MTNL billing discrepancy - Linuxers

20 Apr 2009

...
  How do I find out what is being downloaded ? or what
program is the
 guilty one ? 
assuming you have one nic connected to the modem

tcpdump -vv -i eth0
will dump all packets passing thru eth0

-- 
Rgds
JTD
-- 

here's something seemingly interesting:

------------------

          Client-IP opium.local
          Client-Ethernet-Address 00:13:20:24:d3:9c (oui Unknown)
[|bootp]
10:35:02.283333 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto
UDP (17), length 576) mygateway1.ar7.bootps > opium.local.bootpc:
BOOTP/DHCP, Reply, length 548, xid
sharukh@opium:~$ tail -f tcpdump.log
10:34:10.736003 IP (tos 0x0, ttl 46, id 16613, offset 0, flags [DF],
proto TCP (6), length 638) tibet108.server4you.de.https >
opium.local.48013: P 587:1173(586) ack 1172 win 816 <nop,nop,timestamp
171741530 726567>
10:34:10.736050 IP (tos 0x0, ttl 64, id 62638, offset 0, flags [DF],
proto TCP (6), length 52) opium.local.48013 >
tibet108.server4you.de.https: ., cksum 0x5c6d (correct), 1172:1172(0)
ack 1173 win 414 <nop,nop,timestamp 727012 171741530>
10:34:51.595111 IP (tos 0x0, ttl 39, id 8288, offset 0, flags [DF],
proto TCP (6), length 638) 192.108.114.19.9001 > opium.local.56648: P
587:1173(586) ack 1172 win 214 <nop,nop,timestamp 515952536 725310>
10:34:51.595160 IP (tos 0x0, ttl 64, id 22722, offset 0, flags [DF],
proto TCP (6), length 52) opium.local.56648 > 192.108.114.19.9001: .,
cksum 0x82a5 (correct), 1172:1172(0) ack 1173 win 432 <nop,nop,timestamp
737226 515952536>
10:34:56.585063 arp who-has opium.local tell mygateway1.ar7
10:34:56.585086 arp reply opium.local is-at 00:13:20:24:d3:9c (oui
Unknown)
10:35:02.003708 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 328) opium.local.bootpc > mygateway1.ar7.bootps:
BOOTP/DHCP, Request from 00:13:20:24:d3:9c (oui Unknown), length 300,
xid 0x4d76d060, Flags [none] (0x0000)
          Client-IP opium.local
          Client-Ethernet-Address 00:13:20:24:d3:9c (oui Unknown)
[|bootp]
10:35:02.283333 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto
UDP (17), length 576) mygateway1.ar7.bootps > opium.local.bootpc:
BOOTP/DHCP, Reply, length 548, xid

---------------------------------

who/what is this <tibet108.server4you.de.https> 

regards,

Sharukh
-- 
Dr. Sharukh K. R. Pavri.  			Homoeopath, Linuxer.
 Honi soit qui mal y pense. [Evil to him who evil thinks.] -- Motto
            of the Order of the Garter (est. Edward III)

----- End forwarded message -----

-- 
Dr. Sharukh K R Pavri.  			Homoeopath, Linuxer.
  Experience is what you get when you didn't get what you wanted.