Tag Info

Hot answers tagged

8

That's scary - smells like your ISP isn't isolating customers' broadcast domains, and this other customer simply has their netmask misconfigured as /24. If this is the case, then it's a pretty serious security risk, as they can effectively knock your devices offline or get traffic bound for your systems, either accidentally or maliciously. You can test by ...


8

You can use any private addresses you want, that's kind of their definition. (That said, there are cases like running private networks inside a provider where they may need to set up or give you the private addresses for internal routing/switching reasons)


7

Are you willing to accept working DNS a point of failure in your environment or not. Some services/applications will fail in certain configurations if a system cannot resolve the local machine's name. If you have an absolutely critical service that must be running in all situations, it isn't unusual to add a an entry in the hosts file so that service can ...


7

The solution for me happened to be straight forward. Create, validate new group; add required users to this group: Create: groupadd no-internet Validate: grep no-internet /etc/group Add user: useradd -g no-internet username Note: If you're modifying already existing user you should run: usermod -g no-internet username Create a script in your path and ...


6

Fixed. The router/firewall or Gateway was 192.168.2.253.


6

OK, this question is asked over and over again over the Internet and most of the time there is a (semi-) incorrect answer that you cannot do what was described in the original post. Let me clarify it once and for all :) The short answer is L2TP (and PPTP for that matter) do not have facilities to do route pushes inside the protocol, but it can be achieved ...


6

This is not achievable natively within the TCP/IP protocol, because... well, that's just not how the protocol works - it doesn't have a concept of users, and is designed to just transfer data between devices. The way this is generally done (rate-limiting a specific remote user) is through the use of sessions (layer 5 in your OSI networking model, which is 1 ...


6

Yes, you can use the Ident protocol to identify the user at the source. Well, you used to be able to. Nowadays the only people who expose ident servers to the Internet at large are IRC users who want a funky nickname. Oh, and people who've misconfigured their systems.


5

When the socket is in TIME_WAIT, there is no process attached to it anymore and the kernel is just holding it in case some other packet arrives. At this point, the software the originally opened this socket does not have a open file description to it anymore. That's why you can't find any relation to it. The socket that existed in /proc/$PID/fd is not there ...


5

You can use any addresses in the following ranges: 10.x.x.x 192.168.x.x 172.16.x.x - 172.31.x.x As mentioned by others, your provider may have certain ranges or addresses reserved. If that is the case, they would probably let you know, since it would be completely irresponsible not to do so (you could break their network otherwise). See this wiki ...


5

What you've been told is right, although you've written it wrong (you've forgotten --dport). iptables -A INPUT -p tcp --dport 1000:2000 will open up inbound traffic to TCP ports 1000 to 2000 inclusive. -m multiport --dports is only needed if the range you want to open is not continuous, eg -m multiport --dports 80,443, which will open up HTTP and HTTPS ...


5

This command iptables -t nat -A POSTROUTING -j MASQUERADE Is very overly broad because it is going to do NAT on every connection routed through this box irrespective of the source/destination. You should almost never use this rule without some other rules in place to limit it to a particular direction. This overly broad rule is almost never the right ...


5

The default chain names are most definitely involved in the packet flow. There are many diagrams all over the internet showing the various paths a packet might take through the chains, but in general for your scenario traffic from the machine will traverse output, and traffic to the machine will traverse input. They will traverse other chains too, but that ...


4

if you have the IP address it is trying to connect to, just add it as an alias to an interface on eth port 5. Then your machine will now answer as that IP address and you should be able to use any HTTP server to send the file back. On the linux box assuming you have an ethernet interfaces called eth0 and eth1. Eth0 is connected to your ...


4

To check to make sure NetworkManager is installed run rpm -qa | grep chkconfig However, I'm going to assume you su'ed to root rather than su -. Without su - /sbin/chkconfig won't be in your path and you'll receive that error. Stop NetworkManager: service NetworkManager stop Remove Network Manager from startup Services: chkconfig NetworkManager off Add the ...


4

You can't see VLAN tag from tcpdump -i eth0 output on i686/x86_64 architecture because of VLAN acceleration. the VLAN layer will be filtered by kernel so it always looks untagged. Please refer to Bug 498981 - tcpdump cannot deal with 802.1q vlan tag According to your case, you can get VLAN tags via: tcpdump -Uw - | tcpdump -i eth0 -en -r - vlan 20 You ...


4

I found a better solution for you: sysctl net.ipv4.ip_forward=1 iptables -t nat -A PREROUTING -p tcp --dport port -j DNAT --to-destination ip:port


4

You forgot the scope identifier, which is required to identify which link the link-local address you specified refers to. If the address you want is reachable through the eth1 interface, then you specify it: ping6 fe80::a00:27ff:fe77:9e77%eth1


4

Open a terminal/console window and use -r (-c n). This will do what you want. Alternatively ssh into the server. Ubuntu - mtr 0.85 mtr -c 1 -r google.com Start: Sun Jan 26 15:19:11 2014 HOST: host1 Loss% Snt Last Avg Best Wrst StDev 1.|-- firewall 0.0% 1 0.8 0.8 0.8 0.8 0.0 2.|-- ...


4

The "default" routes are set based on the GATEWAY lines in your ifcfg-<interface> files. As Dom mentioned in his comment, if you remove the incorrect GATEWAY line, your routing table will be as you expect.


4

This is a quote directly from the Docker OS X page The Docker Engine uses Linux-specific kernel features, so to run it on OS X we need to use a lightweight virtual machine (vm). You use the OS X Docker client to control the virtualized Docker Engine to build, run, and manage Docker containers. The rest of the page goes on to explain how to install ...


4

If you reject the packet, you reply to the incoming SYN with a RST packet, so the scanner knows the port is closed (via reject, or because no service is running on that port). If you drop the packets, the scanner waits, and after some time (timeout), it assumes the packets have been dropped (although, they may be lost in transit, or the machine on the far ...


4

This is the correct way: iptables -A INPUT -p tcp --match multiport --dports 1024:3000 -j ACCEPT As an example. Source here.


4

It's all DNS resolution. If the DNS server is slow, it delays netstat. Pass -n to netstat when you invoke it to skip resolution and it'll often return immediately. The other cause of the delay is if you use the -p (-b in Windows) to return the process owner since some processes don't like to be queried if you're not root/Administrator.


4

The entry in /etc/sysconfig/network is where RHEL (and derivatives such as CentOS) set the hostname/nodename that you'll see reflected on for instance the prompt of your shell, in system and log messages etc. That is the hostname that will be returned by the gethostname(2) and uname system calls. A system only has one hostname/nodename, but it can have ...


4

You could obtain the number by using Wireshark on your machine. This is a very common packet analyzer. Here is some good documentation on how to use it. There's a plethora of resources on it though.


4

No, there is no such logfile. You have to specifically set up logging to do that, and I am not aware of a standard way to do it. It may not be easy to do it accurately: a user may cause a process that isn't owned by that user to generate network traffic and it may not be trivial to ascribe that traffic to that user. See e.g. this near-duplicate question or ...


3

The iLO RAC is a completely separate NIC. If you want the OS to have a network connection you must also connect the on-board NIC to the network. I'm guessing you don't have the NIC plugged in, and Ubuntu has no magical powers to make a network connection out of an unplugged NIC.


3

You can do this by using policy-based routing to hint to Linux to prefer particular interfaces for specific traffic. However, the setup you're using here looks very unstable and you're going to HAVE LOTS OF PAIN in the future.


3

Typically enterprise class server hardware comes with provisions for out of band management, either based on the open IPMI standard or the more proprietary options such as HP's ILO, Dell's DRAC, Oracle/SUN ILOM. As @Jose Flores mentioned some datacenter providers have managed PDU's that allow you to remotely power cycle your servers.



Only top voted, non community-wiki answers of a minimum length are eligible