Curl with auth username / password

We can use curl even if it requires you to be logged in. Example

• curl 'https://api.pinnaclesports.com/v1/sports' -x 1.1.2.9:8888 -H "Authorization: Basic `echo -n 'user:password' | base64`"

• -x = Proxy to use
• -H = headers - we put the username and password in here

Curl to view a certificate

• curl -v https://www.google.com  

 View more certificate details:

• openssl s_client -showcerts -connect  www.google.com:443

If this isn't good enough fire up tcpdump and wireshark

connect to wireless

List networks:

• sudo iwlist scan


Connect to network:

• nmcli d wifi connect password  

To restart networking:

• sudo /etc/init.d/networking restart

Useful SO posts:

• http://askubuntu.com/questions/461825/connect-to-wifi-from-command-line

• http://askubuntu.com/questions/398581/is-there-a-terminal-command-to-verify-if-wifi-is-enabled

• http://askubuntu.com/questions/330026/configure-connect-wireless-network-through-the-command-line-in-ubuntu-12-04

Which process is using my port?

Find out which process is listening on port 6501:
  netstat -anpt | grep 6501

output: [num before python is process id]
tcp        0      0 127.0.1.1:6501          0.0.0.0:*               LISTEN      26541/python  

What process is using network bandwidth?

To find what is eating bandwidth:

sudo nethogs

or:
iftop

Network debugging

On target box:

• Check my IP from outside
• curl -s checkip.dyndns.org | sed -e 's/.*Current IP Address: //' -e 's/<.*$//'
• Check what interfaces exist on your box:
• ip addr
• Run a tcpdump 
• Also run tcpdump on any gateway between your boxes that you have access to 

On own box:

• Fire up netcat try to connect
• nc target_ip target_port

On all boxes:

• Run traceroute and follow the IPs. Do we go to a gateway that we shouldn't?
  • mtr  8.8.8.8
  • mtr
• See traffic routing rules for this box: 
• ip route show 
• ip addr
• netstat -ra
• Arping is like ping but lower down, corresponding to layer 2:
•  arping 192.168.1.1

Understanding tcpdump:

• Does the first part of the handshake get thru?
• Do we respond to the above handshake?
• Does it go thru the gateway (both ways)?

Other stuff to check on target box:

• Is iptables blocking it? 
• sudo iptables -L -n | grep 21 
• Is the process listening on that port?
• sudo netstat -tulpn | grep

Networks

host myserver.com
ping myserver.com
^ Host works and ping doesn't

Reason bad DNS server.
check /etc/resolv.conf for DNS server

run host myserver.com dns.server.that.actually.works

Culprit: Often NetworkManager

Launch network manager & restart it:
nm-connection-editor
sudo service network-manager restart

Tcpdump and Wireshark

tcpdump:

View text 'live':

This shows all traffic on interface eth0 going thru a port:

• sudo tcpdump -n -i eth0 port target_port

Example: Show text on port 8125: 

(-A -s 0 = show text so we can grep)

• sudo tcpdump -n  -i eth0 port 8125 -A -s 0

Example: Listen for PINGS on interface eth0:

• sudo tcpdump -n -i eth0 icmp and net 10.100.0.0/16

Wireshark (More detail in tcpdumps):

• sudo tcpdump -n -i vboxnet0 -s 0 -w the.dump tcp

( -i vboxnet0 = the virtual box interface try eth0 for your own box  - run $ ip addr )

Flags:

• S = SYN (sync)
• . = ACK
• P = data

(do network stuff)

wireshark the.dump 

How2 list ports and open files & Ports used by process

List of open files & ports used by process:

• lsof -n -P -p process_id
• lsof -i | grep process_name

List of open ports on the current machine

• netstat -a


Find process: mongodb & the port it has open:

• netstat -tapn | grep mongo

Firewall: see iptables

IP and route tracing

windows
my ip: ipconfig
how packets travel: tracert www.google.com

linux
my ip:  hostname -i
how packets travel: traceroute www.google.com / tracepath www.google.com
my network interfaces: ip addr show

block IP addresses etc: sudo iptables -L

tracing network trafic:
tcpdump -n -i eth1
(make network call on eth1 interface with above job running)

Then wget / curl