Taking a TCPDUMP on Linux OS and Writing the packets to CAP file (Wireshark Readable)

Summary: 

In this post, we are going to quickly take a TCP Dump (Capture packets) on a linux server and write the output to a CAP file that is WireShark readable. 

Problem or Goal: 

Used to capture and analyze packets when troubleshooting network/communication problems. 

Cause: 

N/A

Solution (Examples): 

a) TCP Dump on a single physical interface to capture DNS (port 53) packets

#tcpdump -i eth0 -s 2000 -w /tmp/name_of_trace_file.cap port 53

b) TCP Dump on a bonded interface to capture HTTP (port 80) packets

#tcpdump -i bond1 -s 2000 -w /tmp/name_of_trace_file.cap port 80

Note: "-s 2000" limits the packet length to 2000bytes, default packet length is 1024bytes use "-s 0" to remove the packet length limit. 

Problem Solved?

You can then transfer the file by SFTP to your laptop and read it with Wireshark 

How to quickly add DNS settings in Linux (CentOS)?

Summary: 

This note will show you how to quickly fix DNS settings on linux. Am using centOS

[root@localhost ~]# cat /etc/*release* CentOS release 6.3 (Final) CentOS release 6.3 (Final) CentOS release 6.3 (Final) cpe:/o:centos:linux:6:GA

Problem or Goal:

Pinging a domain name like "yahoo.com" returns error

[root@localhost ~]# ping yahoo.com ping: unknown host yahoo.com [root@localhost ~]#

Cause:

Checking the ifcfg files, there is no DNS settings defined!!

[root@localhost ~]# cd /etc/sysconfig/network-scripts/ [root@localhost network-scripts]# more ifcfg-eth0 DEVICE="eth0" BOOTPROTO="static" BROADCAST="172.17.6.255" GATEWAY="172.17.6.3" HWADDR="14:FE:B5:DF:B9:A9" IPADDR="172.17.6.44" NETMASK="255.255.255.0" NM_CONTROLLED="yes" ONBOOT="yes" TYPE="Ethernet"

Solution:

Check and make sure you have proper internet connection, i tested by pinging a public DNS 8.8.8.8

[root@localhost network-scripts]# ping 172.29.1.111 PING 172.29.1.111 (172.29.1.111) 56(84) bytes of data. 64 bytes from 172.29.1.111: icmp_seq=1 ttl=125 time=0.943 ms 64 bytes from 172.29.1.111: icmp_seq=2 ttl=125 time=0.675 ms ^C --- 172.29.1.111 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1712ms rtt min/avg/max/mdev = 0.675/0.809/0.943/0.134 ms [root@localhost network-scripts]#

Now add the DNS settings in the ifcfg-eth0 file, make sure you know your network DNS IPs to use, or you can use the public DNS, 8.8.8.8 if it's allowed on your network.

[root@localhost network-scripts]# vi ifcfg-eth0 DEVICE="eth0" BOOTPROTO="static" BROADCAST="172.17.6.255" GATEWAY="172.17.6.3" HWADDR="14:FE:B5:DF:B9:A9" IPADDR="172.17.6.44" NETMASK="255.255.255.0" DNS1="172.29.1.111" DNS2="8.8.8.8" NM_CONTROLLED="yes" ONBOOT="yes" TYPE="Ethernet"

Restart the network services

[root@localhost etc]# /etc/init.d/network restart Shutting down interface eth0:                              [  OK  ] Shutting down loopback interface:                          [  OK  ] Bringing up loopback interface:                            [  OK  ] Bringing up interface eth0:                                [  OK  ] [root@localhost etc]#

Problem Solved?

Test by ping a domain name, for example "yahoo.com"

[root@localhost ~]# ping www.yahoo.com PING atsv2-fp.wg1.b.yahoo.com (46.228.47.115) 56(84) bytes of data. 64 bytes from ir1.fp.vip.ir2.yahoo.com (46.228.47.115): icmp_seq=1 ttl=53 time=202 ms 64 bytes from ir1.fp.vip.ir2.yahoo.com (46.228.47.115): icmp_seq=2 ttl=53 time=202 ms 64 bytes from ir1.fp.vip.ir2.yahoo.com (46.228.47.115): icmp_seq=3 ttl=53 time=202 ms 64 bytes from ir1.fp.vip.ir2.yahoo.com (46.228.47.115): icmp_seq=4 ttl=53 time=202 ms 64 bytes from ir1.fp.vip.ir2.yahoo.com (46.228.47.115): icmp_seq=5 ttl=53 time=203 ms ^C --- atsv2-fp.wg1.b.yahoo.com ping statistics --- 6 packets transmitted, 5 received, 16% packet loss, time 5035ms rtt min/avg/max/mdev = 202.167/202.646/203.652/0.772 ms [root@localhost ~]#

Is your bad internet experience being caused by your ISP's underperforming DNS? Find out today

So you have finally signed up for that broadband and dedicated internet bandwidth that you ISP has been trying to sell you for the last one year and has been telling you all the nice things that dedicated bandwidth can do! you decided to bite the bullet and release that hard earned cash to experience that fast lane for internet, may be it started out so well on day one but the experience gets worse by the day and soon or later you can't even tell the difference between your old and new connection.

Well, there are other factors that affect internet speeds and trust me you can have a whole pipe of 100Mbps to yourself, but if your ISP's DNS (Domain Name Server) has issues, it will always have a direct impact to your internet experience. 

One of the major performance indicators (a.k.a KPIs) for DNS is the "DNS Response Time"; This is the time it takes (in milliseconds) for the DNS to resolve a requested domain (for example www.facebook.com) into it's corresponding IP (Internet Protocal) address (for example 157.240.7.35).

A slow, overloaded or unreliable DNS has a direct impact on customer's internet experience and noticeably slows down virtually all your internet use. Every ISP has their own DNS infrastructure that is closer to their end users (topology-wise), but this does not directly imply that it will be the fastest DNS in response time. There are many well known publicly available DNS alternatives, which by geo-location and topology-wise are far away from your access device but have better response times and today am going to show you how you can determine that and also optimize your connection.

"You can't optimize it until you can measure it"

Another important point is that your ISP DNS could be in the wrong order, with the secondary DNS performing faster than the primary DNS and this also matters because the requests will always be sent to the primary DNS first. so this article is for both the end user and you the ISP engineer. Am sure you don't want a customer to walk into your office and present to you a report of how publicly available DNS(s) are performing better than your DNS(s)! So you better measure it now and optimize it now.

DNS Benchmark is a freeware tool and you can download it HERE
This tool compares the performance of the ISP DNS with many well known publicly available alternatives. The tool then generates visual reports that compare your ISP DNS response time with other public DNS(s), these reports are easy to interpret and the DNS(s) are ranked according to response time. You don't need to be an expert or geek to use this tool, and you will find the "How tos?" on the download website.

See below a screen shot of the tool and sample report:

DNS Benchmark

DNS Benchmark Report

Based on the results and conclusions from the benchmark, you can determine if you should continue using the DNS(s) provided by your ISP (if they rank top) or if you should change to public DNS(s), that's if the public DNS(s) rank on top of your ISP DNS(s). And if the DNS settings for your connection can't be manually changed, you have the right to walk up to your ISP and challenge them, just make sure to save your benchmark reports.

Going forward, don't let a slow DNS ruin your internet experience. Have fun

Credits: Precision Freeware by Steve Gibson

I Can Ping But I Can Not Browse - What's wrong with my Internet?

Summary: 

For the biggest part that i have worked in the ISP industry, this is by far the most common complaint from the customers, so today i have decided to write a brief guide line on how to troubleshoot this problem from the client side and possibly resolve it yourself without having to engage the service provider.

Problem or Goal:

You can ping a public IP in the internet for example 4.2.2.2 but can't browse a website for example www.tagsaleuganda.com in your browser.

if you open your CMD terminal and run this test:
1. Ping any public IP, for example 4.2.2.2 you get replies, meaning your connectivity up to layer 3 (refer to the OSI model) is ok.

Opening CMD

Pinging a public IP returns replies, meaning connectivity is OK.

2. The challenge is when you ping a domain name for example; ping www.tagsaleuganda.com
Ideally this should also work if the domain is valid, it should be able to resolve the domain to an IP and you should be able to get replies on the CMD, that is for a good connection.

This is a good ping to a domain name and good DNS resolution of domain to IP

3. But for this case where a customer is able to ping the internet (in 1 above) but can't browse a page on the internet, usually the second test (2 above) will fail, you will get request timed out and the domain will fail to resolve into an IP.

Cause:

Most likely you have a DNS issue, check to make sure the DNS settings are properly configured in your router or PC. 

Solution:

Ask your service provider for the DNS settings, if the DNS is statically configured, make sure you have entered the right DNS IP.
If you don't know which DNS to use, you can configure your router or computer to use the public DNS(s), for example the google public DNS IP: 8.8.8.8

Problem Solved?

Yes

Editing the Windows "hosts" file to override the network DNS resolution

Summary: 

Editing the Windows "hosts" file to override the network DNS resolution 

Problem or Goal:

How to edit the "hosts" file on windows machine, this overrides the network DNS answer.

Cause:

In most cases, especially while testing new website installs on hostgator cpanel for domain names that are already in production, i find myself in a situation where i have to edit the "hosts" file on my PC to point to a hostgator server. when am done testing, i delete the entry i had made in the hosts file and point the domain to the hostgator DNS servers.

This helps me to test the site locally on my laptop without interfering with the live website.

Solution: 

File Location:  C:\Windows\System32\drivers\etc

################################################
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1       localhost
# ::1             localhost

127.0.0.1       localhost

192.185.32.240 www.clientdomain.com

###############################################

Problem Solved?

yes

Common DNS query return messages and response codes and their meaning

Summary:

Common DNS query return messages and response codes and their meaning

Problem or Goal:

when trying to resolve a domain/host-name 

Cause:

DNS error

Solution:

DNS Return Message	DNS Response Code	Function
NOERROR	RCODE:0	DNS Query completed successfully
FORMERR	RCODE:1	DNS Query Format Error
SERVFAIL	RCODE:2	Server failed to complete the DNS request
NXDOMAIN	RCODE:3	Domain name does not exist.
NOTIMP	RCODE:4	Function not implemented
REFUSED	RCODE:5	The server refused to answer for the query
YXDOMAIN	RCODE:6	Name that should not exist, does exist
XRRSET	RCODE:7	RRset that should not exist, does exist
NOTAUTH	RCODE:8	Server not authoritative for the zone
NOTZONE	RCODE:9	Name not in zone

Problem Solved?

Adding Static DNS - LINUX OpenSUSE 13.2 error "ping:unknown host yahoo.com"

Problem:

Ping a domain name for example yahoo.com from the CLI and it returns the message below:

Server1:~ # ping yahoo.com
ping: unknown host yahoo.com


Server1:~ # cat /etc/*release
openSUSE 13.2 (x86_64)
VERSION = 13.2
CODENAME = Harlequin
# /etc/SuSE-release is deprecated and will be removed in the future, use /etc/os-release instead
NAME=openSUSE
VERSION="13.2 (Harlequin)"
VERSION_ID="13.2"
PRETTY_NAME="openSUSE 13.2 (Harlequin) (x86_64)"
ID=opensuse
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:opensuse:13.2"
BUG_REPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://opensuse.org/"

ID_LIKE="suse"

Solution:

This means that my server has no DNS set to resolve host names!

1. open YAST

Server1:~ # yast



2. Use up/down arrow keys to select "Network Devices"
3. Use right arrow key to select "Network Settings" and press Enter Key
4. Hit the "Tab" key once to highlight "Overview" on the top menu

5. Now use the right arrow key on your keyboard to select "Hostname/DNS"
6. Use the TAB key to navigate through and modify the DNS config according to your DNS servers for your network.

7. Use TAB to navigate to "OK" and hit Enter
8. Quit
9. Now test again:

Server1:~ # ping yahoo.com
PING yahoo.com (206.190.36.45) 56(84) bytes of data.
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=1 ttl=45 time=343 ms
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=2 ttl=45 time=345 ms
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=3 ttl=45 time=343 ms
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=4 ttl=45 time=343 ms
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=5 ttl=45 time=344 ms
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=6 ttl=45 time=343 ms
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=7 ttl=45 time=343 ms
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=8 ttl=45 time=345 ms
64 bytes from ir1.fp.vip.gq1.yahoo.com (206.190.36.45): icmp_seq=9 ttl=45 time=343 ms

Cheers :-)

Thinking of parental control for your home internet? - I recommend OpenDNS

Yet another note to self.

Open DNS has a free account that you can use to filter content, block adult and gambling sites for your home internet or small office solution.

Click this link to read more about the setup guide. it's simple and easy to implement.

Use Open DNS to filter content to your home internet, block adult content and gambling sites