Tag Info

Hot answers tagged

33

http.request.method == "POST"


15

After looking at ping.c from iputils-ping Debian etch package, I see: /* * * pr_icmph -- * Print a descriptive string about an ICMP header. */ void pr_icmph(__u8 type, __u8 code, __u32 info, struct icmphdr *icp) { ... case ICMP_PKT_FILTERED: printf("Packet filtered\n"); break; ...


13

awk '{ if (length($0) < 16384) print }' yourfile >your_output_file.txt would print lines shorter than 16 kilobytes, as in your own example. Or if you fancy Perl: perl -nle 'if (length($_) < 16384) { print }' yourfile >your_output_file.txt


13

You can set cache deny all in your squid.conf to disable caching for everyone using the proxy.


10

I work for a school of similar size. My recommendation: Focus on the network infrastructure as the first priority. Get beyond consumer level switches and internet access by implementing say, a Cisco ASA 5505 firewall combined with a Squid web proxy to do edge and http filtering and VPN connectivity. An ASA 5505 is probably less than 500$ with a support ...


8

I have finally managed to craft a working solution. Solution uses ebtables and IP-MAC pairs. Only needed table is the default 'filter' table. There is no need to add any rules or policy to INPUT chain, since INPUT chain is NOT related to running virtual machines. Explanation of meaning of INPUT, OUTPUT and FORWARD chains in filter table is in ebtables ...


6

If you want to display both methods GET and POST you filter wireshark like this http.request.method == GET or http.request.method == POST


6

Ping determines its printed message depending on the ICMP control message it receives in response to an echo-request. At a guess, I would imagine that whatever filtering device Eircom are using to block access to The Pirate Bay is generating either ICMP Type 3, Code 9 (network administratively prohibited) or Type 3, Code 10 (host administratively ...


6

Try this instead. tcpdump -w net75.out -s 0 net 65.192.0.0/10 man pcap-filter(7) dst net net True if the IPv4/v6 destination address of the packet has a net- work number of net. Net may be either a name from the networks database (/etc/networks, etc.) or a network number. An IPv4 network number can ...


6

You'll be farther ahead by extending fail2ban by dropping in a custom configuration file into its .d config directory. Do as little work as possible!


5

Network backbone is going to make or break this, lay ethernet to all rooms, the wifi will be a mess and basically unusable with a lot of traffic on it. These would all need strongly filtered internet access, Some firewalls come with content filtering, but that costs $$$, haven't had much experience outside of that but is typically your best bet ...


5

you would want to only capture traffic that is destined for your host's IP: dst host <your Ip> Sorry, read that as display filter. the above has been corrected for CAPTURE filter syntax.


5

How big is the list and how many files are gone? Can you filter the missing files? % cat list.txt foo/bar foo/baz foo/fred foo/wilma betty % for file in `cat list.txt`; do [ -f $file ] && echo $file; done | xargs tar rvf archive.tar foo/bar foo/fred betty % tar tvf archive.tar -rw-r--r-- scott/scott 0 2011-07-05 10:25 foo/bar -rw-r--r-- ...


4

Because tcpdump filters are the capture filters, and can be passed through tshark or tcpdump as well to avoid running a GUI just for capture if you're reviewing later [tcpdump] ether dst $YOUR_MAC_ADDRESS should cover most of what you want. [tcpdump] ether src not $YOUR_MAC_ADDRESS would be broader. You may some DHCP stuff from your machine in there as ...


4

This is similar to Ansgar's answer, but slightly faster in my tests: awk 'length($0) < 16384' infile >outfile It's the same speed as the other awk answers. It relies on the implicit print of a true expression, but doesn't need to take the time to split the line as Ansgar's does. Note that AWK gives you an if for free. The command above is ...


4

What you are asking about is typically called an "application layer" firewall or "layer 7" firewall because it operates at layer 7 of the OSI model. A layer 7 filter operates by inspecting all packets passing through the firewall in order to identify the protocol in use. There is a layer 7 classifier available for use with Netfilter, the Linux firewall ...


4

I would take a different approach. A centralized log mgmt program that generates its own events from specific server events that either 1) create help desk tickets or 2 allow events to be acknowledged with the mgmt tool. Keep in mind, your job is to cook down the number of events that need to be reviewed to an absolute minimum or else you are just ...


4

Windows Firewall comes with Server 2003. Use it. The Scope option is probably what you're looking for. Allow [blah] on scope [your LAN], deny everything else.


4

its because its specifying a single ip, you need to write it with the subnet: pass in from 111.111.0.0/16 man pf.conf should list a few methods of defining ranges and blocks. A side note, take care to ensure there are no drop quick kind of rules above your pass, and no rules below that could accidently match and block your packets.


4

I guess you mean to look for attribute uid or mail (not filtering on those). It is not possible, straight away, to use 2 different attributes in the LDAP URL, although RFC 2255 allows for it. mod_authnz_ldap alone: not possible Apache mod_authnz_ldap documentation states the URL must be like: ldap://host:port/basedn?attribute?scope?filter with ...


3

Instead of piping email directly into your script, pipe it into procmail first. Procmail can look at the headers and route it accordingly.


3

OK, genuinely interesting problem, given that it's got to function at the end of a pipe. There may be easier ways to do this, but I found this one worked (and it uses the sysadmin's Swiss Army Chainsaw, perl): tail -f catalina.out | perl -n -e '{ if (/^java.io.IOException: Server returned HTTP response code: 401/) { $ignore=1;} elsif ($ignore>=1 and ...


3

grep knows to take files as arguments. Please check the man. You could use egrep, instead of grep -e (which is the same): # egrep -v '^java.io|^\ {8}at' catalina.out | less


3

If it were me, I'd write a script for this: find /mnt/ftp -user 'myuser' -mtime -365 -exec cp {} /home/me/tosend \; That command will work in Linux. If you are using Windows, then the same can probably be accomplished with Cygwin. Either way, you want to make sure the FTP is mounted to the filesystem first.


3

depends on your definition of 'bounce', if you mean an error message (NDR), then no, not nonly NDRs have an empty envelope sender/return path out of office / auto-replies spam DSNs with a successful delivery report forwarders which want to make sure they cannot backscatter some strangely configured web forms depending on your environment you can probably ...


3

Yes, it is possible. You can use the following command: tcpdump -r your_input_file.pcap -w your_output_file.pcap "your_filter" Tcpdump will read the input file, apply the filter, and then write the output file. You need just to come up with the right filter.


3

Which address? The address assigned to a phone or {3,4}G modem can be an RFC 1918 address, an unused public address, or even an IPv6 address which is proxied to v4. These typically sit behind some sort of NAT or proxy device so if you're checking the address from the server end you might be able to use a simple reverse DNS lookup or an ISP database. To ...


3

If it's a true DoS, this isn't going to help much. The requests are still going to clog your pipe whether your server answers or not. By dropping that traffic, you're just delaying the inevitable exhaustion of resources. To truly combat a real DoS, you should contact your ISP and ask then to drop the offending traffic while it's still on their backbone ...


3

Yes, you can do this with a policy server. Standard smtpd_receipient_restrictions and smtpd_sender_restrictions can't do this exactly - they can do it separately and you could defer from one to the next but it wouldn't be reliable. Policy server is the best way to go. The page I linked to even shows an example policy server written in Perl.


3

You can block a website using URL or IP. Both ways can be used in http mode (clear text). However, you can block the website only using IP in https mode (encrypted). This is simply because the URL is also encrypted in https mode. One way to block a website in https mode using its URL is to use a proxy server. Your users will send the requests to this proxy ...



Only top voted, non community-wiki answers of a minimum length are eligible