Linux primer for networkers: Using the sniffer

01.05.2006

So what if these tests indicate that SSHD isn't running? It can be enabled for the session by manually running the program -- usually at /usr/sbin/sshd -- but you should instead ensure that the program starts up at system boot. To manually enable the SSHD requires editing run-level directories and the service file and is beyond the scope of this primer. Fortunately, many distributions (including Fedora Core) include a text-based menu-configuration program. With Fedora, simply type setup, select "System Services" and ensure that SSHD has an asterisk next to it. The machine will need to be rebooted.

Finally, go to a machine elsewhere on the network that the Linux machine has been configured to allow access from (via the /etc/hosts.allow file) ands open up an ssh connection. My personal favorite SSH client is PuTTY; it has a small footprint, is easy to install and is part of an ssh suite that lets you pick and choose what components you want to load.

Ideally, you should verify network connectivity from a machine not on the local subnet, as that tests the gateway configuration as well. You can also ping or run a trace (traceroute) to an off-subnet site to verify connectivity. If the test fails, examine the network settings via setup.

Load the packages

Having verified network connectivity, it's time to load packages. TCPdump is one of the oldest, best known and best performing packet sniffers available. True, it's only text-based, but when diagnosing network problems, sometimes less is much better. With TCPdump, you can rapidly filter on sniffs to whatever granularity is necessary with a few command-line options.