Hardware used in my test CPU: E3-1231 v3 CPU SPECS: 4 Core, 8 Threads – 3.40GHz Memory: 32 GB Storage: 4 x 240 GB SSD Force 3 Raid adapter: 3Ware 9750 Let’s beginning with os tuning. We will tweak sysctl.conf. # # file: ‘/etc/sysctl.conf’ # vm.swappiness = 0 vm.max_map_count = 262144 net.ipv4.tcp_wmem = 4096 65536
By default on Debian is used 8169 driver instead of 8168 (Realtek ethernet driver). Also, 8168 driver does not exist. ~# find /lib/modules/`uname -r`/kernel/drivers/net/ethernet/ -name *816* /lib/modules/3.16.0-4-amd64/kernel/drivers/net/ethernet/realtek/r8169.ko The network device ~# lspci |grep Ether 03:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 09) The loaded driver ~# lsmod |grep
Stop using locate on command line interface. – locate uses a prebuilt database and can be updated only by root – locate will fail to name files that were created since the last database update – locate is insecure – locate is not flexible. Start using find. ‘man find’ is a great place to start.
There are many tools for network monitoring but you can do this with a simple bash script. #!/bin/bash time=”1″ # one second int=”eth0″ # network interface while true do txpkts_old=”`cat /sys/class/net/$int/statistics/tx_packets`” # sent packets rxpkts_old=”`cat /sys/class/net/$int/statistics/rx_packets`” # recv packets sleep $time txpkts_new=”`cat /sys/class/net/$int/statistics/tx_packets`” # sent packets rxpkts_new=”`cat /sys/class/net/$int/statistics/rx_packets`” # recv packets txpkts=”`expr $txpkts_new – $txpkts_old`”
For all commands, you will need root permissions. Use it from root or with sudo. Show all packets with URG flag: tcpdump ‘tcp[13] & 32 != 0’ Show all packets with ACK flag: tcpdump ‘tcp[13] & 16 != 0’ Show all packets with PSH flag: tcpdump ‘tcp[13] & 8 != 0’ Show all packets with