Tag Info

Hot answers tagged

7

Blocking outbound connections to destination TCP port 25 is something that a lot of ISPs do today. While I don't particularly like it, it's a pretty typical thing that gets done. So long as you publish to your users that you're making this change, and perhaps take some packet captures to pre-emptively see who might be effected by the change, I think it's ...


4

You can simply type: echo "$SSH_CONNECTION" Or if you want only the server IP address and not the other fields: echo "$SSH_CONNECTION" | cut -f3 -d' ' If you are using screen and reconnect to a previously started screen session, notice that running these commands inside screen will show the connection from which screen was started and not the session ...


3

Everyone's comments helped me put it all together and gave me a lot to read up on, thanks. I found a good solution that didn't involve doing anything to the router running NAT. This article described my problem and has a good solution, going in the same direction I think mc0e was suggesting. Here is the command I ran to get this routed: iptables -t nat -A ...


3

You need a route which directs the traffic to your local interface, and you may have a firewall issue. Add the output of netstat -an for routing. It's likely to be ipchains -L or iptables -L to list the firewall rules.


3

I propose for now that you: Ensure that remote administration of the RV-042 is actually disabled. Dispute the finding with Trustwave and cite that you have a compensating control, namely, that all connections to those ports are immediately dropped. In the long term you should probably find another router, the software for which is better supported by its ...


3

As the message in the screenshot states, the problem is that there is another connection to the same server from the same client, but with a different username. Windows does not support that. So, if you are supposed to have access to those default (c$, d$, ...) shares (which requires an administrator account on the remote computer), you have to connect with ...


3

If you are referring to Windows Updates, you can have them use either Automatic Updates straight from MS or setup WSUS on the server to centrally administer/approve client updates. Or you can look into SCCM which could be used to also help administer 3rd party software as well. If you are referring to 3rd party software that gets updated on the clients, ...


2

While most users should use ports 465 or 587 to drop mails with their providers, you can't be sure of this and there might be many users still use port 25 (e.g. with STARTTLS or even unencrypted).


2

What TheCleaner said, but I'll add that it's often possible to deploy software updates through group policy or some other management software even if the vendor isn't super-forthcoming. Many installers have undocumented install switches because a lot of software uses the same install package software (you generally find these by trial and error, and you ...


2

Seeing a the route "hop around" on your network is really bizarre. You should see a traffic flow that hops form your edge router through your distribution routers. You definitely shouldn't be seeing traffic being routed through end user Customer addresses / devices. I tend to think you're seeing some kind of artifact of your configuration in these traceroute ...


2

The easiest way would be to use netstat and check for connections in there. user@host:~$ sudo netstat -ntp Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 128 0 123.45.67.89:50212 98.76.54.32:22 ESTABLISHED 16774/ssh [more stuff ...


2

You can't control somebody else's computer. If somebody else has "Administrator" or superuser-level access to the machine then all bets are off. You're better off doing this in the network, where you can control things. I see you say "...without the help of the router", but enforcing network policy with the network equipment gives you the best chance to a ...


1

Click on the next tabs... 'Top 10 Sources' and 'Top 10 Destinations' and identify the internal device from the IP. I would guess someone set up a remote backup or similar scheduled task.


1

This is a bit of a mess and not a good application for VMware ESXi. A physical router/firewall and switch would be the better way to approach this. However, you can create multiple vswitches. vswitch0 could contain the public-facing network uplink and the public interface (vnic) of the Windows server. vswitch1 could have the private interface of the ...


1

Sure, but rather than attempting to virtualize on such limited hardware, I'd suggest just running CentOS to handle both functions. There's probably no reason to use FreeNAS here, as CentOS can serve as a NAS and is entirely capable of ZFS. This would be the best use of the resources available to your ProLiant Microserver.


1

Yes. Install virtualization. Try Hyper-V or ESXi.


1

They can communicate just fine if at least one of them is NATed to another range/IP (private or public) on the way to the other. But it's safer to change one of the ranges, e.g. to avoid problems in network documentation


1

Presumably your resolv.conf includes nameserver 127.0.1.1. When pinging google.com in your example this name first needs to be looked up so that ping knows an IP address which it can send the ICMP echo request packets to. To find the IP address it consults the configured nameserver, hence why it communicates with 127.0.1.1 on 53/udp.


1

This is difficult (if not impossible) to do depending on your access to resources. If its a Unix based server I'd run tcpdump on the server (in such a way that it only listens to the traffic on the port you are interested in), and then try and connect to it via Telnet. Telnet will, of-course fail, but at least you should see the incoming server attempt ...


1

First of all you have to use a managed switch. If you are not using a managed switch, then nothing is stopping a person with sufficient privileges on individual machines from simply spoofing a MAC address of another machine. Once the MAC address is being spoofed, there is no way to tell the difference between the two. With a managed switch you can either ...


1

You need to add a route to 10.10.200.0/24 via 192.168.3.48 to sonicwall.


1

try switching your ACL statements acl "trusted" { 173.255.211.166; 104.200.17.225; //this is the client in question 10.8.0.0/24; 10.8.1.0/24; 127.0.0.1/32; ::1/128; }; acl "outside" { any; };


1

The SonicWall needs a route to the 10.50.1.0/24 network via 192.168.50.254. 10.50.1.0/24 is not directly connected to the SonicWall so it has no idea how to route traffic back to that network. Also, I don't understand this statement: I have pushed a static route via DHCP for 10.50.1.0/24 with the gateway 192.168.50.254 to avoid ICMP redirects from the ...


1

Deleting a primary IP address from an interface will, by default, delete all other address on the same subnet. This is a reply to a REHL bug 1136733 reported by the user lain who provided an answer on 12-Mar-13 ... You're adding multiple addresses in the same subnet, thus the second and subsequent ones become secondaries. This can be seen in the "ip ...



Only top voted, non community-wiki answers of a minimum length are eligible