4285ch02.fm Draft Document for Review May 4, 2007 11:35 am
56 Linux Performance and Tuning Guidelines
You can use these tools to dig into the network related problems. You can find TCP/IP
retransmission, windows size scaling, name resolution problem, network misconfiguration
etc. Just keep in mind that these tools can monitor only frames the network adapter has
received, not entire network traffic.
tcpdumptcpdump is a simple but robust utility. It also has basic protocol analyzing capability allowing
you to get rough picture of what is happening on the network. tcpdump supports many options
and flexible expressions for filtering the frames to be captured (capture filter). We’ll take a look
at this below.
Options:
-i <interface> Network interface
-e Print the link-level header
-s <snaplen> Capture <snaplen> bytes from each packet
-n Avoide DNS lookup
-w <file> Write to file
-r <file> Read from file
-v, -vv, -vvv Vervose output
Expressions for the capture filter:
Keywords:
host dst, src, port, src port, dst port, tcp, udp, icmp, net, dst net, src net etc.
Primitives may be combined using:
Negation (‘`!‘ or ‘not‘).
Concatenation (`&&' or `and').
Alternation (`||' or `or').
Example of some useful expressions:
DNS query packets
tcpdump -i eth0 'udp port 53'
FTP control and FTP data session to 192.168.1.10
tcpdump -i eth0 'dst 192.168.1.10 and (port ftp or ftp-data)'
HTTP session to 192.168.2.253
tcpdump -ni eth0 'dst 192.168.2.253 and tcp and port 80'
Telnet session to subnet 192.168.2.0/24
tcpdump -ni eth0 'dst net 192.168.2.0/24 and tcp and port 22'
Packets for which the source and destination is not in subnet 192.168.1.0/24 with TCP
SYN or TCP FIN flags on (TCP establishment or termination)
tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net
192.168.1.0/24'