Graphing Odds and Ends in Software

Drawer QR Code in Software Graphing Odds and Ends

When it comes to collecting network information, tcpdump is a gold mine Presenting the data collected using tcpdump in some kind of statistical or graphical manner may sometimes be useful/informative (or a good time-killing exercise at any rate!) Here are a few examples of things you can do

The Initial Sequence Number (ISN) in a TCP connection is the sequence number specified in the SYN packet that starts a connection For security reasons, it is important to have a sufficiently random ISN so that others can t spoof connections to your server To see a graph of the distribution of ISNs that your server is generating, let s use tcpdump to capture SYN/ACK packets sent from the web server To capture the data, we use the following bit of tcpdump piped to Perl:

[root@serverA:~]# tcpdump -l -n -t "tcp[13] == 18" | perl -ane '($s,$j)=split(/:/,$F[4],2); print "$s\n";' > graphme

The tcpdump command introduces a new parameter, -l This parameter tells tcpdump to line-buffer its output This is necessary when piping tcpdump s output to another program such as Perl We also introduce a new trick whereby we look into a specific byte offset of the TCP packet and check for a value In this case, we used the figure of the TCP header to determine that the 13th byte holds the TCP flags For SYN/ACK, the value is 18 The resulting line is piped into a Perl script that pulls the sequence number out of the line and prints it The resulting file, graphme, will simply be a string of numbers that looks something like this:

803950992 1953034072 3833050563 3564335347 2706314477

We now use gnuplot (wwwgnuplotinfo) to graph these You could use another spreadsheet to plot these, but depending on how many entries you have, that could be an issue The gnuplot program works well with large data sets, and it is free We start gnuplot and issue the following commands:

[root@serverA:~]$ gnuplot gnuplot>set terminal png Terminal type set to 'png' Options are 'small monochrome' gnuplot>set output 'synspng' gnuplot>plot 'graphme' gnuplot> quit

Taking a look at the generated synspng file, we see a graph that shows a good distribution of ISN values This implies that it is difficult to spoof TCP connections to this host Clearly, the more data you have to graph here, the surer you can be of this result Taking the data to a statistics package to confirm the result can be equally interesting

IPv6 is the Internet Protocol version 6 It is also referred to as IPng, ie, Internet Protocol the Next Generation IPv6 offers many new features and improvements over its predecessor IPv4 Some of the advancements previously mentioned are A larger address space Built-in security capabilities Offers network-layer encryption and authentication A simplified header structure Improved routing capabilities Built-in auto-configuration capabilities

IPv6 is able to offer an increased address space because it is 128 bits long (compared to the 32 bits for IPv4) Because an IPv6 address is 128 bits long (or 16 bytes), there are about 34 x 10^38 possible addresses available (compared to the roughly 4 billion available for IPv4) A human being representing or memorizing (without error) a string of digits that is 128 bits long on paper is not easy Therefore, several abbreviation techniques exist that make it easier to represent or shorten an IPv6 address in order to make it more humanfriendly The 128 bits of an IPv6 address can be shortened by representing the digits in hexadecimal format This effectively reduces the total length to 32 digits in hexadecimal IPv6 addresses are written in groups of four hexadecimal numbers The eight groups are separated by colons (:) A sample IPv6 address is

0012:0001:0000:0000:2345:0000:0000:6789

The leading zeros of a section of an IPv6 address can be omitted, eg, the sample address can be shortened to

12:1:0000:0000:2345:0000:0000:6789