computer:2:know

network analysis - arp tools

 == EtherApe: tool to display network activity 

- install with apt install etherape

- run with "etherape -i eth0"

- or run with "etherape -f tcp" to see only tcp traffic

- there is a graphical interface or you can log it a file using command: "etherape -p -w output_file"

- stop etherape after number of packets: etherape -c 1000

- use it with pcap: "etherape -r input_file.pcap"

- get remote data using ssh: "etherape -r ssh://username@remote_host/"



== ARPwatch: tool to monitor arp activity

- install: apt get install arpwatch

- watch log file: "tail -f /var/log/arpwatch.log"







links:

- https://www.ip-insider.de/so-nutzen-sie-den-arp-cache-fuer-die-netzwerkdiagnose-a-c4ce2ba83d76eae190a0776208c01e11/

- https://www.ip-insider.de/troubleshooting-und-sicherheitsanalyse-im-netzwerk-a-cd1bbf617b71b76920894db7a09a00e7/

Computer and IT knowledge - things to know

network analysis - arp tools