Commands & key bindings reminders

$ sudo sysdig -w tracefile.scap

$ sudo sysdig -r tracefile.scap -c topprocs_cpu

$ man bash

[ ... ]

REDIRECTION
[ ... ]

Bash handles several filenames specially when they are used in redirections,
as described in the following table:
   /dev/tcp/host/port
          If host is a valid hostname or Internet address, and port is an
          integer port number or service name, bash attempts to open a
          TCP  connection to the corresponding socket.

$ > /dev/tcp/google.com/1234
# Wait tcp connection timeout
bash: connect: Network is unreachable
bash: /dev/tcp/google.com/1234: Network is unreachable
$ echo $?
1 # Port is closed

$ > /dev/tcp/google.com/80
$ echo $?
0 # Port is open

                                                | $ nc -l -p 4123
$ echo "stop whining" > /dev/tcp/localhost/4123 |
$                                               | stop whining
                                                | $

-i any : Listen on all interfaces just to see if you're seeing any traffic.
-n : Don't resolve hostnames.
-nn : Don't resolve hostnames or port names.
-X : Show the packet's contents in both hex and ASCII.
-XX : Same as -X, but also shows the ethernet header.
-v, -vv, -vvv : Increase the amount of packet information you get back.
-c : Only get x number of packets and then stop.
-s : Define the snaplength (size) of the capture in bytes. Use -s0 to get everything, unless you are intentionally capturing less.
-S : Print absolute sequence numbers.
-e : Get the ethernet header as well.
-q : Show less protocol information.
-E : Decrypt IPSEC traffic by providing an encryption key.

# tcpdump -i eth0 -nnvvXSs 0 tcp and host host.example.com and (dst port 80 or 443)

$ lsof -p 41256

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
[...] 
tail    41256 root    3r   REG    8,2      336 1974899 /var/log/messages
[...]

$ lsof -i4TCP@www.google.fr:80

COMMAND   PID   USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
nc      10924   klyr    3u  IPv4 12514117      0t0  TCP 192.168.2.17:47553->fx-in-f99.1e100.net:www (ESTABLISHED)

$ lsof /var/log/messages

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
tail    11248 root    3r   REG    8,2      336 1974899 /var/log/messages