Networking

Subnet to Mask Bits conversion table
Mask CIDR Length (Mask Bits)
128.0.0.0 1
192.0.0.0 2
224.0.0.0 3
240.0.0.0 4
248.0.0.0 5
252.0.0.0 6
254.0.0.0 7
255.0.0.0 8
255.128.0.0 9
255.192.0.0 10
255.224.0.0 11
255.240.0.0 12
255.248.0.0 13
255.252.0.0 14
255.254.0.0 15
255.255.0.0 16
255.255.128.0 17
255.255.192.0 18
255.255.224.0 19
255.255.240.0 20
255.255.248.0 21
255.255.252.0 22
255.255.254.0 23
255.255.255.0 24
255.255.255.128 25
255.255.255.192 26
255.255.255.224 27
255.255.255.240 28
255.255.255.248 29
255.255.255.252 30
255.255.255.254 31
255.255.255.255 32

How to tell the network speed of network cards in Linux?

CentOS 7

Find the network cards:

ip addr

1: lo:  mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens160:  mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:0c:29:d5:dc:4a brd ff:ff:ff:ff:ff:ff
    inet 216.55.xxx.xxx/24 brd 216.55.169.255 scope global ens160
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fed5:dc4a/64 scope link
       valid_lft forever preferred_lft forever
3: ens192:  mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:0c:29:d5:dc:54 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.101/24 brd 192.168.1.255 scope global ens192
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fed5:dc54/64 scope link
       valid_lft forever preferred_lft forever

Ethtool

# ethtool ens160
Settings for ens160:
        Supported ports: [ TP ]
        Supported link modes:   1000baseT/Full
                                10000baseT/Full
        Supported pause frame use: No
        Supports auto-negotiation: No
        Advertised link modes:  Not reported
        Advertised pause frame use: No
        Advertised auto-negotiation: No
        Speed: 10000Mb/s
        Duplex: Full
        Port: Twisted Pair
        PHYAD: 0
        Transceiver: internal
        Auto-negotiation: off
        MDI-X: Unknown
        Supports Wake-on: uag
        Wake-on: d
        Link detected: yes

# ethtool ens160 | grep Speed
        Speed: 10000Mb/s

Script:

for i in $(netstat -i | cut -f1 -d" " | tail -n+3) ; do echo "$i: $(ethtool "$i" | grep Speed | sed 's/Speed://g')" ; done

cat /sys/class/net//speed

# cat /sys/class/net/ens160/speed
10000

Above would be in MB.

DMESG

# dmesg |grep eth0
[0.932304] vmxnet3 0000:03:00.0 eth0: NIC Link is Up 10000 Mbps

what is the use of /etc/udev/rules.d/70-persistent-net.rules file in linux? is anyother way to change interface name in linux other than 70-persistent-net.rules?

This file associates your NIC’s MAC address with an interface name that will be given to the NIC at startup. There are certainly ways to change the name at runtime but if you reboot, it’s gonna be the contents of that file that count.

Additionally, you can use it for renaming the interfaces

The ‘neighbor table overflow’ is a VERY common linux issue on large networks. Some network trigger this with default linux settings (because the previous network regime put so many IP address subnets on a single vlan , it creates large ARP tables – which is not normal / default settings). It is not an indication of anything wrong. It is a trigger of linux default.

Here is how to adjust:
If you see this….

__ratelimit: 20 callbacks suppressed
Neighbour table overflow.

For busy networks increase the kernel’s internal ARP cache size. The following kernel variables are used:

net.ipv4.neigh.default.gc_thresh1
net.ipv4.neigh.default.gc_thresh2
net.ipv4.neigh.default.gc_thresh3
To see current values, type:

Run this…

# sysctl net.ipv4.neigh.default.gc_thresh1
net.ipv4.neigh.default.gc_thresh1 = 128

# sysctl net.ipv4.neigh.default.gc_thresh2
net.ipv4.neigh.default.gc_thresh2 = 512

# sysctl net.ipv4.neigh.default.gc_thresh3
net.ipv4.neigh.default.gc_thresh3 = 1024

You need to make sure that the arp table to become bigger than the above defaults. The above limitations are good for small network or a single server. This will also affect your DNS traffic.

How Do I Fix “Neighbour Table Overflow” Error?

# vi /etc/sysctl.conf

Append the following:

 ## works best with <= 500 client computers ##
# Force gc to clean-up quickly
net.ipv4.neigh.default.gc_interval = 3600
 
# Set ARP cache entry timeout
net.ipv4.neigh.default.gc_stale_time = 3600
 
# Setup DNS threshold for arp
net.ipv4.neigh.default.gc_thresh3 = 4096
net.ipv4.neigh.default.gc_thresh2 = 2048
net.ipv4.neigh.default.gc_thresh1 = 1024
 

To load new changes type the following command:

# sysctl -p

Add the IP as Eth0 when the primary is Eth1 (no gateway)

# nano /etc/network/interfaces

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
address 10.168.19.36
netmask 255.255.255.224
hwaddress 0C:C4:7A:6A:0F:E4

auto eth1
iface eth1 inet static
address 206.xxx.xx.xx
netmask 255.255.255.0
gateway 206.xxx.xx.1
hwaddress 0C:C4:7A:6A:0F:E5
dns-nameservers 8.8.8.8 4.4.4.4

See if ports are open

nmap -T4 -Pn -p 21,22,25,80,110,143,443,3389 $SERVER_IP

Do you think 1 Megabit per second (1 Mbps) will allow you to download a 1 Megabyte file in one second?

This is not the case. A Megabit is 1/8 as big as a Megabyte.

1 Megabyte = 8 Megabits
Mbps = Megbits per second
MBps = MegBytes per second
Internet speed is usually measured in megabits per second

So, to download a 1MB file in 1 second you would need a connection of 8Mbps ( 8 Megbits per second). The difference between a Gigabyte (GB) and a Gigabit (Gb) is the same, with a Gigabyte being 8 times larger than a Gigabit.

To calculate how long it will take a file to download over your connection, you can use Google’s simple MB/Mb converter:

https://www.google.com/search?q=megabyte+megabit+converter

Useful commands to check if a server is getting ddos’d

Show IPs with more than 10 connections open:

# netstat -nat | grep ":80" | awk -F: '{print $8}' | sort | uniq -c | sort -n | awk '{ if ( $1 > 10) print $2 ; }'

Show # of connections open per IP

# netstat -nat | egrep ":80|:443" | awk -F: '{print $8}' | sort | uniq -c | sort -n 

Number of connections per IP

# netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

Haynie’s version(better sorting):

# netstat -anp|awk '{print $5}'|awk -F: '{print $4}'|sort -n -t. -k1,1 -k2,2 -k3,3 -k4,4|uniq -c|sort -n

Drop ips with 100 or more connections:

# netstat -nat | egrep ":80|:443" | awk -F: '{print $8}' | sort | uniq -c | sort -n | awk '{ if ( $1 > 100) print $2 ; }' | xargs -n1 echo iptables -I INPUT -j DROP -s

Graphic netstat connections(# of connections open per host)

# netstat -an | grep ESTABLISHED | awk '{print $5}' | awk -F: '{print $1}' | sort | uniq -c | awk '{ printf("%s\t%s\t",$2,$1) ; for (i = 0; i < $1; i++) {printf("*")}; print "" }'