Tag Info

Hot answers tagged

11

To do this you can make usage of tc alone with u32 filters or combined with iptables marking (maybe more straightforward if you don't want to learn the complex filters syntax). I'll in the following post detail the former solution. Simulating your setup As an example, let's consider A, B, C and D running 10 Mbit/s virtual interfaces. You basically want ...


9

Are you willing to accept working DNS a point of failure in your environment or not. Some services/applications will fail in certain configurations if a system cannot resolve the local machine's name. If you have an absolutely critical service that must be running in all situations, it isn't unusual to add a an entry in the hosts file so that service can ...


9

Clearly you have an interference problem. Interference can come from passive elements like aluminum wall studs or thick floors, but those are not likely to show the periodic pattern you see. So something electric or electronic is periodically emitting. Finding it may be expensive or tough, but you have a few options. Graph more. It would be nice to make ...


8

That's scary - smells like your ISP isn't isolating customers' broadcast domains, and this other customer simply has their netmask misconfigured as /24. If this is the case, then it's a pretty serious security risk, as they can effectively knock your devices offline or get traffic bound for your systems, either accidentally or maliciously. You can test by ...


8

You can use any private addresses you want, that's kind of their definition. (That said, there are cases like running private networks inside a provider where they may need to set up or give you the private addresses for internal routing/switching reasons)


8

What you've been told is right, although you've written it wrong (you've forgotten --dport). iptables -A INPUT -p tcp --dport 1000:2000 will open up inbound traffic to TCP ports 1000 to 2000 inclusive. -m multiport --dports is only needed if the range you want to open is not continuous, eg -m multiport --dports 80,443, which will open up HTTP and HTTPS ...


7

This is the correct way: iptables -A INPUT -p tcp --match multiport --dports 1024:3000 -j ACCEPT As an example. Source here.


6

You forgot the scope identifier, which is required to identify which link the link-local address you specified refers to. If the address you want is reachable through the eth1 interface, then you specify it: ping6 fe80::a00:27ff:fe77:9e77%eth1


6

OK, this question is asked over and over again over the Internet and most of the time there is a (semi-) incorrect answer that you cannot do what was described in the original post. Let me clarify it once and for all :) The short answer is L2TP (and PPTP for that matter) do not have facilities to do route pushes inside the protocol, but it can be achieved ...


6

This is not achievable natively within the TCP/IP protocol, because... well, that's just not how the protocol works - it doesn't have a concept of users, and is designed to just transfer data between devices. The way this is generally done (rate-limiting a specific remote user) is through the use of sessions (layer 5 in your OSI networking model, which is 1 ...


6

Yes, you can use the Ident protocol to identify the user at the source. Well, you used to be able to. Nowadays the only people who expose ident servers to the Internet at large are IRC users who want a funky nickname. Oh, and people who've misconfigured their systems.


5

It's all DNS resolution. If the DNS server is slow, it delays netstat. Pass -n to netstat when you invoke it to skip resolution and it'll often return immediately. The other cause of the delay is if you use the -p (-b in Windows) to return the process owner since some processes don't like to be queried if you're not root/Administrator.


5

When the socket is in TIME_WAIT, there is no process attached to it anymore and the kernel is just holding it in case some other packet arrives. At this point, the software the originally opened this socket does not have a open file description to it anymore. That's why you can't find any relation to it. The socket that existed in /proc/$PID/fd is not there ...


5

Remove the gateway defined for eth0 (192.168.5.1). If you need multiple default routes you'll have to use iproute2 to create a policy for it.


5

There's no difference; dev is optional provided the device name can't be mistaken for another keyword that the ip command understands. For instance, if you had an interface named bridge then you would have to use dev as bridge is also a keyword that ip uses. This is undocumented behavior, but it certainly appears to work. You'll know if you ran afoul of ...


5

That image says that the maximum UDP transfer rate over 1gbps ethernet is 119635891 Bytes per second. Multiple 119635891 with 8 (one byte is 8 bits) and you get 957087128 == 957,08mbps


4

I found a better solution for you: sysctl net.ipv4.ip_forward=1 iptables -t nat -A PREROUTING -p tcp --dport port -j DNAT --to-destination ip:port


4

You can use any addresses in the following ranges: 10.x.x.x 192.168.x.x 172.16.x.x - 172.31.x.x As mentioned by others, your provider may have certain ranges or addresses reserved. If that is the case, they would probably let you know, since it would be completely irresponsible not to do so (you could break their network otherwise). See this wiki ...


4

The entry in /etc/sysconfig/network is where RHEL (and derivatives such as CentOS) set the hostname/nodename that you'll see reflected on for instance the prompt of your shell, in system and log messages etc. That is the hostname that will be returned by the gethostname(2) and uname system calls. A system only has one hostname/nodename, but it can have ...


4

If you reject the packet, you reply to the incoming SYN with a RST packet, so the scanner knows the port is closed (via reject, or because no service is running on that port). If you drop the packets, the scanner waits, and after some time (timeout), it assumes the packets have been dropped (although, they may be lost in transit, or the machine on the far ...


4

The "default" routes are set based on the GATEWAY lines in your ifcfg-<interface> files. As Dom mentioned in his comment, if you remove the incorrect GATEWAY line, your routing table will be as you expect.


4

This is a quote directly from the Docker OS X page The Docker Engine uses Linux-specific kernel features, so to run it on OS X we need to use a lightweight virtual machine (vm). You use the OS X Docker client to control the virtualized Docker Engine to build, run, and manage Docker containers. The rest of the page goes on to explain how to install ...


4

You could obtain the number by using Wireshark on your machine. This is a very common packet analyzer. Here is some good documentation on how to use it. There's a plethora of resources on it though.


4

No, there is no such logfile. You have to specifically set up logging to do that, and I am not aware of a standard way to do it. It may not be easy to do it accurately: a user may cause a process that isn't owned by that user to generate network traffic and it may not be trivial to ascribe that traffic to that user. See e.g. this near-duplicate question or ...


4

The iLO RAC is a completely separate NIC. If you want the OS to have a network connection you must also connect the on-board NIC to the network. I'm guessing you don't have the NIC plugged in, and Ubuntu has no magical powers to make a network connection out of an unplugged NIC.


4

I found that you can return to the default network namespace with two simple commands: ln -s /proc/1/ns/net /var/run/netns/default ip netns exec default ifconfig -a This method obviously assumes that you can see processes outside your own namespace through the proc file system. If you are in a separate PID namespace as well, returning to the default ...


4

Newer distros/kernels support the nsenter command which, should do what you want, providing you are root when you do it. Here is an example (Fedora 20). [root@home ~]# unshare -n /bin/bash [root@home ~]# ip a l 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 [root@home ~]# ...


4

iptables and ebtables can't set VLAN tags on packets. That's what VLAN sub-interfaces are for. There's an article on the Ubunut wiki that discusses VLANs that you should probably review. In summary, though, you want to: Make sure the 802.1q module is loaded with a modprobe 80211q. Create the VLAN sub-interface with vconfig add eth0 444. Add an IP ...


3

If your switch supports it, I would use 802.1ad link aggregation for providing failover. With this feature, you bond the two interfaces together, and you can set one as active and one as passive interface. Your IP address would reside on the bonding interface, so there would be no IP address changes if one NIC fails.


3

I believe you created an orphan socket by killing the connection on the .137 server. So, the kernel parameter in use would be tcp_orphan_retries - which has a generic linux default of 7. You can get a description of both the condition you created and the results here: http://www.linuxinsight.com/proc_sys_net_ipv4_tcp_orphan_retries.html



Only top voted, non community-wiki answers of a minimum length are eligible