Etherape queries the IP address of the computer sending the information: 192.168.1.3. Through the network topology diagram and the IP address comparison table, the computer is quickly found. Later, it was found that the computer was aging and physically damaged. If the network card of the network machine is damaged, there will be a broadcast storm. Damaged network cards constantly send a large number of numerical packets to switches, resulting in a large number of useless numerical packets, resulting in a broadcast storm. Due to the broadcast storm caused by physical damage of network cards, it is difficult to eliminate the malfunction. Because the damaged network cards can generally access the Internet, we usually borrow management software to check the network numerical traffic to determine the location of the malfunction point. In addition, some of the more popular network viruses, such as Funlove, Shock Wave, RPC and so on, will be transmitted through the network immediately after the poisoning of an organic machine. The spread of network viruses will consume a large amount of network bandwidth, cause network congestion and broadcast storm. Broadcasting storm refers to the abnormal phenomenon that the number of broadcast frames on the network (due to being forwarded) increases sharply and affects the normal network communication. The criterion of broadcast storm is that a port receives n broadcast frames in a short time. Broadcast storm control allows ports to filter broadcast storms that occur on the network. When a switch finds a broadcast storm on a port, it automatically discards the broadcast frame to prevent the broadcast storm from further expanding.
Experience summary:
When a fault occurs, we should first understand the changes before the fault and establish a perfect network documentation. Including network wiring diagram, IP and MAC corresponding tables, etc. EtherApe will display network traffic in the form of images and lists. In essence, EtherApe is a network sniffer, which plays an irreplaceable role in assisting in monitoring network numerical transmission and eliminating network faults. EtherApe provides the following functions:
1. Automatically filter and transform useful information from the network;
2. Convert the intercepted data package into a format that is easy to identify.
3. Analyse the communication failure in the network environment.
4. Detecting communication bottlenecks in the network environment;
5. Detecting whether hackers are attacking the network system to prevent its intrusion;
6. Record the network process.
Through the analysis of network traffic, we can determine various problems existing in the network, such as bottleneck effect or performance degradation; through it, network administrators can easily determine which traffic belongs to a particular network protocol, which information provides valuable information for network administrators to judge network problems and optimize network performance. Interest. Another feature is to display network protocols and traffic in different colors according to your configuration, which is very intuitive and clear at a glance. If you find a broadcast storm or other network performance bottlenecks, you can use the EtherApe command to quickly find the IP address that is in trouble.
Sniffer technology is not a cutting-edge technology, but a basic subject in the field. The research of sniffer technology does not require too much low-level knowledge, it is not mysterious. In fact, some of our network managers and hardware networks are used for sniffer technology. But many computer software vendors have been keeping a secret of it. It is unwise to avoid this basic fact. Understanding and mastering it is the key.