On a server that is running either the FTP client on server, you can capture the ftp password using tcpdump by
tcpdump -A port ftp
On a server that is running either the FTP client on server, you can capture the ftp password using tcpdump by
tcpdump -A port ftp
Just for my records
grep "WORD\|ANOTHER\|NEITHER" string
searches for either “WORD” or “ANOTHER” or “NEITHER” in string.
If you are using a Linux system that uses yum for package management (like Fedora, Centos, RHEL), you can use the following command to find out which package contains a file. This is useful when you want to figure out which package to install. For example, dig (DNS utility) doesn’t come pre-installed on the system. And running “sudo yum install dig” doesn’t do anything.
sudo yum whatprovides '*/dig'
This returns
Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile 32:bind-utils-9.8.2-0.47.rc1.el6.x86_64 : Utilities for querying DNS name servers Repo : base Matched from: Filename : /usr/bin/dig
breaking down the command options
whatprovides : Is used to find out which package provides some feature or file. Just use a specific name or a file-glob-syntax wildcards to list the packages available or installed that provide that feature or file.
Say you are using netstat to checl all established network connections on a windows machine (confirmed to work on windows 7+ and windows server 2008+) and want to find out how many connections you have, you can use
netstat -an | find "ESTABLISHED" | find /v /c ""
breaking down the command string
netstat -an : Uses netstat command to display all connections and listening ports (-a) and displays them in numerical form instead of resolving DNS or using common names (-n)
| : piping (passing) output of one command to the next one
find “ESTABLISHED” : Uses find command to filter out to just lines that contain the string “ESTABLISHED”‘
find /c /v “” : exclude blank lines (/v “”) and count the number of remaining lines (/c)
If you wanted to something similar in linux, you can use
netstat -an | grep "ESTABLISHED" | wc -l
If you want to search for a pattern at the end of a line, you can use
tail -f logfile | grep -v "0$"
breaking down the commands
tail -f : standard tail command. Continuous output to console as the file grows (or until it ends)
grep -v : -v command forces grep to show content that doesn’t match pattern
0$ : This regex is specifically looking for a 0 at the end of the line, which is denoted by $.
varnishlog, one of the tools provided with varnish cache, uses VSL Query Expressions (https://www.varnish-cache.org/docs/trunk/reference/vsl-query.html) to provide some powerful insights into the requests and responses.
Here is a how you can use varnishlog to show all client requests that are ending up with a 404 response.
sudo varnishlog -g request -i ReqURL -q "BerespStatus != 200"
Technically, this particular query shows all client requests with a response other than 200.
Breaking down the commands
-g request : shows all entries related to the request
-i ReqURL : forces varnishlog to only display the Requesting URL
-q “BerespStatus != 200” : query filter to only match non 200 responses. Note that the query has to be enclosed in “”.
We were trying to modify some ACL (access control lists) in squid to allow traffic to certain websites. Instead of adding each individual hostnames in a domain, we wanted to add all traffic to a certain domain.
Document on the interwebs is old or not clear on how to achieve this.
After some trial and error, here is what works
say you want to allow all traffic to the google.com domain, you create a access list using dstdomain like below
acl name_of_acl dstdomain .google.com
The “.” before the domain name acts as a wildcard
Then you use the acl to allow http access to it like below
http_access allow name_of_acl
Let’s say you are running a command as sudo and need to pass the output to a different command using pipe, you would run
sudo command1 | command 2
this usually results in the following error
-bash: /command2: Permission denied
The trick to fix is to run sudo with -c and enclose the commands in ” like below
sudo -c 'command1 | command 2'
essentially you are opening a shell with sudo and running the commands
If you don’t have tcpdump installed on your solaris server, you can use the “snoop” system command to capture network traffic.
Here is the command line option to capture 1000 packets of network traffic from IP 192.168.10.10 on a solaris server using inteface e1000g1 and write the output to /tmp/capture.pcap
snoop -d e1000g1 -c 10000 -o /tmp/capture.pcap host 192.168.10.10
Details of the command options
More details at https://docs.oracle.com/cd/E23824_01/html/821-1453/gexkw.html
PS : You have to have root privileges to run this command.
quick note for self
hdparm -tT /dev/sdx
sdx : actual device you want to test