TCPEye basically displays those information in a graphical user interface. The application displays all processes that currently have a connection to a remote address. A remote address can be a device on the same computer network, or the Internet.

Each process is listed with its name, local and remote address, connection state, protocol, remote address country, process path and a handful of additional information about the program and company.

The displayed information can be saved or copied (to the clipboard) at anytime. A right-click on an entry, or the selection of the options menu at the top, lead to additional features. Available options include sending a process directly to the online virus checking service Virus Total, resolving addresses, terminating connections or processes, and the built-in Whois IP and Geo IP tools.

The direct upload option to Virus Total can be used to check any running process for malicious code. The file gets uploaded automatically by the application, providing that it is less than 10 Megabytes in size. The results of the scan are opened directly in the default web browser.

TCPEye is a handy netstat frontend that offers enough extra features to make it more than just an alternative. The application can be downloaded from Cnet.

Installation?

Fortunately your distribution should come with the netstat command pre-installed. To check this, open up a terminal window (that’s where you will use netstat anyway) and issue the command which netsat. This command should return something like /bin/netstat. That will tell you that the tool is installed and where the executable is.

Usage

Because netstat offers such a variety of options, it might be best if I first list some of the more useful options.

a: Shows the state of all sockets and routing table entries.

c: Display information continuously.

d: Show the state of all interfaces that use DHCP.

e: Show extended information.

g: Show the multicast group membership information for both IPv4 and IPv6.

i: Display a table of all network inferfaces.

l: Limit statistics to a defined interface.

M: Show multicast routing tables.

n: Shows network addresses as numbers instead of the default symbols.

p: Show address resolution tables.

P: Limit statistics to a defined protocol.

r: Show all routing tables.

t: Show TCP connections.

u: Show UDP connections.

v: Use verbose mode for output.

So let’s take a look and see how these can be used together.

netstat

By itself (no options) this command prints out generic statistics of the host you are currently connected to.

netstat -an

This command will display all connections to the host, including source and destination addresses and ports, and displays them as numbers.

netstat -rn

This command will display the routing table for the host in numeric form.

netstat -r

This command will display your routing table for your host.

netstat -natp

This command will display active TCP connections in numerical form.

netstat -t –listening

This will show you all tcp ports you host is listening on.

Figure 1

netstat –statistics

This command will display various statistics for your host’s interfaces. Note that this command will display a LOT of statistics. A snippet of the output will look like that shown in Figure 1.

As you can see, this command will display quite a bit of information. On top of that you might need to pipe this command through the less command in order to see it more easily. That full command would look like netstat –statistics | less. Using it that way would allow you to use your arrow keys to scroll up and down through the ouput.

Final thoughts

Although not an exhaustive look at the netstat command, this will get you started and using this handy tool. Since there are so many switches and options to use with netstat, in order to cover them all, take a look at the netstat man page (issue the command man netstat) where you can see each and every switch explained.



With the help of the GNOME Nettools you can have a sweet collection of powerful tools that will help you to troubleshoot your network in no time. And this collection of tools is all wrapped up into a user-friendly graphical interface. So without any further adieu, let’s take a look at this powerful suite of tools.

Features

The GNOME Nettools includes the following tools:

• Devices: Have all information about your networking devices at your fingertips.
• Ping: Get detailed information using the ping tool.
• Netstat: Get detailed information about your routing table, active network services, and multicast information about your machine.
• Traceroute: Trace the path to a network host.
• Port scan: Scan for open ports on servers and desktops.
• Lookup: Get detailed information about a server.
• Finger: Lookup a users finger entry.
• Whois: Lookup a whois entry for a domain.

GNOME Nettools also features:

• Copy information to text report.
• Help system.
• Drop downs for previously entered addresses/domains.
• Easy to use GUI.

Now let’s take a look and see how this tool is used.

Usage

Figure 1

As you can see there has been no mention of installation. That is because GNOME Nettools is installed by default. In order to start up the tool you only have to go to the Administration sub-menu of the System menu. Once you have fired up the tool you will be greeted with main window at the Devices tab. This tab is where you gather the information about your installed networking devices. As you can see (In Figure 1) there is plenty of detailed information about my default eth0 interface. You can switch this to display information about any connected internet device you have on the machine by using the Interface drop-down.

The next tab, Ping, is where you can actually start troubleshooting networking issues. Ping is almost always one of the first tools I use, but I generally use it in command line form. Since most new Linux users prefer to not use the command line – you can still get your ping on with Nettools. Click on the Ping tab to reveal how the Ping tool works (see Figure 2).

Figure 2

By default the Nettools Ping tool will be configured for a limited 5 requests. You can up that number or even change it to an unlimited number if you need. In Figure 2 I have sent 5 ping requests to an internal server and received 100% sucess on my packets. I know this server is at least responding.

The other tools will all work exactly as you would expect them. One thing that is nice is as a tool is working you can switch over to another tool without disrupting the original tools task. This is especially nice when running a traceroute that can take a while (see Figure 3).

Figure 3

The traceroute tool will follow a path, hop for hop, to a destination you enter. In Figure 3 I ran a traceroute on www.google.com which ended before it reached its goal. This, of course, was only to show you the output of the traceroute (as there is not much I can personally do if my route to www.google.com is stopped outside of the boundaries of my network or my service providers network. But it gives you an idea of where the route stops. If this were a corporate issue, and the destination was one I had to reach, I would know precisely where the last known successful hop was (in the case of Figure 3 – after the 65.222.158.82 address).

I can then use the Whois tool to discover who is connected to that address. By clicking on the Whois tab and then entering the IP address above I receive the following information:

MCI Communications Services, Inc. d/b/a Verizon Business UUNET65 (NET-65-192-0-0-1)
65.192.0.0 - 65.223.255.255
SPLICE COMMUNICATIONS, INC. UU-65-222-158-80-D4 (NET-65-222-158-80-1)
65.222.158.80 - 65.222.158.87

If www.google.com were a critical address for me (and my company) to reach for work (or a host of my company’s web site) I could at least contact the owner of this domain.

Final thoughts

As you would expect, the rest of the Nettools tools work in a very similar fashion than their command line counter parts. The only difference? You don’t have to open up a terminal window to use them. No commands to remember, no commands to type. Just easy network analysis, with the help of a user-friendly GUI tool.

There is one tool that is ready to hand you much of the networking information you will need from your server. That tool? Netstat. The netstat tool prints out (on the command line) information about the Linux networking subsystem. With this tool you can get valuable information about: Open sockets, routing tables,  multicast group membership, network interfaces, masqueraded connections, and protocol statistics. Each type of information can also be narrowed with the help of options.

In this article you will learn how to be able to make use of the netstat tool, so you can have as much networking information as you need at your fingertips.

Basic structure

The basic netstat command looks like:

netstat ARGUMENT OPTIONS

Where ARGUMENT is the type of address family you want information about and OPTIONS is the optional option(s) that will specify the type of information you get returned.

Now let’s break this command down into address families.

Open Sockets

This is the easiest way to use netstat. If you issue the command without any arguments you will get a list of all sockets that are currently listening on a system. The output would look something like:

Proto RefCnt Flags Type       State         I-Node   Path
unix  3      [ ]   STREAM     CONNECTED     205824   /tmp/.X11-unix/X0
unix  3      [ ]   STREAM     CONNECTED     205823
unix  3      [ ]   STREAM     CONNECTED     203856   /tmp/.X11-unix/X0
unix  3      [ ]   STREAM     CONNECTED     203855

As you can see, from the output above, the information isn’t terribly useful. We can make it much more useful with a few options. What we want to do is tell netstat to give us output for specific applications that are listening for tcp connections. To do this we issue the command:

netstat –tcp –listening –programs

The output for this command would look something like:

Proto Recv-Q Send-Q Local Address Foreign Address Stat    PID/Program
tcp   0      0      *:ssh         *:*             LISTEN  25469/sshd
tcp   0      0      *:httpd       *:*             LISTEN  26754/httpd
tcp   0      0      localhost:ipp *:*             LISTEN  -


Now you can actually see some useful information. In the above output you can see that both sshd and httpd are listening for incoming connections. The above is just a snippet of what the output can look like. What is very handy about this command is it will show you if there is a command or local address listening for incoming connections that shouldn’t be listening. If you find an application that shouldn’t be listening, kill it to be safe.
Route

Netstat is able to quickly print your machines’ kernel routing table with the command:

netstat -r

The output of this command will look like:

Kernel IP routing table
Destination  Gateway     Genmask         Flags   MSS Window  irtt Iface 192.168.1.0  *           255.255.255.0   U       0 0         0    eth0
default      192.168.1.1 0.0.0.0         UG      0 0         0    eth0

Statistics

This is one of the handier of the netstat tools. With this you can find out exactly the statics for each protocol. The basic command structure is:

netstat –statistics

which will give you far more information than you want. Say, you only want to see statistics on the TCP protocol. For this you can issue the command:

netstat -t –statistics

The output to the above command will include information such as:

Tcp:
4343 active connections openings
8 passive connection openings
5 failed connection attempts
178 connection resets received
6 connections established
59075 segments received
60033 segments send out
76 segments retransmited
0 bad segments received.
303 resets sent

Or you could get information on UDP as well with the command:

netstat -u –statistics

Which would give you similar output for the UDP protocol.

Get creative

What if you wanted to see all unique IP addresses connected to a server? You can do that with netstat (and the help of a few other tools) like so:

netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq

The output of the above command would depend upon how much traffic your machine/server is getting. But it will include all unique IP addresses attempting to connect to your server.

What about checking to see if your server is under a DOS attack? You can do that with netstat like this:
netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

The above command will list out the IP addresses requesting the highest amount of connections to your server. If you see a number that is far higher than it should be, you most likely are under a Denial of Service attack.

Final thoughts

As you can see the netstat command is quite useful. And its usefulness is only limited to your creativity. Have you discovered a handy use for netstat? If so, share it with your fellow ghacks readers.

The network monitoring software can be used to monitor incoming and outgoing traffic of selected network adapters and connections. Traffic is shown in graphs and logged in files for further processing. Reports are extensive and provide access to daily, weekly, monthly and custom reports. Even better, reports can be exported which can be useful for book keeping among other things.

A realtime network traffic graph visualizes the incoming and outgoing traffic. Notifications can be used to perform actions under certain conditions. They can be configured to run so called actions when network traffic drops or rises above a certain level. Possible actions include running a software, displaying visual and sound alerts or to drop the connection.

Networx includes network information and testing tools like netstat that display all applications currently using the network connection. The application uses roughly 10 Megabytes of computer memory in minimized state.

Update: The program sits quietly in the system tray of the operating system for most of the time it is running. A right-click brings up the program menu where you can display or hide the traffic graph on the desktop and access other tools and settings.

The application is offered as a setup and portable version, ideal for users who carry an USB or troubleshooting DVD with them around when they to tech support. The latest program version is compatible with all recent versions of the Microsoft Windows operating system, including 32-bit and 64-bit editions of Windows Vista and Windows 7, as well as Windows server variants.

NetWorx 5 has been released in 2009, check out our review of the new version here.

You run it by opening your command prompt and typing netstat. Its highly customizable using switches like netstat -a. Its mainly used to get a quick overview on whats happening on your system connection wise.

The introduction to netstat tutorial is a good essay that features all netstat options and explains the output.