Sunday, January 26, 2014
Saturday, January 25, 2014
Python CodeAcademy
Variables, which store values for later use
- Data types, such as numbers and booleans
- Whitespace, which separates statements
- Comments, which make your code easier to read
- Arithmetic operations, including
+,-,*,/,**, and%
Executing a Python Script from Notepad++
- Switch back to Notepad++, and go up to the menu bar, select Run, and then select Run... (F5)
- Insert the following in the text box that appears:
C:\Python27\python.exe -i "$(FULL_CURRENT_PATH)"
- Click Save...
- Configure CTRL+R to be the command. Give it a name, and press OK.
Python on Windows 7
Source: http://www.cs.utexas.edu/~mitra/bytes/start.html
Installation of Python
- Download the current production version of Python (2.7.1) from the Python Download site.
- Double click on the icon of the file that you just downloaded.
- Accept the default options given to you until you get to the Finish button. Your installation is complete.
Setting up the Environment
- Starting at My Computer go to the following directory C:\Python27. In that folder you should see all the Python files.
- Copy that address starting with C: and ending with 27 and close that window.
- Click on Start. Right Click on My Computer.
- Click on Properties. Click on Advanced System Settings or Advanced.
- Click on Environment Variables.
- Under System Variables search for the variable Path.
- Select Path by clicking on it. Click on Edit.
- Scroll all the way to the right of the field called Variable value using the right arrow.
- Add a semi-colon (;) to the end and paste the path (to the Python folder) that you previously copied. Click OK.
Saturday, January 11, 2014
Installing Java Development Environment
1) java se run time environment downloads (google phrase)
http://www.oracle.com/technetwork/java/javase/downloads/java-se-jre-7-download-432155.html
download and install
2) JDK se (Standard edition)
Ensure that jre and jdk versions match
http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html
3)Eclipse java ide
http://www.eclipse.org/downloads/
http://www.oracle.com/technetwork/java/javase/downloads/java-se-jre-7-download-432155.html
download and install
2) JDK se (Standard edition)
Ensure that jre and jdk versions match
http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html
3)Eclipse java ide
http://www.eclipse.org/downloads/
Friday, December 20, 2013
Command Line Tools to Monitor Linux Performance
Command Line Tools to Monitor Linux Performance
http://www.tecmint.com/command-line-tools-to-monitor-linux-performance/
http://www.tecmint.com/command-line-tools-to-monitor-linux-performance/
Thursday, December 19, 2013
Security Testing in Software : Excellent Web Resources (Notes to Self)
Part5: https://www.youtube.com/watch?v=aLRSBZ3pfjw
Authentication
Authorization
Secure data HTTPs
Penetration testing
(twitter API)
Large file upload
Phishing
SQL Injection
Javascript Injection
Trojan Injection
du (Disk Usage) commands
10 Useful du (Disk Usage) Commands to Find Disk Usage of Files and Directories
Performance Testing
Load testing
stress testing /over load testing
capacity/scalability test /yielding point
volume testingendurance
testing/longevity testing/soak testing
cpu usage
memory usage
network usage
disk usage
perfmon (MS)
top
ps
netstat
Webserver
Database serverapp server
profiling/diagnostics
– go inside and find out what is causing the issue
Load Runner by HP
Silk Performer – Borland
Rational Performance – IBM
TestcompleteGomez by Compuware
More Users
More Data
Longer Duration
Response time for
load testingSpeed, will it slow
down or will it crash LatencyConcurrent Users
Different Types of Performance Testinghttps://www.youtube.com/watch?v=zTf27d1IgQ4
Performance Testing Overviewhttps://www.youtube.com/watch?v=NOiEdpwNVx0
Performance Testing - Response Time Breakdown conceptshttps://www.youtube.com/watch?v=w1ogGMZKmVY
Performance Testing Overviewhttps://www.youtube.com/watch?v=NOiEdpwNVx0
Performance Testing - Response Time Breakdown conceptshttps://www.youtube.com/watch?v=w1ogGMZKmVY
Special bash parameters and their meaning
An excellent source on the web :
http://javarevisited.blogspot.com/2011/06/special-bash-parameters-in-script-linux.html
http://javarevisited.blogspot.com/2011/06/special-bash-parameters-in-script-linux.html
Wednesday, December 18, 2013
FTP Vs SFTP Vs FTPS Vs SCP
FTP (File Transfer Protocol) does not take any precautions to protect information transmitted during a session. This includes your username, password, and any files transmitted.
SFTP (Secure File Transfer Protocol) is a secure replacement for FTP (File Transfer Protocol) based on the Secure Shell protocol. Unlike FTP, SFTP encrypts both commands and data providing effective protection against common network security risks. SSH Client and Server provide both command-line SFTP tools and a graphical user interface for Windows users. SFTP encrypts the session, preventing the casual detection of your username, password or anything you've transmitted.
The major reason for implementing SFTP versus FTP is security. FTP is not even remotely secure. During an FTP session, your username and password are transmitted in clear text. If someone is eavesdropping, it is not difficult for them to log your FTP username and password.
In FTP all data is passed back and forth between the client and server without the use of encryption. This makes it possible for an eavesdropper to listen in and retrieve your confidential information including login details. With SFTP all the data is encrypted before it is sent across the network.
SFTP is not the same as FTP/S; the latter implements the original FTP protocol through a separately-created secure tunnel.
FTPS (FTP-SSL) is a real ftp that uses TSL/SSL to encrypt the control session and if required the data session. With FTPS the control session is always encrypted, but the data session might not be. Why is this? Because with the control session encrypted the authentication is protected and you always want this (normal ftp uses clear text). If you are NOT pre-encrypting the file, you want the data session encrypted so that the file is encrypted while the data is in flight. However, if you are pre-encrypting the file then you do not need to have the data connection encrypted as you do not need to add the overhead of encrypting the data connection, since the file is already encrypted. Understand that SFTP is SSH file transfer and FTPS is FTP with SSL, FTPS is a file transport layer on top of SSL or TLS. The FTPS adds SSL-enabled FTP send and receive capabilities, uses the FTP protocol to transfer files to and from SSL-enabled FTP servers.
SSH Servers
OpenSSH (http://www.openssh.com/)
- OpenSSH is a free version of the SSH protocol suite. OpenSSH servers and clients are available for both Unix and Windows.
- OpenSSH has been ported to Windows with the popular CYGWIN utility. The project was created by Network Simplicity (http://www.networksimplicity.com/)
- SSH2 is a commercial version of SSH, with required license fees for commercial use (noncommercial use is free). Commercial SSH clients/servers are available for both Windows and Unix systems.
RESTful Web Services
- The RESTful Web services are completely stateless. This can be tested by restarting the server and checking if the interactions are able to survive.
- Restful services provide a good caching infrastructure over HTTP GET method (for most servers). This can improve the performance, if the data the Web service returns is not altered frequently and not dynamic in nature.
- The service producer and service consumer need to have a common understanding of the context as well as the content being passed along as there is no standard set of rules to describe the REST Web services interface.
- REST is particularly useful for restricted-profile devices such as mobile and PDAs for which the overhead of additional parameters like headers and other SOAP elements are less.
- REST services are easy to integrate with the existing websites and are exposed with XML so the HTML pages can consume the same with ease. There is hardly any need to refactor the existing website architecture. This makes developers more productive and comfortable as they will not have to rewrite everything from scratch and just need to add on the existing functionality.
- REST-based implementation is simple compared to SOAP.
RESTful Vs SOAP
A Web service, in very broad terms, is a method of communication between two applications or electronic devices over the World Wide Web (WWW). Web services are of two kinds: Simple Object Access Protocol (SOAP) and Representational State Transfer (REST).
"I need to update the local inventory database with the inventory information from multiple suppliers. The suppliers provide Web service-based interface. As the application does not have any server side component (the application is a fat client talking directly to the database), is itpossible to consume these Web services directly from my application database?"
REST works really well for are:
- Limited bandwidth and resources; remember the return structure is really in any format (developer defined). Plus, any browser can be used because the REST approach uses the standard GET, PUT, POST, and DELETE verbs. Again, remember that REST can also use the XMLHttpRequest object that most modern browsers support today, which adds an extra bonus of AJAX.
- Totally stateless operations; if an operation needs to be continued, then REST is not the best approach and SOAP may fit it better. However, if you need stateless CRUD (Create, Read, Update, and Delete) operations, then REST is it.
- Caching situations; if the information can be cached because of the totally stateless operation of the REST approach, this is perfect.
That covers a lot of solutions in the above three. So why would I even consider SOAP? Again, SOAP is fairly mature and well-defined and does come with a complete specification. The REST approach is just that, an approach and is wide open for development, so if you have the following then SOAP is a great solution:
- Asynchronous processing and invocation; if your application needs a guaranteed level of reliability and security then SOAP 1.2 offers additional standards to ensure this type of operation. Things like WSRM – WS-Reliable Messaging.
- Formal contracts; if both sides (provider and consumer) have to agree on the exchange format then SOAP 1.2 gives the rigid specifications for this type of interaction.
- Stateful operations; if the application needs contextual information and conversational state management then SOAP 1.2 has the additional specification in the WS* structure to support those things (Security, Transactions, Coordination, etc). Comparatively, the REST approach would make the developers build this custom plumbing.
HTTP Versus HTTPS
The HyperText Transfer Protocol (HTTP) is an application layer protocol, which means it focuses on how information is presented to the user of the computer but doesn’t care a whit about how data gets from Point A to Point B. It is stateless, which means it doesn’t attempt to remember anything about the previous Web session. This is great because there is less data to send, and that means speed. And HTTP operates on Transmission Control Protocol (TCP) Port 80 by default, meaning your computer must send and receive data through this port to use HTTP. Not just any old port will do.
Secure HyperText Transfer Protocol (HTTPS) is for all practical purposes HTTP. The chief distinction is that it uses TCP Port 443 by default, so HTTP and HTTPS are two separate communications. HTTPS works in conjunction with another protocol, Secure Sockets Layer (SSL), to transport data safely. Remember, HTTP and HTTPS don’t care how the data gets to its destination. In contrast, SSL doesn’t care what the data looks like. People often use the terms HTTPS and SSL interchangeably, but this isn’t accurate. HTTPS is secure because it uses SSL to move data.
Secure HyperText Transfer Protocol (HTTPS) is for all practical purposes HTTP. The chief distinction is that it uses TCP Port 443 by default, so HTTP and HTTPS are two separate communications. HTTPS works in conjunction with another protocol, Secure Sockets Layer (SSL), to transport data safely. Remember, HTTP and HTTPS don’t care how the data gets to its destination. In contrast, SSL doesn’t care what the data looks like. People often use the terms HTTPS and SSL interchangeably, but this isn’t accurate. HTTPS is secure because it uses SSL to move data.
Going Through the Process
With HTTP, you sit at your browser and interact with data. HTTP’s job is to present that data to you, and browsers are the means of doing so. Mozilla’s Firefox browser, for example, understands HTTP instructions and arranges the data as the site’s designer intended. The browser knows what to do when you click. It uses HTTP to do this. But HTTP cannot do much beyond that. How the data travels from Point A to Point B, or even if it travels at all, is none of HTTP’s concern. This is a great compromise if you want speed and elegance and couldn’t care less about security. One does not require security to viewBizTech’s latest online articles, for instance.
With HTTPS, the story is quite the same. But when security is a must, HTTPS differentiates one sender and receiver from another. SSL takes the data, going or coming, and encrypts it. This means that SSL uses a mathematical algorithm to hide the true meaning of the data. The hope is that this algorithm is so complex it is either impossible or prohibitively difficult to crack.
The encryption begins when the owner of the Web site purchases a time-sensitive certificate from a trusted certificate authority such as VeriSign. You can get a certificate anywhere, or even make your own, but is it trusted? Your browser will let you know. This certificate is a security code created specifically for that one user, or even for that one Web site. The code is so complex that no one else on Earth should have a duplicate.
Getting a certificate can be an involved task. All types of information must be recorded so the issuer of the certificate can be a reliable authority on the certificate’s owner. Information that must be provided includes the name of the site and even the name of the server that hosts the site. Complexity makes counterfeiting incredibly difficult.
This makes the issuer a trusted third party. When your browser sees the secure Web site, it uses the information in the certificate to verify that the site is what it claims to be. Browsers commonly indicate security by presenting a picture of a shiny closed lock at the bottom of the screen. This process is not always perfect because of human error. Maybe 53.com is a valid banking site, but53RD.com is not. We call that phishing. Unscrupulous people phish for careless people.
What really happens when you navigate to a URL ?
An excellent article:
1. You enter a URL into the browser (facebook.com, not www.facebook.com)
2. The browser looks up the IP address for the domain name
3. The browser sends a HTTP request to the web server
GET http://facebook.com/ HTTP/1.1 Accept: application/x-ms-application, image/jpeg, application/xaml+xml, [...] User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; [...] Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: facebook.com Cookie: datr=1265876274-[...]; locale=en_US; lsd=WW[...]; c_user=2101[...]
The GET request names the URL to fetch: “http://facebook.com/”. The browser identifies itself (User-Agent header), and states what types of responses it will accept (Accept and Accept-Encodingheaders). The Connection header asks the server to keep the TCP connection open for further requests.
The request also contains the cookies that the browser has for this domain. As you probably already know, cookies are key-value pairs that track the state of a web site in between different page requests. And so the cookies store the name of the logged-in user, a secret number that was assigned to the user by the server, some of user’s settings, etc. The cookies will be stored in a text file on the client, and sent to the server with every request.
In addition to GET requests, another type of requests that you may be familiar with is a POST request, typically used to submit forms. A GET request sends its parameters via the URL (e.g.: http://robozzle.com/puzzle.aspx?id=85). A POST request sends its parameters in the request body, just under the headers.
4.The facebook server responds with a permanent redirect
This is the response that the Facebook server sent back to the browser request:
HTTP/1.1 301 Moved Permanently
Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0,
pre-check=0
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Location: http://www.facebook.com/
P3P: CP="DSP LAW"
Pragma: no-cache
Set-Cookie: made_write_conn=deleted; expires=Thu, 12-Feb-2009 05:09:50 GMT;
path=/; domain=.facebook.com; httponly
Content-Type: text/html; charset=utf-8
X-Cnection: close
Date: Fri, 12 Feb 2010 05:09:51 GMT
Content-Length: 0
The server responded with a 301 Moved Permanently response to tell the browser to go to “http://www.facebook.com/” instead of “http://facebook.com/”.
5. The browser follows the redirect
The browser now knows that “http://www.facebook.com/” is the correct URL to go to, and so it sends out another GET request:
GET http://www.facebook.com/ HTTP/1.1 Accept: application/x-ms-application, image/jpeg, application/xaml+xml, [...] Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; [...] Accept-Encoding: gzip, deflate Connection: Keep-Alive Cookie: lsd=XW[...]; c_user=21[...]; x-referer=[...] Host: www.facebook.com
6. The server ‘handles’ the request
The server will receive the GET request, process it, and send back a response.
- Request handlerThe request handler reads the request, its parameters, and cookies. It will read and possibly update some data stored on the server. Then, the request handler will generate a HTML response.
7. The server sends back a HTML response
Here is the response that the server generated and sent back:HTTP/1.1 200 OK Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="DSP LAW" Pragma: no-cache Content-Encoding: gzip Content-Type: text/html; charset=utf-8 X-Cnection: close Transfer-Encoding: chunked Date: Fri, 12 Feb 2010 09:05:55 GMT8. The browser begins rendering the HTML
Even before the browser has received the entire HTML document, it begins rendering the website:9. The browser sends requests for objects embedded in HTML
As the browser renders the HTML, it will notice tags that require fetching of other URLs. The browser will send a GET request to retrieve each of these files.Here are a few URLs that my visit to facebook.com retrieved:
- Imageshttp://static.ak.fbcdn.net/rsrc.php/z12E0/hash/8q2anwu7.gif http://static.ak.fbcdn.net/rsrc.php/zBS5C/hash/7hwy7at6.gif …
- CSS style sheetshttp://static.ak.fbcdn.net/rsrc.php/z448Z/hash/2plh8s4n.css http://static.ak.fbcdn.net/rsrc.php/zANE1/hash/cvtutcee.css …
- JavaScript files http://static.ak.fbcdn.net/rsrc.php/zEMOA/hash/c8yzb6ub.js http://static.ak.fbcdn.net/rsrc.php/z6R9L/hash/cq2lgbs8.js …
Each of these URLs will go through process a similar to what the HTML page went through. So, the browser will look up the domain name in DNS, send a request to the URL, follow redirects, etc.However, static files – unlike dynamic pages – allow the browser to cache them. Some of the files may be served up from cache, without contacting the server at all. The browser knows how long to cache a particular file because the response that returned the file contained an Expires header. Additionally, each response may also contain an ETag header that works like a version number – if the browser sees an ETag for a version of the file it already has, it can stop the transfer immediately.
FTP Vs SSH
Notes to self from : http://www.differencebetween.net/technology/internet/difference-between-ftp-and-ssh/
FTP stands for File Transfer Protocol, a protocol that was created for the transferring of files from a remote location to a local computer, or vice versa. On the other hand, Secure Shell, or SSH, is network protocol that facilitates the communication between two computers, regardless of distance, as long as there is an electrical path for the travel of communication.
FTP is rather old, as it was created prior to the evolution of public networks, as we see them today. Due to this fact, the creators of FTP did not see the need for securing the data, or the authentication of usernames and passwords, and actually sends them in plain text.
This means that anybody with the knowledge to sniff data packets will be able to reconstruct the data being transferred, or worse, get the username and password, gaining full access to the remote site.
SSH was actually created after a sniffing attack was conducted on the Helsinki University of Technology. It replaces the antiquated and vulnerable Telnet protocol that was in prominent use at that time. The security of SSH is implemented by encrypting the data before it is sent out. This is then only decrypted at the designated location.
As a file transfer protocol, FTP is only capable of transferring files from one point to another, and some basic file operations, like copying, moving, or deleting files and directories. SSH goes far beyond this, as it allows the user to issue commands that can be interpreted and executed on the remote computer by a listening server. It can also be used for tunneling, monitoring certain services and applications that are running, and even for transferring files
1. FTP is a file transfer protocol, while SSH is a network protocol.
2. FTP is inherently unsecure,, while SSH is inherently secure.
3. FTP only allows the control of files, while SSH allows a wide variety of applications.
FTP stands for File Transfer Protocol, a protocol that was created for the transferring of files from a remote location to a local computer, or vice versa. On the other hand, Secure Shell, or SSH, is network protocol that facilitates the communication between two computers, regardless of distance, as long as there is an electrical path for the travel of communication.
FTP is rather old, as it was created prior to the evolution of public networks, as we see them today. Due to this fact, the creators of FTP did not see the need for securing the data, or the authentication of usernames and passwords, and actually sends them in plain text.
This means that anybody with the knowledge to sniff data packets will be able to reconstruct the data being transferred, or worse, get the username and password, gaining full access to the remote site.
SSH was actually created after a sniffing attack was conducted on the Helsinki University of Technology. It replaces the antiquated and vulnerable Telnet protocol that was in prominent use at that time. The security of SSH is implemented by encrypting the data before it is sent out. This is then only decrypted at the designated location.
As a file transfer protocol, FTP is only capable of transferring files from one point to another, and some basic file operations, like copying, moving, or deleting files and directories. SSH goes far beyond this, as it allows the user to issue commands that can be interpreted and executed on the remote computer by a listening server. It can also be used for tunneling, monitoring certain services and applications that are running, and even for transferring files
Saturday, December 07, 2013
Tcpdump - Packet Analyzer
Notes to self from an excellent resource:
http://www.thegeekstuff.com/2010/08/tcpdump-command-examples/
tcpdump command is also called as packet analyzer.
tcpdump allows us to save the packets that are captured, so that we can use it for future analysis. The saved file can be viewed by the same tcpdump command. We can also use open source software like wireshark to read the tcpdump pcap files.
http://www.thegeekstuff.com/2010/08/tcpdump-command-examples/
tcpdump command is also called as packet analyzer.
tcpdump allows us to save the packets that are captured, so that we can use it for future analysis. The saved file can be viewed by the same tcpdump command. We can also use open source software like wireshark to read the tcpdump pcap files.
Netstat - Network Related Information: network connections,routing tables, interface statistics
Notes to self from an excellent web source: http://www.thegeekstuff.com/2010/03/netstat-command-examples/
Netstat command displays various network related information such as network connections, routing tables, interface statistics, masquerade connections, multicast memberships etc.
Netstat command displays various network related information such as network connections, routing tables, interface statistics, masquerade connections, multicast memberships etc.
1. List All Ports (both listening and non listening ports)
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -a | more
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:domain *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:3350 *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 *:3389 *:* LISTEN
tcp 0 0 localhost:mysql *:* LISTEN
tcp 1 0 psqa-Precision-Wo:56250 mulberry.canonical:http CLOSE_WAIT
tcp 0 52 psqa-Precision-Work:ssh 10.155.1.178:65099 ESTABLISHED
tcp6 0 0 [::]:32781 [::]:* LISTEN
tcp6 0 0 [::]:http-alt [::]:* LISTEN
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 [::]:5910 [::]:* LISTEN
tcp6 0 0 ip6-localhost:ipp [::]:* LISTEN
tcp6 0 0 [::]:58471 [::]:* LISTEN
udp 0 0 *:58874 *:*
udp 0 0 localhost:domain *:*
udp 0 0 *:bootpc *:*
udp 0 0 *:mdns *:*
udp6 0 0 [::]:33848 [::]:*
udp6 0 0 [::]:38606 [::]:*
udp6 0 0 [::]:mdns [::]:*
udp6 0 0 [::]:mdns [::]:*
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 7832738 /tmp/.X11-unix/X0
unix 2 [ ACC ] STREAM LISTENING 13521345 /tmp/keyring-LJiqbG/control
unix 2 [ ACC ] STREAM LISTENING 13519782 /tmp/ssh-FmqICnl32734/agent.32734
unix 2 [ ACC ] STREAM LISTENING 13507507 /tmp/.ICE-unix/32734
unix 2 [ ACC ] STREAM LISTENING 7703 /var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 13519818 /tmp/keyring-LJiqbG/pkcs11
unix 2 [ ACC ] STREAM LISTENING 13519819 /tmp/keyring-LJiqbG/gpg
unix 2 [ ] DGRAM 7821596 /var/run/xrdp/xrdp_chansrv_00006537_main_term
unix 2 [ ] DGRAM 7821598 /var/run/xrdp/xrdp_chansrv_00006537_thread_done
unix 2 [ ACC ] STREAM LISTENING 5430847 /tmp/.esd-1000/socket
unix 2 [ ACC ] STREAM LISTENING 5430849 /home/psqa/.pulse/dd64bbdc6e387b6ce5594de20000000c-runtime/native
2.List all tcp ports using netstat -at
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -at
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:domain *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:3350 *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 *:3389 *:* LISTEN
tcp 0 0 localhost:mysql *:* LISTEN
tcp 1 0 psqa-Precision-Wo:56250 mulberry.canonical:http CLOSE_WAIT
tcp 0 52 psqa-Precision-Work:ssh 10.155.1.178:65099 ESTABLISHED
tcp6 0 0 [::]:32781 [::]:* LISTEN
tcp6 0 0 [::]:http-alt [::]:* LISTEN
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 [::]:5910 [::]:* LISTEN
tcp6 0 0 ip6-localhost:ipp [::]:* LISTEN
tcp6 0 0 [::]:58471 [::]:* LISTEN
3.List all udp ports using netstat -au
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -au
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 *:58874 *:*
udp 0 0 localhost:domain *:*
udp 0 0 *:bootpc *:*
udp 0 0 *:mdns *:*
udp6 0 0 [::]:33848 [::]:*
udp6 0 0 [::]:38606 [::]:*
udp6 0 0 [::]:mdns [::]:*
udp6 0 0 [::]:mdns [::]:*
4.List Sockets which are in Listening State
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -l
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:domain *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:3350 *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 *:3389 *:* LISTEN
tcp 0 0 localhost:mysql *:* LISTEN
tcp 1 0 psqa-Precision-Wo:56250 mulberry.canonical:http CLOSE_WAIT
5.List only listening TCP Ports using netstat -lt
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -lt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:domain *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:3350 *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 *:3389 *:* LISTEN
tcp 0 0 localhost:mysql *:* LISTEN
6.List only listening UDP Ports using netstat -lu
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -lu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 *:58874 *:*
udp 0 0 localhost:domain *:*
udp 0 0 *:bootpc *:*
udp 0 0 *:mdns *:*
udp6 0 0 [::]:33848 [::]:*
udp6 0 0 [::]:38606 [::]:*
udp6 0 0 [::]:mdns [::]:*
udp6 0 0 [::]:mdns [::]:*
7.List only the listening UNIX Ports using netstat -lx
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -lx
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 7832738 /tmp/.X11-unix/X0
unix 2 [ ACC ] STREAM LISTENING 13521345 /tmp/keyring-LJiqbG/control
unix 2 [ ACC ] STREAM LISTENING 13519782 /tmp/ssh-FmqICnl32734/agent.32734
unix 2 [ ACC ] STREAM LISTENING 13507507 /tmp/.ICE-unix/32734
unix 2 [ ACC ] STREAM LISTENING 7703 /var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 13519818 /tmp/keyring-LJiqbG/pkcs11
unix 2 [ ACC ] STREAM LISTENING 13519819 /tmp/keyring-LJiqbG/gpg
unix 2 [ ACC ] STREAM LISTENING 5430847 /tmp/.esd-1000/socket
unix 2 [ ACC ] STREAM LISTENING 5430849 /home/psqa/.pulse/dd64bbdc6e387b6ce5594de20000000c-runtime/native
unix 2 [ ACC ] STREAM LISTENING 13519820 /tmp/keyring-LJiqbG/ssh
8.Show the statistics for each protocol
Show statistics for all ports using netstat -s
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -s
Ip:
19245274 total packets received
33255 with invalid addresses
0 forwarded
0 incoming packets discarded
19212008 incoming packets delivered
6367978 requests sent out
Icmp:
430 ICMP messages received
0 input ICMP message failed.
ICMP input histogram:
destination unreachable: 10
echo requests: 409
echo replies: 11
80290 ICMP messages sent
0 ICMP messages failed
ICMP output histogram:
destination unreachable: 79867
echo request: 14
echo replies: 409
IcmpMsg:
InType0: 11
InType3: 10
InType8: 409
OutType0: 409
OutType3: 79867
OutType8: 14
Tcp:
279678 active connections openings
5867 passive connection openings
4701 failed connection attempts
2700 connection resets received
1 connections established
12037981 segments received
5816889 segments send out
42226 segments retransmited
5 bad segments received.
13883 resets sent
Udp:
3583428 packets received
79867 packets to unknown port received.
0 packet receive errors
438883 packets sent
9.Show statistics for TCP (or) UDP ports using netstat -st (or) netstat -su
10. Display PID and program names in netstat output using netstat -p
netstat -p option can be combined with any other netstat option. This will add the “PID/Program Name” to the netstat output. This is very useful while debugging to identify which program is running on a particular port.
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -pt
(Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.)
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 1 0 psqa-Precision-Wo:56250 mulberry.canonical:http CLOSE_WAIT 482/ubuntu-geoip-pr
tcp 0 412 psqa-Precision-Work:ssh 10.155.1.178:65099 ESTABLISHED -
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -pu
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
psqa@psqa-Precision-WorkStation-T3500:~$
11.Print netstat information continuously
netstat will print information continuously every few seconds.
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -c
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 1 0 psqa-Precision-Wo:56250 mulberry.canonical:http CLOSE_WAIT
12.Find the non supportive Address families in your system
netstat -v
netstat: no support for `AF IPX' on this system.
netstat: no support for `AF AX25' on this system.
netstat: no support for `AF X25' on this system.
netstat: no support for `AF NETROM' on this system.
13. Display the kernel routing information using netstat -r
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
default 10.20.10.1 0.0.0.0 UG 0 0 0 eth0
10.20.10.0 * 255.255.254.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 0 0 0 eth0
14.Don’t resolve host, port and user name in netstat output
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
default 10.20.10.1 0.0.0.0 UG 0 0 0 eth0
10.20.10.0 * 255.255.254.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 0 0 0 eth0
14.Don’t resolve host, port and user name in netstat output
When you don’t want the name of the host, port or user to be displayed, use netstat -n option. This speeds up the output, as netstat is not performing any look-up.
netstat -an
15. Find out on which port a program is running
psqa@psqa-Precision-WorkStation-T3500:~$ sudo netstat -ap | grep ssh
tcp 0 0 *:ssh *:* LISTEN 2197/sshd
tcp 0 52 psqa-Precision-Work:ssh 10.155.1.178:65099 ESTABLISHED 31357/sshd: psqa [p
tcp6 0 0 [::]:ssh [::]:* LISTEN 2197/sshd
psqa@psqa-Precision-WorkStation-T3500:~$ sudo netstat -ap | grep ssh
tcp 0 0 *:ssh *:* LISTEN 2197/sshd
tcp 0 52 psqa-Precision-Work:ssh 10.155.1.178:65099 ESTABLISHED 31357/sshd: psqa [p
tcp6 0 0 [::]:ssh [::]:* LISTEN 2197/sshd
16.Find out which process is using a particular port:
-bash-4.1# netstat -ap | grep ':80'
tcp 0 0 *:8009 *:* LIST EN 5792/java
-bash-4.1# netstat -ap | grep ':8080'
-bash-4.1# netstat -ap | grep ':80'
tcp 0 0 *:8009 *:* LISTEN 5792/java
17.Show the list of network interfaces
17.Show the list of network interfaces
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -i
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 26476172 0 0 0 6186673 0 0 0 BMRU
eth1 1500 0 0 0 0 0 0 0 0 0 BMU
lo 16436 0 222432 0 0 0 222432 0 0 0 LRU
psqa@psqa-Precision-WorkStation-T3500:~$
18.Display extended information on the interfaces
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -ie
Kernel Interface table
eth0 Link encap:Ethernet HWaddr 00:10:18:77:6b:c0
inet addr:10.20.10.150 Bcast:10.20.11.255 Mask:255.255.254.0
inet6 addr: fe80::210:18ff:fe77:6bc0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:26476601 errors:0 dropped:0 overruns:0 frame:0
TX packets:6186707 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:16880934683 (16.8 GB) TX bytes:691922199 (691.9 MB)
Interrupt:28
eth1 Link encap:Ethernet HWaddr b8:ac:6f:95:fc:4d
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:17
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:222432 errors:0 dropped:0 overruns:0 frame:0
TX packets:222432 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:41913247 (41.9 MB) TX bytes:41913247 (41.9 MB)