete a user ( '-r' eliminates home directory)

# usermod -c "User FTP" -g system -d /ftp/user1 -s /bin/nologin user1   
change user attributes

ls commands

See list SCSI devices (or hosts) and their attributes under Linux operating systems
# lsscsi -g

Use this command to list block devices
# lsblk

To see file system type
# lsblk -f

To output info about permissions
# lsblk -m

Use this command to see Linux distribution-specific information, enter
# lsb_release
# lsb_release -a

Use this command to see USB buses in the Linux based system and the devices connected to them
# lsusb

lscpu command shows information about CPU architecture information like number of CPUs, threads, cores
# lscpu

lspci command shows information about PCI buses in the system and devices connected
# lspci

lspci command can be used to find out if a given PCI hardware
# lspci | grep VT6120

lshw command finds detailed information about the hardware configuration
# lshw / lshw-gtk

Use ls command to list directory contents
# ls
# ls -l ## long format
# ls -F ## appends a character revealing the nature of a file
# ls -a ## Show all files including hidden files
# ls -R ## recursively lists subdirectories
# ls -d ## Get info about a symbolic link or directory
# ls -t ## Sort the list of files by modification time
# ls -h ## Show sizes in human readable format
# ls -B ## In directories, ignore files that end with ‘~’ (backup files)
# ls -Z ## Display the SELinux security context
# ls --group-directories-first -l ## Show directories first (group directories). Useful on server.
# ls --color ##  Colorize the # ls output
# ls --hide='*.txt' -l ## Hide or  ignore files whose names ends with .txt

Use this command list open files, network ports, active process

#lsof | less
List all open file

#lsof -u vivek -i
See all files  opened by user "vivek"

#lsof -i 4 -a -p 7007
List all open IPv4 network files in use by the process whose PID is 7007

#lsof -i TCP80
Find process running on tcp port 80

#lsof -i 6
List only open IPv6 network files

#lsof -i 4
List only open IPv4 network files

#lsof -i TCP1-1024
List process open in port range 1 to 1024

#lsof -i @server.host.example1200-1205
List all files using any protocol on ports 1200 to 1205 of host server.host.example, use            

#lsof /dev/sr0
List all open files on device /dev/sr0

#lsof /dev/dvd
Find out why my DVD drive does not eject?

#lsof -i -u^root
See all files open by all users except root

#lsof /etc/foobar
Find out who's looking at the /etc/foobar file?

Use lsattr to lists the file attributes on a second extended file system
# lsattr /etc/passwd

Use lshal command to display items in the HAL (Hardware Abstraction Layer)
# lshal | less

Use this command to show the content of given initramfs images
# lsinitramfs /boot/initrd.img

Use this command to list all device driver loaded currently in the Linux Kernel
# lsmod

See information about the PCMCIA sockets and devices
# lspcmcia

Use this command to to lists all locks associated with the local files of the system
# lslk

Use this command to display the number of messages in a mailbox
# lsmbox