Tag Info

Hot answers tagged

11

This is the correct way: iptables -A INPUT -p tcp --match multiport --dports 1024:3000 -j ACCEPT As an example. Source here.


11

To do this you can make usage of tc alone with u32 filters or combined with iptables marking (maybe more straightforward if you don't want to learn the complex filters syntax). I'll in the following post detail the former solution. Simulating your setup As an example, let's consider A, B, C and D running 10 Mbit/s virtual interfaces. You basically want ...


10

What you've been told is right, although you've written it wrong (you've forgotten --dport). iptables -A INPUT -p tcp --dport 1000:2000 will open up inbound traffic to TCP ports 1000 to 2000 inclusive. -m multiport --dports is only needed if the range you want to open is not continuous, eg -m multiport --dports 80,443, which will open up HTTP and HTTPS ...


9

Clearly you have an interference problem. Interference can come from passive elements like aluminum wall studs or thick floors, but those are not likely to show the periodic pattern you see. So something electric or electronic is periodically emitting. Finding it may be expensive or tough, but you have a few options. Graph more. It would be nice to make ...


8

You want eth1 and eth2 on the same subnet so they should be on the same ethernet link: you should configure your linux box as a bridge between eth1 and eth2. This will create a new network interface (named br0 below): the kernel will work as a switch bridging your eth1 and eth2 (at layer 2). The IP configuration will be done on br0 instead of eth1 and eth2 ...


7

I do exactly that. The test is pretty trivial, inasmuch as it connects to a custom database called nagios and selects from a table that contains just a single numeric value, alerting if that value isn't 74581 - but I figure if mysql works well enough to retrieve that exact number from a table, it's probably fine. You could run more complex queries, though. ...


7

The order of reboots is important. Rebooting the server after the clients can result in this situation. The stale NFS handle indicates that the client has a file open, but the server no longer recognizes the file handle. In some cases, NFS will cleanup its data structures after a timeout. In other cases, you will need to clean the NFS data structures ...


6

I found that you can return to the default network namespace with two simple commands: ln -s /proc/1/ns/net /var/run/netns/default ip netns exec default ifconfig -a This method obviously assumes that you can see processes outside your own namespace through the proc file system. If you are in a separate PID namespace as well, returning to the default ...


6

This is not achievable natively within the TCP/IP protocol, because... well, that's just not how the protocol works - it doesn't have a concept of users, and is designed to just transfer data between devices. The way this is generally done (rate-limiting a specific remote user) is through the use of sessions (layer 5 in your OSI networking model, which is 1 ...


6

Yes, you can use the Ident protocol to identify the user at the source. Well, you used to be able to. Nowadays the only people who expose ident servers to the Internet at large are IRC users who want a funky nickname. Oh, and people who've misconfigured their systems.


5

When the socket is in TIME_WAIT, there is no process attached to it anymore and the kernel is just holding it in case some other packet arrives. At this point, the software the originally opened this socket does not have a open file description to it anymore. That's why you can't find any relation to it. The socket that existed in /proc/$PID/fd is not there ...


5

You could obtain the number by using Wireshark on your machine. This is a very common packet analyzer. Here is some good documentation on how to use it. There's a plethora of resources on it though.


5

Remove the gateway defined for eth0 (192.168.5.1). If you need multiple default routes you'll have to use iproute2 to create a policy for it.


5

There's no difference; dev is optional provided the device name can't be mistaken for another keyword that the ip command understands. For instance, if you had an interface named bridge then you would have to use dev as bridge is also a keyword that ip uses. This is undocumented behavior, but it certainly appears to work. You'll know if you ran afoul of ...


5

That image says that the maximum UDP transfer rate over 1gbps ethernet is 119635891 Bytes per second. Multiple 119635891 with 8 (one byte is 8 bits) and you get 957087128 == 957,08mbps


4

Your smtpd_relay_restrictions should prevent that anyone can connect to my server and use it as an open relay for spam. The value of mynetworks does not determine if others can email you. 127.0.0.0/8 is a correct value 0.0.0.0/0 is not. What determines if email for your account username@example.com is accepted is determined by the settings that inform ...


4

You can create a new iptables chain which can be separately flushed and refreshed. $ iptables -N AWS $ iptables -I INPUT 1 -j AWS From here, just add all of the IP ranges to the AWS chain. To refresh the rules, simply iptables -F AWS and re-populate. For example: $ iptables -F AWS $ iptables -A AWS -s 50.19.0.0/16 -j REJECT If you want to automate ...


4

iptables and ebtables can't set VLAN tags on packets. That's what VLAN sub-interfaces are for. There's an article on the Ubunut wiki that discusses VLANs that you should probably review. In summary, though, you want to: Make sure the 802.1q module is loaded with a modprobe 80211q. Create the VLAN sub-interface with vconfig add eth0 444. Add an IP ...


4

Ok so after posting this question last night night I continued to do some research the only real solution I came across seems to have taken care of the problem. Disabling TSO, GSO and GRO using ethtool: ethtool -K eth0 gso off gro off tso off According to a post found here: http://ehc.ac/p/e1000/bugs/378/ From what I understand this will or can cause a ...


4

No, there is no such logfile. You have to specifically set up logging to do that, and I am not aware of a standard way to do it. It may not be easy to do it accurately: a user may cause a process that isn't owned by that user to generate network traffic and it may not be trivial to ascribe that traffic to that user. See e.g. this near-duplicate question or ...


4

Newer distros/kernels support the nsenter command which, should do what you want, providing you are root when you do it. Here is an example (Fedora 20). [root@home ~]# unshare -n /bin/bash [root@home ~]# ip a l 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 [root@home ~]# ...


4

The iLO RAC is a completely separate NIC. If you want the OS to have a network connection you must also connect the on-board NIC to the network. I'm guessing you don't have the NIC plugged in, and Ubuntu has no magical powers to make a network connection out of an unplugged NIC.


4

The "default" routes are set based on the GATEWAY lines in your ifcfg-<interface> files. As Dom mentioned in his comment, if you remove the incorrect GATEWAY line, your routing table will be as you expect.


4

This is a quote directly from the Docker OS X page The Docker Engine uses Linux-specific kernel features, so to run it on OS X we need to use a lightweight virtual machine (vm). You use the OS X Docker client to control the virtualized Docker Engine to build, run, and manage Docker containers. The rest of the page goes on to explain how to install ...


4

Long waiting for SMTP greeting How long do you wait to get SMTP greeting message? Exact duration in seconds may provide very important hint. AFAIR some servers issue SMTP greeting message after doing DNS lookups (IP address -> DNS name -> IP address). Typical DNS timeout is 75s. DNS is not the only suspect.


4

Just to explain why you need a bridge... A Bridge creates a link between two Layer 2 networks (eth1 and eth2 in your case) to act as a single Layer 2 network. This is Switching. A Router creates a link between two Layer 3 networks (eth0 and br0 in your case once you create the bridge). This is routing. With both clients in the same subnet, there is no ...


3

Bond them for reliability and speed and use aliases to the bonded interface.


3

This looks to actually be an issue that's occurring on your second Debian box when it attempts to send the packets in question, rather than it being anything to do with the box you're scanning. Try disabling iptables/netfilter on the second box and see if that helps.


3

The immediate cause of error is the leading whitespace in your db.10 file. Correct: ; ; BIND reverse data file for local loopback interface ; $TTL 604800 @ IN SOA necacdnsone.necone.com. root.necone.com. ( 1 ; Serial 604800 ; Refresh 86400 ...


3

The keyword you are looking for is "metric". It basically specifies how "preferred" a particular route is. The comment at the end of this article explains how to set it up on Debian based systems: https://singpolyma.net/2012/08/how-to-force-the-default-route-to-always-use-a-specific-interface-on-ubuntu/ The article has some info on how to customise ...



Only top voted, non community-wiki answers of a minimum length are eligible