Tag Info

Hot answers tagged

15

After looking at ping.c from iputils-ping Debian etch package, I see: /* * * pr_icmph -- * Print a descriptive string about an ICMP header. */ void pr_icmph(__u8 type, __u8 code, __u32 info, struct icmphdr *icp) { ... case ICMP_PKT_FILTERED: printf("Packet filtered\n"); break; ...


7

This is untested, but setting up something like this at the very end of sshd_config should work: PasswordAuthentication no PubkeyAuthentication yes RSAAuthentication yes Match Address 192.168.1.0/24 PasswordAuthentication yes Basically you're globally allowing public key auth, globally disallowing password auth, and then specifically re-allowing ...


7

ssl.record.version == 0x0301 That tells Wireshark to only display packets that are SSL conversations using TLS semantics.


6

Ping determines its printed message depending on the ICMP control message it receives in response to an echo-request. At a guess, I would imagine that whatever filtering device Eircom are using to block access to The Pirate Bay is generating either ICMP Type 3, Code 9 (network administratively prohibited) or Type 3, Code 10 (host administratively ...


6

The risks in turning it off are: Windows Firewall cannot operate Unpredictable behavior and event logging from other components and applications that may assume that Windows Filtering Platform is operating normally. No IPsec A prime example of "other components and apps" that use/need the WFP in various ways would be antivirus. But I'll hazard a guess ...


5

The -s flags selects only that traffic that matches the host or network specified. If you want to match all traffic except that, use ! -s 10.0.3.0/24 and don't forget to escape that ! from the shell with either quotes or a backslash.


5

No. tcp and port 10000 means "tcp port 10000" port 10000 means "tcp port 10000 or udp port 10000" and is a synonym for (tcp or udp) and port 10000 I would force TCP if I wanted, for example, to see only DNS packets that are being transported over TCP (as opposed to the default UDP). (tcpdump should have been named packetdump or netdump since it can ...


4

For the first question - yes, that would be possible. You'd have the DNS for your webservers set to the server running SNORT, and have that server forward the traffic to the actual webserver. That's one of the standard ways to set up a firewall/filtering server. For the second - that's a question that invites a long discussion, something doesn't really fit ...


4

One installation method for Snort is called in-line mode. In this configuration your snort sensor will be a choke point for your traffic, much like a traditional router or firewall. All packets will be received on the outside interface, passed through the snort application, and then forwarded onto the inside interface. If done correctly it will be ...


4

You could always do something like this in the top of each built-in chain: iptables -I INPUT -i eth1 -j eth1chain iptables -I INPUT -i eth1 -j DROP Then whack whatever rules you want into eth1chain to allow traffic (you can skip putting the -i eth1 into those chains, too!), and leave the policy on the main chain as ACCEPT. However, I wouldn't recommend ...


4

The source-track option does apply per-rule, so you are not restricting "Google to X req/day", you are restricting each individual address to that limit. I give you two solutions here. One is simple and approximate, the other is harder and sharper. Solution 1 Transform the condition so as to match all servers of interest in one rule. The simplest approach ...


4

Pfsense can do most of this if you add extra packages which are easily installable inside the distribution. It is also very stable and intuitive to use.


4

No, tc is not for firewalling. Use ebtables instead.


3

I don't think the anti-spam component is enabled by default. This article shows you how to enable it. http://www.petri.co.il/install-anti-spam-exchange-2007.htm


3

That means that device 159.134.124.176 is blocking ICMP (Ping) packets and replying back to you with that information. The possible ICMP replies are listed in this Wiki article.


3

Set up different instances of postfix with the listener in the subnet, set mynetworks to be that subnet, don't allow mail from elsewhere, set the corporate mail domain as a valid relay domain. This is quite simple with check_sender_access. Create an allowed sender group, with check_sender_access you can allow or disallow by IP or subnet also. Have a look at ...


3

Is there any particular reason why your server has to answer to external queries at all ? Ideally, you would setup an external resolver for your public resolver (used to resolve all resources that must be accessed externally: MX, web server, etc), use the windows DNS server only for your internal network and block all incoming DNS queries at your perimeter. ...


3

The browser knows it's connecting to a proxy, it's not really "fooled". There are passive proxies that you can setup, but still the browser will know that proxy is there the first time it hits an encrypted URL if the proxy doesn't just route the traffic through untouched. Often the connection to the proxy server is either always encrypted or always ...


3

How do proxy servers filter HTTPS websites? It isn't very easy. You have a couple poor choices, each with there own problems. You can do it purely on the NAME/IP passed via the HTTP CONNECT request. Meaning you are likely to have lots of false positives/negatives. You can perform a MITM attact. With a couple products in a corporate environment, a ...


3

This worked for me - not exactly as described above, but close enough: awk '/ERROR|WARN/,/DEBUG|INFO/ { if ($0 !~ /(DEBUG|INFO)/) { print } }' < logfile Very convenient that awk supports this: /startpattern/,/stoppattern/ { }. Unfortunately if the stop pattern is matched on the same line as the start pattern, it prints out that line only, hence the ...


2

Try something like this: cat importantstuff.log | grep 'File .*, line .*, in .*' -B 1 -A 2 Doesn't exactly answer the question, but I think it accomplishes the task. The -A and -B flags for grep control lines of context after or before your match. This works because grep groups adjacent matches, so you end up with nicely separated tracebacks: Traceback ...


2

Firstly, why do you have two subnets contained in the same VLAN?. Although, that's not your problem here. I can't speak to the syntax of the commands as I haven't configured HP ProCurves, but it seems your logic is off. Instead of filtering inbound traffic on your uplink, you should be filtering outbound traffic. The uplink interface wouldn't receive ...


2

The proper way to solve this problem is to host your demo website somewhere that is designed to host websites. Your home cable connection is not designed for this purpose and trying to host a website, even a demo website, from home will only cause you grief. A free-tier EC2 instance from Amazon can be created from scratch in about 30 minutes, which is ...


2

You will probably want to utilize your web analytics tools for this purpose. You should probably start with a visit to the Google Ads Ad Traffic Quality Resource Center. Here is an InsideAdWords blog post with good information on the topic.


2

Would it then be possible to route ALL my traffic through it like a firewall to my websites? Not only is it possible, but it's exactly how you should setup an IPS if you want it to actually drop bad traffic. If not, then it becomes an IDS and will only flag bad traffic. The only part of your question I do not agree with is when you compare Snort with a ...


2

Install a (transparent) proxy and configure it to block whatever URLs and patterns you want. This isn't possible to do at anything below layer 7 (I count DPI as a layer 7 technology), because nothing below that has any idea of the concept of a "URL".


2

ping receives a ICMP_DEST_UNREACH and depending on the type of returned icmp package returned ping knows that it's filtered.


2

This all assumes that you want to collect info on bounces rather than the bounced email itself: I have pretty much the same setup with postfix, mysql, and virtual hosts. From n hardware resource perspective the most efficient way to keep track of this is to parse the log files as you are doing. But if you think how you're parsing is to big of a load, you ...


2

What compression are you using? SQL 2005 doesn't support compression. The way the row filtering works is that when the snapshot is taken a WHERE clause is put on the select statement that BCP uses to export the data. When the data is being transfered the data is run against the filter and if it matches the filter then the data is transmitted. If the data ...


2

Reading through large log files is not a good idea you need to first filter them to the necessary lines and then look at them even then, if possible (and if the filtered lines are a lot too), you should run secondary filters and counting scripts to analyze them When you have a large static file and know the filters to eliminate lines from it, it is always ...



Only top voted, non community-wiki answers of a minimum length are eligible