Tag Info

Hot answers tagged

17

After looking at ping.c from iputils-ping Debian etch package, I see: /* * * pr_icmph -- * Print a descriptive string about an ICMP header. */ void pr_icmph(__u8 type, __u8 code, __u32 info, struct icmphdr *icp) { ... case ICMP_PKT_FILTERED: printf("Packet filtered\n"); break; ...


9

ssl.record.version == 0x0301 That tells Wireshark to only display packets that are SSL conversations using TLS semantics.


8

Ping determines its printed message depending on the ICMP control message it receives in response to an echo-request. At a guess, I would imagine that whatever filtering device Eircom are using to block access to The Pirate Bay is generating either ICMP Type 3, Code 9 (network administratively prohibited) or Type 3, Code 10 (host administratively ...


7

This is untested, but setting up something like this at the very end of sshd_config should work: PasswordAuthentication no PubkeyAuthentication yes RSAAuthentication yes Match Address 192.168.1.0/24 PasswordAuthentication yes Basically you're globally allowing public key auth, globally disallowing password auth, and then specifically re-allowing ...


6

The risks in turning it off are: Windows Firewall cannot operate Unpredictable behavior and event logging from other components and applications that may assume that Windows Filtering Platform is operating normally. No IPsec A prime example of "other components and apps" that use/need the WFP in various ways would be antivirus. But I'll hazard a guess ...


6

To execute your filters on your existent mailbox you can manually run sieve-filter from the command line. To (dry) run the sieve-script example.sieve as user test on the mailbox INBOX use the following command: sieve-filter -v -C -u test /path/to/sieve/example.sieve 'INBOX' Once you like the actions sieve would perform you can execute the script with ...


5

The -s flags selects only that traffic that matches the host or network specified. If you want to match all traffic except that, use ! -s 10.0.3.0/24 and don't forget to escape that ! from the shell with either quotes or a backslash.


5

No. tcp and port 10000 means "tcp port 10000" port 10000 means "tcp port 10000 or udp port 10000" and is a synonym for (tcp or udp) and port 10000 I would force TCP if I wanted, for example, to see only DNS packets that are being transported over TCP (as opposed to the default UDP). (tcpdump should have been named packetdump or netdump since it can ...


4

For the first question - yes, that would be possible. You'd have the DNS for your webservers set to the server running SNORT, and have that server forward the traffic to the actual webserver. That's one of the standard ways to set up a firewall/filtering server. For the second - that's a question that invites a long discussion, something doesn't really fit ...


4

One installation method for Snort is called in-line mode. In this configuration your snort sensor will be a choke point for your traffic, much like a traditional router or firewall. All packets will be received on the outside interface, passed through the snort application, and then forwarded onto the inside interface. If done correctly it will be ...


4

The source-track option does apply per-rule, so you are not restricting "Google to X req/day", you are restricting each individual address to that limit. I give you two solutions here. One is simple and approximate, the other is harder and sharper. Solution 1 Transform the condition so as to match all servers of interest in one rule. The simplest approach ...


4

No, tc is not for firewalling. Use ebtables instead.


4

You could always do something like this in the top of each built-in chain: iptables -I INPUT -i eth1 -j eth1chain iptables -I INPUT -i eth1 -j DROP Then whack whatever rules you want into eth1chain to allow traffic (you can skip putting the -i eth1 into those chains, too!), and leave the policy on the main chain as ACCEPT. However, I wouldn't recommend ...


4

Pfsense can do most of this if you add extra packages which are easily installable inside the distribution. It is also very stable and intuitive to use.


4

How do proxy servers filter HTTPS websites? It isn't very easy. You have a couple poor choices, each with there own problems. You can do it purely on the NAME/IP passed via the HTTP CONNECT request. Meaning you are likely to have lots of false positives/negatives. You can perform a MITM attact. With a couple products in a corporate environment, a ...


3

I don't think the anti-spam component is enabled by default. This article shows you how to enable it. http://www.petri.co.il/install-anti-spam-exchange-2007.htm


3

That means that device 159.134.124.176 is blocking ICMP (Ping) packets and replying back to you with that information. The possible ICMP replies are listed in this Wiki article.


3

This worked for me - not exactly as described above, but close enough: awk '/ERROR|WARN/,/DEBUG|INFO/ { if ($0 !~ /(DEBUG|INFO)/) { print } }' < logfile Very convenient that awk supports this: /startpattern/,/stoppattern/ { }. Unfortunately if the stop pattern is matched on the same line as the start pattern, it prints out that line only, hence the ...


3

The browser knows it's connecting to a proxy, it's not really "fooled". There are passive proxies that you can setup, but still the browser will know that proxy is there the first time it hits an encrypted URL if the proxy doesn't just route the traffic through untouched. Often the connection to the proxy server is either always encrypted or always ...


3

Set up different instances of postfix with the listener in the subnet, set mynetworks to be that subnet, don't allow mail from elsewhere, set the corporate mail domain as a valid relay domain. This is quite simple with check_sender_access. Create an allowed sender group, with check_sender_access you can allow or disallow by IP or subnet also. Have a look at ...


3

Is there any particular reason why your server has to answer to external queries at all ? Ideally, you would setup an external resolver for your public resolver (used to resolve all resources that must be accessed externally: MX, web server, etc), use the windows DNS server only for your internal network and block all incoming DNS queries at your perimeter. ...


2

Would it then be possible to route ALL my traffic through it like a firewall to my websites? Not only is it possible, but it's exactly how you should setup an IPS if you want it to actually drop bad traffic. If not, then it becomes an IDS and will only flag bad traffic. The only part of your question I do not agree with is when you compare Snort with a ...


2

Based on the output of master.cf above, we know that postfix will passed the original sender on first argument of your script. So, your script will have to parse the arguments, save it to variable and use it to provide sender address when email reinjected to postfix via sendmail command. Sendmail command accept sender parameter via -f parameter. So your ...


2

Install a (transparent) proxy and configure it to block whatever URLs and patterns you want. This isn't possible to do at anything below layer 7 (I count DPI as a layer 7 technology), because nothing below that has any idea of the concept of a "URL".


2

The proper way to solve this problem is to host your demo website somewhere that is designed to host websites. Your home cable connection is not designed for this purpose and trying to host a website, even a demo website, from home will only cause you grief. A free-tier EC2 instance from Amazon can be created from scratch in about 30 minutes, which is ...


2

Try something like this: cat importantstuff.log | grep 'File .*, line .*, in .*' -B 1 -A 2 Doesn't exactly answer the question, but I think it accomplishes the task. The -A and -B flags for grep control lines of context after or before your match. This works because grep groups adjacent matches, so you end up with nicely separated tracebacks: Traceback ...


2

Firstly, why do you have two subnets contained in the same VLAN?. Although, that's not your problem here. I can't speak to the syntax of the commands as I haven't configured HP ProCurves, but it seems your logic is off. Instead of filtering inbound traffic on your uplink, you should be filtering outbound traffic. The uplink interface wouldn't receive ...


2

You will probably want to utilize your web analytics tools for this purpose. You should probably start with a visit to the Google Ads Ad Traffic Quality Resource Center. Here is an InsideAdWords blog post with good information on the topic.


2

ping receives a ICMP_DEST_UNREACH and depending on the type of returned icmp package returned ping knows that it's filtered.


2

Reading through large log files is not a good idea you need to first filter them to the necessary lines and then look at them even then, if possible (and if the filtered lines are a lot too), you should run secondary filters and counting scripts to analyze them When you have a large static file and know the filters to eliminate lines from it, it is always ...



Only top voted, non community-wiki answers of a minimum length are eligible