Sniff HDD Reads and Writes?

Discussion in 'all things UNIX' started by Searching_ _ _, May 30, 2011.

Thread Status:
Not open for further replies.
  1. Searching_ _ _

    Searching_ _ _ Registered Member

    Joined:
    Jan 2, 2008
    Posts:
    1,988
    Location:
    iAnywhere
    Like is done with a Hub on a network, can I capture data going to the HDD regardless if the HDD is mounted or not?
     
    Searching_ _ _, May 30, 2011
    #1
  2. mvario

    mvario Registered Member

    Joined:
    Sep 16, 2008
    Posts:
    339
    Location:
    Haddonfield, IL
    Try iotop or daemonfs
     
    mvario, May 30, 2011
    #2
  3. Searching_ _ _

    Searching_ _ _ Registered Member

    Joined:
    Jan 2, 2008
    Posts:
    1,988
    Location:
    iAnywhere
    Thanks, I'll look those up.
     
    Searching_ _ _, May 30, 2011
    #3
  4. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    10,224
    HDD mounted? You mean partitions, right?
    And going to the HDD from where? Memory? Network? Both? Else?

    Mrk
     
    Mrkvonic, May 30, 2011
    #4
  5. Searching_ _ _

    Searching_ _ _ Registered Member

    Joined:
    Jan 2, 2008
    Posts:
    1,988
    Location:
    iAnywhere
    Yep. Brain fade.
    Exactly. I would like to MITM the HDD.

    iotop doesn't show all HDD activity, only activity started by host processes.
    It also doesn't function as expected, using the -a option some processes do not remain, they pop up then disappear with no cumulative.
     
    Searching_ _ _, May 31, 2011
    #5
  6. mvario

    mvario Registered Member

    Joined:
    Sep 16, 2008
    Posts:
    339
    Location:
    Haddonfield, IL
    I found this:
    http://ubuntuforums.org/showthread.php?p=2415252#post2415252
    might be of help.
     
    mvario, May 31, 2011
    #6
  7. Searching_ _ _

    Searching_ _ _ Registered Member

    Joined:
    Jan 2, 2008
    Posts:
    1,988
    Location:
    iAnywhere
    WooHoo! Lots of activity.

    Works much better than iotop, except there are entries that don't need to be displayed.

    How would I exclude entries from displaying?
    For example:
    Code:
    [122468.692488] sudo(13946): READ block 79574 on loop0
[122468.735831] loop0(470): READ block 80608 on sr0
    Or, as an example, should I just add "grep -i usb" to "dmesg -c"?
    Can I chain multiple display filters? Ex. grep -i usb,tty,debugfs,pdq
     
    Searching_ _ _, Jun 1, 2011
    #7
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...