While diffing mounted snapshots would work, it sounds like it could be horribly slow in many cases.
Is there btrfs specific functionality for diffing snapshots? (I was unable to find any in the docs)
I was watching the funny server type from http://www.reddit.com with curl -I http://www.reddit.com when I guessed that curl -X HEAD http://www.reddit.com would do the same. But, in fact, it doesn't.
I'm curious about why.
This is what I observe running the two commands:
curl -I: works as expected, outputs the header and exists.curl -X HEAD: does not show anything and seems to wait for user input.
But, sniffing with tshark I see the second command actually sends the same HTML query and receives the correct answer, but it does not show it and it doesn't close the connection.
curl -I
0.000000 333.33.33.33 -> 213.248.111.106 TCP 59675 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=47267342 TSER=0 WS=6
0.045392 213.248.111.106 -> 333.33.33.33 TCP http > 59675 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=2552532839 TSER=47267342 WS=1
0.045441 333.33.33.33 -> 213.248.111.106 TCP 59675 > http [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=47267353 TSER=2552532839
0.045623 333.33.33.33 -> 213.248.111.106 HTTP HEAD / HTTP/1.1
0.091665 213.248.111.106 -> 333.33.33.33 TCP http > 59675 [ACK] Seq=1 Ack=155 Win=6432 Len=0 TSV=2552532886 TSER=47267353
0.861782 213.248.111.106 -> 333.33.33.33 HTTP HTTP/1.1 200 OK
0.861830 333.33.33.33 -> 213.248.111.106 TCP 59675 > http [ACK] Seq=155 Ack=321 Win=6912 Len=0 TSV=47267557 TSER=2552533656
0.862127 333.33.33.33 -> 213.248.111.106 TCP 59675 > http [FIN, ACK] Seq=155 Ack=321 Win=6912 Len=0 TSV=47267557 TSER=2552533656
0.910810 213.248.111.106 -> 333.33.33.33 TCP http > 59675 [FIN, ACK] Seq=321 Ack=156 Win=6432 Len=0 TSV=2552533705 TSER=47267557
0.910880 333.33.33.33 -> 213.248.111.106 TCP 59675 > http [ACK] Seq=156 Ack=322 Win=6912 Len=0 TSV=47267570 TSER=2552533705
curl -X HEAD
34.106389 333.33.33.33 -> 213.248.111.90 TCP 51690 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=47275868 TSER=0 WS=6
34.149507 213.248.111.90 -> 333.33.33.33 TCP http > 51690 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=3920268348 TSER=47275868 WS=1
34.149560 333.33.33.33 -> 213.248.111.90 TCP 51690 > http [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=47275879 TSER=3920268348
34.149646 333.33.33.33 -> 213.248.111.90 HTTP HEAD / HTTP/1.1
34.191484 213.248.111.90 -> 333.33.33.33 TCP http > 51690 [ACK] Seq=1 Ack=155 Win=6432 Len=0 TSV=3920268390 TSER=47275879
34.192657 213.248.111.90 -> 333.33.33.33 TCP [TCP Dup ACK 15#1] http > 51690 [ACK] Seq=1 Ack=155 Win=6432 Len=0 TSV=3920268390 TSER=47275879
34.823399 213.248.111.90 -> 333.33.33.33 HTTP HTTP/1.1 200 OK
34.823453 333.33.33.33 -> 213.248.111.90 TCP 51690 > http [ACK] Seq=155 Ack=321 Win=6912 Len=0 TSV=47276048 TSER=3920269022
Any idea about why this difference in behaviour?
How can I compare two directories with sub dirs to see where is the difference?
We had someone steal some files before quitting and it has eventually come down to a lawsuit. I've now been provided with a cd of files and I have to "prove" that they are our files by matching them to our files from our own file server.
I don't know if this is just for our lawyer or evidence for court or both. I also realize that I am not an impartial 3rd party.
In thinking how to "prove" these files came from our servers we realized I also have to prove we had the files before receiving the cd. My boss took screen shots of our explorer windows of the files in question with creation dates and file names showing and emailed them to our lawyer the day before we received the cd. I would have liked to have provided md5sums but I wasn't involved in that part of the process.
My first thoughts were to use the unix diff program and give console shell output. I also thought I could couple it with the md5 sums of both our files and their files. Both of these can easily be faked.
I'm at a loss of what I actually should provide and then again at a loss on how to provide an auditable trail to reproduce my findings, so if it does need to be proved by a 3rd party it can be.
Does anyone have any experience with this?
Facts about the case:
- The files came from A Windows 2003 file server
- The incident happed over a year ago and the files haven't been modified since before the incident.
I'm copying lots of files that have changed from one server to another using rsync. I know I can use the -n option to do a dry run, so I can see what files have been changed. However is it possible to get rsync to print a diff of the file contents that's changed? I'd like to see what's happening before doing a copy? Something I can save to a file and the apply with diff(1) later?