Wednesday, May 14, 2014

In your VPC if you have ICMP protocol disabled, you can still test connections between your public and private subnets using tcpdump and netcat utilities

If you are troubleshooting connection issues among the instances within your VPC between public and private subnets you could use tcpdump and netcat utilities.

You can set up a listen port on ip address such as 8.8.8.8 using tcpdump:-

$ sudo tcpdump -nei any host 8.8.8.8
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
x:44:42.136491 Out 0a:2b:97:62:61:e6 ethertype IPv4 (0x0800), length 68: 10.98.x.x.60362 > 8.8.8.8.http: Flags [S], seq 2892799385, win 17922, options [mss 8961,nop,nop,sackOK,nop,wscale 7], length 0
17:44:43.135965 Out 0a:2b:97:62:61:e6 ethertype IPv4 (0x0800), length 68: 10.98.x.x.60362 > 8.8.8.8.http: Flags [S], seq 2892799385, win 17922, options [mss 89
61,nop,nop,sackOK,nop,wscale 7], length 0

From your other subnet, you can use netcat to post some packets:

$ nc 8.8.8.8 80
POST / HTTP/1.1

you will notice that your tcpdump is now receiving those packets if the route tables have been set up correctly.

No comments:

Post a Comment