This Blog is to share our knowledge and expertise on Linux System Administration and VMware Administration

Monday, November 9, 2015

Understanding the TCPDUMP command with an example - Linvirtshell

Monday, November 09, 2015 0
In most cases you will need root permission to be able to capture packets on an interface. Using tcpdump (with root) to capture the packets and saving them to a file to analyze.

See the list of interfaces on which tcpdump can listen:

tcpdump -D

[root@nsk-linux nsk]# tcpdump -D

1.usbmon1 (USB bus number 1)
2.eth4
3.any (Pseudo-device that captures on all interfaces)
4.lo

Listen on interface eth0:

tcpdump -i eth0

Listen on any available interface (cannot be done in promiscuous mode. Requires Linux kernel 2.2 or greater)

tcpdump -i any

Capture only N number of packets using tcpdump -c

 [root@nsk-linux nsk]# tcpdump -c 2 -i eth4

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth4, link-type EN10MB (Ethernet), capture size 65535 bytes
18:35:51.382706 IP 10.0.2.15.ssh > 10.0.2.2.51879: Flags [P.], seq 4037059562:4037059770, ack 3747030, win 36432, length 208
18:35:51.383008 IP 10.0.2.2.51879 > 10.0.2.15.ssh: Flags [.], ack 208, win 65535, length 0
2 packets captured
6 packets received by filter
0 packets dropped by kernel

Display Captured Packets in ASCII using tcpdump -A

# tcpdump -A -i eth0

Display Captured Packets in HEX and ASCII using tcpdump -XX

#tcpdump -XX -i eth0

Be verbose while capturing packets

#tcpdump –v

Be very verbose while capturing packets

#tcpdump -vvv

Be verbose and print the data of each packet in both hex and ASCII, excluding the link level header

tcpdump -v -X

Be verbose and print the data of each packet in both hex and ASCII, also including the link level header

tcpdump -v -XX

Be less verbose (than the default) while capturing packets

tcpdump -q

Limit the capture to 100 packets

tcpdump -c 100

Record the packet capture to a file called capture.cap

tcpdump -w capture.cap

Record the packet capture to a file called capture.cap but display on-screen how many packets have been captured in real-time

tcpdump -v -w capture.cap

Display the packets of a file called capture.cap

tcpdump -r capture.cap

Display the packets using maximum detail of a file called capture.cap

tcpdump -vvv -r capture.cap

Display IP addresses and port numbers instead of domain and service names when capturing packets (note: on some systems you need to specify -nn to display port numbers)

tcpdump -n

Capture any packets where the destination host is 10.0.2.2. Display IP addresses and port numbers

tcpdump -n dst host 10.0.2.2

Capture any packets where the source host is 10.0.2.2. Display IP addresses and port numbers

tcpdump -n src host 10.0.2.2

Capture any packets where the source or destination host is 10.0.2.15. Display IP addresses and port numbers

tcpdump -n host 10.0.2.15

Capture any packets where the destination network is 10.0.2.0/24. Display IP addresses and port numbers

tcpdump -n dst net 10.0.2.0/24

Capture any packets where the source network is 10.0.2.0/24. Display IP addresses and port numbers

tcpdump -n src net 10.0.2.0/24


Capture any packets where the source or destination network is 10.0.2.0/24. Display IP addresses and port numbers

[root@nsk ~]# tcpdump -n net 10.0.2.0/24

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes

18:56:07.471583 IP 10.0.2.15.ssh > 10.0.2.2.60038: Flags [P.], seq 312243348:312243556, ack 3492510, win 65136, length 208
18:56:07.471790 IP 10.0.2.15.ssh > 10.0.2.2.60038: Flags [P.], seq 208:384, ack 1, win 65136, length 176
18:56:07.471947 IP 10.0.2.15.ssh > 10.0.2.2.60038: Flags [P.], seq 384:544, ack 1, win 65136, length 160
18:56:07.472093 IP 10.0.2.15.ssh > 10.0.2.2.60038: Flags [P.], seq 544:704, ack 1, win 65136, length 160
18:56:07.472247 IP 10.0.2.15.ssh > 10.0.2.2.60038: Flags [P.], seq 704:864, ack 1, win 65136, length 160
18:56:07.472370 IP 10.0.2.15.ssh > 10.0.2.2.60038: Flags [P.], seq 864:1024, ack 1, win 65136, length 160
18:56:07.472576 IP 10.0.2.15.ssh > 10.0.2.2.60038: Flags [P.], seq 1024:1184, ack 1, win 65136, length 160
18:56:07.472605 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 208, win 65535, length 0
18:56:07.472619 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 384, win 65535, length 0
18:56:07.472624 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 544, win 65535, length 0
18:56:07.472627 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 704, win 65535, length 0
18:56:07.472629 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 864, win 65535, length 0
18:56:07.472632 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 1024, win 65535, length 0

Capture any packets where the destination port is 22. Display IP addresses and port numbers

[root@nsk ~]# tcpdump -n dst port 22

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
18:54:41.047546 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 312125892, win 65535, length 0
18:54:41.047856 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 161, win 65535, length 0
18:54:41.048086 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 305, win 65535, length 0
18:54:41.048309 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 449, win 65535, length 0
18:54:41.048535 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 593, win 65535, length 0
18:54:41.048744 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 737, win 65535, length 0
18:54:41.048969 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 881, win 65535, length 0

Capture any packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers

[root@nsk ~]# tcpdump -n dst portrange 1-1023

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
18:53:33.082176 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 311660756, win 65535, length 0
18:53:33.082872 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 161, win 65535, length 0
18:53:33.083288 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 305, win 65535, length 0
18:53:33.083668 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 449, win 65535, length 0
18:53:33.083860 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 593, win 65535, length 0
18:53:33.084131 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 737, win 65535, length 0
18:53:33.084410 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 881, win 65535, length 0
18:53:33.084655 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 1025, win 65535, length 0

Capture only TCP packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers

[root@nsk ~]# tcpdump -n tcp dst portrange 1-1023

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
18:51:43.154211 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 311537732, win 65535, length 0
18:51:43.155095 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 161, win 65535, length 0
18:51:43.155509 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 305, win 65535, length 0
18:51:43.155805 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 449, win 65535, length 0
18:51:43.156082 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 593, win 65535, length 0
18:51:43.156352 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 737, win 65535, length 0
18:51:43.156619 IP 10.0.2.2.60038 > 10.0.2.15.ssh: Flags [.], ack 881, win 65535, length 0


Capture only UDP packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers

[root@nsk ~]# tcpdump -n udp dst portrange 1-1023


Capture any packets with destination IP 10.0.2.15 and destination port 23. Display IP addresses and port numbers

[root@nsk ~]# tcpdump -n "dst host 10.0.2.15 and dst port 23"


Capture any packets with destination IP 10.0.2.15 and destination port 80 or 443. Display IP addresses and port numbers

[root@nsk ~]# tcpdump -n "dst host 10.0.2.15 and (dst port 80 or dst port 443)"


Capture any ICMP packets

[root@nsk ~]# tcpdump -v icmp


Capture any ARP packets

[root@nsk ~]# tcpdump -v arp


Capture 500 bytes of data for each packet rather than the default of 68 bytes

[root@nsk-linux nsk]# tcpdump -s 500


Capture all bytes of data within the packet

[root@nsk-linux nsk]# tcpdump -s 0


Capture the particular interface traffic and save as .cap file

[root@nsk-linux nsk]# tcpdump -i enp0s3 -s 0 -vvv -w /home/nsk/file_18:03:54.pcap
tcpdump: listening on enp0s3, link-type EN10MB (Ethernet), capture size 65535 bytes
^C97390 packets captured
97855 packets received by filter
460 packets dropped by kernel

Thursday, November 5, 2015

Explain about the LVM DUMPCONFIG command in Linux Server?

Thursday, November 05, 2015 0
The lvm dumpconfig Command

You can display the current LVM configuration, or save the configuration to a file, with the dumpconfig option of the lvm command. There are a variety of features that the lvm dumpconfig command provides, including the following;


1. You can dump the current lvm configuration merged with any tag configuration files.
2. You can dump all current configuration settings for which the values differ from the defaults.
3. You can dump all new configuration settings introduced in the current LVM version, in a specific LVM version.
4. You can dump all profilable configuration settings, either in their entirety or separately   for command and metadata profiles

5. You can dump only the configuration settings for a specific version of LVM.
6. You can validate the current configuration.

For a full list of supported features and information on specifying the lvm dumconfig options, see the lvm-dumpconfig man page.

What are the Metadata Contents available in LVM?

Thursday, November 05, 2015 0
The volume group metadata contains:
    ·         Information about how and when it was created
    ·         Information about the volume group:

The volume group information contains:
    ·         Name and unique id
    ·         A version number which is incremented whenever the metadata gets updated
    ·         Any properties: Read/Write? Resizeable?
    ·         Any administrative limit on the number of physical volumes and logical volumes it may contain
    ·         The extent size (in units of sectors which are defined as 512 bytes)

An unordered list of physical volumes making up the volume group, each with:
    ·         Its UUID, used to determine the block device containing it
    ·         Any properties, such as whether the physical volume is allocatable
    ·         The offset to the start of the first extent within the physical volume (in sectors)
    ·         The number of extents

 An unordered list of logical volumes. Each consisting of
        An ordered list of logical volume segments. For each segment the metadata includes a mapping applied to an ordered list of physical volume segments or logical volume segments.

Sample Metadata Contents.

# Generated by LVM2 version 2.02.88(2)-RHEL5 (2012-01-20): Sat Mar 21 15:44:51 2015

contents = "Text Format Volume Group"
version = 1

description = "Created *before* executing '/usr/sbin/vgs --noheadings -o name'"

creation_host = "testserver.com"    # Linux testserver.com 2.6.32-300.10.1.el5uek #1 SMP Wed Feb 22 17:37:40 EST 2012 x86_64
creation_time = 1426945491      # Sat Mar 21 15:44:51 2015

VolGroup00 {
        id = "ZfQCQ1-suTc-ykV9-TwvN-ACpB-XcEM-NuWlnE"
        seqno = 3
        status = ["RESIZEABLE", "READ", "WRITE"]
        flags = []
        extent_size = 65536             # 32 Megabytes
        max_lv = 0
        max_pv = 0
        metadata_copies = 0

        physical_volumes {

                pv0 {
                        id = "36bcud-E3uI-NPeG-BfTe-ePx0-FEpQ-un5N5F"
                        device = "/dev/xvda2"   # Hint only

                        status = ["ALLOCATABLE"]
                        flags = []
                        dev_size = 104647410    # 49.8998 Gigabytes
                        pe_start = 384
                        pe_count = 1596 # 49.875 Gigabytes
                }
        }
        logical_volumes {

                LogVol00 {
                        id = "SWOjo1-qFZZ-CztY-CSXb-zQdX-pwRH-jDNI3o"
                        status = ["READ", "WRITE", "VISIBLE"]
                        flags = []
                        segment_count = 1

                        segment1 {
                                start_extent = 0
                                extent_count = 1024     # 32 Gigabytes

                                type = "striped"
                                stripe_count = 1        # linear

                                stripes = [
                                        "pv0", 0
                                ]
                        }
                }
                LogVol01 {
                        id = "LoJOLg-5TDC-5ity-l5a6-qLJ5-fuju-oRRzWb"
                        status = ["READ", "WRITE", "VISIBLE"]
                        flags = []
                        segment_count = 1

                        segment1 {
                                start_extent = 0
                                extent_count = 572      # 17.875 Gigabytes

                                type = "striped"
                                stripe_count = 1        # linear

                                stripes = [
                                        "pv0", 1024
                                ]
                        }
                }
        }
}

Wednesday, November 4, 2015

Explain about the dmsetup Command in Linux?

Wednesday, November 04, 2015 0
The dmsetup command is a command line wrapper for communication with the Device Mapper. For general system information about LVM devices, you may find the info, ls, status, and deps options of the dmsetup command to be useful, as described in the following subsections.

The dmsetup info Command

The dmsetup info device command provides summary information about Device Mapper devices. If you do not specify a device name, the output is information about all of the currently configured Device Mapper devices.
If you specify a device, then this command yields information for that device only.
The dmsetup info command provides information in the following categories:

Name:
The name of  the device. An LVM device is expressed as the volume group name and the logical volume name separated   by a hyphen. A hyphen in the original name is translated to two hyphens. During standard LVM operations, you should not use the name of an LVM device in this format to specify an LVM device directly, but instead you should  use the vg/lv alternative.

State:
Possible device states are SUSPENDED, ACTIVE, and READ-ONLY. The dmsetup suspend command sets a device state to SUSPENDED.
When a device is suspended, all I/O operations to that device stop. The dmsetup resume command restores a device state to ACTIVE.

Read Ahead:
The number of data blocks that the system reads ahead for any open file on which read operations are ongoing. By default, the kernel chooses a suitable value automatically. You can change this value with the --readahead option of the dmsetup command.

Tables present:
Possible states for this category are LIVE and INACTIVE. An INACTIVE state indicates that a table has been loaded which will be swapped in when a dmsetup resume command restores a device state to ACTIVE, at which point the table's state becomes LIVE. For information, see the dmsetup man page.

Open count:
    The open reference count indicates how many times the device is opened. A mount command opens a device.

Event number:
The current number of events received. Issuing a dmsetup wait n command allows the user to wait for the n'th event, blocking the call until it is received.

Major, minor
    Major and minor device number

Number of targets
    The number of frag ments that make up a device. For example, a linear device spanning 3 disks would have 3 targets. A linear      device composed of the beginning and end of a disk, but not the middle would have 2 targets.      

UUID
    UUID of the device.

The following example shows partial output for the dmsetup info command.

[root@testserver ~]# dmsetup info
Name:                       VolGroup00-LogVol01
State:                         ACTIVE
Read Ahead:             256
Tables present:          LIVE
Open count:              2
Event number:          0
Major, minor:            252, 1
Number of targets:    1
UUID: LVM-ZfQCQ1suTcykV9TwvNACpBXcEMNuWlnELoJOLg5TDC5ityl5a6qLJ5fujuoRRzWb

Name:                     VolGroup00-LogVol00
State:                      ACTIVE
Read Ahead:          256
Tables present:       LIVE
Open count:           1
Event number:       0
Major, minor:          252, 0
Number of targets: 1
UUID: LVM-ZfQCQ1suTcykV9TwvNACpBXcEMNuWlnESWOjo1qFZZCztYCSXbzQdXpwRHjDNI3o

Remediating an ESXi 5.x and 6.0 host with Update Manager fails with the error: There was an error checking file system on altbootbank

Wednesday, November 04, 2015 0
To resolve the issue, repair the altbootbank partition.

To repair the altbootbank partition:

    Run this command to determine the device for /altbootbank:
    vmkfstools -P /altbootbank

    You see output similar to:
    mpx.vmhba32:C0:T0:L0:5

    Run this command to repair the altbootbank filesystem:
    dosfsck -a -w /dev/disks/device_name
For example:
    dosfsck -a -w /dev/disks/mpx.vmhba32:C0:T0:L0:5

    If remediation fails at this stage, reboot the host.

Red Hat Enterprise Virtualization Manager (RHEVM) minimum hardware requirements.

Wednesday, November 04, 2015 0
Red Hat Enterprise Virtualization Manager servers must run Red Hat Enterprise Linux 6. A number  of additional hardware requirements must also be met.

Item                   Limitations
RAM                  A minimum of 3 GB of RAM is required.
PCI Devices      At least one network controller with a minimum bandwidth of 1 Gbps (Rec)

Storage             A minimum of 3 GB of available local disk space is recommended.

Monday, November 2, 2015

How to Manage Software with YUM in Linux Server?

Monday, November 02, 2015 0
Use the yum utility to modify the software on your system in four ways:

    To install new software from package repositories
    To install new software from an individual package file
    To update existing software on your system
    To remove unwanted software from your system

[Important]            Installing Software from a Package File


To use yum, specify a function and one or more packages or package groups. Each section below gives some examples.

For each operation, yum downloads the latest package information from the configured repositories.

The yum utility searches these data files to determine the best set of actions to produce the required result, and displays the transaction for you to approve. The transaction may include the installation, update, or removal of additional packages, in order to resolve software dependencies.

This is an example of the transaction for installing tsclient:
==================================================================
 Package                 Arch       Version          Repository        Size
==================================================================
Installing:
 tsclient                   i386       0.132-4          base              247 k
Installing for dependencies:
 rdesktop                i386       1.3.1-5            base              107 k
Transaction Summary
==================================================================
Install      2 Package(s)
Update       0 Package(s)
Remove       0 Package(s)
Total download size: 355 k

Is this ok [y/N]:
Format of YUM Transaction Reports:
Review the list of changes, and then press y to accept and begin the process. If you press N or Enter, yum does not download or change any packages.

Package Versions
 The yum utility only displays and uses the newest version of each package, unless you specify an older version.
The yum utility also imports the repository public key if it is not already installed on the rpm keying.

This is an example of the public key import:

warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID 443E1821
public key not available for tsclient-0.132-4.i386.rpm
Retrieving GPG key from http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-4
Importing GPG key 0x443E1821 "CentOS-4 Key<centos-4key@centos.org>"
Is this ok [y/N]:

Format of yum Public Key Import

 Check the public key, and then press y to import the key and authorize the key for use. If you press N or Enter, yum stops without installing any packages.
To ensure that downloaded packages are genuine, yum verifies the digital signature of each package against the public key of the provider. Once all of the packages required for the transaction are successfully downloaded and verified, yum applies them to your system.

Downloads are Cached

The yum utility keeps downloaded data files and packages for reuse. You may copy packages from the repository cache directories under /var/cache/yum/, and use them elsewhere if you wish. If you remove a package from the cache, you do not affect the copy of the software installed on your system.

Installing New Software with YUM:

 To install the package tsclient, enter the command:
 yum install tsclient

To install the package group MySQL Database, enter the command:
yum groupinstall "MySQL Database"

Updating Software with YUM:
yum update tsclient

Note: New Software Versions Require Reloading

If a piece of software is in use when you update it, the old version remains active until the application or service is restarted. Kernel updates take effect when you reboot the system.

To update all of the packages in the package group MySQL Database, enter the command:
yum groupupdate "MySQL Database"

Removing Software with YUM:

To remove software, yum examines your system for both the specified software, and any software which claims it as a dependency. The transaction to remove the software deletes both the software and the dependencies.
yum remove tsclient

To remove all of the packages in the package group MySQL Database, enter the command:
yum groupremove "MySQL Database"

Searching for Packages with YUM:
Use the search features of yum to find software that is available from the configured repositories, or already installed on your system. Searches automatically include both installed and available packages.

The format of the results depends upon the option. If the query produces no information, there are no packages matching the criteria.

Searching by Package Name and Attributes
yum list tsclient

To make your queries more precise, specify packages with a name that include other attributes, such as version or hardware architecture. To search for version 0.132 of the application, use the command:
yum list tsclient-0.132

Advanced Searches:

If you do not know the name of the package, use the search or provides options. Alternatively, use wild cards or regular expressions with any yum search option to broaden the search criteria.

The search option checks the names, descriptions, summaries and listed package maintainers of all of the available packages to find those that match. For example, to search for all packages that relate to PalmPilots, type:
yum search PalmPilot

This provides function checks both the files included in the packages and the functions that the software provides. This option requires yum to download and read much larger index files than with the search option.

To search for all packages that include files called libneon, type:
yum provides libneon

To search for all packages that either provides a MTA (Mail Transport Agent) service, or includes files with mta in their name:
yum provides MTA

Use the standard wildcard characters to run any search option with a partial word or name: ? to represent any one character, and * to mean zero or more characters. Always add the escape character (\) before wildcards.

To list all packages with names that begin with tsc, type:
yum list tsc\*

Understanding Matches
 Searches with yum show all of the packages that match your criteria. Packages must meet the terms of the search exactly to be  considered matches,  unless you use wildcards or a regular expression.

For example, a search query for shadowutils or shadow-util would not produce the package shadow-utils. This package would match and be shown if the query was shadow-util\?, or shadow\*.
Updating Your System with yum

Use the update option to upgrade all of your system software to the latest version with one operation.
yum update

Automatically Updating Your System
/sbin/chkconfig --level 345 yum on; /sbin/service yum start

How Daily Updates are Run

There is no separate yum service that runs on your system. The command given above enables the control script /etc/rc.d/init.d/yum.
This control script activates the script /etc/cron.daily/yum.cron, which causes the cron service to perform the system update  automatically at 4am each day.

Maintaining YUM
The yum system does not require any routine maintenance. To ensure that yum operations are carried out at optimal speed, disable or remove repository definitions which you no longer require. You may also clear the files from the yum caches in order to recover disk space.

Disabling or Removing Package Sources
 Set enable=0 in a definition file to prevent yum from using that repository. The yum utility ignores any definition file with this setting.

To completely remove access to a repository:
    Delete the relevant file from /etc/yum.repos.d/.
    Delete the cache directory from /var/cache/yum/.

Clearing the yum Caches

By default, yum retains the packages and package data files that it downloads, so that they may be reused in future operations without being downloaded again. To purge the package data files, use this command:
yum clean headers

Run this command to remove all of the packages held in the caches:
yum clean packages

For CentOS-4 users, to clean the metadata files use this command:
yum clean metadata

Purging cached files causes those files to downloaded again the next time that they are required. This increases the amount of time required to complete the operation.

Difference Between RHEL 5, 6, AND 7 - JOBS & SERVICES

Monday, November 02, 2015 0
Difference Between RHEL 5, 6, AND 7 - JOBS & SERVICES