This month, I’m going to wrap up discussion of network troubleshooting tools. So far, I’ve covered netstat, tcpdump, and ngrep and sniff. This month, I’ll discuss Ethereal, a tool for browsing network traffic interactively and analyzing network traffic. To put it more emphatically, Ethereal is the all-singing, all-dancing, packet-inspecting tool that all admins should have in their software toolboxes. Ethereal is capable of capturing packets for analysis or reading saved packet captures in a number of common formats. Ethereal support libpcap/tcpdump, Sun’s snoop/atmsnoop, LanAlyzer, MS Network Monitor, HPUX nettl, AIX iptrace, Cisco Secure IDS, and a number of others. (The full list can be found in the FAQ.) Ethereal supports more than 530 network protocols. You can also see supported protocols by selecting “Supported Protocols” from Ethereals Help menu. The Ethereal Interface I’ll start off by taking a look at Ethereal’s interface. Ethereal has a 3-pane interface that shows the user a great deal of information in an easy-to-use interface. The first pane shown gives a summary of captured packets (see Figure 1), displaying the packet number, its source and destination, protocol, and information about the packet. The middle pane gives detailed information about a selected packet, and the bottom pane displays the packet itself in a hexdump style. Note that you can edit the columns in the second pane using Ethereal’s Preferences dialog, found under the Edit menu. A particularly spiffy feature of Ethereal is that it will highlight each part of the packet when you click on the information in the middle pane. For example, let’s say you capture some traffic between your desktop and a Web site, as you’re requesting a Web page. In the first pane, you click on the packet containing a GET request. This displays that packet in the second and third panes. Then, you can click on a particular bit of information contained in that packet in the second window — like the packet’s source — and it will highlight the section of the packet that contains that information in the third window. Of course, you need some captured packet data to display. The Ethereal Web site features some interesting sample captures. They also have several capture formats so users can test Ethereal’s multi-format capabilities. Even if you don’t have much in the way of interesting traffic, it’s a good idea to familiarize yourself with Ethereal’s packet-capturing capabilities. The CTRL+k hotkey will bring […]
https://dissociatedpress.net/2004/08/24/the-open-road-ethereal/
whatis netstat- Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships;
Tip: want to see which programs makeup current connections to your #Linux device?
Try netstat -p
Tipos de conexiones en netstat y ss explicadas
https://www.ochobitshacenunbyte.com/2020/11/07/tipos-de-conexiones-en-netstat-y-ss-explicadas/
¿Cómo se usa el comando ss en Linux?
https://www.ochobitshacenunbyte.com/2020/09/01/como-se-usa-el-comando-ss-en-linux/