Using Tcpdump to dump and read network traffic

Another Quick FYI tip.

There are many network analyzer/reader utilities available on both Linux and Windows platform. There is of-course Wireshark, the most preferred GUI network protocol analyzer, but I prefer tcpdump as it is very easy to use.

Lets get started with some examples then. Say if you want to capture all multicast data (from all interfaces), to a file, you run:

$> tcpdump -n "multicast" -vvv -w VideoStreamData.pcap

where:

• -w flag writes the captured traffic to the filepath specified. 
• -n flag avoid DNS look ups to convert host addresses to names. 

Or if you want to capture any packets with a specific destination IP say 172.68.1.1 and destination port 80 or 8080.

$> tcpdump -n "dst host 172.68.1.1 and (dst port 80 or dst port 8080)"

After you have captured network data in a pcap file with the tcpdump command, you can read the data packets in ASCII character sets with the command:

$> tcpdump  -A -r httpServerLogonMessages.pcap 

It comes in handy for reading http/web page traffic.

Or if you want to read the messages both HEX and ASCII along with header data.

$> tcpdump  -x -r MessengerCommunication_11July.pcap 

This comes in handy when you want to convert between different host and network byte order (or the other way round).

Read more about Big Endian to Little Endian conversion and vice-versa here. 

Troubleshooting Packet Drops in SolarFlare Onload 10G PCI Card

If you see lots of packet drops in your onload accelerated application even after going the troubleshooting discussion we did over here, you still see drops and are you are nowhere, you can investigate your application design/OS context scheduling and how the application is reading consuming the data packets. The potential reasons for packet drops could be that,
a) another task interrupting the threads reading the traffic or
b) You have run out of packet buffers because the socket receive buffers aren’t being emptied because read()/recv() isn’t called often enough.

It would be a good idea to monitor how many context switches the application/threads are experience because if this suddenly increases when you have a problem it would indicate another thread is competing for processing time on that core.

You can check this using the following command:

# cat /proc/<pid>/status | grep ctxt_switches
voluntary_ctxt_switches:        58
nonvoluntary_ctxt_switches:     1

Replace “<pid>” with the process ID for your application and the “voluntary” count is the number of times the application blocked and another thread was allowed to run. The “nonvoluntary” count is the number of times the thread was stopped from running by the kernel so something else could run in preference.

You can check the individual threads for the process by monitoring the ‘status’ files in the underlying ‘task’ directory:

# grep ctxt_switches /proc/<pid>/task/*/status
/proc/<pid>/task/<task-n1>/status:voluntary_ctxt_switches:    630
/proc/<pid>/task/<task-n1>/status:nonvoluntary_ctxt_switches: 32
/proc/<pid>/task/<task-n2>/status:voluntary_ctxt_switches:    2
/proc/<pid>/task/<task-n2>/status:nonvoluntary_ctxt_switches: 0
/proc/<pid>/task/<task-n3>/status:voluntary_ctxt_switches:    1
/proc/<pid>/task/<task-n3>/status:nonvoluntary_ctxt_switches: 0

Using Docker Containers to build C++ Projects

With everyone moving to the docker bandwagon, why should you feel left behind. If you have your project hosted on BitBucket.org, make sure that you do make use of the pipeline feature to ensure that the project/product is always in the sane state.

Here is a sample bitbucket-pipelines.yml file to get you going with building C++ projects.

# This is a sample build configuration for C++ – Make.
# Check our guides at https://confluence.atlassian.com/x/5Q4SMw for more examples.
# Only use spaces to indent your .yml configuration.
# -----
# You can specify a custom docker image from Docker Hub as your build environment.
image: gcc:6.1

pipelines:
  default:
    - step:
        script: # Modify the commands below to build your repository.
          - make
          - make test

Well this is not going to be very useful if you use other libraries like boost, or qt in your project. Because the basic default image that BitBucket uses has tools like gcc, python, maven, npm, java etc(Read more about the image here). It does not back with it other third party libraries (like boost).

What do you do? You have the following options at hand for specifying the image:

1. the default image bitbucket provides(which is not very useful. Read here about the image), 
2. your own image from docker hub (public/private) 
3. specify am image hosted in private registry. (for detailed instruction read here)

Well for our little POC project where we were testing the feasibility of making use of Pipeline features we decided to use ilssim/cmake-boost-qt5  image.

CAUTION: Always check the DockerFile of the image when using someone else's image for security issues. Its always better to build your own image and host it on Docker hub and use it.

Coming back to my example, our POC project had reference to boost threading libraries, so here is my sample bitbucket-pipelines.yml file:

# This is a sample build configuration for C++ – Make.
# Check our guides at https://confluence.atlassian.com/x/5Q4SMw for more examples.
# Only use spaces to indent your .yml configuration.
# -----
# You can specify a custom docker image from Docker Hub as your build environment.
image: ilssim/cmake-boost-qt5

pipelines:
  default:
    - step:
        script:
          - echo "This script runs on all branches that don't have any specific pipeline assigned in 'branches'."
  branches:
    master:
      - step:
          script:
          - make
          - make test
    feature/*:
      - step:
          script:
          - cd orchestrationService
          - cmake
          - make

You can read more about branch workflows here.

Block UDP Traffic via IPTables

While testing an application to verify all code flow paths, one of the scenarios demanded that the application handle dropped UDP packet stream. Now we had a recorded UDP stream at hand which we could play at will.

To simulate UDP packet drop, we added a rule in IPTables to drop/block all UDP packets destined for our UDP destination port 10222. The following command does it for you. 

To Block all udp traffic destined for port 10222

[root@paragpc ~]# iptables -A INPUT -p udp -i eth1 --dport 10222 -j DROP

where:

• -A is for add/Append iptable rule
• -p is for protocol
• -i  = --in-interface eth1  (there is similarly -o =--out-interface
• -j = JUMP

Refer the man page of iptables for more details. 

However don't forget to remove the rule once your test case is over.

Remove iptable rule dropping udp traffic destined for port 10222 [-D is for Delete iptable rule]

[root@paragpc ~]# iptables -D INPUT -p udp -i eth1 --dport 10222 -j DROP

However if you wish to permanently save the rule run the following command(source).

service iptables save

Creating tunnels over ssh - Connecting to remote machine ports over internet

Sometimes when I am working from home, I need my application, which generates data, to be able to send it(data) from my laptop to some machine in the office. For eg. Parsing XML files and storing it to a DB on the office LAN, or talking to web-service deployed in our staging environment, etc.

You can use a VPN to connect to your office LAN. Or you can use this simple tunneling solution that comes with ssh and get going.
From one terminal connect to your office machine (paragOfcPc).

parag@paragpc:~# ssh paragOfcPc -L 10000:192.168.42.43:12871
Last login: Tue May 16 14:41:01 2016 from 172.168.XX.YY
[root@paragOfcPc ~]# ssh 192.168.42.43
Last login: Tue May 16 08:08:51 2016 from 172.168.XX.YY
[root@SQL43 ~]# nc -lkv 12871
Connection from 10.1.1.51 port 12871 [tcp/*] accepted

This forwards the local port 10000 to port 12871 on some server on my office LAN: 192.168.42.43, which is different from my office pc : paragOfcPc. The nice thing about using ssh is I get the added benefit of being on a secure encrypted connection.

From another terminal you can test it with :

parag@paragpc:~# cat hello.txt
This is a demo message for the connection
Send more messages to the remote server
parag@paragpc:~# cat hello.txt | nc localhost 10000
parag@paragpc:~#

After you execute the second command you should now see the content of the file hello.txt in nc -lkv output.

In case you want to send data only to your office pc (in my case paragOfcPc), you can substitute 192.168.42.43 with localhost while creating the tunnel with -L parameter

Checking Bad Blocks in Hard Disk

If you need to see/check how your hard disk in doing, the first thing you look for bad sectors and read/write speed of your hard disk.
Below are a few commands which can be run on your linux machine to check for any errors/speed related or read-write issues

[parag@centos: /home/parag]# fdisk -l

Disk /dev/sda: 160.0 GB, 160041885696 bytes
255 heads, 63 sectors/track, 19457 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xd42ad42a

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1          64      512000   83  Linux
Partition 1 does not end on cylinder boundary.
/dev/sda2              64         587     4194304   82  Linux swap / Solaris
Partition 2 does not end on cylinder boundary.
/dev/sda3             587       19458   151582720   83  Linux


[parag@centos: /home/parag]# badblocks -v -s /dev/sda1
Checking blocks 0 to 511999
Checking for bad blocks (read-only test): done
Pass completed, 0 bad blocks found.

[parag@centos: /home/parag]# hdparm -tT /dev/sda

/dev/sda:
 Timing cached reads:   532 MB in  2.00 seconds = 266.05 MB/sec
 Timing buffered disk reads: 248 MB in  3.02 seconds =  82.11 MB/sec
[parag@centos: /home/parag]# hdparm -tT /dev/sda1

/dev/sda1:
 Timing cached reads:   556 MB in  2.00 seconds = 277.54 MB/sec
 Timing buffered disk reads: 236 MB in  3.00 seconds =  78.61 MB/sec

[parag@centos: /home/parag]# hdparm -tT /dev/sda1

/dev/sda1:
 Timing cached reads:   524 MB in  2.01 seconds = 261.21 MB/sec
 Timing buffered disk reads: 174 MB in  3.03 seconds =  57.49 MB/sec

[parag@centos: /home/parag]

Bash Script to Create users in a DB

Many a times when running unit test on a clean build, I want to skip the user creation part, or may be reset the user details/profile for a particular user(s) in Development environment.
Of course there are unit test suite written to automate the flow, but sometimes when you are in the flow or designing the test cases itself, you need something to do the little rub-scrub-and-setup the little tiny jobs.
Here is my small script which deletes two very specific users from the my_dev_db db and creates them again. The details of the user are in file UserProd.txt which is tab delimited.  Enjoy.

[parag@paragcentosvm ~]# cat populateUsers.sh
#!/bin/sh

mysql -u parag_dev -pSOMEPASSWORD -e "DELETE FROM User_Table where UserId in (110,111);" -D my_dev_db;
mysql -u parag_dev -pSOMEPASSWORD -e "LOAD DATA LOCAL INFILE '/home/Parag/UserProd.txt' INTO TABLE User_Table;" -D my_dev_db;

Zipping file and folders in Linux CentOS Fedora

To zip a file (or multiple files) in a zip (compressed format for distribution, saving disk space or emailing as attachment), you can use the zip utility present in allmost all the linux distros.

To check if you have zip installed on your machine type

# zip -h

if it is not present, it can be installed via yum Hence the task

# yum install zip
# yum install unzip

Or if you prefer apt over yum then run the following commands:

# apt-get install zip
# apt-get install unzip

Next you can zip files by running the following command. No need to add .zip file extension as it will be added by the zip utility:

$ zip myZip_FileName *

To compress a directory (and all sub-directories within it) run:

$  zip -r myZipped_FolderName *

To decompress (or deflate or unzip) the zip simply run the following command from your command prompt:

$ unzip  zippedFile.zip

To simply view the contents of a zip and not actually unzip it run:

$ unzip -tq zippedFile.zip

To unzip the contents of a zip in a new directory (for avoiding clutter and confusion) run:

$ unzip zippedFile.zip  -d /Folder_to_Unpack_into

Quick and easy bash script to update config file values

We have a service which connects to a database and does its job. As part of company policy we update/change the password for the database every 90 days. Here is a quick and easy script to update the password in all the config files connecting to the database. 

#!/bin/sh

NEW_PASSWORD="P@ssw0rd!!"
SERVICE_HOME_DIR="/opt/services/LogService"
cd $SERVICE_HOME_DIR 

#Password in the config file in the form: Password=OldP@sswd!
current_password=`cat service.config |grep ^Password | awk {'print $1'} `

#echo "Current Password::" $current_password
#echo "New Password::" $NEW_PASSWORD

# sed used to replace the current password by new password in config file
sed -i 's/^Password=.*/Password='${NEW_PASSWORD}'/' service.config

echo "Password successfully changed !!"

Hope this helps.