[ILUG] [Possibly OT] Network Traffic Analysis and Interface Control

[Baruch Even]

Hamilton, David (TSG C&I) wrote:
> I am looking for a way of getting a machine to monitor traffic of a
> specific type between specific hosts, and when more than a certain
> threshold of TCP re-Transmissions occur in a specified period, have the
> machine shut down a cisco router interface via SNMP for a specific
> period of time, and then re-open it afterwards.
> I am not hugely fussed about platform choice, although I think I have a
> better chance of finding what I'm looking for on a linux platform.
> I am currently using ethereal to capture the data from the network, but
> can't find a way of getting it to automagically do anything with the
> data captured.
> None of the sniffers included in backtrack (http://iwhax.net) seem to
> support this kind of operation.
> Nice interface for configuration would be a bonus, but not a
> requirement.

I don't have an off-the-shelf solution for you, but you should be able
to script this in your favourite scripting language (mine starts with P).

In some hypothetically superior language that I'll call Python for the
sake of discussion (don't raise hell for the choice of language or its
supposed superiority) you will find Scapy[1] to provide you with a
sniffer interface. And a snmp[2] module of your choice to do the control
part.

You will need to figure out how to find if there are retransmits, but if
you say that the bandwidth usage drops you might also be able to find
that from snmp on the router as well?

Baruch

[1] http://freshmeat.net/projects/scapy/
[2]
http://www.python.org/pypi?%3Aaction=search&name=snmp&version=&summary=&description=&keywords=&_pypi_hidden=0