New answers tagged

0

yes, wireshark both sides, tcpdump, network traces taken at the switch level (rather high-end Arista 10G switches), traces taken on the firewall (Fortinet), etc. etc. The problem is not why the client is not receiving the reply. This is a busy network with bursty traffic, so losing one packet in 10,000 is not unexpected. But I need to provide an SLA even ...


1

You can't do what you want to do. There is no single command that will give you the information you want. Additionally, there can be multiple forward (A) records for a a single IP address as well as CNAME records all of which are hostnames for the system. You could try dumping your DNS config and searching for all records that have the same IP addrress, ...


1

You can't get this information at all, at least in a reliable and complete way. The system doesn't need to be aware of what DNS names for what domain are pointing to it. If PTR records are defined, you can get these like Brennen described, but everything else is unreliable. As an example, nothing prevents me from setting up DNS entries for any IP ...


0

This one liner will work: ifconfig | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}' | xargs -L1 host


0

Turned out it was the /etc/nsswitch file See the problem? cat /etc/nsswitch.conf | grep hosts hosts: = files mdns4_minimal [NOTFOUND=return] dns mdns4 A '=' sign incorrectly in the script. This was done in a custom package of ours (not written by me, blame allocation FTW!). that simply wasn't installed on the one that worked but was installed on the one ...


3

No iptables rule will ever close an existing TCP connection as that involves actively transmitting a message with the FIN bit. That is done by the application and not by a packet filter. On the other hand iptables can, at any moment, block your application from receiving or transmitting new packets over any existing connection and it can also deny any new ...


2

You can't just randomly assigned an IP address from somewhere else to your server and hope it'll work (well, you can, but your hope will be in vain). In order for a packet assigned to that IP to reach your server, some routing configuration needs to be done. Your options are: Have a machine in the UK behind the router where the network thinks your IP is, ...


2

Unless you have bought the address from OVH and they told you that you would be able to use it for the server in France (which is extremely unlikely), this will not work. In general, IP addresses, unlike domain names, are bound to physical networks and you can't just randomly assign an address to some host in a totally different network. Please read up ...


0

Docker, by the very definition of a container, is isolating you from the host environment. Anything that lets you do this from within the container without exposing the host via --privileged or some remote api interface should be a security exploit of the container.


3

You might want to add a null route for that specific ip address. Although, this makes ALL communication to the address impossible, this accomplishes what you need. You can find examples online of this. one of them. http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html Something like this route add -host IP-ADDRESS ...


0

Try this sysctl: net.bridge.bridge-nf-call-arptables=0 net.bridge.bridge-nf-call-ip6tables=0 net.bridge.bridge-nf-call-iptables=0 You need your bridge working as a "switch" without any routing and NATing. And there is no need to set "net.ipv4.conf.all.forwarding" unless you have NATed virtual networtks too. Standard libvirt iptables rules are working well ...


2

This is expected behavior when you have unmatched speed and are running mismatched speeds. If you are able to saturate the 1GB link, the other end will have read only 100 packets by the time you have sent the 1000 packets. It is unlikely your router will buffer the remaining 900 packets. UDP is an unreliable protocol. Unlike TCP it does not come with a ...


0

It depends. This is a fairly poor format for such a question, and we have no idea on the aspects of your environment that guide such decisions. To cram an answer in before it's closed, consider tools native to rh/centos, such as: Freeipa/idm for auth/dns Spacewalk/satellite for patch management & deployment I'm fairly sure this question will be ...


1

Essentially, you can't because the data is gone. Cacti uses rrdtool to store the data and this tool works by storing detailed records for only a short time and then aggregating this data into lower time resolution for longer time periods. As an example, it might store data in 5 minute intervals for a day 30 min intervals for a week (averaging 6 of the ...


0

you can also "simulate" the local network by doing iptables redirect from a local machine to remote cloud.


1

The normal way to handle multi-site fail over is to have a pair of load balancers on site A in a master/slave fail over config. Then put an identical pair on the remote site. If ALL the backend servers on site A fail then use the public VIP on site B as the fallback (high latencey of course across the WAN)... But back this up with a proper DNS based load ...


1

You could use HAProxy, or Nginx, or ATS, or Squid, or Pound or just a set of iptables rules. But you've not told us very much about the problem you are trying to solve. If the service requires a nominated IP address, then presumably it has some value which should be protected - anything you put in place should ensure that there is equivalent or better ...


0

This is strange, but maybe is related to network config, and after pinging the switch discover 2 routes to same dest, and learn the correct. On strict sense, you need to share us more details, tracert results. Regards!


0

84.180.231.1 is not inside 84.60.42.181/25, hope you made it intentionally. Make sure the rest of the world knows that the specific server has that range of IP, that you have routing configured properly both at your default gateway and that you configured default gw properly on the server. Also, don't forget to check icmp on your firewall(s)


0

Since the only adapter you have is SFP+ adapter, and em1 and em2 show 10000baseT/Full, it seems that you'd better choose em1 or em2 for 10gb speeds.


0

You can increase tcp window scale factor increasing net.core.rmem_max and net.ipv4.tcp_rmem. When increasing rmem (receiver memory buffer), indirectly it increases *rcv_wscale. For example, increasing receive window buffer to 32MB, I got a window scale factor of 1024: echo 'net.core.rmem_max=33554432' >> /etc/sysctl.conf echo 'net.ipv4.tcp_rmem=4096 ...


1

Make sure you have the same config on OSX and Ubuntu. Looks like after connection is established, you don't receive message that "hey, I (the gate you connected to) can route to 10.0.3.x and 10.1.25.x as well!" Make sure your subnets are correct: 10.1.22.185 can be outside of 10.1.25.x Re-check route table (locally)/router(s) in VPC, security groups/...


-1

I figured out the solution. All I had to do was enter two commands to activate the network card in CentOS 6: sudo modprobe mlx4_core sudo modprobe mlx4_en Now I have eth1 in ifconfig -a and can configure it (IP address, netmask, etc.) To make it permanent across reboots, I added a new file /etc/sysconfig/modules/mellanox.modules and set its permissions (...


2

This card should work natively without any changes. Just remove your 70-persistent-net.rules/reboot and/or check dmesg output. You may have an issue with a UUID or MAC in the /etc/sysconfig/network-scripts/ifcfg-ethX files. If neither of those are the case, download the driver from Mellanox or HP. # modinfo mlx4_en filename: /lib/modules/2.6.32-...


0

Assuming that you only have a single 10Gb interface use ethtool to show supported speeds.


2

Probably what's happening is that you're seeing IPv6 broadcast traffic on your subnet, as per what you posted from a tcpdump output here: 12:19:41.622297 IP6 (hlim 1, next-header UDP (17) payload length: 112) fe80::a4a0:460b:c99a:c992.dhcpv6-client > ff02::1:2.dhcpv6-server: [udp sum ok] dhcp6 solicit (xid=455863 (elapsed-time 700) (client-ID hwaddr/time ...


1

Try looking at the output without the wc -l. The pattern '10.241.169.7' matches 11 addresses. You may want a pattern like ^tcp.*10.241.169.7:.*ESTABLISED which reduces the number of commands required. You don't need sudo nor all the netstat options. Try a command like: netstat -nt | grep `^tcp.*10.241.169.7:.*ESTABLISED` | wc -l


1

Probably your CentOS servers are sending the hostname to the DHCP server and this is updating the DNS. One way to disable it is using nmcli (use ipv6.dhcp-send-hosname if you are using IPv6): nmcli c m "System eth0" ipv4.dhcp-send-hostname no You must set that configuration for all the connections (you can list them with nmcli c s -a). I believe that ...


0

If you are on RHEL7 (or alike) and use Network Manager instead of /etc/init.d/network to control your interfaces the proposed answer will not work, since /sbin/ifup-local (as well as ifdown-pre-local and ifdown-local) will never get executed. Instead put your scripts into /etc/NetworkManager/dispatcher.d/ and make sure the NetworkManager-dispatcher service ...



Top 50 recent answers are included