Tag Info

Hot answers tagged

8

That's scary - smells like your ISP isn't isolating customers' broadcast domains, and this other customer simply has their netmask misconfigured as /24. If this is the case, then it's a pretty serious security risk, as they can effectively knock your devices offline or get traffic bound for your systems, either accidentally or maliciously. You can test by ...


6

Are you willing to accept working DNS a point of failure in your environment or not. Some services/applications will fail in certain configurations if a system cannot resolve the local machine's name. If you have an absolutely critical service that must be running in all situations, it isn't unusual to add a an entry in the hosts file so that service can ...


6

The solution for me happened to be straight forward. Create, validate new group; add required users to this group: Create: groupadd no-internet Validate: grep no-internet /etc/group Add user: useradd -g no-internet username Note: If you're modifying already existing user you should run: usermod -g no-internet username Create a script in your path and ...


5

The default chain names are most definitely involved in the packet flow. There are many diagrams all over the internet showing the various paths a packet might take through the chains, but in general for your scenario traffic from the machine will traverse output, and traffic to the machine will traverse input. They will traverse other chains too, but that ...


5

The destination unreachable ICMP packet is a standard Internet control message which indicates that there is no service available on that port. There's generally no reason to disable it (and you didn't give one). But if you really want to disable it, you can just change your firewall rules to drop packets rather than rejecting them. (Wait, you are ...


5

You can use any addresses in the following ranges: 10.x.x.x 192.168.x.x 172.16.x.x - 172.31.x.x As mentioned by others, your provider may have certain ranges or addresses reserved. If that is the case, they would probably let you know, since it would be completely irresponsible not to do so (you could break their network otherwise). See this wiki ...


5

This command iptables -t nat -A POSTROUTING -j MASQUERADE Is very overly broad because it is going to do NAT on every connection routed through this box irrespective of the source/destination. You should almost never use this rule without some other rules in place to limit it to a particular direction. This overly broad rule is almost never the right ...


4

You forgot the scope identifier, which is required to identify which link the link-local address you specified refers to. If the address you want is reachable through the eth1 interface, then you specify it: ping6 fe80::a00:27ff:fe77:9e77%eth1


4

It's all DNS resolution. If the DNS server is slow, it delays netstat. Pass -n to netstat when you invoke it to skip resolution and it'll often return immediately. The other cause of the delay is if you use the -p (-b in Windows) to return the process owner since some processes don't like to be queried if you're not root/Administrator.


4

The entry in /etc/sysconfig/network is where RHEL (and derivatives such as CentOS) set the hostname/nodename that you'll see reflected on for instance the prompt of your shell, in system and log messages etc. That is the hostname that will be returned by the gethostname(2) and uname system calls. A system only has one hostname/nodename, but it can have ...


4

It's easy to add next level of dot1q tagging to an interface manually - using the vconfig utility. Add a dot1q tag to interface: vconfig add eth0 34 After this you will have a eth0.34 interface. vconfig add eth0.34 56 This creates the eth0.34.56 See "man vconfig" for more detailed explanation. To make the configuration permanent you need to use the ...


4

Link local addresses are derived from the MAC address of the device. They are auto-generated as a part of bringing the interface up. Auto-configuration includes a discovery process to ensure that the address is unique on the network. A similar process is used to auto-configure routable addresses when a router advertisement is available. These addresses ...


4

if you have the IP address it is trying to connect to, just add it as an alias to an interface on eth port 5. Then your machine will now answer as that IP address and you should be able to use any HTTP server to send the file back. On the linux box assuming you have an ethernet interfaces called eth0 and eth1. Eth0 is connected to your ...


4

To check to make sure NetworkManager is installed run rpm -qa | grep chkconfig However, I'm going to assume you su'ed to root rather than su -. Without su - /sbin/chkconfig won't be in your path and you'll receive that error. Stop NetworkManager: service NetworkManager stop Remove Network Manager from startup Services: chkconfig NetworkManager off Add the ...


4

Open a terminal/console window and use -r (-c n). This will do what you want. Alternatively ssh into the server. Ubuntu - mtr 0.85 mtr -c 1 -r google.com Start: Sun Jan 26 15:19:11 2014 HOST: host1 Loss% Snt Last Avg Best Wrst StDev 1.|-- firewall 0.0% 1 0.8 0.8 0.8 0.8 0.0 2.|-- ...


3

Try using the package mtr-tiny on Debian to get it to work without GTK or ncurses. mtr-tiny is compiled without support for X and conserves disk space. root@mail:~# apt-cache show mtr-tiny Package: mtr-tiny Priority: optional Section: net Installed-Size: 120 Maintainer: Robert Woodcock <rcw@debian.org> Architecture: amd64 Source: mtr Version: ...


3

Make sure that you are allowing tcp port 2222 inboud from 0.0.0.0/0 on the security group for your nat box Make sure you have your VPC "Route Table" setup properly. At least two separate tables (one associated with the private subnet, one associated with the public subnet) Your 10.0.1.0 (private) subnet should have a route table rule like: Destination: ...


3

Your interfaces file has a bunch of problems in it. First, netmask isn't specified properly. Second, you're using the old way of aliasing, which doesn't really work anymore, and especially not with VLANs. Third, your route statement also uses the old style. Unfortunately, all of these are actually recommended in Debian's wiki and hundreds of old, outdated ...


3

Where to begin ... You have not told us the netmask - I assume these all on the same /24? If so, routing has absolutely nothing to do with this. These machines are all on the same subnet so there will be no routing. I assume you have two NICs in each server? And I also assume you are trying to connect by IP? If so, the IP that is associated with the down ...


3

The "magic" part is not the SNAT rule or the NAT table altogether, it is this routing table entry: default via 216.82.212.254 dev eth0 src 72.48.103.182 metric 100 it is telling your kernel to use 72.48.103.182 for outbound locally-initiated connections (as long as the socket is not explicitly bound to a specific address upon creation) if the ...


3

You can't see VLAN tag from tcpdump -i eth0 output on i686/x86_64 architecture because of VLAN acceleration. the VLAN layer will be filtered by kernel so it always looks untagged. Please refer to Bug 498981 - tcpdump cannot deal with 802.1q vlan tag According to your case, you can get VLAN tags via: tcpdump -Uw - | tcpdump -i eth0 -en -r - vlan 20 You ...


3

For whatever reason, you have an IPv6 address other than the link-local address, but it doesn't have a route to where that server is (most likely because it doesn't have a default route). IPv6 addresses can become configured a number of different ways. For instance, you might be running a teredo daemon (eg. miredo), you may have set up a script that sets ...


3

I would realize this with a simple cron job #!/bin/sh PING=$(ping $ETH0ISPGW -I eth0 -c1 -W5 | awk -F '[ /]*' '/rtt/ {print $8}') if [ -z "$PING" ]; then echo "Line is dead" echo "do something" else echo "everything ok" echo "$PING" fi If the line drops delete the specific rule , and let it send you an email, or ...


3

There is a DHCP option for that if you configure the networking dynamically on the host. If not, there is anycast: http://www.gsp.com/cgi-bin/man.cgi?topic=ntp.conf#19 if not, you can script nmap to scan the ntp ports, then try to ntpdate from open ports and if the host answers, add them to your config. However, I wouldn't do that. ever. This can pickup ...


3

On the surface it sounds like you just need a layer 2 Ethernet switch. Clarify for me, though, if you don't already have equipment handling the connection to "the cloud" where you host your replicated Cassandra cluster. You'll need a router (and, ideally, a firewall and potentially a network address translation facility since you're might use "internal IP ...


3

You can set up virtual interfaces by appending to the physical interface name :<n> where n is a number. $ ifconfig eth0:0 192.168.1.1 netmask 255.255.255.0 Using the ip utility, you can even specify a name: $ ip link add link eth0 name virt1 $ ip addr add 192.168.1.1/24 dev virt1


3

arping can help you in disvovering IP clashes. Just send an arping to the IP: # arping 172.16.10.1 ARPING 172.16.10.1 from 172.16.10.204 eth0 Unicast reply from 172.16.10.1 [00:10:DB:FC:11:00] 0.982ms Unicast reply from 172.16.10.1 [00:10:DB:FC:11:00] 0.966ms Unicast reply from 172.16.10.1 [00:10:DB:FC:11:00] 0.975ms Unicast reply from 172.16.10.1 ...


3

When your virtual machines use in-host virtual networking (they only communicate with the host or other VMs running under the same host) you can assign literally any IP address you want. But when you would like to communicate with VMs or bare-metal machines running on other servers, you will need to use the network infrastructure of your hosting provider, ...


3

If you reject the packet, you reply to the incoming SYN with a RST packet, so the scanner knows the port is closed (via reject, or because no service is running on that port). If you drop the packets, the scanner waits, and after some time (timeout), it assumes the packets have been dropped (although, they may be lost in transit, or the machine on the far ...


3

If your switch supports it, I would use 802.1ad link aggregation for providing failover. With this feature, you bond the two interfaces together, and you can set one as active and one as passive interface. Your IP address would reside on the bonding interface, so there would be no IP address changes if one NIC fails.



Only top voted, non community-wiki answers of a minimum length are eligible