Tag Info

Hot answers tagged

11

To do this you can make usage of tc alone with u32 filters or combined with iptables marking (maybe more straightforward if you don't want to learn the complex filters syntax). I'll in the following post detail the former solution. Simulating your setup As an example, let's consider A, B, C and D running 10 Mbit/s virtual interfaces. You basically want ...


9

Clearly you have an interference problem. Interference can come from passive elements like aluminum wall studs or thick floors, but those are not likely to show the periodic pattern you see. So something electric or electronic is periodically emitting. Finding it may be expensive or tough, but you have a few options. Graph more. It would be nice to make ...


9

If you really need a quick way to transfer files, and both systems are Linux-based, you can try UDR. This is really a form of rsync-over-UDP (using the open-source UDT framework) and is particularly handy for moving large numbers of files or transferring over high-bandwidth or high-latency links. In addition, encryption is disabled by default, so the ...


8

You want eth1 and eth2 on the same subnet so they should be on the same ethernet link: you should configure your linux box as a bridge between eth1 and eth2. This will create a new network interface (named br0 below): the kernel will work as a switch bridging your eth1 and eth2 (at layer 2). The IP configuration will be done on br0 instead of eth1 and eth2 ...


7

The problem is that you can't refer multiple IP ranges in a single iptables rule, but using multiple rules indirectly leads to a disjunction (logical OR): connections will be logged if they match your first, OR your second rule. What you want, is a conjunctive behavior (logical AND): new connections coming out of 10.51.0.0/16, AND also out of ...


7

I do exactly that. The test is pretty trivial, inasmuch as it connects to a custom database called nagios and selects from a table that contains just a single numeric value, alerting if that value isn't 74581 - but I figure if mysql works well enough to retrieve that exact number from a table, it's probably fine. You could run more complex queries, though. ...


7

The order of reboots is important. Rebooting the server after the clients can result in this situation. The stale NFS handle indicates that the client has a file open, but the server no longer recognizes the file handle. In some cases, NFS will cleanup its data structures after a timeout. In other cases, you will need to clean the NFS data structures ...


7

I found that you can return to the default network namespace with two simple commands: ln -s /proc/1/ns/net /var/run/netns/default ip netns exec default ifconfig -a This method obviously assumes that you can see processes outside your own namespace through the proc file system. If you are in a separate PID namespace as well, returning to the default ...


6

This is not achievable natively within the TCP/IP protocol, because... well, that's just not how the protocol works - it doesn't have a concept of users, and is designed to just transfer data between devices. The way this is generally done (rate-limiting a specific remote user) is through the use of sessions (layer 5 in your OSI networking model, which is 1 ...


6

Yes, you can use the Ident protocol to identify the user at the source. Well, you used to be able to. Nowadays the only people who expose ident servers to the Internet at large are IRC users who want a funky nickname. Oh, and people who've misconfigured their systems.


6

Incoming connections are always going to match one of those rules aren't they? A connection from 10.51.0.1 for example won't get logged by the first rule but will hit the second one. Don't you need the equivalent of !10.51.0.0/16 && !192.168.0.0/16 (probably not valid syntax but correct logically).


5

When the socket is in TIME_WAIT, there is no process attached to it anymore and the kernel is just holding it in case some other packet arrives. At this point, the software the originally opened this socket does not have a open file description to it anymore. That's why you can't find any relation to it. The socket that existed in /proc/$PID/fd is not there ...


5

You could obtain the number by using Wireshark on your machine. This is a very common packet analyzer. Here is some good documentation on how to use it. There's a plethora of resources on it though.


5

Remove the gateway defined for eth0 (192.168.5.1). If you need multiple default routes you'll have to use iproute2 to create a policy for it.


5

That image says that the maximum UDP transfer rate over 1gbps ethernet is 119635891 Bytes per second. Multiple 119635891 with 8 (one byte is 8 bits) and you get 957087128 == 957,08mbps


5

There's no difference; dev is optional provided the device name can't be mistaken for another keyword that the ip command understands. For instance, if you had an interface named bridge then you would have to use dev as bridge is also a keyword that ip uses. This is undocumented behavior, but it certainly appears to work. You'll know if you ran afoul of ...


4

Since I cannot post a comment because of my low reputation, I'm posting this as an answer, which it is NOT intended to be. Can you post the following: /etc/sysconfig/network-script/ifcfg-eth0 /etc/hosts /etc/resolv.conf You might want to check your configured routes for that specific NIC (found in /etc/sysconfig/network-scripts/route-<interface>), ...


4

You can create a new iptables chain which can be separately flushed and refreshed. $ iptables -N AWS $ iptables -I INPUT 1 -j AWS From here, just add all of the IP ranges to the AWS chain. To refresh the rules, simply iptables -F AWS and re-populate. For example: $ iptables -F AWS $ iptables -A AWS -s 50.19.0.0/16 -j REJECT If you want to automate ...


4

iptables and ebtables can't set VLAN tags on packets. That's what VLAN sub-interfaces are for. There's an article on the Ubunut wiki that discusses VLANs that you should probably review. In summary, though, you want to: Make sure the 802.1q module is loaded with a modprobe 80211q. Create the VLAN sub-interface with vconfig add eth0 444. Add an IP ...


4

Your smtpd_relay_restrictions should prevent that anyone can connect to my server and use it as an open relay for spam. The value of mynetworks does not determine if others can email you. 127.0.0.0/8 is a correct value 0.0.0.0/0 is not. What determines if email for your account username@example.com is accepted is determined by the settings that inform ...


4

Long waiting for SMTP greeting How long do you wait to get SMTP greeting message? Exact duration in seconds may provide very important hint. AFAIR some servers issue SMTP greeting message after doing DNS lookups (IP address -> DNS name -> IP address). Typical timeout for single DNS query is 75s. DNS is not the only suspect (e.g. ident timeout may be ...


4

No, there is no such logfile. You have to specifically set up logging to do that, and I am not aware of a standard way to do it. It may not be easy to do it accurately: a user may cause a process that isn't owned by that user to generate network traffic and it may not be trivial to ascribe that traffic to that user. See e.g. this near-duplicate question or ...


4

The iLO RAC is a completely separate NIC. If you want the OS to have a network connection you must also connect the on-board NIC to the network. I'm guessing you don't have the NIC plugged in, and Ubuntu has no magical powers to make a network connection out of an unplugged NIC.


4

Newer distros/kernels support the nsenter command which, should do what you want, providing you are root when you do it. Here is an example (Fedora 20). [root@home ~]# unshare -n /bin/bash [root@home ~]# ip a l 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 [root@home ~]# ...


4

Ok so after posting this question last night night I continued to do some research the only real solution I came across seems to have taken care of the problem. Disabling TSO, GSO and GRO using ethtool: ethtool -K eth0 gso off gro off tso off According to a post found here: http://ehc.ac/p/e1000/bugs/378/ From what I understand this will or can cause a ...


4

This is a quote directly from the Docker OS X page The Docker Engine uses Linux-specific kernel features, so to run it on OS X we need to use a lightweight virtual machine (vm). You use the OS X Docker client to control the virtualized Docker Engine to build, run, and manage Docker containers. The rest of the page goes on to explain how to install ...


4

Just to explain why you need a bridge... A Bridge creates a link between two Layer 2 networks (eth1 and eth2 in your case) to act as a single Layer 2 network. This is Switching. A Router creates a link between two Layer 3 networks (eth0 and br0 in your case once you create the bridge). This is routing. With both clients in the same subnet, there is no ...


3

Bond them for reliability and speed and use aliases to the bonded interface.


3

The immediate cause of error is the leading whitespace in your db.10 file. Correct: ; ; BIND reverse data file for local loopback interface ; $TTL 604800 @ IN SOA necacdnsone.necone.com. root.necone.com. ( 1 ; Serial 604800 ; Refresh 86400 ...


3

This looks to actually be an issue that's occurring on your second Debian box when it attempts to send the packets in question, rather than it being anything to do with the box you're scanning. Try disabling iptables/netfilter on the second box and see if that helps.



Only top voted, non community-wiki answers of a minimum length are eligible