Tag Info

New answers tagged

0

Error message is misleading, but there's erorr in your command: $ siege -c 500 myweb.com/somefile.php After -c you must specify number of consurrent simulated users. Don't forget to check the rights for log file: by default it's /var/log/siege.log. Or, specify your own by adding --log=/home/user/siege.log


0

There are indeed many choices if it comes to network monitoring. I share the same prefrence as sareeshmnair to use pfsense. An other for small networks is Untangle. I have to say i did not try it for 30 systems but with 12 systems it was keeping up quite well. With 160 GB of hard-drive space and 3 GB of RAM. It is mostly a mater of taste, available ...


0

Depending on the type of switch you have, you may be able to access per-port traffic data via SNMP. It won't necessarily tell you WHAT a given port is doing (youtube vs download from a vendor website of necessary stuff), but it can give an indication of which ports are the big bandwidth hogs. In my case, I've got an older HP Procurve 4000 switch, and it ...


0

You can use a firewall in between router and the systems. PFSENSE is my choice (open source and free). so that you can monitor the total bandwidth usage, per IP usage etc.. Also you can use proxy (squid) to block websites, videos etc.. pfsense is just my choice. there are lot of free solutions to do this.


0

We ended up solving this issue by using another rule to not scan the URI. SecRuleUpdateTargetById 950120 !ARGS:REQUEST_URI This way this particular rule would not scan the URI but would still be scan the rest of the packet. It should be noted that this rule needs to be replicated for every rule you have.


0

To see interfaces use: "show interfaces" from the CLI. To configure them use Vyatta´s configuration mode, not Linux. To enter configuration mode: "configure" set interfaces ethernet eth1 address 'x.x.x.x/23' set interfaces ethernet eth1 description 'INSIDE' commit save "exit" to exit configuration mode, then "show interfaces". Take into account the ...


0

As far as I'm aware it is not possible to blanket ignore any particular part of the request (be it URI or any parameters) from all configured ModSecurity rules. While that may be useful it would likely open up a number of security holes. So you just need to see which rules are failing and add white list exceptions for those rules. If you give examples of ...


2

Actually, when you do: $ ssh -f -N -D 0.0.0.0:8080 root@192.168.3.182 $ curl --socks5 192.168.3.182:8080 ip.appspot.com The following events occur: CURL opens a TCP connection from [YOUR-HOST]:[RANDOM-PORT] to the SOCKS server that SSHD runs on 192.168.3.182:8080 SSHD accepts the connection CURL asks SSHD to open a new connection from ...


1

DNS congestion is pretty damn unlikely. Not only has it been around since the days of dial-up (read: serial port speeds), the /etc/resolv.conf defaults use a five second timeout cycle by default. There are a few knobs you can play with, but this is unlikely to be a real problem. Tune timeout and similar options in /etc/resolv.conf. (see man resolv.conf) ...


0

Since osx is nix based the commands are similar. sudo route add -host 192.168.1.3 -interface en0 I would then set en0 to a netmask of 255.255.255.255 so no trafic will route through it unless it is going to the static route for the other ip.


0

The problem for us turned out to be that our uwsgi request queue was filling up. To fix that we had to adjust a uwsgi setting and a kernel setting: https://stackoverflow.com/questions/8516516/stuck-at-100-requests-uwsgi


0

I have seen the same issue on Linux hosts. The solution was to deactivate Large Receive Offload (LRO) on the network driver (vmxnet) of the gateway machine. To quote the VMware KB: LRO reassembles incoming network packets into larger buffers and transfers the resulting larger but fewer packets to the network stack of the host or virtual machine. The ...


0

ping and curl are trying to get an actual IP address but the answer to the resolution jenkins-deb-builder.service.search.km is a CNAME ( mailtest-4.dev.search.km ) and that canonical name doesn't resolve to an IP address, that's why those tools cannot get an IP address. If Consul is able to resolve mailtest-4.dev.search.km then maybe you should modify your ...


1

This answer assumes that your router has an ip address of 192.169.1.100 (or any ip address between 192.168.1.0-255). With a /24 subnet mask your ip address range is 192.168.1.0-192.168.1.255 (including the network and broadcast addresses). With a /20 subnet mask your ip address range is 192.168.0.0-192.168.15.255 (including the network and broadcast ...


5

The subnet mask is mostly used to work out whether another IP address can be accessed on the local network, or if it needs to go through a router. Your workstations with the old /24 subnet mask will have been able to access everything else that was inside the old /24 network, because the wrong mask will still give the right answer for those addresses. They ...


0

You can run different congestion control using this command. I.e Congstion Control Algorithm name sysctl -w net.ipv4.tcp_congestion_control=cubic


0

This link explain well the danger of tcp_tw_recycle and tcp_tw_reuse. Don't use that.


0

I'm not sure what resources you have available to you, but there are devices that accomplish this based on the identity of the user logging in. For example, Cisco ASA Firewalls have an identity feature that picks up log-in events on a Microsoft Active Directory server and alerts the firewall of that user's IP address. Then you write ACL's based on username, ...


0

Following the response in the comments on the original question; In short it is not possible to negate the URI from inspection, ModSecurity is like other products rule/signature based. What you can do however is get the ruleid for your false positives (from the apache error log for the VirtualHost) and perform a SecRemoveRuleById 123456 in your apache ...


0

So I assume you are looking for a php solution? In that case you will need something like this: function get_ip_address() { // check for shared internet/ISP IP if (!empty($_SERVER['HTTP_CLIENT_IP']) && validate_ip($_SERVER['HTTP_CLIENT_IP'])) { return $_SERVER['HTTP_CLIENT_IP']; } // check for IPs passing through proxies ...


0

you need to set GATEWAY in your ethernet file not in /etc/sysconfig/network [root@puppetmaster]# cat /etc/sysconfig/network-scripts/ifcfg-ens33 TYPE=Ethernet BOOTPROTO=static DEFROUTE=yes PEERDNS=yes PEERROUTES=yes IPADDR=192.168.1.10 SUBNETMASK=255.255.255.0 GATEWAY=192.168.1.1


0

If I am not mistaken, mount.cifs does not support the encryption feature of Samba (yet!?). The -e option of smbclient should work, though.


0

Were you told to apply these settings on the same network interface (e.g. eth0) or did you receive a separate new one? Either way, you'll just have to configure the new settings but omit the default gateway, and see if it works - if 188.60.240.1 and 188.60.240.129 are both aware that both sets of traffic are legitimately originating from your machine, ...


0

These addresses are from other subnets. So they won't work directly. You can: Configure dedicated server as router (it will be complicated). Merge these subnets into single network (very simple, but not always possible for some reasons outside this topic eg. extra payments).


5

One answer I've not seen yet: Check the most recently modified files. Logs, database files, other output files etc. may get written to still that may provide clues: find . -mtime -3 That would find modified files in the current directory and deeper, changed in the last 3 days. Increase the number 3 to an educated guess until you get some output you can ...


7

Check the firewall rules. With a bit of luck, it's configured for default-deny. That means there's an explicit rule for each allowed service. This is better then netstat because it can also show ports that are open for e.g for nightly backups.


40

Unplug the ethernet cable and see who gets upset. Seriously though, mystery machines like this create a lot of mental overheard for a team and often provide absolutely no business value. Talk to your boss, if no one knows what it does maybe no one cares what it does.


-1

I think can achieve this target by adding multiple secondary IPv6 addresses, please edit your file as you did before, vi /etc/sysconfig/network-scripts/ifcfg-eth0 file and you add in this format (remove ***); IPV6ADDR_SECONDARIES="2001:0df3:3cXX::X1/64 \ 2001:0df3:3cXX::X2/64 \ 2001:0df3:3cXX::X3/64 \ 2001:0df3:3cXX::X4/64 \ 2001:0df3:3cXX::X5/64" If the ...


17

Another method involves checking the /etc directory and looking at the modification dates. After a fresh install all the files in this directory should have roughly the same date/time. And since an install usually installs a lot of things people usually do not use, only the files that have a later modification date reflect the actual purpose of the server. ...


19

There are a few things you could do to try and ascertain what's running on your system. You can check which ports your server is listening on to get an idea of what's on there. A good command to use would be: [root@server ~]# netstat -tulpn Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address ...


0

Had this error after cloning a virtual server, the clone was given a new hardware address ( MAC ) and the network adapter config still had the old one. The line looks like: HWADDR=00:00:00:00:00:00


29

This is a pretty broad question for the Serverfault format, but here is a good start: Check for running processes and those scheduled to run at system startup. Review the running configuration of each. Look into any defined data directories. (Maybe someone installed MySQL and turned it on, but there are no databases.) Check for scheduled tasks. Check the ...


0

I guess you need to exclude REDSOCKS's own traffic — when you redirect for all users, you're creating a loop.


2

According to nixCraft: Genmask : The netmask for the destination net; 255.255.255.255 for a host destination and 0.0.0.0 for the default route. It's called 'genmask' because it shows the 'generality' (i.e. the netmask) of the route.


0

A DNS server can be configured to operate in one of two different ways. Either it operates as an authoritative DNS server for one or more zones, or it is a caching recursive resolver. It is possible to configure one DNS server to do both simultaneously, but before doing so, you need to fully understand the difference between the two. Without sufficient ...


0

I suppose you know how hashing generally works: it calculates some function out of the data (IP, pair of IPs, etc) and uses value of that function as an index in the table to locate the structures associated with that data. Each cell in the table (which corresponds to one possible value of hash function) is usually called hash bucket. Unfortunately ...



Top 50 recent answers are included