Tracing Spurious Network Traffic

[Ian Foster_2]

Alledgedly one of our servers is flooding the data network with packets addressed to a bogus ip. Any tips for tracking down which errant process/configuration may be causing this ? I have tried some obvious suspects(like checking for a misconfigured print queue, mail configuration etc), but in truth I'm not making much headway. I guess it's harder as it's not actually establishing a connection to a genuine host; just sending data out to an invalid address (reputedly).

[Steven E. Protter · Accepted solution]

Shalom,

Any Unix or Linux server on the network can run the command tcpdump.

That sniffs the network.

First run tcpdump to see if you can find the source system of the traffic.

tcpdump host sprotterlt

That tcpdump command takes a look at all traffic from a host, in this case my laptop at work.

You may narrow it down to a particular port which will give you something to look at.

SEP

[Bill Hassell]

Another sniffer is Wireshark which runs on several platforms. Note that with tcpdump, nettl (HP-UX) or Wireshark, the box that is monitoring must NOT be connected with a switch port but instead must be connected to the problem server with a true hub (some "hubs" are actually switches) so you can see all the traffic. Wireshark is by far the easiest tool to monitor this type of traffic as you can quickly sort the data in many ways and filter the traffic based on IP.

Identifying the process will be easier once you see what type of message (and port) is being used.

[Lethuillier]

You should find some help and stuff there; traffic analysis is their job :

http://www.openpacket.org

[Ian Foster_2]

Thanks for the advice. I managed to install and run tcpdump. Didn't help much in terms of source ports (various, not registered in /etc/services) - but target port confirmed that it is a bogus remote print queue:

10:43:07.119806 IP (tos 0x0, ttl 64, id 21165, offset 0, flags [DF], proto TCP (6), length 40) s900503.ad03.local.856 > 10.178.20.22.printer: R, cksum 0x84fb (incorrect (-> 0x2b88), 164048493:164048493(0) win 49640

Killing this off however, has proved to be more problematic. First off we couldn't identify the queue in question. By process of elimination we think we have removed all the defunct/misconfigured queues on the system, but even after cleaning out the queues and restarting the print services, there is still a process polling this bogus ip intermittantly. Considering a reboot. This turned out to be a Solaris10 box BTW. Anyway - thanks for the help.

[Rasheed Tamton]

On Solaris, you have the snoop

man snoop

snoop - capture and inspect network packets
snoop prints all packets that are sent through a network interface.
Example: snoop -d eri0 host oraprd1 monitors all traffic on network port "eri0" that is exchanged with host "oraprd1".

[Ian Foster_2]

tcpdump helped trace the source of the traffic. Thanks all.