Netflow is the protocol developed by Cisco to manage data about IP traffic. In a few words using Netflow you can collect data about all IP data send/received on multiple Cisco/Linux/BSD/Juniper hosts and send it to central Netflow collector that will show you the nice graphs and also will allow to have a complete picture of what data was sent/received on those hosts (including destination and source IP, port, bytes transfered, int/out interfaces etc). Nfdump is netflow collector. Nfsen is graphical tools for generating graphs and querying Nfdump for historical traffic reports. In this article you will see how to deploy all this staff in Linux.

Netflow probe is required to collect IP traffic data on Linux host. In general this piece of sofware will sit in background, store every network activity on certain network interface and then send collected data to Netflow collector nfdump. As Netflow probe I prefer fprobe that is totally simple application that just does its job. If you feel that fprobe is not what you need or there are some problems with installing it you can try softflowd that can do the same job.

Install fprobe from sources:

cd /usr/src/
sudo -s
wget http://sourceforge.net/projects/fprobe/files/fprobe/1.1/fprobe-1.1.tar.bz2/download
tar -xvjf fprobe-1.1.tar.bz2
cd fprobe-1.1
./configure --prefix=/
make
make install

Point fprobe to one of network interfaces of Linux host and make it to send data to Netflow collector:

fprobe -i eth0 11.22.33.44:23456

In above example fprobe stores all data trasnfers on eth0 network interface and sends collected data to 11.22.33.44 host via 23456 UDP port (you may want to change firewall rules to make Netflow working over 23456 UDP port).

Install nfdump Netflow collector from sources:

cd /usr/src/
sudo -s
wget http://sourceforge.net/projects/nfdump/files/stable/nfdump-1.6.2/nfdump-1.6.2.tar.gz/download
tar -xvzf nfdump-1.6.2.tar.gz
cd nfdump-1.6.2
./configure --prefix=/ --enable-nfprofile
make make
install

When finished Netflow collector becomes ready so you can start capturing traffic from Netflow probe. If you don’t need any graphical tools like nfsen described below you can just start collector and save Netflow data in /var/neflow/ directory (THIS STEP IS OPTIONAL):

/bin/nfcapd -w -D -p 23456 -B 200000 -S 1 -z -I Linux-Host-1-eth0 -l /var/netflow/

In order to install nfsen from sources you have to get all its prerequisites, run one of below lines depending on what Linux distro you’re using (1st line is for Fedora, Centos, Redhat while 2nd line is for Ubuntu, Debian, Mint and similar):

yum install rrdtool rrdtool-devel rrdutils perl-rrdtool -y

or

aptitude install rrdtool librrd2-dev librrd-dev librrd4 librrds-perl librrdp-perl

Compile nfsen from sources:

cd /usr/src/
sudo -s
wget http://sourceforge.net/projects/nfsen/files/stable/nfsen-1.3.5/nfsen-1.3.5.tar.gz/download
tar -xvzf nfsen-1.3.5.tar.gz
cd nfsen-1.3.5
cp etc/nfsen-dist.conf etc/nfsen.conf

In order to continue the installation you should edit file etc/nfsen.conf to specify where to install nfsen, web server’s username (yes, you have to install apache, lighttpd, nginx or any other web server first), its document root directory etc. The major section of that config file is ‘Netflow sources’ that must list all hosts you’ve started Netflow probes at. Here is an example section for monitoring above Linux host:

%sources = (
    'Linux-Host-eth0'    => { 'port' => '23456', 'col' => '#ff0000', 'type' => 'netflow' },
);

When finished it’s time to actually install nfsen using installation script:

./install.pl etc/nfsen.conf

In case of successful installation you will be notified with corresponding congratulations message so it would be proper time to start nfsen daemon:

/path/to/nfsen/bin/nfsen start

Now you can open http://localhost/nfsen/nfsen.php at Linux host where nfsen was installed to start using this Netflow tool and see some graphs. Notice that it takes about 5-10 minutes to see first bars at the graphs, if the graphs are still empty you will have to check at least the following:

1. If fprobe is able to communicate to Netwflow collector and can send Netflow data to it (use ‘ps ax | grep fprobe’ and Linux host being monitored and tcpdump tool at Netflow collector).
2. If Netflow collector is started and can receive data from Netflow probe. Use ‘ps ax | grep nfcapd’ and tcpdump at Netflow collector Linux host.

If you can add anything — feel free to drop a comment below.

1. Mount cd-rom:

mount -F hsfs /dev/dsk/c0t1d0s2 /mnt/

where c0t1d0s2 is identifier of your cd-rom and may differ from system to system.

2. Install Packages:

pkgadd -d /mnt/Solaris_10/Product SUNWman
pkgadd -d /mnt/Solaris_10/Product SUNWdoc

PDF | Command Line Interface (CLI), Security, Networking

• Unix/Linux Command Reference by fosswire.com
• THE ONE PAGE LINUX MANUAL (A summary of useful Linux commands)
• LINUX System Call Quick Reference
• LINUX Admin Quick Reference
• Linux quick reference card
  
• Linux Shell quick reference guide
• Linux Security Quick Reference Guide
• tcpdump cheat sheet
• Wireshark display filters
• Netcat cheat sheet

HTML | CLI, Gnome/KDE

• DOS to Linux cheatsheet
• Unix toolbox
• Treebeard’s Unix cheat sheet
• Linux terminal shortcuts
• Just Linux cheat sheet
• Computerworld’s Linux cheat sheet
• Linux CLI reference for common operations
• Peter Lombardo’s Linux cheat sheet
• EZ Linux Cheat Sheet
• Gnome/KDE shortcuts
• Linux related reference sheets by suso.com
• Bonus: Linux/UNIX and Microsoft Cheat Sheet

PDF | Linux Distributions Cheat Sheets

• Ubuntu
• Debian
• Top  Ubuntu Cheat Sheets

HTML/PDF | vi, sed, awk

• Vi Cheat Sheet
• Vim Tips Cheat Sheet
• Awk, Nawk Cheat Sheet
• Sed Stream Editor Cheat Sheet
• Vi/Vim Cheat Sheets (Lessons)

Information improvisation: Our incredible deals of HP2-Q04 practice exam and free 642-467 dumps tutorials make your success certain for the final OG0-093 exam and you can get HP0-S30 exam dumps & 642-456.

A: In GNU Screen press Ctrl + a + [ to enter Copy Mode, then scroll up/down using keys j or k. Below are some other navigation keys:

h -    Move the cursor left by one character
j -    Move the cursor down by one line
k -    Move the cursor up by one line
l -    Move the cursor right by one character
0 -    Move to the beginning of the current line
$ -    Move to the end of the current line.
G -    Moves to the specified line
       (defaults to the end of the buffer).
C-u -  Scrolls a half page up.
C-b -  Scrolls a full page up.
C-d -  Scrolls a half page down.
C-f -  Scrolls the full page down.

By the way, in order to define scrollback buffer size start screen with the following key (5000 lines in this example):

screen -h 5000

Quick info about GNU Screen utility: it is Unix tool that allows to run multiple applications in several “virtual” windows. It is very useful when you need, let’s say, to see hardware resources consumption caused by started application in different console etc. GNU screen is also good option to run applications remotely via ssh: just run application in screen and log off until it’s finished, then just “pick up” screen session and see how the application’s output.

Update: You can use activate copy mode of GNU Screen also by Ctrl + Esc that might be more useful than Ctrl + a + [ shortcut (thanks to Yu-Jie Lin for this tip).

Information improvisation: You can get score highest marks in 000-119 exam using 642-971 and 642-481 which are prepared by top certified professionals, mcp certification & 642-631; both are marvelous in their nature.

The !$ command returns the last argument used with a command. But what happens if you have a command that used arguments and you want to reuse just one of them? The !:1 operator returns the argument used in a command. The example in Listing 3 shows how you can use this operator in combination with the !$ operator. In the first command, a file is renamed to a more meaningful name, but to preserve use of the original file name, a symbolic link is created. The file kxp12.c is renamed in a more readable manner, then the link command is used to create a symbolic link back to the original file name, in case it’s still used elsewhere. The !$ operator returns the file_system_access.c argument, and the !:1 operator returns the kxp12.c argument, which is the first argument of the previous command.

Listing 3
$ mv kxp12.c file_system_access.c
$ ln –s !$ !:1

Read more here…

A: Well… You can use Pizza Party application written by Cory Arcangel and Michael Frumin! Here are some features this outstanding application provides:

• Can order pizza with only a few keystrokes.
• Can save pizza preferences.
• Can use batch files for ordering many pizzas.
• Has easy to use flags for ordering different toppings.
• Runs on most UNIX-like operating systems.
• Supports most currently popular topings like “mushrooms”, and “pepperoni”!
• Unattended / background operation.
• Pizza Party is distributed under the GNU General Public License.

Download Pizza Party’s initial source code here and python ported version from this link.

P.S. This portion of Friday humour is provided by Royal HeHe2-ness!

Information improvisation: You can sign up for 70-576 training program to guarantee passes your HP0-J43 exam. We also offer best quality self study resources for 70-536 & OG0-093, have you ever heard about 000-152, they are stunning in IT world.

found at http://17outs.com/.

Answer: You are welcome to use dmidecode which helps to get information about your system’s hardware as described in your system BIOS. That information typically includes system manufacturer, model name, serial number, BIOS version, asset tag as well as a lot of other details depending on the manufacturer.

Beware that DMI data have proven to be too unreliable to be blindly trusted. Dmidecode does not scan your hardware, it only reports what the BIOS told it to. Dmidecode was first written by Alan Cox and is now being further developed and maintained by Jean Delvare. It is released under the General Public License (GPL).

This tool can be easily downloaded from here (source code) or can be installed as binary package included into repositories of many distributions like Debian, Ubuntu, Gentoo. FreeBSD version is also available. Actualy it is reported that dmidecode works well on the following systems:

• Linux i386
• Linux x86_64
• Linux ia64
• FreeBSD i386
• FreeBSD x86_64
• NetBSD i386
• OpenBSD i386
• BeOS i386
• Cygwin i386
• Solaris x86 (CVS version)

In Ubuntu (my favourite distro) just execute the following: sudo aptitude install dmidecode (sample output is here).

1. Easy to configure and powerful MTA (Postfix)
2. Virtual domains and user accounts (this information is stored in MySQL database)
3. Antispam and antivirus checking for all accounts (spamassassin and clamav via amavis-new)
4. Secure access to mailboxes through POP3, IMAP and HTTP (squirellmail)
5. Secure SMTP server
6. Extremal Stability and Security

Actually OpenBSD 4.2 was chosen because of it’s “security by default”. Thankfully Daniele Mazzocchio from friendly site www.kernel-panic.it wrote an excellent article about how to build such mail server on this operating system:

Offering a reliable and secure email service is probably one of the top priorities of most system administrators; therefore, in the next chapters, we will build a full-featured mail server, based on open-source software and focusing on security. Read more…

The only thing that is not covered by it is mail content filtering with maildrop and vacation messages that users often ask to set while they are out. Working on it!

When you use a system often, you tend to fall into set usage patterns. Sometimes, you do not start the habit of doing things in the best possible way. Sometimes, you even pick up bad practices that lead to clutter and clumsiness. One of the best ways to correct such inadequacies is to conscientiously pick up good habits that counteract them. This article suggests 10 UNIX command-line habits worth picking up — good habits that help you break many common usage foibles and make you more productive at the command line in the process. Each habit is described in more detail following the list of good habits.

Those 10 good habits to adopt are:

1. Make directory trees in a single swipe.
2. Change the path; do not move the archive.
3. Combine your commands with control operators.
4. Quote variables with caution.
5. Use escape sequences to manage long input.
6. Group your commands together in a list.
7. Use xargs outside of find.
8. Know when grep should do the counting — and when it should step aside.
9. Match certain fields in output, not just lines.
10. Stop piping cats.

Full article is here.