14

With nmap scan, you usually get 3 states: Open - remote computer responded with a SYN/ACK to your SYN Closed - remote computer rejected your connection attempt with a RST packet Filtered - nothing came back, timeout occured Opening a netcat to port 80 and waiting will not do anything. Port 80 (usually) means a http server is listening on the other side, ...


12

On Cisco devices, you can use Cisco IP SLA. You need to first configure and enable it, and then monitor the results. Steps: 1. ip sla monitor operation-number 2. type echo protocol ipIcmpEcho {destination-ip-address | destination-hostname} [source-ipaddr {ip-address | hostname} | source-interface interface-name] 3. frequency seconds 4. ip sla monitor ...


9

In Infrastructure/ESS mode, it doesn't make much sense to capture packets going to other stations in promiscuous mode, for several reasons : The 802.11 ESS operation assumes that, in a BSS, all non-AP stations must send all their packets to the AP, regardless of the destination address. This is implemented as follows: if a station wants to communicate with ...


9

Two possible choices... a packet capture tap (which is quite viable) or packet capture on the ASA. If you're not interested in buying a tap and inserting it inline, you shouldn't be afraid of capturing on your Cisco PIX. To capture traffic on the PIX, first define an ACL... assume you're trying to capture traffic from a host inside the firewall at 10.10.10....


9

There are a couple of options, depending on how much traffic you will receive: If you're going to receive a lot of traffic, should use gulp, which runs on linux; gulp requires the linux pf_ring kernel module. If the bandwidth requirements are reasonable, you could simply use your laptop with wireshark's ERSPAN decoder; wireshark can see the protocols inside ...


8

A closed port is a port that doesn't have any software listening on it, so an attempt to make a connection to that port on that system will result in the system sending back a TCP RST packet. A filtered port, on the other hand is typically a port that is blocked by a firewall in the network path, so an attempt to make a connection to that port on that ...


6

On juniper hardware you can use the RPM service to get those measurements. The service can be configured to monitor specific interfaces which will help with the 'per-link' requirement.


6

What you are describing is IP Source Route. However, any network with even a hint of security will have source-route disabled. But if you want to try it anyway, keep in mind there's a limit to the size of an IP header, and thus, a limit to the number of hops you can specify.


6

Usually this is discussed in the context of network capture appliances. So - for example - if you have taps on four links and a given packet happens to traverse all four then you'll naturally see four copies of the same packet. De-duplication is the capability to deliver only one copy of this packet to a protocol analyzer. ETA: Some actual use-cases ...


5

The verbiage you're using to setup IPFix is definately right. This is what you have: ovs-vsctl -- set Bridge s1 ipfix=@i -- --id=@i create IPFIX targets=\"10.0.0.1:4739\" obs_domain_id=123 obs_point_id=456 sampling=64 And pretty much the same example is outlined in the ovs-vsctl man file: IPFIX Configure bridge br0 to send one IPFIX flow record per ...


4

According to this list, none of those MIBs carry per-rate statistics. Looking through all the v1 and v2 MIBs, I see nothing to indicate a way to get the per-rate stats. Cisco IOS MIB Locator for my specific 1242. Use "New Search" to get the specifics for your 1142.


4

Unfortunately the DOM MIB does not seem to be supported on any of the EX 22/32/42/82xx switches. I've been bitten by this in the past. The values are present on the device eg: show interfaces diagnostics optics xe-1/1/0, but not exported into the MIB tree.


4

Etherate enables you to measure throughput, latency and packet (frame) loss down at layer 2 directly over Ethernet (which sounds like what you are looking for). It doesn’t measure jitter at present but it will do in the future. Using it you can generate layer 2 Ethernet traffic in a controlled manner which you can measure. You can specify traffic flow ...


4

Check out Y.1731 protocol (or IEEE 802.1ag, or OAM). It's fairly easy to implement in software (I'm guessing that's what you're aiming at), and it's supported by all the physical network elements. There is a very naive open-source Y.1731 implementation in C, which you can look at. Please note that Y.1731 is not designed to cross physical network boundary (...


4

When you only have one Router, then you are fine monitoring both directions or both interfaces. If you monitor both directions and both interfaces, you will be monitoring duplicated flows. The decision of where and what direction to monitor becomes a bit more ionvolved when more Router's are involved. Take this simple example: Host X <----> Router A &...


4

Monitor Mode provides constant channel scanning with attack detection and forensics (packet capture) capabilities. Capture packets regardless of connected network. No association to AP needed (and no authentication). Because it is not connected to a network, you can't process the Wi-Fi frames. If you switch your AP into monitor mode all clients will be ...


4

The concern is that generating the traps will affect the performance of the router, especially on that day when things go wrong and you have a lot of changes. Some problem will cause instability, which will lead to a flurry of traps, which will tax the router, leading to even more instability,... An alternative is to dedicate a router to monitoring the BGP ...


4

You can send configuration commands to the syslog server with the notify syslog command (Cisco IOS Configuration Fundamentals Command Reference): archive ! archive configuration mode log config ! change logger configuration mode logging enable ! log configuration changes notify syslog ! send change notifications to syslog server Examples ...


4

I believe what you're really needing to know is whether the interface is being used "optimally" and how much "spare capacity" you have on that link. These are fuzzy terms, but important because you need to know whether, for example, that 10Gbps interface needs to be replaced with a 40Gbps. From the "show" command output we know that in the last five ...


4

Add the host keyword. As in: user@host> monitor traffic matching "host 192.0.2.22” no-resolve


3

Well I think you are in luck, as there is a wireshark forum convo that addresses this completely, and describes your situation. https://ask.wireshark.org/questions/2365/tcp-window-size-and-scaling Basically, it's not the network, it's more likely the server your traders are all trying to access. The server can't process the packets it's getting at the rate ...


3

as usually, big(modullar) devices and switches have hardware accelerated QOS. So you cant see load of CPU, because qos is implemented in ASIC. Ofcource, it is limited, but limit is in packet per second(1mpps of cef switching npe g1, 2mpps of cef switching - npe g2) , not in bit per second http://www.cisco.com/en/US/prod/collateral/routers/ps341/...


3

Cisco has all sorts of guides to configuring SNMP. For instance: Configuring SNMP. It is possible that some switches or IOS versions will vary. There are also some decision to be made, such as SNMP ACLs, which notifications, etc. You will need to make some decision and customize your configuration. SNMP Configuration Guidelines If the switch starts ...


3

You can query the switch via SNMP to read the ifLastChange field from the standard MIB-2, which gives you the value of the sysUpTime counter when the interface last changed state. You have to read the current sysUpTime value as well to make sense of it, of course, and I recall there are some caveats if that last change is too far in the past because the ...


3

Typically, the approach is indeed just "multiply the observed octet/packet sample counts by 100" (or 1000, or whatever) and that does pretty well for getting overall traffic volumes roughly correct. It gets packet count almost exactly right, because it's sampling every 100 packets. It gets octet count more or less right because ordinarily the bytes-per-...


3

A device (or its SNMP Agent to be precise) can contain whatever objects it likes. Since many (networked) devices often share common objects (for instance related to the Ethernet interface) they make use of common defined objects, as found in common MIBs. For any unique device features it's not uncommon to have an enterprise MIB which defines only the objects ...


3

For traffic analysis sampled netflow is often used, because 1:1 sampling (or non-sampled) netflow can be quite a burden on both the router sending the flow data and on the flow receiver. Most setups I've seen use a sampling rate varying from 1:100 upto 1:4000 (depending on the size of the network and the amount of traffic pushed), and they're perfectly able ...


3

Not sure why wireshark is unable to do this automatically, but you can see the IPv4 header in the "Data" portion: 45 => version/header length 00 => ToS 003b => Length (= 59 bytes) 0000 => Identifier 4000 => Flags + Frag offset 3a => TTL 11 => Protocol (0x11 = 17 = UDP) df93 => Header Checksum d83ac6c3 => Source IP address (216.58....


3

We would like to keep an eye on browsing traffic on LAN 192.168.2.0/24, because we don't want guests to visit wrong websites. Instead of "keeping an eye" on specific traffic you should simply block unwanted traffic. Separate guest subnet from management subnet by firewall. Allow guest subnet access to Internet but not to management network. Allow ...


Only top voted, non community-wiki answers of a minimum length are eligible