Re: [SQU] Using tcpdump or snoop to track down traffic

At 10:19 12/10/00 -0500, Karl Jones wrote:
> When I telnet to a specific site using port 9000 they
> can snoop and see the activity however when I use their
> website via my browser (IE5.0), they see no traffic.
> Thousands others use the site without problem so it must
> somehow be us. They recommend using snoop at my end to
> see what's happening. I am on SCO and have gotten ahold
> of tcpdump but from the README it seems like I need to
> set up the system to have a dedicated network card to
> analyze traffic. Am I missing something? Isn't there
> some easier way to use my 99.99% working system and
> check on why this traffic is getting stopped?

I've never used tcpdump under SCO but under Linux it works fine with the
standard ethernet interface - it just slows down the packet latency
somewhat. Have you tried typing 'tcpdump' and seeing what happens?

Alternatively, you could build a Linux system on an old PC and run tcpdump
on that - any distro would do, you only need to install the basic OS. Any
old 386 or 486 PC with 8Mb, about 100Mb of disk and a network card will do
fine. This means you won't be introducing a performance penalty on the
'real' server. Email me directly if you need help about specific distros.

HTH, Paul

Paul Sherwin Consulting 22 Monmouth Road, Oxford OX1 4TD, UK
Phone +44 (0)1865 721438 http://www.psherwin.strayduck.com
Mobile +44 (0)7931 578334 mailto:psherwin@strayduck.com
Pager +44 (0)7666 797228

--
To unsubscribe, see http://www.squid-cache.org/mailing-lists.html