To monitor only UDP or TCP traffic using iftop

To monitor only UDP or TCP traffic using iftop, you can use the following options:

1. Monitor Only TCP Traffic:

   sudo iftop -P -f "tcp"
   

2. Monitor Only UDP Traffic:

   sudo iftop -P -f "udp"
   

Here’s a quick breakdown:

• -P: This option shows port numbers instead of service names.
• -f "tcp": This option filters the traffic to only show TCP packets.
• -f "udp": This option filters the traffic to only show UDP packets.

You can combine these with other iftop options to further customize your monitoring.

sudo tcpdump -i eth0 udp port 4672 -XX

iftop can be quite useful in identifying and analyzing network traffic patterns, which is crucial when dealing with cyber attacks like DDoS. By monitoring the incoming and outgoing traffic, you can quickly spot unusual spikes or patterns that may indicate an ongoing attack. Here are a few tips for using iftop in such scenarios:

1. Identify High Traffic Sources and Destinations:
   Run iftop to see which IP addresses are generating the most traffic. This can help you identify potential sources of a DDoS attack.

   sudo iftop -P
   

2. Filter Specific Ports:
   If you know which ports are being targeted, you can filter traffic to those ports. For example, to filter traffic on port 80:

   sudo iftop -P -f "port 80"
   

3. Use Network Interface:
   Specify the network interface if you are monitoring a specific interface:

   sudo iftop -i eth0 -P
   

4. Monitor Specific Protocols:
   As mentioned earlier, filter by TCP or UDP to narrow down the traffic:

   sudo iftop -P -f "tcp"
   sudo iftop -P -f "udp"
   

5. Logging and Analysis:
   While iftop is great for real-time monitoring, consider using additional tools for logging and detailed analysis, such as tcpdump or wireshark, to capture and analyze packets over a longer period.

By using these options and strategies, you can leverage iftop effectively to detect and respond to DDoS attacks.

To check open ports and disable unnecessary daemons, follow these steps:

Step 1: Check Open Ports

1. Using netstat:

   sudo netstat -tuln
   

   This command will list all TCP (-t) and UDP (-u) ports that are listening (-l) along with numeric port numbers (-n).

2. Using ss:

   sudo ss -tuln
   

   ss is a modern replacement for netstat and provides similar functionality.

3. Using nmap:

   sudo nmap -sT -sU -O localhost
   

   This will perform a TCP (-sT) and UDP (-sU) scan on your local machine, attempting to identify open ports and the services running on them. The -O option enables OS detection.

Step 2: Identify and Disable Unnecessary Daemons

1. List Running Services:

   sudo systemctl list-units --type=service --state=running
   

2. Identify Services Listening on Ports:
   Combine ss with ps to find the service name:

   sudo ss -tulnp
   

   This will show you the process ID (pid) and the name of the program (name) listening on each port.

3. Disable Unnecessary Services:
   Once you identify the unnecessary services, you can stop and disable them using systemctl. For example:

   sudo systemctl stop servicename
   sudo systemctl disable servicename
   

4. Mask Services (Optional):
   To prevent a service from being started by any means (including dependencies):

   sudo systemctl mask servicename
   

Example

Let’s go through a brief example:

1. Check Open Ports:

   sudo ss -tulnp
   

   Example output:

   Netid  State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port  Process
   tcp    LISTEN  0       128      0.0.0.0:22           0.0.0.0:*          users:(("sshd",pid=1234,fd=3))
   tcp    LISTEN  0       128      0.0.0.0:80           0.0.0.0:*          users:(("apache2",pid=5678,fd=4))
   

2. Identify Unnecessary Services:
   In this example, if apache2 is unnecessary, it can be disabled.

3. Stop and Disable the Service:

   sudo systemctl stop apache2
   sudo systemctl disable apache2
   

4. Mask the Service (Optional):

   sudo systemctl mask apache2
   

By regularly checking open ports and disabling unnecessary services, you can reduce the attack surface and enhance the security of your system.