# Network analysis!

## airwalker

Hi!

I wonder if you could give me some advices how to map a network, and which system files I should read to gain information about this. For instance, I would like to know the primary and secondary DNS, which machines offering www-services, where mail is "treated" and so on...what kind of tools (ie. ping, dig etc...) is best to use to gather this information?

I would be glad for an answer!  :Smile: 

Cheers!

----------

## steel300

nmap and netcat are two tools that are invaluable to any network person. For a more visual mapping, cheops will visually map a subnet. All of the information you need can be gathered from nmap and netcat though. Ping and traceroute are also useful.

----------

## nharring

The tools mentioned in the first reply are great. I'm assuming from your post that you have access to at least one machine on the network, and want to see what it sees. Look at /etc/resolv.conf to see how it handles DNS, /etc/nsswitch.conf to see whether things like NIS are in the picture.

Check out the arp cache with arp -a. If you see only a very small number of arp entries expect that you're behind a router or firewall that's masq'ing the arp entries. If you know you're on a switch you can use some of Doug Songs tools like dsniff to throw the switch into a mode whereby it forwards more traffic to your port than it should, allowing you to sniff more than you normally can on a switched network.

Be careful with that last bit though, because some switches don't fail to open, they fail to close your port, or if they're buggy they fail to shut the whole damn switch down. Even if they fail "open" they can still mess a network up pretty bad, especially if its a network that would have a lot of broadcast traffic if it weren't for the switch.

Remember, the two watchwords in network mapping, illicit or consentual, are caution and common sense.

----------

## airwalker

Great replies! Thanks! 

It's what you call a "consentual" mapping/survey and yes I have access to machines on the net.  :Smile:  I just need to find out how its structure and some of the configuration.

Thanks again!  :Smile: 

----------

## vcihon

Does anyone know if there is an ebuild for cheops?  I was going to RPM it but it lists a whole host of dependencies.  . .

----------

## airwalker

Follow up: Could someone please give me a list of the most important aspects/services etc. to include when mapping a network? For instance

DNS, printers, disk space and so on...  :Smile: 

----------

## tSp

 *vcihon wrote:*   

> Does anyone know if there is an ebuild for cheops?  I was going to RPM it but it lists a whole host of dependencies.  . .

 

# Copyright 1999-2003 Gentoo Technologies, Inc.

 # Distributed under the terms of the GNU General Public License v2

 # $Header: $

 # Short one-line description of this package.

 DESCRIPTION="Cheops-ng is a Network management tool for mapping and monitoring your network."

 HOMEPAGE="http://cheops-ng.sourceforge.net/"

 # Portage.

 SRC_URI="http://easynews.dl.sourceforge.net/sourceforge/cheops-ng/cheops-ng-0.1.12.tgz"

 LICENSE="GPL2"

 SLOT="0"

 # compatibility reasons.

 KEYWORDS="~x86"

 # ebuild doesn't use any USE flags, set to "".

 IUSE="X gnome"

 # other users hopefully won't be caught without the right version of

 # a dependency.

 DEPEND=">=gnome-base/gnome-libs-1.4.2

 >=dev-libs/libxml-1.8.17-r2

 >=x11-libs/gtk+-1.2.10-r10

 >=net-analyzer/nmap-3.27-r1

 >=media-libs/imlib-1.9.14-r1

 >=dev-libs/glib-1.2.10-r5"

 # Run-time dependencies, same as DEPEND if RDEPEND isn't defined:

 #RDEPEND=""

 S=${WORKDIR}/${P}

 src_compile() {

 # process should abort if they aren't successful.)

 ./configure \

#--host=${CHOST} \

#--prefix=/usr \

#--infodir=/usr/share/info \

#--mandir=/usr/share/man || die "./configure failed"

 # Cheops-ng uses adns included on its source.

 cd adns-1.0; ./configure || die "./configure failed"

 #

 # econf || die

 # Note that econf will die on failure, but plase use econf || die

 # for consistency.

 # not work for some packages, in which case you'll have to resort

 # to normal "make".

 cd ../

# emake || die

 make || die

 }

 src_install() {

 # understanding the install part of the Makefiles.

 make DESTDIR=${D} install || die

 # you also need to specify mandir and infodir, since they were

 # passed to ./configure as absolute paths (overriding the prefix

 # setting).

# make \

# prefix=${D}/usr \

# mandir=${D}/usr/share/man \

# infodir=${D}/usr/share/info \

 install || die

 # Again, verify the Makefiles! We don't want anything falling

 # outside of ${D}.

 # Note that einstall will die on failure, but please use einstall || die

 # for consistency.

 }

----------

## tutaepaki

A new ebuild for cheops-ng, including a patch for the gpl.c problem..

```

# Copyright 1999-2003 Gentoo Technologies, Inc.

# Distributed under the terms of the GNU General Public License v2

# $Header: $

inherit eutils

DESCRIPTION="Cheops-ng  is a Network management tool for mapping and monitoring your network."

HOMEPAGE="http://cheops-ng.sourceforge.net/"

SRC_URI="http://flow.dl.sourceforge.net/sourceforge/cheops-ng/${P}.tgz"

LICENSE="GPL-2"

SLOT="0"

KEYWORDS="~x86"

IUSE="X gnome"

DEPEND=">=gnome-base/gnome-libs-1.4.2 

        >=dev-libs/libxml-1.8.17-r2

       >=x11-libs/gtk+-1.2.10-r10

       >=net-analyzer/nmap-3.27-r1

      >=media-libs/imlib-1.9.14-r1

      >=dev-libs/glib-1.2.10-r5"

src_unpack() {

      unpack ${A}

      cd ${S}

      epatch ${FILESDIR}/${P}-gpl.patch

}

src_compile() {

   econf || die

    # Cheops-ng uses adns included on its source.

   cd adns-1.0

   econf || die

   cd ../

   emake || die

}

src_install() {

   einstall || die

}

```

```

--- Makefile.in-ORIG   2004-05-04 13:48:54.000000000 +1200

+++ Makefile.in   2004-05-04 14:07:06.000000000 +1200

@@ -140,7 +140,7 @@

    $(CC) $(CFLAGS) -c event.c -o gui-event.o $(GTKCFLAGS) -DCOMPILING_GUI

 

 gpl.c: COPYING

-   ( echo "char *gpl_text = \"" ; cat COPYING | sed s/\\\"/\\\\\"/g; echo "\";" ) >gpl.c

+   ( echo "char *gpl_text = \"\\n\"" ; cat COPYING | sed 's/"/\\"/g;s/^/"/;s/$$/\\n"/'; echo ";" ) >gpl.c

 

 agent-io.o: io.c

    $(CC) $(CFLAGS) -c io.c -o agent-io.o $(CC_LIBS)

```

----------

## vcihon

This might be dumb but do I just copy the code, put it in an cheop-ng.ebuild file and then emerge it?

----------

## Dracnor

Yes copy that code and patch to files and name it the version of cheops you want to install (you can bump the version up as they newer ones are released.)  The patch will go in the files directory.  And cheops will be in wherever you have PORTDIR_OVERLAY set to (e.g. /usr/local/portage/).  Then you can ebuild cheop-ng_ver.ebuild digest, and emerge cheops-ng.

----------

## vcihon

ok - I want to be clear.

I put the first code in a /usr/local/portagecheops-ng-0.1.12.ebuild.

What do I name the patch code and what do you mean by putting it in the files directory?

Thanks.

----------

## cdeberry

ok- here's what i did

copy ebuild text into

/usr/portage/net-analyzer/cheops-ng/cheops-ng-0.1.12.ebuild

copy patch text tino

/usr/portage/net-analyzer/cheops-ng/files/cheops-ng-0.1.12.patch

run

ebuild ./cheops-ng-0.1.12.ebuild digest

>>> Generating digest file...

<<< cheops-ng-0.1.12.tgz

>>> Generating manifest file...

<<< cheops-ng-0.1.12.ebuild

<<< files/cheops-ng-0.1.12.patch

<<< files/digest-cheops-ng-0.1.12

>>> Computed message digests.

yay-

now, 

ACCEPT_KEYWORDS='~x86' emerge cheops-ng

Calculating dependencies ...done!

>>> emerge (1 of 1) net-analyzer/cheops-ng-0.1.12 to /

>>> md5 src_uri  :Wink:  cheops-ng-0.1.12.tgz

>>> Unpacking source...

>>> Unpacking cheops-ng-0.1.12.tgz to /var/tmp/portage/cheops-ng-0.1.12/work

 * Cannot find $EPATCH_SOURCE!  Value for $EPATCH_SOURCE is:

 * 

 *   /usr/portage/net-analyzer/cheops-ng/files/cheops-ng-0.1.12-gpl.patch

!!! ERROR: net-analyzer/cheops-ng-0.1.12 failed.

!!! Function epatch, Line 182, Exitcode 0

!!! Cannot find $EPATCH_SOURCE!

Am I naming the patch file incorrectly?

----------

## Nekkrist

```
epatch ${FILESDIR}/${P}-gpl.patch
```

This means that the patch will appear in the files directory of the package, and will be named the same thing as the ebuild (package name and version) but with -gpl.patch on the end.  So if the ebuild was cheops-1.1.ebuild then you would have, in the files/ directory, cheops-1.1-gpl.patch.

Then it ought to work.

----------

## MacFennec

$ cat /var/tmp/portage/cheops-ng-0.1.12/temp/cheops-ng-0.1.12-gpl.patch-14513.out

```
***** cheops-ng-0.1.12-gpl.patch *****

 

======================================

 

PATCH COMMAND:  patch -p0 -g0 < /usr/portage/net-analyzer/cheops-ng/files/cheops-ng-0.1.12-gpl.patch

 

======================================

patching file Makefile.in

Hunk #1 FAILED at 140.

1 out of 1 hunk FAILED -- saving rejects to file Makefile.in.rej

======================================

 

PATCH COMMAND:  patch -p1 -g0 < /usr/portage/net-analyzer/cheops-ng/files/cheops-ng-0.1.12-gpl.patch

 

======================================

missing header for unified diff at line 3 of patch

can't find file to patch at input line 3

Perhaps you used the wrong -p or --strip option?

The text leading up to this was:

--------------------------

|--- Makefile.in-ORIG   2004-05-04 13:48:54.000000000 +1200

|+++ Makefile.in   2004-05-04 14:07:06.000000000 +1200

--------------------------

No file to patch.  Skipping patch.

1 out of 1 hunk ignored

======================================

 

PATCH COMMAND:  patch -p2 -g0 < /usr/portage/net-analyzer/cheops-ng/files/cheops-ng-0.1.12-gpl.patch

 

======================================

missing header for unified diff at line 3 of patch

can't find file to patch at input line 3

Perhaps you used the wrong -p or --strip option?

The text leading up to this was:

--------------------------

|--- Makefile.in-ORIG   2004-05-04 13:48:54.000000000 +1200

|+++ Makefile.in   2004-05-04 14:07:06.000000000 +1200

--------------------------

No file to patch.  Skipping patch.

1 out of 1 hunk ignored

======================================

 

PATCH COMMAND:  patch -p3 -g0 < /usr/portage/net-analyzer/cheops-ng/files/cheops-ng-0.1.12-gpl.patch

 

======================================

missing header for unified diff at line 3 of patch

can't find file to patch at input line 3

Perhaps you used the wrong -p or --strip option?

The text leading up to this was:

--------------------------

|--- Makefile.in-ORIG   2004-05-04 13:48:54.000000000 +1200

|+++ Makefile.in   2004-05-04 14:07:06.000000000 +1200

--------------------------

No file to patch.  Skipping patch.

1 out of 1 hunk ignored

======================================

 

PATCH COMMAND:  patch -p4 -g0 < /usr/portage/net-analyzer/cheops-ng/files/cheops-ng-0.1.12-gpl.patch

 

======================================

missing header for unified diff at line 3 of patch

can't find file to patch at input line 3

Perhaps you used the wrong -p or --strip option?

The text leading up to this was:

--------------------------

|--- Makefile.in-ORIG   2004-05-04 13:48:54.000000000 +1200

|+++ Makefile.in   2004-05-04 14:07:06.000000000 +1200

--------------------------

No file to patch.  Skipping patch.

1 out of 1 hunk ignored

```

I have the same error, I'don't understand that   :Crying or Very sad: 

----------

## MacFennec

The patch don't apply. So, I have copy the Makefiles.in and  patched  manualy. I put this in $FILESDIR

I have modify the ebuild like that:

```
src_unpack() {

      unpack ${A}

      cd ${S}

      # epatch ${WORKDIR}/${P}-gpl.patch

      cp ${FILESDIR}/Makefile.in  ${WORKDIR}/${P}/Makefile.in

```

and it work.

They are certainly a  more easy methode.  :Embarassed: 

----------

## abuthemagician

anyone have this working still? i really want to use it....

----------

## tSp

unfortunately, I never could get either ebuild to work, and I even tried to manually replace the lines from the Makefile.in from the patch file without success........but these steps will work.....originally from here

https://forums.gentoo.org/viewtopic.php?t=151256&highlight=cheopsng

Here is how to manually install: basically, copy the source file to a temp directory, extract it there, cd to the directory containing the source, run ./configure, edit the gpl.c file, run ./configure && make && make install 

cd /usr/portage/distfiles

cp cheops-ng*.tgz /tmp

cd /tmp

tar xzfv cheops-ng*.tgz

cd cheops-ng*

./configure

make

edit the gpl.c file with your editor of choice so that it only contains the line:

char *gpl_text = "";

next do the normal make install  

here is a copy of my text from terminal with the above steps:

xx cheops-ng-0.1.12 # make

gcc -o cheops-ng logger.o misc.o cerror.o cache.o script.o cheops-gui.o gui-handlers.o gui-viewspace.o gui-settings.o gui-canvas.o gui-utils.o gui-config.o ip_utils.o cheops-osscan.o gui-dns.o gui-service.o gui-pixmap.o gui-monitoring.o cheops-monitoring.o gui-io.o gui-sched.o gui-event.o gui-help.o gpl.c  `gnome-config  --libs gnome gnomeui glib` -lnsl -lpthread -lncurses -lpthread -lssl -lcrypto -lSM -lICE -L/usr/lib -L/usr/X11R6/lib -lgtk -lgdk -rdynamic -lgmodule -lglib -ldl -lXi -lXext -lX11 -lm -rdynamic -L/usr/lib -L/usr/X11R6/lib  -rdynamic -lgnomeui -lart_lgpl -lgdk_imlib -lSM -lICE -lgtk -lgdk -lgmodule -ldl -lXi -lXext -lX11 -lgnome -lgnomesupport -lesd -laudiofile -lm -ldb1 -lglib -L/usr/lib -L/usr/X11R6/lib -lgtk -lgdk -rdynamic -lgmodule -lglib -ldl -lXi -lXext -lX11 -lm -L/usr/lib -lglib -L/usr/lib -lImlib -ljpeg -ltiff -lungif -lpng -lz -lm -lXext -L/usr/X11R6/lib -lSM -lICE -lXext -lX11 -L/usr/lib -lxml -lz -lcrypt  ./adns-1.0/src/libadns.a

xx cheops-ng-0.1.12 # make install

mkdir -p /usr/local/share/cheops-ng/pixmaps

/bin/install -c -d /usr/local/share/cheops-ng

/bin/install -c -d /usr/local/bin

/bin/install -c -d /usr/local/share/pixmaps

/bin/install -c pixmaps/*.xpm /usr/local/share/cheops-ng/pixmaps

/bin/install -c pixmaps/cheops-ng.xpm /usr/local/share/pixmaps

/bin/install -c -s -m 755 -o root -g root cheops-agent /usr/local/bin

/bin/install -c -s -m 755 -o root -g root cheops-ng /usr/local/bin

/bin/install -c -d /usr/local/share/gnome/apps/Internet

/bin/install -c -d /usr/local/share/gnome/ximian/Programs/Internet

/bin/install -c cheops-ng.desktop /usr/local/share/gnome/apps/Internet

/bin/install -c cheops-ng.desktop /usr/local/share/gnome/ximian/Programs/Internet

xx cheops-ng-0.1.12 # which cheops-ng

/usr/local/bin/cheops-ng

----------

## abuthemagician

and this will install the deps as well?

----------

## tSp

 *abuthemagician wrote:*   

> and this will install the deps as well?

 

the configure command will error if you do not have the correct dependencies.  

If you have gnome installed, you likely have all the correct dependancies but you could manually check you have dependancies like this (ignore everything starting at the "<--"):

emerge -s gnome-base/gnome-libs  <-- must be equal or greater than 1.4.2

emerge -s dev-libs/libxml   <-- must be equal or greater than 1.8.17-r2

emerge -s x11-libs/gtk+  <-- must be equal or greater than 1.2.10-r10

emerge -s net-analyzer/nmap   <-- must be equal or greater than 3.27-r1

emerge -s media-libs/imlib  <-- must be equal or greater than 1.9.14-r1

emerge -s dev-libs/glib   <-- must be equal or greater than 1.2.10-r5

Granted, the way I install this is not the 'best' way or the 'cleanest' way, but it works.  I don't have a clue why the patch file does not work....I've looked over the area of the Makefile.in that is affected, and the line numbers are correct.  The steps that I have used have worked for some time.  The gpl.c file erros are the same you will get on other distributions, so I find it hard to believe that nobody has complained.

----------

## abuthemagician

what if the gpl.c file is not there to edit?

----------

## tSp

 *abuthemagician wrote:*   

> what if the gpl.c file is not there to edit?

 

I edited my instructions to fix that....run ./configure && make then start with the edit the gpl.c file

because I am getting ready to go to a funeral and was spending my time here to keep my mind off things.....

 All you have to do to start cheops-ng is (after installing):

       cheops-agent &

       cheops-ng

----------

## abuthemagician

ahhhh.... don't i feel stupid

----------

## abuthemagician

got it installed

----------

## tSp

 *abuthemagician wrote:*   

> ahhhh.... don't i feel stupid

 

actually, all your questions helped me figure out why the patch fails....so don't feel as stupid as I do right now, realizing that the patch code in the ebuild has to come after the ./configure and make functions.......I'm working on the ebuild still, but with the funeral and stuff going on, its mostly just to help me pass time.  I'll get it up and working in a few days though.

----------

## abuthemagician

funerals are always no fun... anyway, glad i could help jog your memory, i was trying to figure out the patch but i am quite a n00b with linux and coding

----------

## mauricec

I applied the patch the cruel way .... 

ACCEPT_KEYWORDS="~x86" emerge cheops-ng

When it says source unpacked.... i press CTL-z

apply the patch by hand, then type fg

My machine is not that fast ( PIII800 )...

----------

