Tuesday, January 26, 2010

Monitor network traffic on OpenSolaris from command line

To check a summary of network activity for a NIC, use:
# netstat -i 1
    input   xnf0      output       input  (Total)    output
packets errs  packets errs  colls  packets errs  packets errs  colls
1111615 0     745655  0     0      1111684 0     745724  0     0    
399     0     306     0     0      399     0     306     0     0    
416     0     343     0     0      416     0     343     0     0 


To expolore actual packets crossing the network, use snoop command. It captures both TCP and UDP traffic. It is a tool that is shipped with Solaris.

Here is sample output:
# snoop
Using device xnf0 (promiscuous mode)
cbcb-vs.umiacs.umd.edu -> domU-12-31-39-04-EC-47.compute-1.internal TCP D=60088 S=8021 Ack=4204280156 Seq=2401233531 Len=1460 Win=92
domU-12-31-39-04-EC-47.compute-1.internal -> cbcb-vs.umiacs.umd.edu TCP D=8021 S=60088 Ack=2401246671 Seq=4204280156 Len=0 Win=49640 Options=

domU-12-31-39-04-EC-47.compute-1.internal -> dhcp243113.rollins.emory.edu TCP D=49769 S=22 Push Ack=4234202219 Seq=2467318705 Len=192 Win=49232




It shows source and destination servers, type of traffic, source and destination ports, as well as some packet info.

No comments: