Tag Info

Hot answers tagged

8

That's scary - smells like your ISP isn't isolating customers' broadcast domains, and this other customer simply has their netmask misconfigured as /24. If this is the case, then it's a pretty serious security risk, as they can effectively knock your devices offline or get traffic bound for your systems, either accidentally or maliciously. You can test by ...


8

You can use any private addresses you want, that's kind of their definition. (That said, there are cases like running private networks inside a provider where they may need to set up or give you the private addresses for internal routing/switching reasons)


8

What you've been told is right, although you've written it wrong (you've forgotten --dport). iptables -A INPUT -p tcp --dport 1000:2000 will open up inbound traffic to TCP ports 1000 to 2000 inclusive. -m multiport --dports is only needed if the range you want to open is not continuous, eg -m multiport --dports 80,443, which will open up HTTP and HTTPS ...


7

Are you willing to accept working DNS a point of failure in your environment or not. Some services/applications will fail in certain configurations if a system cannot resolve the local machine's name. If you have an absolutely critical service that must be running in all situations, it isn't unusual to add a an entry in the hosts file so that service can ...


6

You forgot the scope identifier, which is required to identify which link the link-local address you specified refers to. If the address you want is reachable through the eth1 interface, then you specify it: ping6 fe80::a00:27ff:fe77:9e77%eth1


6

OK, this question is asked over and over again over the Internet and most of the time there is a (semi-) incorrect answer that you cannot do what was described in the original post. Let me clarify it once and for all :) The short answer is L2TP (and PPTP for that matter) do not have facilities to do route pushes inside the protocol, but it can be achieved ...


6

This is the correct way: iptables -A INPUT -p tcp --match multiport --dports 1024:3000 -j ACCEPT As an example. Source here.


6

This is not achievable natively within the TCP/IP protocol, because... well, that's just not how the protocol works - it doesn't have a concept of users, and is designed to just transfer data between devices. The way this is generally done (rate-limiting a specific remote user) is through the use of sessions (layer 5 in your OSI networking model, which is 1 ...


6

Yes, you can use the Ident protocol to identify the user at the source. Well, you used to be able to. Nowadays the only people who expose ident servers to the Internet at large are IRC users who want a funky nickname. Oh, and people who've misconfigured their systems.


5

When the socket is in TIME_WAIT, there is no process attached to it anymore and the kernel is just holding it in case some other packet arrives. At this point, the software the originally opened this socket does not have a open file description to it anymore. That's why you can't find any relation to it. The socket that existed in /proc/$PID/fd is not there ...


5

Remove the gateway defined for eth0 (192.168.5.1). If you need multiple default routes you'll have to use iproute2 to create a policy for it.


5

This command iptables -t nat -A POSTROUTING -j MASQUERADE Is very overly broad because it is going to do NAT on every connection routed through this box irrespective of the source/destination. You should almost never use this rule without some other rules in place to limit it to a particular direction. This overly broad rule is almost never the right ...


4

I found a better solution for you: sysctl net.ipv4.ip_forward=1 iptables -t nat -A PREROUTING -p tcp --dport port -j DNAT --to-destination ip:port


4

Open a terminal/console window and use -r (-c n). This will do what you want. Alternatively ssh into the server. Ubuntu - mtr 0.85 mtr -c 1 -r google.com Start: Sun Jan 26 15:19:11 2014 HOST: host1 Loss% Snt Last Avg Best Wrst StDev 1.|-- firewall 0.0% 1 0.8 0.8 0.8 0.8 0.0 2.|-- ...


4

Make sure that you are allowing tcp port 2222 inboud from 0.0.0.0/0 on the security group for your nat box Make sure you have your VPC "Route Table" setup properly. At least two separate tables (one associated with the private subnet, one associated with the public subnet) Your 10.0.1.0 (private) subnet should have a route table rule like: Destination: ...


4

You can use any addresses in the following ranges: 10.x.x.x 192.168.x.x 172.16.x.x - 172.31.x.x As mentioned by others, your provider may have certain ranges or addresses reserved. If that is the case, they would probably let you know, since it would be completely irresponsible not to do so (you could break their network otherwise). See this wiki ...


4

It's all DNS resolution. If the DNS server is slow, it delays netstat. Pass -n to netstat when you invoke it to skip resolution and it'll often return immediately. The other cause of the delay is if you use the -p (-b in Windows) to return the process owner since some processes don't like to be queried if you're not root/Administrator.


4

The entry in /etc/sysconfig/network is where RHEL (and derivatives such as CentOS) set the hostname/nodename that you'll see reflected on for instance the prompt of your shell, in system and log messages etc. That is the hostname that will be returned by the gethostname(2) and uname system calls. A system only has one hostname/nodename, but it can have ...


4

If you reject the packet, you reply to the incoming SYN with a RST packet, so the scanner knows the port is closed (via reject, or because no service is running on that port). If you drop the packets, the scanner waits, and after some time (timeout), it assumes the packets have been dropped (although, they may be lost in transit, or the machine on the far ...


4

The iLO RAC is a completely separate NIC. If you want the OS to have a network connection you must also connect the on-board NIC to the network. I'm guessing you don't have the NIC plugged in, and Ubuntu has no magical powers to make a network connection out of an unplugged NIC.


4

No, there is no such logfile. You have to specifically set up logging to do that, and I am not aware of a standard way to do it. It may not be easy to do it accurately: a user may cause a process that isn't owned by that user to generate network traffic and it may not be trivial to ascribe that traffic to that user. See e.g. this near-duplicate question or ...


4

I found that you can return to the default network namespace with two simple commands: ln -s /proc/1/ns/net /var/run/netns/default ip netns exec default ifconfig -a This method obviously assumes that you can see processes outside your own namespace through the proc file system. If you are in a separate PID namespace as well, returning to the default ...


4

Newer distros/kernels support the nsenter command which, should do what you want, providing you are root when you do it. Here is an example (Fedora 20). [root@home ~]# unshare -n /bin/bash [root@home ~]# ip a l 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 [root@home ~]# ...


4

This is a quote directly from the Docker OS X page The Docker Engine uses Linux-specific kernel features, so to run it on OS X we need to use a lightweight virtual machine (vm). You use the OS X Docker client to control the virtualized Docker Engine to build, run, and manage Docker containers. The rest of the page goes on to explain how to install ...


4

The "default" routes are set based on the GATEWAY lines in your ifcfg-<interface> files. As Dom mentioned in his comment, if you remove the incorrect GATEWAY line, your routing table will be as you expect.


4

You could obtain the number by using Wireshark on your machine. This is a very common packet analyzer. Here is some good documentation on how to use it. There's a plethora of resources on it though.


4

iptables and ebtables can't set VLAN tags on packets. That's what VLAN sub-interfaces are for. There's an article on the Ubunut wiki that discusses VLANs that you should probably review. In summary, though, you want to: Make sure the 802.1q module is loaded with a modprobe 80211q. Create the VLAN sub-interface with vconfig add eth0 444. Add an IP ...


3

802.1Q tag is inserted into MAC header, and kernel won't decode it if your interface isn't VLAN tagged. So, even if you could mangle outgoing packets, incoming traffic with VLAN tag would stay ignored. What you need to do is create a VLAN tagged interface, just as you did, and add an IP to it within the same rage the switch IP you're trying to access is in. ...


3

You can do this by using policy-based routing to hint to Linux to prefer particular interfaces for specific traffic. However, the setup you're using here looks very unstable and you're going to HAVE LOTS OF PAIN in the future.


3

Clearly you have an interference problem. Interference can come from passive elements like aluminum wall studs or thick floors, but those are not likely to show the periodic pattern you see. So something electric or electronic is periodically emitting. Finding it may be expensive or tough, but you have a few options. Graph more. It would be nice to make ...



Only top voted, non community-wiki answers of a minimum length are eligible