In the first part of this blog series, we did a round-up of five common Linux network commands and their equivalent commands in Windows. In this part we will continue with the five described Linux commands for networking, and we will automate the usage of these with Bash scripts.
The commands we will cover are netstat, nslookup, ping, traceroute and curl. As you may be familiar with, these commands have a range of different switches that can be activated when running the commands. By using Bash, we will automate the running of the commands and the output they generate. We will also use the read Bash built-in command to create simple user interfaces where we request input from the keyboard. In one of our examples we will use a handy while loop in combination with the read command to read all lines in a file. That is a code snippet you will definitely have use of in the future.
Let’s get to it!
netstat for network connections
So netstat can show you network connections and the routing table as well as network interface statistics. But let’s say we want to narrow down our search for network connections in listening mode, and only those that were opened by users on the local Linux box. We can do that with the -l switch in combination with a grep command to filter for the connections that have the path “user” (in ‘run’ directory on Debia-based Linux). This way we get a neat table as output which shows all listening network connections initiated by users.
Check out the code here..
netstat -l | grep user
Above we pipe the output from netstat to grep and only match for entries in the output that contain “user”.
Checking listening network connections for a specific user
Let’s move on to the next netstat Bash example. We are going to build on the last command snippet. Now we want to narrow down the search even more, to only show listening network connections that were opened by a specific user ID. Recall that all users in a Linux system have numeric user IDs associated with them. If you want to learn more about Linux user IDs, please read “What is a Linux UID?”.
Now let us look at the Bash script.
read -p "Which user ID? " usr
netstat -l | grep user | grep $usr
As you can see, the second line is almost identical to the one in the last section. The difference is that we have added another grep statement, and matching for the contents in the variable $usr. The first line is where we define the $usr variable, and we do that by reading from the keyboard with the Bash built-in read.
The result is a pretty useful, although simple, Bash script. We ask the user to enter a UID, and then we search for all listening network connections and grep for only user initated connections, and finally for the specific UID.
But netstat -l is not fool-proof!
You need to know that the solution above is not fool-proof, because we are using predetermined matching conditions and we cannot guarantee that there will not be false positives. However, although the output may contain some extra lines for matching (listening) network connections, we can be sure that all the specific listening network connections for a specific UID will be displayed.
netstat for TCP and UDP connections
Now it’s time to look further and automate netstat even more. In this scenario we will consider when we want to check the listening and connected network sockets for both TCP and UDP. We will also want to map the network sockets to the PID (program name) that opened the network sockets.
netstat -tulpn
nslookup to look up domain names
Our first nslookup example will ask for a domain name and lookup the associated A record for it.
read -p "Enter domain: " domain
nslookup $domain
As you can see, we are reading the domain name from the keyboard and simply passing that variable value to nslookup.
nslookup for several domains on the same line
Let’s say you want to get A-records for several domains in one go. Well, since the internal field separator (IFS) is set to carriage return, you can use space to separate several values to assign to variables. The read command will read the input until it encounters a newline character. So the command really reads words, not lines. Like this..
read -p "Enter domains: " domain domain2
nslookup $domain
nslookup $domain2
We assign the variable values to each variable in turn, and then we just run nslookup twice, once for each variable. This was simple enough.
nslookup can do more
nslookup can look up all sorts of domain records, such as the name servers responsible for specific A-domains (records), and the email servers (MX records). Check out the following example..
read -p "Enter domain: " domain
nslookup -type=MX $domain
nslookup -type=NS $domain
Here we read one domain from the keyboard and assign it to a variable, noting new here. But check out the two nslookup commands. We use the -type switch to specify which type of domain records we are looking for, for the specific domain. MX stands for Mail Exchange, for routing emails. And NS stands for Nameserver, for the authoritative domain server(s) for the specific domain.
curl to get web page contents
curl is in its generic form a tool to transfer data to and from servers. It is often used to transfer HTTP data. Here we will see how to get the web page headers for a domain.
curl -I https://www.google.com
The -I switch tells curl to fetch the headers only. This is perhaps the simplest of all curl examples. Be aware that it supports a wide range of protocols, as follows (DICT, FILE, FTP, FTPS, GOPHER, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET and TFTP).
curl to fetch a user-specified web page
So let us continue by using curl to fetch an entire web page. This is the default mode when you use curl without switches.
read -p "Domain name? " domain
curl $domain
Like before, we ask the user to submit a domain name (should be prepended with HTTP or HTTPS). Then we simply invoke curl for the read variable, and we will see the entire web page printed to stdout.
curl to fetch and save web pages
Finally, let us modify the previous example and save the output to a file. Like this..
read -p "Domain name? " domain
curl $domain -o output.txt
That’s it! To understand the usefulness of curl, I highly recommend that you run man curl and read about all the available options.
You can find the GitHub repository with the simple examples here.
Author: Paul-Christian Markovski, for NailLinuxExam.com.
