WEBVTT 00:08.730 --> 00:11.180 Old friends will come back in this lesson. 00:11.190 --> 00:16.880 We're going to talk about how to monitor the network services in the Linux environment. 00:16.890 --> 00:21.930 In this lesson we're going to talk about some of the important commands which are very helpful for you 00:21.930 --> 00:24.050 to monitor the network services. 00:24.170 --> 00:24.790 OK. 00:24.870 --> 00:27.390 So let's see here all the commands. 00:27.390 --> 00:29.410 One by one. 00:29.580 --> 00:36.190 OK what's going on that I would like to show you is that the next step one gives you the information 00:36.190 --> 00:38.440 about all the connections. 00:38.560 --> 00:39.010 OK. 00:39.130 --> 00:43.600 So let's see here how it works when you type on. 00:43.630 --> 00:45.200 Let's stack them like this. 00:45.210 --> 00:48.840 It really is the connections on your system. 00:49.230 --> 00:49.940 OK. 00:49.960 --> 00:55.760 There are different switches with the help of which you're going to get more information. 00:55.780 --> 00:58.010 OK then type hyphen. 00:58.100 --> 01:04.750 It can list all the new connections on your system or whether it is act do or not. 01:04.750 --> 01:07.700 It will list all the connections with the iPhone. 01:07.950 --> 01:13.920 So just like 520 and more to view the connection status one by one. 01:14.260 --> 01:14.600 OK. 01:14.620 --> 01:19.700 So here you can see it use this information like this. 01:19.720 --> 01:20.430 OK. 01:20.590 --> 01:25.950 I know no more part of that process or that software or program. 01:26.110 --> 01:30.230 And it gives the status of is listening are connected. 01:30.280 --> 01:30.730 OK. 01:30.760 --> 01:38.070 Like that then type that stream or DRAM or OK and flag then pro-coal that is the protocol. 01:38.330 --> 01:43.090 There are different protocols like ECP of the UDP. 01:43.090 --> 01:49.250 So in this way when you type it it will list all the new connections. 01:49.450 --> 01:57.750 If you want to listen only the DCT connections aren't TCAP connections and then just type in the name. 01:57.800 --> 02:00.470 It will list all the reports. 02:00.610 --> 02:07.240 Here you can see it shows the TCAP ports only OK with Deira a local IP address. 02:07.330 --> 02:12.220 And for an IP address and the state whether it is listening or not. 02:12.240 --> 02:12.570 OK. 02:12.640 --> 02:23.230 And here if you want to see UDP ports then disable you then you release all the UDP ports which are 02:23.230 --> 02:25.790 currently listening on your system. 02:26.000 --> 02:26.580 OK. 02:26.890 --> 02:33.360 And if you want to see all the DCP ports with only listening ports. 02:33.430 --> 02:38.070 So for that reason you just type and hit enter. 02:38.110 --> 02:42.310 Now it leaves only the listening ports on your system will get. 02:42.640 --> 02:49.540 So listening ports are those ports which are waiting for the incoming connection listening ports are 02:49.540 --> 02:55.260 generally our ports which are provided by the server for the clients. 02:55.510 --> 03:03.340 OK so in this way you can view the armed do listening connections for the DC reports. 03:03.400 --> 03:08.830 If you want to do the same with UDP then just replace the DVD you enter. 03:09.010 --> 03:14.420 And here you can see the act do listening UDP port connections. 03:14.710 --> 03:18.670 OK in this way you can view this information OK. 03:19.000 --> 03:30.250 And if you want to see the statistics of user interface then just type as like this or more to one by 03:30.250 --> 03:30.950 one. 03:30.970 --> 03:38.650 So here you can see the statistics like the IP information packets send receive information the protocol 03:39.010 --> 03:46.650 that is DCB UDP like this information here in the complete form in the form of statistics. 03:47.020 --> 03:56.200 And if you want to view the information of the program OK if you want to view the program name it also. 03:56.520 --> 03:59.860 So this type of the. 03:59.900 --> 04:00.880 And B. 04:00.980 --> 04:06.580 Ok so now it's not printed here. 04:07.020 --> 04:07.510 OK. 04:07.750 --> 04:14.440 So here you can see it on your right hand side you can see the program name but it is blank here because 04:14.590 --> 04:17.640 it may be hidden for some reasons. 04:17.730 --> 04:26.890 So but if you want to view the program name just type B and if you want to see the username of the process 04:27.160 --> 04:28.780 or the program. 04:28.840 --> 04:30.790 So just type E. 04:31.080 --> 04:32.240 OK. 04:32.260 --> 04:32.850 When you type. 04:32.860 --> 04:37.870 You can see here it gives the information about Deiner number and the user. 04:37.870 --> 04:41.500 So here you can see a route is the system the resolve. 04:41.710 --> 04:45.290 These are the users for the TCAP ports here. 04:45.460 --> 04:53.340 So in this way you can list this information if you want to view the routing information that we saw 04:53.370 --> 04:55.310 with route come on in our previous lives. 04:55.320 --> 05:04.420 And you can just type on and he can do OK you can if you like this and if you don't want to print the 05:04.450 --> 05:09.260 hostname if you want to print only the IP addresses here you can see. 05:09.460 --> 05:12.810 In this case the hostname must be our default here. 05:12.820 --> 05:13.930 Column number one. 05:13.990 --> 05:20.240 If you don't want to print that and you want to print painlessness type and hit enter. 05:20.260 --> 05:24.810 Now here you can see $0.00 0 is printed here. 05:24.940 --> 05:28.120 OK instead of that different name. 05:28.320 --> 05:32.020 In this way you can see such kind of information. 05:32.100 --> 05:38.510 If you cannot sprint the interface name or OK on your local system like this. 05:38.670 --> 05:39.220 OK. 05:39.430 --> 05:45.610 So these are the interfaces here you can see in the registry and all these are the interface names that 05:45.610 --> 05:47.150 you can list with I. 05:47.290 --> 05:52.620 And if you want to see more user friendly output of this then just take each. 05:52.840 --> 05:53.530 OK. 05:53.720 --> 05:55.490 He can't get in. 05:55.510 --> 05:58.920 You can see the output like then ifconfig c'mon. 05:59.190 --> 05:59.760 OK. 06:00.060 --> 06:04.880 And if you want to call them diecast mission then type I fringy. 06:05.360 --> 06:05.770 OK. 06:05.800 --> 06:09.990 This list the multicast group information. 06:10.480 --> 06:14.220 There is a Funmi if you want to view the output of Nestor's. 06:14.240 --> 06:16.890 Come you know continues we like you. 06:16.930 --> 06:25.880 You maybe saw in some good movies nice continues GROL and does all that come on line or could so just 06:25.880 --> 06:28.520 type here see and hit enter. 06:28.760 --> 06:37.060 And now you can see it continues to scroll that screen ok for a long time until you press control seek 06:37.060 --> 06:46.390 to get it in this way you can use the nets that combined to monitor the network connections on the interface 06:46.540 --> 06:49.130 on your local interface. 06:49.410 --> 06:55.410 OK you know and we saw group come on OK we saw here like this. 06:55.640 --> 07:03.220 And in with this we get that network IP and forget me. 07:04.460 --> 07:08.770 OK here would to show you the more information I will come on. 07:08.770 --> 07:13.170 So you can add a default route into your system. 07:13.300 --> 07:14.140 Come on. 07:14.140 --> 07:26.200 So suruh then an OK after that default gateway and the IP address of your gateway machine will get the 07:26.210 --> 07:27.670 Gateway Interface. 07:27.670 --> 07:35.570 So after this hit enter only you'll find that the default gateway has been added. 07:36.010 --> 07:45.700 And if you want to delete that then just tell us who defined and after typing this you will find you 07:45.700 --> 07:52.790 will default gateway will be moved in this way you can perform this operation. 07:52.950 --> 07:59.010 Come on you can also block Blockley particular host frocked from user interface. 07:59.220 --> 07:59.520 OK. 07:59.530 --> 08:04.670 So good that what you need to do is just get the come on. 08:04.870 --> 08:11.870 OK you need to have super access and traders who then host. 08:12.340 --> 08:15.870 Suppose I want to lock the doors. 08:16.010 --> 08:18.390 You got 14. 08:18.670 --> 08:27.310 And for this they reject Algie and he can get in. 08:27.370 --> 08:30.330 You try to clean that up. 08:30.340 --> 08:32.470 You got 14. 08:32.930 --> 08:35.500 Let's see what it says no to the host. 08:35.500 --> 08:39.450 That means that host is blocked on this interface. 08:39.610 --> 08:40.270 OK. 08:40.270 --> 08:42.840 You can also block a complete network. 08:42.880 --> 08:49.480 OK on you work system so good that what you need to do is lose this horse get laid. 08:49.980 --> 08:50.620 OK. 08:50.680 --> 09:00.640 And here you need to point out things like this and then mega-mosque 255 dog give 09:03.580 --> 09:05.520 255 or zero. 09:05.830 --> 09:13.480 And after that reject and hit enter or get after doing this you will find you blocked on the networks 09:13.570 --> 09:18.830 means you cannot configure any IP address in that range on the word interface. 09:19.030 --> 09:19.580 OK. 09:19.780 --> 09:20.900 In this way. 09:21.260 --> 09:22.060 Come on. 09:22.150 --> 09:25.100 Can we use to form their own operations. 09:25.260 --> 09:33.550 OK after performing all these operations the next I like to show you how to monitor the packets or how 09:33.550 --> 09:37.090 to capture the packets on only word or interface. 09:37.230 --> 09:37.670 OK. 09:37.810 --> 09:45.910 So there is a c'mon Corolla's PC be done with that participial dump come on you can monitor the packets 09:45.910 --> 09:49.090 on an the face on your system. 09:49.440 --> 09:49.960 OK. 09:50.020 --> 09:53.650 So let's check whether that command is installed or not. 09:53.650 --> 10:04.840 Or if you find that command is not installed just who will still be dumped and after that and that come 10:04.840 --> 10:07.890 on installed on your system. 10:08.010 --> 10:10.270 And now I have that come on. 10:10.480 --> 10:21.050 So just type in the dump and Unica point here switched for interface and then in its name you see and 10:21.310 --> 10:22.160 enter. 10:22.540 --> 10:27.390 OK now here you can see it start to listen for the incoming or outgoing ports. 10:27.550 --> 10:29.390 OK on that interface. 10:29.410 --> 10:36.210 So what happens here is it captures the back gates on that interface and show it to you. 10:36.220 --> 10:36.940 OK. 10:37.420 --> 10:43.090 So currently I'm not going to capture the packets because it takes a long time actually to capture the 10:43.090 --> 10:47.570 Packers because there is no interaction is going on on this interface currently. 10:47.650 --> 10:50.100 So I'm going to press control-C. 10:50.620 --> 10:58.350 OK you can the come on here and word for a long time then of course some time will find something is 10:58.360 --> 11:03.060 going on means it captures some packets on your system and show it to you. 11:03.390 --> 11:03.960 OK. 11:04.060 --> 11:11.190 So in this way you can capture the packets if you want to see all the visual interfaces on your system. 11:11.260 --> 11:14.360 And then just type the switch capability. 11:14.380 --> 11:15.420 OK. 11:15.460 --> 11:21.480 So it enter and this is all the available interfaces on your system after this. 11:21.500 --> 11:26.280 Suppose you want to capture the packets for a particular amount of time. 11:26.470 --> 11:33.330 Our particular package specific packets then just type your fancy and then fine. 11:33.540 --> 11:34.040 OK. 11:34.240 --> 11:42.140 And then I found an interface name OKI like this and it will capture the back. 11:42.150 --> 11:45.280 It's only five packets or five times. 11:45.280 --> 11:47.090 OK on this interface. 11:47.320 --> 11:47.920 Good. 11:48.250 --> 11:56.410 And if you want to print all the packets in ASCII format Gadot then just type hyphen a little high and 11:56.410 --> 11:58.900 the interface name in the list. 11:59.080 --> 11:59.590 OK. 11:59.770 --> 12:00.810 And hit enter. 12:00.910 --> 12:06.090 Now I would start to capture the packets and it will display an ASCII format. 12:06.190 --> 12:10.870 And if you want to display it in hexadecimal format then type capital. 12:10.900 --> 12:12.390 And hit enter. 12:12.550 --> 12:19.410 Now you start to listen to start to capture the packet and show it to you in the exact decimal as well 12:19.410 --> 12:22.210 as in like ASCII format. 12:22.280 --> 12:26.150 In this way you can capture packets in different forms. 12:26.290 --> 12:30.310 You can write down this capsule package school file. 12:30.630 --> 12:38.650 Ok so if you want to capture those packets then what you need to do is unique type w here and here you 12:38.650 --> 12:40.190 need to provide the file name. 12:40.270 --> 12:44.810 I'm going to provide your 00 one got our got. 12:44.860 --> 12:45.630 Recap. 12:45.690 --> 12:47.130 Recap for packet capture. 12:47.130 --> 12:53.740 Any danger now of getting engaged will capture the packet on interface in history and so that file in 12:53.740 --> 12:56.520 your current directory will get. 12:56.950 --> 13:04.850 And if you want to read that captured packets what you need to do is just provide for an hour. 13:05.110 --> 13:06.270 And finally. 13:06.490 --> 13:09.810 So here you can see on my system currently. 13:09.820 --> 13:15.260 I already captured a packet in the file 0 0 0 1 part recap. 13:15.310 --> 13:19.910 So I want to show it to you how to read the packet file. 13:19.950 --> 13:26.780 So dumb they are and 0 1 got. 13:27.490 --> 13:33.510 And he can not hear and see how I read that file and show it to you. 13:33.980 --> 13:36.290 OK Typhon are OK. 13:36.520 --> 13:41.750 You can also do like if you want to see only TCAP ports. 13:41.770 --> 13:49.850 If you want to capture the backgrounds from only TZP ports Okey then you can do it like this like the 13:49.850 --> 13:50.600 Superdome. 13:50.740 --> 13:56.910 Then you can be Z-list tree and here just need to port DCP. 13:56.950 --> 14:01.810 Then what happens is GEP just only TCAP packets on that interface. 14:02.380 --> 14:09.770 Resti you can support the port number if you want to capture the package for one particular part number 14:09.980 --> 14:12.460 then you can proceed like this. 14:12.590 --> 14:20.290 The port number and then he turned to you can also capture that differs from the source machine. 14:21.210 --> 14:23.030 Our source IP address. 14:23.330 --> 14:30.580 So for those pederasts destroyed SIRC and they played this off fuel source machine. 14:30.890 --> 14:33.430 So soberly idlis means your local machine. 14:33.590 --> 14:43.190 OK so suppose I want to capture that for this then I don't know start to listen or start to capture 14:43.190 --> 14:47.140 the package on this interface on for this IP address only. 14:47.720 --> 14:54.910 And you can also captive for destination so you capture the packets for this mission machine and just 14:54.910 --> 14:59.090 type DST and IP address of the destination machine. 14:59.750 --> 15:06.490 So here you deploy I suppose I have this condition machine off I played this one night we bought 1 6 15:07.380 --> 15:10.790 0 on 1 ok. 15:11.060 --> 15:15.020 Start to capturing the packets on that interface. 15:15.360 --> 15:21.270 Ok in this way you can perform all the network monitoring really discussed with the help of these commands. 15:21.270 --> 15:24.510 These are very basic but very important commands. 15:25.590 --> 15:29.870 These commands are very helpful in performing the network administration. 15:29.990 --> 15:33.300 OK so where does this come on on your own.