• Parallel Programming Cluster using MPI/LAM.
• Network Intrusion Detection System using Libnids.
• Analysis of Networking traffic and display results using MRTG.
• DHCP Server extensions using DHCP Callout API

http://hocuspokus.net/2008/05/13/install-postgresql-on-ubuntu-804/
http://www.ubuntugeek.com/howto-setup-database-server-with-postgresql-and-pgadmin3.html

Tutorial
http://www.postgresql.org/docs/manuals/

1. Theoretical background
2. The tools to apply such knowledge

I’m presenting both:

1. Tutorials

http://gnosis.cx/publish/programming/regular_expressions.html
http://www.zytrax.com/tech/web/regex.htm
http://www.delorie.com/gnu/docs/regex/regex_67.html
http://www.lunametrics.com/blog/2006/11/27/
http://chaos4.phy.ohiou.edu/~thomas/ref/info/rx/Character_Sets.html
http://www.regular-expressions.info/tutorial.html

2. How to use regular expressions.

Regular Expressions in C++ using Netbeans and Boost

Notice that the link above explains how to use regular expressions using Boost with and without Netbeans.

Wireshark filters

By net1.scr>net2.dst ip.src==10.253.0.0/16 and ip.dst==10.254.0.0/16
By TCP Port tcp.port == 135
By IP address ip.addr == 192.168.10.67
IP 1 or IP 2 (ip.addr == 192.168.10.45) or (ip.addr == 192.168.10.67)
IP 1 and IP 2 (ip.addr == 192.168.10.45) && (ip.addr == 192.168.10.67)
By MAC address eth.addr == 00:01:02:68:59:ea
handshake tcp.flags.syn == 1 or tcp.flags.ack == 1
SYN’s only tcp.flags.ack != 1 && tcp.flags.syn == 1

To look for word in dump file (t option will print the time stamps)
ngrep -wt ‘word’ -I dump_file

Monitor all interfaces through port 80
ngrep -d any port 80

For the word ‘error’
ngrep -d any ‘error’ port syslog

For details
ngrep -d any -W byline port 80

Install the latter from the Ubuntu repositories.

Even though, to use this open source programming skills are necessary, it’s very worth it.

http://libnids.sourceforge.net/
http://monkey.org/~jose/presentations/hitb04-tools.d/

Watch packets which have SYN sets
tcpdump tcp[13] == 2

Watch packets which have SYN-ACK sets
tcpdump ‘tcp[13] & 2 == 2′

Different ways of dumping packets: Interface: eth1, host: 192.168.0.1
tcpdump -i eth1 -nne host 192.168.0.1 and port 80
tcpdump -i eth1 -s0 -A -v host 192.168.0.1
tcpdump -i eth1 tcp dst port 80 and src host 192.168.0.1
tcpdump -n host 192.168.0.1 and tcp[13]=2 -w output_file

Monitoring with tcpdump
http://www-iepm.slac.stanford.edu/monitoring/passive/tcpdump.html

More tcpdump

Port Scanning (check if TCP ports 80-90 are open)
nc -vzt 192.168.0.1 80-90

Banner grabbing
nc -v -n 192.168.0.1 80

tcp statistics

netstat -nc | grep tcp: Info per second
netstat -np | grep tcp: Show pid of programs
netstat -nl | grep tcp: Show listening sockets

Requirements:

A file which holds the name of the boxes in the cluster (i.e /mnt/lamhosts)
A sharing directory the cluster (i.e /mnt/lam)
A LAM/MPI parallel computing program (i.e. hello.c)
Need to log in as an authorized user
And of course a working Beowulf cluster

1. Copy the file lamhosts, and the program hello.c into /mnt/lamhosts
2. cd /mnt/lamhosts
3. Turn on LAM: lamboot -v lamhosts
4. Compile prog: mpicc -o hello hello.c
5. Run: mpirun n0-x hello
(x: number of machines – 1)
6. Once you finish, turn Lam off: lamhalt