How to Capture Network Packets in Solaris

How to Capture Network Packets in Solaris  

# snoop -h

snoop: illegal option -- h

Usage:  snoop

        [ -a ]                  # Listen to packets on audio

        [ -d device ]           # Listen on interface named device

        [ -s snaplen ]          # Truncate packets

        [ -c count ]            # Quit after count packets

        [ -P ]                  # Turn OFF promiscuous mode

        [ -D ]                  # Report dropped packets

        [ -S ]                  # Report packet size

        [ -i file ]             # Read previously captured packets

        [ -o file ]             # Capture packets in file

        [ -n file ]             # Load addr-to-name table from file

        [ -N ]                  # Create addr-to-name table

        [ -t  r|a|d ]           # Time: Relative, Absolute or Delta

        [ -v ]                  # Verbose packet display

        [ -V ]                  # Show all summary lines

        [ -p first[,last] ]     # Select packet(s) to display

        [ -x offset[,length] ]  # Hex dump from offset for length

        [ -C ]                  # Print packet filter code

        [ -q ]                  # Suppress printing packet count

        [ -r ]                  # Do not resolve address to name

        [ filter expression ]

Example:

        snoop -o saved  host fred

        snoop -i saved -tr -v -p19

Show DHCP packets :

# snoop |grep -i dhcp

Using device igb0 (promiscuous mode)

   50.17.0.1 -> NTU-HQ-GLOBAL DHCP/BOOTP DHCPDISCOVER

NTU-HQ-GLOBAL -> 50.17.0.1    DHCP/BOOTP DHCPOFFER

   50.17.0.1 -> NTU-HQ-GLOBAL DHCP/BOOTP DHCPDISCOVER

Show UDP packets :

# snoop |grep -i udp

Using device igb0 (promiscuous mode)

  172.16.0.1 -> 50.200.0.229 UDP D=1728 S=37628 LEN=32

  172.16.0.1 -> 50.17.0.41   UDP D=1728 S=37628 LEN=32

  172.16.0.1 -> 50.210.0.214 UDP D=1728 S=37628 LEN=32

Verbose packet display:

# snoop -v

ETHER:  ----- Ether Header -----

ETHER:

ETHER:  Packet 182 arrived at 15:37:15.74365

ETHER:  Packet size = 66 bytes

ETHER:  Destination = 0:0:5e:0:1:64, U.S. Department of Defense (IANA)

ETHER:  Source      = 0:21:28:d2:88:8c,

ETHER:  Ethertype = 0800 (IP)

^CETHER:

IP:   ----- IP Header -----

IP:

IP:   Version = 4

IP:   Header length = 20 bytes

IP:   Type of service = 0x00

IP:         xxx. .... = 0 (precedence)

IP:         ...0 .... = normal delay

IP:         .... 0... = normal throughput

IP:         .... .0.. = normal reliability

IP:         .... ..0. = not ECN capable transport

IP:         .... ...0 = no ECN congestion experienced

IP:   Total length = 52 bytes

IP:   Identification = 36051

IP:   Flags = 0x4

IP:         .1.. .... = do not fragment

IP:         ..0. .... = last fragment

IP:   Fragment offset = 0 bytes

IP:   Time to live = 255 seconds/hops

IP:   Protocol = 17 (UDP)

IP:   Header checksum = 0000

IP:   Source address = 172.16.0.1, 172.16.0.1

IP:   Destination address = 50.78.0.6, 50.78.0.6

IP:   No options

IP:

UDP:  ----- UDP Header -----

UDP:

UDP:  Source port = 37628

UDP:  Destination port = 1728

UDP:  Length = 32

UDP:  Checksum = DE96

UDP:

Display information on host 172.16.0.1 using summary verbose mode:

# snoop -V 172.16.0.1

To enable data captures from the snoop output without losing packets (while writing to the screen)by sending the snoop output to a file (snooper) :

# snoop -o/tmp/snooper -V 172.16.0.1

Show broadcast packets:

# snoop -d igb0 broadcast

Using device igb0 (promiscuous mode)

50.17.0.1   -> (broadcast)  ARP C Who is 172.16.0.8, sys13 ?

       

Read More

How to traceroute in Solaris 10

traceroute

It will print the route packets take to network host

# traceroute

Usage: traceroute [-adFIlnSvx] [-A address_family] [-c traffic_class]

        [-f first_hop] [-g gateway [-g gateway ...]| -r] [-i iface]

        [-L flow_label] [-m max_hop] [-P pause_sec] [-p port] [-Q max_timeout]

        [-q nqueries] [-s src_addr] [-t tos] [-w wait_time] host [packetlen]

Some output symbol descriptions:

!  the ttl (hop limit) value in the received packet is <= 1.

!H host unreachable.

# traceroute  5 8.8.8.8

traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 40 byte packets

 1  172.16.0.250 (172.16.0.250)  0.679 ms !H *  0.594 ms !H

!X communication administratively prohibited.

 ICMP (ICMP6) unreachable code N.

!F The associated gateway is broken.

!N network unreachable.

!P protocol unreachable.

!S source route failed. It is likely that the gateway does not support source routing.

!T unreachable for the specified TOS (type-of-service).

!U source host isolated or precedence problem.

!A host unreachable for a reason other than lack of an entry in the routing table.

!B packet too big.

!E destination is not a neighbor.

!R unrecognized next header.

# traceroute  50.200.0.144

traceroute to 50.200.0.144 (50.200.0.144), 30 hops max, 40 byte packets

 1  172.16.0.250 (172.16.0.250)  0.457 ms  0.285 ms  0.320 ms

 2  50.200.0.144 (50.200.0.144)  1.593 ms  1.475 ms  1.549 ms

Read More

Install Webmin in solaris 10

What is Webmin…?

Webmin is a web-based interface for system administration for Unix, and it will help administrators to handle so many applications that are running on Unix systems and the system (OS) very easily(eg: mysql, logs, DHCP servers, apache server, setup user accounts, DNS, file sharing and many more).

Default webmin is built in to Solaris 10 under /usr/sfw/webmin  directory.

What you want to do is setup webmin and enables webmin service.

Login as root:#su

Enter a port for the web server. 10000 is the default port

# /usr/sfw/lib/webmin/setup.sh

Or

# /usr/sfw/bin/webminsetup

Login name (default root):

root

Web server port (default 10000):

10000

Use SSL?  [y,n,?,q] ?

        To respond in the affirmative, enter y, yes, Y, or YES. To respond in

        the negative, enter n, no, N, or NO.

Use SSL?  [y,n,?,q] y

***********************************************************************

*            Welcome to the Webmin setup script, version 1.170        *

***********************************************************************

Webmin is a web-based interface that allows Unix-like operating

systems and common Unix services to be easily administered.

Installing Webmin in /usr/sfw/lib/webmin ...

***********************************************************************

Webmin uses separate directories for configuration files and log files.

Unless you want to run multiple versions of Webmin at the same time

you can just accept the defaults.

Config file directory [/etc/webmin]: Found existing Webmin configuration in /etc/webmin

Creating start and stop scripts..

..done

Updating config files..

..done

Changing ownership and permissions ..

..done

Running postinstall scripts ..

..done

Attempting to start Webmin mini web server..

..done

***********************************************************************

Webmin has been installed and started successfully. Use your web

browser to go to

  https://MEN-TM:10000/

and login with the name and password you entered previously.

Because Webmin uses SSL for encryption only, the certificate

it uses is not signed by one of the recognized CAs such as

Verisign. When you first connect to the Webmin server, your

browser will ask you if you want to accept the certificate

presented, as it does not recognize the CA. Say yes.S

Then enable the webmin service

# svcadm enablewebmin

First download relevant webmin package (webmin-1.590.pkg.gz) from http://www.webmin.com/download.html

If your server having internet access:

#

#wgethttp://prdownloads.sourceforge.net/webadmin/webmin-1.590.pkg.gz

Login as root

#su

Untar the webmin package

gunzip webmin-1.590.pkg.gz

pkgadd -dwebmin-1.590.pkg WSwebmin

go to

 #cd /usr/sfw/lib/webmin

Run the setup script

 #./setup.sh

Enter a port for the web server. 10000 is the default port.

The installation will be made to /opt/webmin , you should now be able to login to Webmin at the

URL http://localhost:10000/With the administration username root  and your current root password.

Sample DHCP server configure in Webmin:

Read More

Continuous ping in solaris 10

usage: ping host [timeout]
usage: ping -s [-l | U] [adLnRrv] [-A addr_family] [-c traffic_class]
        [-g gateway [-g gateway ...]] [-F flow_label] [-I interval]
        [-i interface] [-P tos] [-p port] [-t ttl] host [data_size] [npackets]

 -s  :  Send one  datagram  per  second  and collect statistics.

Put a Continuous ping:

# ping -s 50.17.0.1
PING 50.17.0.1 (50.17.0.1): 56 data bytes
64 bytes from 50.17.0.1: icmp_seq=0. time=1.22 ms
64 bytes from 50.17.0.1: icmp_seq=1. time=26.5 ms
64 bytes from 50.17.0.1: icmp_seq=2. time=8.13 ms
64 bytes from 50.17.0.1: icmp_seq=3. time=64.1 ms
64 bytes from 50.17.0.1: icmp_seq=4. time=30.7 ms
64 bytes from 50.17.0.1: icmp_seq=5. time=33.9 ms
64 bytes from 50.17.0.1: icmp_seq=6. time=1.03 ms
64 bytes from 50.17.0.1: icmp_seq=7. time=1.14 ms

.

.

.

.

.

64 bytes from 50.17.0.1: icmp_seq=26. time=1.27 ms

64 bytes from 50.17.0.1: icmp_seq=27. time=0.994 ms

^C

----50.17.0.1 PING Statistics----

28 packets transmitted, 28 packets received, 0% packet loss

round-trip (ms)  min/avg/max/stddev = 0.989/19.27/64.1/18.9

Put a Continuous ping with specific data size :

# ping  -s 50.17.0.1 200

PING 50.17.0.1: 200 data bytes

208 bytes from 50.17.0.1: icmp_seq=0. time=1.35 ms

208 bytes from 50.17.0.1: icmp_seq=1. time=27.1 ms

208 bytes from 50.17.0.1: icmp_seq=2. time=22.1 ms

^C

----50.17.0.1 PING Statistics----

3 packets transmitted, 3 packets received, 0% packet loss

round-trip (ms)  min/avg/max/stddev = 1.35/16.9/27.1/14.

Read More

Mount unmount portable usb DVD/HDD drive in Solaris 10(Sparc server)

Assuming system disabled the automount option.

How to check auto Mount is disable or not:

Check whether  volfs is running or not..

# svcs -a|grep volfs

disabled       Jun_06   svc:/system/filesystem/volfs:default

if it is disabled, enable it for enable auto-mounting option.

# svcadm enable volfs

If the  usb flash is recognize by the system it will be mount and you  can see the
status with

# rmformat

rmformat:The rmformat utility is used to  format,  label,  partition,and  perform  other  miscellaneous  functions  on removable, rewritable media that include floppy drives, and the  PCMCIA memory  and  ata  cards. 

mount, umount: - mount or unmount file systems and remote resources

eg: mount [-F FSType] [generic_options] [-o specific_options] [-O] special

mount_point

bash-3.2# mount -F hsfs -o ro /dev/dsk/c0t0d0s0 /cdrom/unnamed_cdrom

bash-3.2#umount /dev/dsk/c0t0d0s0

[-F FSType]

Used to specify the FSType on which to operate. The FSType must be specified or

must be determinable from /etc/vfstab, or by consulting /etc/default/fs or

/etc/dfs/fstypes.

ro | rw Specify read-only or read-write. The default is rw.

/dev/dsk/c0t0d0s0  : :mount device

/cdrom/unnamed_cdrom :mount location

To find under what names file systems are mounted:  use the
 bash-3.2#df -k


The df utility displays the amount of disk space occupied by mounted  or  unmounted  file systems, the amount of used and available space, and how much of  the  file  system's  total capacity has been used.



-k
 Prints the allocation in kbytes. The output consists  of one  line of information for each specified file system.This information includes  the  file  system  name,  the total  space allocated in the file system, the amount of space allocated to existing files, the total  amount  of space  available  for  the  creation  of  new  files  by unprivileged  users,  and  the  percentage  of  normally.

Read More

VI Editor Quick Reference

Mostly use commands:Create new file name perlFile.pl or open existing file named perlFile.pl.

#vi perlFile.pl

press letter "i" in the keybord for write to the file

Write what eve you want...

If you want to delete a character under cursor:  move pointer on top to the letter, press <Esc> and press letter "x".

To delete character before cursor: move pointer  before the letter , press <Esc> and   press letter "X".

To delete a line: move the pointer to anywhere in the line , press <Esc> and press the letter "dd".
Delete everything in the file: Press <Ese> ":1,$d" and press <Enter>


Save the file : Press <Ese> "wq!"  and press <Enter>
Quite without saving :Press <Ese> "q!"  and press <Enter>

Read More

How to change IP and HOST-NAME on a Solaris 10

How to change IP and HOST-NAME on a Solaris 10

In Solaris 10, you must edit the /etc/hosts and the  /etc/inet/ipnodes file (a symbolic link to /etc/inet/hosts file) with VI editor to do necessary changers an entry for IP address and/or hostname.

How to show the hostname of your system:

# hostname

NTU-HQ-EMS

#

How to show the IP details of your network interfaces:

# ifconfig -a

lo0:1: flags=2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu 8232 index 1

        inet 127.0.0.1 netmask ff000000

igb0:1: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 2

        inet 172.16.0.1 netmask ffffff00 broadcast 172.16.0.255

#

You can change Red (IP) and green(Host name) colour one as your require...

# cat etc/hosts

#

# Internet host table

#

::1     localhost

127.0.0.1       localhost

172.16.0.1      NTU-HQ-EMS      loghost

#

# cat /etc/inet/ipnodes

#

# Internet host table

#

::1     localhost

127.0.0.1       localhost

172.16.0.1      NTU-HQ-EMS      loghost

#

Once done, restart the Network service using following command:

# svcadm restart network/physical

Or reboot the server for the changes to take effect.

Check your physical network is up and running:

# svcs |grep -i physical

online         Feb_08   svc:/network/physical:default

#

Note:

The /etc/inet/ipnodes file stores both IPv4 and IPv6 addresses.

If you need to change addresses, you must add IPv4 addresses to both the hosts and ipnodes files. You add only IPv6 addresses to the ipnodes file.

Also, ensure that the /etc/netmasks file with the network ID and the netmask.

Read More