topic Re: nettladm to capture data on single port in Operating System - HP-UX

nettladm to capture data on single port

Ted Ellis_2 — Fri, 30 Sep 2005 17:42:58 GMT

I have a request to collect/report on data transmitted across port 26204, which is used to transmit information for a particular application. How would I configure nettladm to filter information at this level? Or is there a better tool to use?

Re: nettladm to capture data on single port

Nemer_1 — Sat, 01 Oct 2005 03:45:48 GMT

Hi Ted,

to collect data transmitted across specific port, you need to start tracing on data across that port. to do so :

first: start the nettladm, then choose traceing subsystem from the list menu.

select the appropriate subsystem (NS_LS_TCP or NS_LS_UDP)from the subsystems listed. from the action menu choose modify tracing.

in the modify tracing set the "Include in Tracing" to "yes", check the "Incomming Protocol Data Unit" and "Outgoing Protocol Data Unit" as appropriate.

in the "Specify Filter (Optional)" specify your source/destination ip/port. then click on "ok"

After that you have to start the configured tracing from the Action menu.

Note: * You can control the trace file size & location from "Modify Startup Parameters" in the Action Menu.
** To create a report from the collected data use Create report from File menu.
*** to stop tracing, choose stop tracing from Action menu. and toggle the "Include in Trace" to No in "Modify tracing"

Regards

Re: nettladm to capture data on single port

rick jones — Mon, 03 Oct 2005 11:41:42 GMT

You can also install tcpdump from the HP Internet Express bundle (software.hp.com) and say:

tcpdump -i -w port

and later post-process the file via:

tcpdump -r

and/or use any of the tools that know how to read a tcpdump trace.

Another consideration, albeit with at least as much overhead if not possibly more, is to use tusc to system call trace the specific application - that will of course not give you the TCP/IP/Ethernet headers, but you can still see the application data, and get some idea of what the application does with the data.

Re: nettladm to capture data on single port

Hazem Mahmoud_3 — Mon, 03 Oct 2005 12:12:15 GMT

Ted,
I have just started using Snort on HP-UX and find it to be a great and easy tool to use. You can get Snort (and also download pcre-6.2) from the HP-UX porting and archiving center. You will also need libpcap. The install takes less than a minute for all 3. Then you can simply do:
snort -vde port 26204
You can also pipe that into a file. Snort has many powerful features that you might find useful. Here are the links to the 3 downloads:
snort:
http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/snort-2.3.3/
pcre:
http://hpux.cs.utah.edu/hppd/hpux/Languages/pcre-6.2/
libpcap:
http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/libpcap-0.9.3/

HTH
-Hazem

Re: nettladm to capture data on single port

Ted Ellis_2 — Tue, 04 Oct 2005 14:48:34 GMT

this system is HPUX 11.0. I would like to grab a pre-compiled version or depot for installation. the sites listed here only have packages for 11.11. Anyone know where to locate 11.0 ones?

Re: nettladm to capture data on single port

rick jones — Tue, 04 Oct 2005 14:51:03 GMT

tcpdump and libpcap sources from www.isc.org will likely compile and run just fine on 11.0 - I used to build them on 11.0 with the HP compilers.

If you haven't done so already, getting started on an OS upgrade might not be a bad idea. If you can jump all the way up to 11.23 (11iv2) that would be best, but going to 11.11 (11iv1) would be better than nothing.

Re: nettladm to capture data on single port

Arunvijai_4 — Tue, 04 Oct 2005 22:36:53 GMT

You can use TCPDUMP, Ethereal for capturing and analysis. For 11.0, you need to download source code and compile yourself.

www.tcpdump.org
www.ethereal.com

-Arun

Re: nettladm to capture data on single port

Biswajit Tripathy — Wed, 05 Oct 2005 01:05:49 GMT

Ofcourse, another option would be to use
HP-UX IPFilter. Takes 10 seconds to configure
it for the logging you want. If you are using
HP-UX 11i v2, it would be already installed
on your system.

- Biswajit

Re: nettladm to capture data on single port

Ted Ellis_2 — Wed, 05 Oct 2005 15:10:25 GMT

thanks all... I have compiled tcpdump successfully. No more replies required

Re: nettladm to capture data on single port

Ted Ellis_2 — Wed, 05 Oct 2005 15:13:39 GMT

solution in hand