Hot answers tagged

3

No iptables rule will ever close an existing TCP connection as that involves actively transmitting a message with the FIN bit. That is done by the application and not by a packet filter. On the other hand iptables can, at any moment, block your application from receiving or transmitting new packets over any existing connection and it can also deny any new ...


3

You might want to add a null route for that specific ip address. Although, this makes ALL communication to the address impossible, this accomplishes what you need. You can find examples online of this. one of them. http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html Something like this route add -host IP-ADDRESS ...


2

This card should work natively without any changes. Just remove your 70-persistent-net.rules/reboot and/or check dmesg output. You may have an issue with a UUID or MAC in the /etc/sysconfig/network-scripts/ifcfg-ethX files. If neither of those are the case, download the driver from Mellanox or HP. # modinfo mlx4_en filename: /lib/modules/2.6.32-...


2

Probably what's happening is that you're seeing IPv6 broadcast traffic on your subnet, as per what you posted from a tcpdump output here: 12:19:41.622297 IP6 (hlim 1, next-header UDP (17) payload length: 112) fe80::a4a0:460b:c99a:c992.dhcpv6-client > ff02::1:2.dhcpv6-server: [udp sum ok] dhcp6 solicit (xid=455863 (elapsed-time 700) (client-ID hwaddr/time ...


2

This is expected behavior when you have unmatched speed and are running mismatched speeds. If you are able to saturate the 1GB link, the other end will have read only 100 packets by the time you have sent the 1000 packets. It is unlikely your router will buffer the remaining 900 packets. UDP is an unreliable protocol. Unlike TCP it does not come with a ...


2

You can't just randomly assigned an IP address from somewhere else to your server and hope it'll work (well, you can, but your hope will be in vain). In order for a packet assigned to that IP to reach your server, some routing configuration needs to be done. Your options are: Have a machine in the UK behind the router where the network thinks your IP is, ...


2

Unless you have bought the address from OVH and they told you that you would be able to use it for the server in France (which is extremely unlikely), this will not work. In general, IP addresses, unlike domain names, are bound to physical networks and you can't just randomly assign an address to some host in a totally different network. Please read up ...


2

It looks like you are running a newer OpenSSH client (OpenSSH 7.2p2) against an older OpenSSH server (OpenSSH 6.6.1p1). In the OpenSSH 7.1p2 release notes, it mentions: ssh(1), sshd(8): increase the minimum modulus size supported for diffie-hellman-group-exchange to 2048 bits. From the error message reported, it looks like it is your client ...


1

You can't do what you want to do. There is no single command that will give you the information you want. Additionally, there can be multiple forward (A) records for a a single IP address as well as CNAME records all of which are hostnames for the system. You could try dumping your DNS config and searching for all records that have the same IP addrress, ...


1

You can't get this information at all, at least in a reliable and complete way. The system doesn't need to be aware of what DNS names for what domain are pointing to it. If PTR records are defined, you can get these like Brennen described, but everything else is unreliable. As an example, nothing prevents me from setting up DNS entries for any IP ...


1

Essentially, you can't because the data is gone. Cacti uses rrdtool to store the data and this tool works by storing detailed records for only a short time and then aggregating this data into lower time resolution for longer time periods. As an example, it might store data in 5 minute intervals for a day 30 min intervals for a week (averaging 6 of the ...


1

The normal way to handle multi-site fail over is to have a pair of load balancers on site A in a master/slave fail over config. Then put an identical pair on the remote site. If ALL the backend servers on site A fail then use the public VIP on site B as the fallback (high latencey of course across the WAN)... But back this up with a proper DNS based load ...


1

You could use HAProxy, or Nginx, or ATS, or Squid, or Pound or just a set of iptables rules. But you've not told us very much about the problem you are trying to solve. If the service requires a nominated IP address, then presumably it has some value which should be protected - anything you put in place should ensure that there is equivalent or better ...


1

Make sure you have the same config on OSX and Ubuntu. Looks like after connection is established, you don't receive message that "hey, I (the gate you connected to) can route to 10.0.3.x and 10.1.25.x as well!" Make sure your subnets are correct: 10.1.22.185 can be outside of 10.1.25.x Re-check route table (locally)/router(s) in VPC, security groups/...


1

Try looking at the output without the wc -l. The pattern '10.241.169.7' matches 11 addresses. You may want a pattern like ^tcp.*10.241.169.7:.*ESTABLISED which reduces the number of commands required. You don't need sudo nor all the netstat options. Try a command like: netstat -nt | grep `^tcp.*10.241.169.7:.*ESTABLISED` | wc -l


1

Probably your CentOS servers are sending the hostname to the DHCP server and this is updating the DNS. One way to disable it is using nmcli (use ipv6.dhcp-send-hosname if you are using IPv6): nmcli c m "System eth0" ipv4.dhcp-send-hostname no You must set that configuration for all the connections (you can list them with nmcli c s -a). I believe that ...



Only top voted, non community-wiki answers of a minimum length are eligible