[LARTC] iptables output ?

[LARTC] iptables output ?

[raptor]

hi,

anyone to know a tool that will display more friendly output ... probably a tree like structure (if no cross sections occur)...

OR a top like output...

thanx
raptor
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] iptables output ?

[Dawid Kuroczko]

On Thu, 24 Oct 2002, raptor wrote:

> anyone to know a tool that will display more friendly output ...
> probably a tree like structure (if no cross sections occur)...

Some time ago I've started working on something like this, only
different. ;-)

Actually it is a perl module which interfaces with IPTables (and
so far it only reads standard data, no writing and no special
matching modules...).

What is "special" about it, is that it uses ioctls to read
tables, not libipt.  Reasons for it were: first of all libipt
used in a "daemon" leaks memory (some advanced hash-like magic
gets too complicated and not all memory mallocated gets freed),
secondly perl is already equipped with quite efficient means
of managing lists, etc so most of libipt's code isn't needed. :)
And having bypassed libipt gives a little bit more flexibility
(for instance, a matching module could be written as a pure
perl code, using unpack and pack functions)...

Of course most of it is a bit of my wishful thinking, but
some of it works already.  Unfortunately it is available
only through anonymous cvs (far too early to release it):

cvs -d :pserver:cvs@atlantis.ssw.krakow.pl:/var/cvs co \
 IPTables-perl/perliptc4

  Regards,
    Dawid

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] iptables output ?

[raptor]

Chandrashekhar Rane told me about "iftop" and i thuoght probably many of u don't know some very handy tools laying around and not included in the distros which can be interestiong to u so here is the list (u should find them with Google 'cause don't have them at hand here) :

iftop - top/tcpdump like network info
scli - browse info on the cisco router (via SNMP)
sntop - who is online !! polls hosts and indicate their current state.. has HTML output and can run as daemon.
fping - ping many hosts at once...
arping - ping but not with IP packets but with ARP requests... the best way to check conectivity even if the IP is misconfigured
atop - top like program with patch to the kernel can display net info too.
driftnet - capture gif,jpeg and mpeg-audio that cross over network :"))

If u know any other please mail them...

raptor
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] iptables output ?

[Dawid Kuroczko]

On Fri, 25 Oct 2002, raptor wrote:

> Chandrashekhar Rane told me about "iftop" and i thuoght probably many of
> u don't know some very handy tools laying around and not included in the
> distros which can be interestiong to u so here is the list (u should
> find them with Google 'cause don't have them at hand here) :
> 
> iftop - top/tcpdump like network info
> scli - browse info on the cisco router (via SNMP)
> sntop - who is online !! polls hosts and indicate their current state.. has HTML output and can run as daemon.
> fping - ping many hosts at once...
> arping - ping but not with IP packets but with ARP requests... the best way to check conectivity even if the IP is misconfigured
> atop - top like program with patch to the kernel can display net info too.
> driftnet - capture gif,jpeg and mpeg-audio that cross over network :"))
> 
> If u know any other please mail them...

dsniff? :-)  http://naughty.monkey.org/~dugsong/dsniff/
A nice collection of general sniffing-related tools, like
urlsnarf -- sniffs http traffic and produces access_log style file with 
  all requests it has seen.
webspy -- like urlsnarf, except it remotely commands Netscape to display
  sniffed urls.
tcpnice, tcpkill -- forge packets which should either slow down or kill
  specified tcp connection.

...something like that. :)

q.

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/