Here's the abstract for the session I'll be sharing tomorrow at Central Pennsylvania Open Source Conference. I've posted some "further reading" as well as a couple versions of the slide deck to help people retain the information. These conferences cram a lot in.

Linux has many advanced network traffic monitoring and manipulation capabilities. In this session we’ll assume you have command-line access to a Linux firewall or router between your network and the outside world. We’ll explore the tools available to most distros and how they can be used to gather and manipulate information from the network. We’ll primarily discuss tools available from the command line such as tcpdump and iproute2. The first will help us discover what is flowing and the second will help us manipulate it in the direction desired.

I think I've pretty much managed to keep to that. I've decided I don't have time to cover anything but tcpdump and iproute2. If I had a bit more time I'd cover using iptable to mark (or tag) packets. I'll be making a passing reference to it. In order to facilitate further study on the topic, I'm posting some interesting documentation and articles on the topic.

• tcpdump website
• iproute2 site (unofficial)
• nmap website: great for deeper network discovery and probing
• iproute2 Manual
• tcpdump man page
• Using iptables to mark traffic, including using iproute2 to act on those markings
• Setting up an IPv6 tunnel over IPv4 with iproute2

The presentation itself is available for download below.