TCPDUMP - How to

#### TCPDUMP ####    www.tcpdump.org 
Tcpdump is a utility used to capture and analyze packets on network interfaces. Details about these packets can either be displayed to the screen or they can be saved to a file
for later analysis. Tcpdump utilizes the libpcap library for packet capturing 

#sudo tcpdump -i any -c 5
#sudo tcpdump -i any
#sudo tcpdump -i any -c 5 -n   # -n : Shows IP Address and Port Number
#sudo tcpdump -i any -c 5 -n -S96 # -S96 : Specify the capture size of the packet 
#sudo tcpdump -i any -c 20 -n tcp and dst port 49952 -t 

#### DNS Traffic Example ####
#wget youtube.com     #DNS : Traffic is UDP 
#sudo tcpdump -i eth0 port 53 -n

### Save Capture to a File ### 
#sudo tcpdump -i any -w capture.pcap -v
#Limit upto 20 packets
#sudo tcpdump -i any -w capture.pcap -v -c 20

### Reading Capture File ###
#sudo tcpdump -n -r capture.pcap

### TCPDUMP Filters ### 
Only Host Specific Traffic [ SRC and DST ]
#sudo tcpdump -i eth1 -n host 10.0.0.3 -c 5 
#ping 10.0.0.3
#sudo tcpdump -i eth1 -n src host 10.0.0.3 -c 5 

Traffic Between the 2 IP Address
#sudo tcpdump -i eth1 -n host 10.0.0.1 and host 10.0.0.3 -c 5
#sudo tcpdump -i eth0 -n host 192.168.1.91 and port 80
#wget google.com  

### Port 80 and port 443 ###
#sudo tcpdump -i eth0 -n "host 192.168.1.191 and (port 80 and port 443)"

### Subnet Traffic ### 
#sudo tcpdump -i eth0 -n -c100 "src net 192.168.0.0/16 and not dst net 1968.0.0/16 and not dst net 10.0.0.0/8"

## Filters on MAC Address ###
#sudo tcpdump -i eth0 ether host -n -c 10 # -e [option] used to see the MAC Address
#sudo tcpdump -i eth0 ether host -n -c10 -e

## IP6 Traffic to view ##
#sudo tcpdump -i any ip6
#ping6 2000.2

## only packets with Syn and Play 
#sudo tcpdump -i any "tcp [tcp flags]" & tcp-syn!=0"
$nc 10.0.0.3 80
$nc 10.0.0.3 801
$nc 10.0.0.3 802

#sudo tcpdump -i any "tcp [tcp flags]" & tcp-rst!=0"
$nc 10.0.0.3 80
$nc 10.0.0.3 801
$nc 10.0.0.3 802

Details output with Verbose
$sudo tcpdump -i eth0 port 80 -c7 -XX
   wget www.google.com

$sudo tcpdump -i eth0 port 80 -c7 -A  # Ascii Data 
   wget www.google.com

$sudo tcpdump -i eth1 -c15 -vvv  # Display more verbosity 

### Time Difference Between Packets
$sudo tcpdump -i eth1 -c5 -q -t  # Time Difference between packets 
$sudo tcpdump -i eth1 -c5 -q -ttt

Openstack Cinder backend Flow !

Cloud Controllers will try to get Authorization via HTTP protocol from Storage Subsystems. The cloud controllers will use the cinder.conf - The information  below is an Example of StoreVirtual VSA Storage backend information. 

[tripleo_lefthand]
hplefthand_password=*******
hplefthand_username=*******
hplefthand_iscsi_chap_enabled=True
hplefthand_api_url=https://*.*.*.*:8081/lhos
hplefthand_debug=False
volume_driver=cinder.volume.drivers.san.hp.hp_lefthand_iscsi.HPLeftHandISCSIDriver
hplefthand_clustername=
volume_backend_name=tripleo_lefthand

NOTE: From the cloud controllers - we should be able to ping the storage subsystem. What we mention in the Cinder.conf file. In fact many storage subsystems will allow as to LOGIN with username/Password what we mention in the cinder.conf file for validation. 
Example: To login to the VSA Storage Cluster 
#ssh username@ -p 16022 

Once the Controllers are authorized to the Storage backend, the cloud controllers will initialize the Driver. In this case it would be LEFTHAND Driver for VSA 

The cloud computes (KVM, ESXi , XEN) all will establish the iscsi initiator ID via iSCSI/CHAP protocols. All the computes will register to Storage Subsystem with their hostname. The hostname will hold the CHAP ID and the Computes will have the same CHAP ID in the file - /etc/iscsi/initiatorname.iscsi
InitiatorName=iqn.1994-05.com.redhat:e52c4e5689c

Below are the screen shots of the storage subsystem

Quick Verification of Cinder volumes in openstack 

Example: 1 

On the Cloud Controller:

#volume Attach and Detach 

nova volume-attach Virtual_Machine

nova volume-detach Virtual_Machine

On the Cloud Compute Node: 

#dmesg -c 

#iscsiadm -m node -o show

Example: 2

On the Cloud Controller: 

glance image-list

cinder create --image-id ID --display_name=Bootable_Image 10

nova --debug boot --flavor Number --nic net-id=ID --block-device-mapping=Cinder_ID vda=:::0 VM_Name

on the Cloud Compute Node:

#dmesg -c 

#iscsiadm -m node -o show

Monitor TCPDUMP iSCSI TRAFFIC on Compute Node
tcpdump -i interface  port 3260
tcpdump -i any "src net *.*.*.*/24"
tcpdump -i interface "src net *.*.*.*/24"

NOTE: Interface - Will be dedicate Storage Interface e.g. vlan211 and iSCSI-Target ( iSCSI Port - 3260)