Hamilton, David (TSG C&I) wrote:
> I am looking for a way of getting a machine to monitor traffic of a
> specific type between specific hosts, and when more than a certain
> threshold of TCP re-Transmissions occur in a specified period, have the
> machine shut down a cisco router interface via SNMP for a specific
> period of time, and then re-open it afterwards.
> I am not hugely fussed about platform choice, although I think I have a
> better chance of finding what I'm looking for on a linux platform.
> I am currently using ethereal to capture the data from the network, but
> can't find a way of getting it to automagically do anything with the
> data captured.
> None of the sniffers included in backtrack (http://iwhax.net) seem to
> support this kind of operation.
> Nice interface for configuration would be a bonus, but not a
I don't have an off-the-shelf solution for you, but you should be able
to script this in your favourite scripting language (mine starts with P).
In some hypothetically superior language that I'll call Python for the
sake of discussion (don't raise hell for the choice of language or its
supposed superiority) you will find Scapy to provide you with a
sniffer interface. And a snmp module of your choice to do the control
You will need to figure out how to find if there are retransmits, but if
you say that the bandwidth usage drops you might also be able to find
that from snmp on the router as well?
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!