Remote Monitoring System For Cyber Forensic
Remote Monitoring System For Cyber Forensic
Remote Monitoring System For Cyber Forensic
programetically ?
---- >
Network Commands :
TRACEROUTE COMMAND :
Traceroute command is a very useful network diagnostic tool. Traceroute displays each
host that a packet travels through as it tries to reach its destination. We can see how many
“hops” from the Slackware web site you are with this command:
% traceroute www.slackware.com
Each host will be displayed, along with the response times at each host. Here is an
example output:
% traceroute www.slackware.com
traceroute to www.slackware.com (204.216.27.13), 30 hops max, 40 byte packets
1 zuul.tdn (192.168.1.1) 0.409 ms 1.032 ms 0.303 ms
2 207.171.227.254 (207.171.227.254) 18.218 ms 32.873 ms 32.433 ms
3 border-sf-2-0-4.sirius.com (205.134.230.254) 15.662 ms 15.731 ms 16.142 ms
4 pb-nap.crl.net (198.32.128.20) 20.741 ms 23.672 ms 21.378 ms
5 E0-CRL-SFO-03-E0X0.US.CRL.NET (165.113.55.3) 22.293 ms 21.532 ms 21.29 ms
6 T1-CDROM-00-EX.US.CRL.NET (165.113.118.2) 24.544 ms 42.955 ms 58.443 ms
7 www.slackware.com (204.216.27.13) 38.115 ms 53.033 ms 48.328 ms
traceroute is similar to ping in that it uses ICMP packets.
DNS Tools
Domain Name Service (DNS for short) is that magical protocol that allows your
computer to turn meaningless domain names like www.slackware.com into meaningful
IP address like 64.57.102.34. Computers can't route packets to www.slackware.com, but
they can route packets to that domain name's IP address. This gives us a convenient way
to remember machines. Without DNS we'd have to keep a mental database of just what
IP address belongs to what computer, and that's assuming the IP address doesn't change.
Clearly using names for computers is better, but how do we map names to IP addresses?
host
host(1) can do this for us. host is used to map names to IP addresses. It is a very quick
and simple utility without a lot of functions.
% host www.slackware.com
www.slackware.com is an alias for slackware.com.
slackware.com has address 64.57.102.34
dig
The meanest dog in the pound, the domain information groper, dig(1) for short, is the go-
to program for finding DNS information. dig can grab just about anything from a DNS
server including reverse lookups, A, CNAME, MX, SP, and TXT records.
% dig @192.168.1.254 www.slackware.com mx
;; QUESTION SECTION:
;www.slackware.com. IN MX
;; ANSWER SECTION:
www.slackware.com. 76634 IN CNAME slackware.com.
slackware.com. 86400 IN MX 1 mail.slackware.com.
;; AUTHORITY SECTION:
slackware.com. 86400 IN NS ns1.cwo.com.
slackware.com. 86400 IN NS ns2.cwo.com.
;; ADDITIONAL SECTION:
ns1.cwo.com. 163033 IN A 64.57.100.2
ns2.cwo.com. 163033 IN A 64.57.100.3
finger Command
finger will retrieve information about the specified user. You give finger a username or
an email address and it will try to contact the necessary server and retrieve the username,
office, telephone number, and other pieces of information. Here is an example:
% finger johnc@idsoftware.com
finger can return the username, mail status, phone numbers, and files referred to as “dot
plan” and “dot project”. Of course, the information returned varies with each finger
server. The one included with Slackware returns the following information by default:
• Username
• Room number
• Login status
• Email status
telnet
Telnet allows you to log in to a computer, just as if you were sitting at the terminal. Once
your username and password are verified, you are given a shell prompt. From here, you
can do anything requiring a text console. Compose email, read newsgroups, move files
around, and so on. If you are running X and you telnet to another machine, you can run X
programs on the remote computer and display them on yours.
To login to a remote machine, use this syntax:
% telnet <hostname>
If the host responds, you will receive a login prompt. Give it your username and
password. That's it. You are now at a shell. To quit your telnet session, use either the exit
command or the logout command.
telnet does not encrypt the information it sends. Everything is sent in plain text, even
passwords. It is not advisable to use telnet over the Internet. Instead, consider the Secure
Shell. It encrypts all traffic and is available for free.
HTTP/1.1 200 OK
Date: Mon, 25 Apr 2005 20:47:01 GMT
Server: Apache/1.3.33 (Unix) mod_ssl/2.8.22 OpenSSL/0.9.7d
Last-Modified: Fri, 18 Apr 2003 10:58:54 GMT
ETag: "193424-c0-3e9fda6e"
Accept-Ranges: bytes
Content-Length: 192
Connection: close
Content-Type: text/html
netstat
Displays contents of /proc/net files. It works with the Linux Network Subsystem, it
will tell you what the status of ports are ie. open, closed, waiting, masquerade
connections. It will also display various other things. It has many different options.
tcpdump
This is a sniffer, a program that captures packets off a network interface and
interprets them for you. It understands all basic internet protocols, and can be used to
save entire packets for later inspection.
nmap
“ network exploration tool and security scanner”. nmap is a very advanced network
tool used to query machines (local or remote) as to whether they are up and what
ports are open on these machines.
A simple usage example:
nmap machine_name
This would query your own machine as to what ports it keeps open. nmap is a very
powerful tool, documentation is available on the nmap site as well as the information
in the manual page.
ifconfig
This command is used to configure network interfaces, or to display their current
configuration. In addition to activating and deactivating interfaces with the “up” and
“down” settings, this command is necessary for setting an interface's address
information if you don't have the ifcfg script.
route
The route command is the tool used to display or modify the routing table. To add a
gateway as the default you would type:
route add default gw some_computer
The ‘Ping’ class is similar to the Ping.exe tool. You can send an Internet Control
Message Protocol (ICMP) echo request using both synchronous and asynchronous
methods of the ‘Ping’ class. The Send() method is a synchronous method and returns
a ‘PingReply’ containing the results of an ICMP request. It blocks the application
while waiting for a reply. The SendAsync() is an asynchronous method which uses a
separate thread to send the request. The ‘PingCompleted’ event is raised when the
operation completes and you can use the ‘PingCompletedEventHandler’ delegate to
handle it.
Let us see how to use these classes to send a request both synchronously and
asynchronously:
C#
using System.Net.NetworkInformation;
VB.NET
Imports System.Net.NetworkInformation
Console.ReadLine();
C#
pingasync.SendAsync(mac, "ping");
autores.WaitOne();
Console.ReadLine();
if(e.Error != null)
Console.WriteLine(e.Error.ToString());
}
WINIPCFG
The winipcfg command available in Windows allows a user to display network and
network adapter information. Here, a user can find such information as an IP address,
Subnet Mask, Gateway, etc...
NETWORK PROCESSES
The basic function for creating network connections and network servers is make-
network-process.
:name name
Use the string name as the process name. It is modified if necessary to make it
unique.
:type type
Specify the communication type. A value of nil specifies a stream connection (the
default); datagram specifies a datagram connection; seqpacket specifies a
“sequenced packet stream” connection. Both connections and servers can be of these
types.
:server server-flag
If server-flag is non-nil, create a server. Otherwise, create a connection. For a stream
type server, server-flag may be an integer which then specifies the length of the
queue of pending connections to the server. The default queue length is 5.
:host host
Specify the host to connect to. host should be a host name or Internet address, as a
string, or the symbol local to specify the local host. If you specify host for a server,
it must specify a valid address for the local host, and only clients connecting to that
address will be accepted.
:service service
service specifies a port number to connect to, or, for a server, the port number to
listen on. It should be a service name that translates to a port number, or an integer
specifying the port number directly. For a server, it can also be t, which means to let
the system select an unused port number.
:family family
family specifies the address (and protocol) family for communication. nil means
determine the proper address family automatically for the given host and service.
local specifies a Unix socket, in which case host is ignored. ipv4 and ipv6 specify
to use IPv4 and IPv6 respectively.
:local local-address
For a server process, local-address is the address to listen on. It overrides family, host
and service, and you may as well not specify them.
:remote remote-address
For a connection, remote-address is the address to connect to. It overrides family,
host and service, and you may as well not specify them.
:nowait bool
If bool is non-nil for a stream connection, return without waiting for the connection
to complete. When the connection succeeds or fails, Emacs will call the sentinel
function, with a second argument matching "open" (if successful) or "failed". The
default is to block, so that make-network-process does not return until the
connection has succeeded or failed.
:stop stopped
Start the network connection or server in the `stopped' state if stopped is non-nil.
:buffer buffer
Use buffer as the process buffer.
:coding coding
Use coding as the coding system for this process. To specify different coding systems
for decoding data from the connection and for encoding data sent to it, specify
(decoding . encoding) for coding.
:noquery query-flag
Initialize the process query flag to query-flag. See Query Before Exit.
:filter filter
Initialize the process filter to filter.
:sentinel sentinel
Initialize the process sentinel to sentinel.
:log log
Initialize the log function of a server process to log. The log function is called each
time the server accepts a network connection from a client. The arguments passed to
the log function are server, connection, and message, where server is the server
process, connection is the new process for the connection, and message is a string
describing what has happened.
:plist plist
Initialize the process plist to plist.
A TDI filter driver to collect the stats, a service which communicates with the driver
and gets the stats once per second.