Underused Tools

There are a lot of tools for administration and networking that generally go unused. They are very helpful in both diagnostics and general administration. There are even some tools that come installed with linux and go unused and unheard of. Here I am going to cover a mere few of my favorite and hope that they work for you as well.

1. traceproto
   The first tool I want to cover is one of my favorite tools when writing firewall scripts and is a close relative of traceroute; it’s called traceproto. traceproto doesn’t come installed by default on most linux systems. It is a replacement (or even just a complement) for traceroute that goes the extra mile. Like traceroute, you can change ports and ttl (time to live) on your queries. But the extra mile appears where you can specify whether to use tcp, udp, or icmp when you specify the ports. You can also specify the source port of the network traffic.
   The way that I make best use this tool is when I am writing firewall scripts. For instance, when I allow ntp through on a firewall, it can sometimes be difficult to test if my firewall rules are letting the packets through (since I have multiple levels of firewalls). Therefore, I use traceproto as follows (ntp is on udp port 123):

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

   root@tivo:~# traceproto -d 53 -p udp ns1.myserver.com traceproto: trace to ns1.myserver.com (1.2.3.4), port 53 ttl  1:  ICMP Time Exceeded from 192.168.1.1 (192.168.1.1)         0.83300 ms      0.67900 ms      0.71300 ms ttl  2:  ICMP Time Exceeded from 10.75.128.1 (10.75.128.1)         11.577 ms       6.1550 ms       6.4960 ms ... Removed for brevity ... ttl  11:no response     no response     no response ttl  12:  UDP from myserver.com (1.2.3.4)         132.07 ms       126.28 ms       125.88 ms hop :  min   /  ave   /  max   :  # packets  :  # lost -------------------------------------------------------   1 : 0.67900 / 0.74167 / 0.83300 :   3 packets :   0 lost   2 : 6.1550 / 8.0760 / 11.577 :   3 packets :   0 lost   3 : 5.9680 / 7.0697 / 7.6650 :   3 packets :   0 lost   4 : 0.0000 / 0.0000 / 0.0000 :   0 packets :   3 lost   5 : 0.0000 / 0.0000 / 0.0000 :   0 packets :   3 lost   6 : 8.8930 / 12.198 / 15.810 :   3 packets :   0 lost   7 : 0.0000 / 0.0000 / 0.0000 :   0 packets :   3 lost   8 : 9.2340 / 24.556 / 32.438 :   3 packets :   0 lost   9 : 9.8230 / 13.669 / 18.890 :   3 packets :   0 lost  10 : 0.0000 / 0.0000 / 0.0000 :   0 packets :   3 lost  11 : 0.0000 / 0.0000 / 0.0000 :   0 packets :   3 lost  12 : 125.88 / 128.08 / 132.07 :   3 packets :   0 lost ------------------------Total-------------------------- total 125.88 / 22.834 / 132.07 :  21 packets :  15 lost

2. pstree, pgrep, pidof
   Although these are 3 separate tools, they are all very handy for process discovery in their own right.

   To take advantage of of the pidof command, you just need to figure out which program you want to know about its family (parent and children). 2 ways to demonstrate this would be to use either kthread or apache2 as follows:

   1 2 3 4

   # pidof apache2 29297 29291 29290 29289 29245 29223 29222 29221 20441 # pidof kthread 6

   By typing pstree, you will see exactly what it is capable of. pstree outputs an ASCII graphic of the process list by separating it into parents and children. By adding the -u option to pstree, you can see if your daemons made their uid transitions. This is also an extremely useful program for displaying SELinux context of each process (by using the -Z option if pstree was built with it). To see the children of kthread which we found above was pid 6, we can use these commands in conjunction.

   1 2 3 4 5 6 7 8 9 10

   # pstree `pidof kthread` kthread-+-aio/0         |-kacpid         |-kblockd/0         |-kgameportd         |-khubd         |-kmirrord         |-kpsmoused         |-kseriod         `-2*[pdflush]

   And finally pgrep. There are many ways to make use of pgrep. It can be used like pidof:

   1 2	# pgrep -l named 18935 named

   We can also list all processes that are being run that aren’t being controlled by controlling port 1 (pts/1):

   1 2 3 4 5 6 7 8 9 10 11 12

   # pgrep -l -t pts/1 -v 1 init 2 ksoftirqd/0 3 watchdog/0 4 events/0 ... Removed for brevity ... 10665 getty 18975 named 19009 qmgr 25447 sshd 25448 bash 29221 apache2

3. tee
   There are sometimes commands that can take a long time to run. You want to see the output, but you also want to save it for later. How can we do that. We can use the tee command. This sends the output to STDOUT and send (or append) to a filehandle. For simplicity, I will show you an example of tee using an df.

   1	df -h | tee -a snap_shot

4. tac
   Everyone knows about cat, it’s what we use to list the entire contents of a file. cat has a little known cousin that is usually installed by default on a system called tac. It prints the entire contents of a file in reverse.
5. fuser
   fuser displays the process id of all processes using the specified file or file system. This has many handy uses. If you are trying to unmount a partition and want to know why its still busy, then run fuser on the filesystem and find out which processes are still using the device. fuser is even nice enough to tell you what kind of files are using the files or file systems. For example, I want to umount /root/, but I can’t and I don’t know why:

   1 2	# fuser /root/ /root:          29475c 29483c

   Hmm, c means that I am currently in the directory. Maybe I need to watch what I’m doing.

Most of these tools don’t fall into the same category, but they are all useful in their own right. I hope you can make as good use of them as I do. There are many more little known tools that come with many linux installs by default and this is a just a few of the common ones that I take advantage of on a regular basis.