Tag Info

Hot answers tagged

35

http.request.method == "POST"


15

After looking at ping.c from iputils-ping Debian etch package, I see: /* * * pr_icmph -- * Print a descriptive string about an ICMP header. */ void pr_icmph(__u8 type, __u8 code, __u32 info, struct icmphdr *icp) { ... case ICMP_PKT_FILTERED: printf("Packet filtered\n"); break; ...


14

You can set cache deny all in your squid.conf to disable caching for everyone using the proxy.


13

awk '{ if (length($0) < 16384) print }' yourfile >your_output_file.txt would print lines shorter than 16 kilobytes, as in your own example. Or if you fancy Perl: perl -nle 'if (length($_) < 16384) { print }' yourfile >your_output_file.txt


10

I work for a school of similar size. My recommendation: Focus on the network infrastructure as the first priority. Get beyond consumer level switches and internet access by implementing say, a Cisco ASA 5505 firewall combined with a Squid web proxy to do edge and http filtering and VPN connectivity. An ASA 5505 is probably less than 500$ with a support ...


8

I have finally managed to craft a working solution. Solution uses ebtables and IP-MAC pairs. Only needed table is the default 'filter' table. There is no need to add any rules or policy to INPUT chain, since INPUT chain is NOT related to running virtual machines. Explanation of meaning of INPUT, OUTPUT and FORWARD chains in filter table is in ebtables ...


7

If you want to display both methods GET and POST you filter wireshark like this http.request.method == GET or http.request.method == POST


6

Ping determines its printed message depending on the ICMP control message it receives in response to an echo-request. At a guess, I would imagine that whatever filtering device Eircom are using to block access to The Pirate Bay is generating either ICMP Type 3, Code 9 (network administratively prohibited) or Type 3, Code 10 (host administratively ...


6

Try this instead. tcpdump -w net75.out -s 0 net 65.192.0.0/10 man pcap-filter(7) dst net net True if the IPv4/v6 destination address of the packet has a net- work number of net. Net may be either a name from the networks database (/etc/networks, etc.) or a network number. An IPv4 network number can ...


6

You'll be farther ahead by extending fail2ban by dropping in a custom configuration file into its .d config directory. Do as little work as possible!


5

How big is the list and how many files are gone? Can you filter the missing files? % cat list.txt foo/bar foo/baz foo/fred foo/wilma betty % for file in `cat list.txt`; do [ -f $file ] && echo $file; done | xargs tar rvf archive.tar foo/bar foo/fred betty % tar tvf archive.tar -rw-r--r-- scott/scott 0 2011-07-05 10:25 foo/bar -rw-r--r-- ...


5

Network backbone is going to make or break this, lay ethernet to all rooms, the wifi will be a mess and basically unusable with a lot of traffic on it. These would all need strongly filtered internet access, Some firewalls come with content filtering, but that costs $$$, haven't had much experience outside of that but is typically your best bet ...


5

you would want to only capture traffic that is destined for your host's IP: dst host <your Ip> Sorry, read that as display filter. the above has been corrected for CAPTURE filter syntax.


4

Because tcpdump filters are the capture filters, and can be passed through tshark or tcpdump as well to avoid running a GUI just for capture if you're reviewing later [tcpdump] ether dst $YOUR_MAC_ADDRESS should cover most of what you want. [tcpdump] ether src not $YOUR_MAC_ADDRESS would be broader. You may some DHCP stuff from your machine in there as ...


4

This is similar to Ansgar's answer, but slightly faster in my tests: awk 'length($0) < 16384' infile >outfile It's the same speed as the other awk answers. It relies on the implicit print of a true expression, but doesn't need to take the time to split the line as Ansgar's does. Note that AWK gives you an if for free. The command above is ...


4

What you are asking about is typically called an "application layer" firewall or "layer 7" firewall because it operates at layer 7 of the OSI model. A layer 7 filter operates by inspecting all packets passing through the firewall in order to identify the protocol in use. There is a layer 7 classifier available for use with Netfilter, the Linux firewall ...


4

I would take a different approach. A centralized log mgmt program that generates its own events from specific server events that either 1) create help desk tickets or 2 allow events to be acknowledged with the mgmt tool. Keep in mind, your job is to cook down the number of events that need to be reviewed to an absolute minimum or else you are just ...


4

Windows Firewall comes with Server 2003. Use it. The Scope option is probably what you're looking for. Allow [blah] on scope [your LAN], deny everything else.


4

Yes, it is possible. You can use the following command: tcpdump -r your_input_file.pcap -w your_output_file.pcap "your_filter" Tcpdump will read the input file, apply the filter, and then write the output file. You need just to come up with the right filter.


4

I guess you mean to look for attribute uid or mail (not filtering on those). It is not possible, straight away, to use 2 different attributes in the LDAP URL, although RFC 2255 allows for it. mod_authnz_ldap alone: not possible Apache mod_authnz_ldap documentation states the URL must be like: ldap://host:port/basedn?attribute?scope?filter with ...


4

its because its specifying a single ip, you need to write it with the subnet: pass in from 111.111.0.0/16 man pf.conf should list a few methods of defining ranges and blocks. A side note, take care to ensure there are no drop quick kind of rules above your pass, and no rules below that could accidently match and block your packets.


3

Why not configure your GMail account to forward a copy of the specific messages (based on the sender) to the email address of your phone.


3

That seems like a large amount of overkill. Firstly, if you don't want them, can you unsubscribe from the list? If not, why not just set up an Outlook rule to either delete these emails, or move them to another folder?


3

To be honest, I don't know of a good solution. I'm in the US, I've always seen a small pile of junk faxes next to any machine that allows inbound. Thoughts: Do you have a business need for inbound faxing? If not, turn it off. Related to the above - can you turn it off overnight? Don't know if this will do much to cut down the volume. Can you have the ...


3

It's been a while since I've used maildrop to create recipes, but I believe something like this: if ( /^From:.*domain\.com/:h ) { cc "!someothermail@domain2.com" } References: http://www.courier-mta.org/maildrop.html http://www.courier-mta.org/maildropfilter.html


3

That means that device 159.134.124.176 is blocking ICMP (Ping) packets and replying back to you with that information. The possible ICMP replies are listed in this Wiki article.


3

I believe you will have to put a capture filter for all HTTP traffic, and then put in a display filter for the http.response.code == 500 After you have found a response code, remove the display filter and then use the Follow TCP Stream -or- the Conversation Filter to find the related packets...


3

Give something like this a try for a catch-all tc filter add dev $IF_LAN parent 1: protocol ip prio 7 u32 match ip dst 0.0.0.0/0 flowid 1:190


3

Have you tried a specialised/custom version of Linux/BSD? pfSense would be one example. Endian firewall would be another. Since they rely on Squid as their backend theoretically everything that you are currently doing should be supported. Else have you invesitagated frontends for Squid such as Webmin or DansGuardian?


3

Your request to capture only incoming traffic leads to some ambiguity. The word incoming may has at least two different meanings in networking. The first meaning packets received by a particular interface/device is relatively simple. The answer Jeff provides is what you want. You basically just need to filter for packets which have an IP or MAC address ...



Only top voted, non community-wiki answers of a minimum length are eligible