Tagged Questions

0
votes
1answer
50 views

syn flood attack — packet hits on shared ip

How can I dump the TCP packets to get a better idea to know which website is being attacked? Here is what I have in my logs: May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
0
votes
2answers
112 views

TCPDump and IPTables DROP by string

by using tcpdump -nlASX -s 0 -vvv port 80 I get something like: 14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480) 206.72.206.58.http > ...
1
vote
4answers
77 views

Locally examine network traffic of remote machine

I have root access to my dd-wrt router at 192.168.0.1 and computer at 192.168.0.100. I need to get the traffic comming through the router(in the Internet and out) from some other ...
1
vote
1answer
78 views

tcpdump not picking up traffic redirected by iptables

The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1): iptables -t nat -A PREROUTING -i eth1 -p tcp ...
0
votes
1answer
26 views

Getting packet rate with tcpdump or iptables

I need to get the rate at which certain packets (i.e. LDAP) arrive on a interface in a linux environment. I was thinking of using tcpdump to filter the wanted packets and subsequently monitor the ...
-2
votes
2answers
81 views

Using tcpdump to find strings [closed]

I need to block certain TCP packets by trying to find a string match in and on them. Is there a way to do that with TCPDump? Or do I need wireshare install on my linux server? One I have the string ...
0
votes
1answer
254 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
2
votes
1answer
814 views

iptables drop packet by hex string match

I got this packet captured with tcpdump but I'm not sure how to use the --hex-string param to match the packet. Can someone show me how to do it? 11:18:26.614537 IP (tos 0x0, ttl 17, id 19245, offset ...
4
votes
1answer
172 views

Can tcpdump tell accessed port numbers?

I have a server with two NICs, and I would like to only have those ports open on eth1 that are being used. Question How do I get tcpdump to tell me the port numbers that is being accessed on eth1?
0
votes
1answer
321 views

TCP Sessions Hanging with Debian and iptables

Up until now I have been using a CentOS 5.x PC with 2x NICs running iptables as a router for my network. It worked great but recently I decided to get a DreamPlug which runs Debian 5.0.3/kernel ...
0
votes
1answer
451 views

dhcp-server + iptables: Can't share ppp internet connection

I had this configuration before, and it used to work well, but now I got a new server and I can't setup it to share the internet connection from ppp0. I'm on Debian testing. The client connects ...
3
votes
1answer
271 views

Incoming packets to server

I have enabled iptables logging for packets coming from the outside -A INPUT ! -s 192.168.218.0/24 -j LOG Now i am seeing lots of incoming packets from unknown addresses Jun 5 14:54:56 localhost ...
0
votes
1answer
200 views

iptables logging packets coming from the outside world

I want to log all INPUT packets that do not originate in the LAN for audit purposes, I have a script with tcpdump basically appending to a file the result from this: tcpdump "(dst net 192.168.0.0/24 ...
2
votes
3answers
966 views

how to monitor traffic at port 53 (DNS)

I am a bit confused with the abundant tcpdump tutorials on internet. I am having a few of the virtual machines running on a virtualization server.Where I am debugging a problem.Port 53 is the one in ...
3
votes
1answer
497 views

tcpdump output with iptables REJECT policy enabled

Quick question. I have a firewall with these simple rules: iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT ...
1
vote
4answers
681 views

How to block packets after capturing?

I use tcpdump to capture output packets for one server, but I also need to block these packets. If I use iptables to block them, then I also can not capture anything. Can I block packets with ...
0
votes
3answers
915 views

How can I log all traffic with its exact length?

I want to process all packets with their size going through our gateway server (running Debian 4.0). My idea is to use tcpdump, but I have two questions. The command I'm currently thinking of is ...