Lecture 7 Network Management and Debugging
Total Page:16
File Type:pdf, Size:1020Kb
SYSTEM ADMINISTRATION MTAT.08.021 LECTURE 7 NETWORK MANAGEMENT AND DEBUGGING Prepared By: Amnir Hadachi and Artjom Lind University of Tartu, Institute of Computer Science [email protected] / [email protected] 1 LECTURE 7: NETWORK MGT AND DEBUGGING OUTLINE 1.Intro 2.Network Troubleshooting 3.Ping 4.SmokePing 5.Trace route 6.Network statistics 7.Inspection of live interface activity 8.Packet sniffers 9.Network management protocols 10.Network mapper 2 1. INTRO 3 LECTURE 7: NETWORK MGT AND DEBUGGING INTRO QUOTE: Networks has tendency to increase the number of interdependencies among machine; therefore, they tend to magnify problems. • Network management tasks: ✴ Fault detection for networks, gateways, and critical servers ✴ Schemes for notifying an administrator of problems ✴ General network monitoring, to balance load and plan expansion ✴ Documentation and visualization of the network ✴ Administration of network devices from a central site 4 LECTURE 7: NETWORK MGT AND DEBUGGING INTRO Network Size 160 120 80 40 Management Procedures 0 AUTOMATION ILLUSTRATION OF NETWORK GROWTH VS MGT PROCEDURES AUTOMATION 5 LECTURE 7: NETWORK MGT AND DEBUGGING INTRO • Network: • Subnets + Routers / switches Time to consider • Automating mgt tasks: • shell scripting source: http://www.eventhelix.com/RealtimeMantra/Networking/ip_routing.htm#.VvjkA2MQhIY • network mgt station 6 2. NETWORK TROUBLES HOOTING 7 LECTURE 7: NETWORK MGT AND DEBUGGING NETWORK TROUBLESHOOTING • Many tools are available for debugging • Debugging: • Low-level (e.g. TCP/IP layer) • high-level (e.g. DNS, NFS, and HTTP) • This section progress: ping trace route GENERAL ESSENTIAL TROUBLESHOOTING netstat TOOLS STRATEGY nmap tcpdump … 8 LECTURE 7: NETWORK MGT AND DEBUGGING NETWORK TROUBLESHOOTING • Before action, principle to consider: ✴ Make one change at a time ✴ Document the situation as it was before you got involved. ✴ Document any changes you add since the moment of your involvement. ✴ You should be aware that problems might be transient; thus, begin by capturing relevant information using tools such as “sar" or “nmon". ✴ Always start at one end of a system and work your way trough the system’s critical components until you reach the problem. ✴ Communicate regularly with your colleague. (team work spirit) ✴ Use the network layers to negotiate the problem. (top to bottom or vice versa) 9 LECTURE 7: NETWORK MGT AND DEBUGGING NETWORK TROUBLESHOOTING • when you are working your way trough the network layer ask yourself question such as: • Can you ping the localhost address (127.0.0.1)? • Do you have physical connectivity and a link light? • Can you ping other local hosts by IP address? • Is your interface configured properly? • Is DNS working properly?1 • Do your ARP tables show other hosts? • Can you ping other local hosts by hostname? • Is there a firewall on your local machine? • Can you ping hosts on another network? • Is there a firewall anywhere between you and the destination? • Do high-level services such as web and SSH servers work? • If firewalls are involved, do they pass ICMP ping packets and responses? • Did you really check the firewalls? 10 3. PING PING!!! 11 LECTURE 7: NETWORK MGT AND DEBUGGING PING • What is a ping in networking? Ping is a networking utility program to test if a particular host is reachable. • What is a ping test? Ping test is the process of calculating how long it takes for a packet to reach the server and to be sent back. 12 LECTURE 7: NETWORK MGT AND DEBUGGING PING • Command COMMAND: $ ping <address> OUTPUT: AHs-Mac-mini:~ AH$ ping www.ut.ee PING www.ut.ee (193.40.5.73): 56 data bytes 64 bytes from 193.40.5.73: icmp_seq=0 ttl=61 time=1.173 ms 64 bytes from 193.40.5.73: icmp_seq=1 ttl=61 time=1.112 ms ^C --- www.ut.ee ping statistics --- 2 packets transmitted, 2 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 1.112/1.143/1.173/0.031 ms ICMP ? time ? TTL ? packets ? 13 LECTURE 7: NETWORK MGT AND DEBUGGING PING • What is ICMP ? DEFINITION: ICMP or Internet Control Message Protocol is one of the main internet protocols used by the network devices to report errors and service availability info. • ICMP packet structure: MAC IP ICMP ICMP Header Header Header Data 14 bytes 20 bytes 8 bytes Variable Ethernet Frame IP Packet ICMP Packet 14 LECTURE 7: NETWORK MGT AND DEBUGGING PING • How does it work? Servers are you alive ? ICMP ECHO_REQUEST User yes I am ICMP ECHO_RESPONSE 15 LECTURE 7: NETWORK MGT AND DEBUGGING PING • What ping can tell you? • Ping uses a unique sequence of each transmitted packets and reports on each one if it was received or not. Therefore, you can conclude if the packets has been dropped or not, or rendered. • The fact that the ping uses timestamp you can compute how long the exchange of the packets took. (Round Trip Time, RTT) • Ping also report if the router is declining the target host unreachable. 16 LECTURE 7: NETWORK MGT AND DEBUGGING PING • Ping commands: EXAMPLE 1: TIME INTERVAL MANIPULATION COMMAND: $ ping -i <interval_time_digit> <address> OUTPUT: AHs-Mac-mini:~ AH$ ping -i 5 www.ut.ee PING www.ut.ee (193.40.5.73): 56 data bytes 64 bytes from 193.40.5.73: icmp_seq=0 ttl=61 time=0.998 ms 64 bytes from 193.40.5.73: icmp_seq=1 ttl=61 time=0.801 ms 64 bytes from 193.40.5.73: icmp_seq=2 ttl=61 time=1.196 ms 64 bytes from 193.40.5.73: icmp_seq=3 ttl=61 time=0.867 ms ^C^C --- www.ut.ee ping statistics --- 4 packets transmitted, 4 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 0.801/0.966/1.196/0.151 ms 17 LECTURE 7: NETWORK MGT AND DEBUGGING PING • Ping commands: EXAMPLE 2: CHECKING LOCAL INTERFACE IF IT IS UP RUNNING COMMAND: $ ping 0 $ ping localhost OUTPUT: AHs-Mac-mini:~ AH$ ping localhost PING localhost (127.0.0.1): 56 data bytes 64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.045 ms 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.168 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.085 ms 64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.058 ms ^C --- localhost ping statistics --- 4 packets transmitted, 4 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 0.045/0.089/0.168/0.048 ms 18 LECTURE 7: NETWORK MGT AND DEBUGGING PING • Ping commands: EXAMPLE 3: SEND SPECIFIC N PACKETS COMMAND: $ ping -c <Number_of_packets> <address> OUTPUT: AHs-Mac-mini:~ AH$ ping -c 4 www.ut.ee PING www.ut.ee (193.40.5.73): 56 data bytes 64 bytes from 193.40.5.73: icmp_seq=0 ttl=61 time=1.102 ms 64 bytes from 193.40.5.73: icmp_seq=1 ttl=61 time=0.839 ms 64 bytes from 193.40.5.73: icmp_seq=2 ttl=61 time=1.032 ms 64 bytes from 193.40.5.73: icmp_seq=3 ttl=61 time=0.986 ms --- www.ut.ee ping statistics --- 4 packets transmitted, 4 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 0.839/0.990/1.102/0.096 ms 19 LECTURE 7: NETWORK MGT AND DEBUGGING PING • Ping commands: EXAMPLE 4: FLOOD THE NETWORK COMMAND: $ ping -f <address> OUTPUT: AHs-Mac-mini:~ AH$ sudo ping -f localhost Password: PING localhost (127.0.0.1): 56 data bytes ..Request timeout for icmp_seq 250 .Request timeout for icmp_seq 251 … … … .Request timeout for icmp_seq 1748 ^C --- localhost ping statistics --- 1750 packets transmitted, 750 packets received, 57.1% packet loss round-trip min/avg/max/stddev = 0.013/0.026/0.137/0.009 ms 20 LECTURE 7: NETWORK MGT AND DEBUGGING PING • Ping commands: EXAMPLE 5: FIND OUT IP ADDRESS COMMAND: $ ping -c 1 <address> OUTPUT: AHs-Mac-mini:~ AH$ ping -c 1 www.ut.ee PING www.ut.ee (193.40.5.73): 56 data bytes 64 bytes from 193.40.5.73: icmp_seq=0 ttl=61 time=1.064 ms --- www.ut.ee ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 1.064/1.064/1.064/0.000 ms 21 LECTURE 7: NETWORK MGT AND DEBUGGING PING • Ping commands: EXAMPLE 6: PRINT ONLY PING COMMAND REPORT STAT COMMAND: $ ping -c 5 -q <address> OUTPUT: AHs-Mac-mini:~ AH$ ping -c 5 -q www.ut.ee PING www.ut.ee (193.40.5.73): 56 data bytes --- www.ut.ee ping statistics --- 5 packets transmitted, 5 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 0.905/1.030/1.362/0.169 ms 22 LECTURE 7: NETWORK MGT AND DEBUGGING PING • Ping commands: EXAMPLE 7: TIMEOUT COMMAND: $ ping -t 7 <address> OUTPUT: AHs-Mac-mini:~ AH$ ping -t 7 localhost PING localhost (127.0.0.1): 56 data bytes 64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.063 ms 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.072 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.134 ms 64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.068 ms 64 bytes from 127.0.0.1: icmp_seq=4 ttl=64 time=0.161 ms 64 bytes from 127.0.0.1: icmp_seq=5 ttl=64 time=0.082 ms 64 bytes from 127.0.0.1: icmp_seq=6 ttl=64 time=0.083 ms --- localhost ping statistics --- 7 packets transmitted, 7 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 0.063/0.095/0.161/0.035 ms 23 LECTURE 7: NETWORK MGT AND DEBUGGING PING • Ping commands: EXAMPLE: SIMPLE PING WITH NO ANSWER COMMAND: $ ping <address> OUTPUT: AHs-Mac-mini:~ AH$ ping 192.168.88.243 PING 192.168.88.243 (192.168.88.243): 56 data bytes Request timeout for icmp_seq 0 Request timeout for icmp_seq 1 Request timeout for icmp_seq 2 Request timeout for icmp_seq 3 Request timeout for icmp_seq 4 ^C --- 192.168.88.243 ping statistics --- 6 packets transmitted, 0 packets received, 100.0% packet loss • What does it mean ? 24 LECTURE 7: NETWORK MGT AND DEBUGGING PING • Four possible Cases: • External firewall • Workstation firewall • Host not connected or broken link • Not alive 25 LECTURE 7: NETWORK MGT AND DEBUGGING PING • If A can ping B, does mean that the opposite it true? Ping True ? 26 4.