curl-tcpdump-netstat

curl-tcpdump-netstat.txt

# -------------------------
# tcpdump packet capture 
# -------------------------

# capture tcp to and from port 9393 (-n tells not to translate port numbers)
# just logs a message for each packet with tcp flags, sequence number, without the data

# Note! for SYN / SYN-ACK the real sequence number/ack number is shown, all other packets get relative sequence number 
# (relative to initial sequence number)

# also you get the real sequence number/ack number for the first captured packet of a connection 
# (if you start to capture when the connection was already established)

sudo tcpdump -nn -i any port 9393 >log.log 

# -i any - on any network interface
# -nn - don't translate numeric port address to port names (you really need two n !)
# port 9393 - capture packets if source or destination port is 9393

tcpdump: tcp flags notation explained

SYN  =  [S] (Start Connection)
SYN-ACK =  [S.] (SynAcK Packet)
           [.] (ack flag is set)
FIN  =  [F] (Finish Connection)
RST  =  [R] (Reset Connection)
PSH  =  [P] (Push Data)
URG  =  (Not Displayed in Flag Field) 

# capture with data, so that you can download the file and look at it in wireshark
sudo tcpdump -i any port 9393 -w capture_file.pcap

# you can also do some clever capture filtering, if you need to keep the capture file small,
# or if you want to decrease the footprint. But here you need to look at the man pages...

# -------------------------
# netstat and friends 
# -------------------------

Who is listening and serving?

```
ss -tulnp 

netstat -tulnp
```

shows processes (-p) listening (-l) on tcp (-p) and udp (-u) sockets, displays ip address in numeric form (-n) instead of hostname

The ss command if quick, and doesn't need root - it uses netlink api for ENUMERATING the processes
It reads from /proc/net/TCP and /proc/net/UDP for enumerating processes 
(that's why they 'deprecated' netstat, which gets everything from /proc) 

ss -tulnp : when searching for command line of processes it still reads /proc/[pid]/fd/  

(more on ss filtering: https://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html - that's where it shines, compared to slow netstat. Netstat greps around /proc, whereas ss talks to the kernel directly)

```
lsof -nPi
```

You can look at networking from a file system perspective (it's unix, where everything is a file, kindof)
similar job to do with lsof, but only for the current user. To get info on the whole system this must be run as sudo!!! (gotcha)

lsof looks at /proc/PID/fd , that' how it gets info on files/sockets opened by processes, if has a 'file context view' - 
while `ss` is more networking focused.

```
lsof -i UDP
lsof -i TCP
lsof -i TCP:8088
lsof -i TCP:127.0.0.1:8088
```

show all listening hosts on udp/tcp (or other options of detail - per port, per interface & port) - for current user (for whole system you need sudo for that)



# -------------------------
# Curl 
# -------------------------

sending http request to test your services

# skip client side ssl verification with -k
curl -k https://localhost:12345/addItem

# -d 'lala' the request body is the string 'lala' 
curl -k -X POST -d '{"name":"Michael", "status": "true"}' https://localhost:12345/addItem

# and add an HTTP Authorization header

USER="m123"
PASS="12345"
HTTP_AUTH=$(echo -n "$USER:$PASS" | base64 - )
curl -k -X POST -d '{"name":"Michael", "status": "true"}' -H "Authorization: Basic $HTTP_AUTH" https://localhost:12345/addItem

# -v if you want to see details like http headers of response
curl -v -k -X POST -d '{"name":"Michael", "status": "true"}' -H "Authorization: Basic $HTTP_AUTH" https://localhost:12345/addItem

# and you can send the same request twice, over the same connection - put in url twice
curl -v -k -X POST -d '{"name":"Michael", "status": "true"}' -H "Authorization: Basic $HTTP_AUTH" https://localhost:12345/addItem https://localhost:12345/addItem


#-------------------

# Want to show your kids that REST api is a cool thing?

# There is a nice REST api that does not require an api key or throttle after three requests!
# it gives you the weather forecast for your location.
# It is open source and has a nice description of the API https://github.com/chubin/wttr.in

# three days forecast for Tel Aviv

curl 'https://wttr.in/Tel+Aviv'

# or give the same report in different languages

curl 'https://wttr.in/Tel+Aviv?lang=he'

curl 'https://wttr.in/Tel+Aviv?lang=fr'

# even gives you a chance to talk about url encoding :-)
curl 'https://wttr.in/Modi%27in+Maccabim+Reut'

# or for landmarks!

curl 'https://wttr.in/~Wailing+Wall'

curl 'https://wttr.in/~Eifel+Tower'

# or show it as a pictux`re, in the browser
http://wttr.in/Jerusalem.png

# or tell it to do format in json (very detailed format, never knew there were so many details in a weather forecast)
# don't know what half of the values mean.
# (but the request is of high latency...)

curl 'http://wttr.in/Jerusalem?format=j1'

------

there is a reference of public REST api's https://publicapi.dev

(curiously it doesn't know anything about wttr.in :-)