Saturday, November 19, 2005

UNIX: Plumb an interface for promiscuous traffic

This is nifty if you want to "plumb" (the term used in the Solaris world) and interface. This allows you to initialize the data-link portion of a NIC but not any level-3 stuff (like IP). Why would you use this? Simple....you want to hear everything that comes down the wire but you want no detectable presence on the network at all.

Solaris: ifconfig [iface] plumb

Linus: ifconfig [iface] 0.0.0.0

Thursday, November 17, 2005

UNIX: Back up a hard drive with 'dd'

Create an image:
dd if=/dev/[device] fs=1k conv=sync,noerror | gzip -c > output_file

Restore an image:
gunzip -c output_file | dd of=/dev/[device] fs=1k conv=sync,noerror

Also works over a network:
dd if=/dev/[device] fs=1k conv=sync,noerror | ssh whomever@whereever "dd of=[device or file] fs=1k conv=sync,noerror"

NOTE: It's been a few weeks since doing the above. My syntax may be a tad rusty. ;)

When specifying the device, use the raw device (/dev/hda or /dev/sdb or whatever) without specifying partition numbers. However, partitions can be specified if you want to back them up on that basis. Dumping the entire disk also gets the MBR. You should be good-to-go.

Recommend you use a live linux distro or something similar. I use Knoppix.