Network Traffic Analysis

Linux Tools For Network Analysis

Network problems

Networks are funny places where all sort of things happen in a matter of microseconds. Domain Name System (DNS) lookups are answered, and data blocks traverse the network as part of file-sharing protocols (such as SMB and NFS) while packets make their way from the Internet to your web browser. At any moment a network printer could go haywire and start broadcasting an endless stream of address resolution requests, or an NFS client could send mangled data to its server wreaking havoc on your work.

If you’ve done any systems administration work, you have probably seen these problems and dozen of others. Debugging them requires experience, as well as the right tools to diagnose what has gone wrong and to help determine what to do about it.

Network analysis

One of the most valuable tools in diagnosing a network problem, besides the manuals that come with all of your networking gear, is a network protocol analyzer. A network protocol analyzer listens to the network, then displays the data in a way that lets you watch things such as

interactions of clients and servers,
broadcasts,
packet storms, and
routing updates.

Commercial network analysis software packages can cost more than $1,000 for the software alone. Add a dedicated top-of-the-line laptop and a high-speed network controller, and the cost can easily exceed $5,000.

Fortunately, there are open source, Linux-based solutions that can give you all of the benefits of a commercial product (along with the ability to extend the software) at a fraction of the price.

Two packages that make network diagnostics and troubleshooting easier are Ethereal and Netwatch.

Ethereal is a “network sniffer” package that allows you to look at all of the traffic on a network.
Netwatch monitors traffic flow between clients and servers (such as between a web browser and a web server) and determines what ports are being used in those communications.

Ethereal

Netwatch

Gordon MacKay’s Netwatch utility, which runs in a terminal window, is invaluable for watching network loads and for seeing, at a higher level than Ethereal, who is talking to whom on your network. As shown in Figure 2, Netwatch monitors network bandwidth in terms of which hosts are producing and consuming packets.

Figure 2. Netwatch monitors network bandwidth. (Click on image for full-size view)

Another useful mode of Netwatch, seen in Figure 3, shows which ports are involved in the communications between hosts. This can be very useful in seeing if the client/server applications on your network are using the ports that you expect them to use.

It can also alert you to potential trouble if you see hosts using protocol slots that should never be seen on your network. For example, if you see a service (such as TCP or UDP port) that shouldn’t be running, it could mean someone is running an unauthorized service on a machine (for example, a Quake GAME server) or that someone has broken in.

, as shown in Figure 1, is a GUI-based program that displays packet traffic on a network. In this figure, Ethereal displays several packets on my home network, including DNS lookup packets, NFS transactions, and e-mail being delivered via the POP3 protocol. The packet highlighted in this example is a WHO packet that is part of a protocol that reports on machine uptimes, and records who is logged in to which machine.

Figure 1. Ethereal displays packet traffic on a network. (Click on image for full-size view)

In this example, the middle panel of Ethereal shows the decomposition of the WHO packet that contains sub-fields which describe who is logged into the machine that broadcast the packet along with other relevant machine info such as load averages and uptimes.

The bottom panel of Ethereal shows the actual packet-data as a hexadecimal dump of bytes.

Taken as a whole, Ethereal is a complete network traffic analysis tool. A short list of features includes:

A session tracer that shows network sessions as collections of transactions, rather than just as network packets
A text-mode tool that uses the Ethereal packet engine, then can be run from either an X-window terminal or in a shell window with no windowing support
Colorization modes for the packet displays
The ability to read dump files from other (commercial) network analyzer packages

Linux Solutions