36 Streamlining

Your Network

Technique Surveillance

Save Time By

Checking out file usage with lsof

Looking for open servers with lsof and grep

Using the Ethereal Network Analyzer to follow network traffic

Adding color to Ethereal reports for easy reading

Watching what your users are up to can tell you a lot about the requirements of your network. It can also alert you to practices that are going on that shouldn’t be. This technique is all about

watching file and network traffic to find out what your users are doing.

You use the lsof command to get a list of all the open files on your system as well as useful information about each file — the file owner, the process that’s using it, and more. You can also use the lsof command to find a list of all the files currently in use by a single user — a quick way to see what someone’s up to.

When you combine the lsof command with grep, you can query your computer for a list of network services. It’s easy to find out what’s out there listening for processes — ssh, vnc, webmin, and so on. You can also use the combination of commands to generate a complete list of connections and servers to get a clear picture of the activity on your network.

The Ethereal Network Analyzer tool is included with most standard distributions, and it gives you a cozy place to watch network traffic. You can even colorize and filter network traffic to discover details about the specific information types you’re watching for. If too much surfing is going on and clogging network resources, Ethereal helps you to find this out. This tool also tells you who’s doing it.

This technique is about being a snoop. Snooping can be a bad thing, or a good thing. Snooping to get people in trouble isn’t nice, but snooping for a good cause can be useful. Use this technique wisely, and you can watch for bad guys in your system and network slowdowns that can be averted with a quiet word to a coworker.

Exploring Your Network with lsof

lsof is one of the most powerful tools in the Linux toolbox. lsof displays a list of all the files currently open on your computer. Browsing through the output from lsof gives you a clear picture of who’s logged in, what

248 Technique 36: Streamlining Your Network Surveillance

they’re running, and what resources they’re using. You can also see which background daemons are running and what resources they’re using.

Running lsof

To use lsof, open a terminal window and give yourself superuser privileges with the su- command. Enter the command lsof and press Enter.

You can run lsof without giving yourself superuser privileges. However, you can only view processes that you own, and you probably have to use the complete pathname when you invoke lsof (/usr/sbin/lsof).

Stretch your terminal window as wide as possible before running lsof. Line-wrapping in a narrow window makes the list hard to read.

If it’s not already installed on your system, you can add the lsof.version.rpm package from your distribution media. See Technique 17 for helpful hints about installing RPM packages.

The results from the lsof command appear, as shown in Figure 36-1.

• Figure 36-1: The list of open files.

Interpreting the lsof output

use. The columns, from left to right, display the following information:

Name of the program that’s using the file

Process ID

User name

File descriptor or usage type

File type

Device where the file is located

File size

Inode number

Complete pathname of the file

The column labeled FD displays either a file descriptor number or a usage type.

If you see a number (followed by a letter or two), that’s a file descriptor number. The number isn’t very useful except in three cases:

File descriptor number 0 is connected to the standard input stream for the process.

File descriptor number 1 is connected to the standard output stream.

File descriptor number 2 is where the program sends error messages.

File descriptors 0, 1, and 2 are usually connected to a terminal device (/dev/ttynn or /dev/ptynn) for interactive processes. If you see one of those descriptors connected to a file, you know that that stream has been redirected with a > or a <. If a descriptor is connected to a pipe, it’s connected to the standard input stream (or standard output stream) of another process with a pipe character |. If an output descriptor (descriptor 1 or 2) is connected to /dev/null, output sent to that stream is thrown away. If descriptor 0 is connected to /dev/ null, that process is reading from an empty file.

The output from lsof contains a wealth of information. Each line represents a file that’s currently in

The letters following the file descriptor number tell you how the process is using the file: