12/24 Can you guys point out existing tools that do diagnostics by
sniffing network packets? For example, what are some tools
that can sniff out packet drop rate (missing ACK, irregular
RTT, etc), and give warning on possible switch problems,
router problems, DoS, and simply pinpoint problems? Secondly,
are there tools out there that inspect the link layer packets
all the way up to say, applications for diagnostics? Thanks.
\_ Cisco sells a couple of things that do some of this.
Their IDS system would help. There is no simple tool
that will just tell you where your network problem is,
you have to have the skill and experience to interpret
the output.
\- if you are dealing with a traffic flow that involves
a lot of weird stuff ... exposed to the open internet,
or on a network with thousands of devices including
embedded stuff, you will see a huge huge huge amount
of stuff you should never see ... there are all kinds
of spec violating tcp stacks. in some of our applications
+50% of the code lines deal with spec violating stuff.
believe me it will be easier to look for specific problems
rather than anything that isnt strictly correct. there
are also some things that are strictly correct that are
just weird to see [like say in the TOS bits]. if you
combine this with out of order packets vs. possibly
malicious stuff, it gets complicated indeed [and opens
you application up to DoS attacks depending on how you
handle the state tables]. Bro may be a little
heavyweight for this. some people like etherreal. there
is some decent commercial stuff. if commercial stuff is
an option, you can email me. ok tnx.
\_ what is TOS bits? and who do I email to? |
http://csua.com/feed/