The tag has no wiki summary.

learn more… | top users | synonyms

12
votes
2answers
23k views

How to make wireshark filter POST-requests only?

How to make wireshark filter POST-requests only?
7
votes
1answer
2k views

How to prevent IP spoofing using MAC and ebtables?

I am trying to create IP-MAC pairing rules in ebtables. There are few tutorials and related questions [1] available but I have kind of specific setting. ENVIRONMENT: I have many physical hosts. Each ...
6
votes
6answers
14k views

How does ping know that my packets are filtered?

I'm customer of an Irish ISP, eircom, which has started censoring the pirate bay. When I try to ping 194.71.107.15 which is the IP address of thepiratebay.com, I get this output: PING 194.71.107.15 ...
6
votes
4answers
4k views

Linux shell command to filter a text file by line length

I have a 30gb disk image of a borked partition (think dd if=/dev/sda1 of=diskimage) that I need to recover some text files from. Data carving tools like foremost only work on files with well defined ...
4
votes
2answers
1k views

Server and network setup for a small private school

I help a local private school with a lot of their tech needs. So far, it's been on the order of repairing/installing office computers and helping manage the office network. But now the administrator ...
4
votes
2answers
11k views

How to prevent squid from caching and just filter?

I have set a proxy server on my network. I only want to filter the web traffic. So, I have Squid as a proxy and Qlproxy as the filter : http://www.quintolabs.com/qlicap_info.php My server have only ...
4
votes
1answer
1k views

More Searchfilters in AuthLDAPURL

Is it posible to have more then one searchfilter in AuthLDAPURL? Example uid filter: <Location /test/> AuthType Basic AuthName "Test" AuthBasicProvider ldap ...
4
votes
1answer
518 views

Traffic shaping: tc filter catch all filter

How Can I configure a "catch all" filter with tc filter? I tested with the following code but it gave me the error: "Unknown filter "1:100", hence option "protocol" is unparsable": tc filter add ...
4
votes
2answers
249 views

How do I remove (un-apply) a named filter from a Procurve switch port using the CLI?

EDIT: Edited my examples to reflect that I was indeed attempting this with the switch in "configure" mode. Still no joy. EDIT: I've done some more searching on this issue. I just can't seem to see it ...
4
votes
5answers
2k views

Why are emails sent from my applications being marked as spam?

I have 2 web apps running on the same server. The first is www.nimikri.com and the other is www.hourjar.com. Both apps share the same IP address (75.127.100.175). My server is through a shared ...
4
votes
4answers
3k views

Log every IP connecting on a system with iptables

Title says it all. How can I, with iptables under Linux, log all IP connecting to a server? As a little detail, I'd like to have only ONE entry in the log PER DAY PER IP. Thanks :) EDIT: I ...
3
votes
4answers
6k views

Wireshark filter to only capture Incoming Packets?

I am trying to setup a Filter (so my log files aren't massive) that will capture only incoming traffic. I have looked on http://wiki.wireshark.org/CaptureFilters but so far have been unable to find a ...
3
votes
3answers
376 views

Filter the output of a log file

Question I've a log-File which display all console-logs of my website in the range of 10.Oct to 1.Nov, start with the logs of 10.Oct. I need all logs from the range of 25.Oct until today. The problem ...
3
votes
1answer
9k views

tcpdump filter on network and subnet mask

I'm using the following tcpdump command: tcpdump -w net75.out -s 0 host 65.207.95.222 I want to change the filter on the single host to be all addresses in the following subnet: 65.192.0.0/10 I ...
3
votes
1answer
71 views

How do I check whether an administrator has viewed the security audit log?

A colleague and I have been discussing an IS audit demo on Windows. One point we'd like to cover is that an administrative/high-privilege user should view the security log within X hours of a failure ...
3
votes
1answer
295 views

Is null return path reliable indication of a bounce?

I have a mailbox that receives bounces as well as normal email (the latter includes messages from automated services). I want to filter out the bounces and forward them to another mailbox. Assume I ...
3
votes
1answer
5k views

How to filter for HTTP 500 responses and their requests in Wireshark?

How do I filter for HTTP 500 responses and their requests in Wireshark? I'm able to use http.response.code == 500 to find all the responses which got the return code 500 but I want to be able to see ...
3
votes
1answer
341 views

Reduce munin logging level

Munin is quite verbose, and logs a bunch of things into munin-graph.log, munin-html.log, munin-limits.log and munin-update.log at each run of munin-cron. I already reduced munin-node logging level by ...
2
votes
5answers
651 views

Limit Internet access to White-Listed Sites?

We have need for certain computers to have their Internet access limited to a list of sites, denying access to all others (white-listing). Some of these sites use HTTPS, so the solution needs to ...
2
votes
2answers
465 views

Filter tcpdump file AFTER capturing

I captured a really big tcpdump file which now always crashes my wireshark. It was captured with no filters and I need to apply some afterwards to make the file smaller. Is this somehow possible?
2
votes
1answer
387 views

Block UDP traffic by rate/string-match on Windows 2008

I am administrating a Windows 2008 server (64-bit). It is being subjected to a focused set of DOS attacks where UDP packets are sent to a specific port and contain a specific string. What I need to ...
2
votes
1answer
178 views

Postfix address filtering

Is it possible to do sender address filtering within postfix itself? I want to block email where the sender and recipient are both root@domain.com except in the case that the email was sent locally. ...
2
votes
1answer
135 views

Set up a Fax server to filter spam

At my work, we have a huge costly multi-function printer that does everything a printer can dream of. It is hooked up directly on a dedicated fax telephone line. Now we receive an increasing amount of ...
2
votes
1answer
2k views

How can I use maildrop to forward a copy to another email address?

I have a postfix + virtual users setup. I have enabled maildrop as the delivery agent. How can I write a filter for a user so that if mail comes from a particular domain to that user a copy also goes ...
2
votes
2answers
658 views

tc prio qdisc for priorization of mysql traffic

I am struggling with tc prio qdisc for a few hours now. I have read the lartc Documentation, Examples and HowTos, but this whole thing is kinda new for me and somewhat confusing :) So this is my ...
2
votes
1answer
107 views

Postfix: Filter emails for my domain for helpdesk email

My helpdesk system doesn't allow to filter by email. Some users send helpdesk tickets from their personal accounts by accident. I would like to make sure that only emails coming from domain.com will ...
2
votes
1answer
405 views

Inaccurate bandwidth limiting in altq queues

I'm setting up an environment where I have one Linux server, one OpenBSD router and one Linux client and I want to be able to limit how much bandwidth the client should be able to use. I've been ...
2
votes
0answers
145 views

Can ebtables BROUTING/PREROUTING package to INPUT or FORWARD table?

Can I decide the direction of package with ebtables? See the diagram above, when raw package come, I want to the package goto FORWARD table rather than INPUT table with ebtables, directly. The ...
2
votes
1answer
630 views

Linux ldap authentication, pam_filter ignored

I've set up linux client authentication via ldap, it works. I want to control user's access to several services by adding or removing different OUs for accounts. E.g., if user is allowed to login ...
2
votes
1answer
486 views

How to allow only certain files in Apache

I'd like to filter access to certain files in apache. I want only CGI access. So I tried putting in vhost file: <FilesMatch "\.cgi$"> Order allow,deny Allow from all </FilesMatch> ...
2
votes
1answer
635 views

Traffic shaping: tc filter attached to an HTB class?

Can I attach a tc filter to an HTB class rather than to an HTB qdisc? For example: tc class add dev $IF_LAN parent 1:100 classid 1:180 htb rate 19kbit ceil 2000kbit prio 4 where: 1:100 -> Is ...
1
vote
3answers
111 views

drop ips with iptables from awk result [closed]

I have a log file like this : Frq:15 IP:0.0.0.0 Date: 2014-03-21 12:19:31 AM Frq:9 IP:198.252.206.25 Date: 2014-03-21 12:19:31 AM Now i get column of ip addresses with awk : cat /tmp/test | awk ...
1
vote
4answers
704 views

Free SMS notification of new filtered mail message

Does anyone know how to get notified by SMS for free when a new mail message has been received in the inbox. I am using a script which notifies to my Gmail account if one of my websites are slow or ...
1
vote
1answer
167 views

PF: Block all, but one subnet firewall rule?

I'm trying to do something that I thought would be relatively simple: Block all the traffic to a test server, other than my company's subnet. I've tried things along these lines (111.111.0.0 is my ...
1
vote
1answer
92 views

How to filter some protocols on all ports

Under CentOS, how can I filter traffic by protocol rather than by port? For example, I would like to filter ftp traffic regardless of the port being used in order to prevent users on the network from ...
1
vote
2answers
35 views

Rsync Include and Exclude with Dates

I have a bunch of log files that I sync with another server using rsync. The log files are all named in the format YYYY-MM-DD XXX.txt. I only want to sync the current month and last month of logs ...
1
vote
1answer
57 views

RSYNC Filters Conflicting

I've had to break my rsync tasks down into smaller jobs given the size of my directories. Essentially, I'm doing it alphabetically (i.e., script that syncs folders starting with A-D, E-H, etc, etc). ...
1
vote
1answer
241 views

How to allow a single domain name with iptables

I am looking for a way to make iptables only accept requests for my domain name and reject the others. Lately I misconfigured my apache proxy, it is now fixed, but I keep receiving a load of requests ...
1
vote
2answers
603 views

How to exclude local traffic from AWStats reports?

I have AWStats configured to run on my website, but I would like it to exclude hits coming from myself (localhost) that are seen as originating from these ip addresses: 127.0.0.1 192.168.0.1 How ...
1
vote
5answers
3k views

Separate color from black-and-white pages for printing

My organization has a leased color printer. We pay a per-page cost to the lessor, and the color page cost is far greater than the black-and-white page cost. Our users are pretty good about selecting ...
1
vote
1answer
323 views

Get an IIS 6 ISAPI dll to ignore virtual directories

I have an IIS 6 website with an ISAPI dll to run an application. The application and ISAPI filter works well. I also have a couple of virtual directories set up to handle things like images without ...
1
vote
1answer
157 views

syslogd filtering not working on FreeBSD

I am failing to get filtering by program or facility working in FreeBSD syslogd. I added local6.debug /var/log/test.log !testd *.debug /var/log/test.log to my ...
1
vote
1answer
251 views

trigger script on postfix delivery errors

I'm trying to get postfix to run a script on soft (4xx) and hard (5xx) delivery errors, but I'm not sure where to start. If I understand things correctly, I could insert (pipe-based) filters in the ...
1
vote
1answer
247 views

How can I display-filter the correspondant response to a specific display-filtered request in wireshark?

I am just tracing a very sporadic error in responses to HTTP requests to a specific resource on an embedded device's webserver. So my plan is to run a test over night (or even weekend), capture the ...
1
vote
1answer
2k views

Redirect specific domains with DNS

Currently we filter internet content using OpenDNS, our internal Windows DC/DNS servers point to the router's DNS, which then points to the OpenDNS servers. This works well to block all computer's on ...
1
vote
0answers
27 views

Juniper Junos SRX (with HA Cluster): filter on lo0 not working

config: 2 srx firewalls in a ha cluster on lo0 we use ssh. i tried to log the ssh packages: # show firewall family inet { filter deny_ssh_default_port { term deny_ssh_default_port_term { ...
1
vote
2answers
421 views

PowerShell filter files by date in name

I have many files with different names per day. How can I filter them by the date in their name? For example: app_20130505.log app_20130506.log app_20130507.log app_20130508.log app_20130509.log ...
1
vote
3answers
4k views

Use MikroTik Bridge as a Public IP Firewall for Public Hosted Servers

We want to do this: Internet<->MikroTik in Bridge Mode with Firewall Filter<->Hosted Server The primary objective is to allow RDP and FTP in from the outside but block everything else from ...
1
vote
1answer
407 views

Can't connect using TCP though UDP/ICMP works

My office changed IP addresses yesterday and since then we can't access any site hosted by mediatemple.net plus a couple of other sites. The office connection is ADSL (PPPoA). Both MT and my ISP ...
0
votes
2answers
311 views

tar too slow when file doesn't exist!

I have a gigantic list of files on a text files. This list is passed to tar, like this: cat list.txt | xargs tar rvf archive.tar --ignore-failed-read The problem is that some files that are on the ...