Tag Info

New answers tagged

1

create /etc/dhcp/dhclient-eth0.conf and put these lines: send host-name = gethostname(); request subnet-mask, broadcast-address, time-offset, routers, domain-name, domain-name-servers, domain-search, host-name, dhcp6.name-servers, dhcp6.domain-search, netbios-name-servers, netbios-scope, interface-mtu, rfc3442-classless-static-routes, ntp-servers; ...


0

Your kernel ignores packages that are not addressed to the local network interfaces. You should change eth0 to promiscuous mode: ip link set dev eth0 promisc on You could make this persistent via the network configuration: Debian auto eth0 iface eth0 inet manual up ifconfig eth0 promisc up down ifconfig eth0 promisc down Redhat ...


0

Amazon's RDS service provides you with the possibility to create cross-region read replicas. Using CloudWatch you can closely monitor the Replica Lag and e.g. setup alarms when it gets to high. I would suggest that you setup a RDS instance in one region and a read replica in another to see what kind of lag you could expect and whether or not it is ...


2

I generally install arpalert on a system for this purpose. It is a daemon, that uses libcap to watch traffic. It keeps a database of mac addresses per interface. It can also watch for some unusual types of events and send notifications. It keeps track of the last usage, and it will keep the database across reboots (in comparison to just setting up a ...


0

Maybe I'm missing something from your setup but here's what I think is the issue. If the Modem is connected to one of the switch as pictured in your design via an access port, then that modem needs to have routes for all of your VLAN pointing back to your OpenBSD firewall. That would explain why the Modem seems to only "see" the Firewall since it's layer 2 ...


1

Well to be fair, everyone says "arp -a", but I am not satisfied with this answer, since it only shows the known MAC addresses (and their corresponding IP). To list all addresses on a port, you'll need to change your current network configuration. We will use the bridge-utils package, but any other bridge implementation (eg.: OpenvSwitch) can do this. The ...


0

According to SonicWALL documentation on the Layer 2 bridging: Layer 2 Bridge Bypass is a physical X0-X1 interface bypass relay currently implemented on the SonicWALL NSA E7500. This feature is sometimes known as “fail to wire”, meaning that the LAN-WAN connection reverts to a straight-through connection if the SonicWALL appliance experiences a ...


0

You can temporarily open your firewall with iptables -I INPUT 1 -j ACCEPT which adds the ACCEPT rule BEFORE anything else (the 1 means "at index 1"). Make the yum updates and installs, then close the firewall again with iptables -D INPUT 1 Another solution would be to temporarily delete the first rule with iptables -D INPUT 1 and then restore the ...


2

Invoke-WebRequest http://speedtest.newark.linode.com/100MB-newark.bin -OutFile $env:TEMP


0

You are not supposed to configure the failover IP addresses on the host in this scenario. They must be configured only in the guests. Better yet, use your IPv6 addresses to access your VMs from the host. This is going to be more reliable anyway.


1

Changing metrics sure is better solution than deleting any of the default routes. It's also robust, since on disconnect you'd still be able to access the internet via the corporate LAN without modifications. However, since you have dynamic IP on this interface, it's frustrating to manually find the changing gateway IP every day. Therefore, you could use ...


2

We normally do it like this: auto eth1 iface eth1 inet static address 243.124.38.195 broadcast 243.124.38.207 gateway 243.124.38.193 netmask 255.255.255.240 dns-nameservers 127.0.0.1 dns-search sample.xyz ## virtual ip4 interfaces up ip addr add 192.168.1.1/28 dev $IFACE down ip addr del 192.168.1.1/28 dev $IFACE || ...


2

No, this is most definitely not possible. You are trying to route relatively high voltage, analog POTS signals over a digital switching media. It won't work. Just because the connectors are similar doesn't mean you can jimmy things together. You'll need to get someone in to pull some cable for you. There's a slight chance you could wire these two ...


1

Bonding 1GBE links is almost linear. I haven't tried it with 10GBe links though and I suspect it's less than linear. The reason is the memory and CPU become bottlenecks. I've seen this with FDR infiniband and I don't doubt the same can happen to Ethernet despite the offload mechanisms. This is why RDMA was invented. On Infiniband it's referred to as ...


1

Usually VMs in VirtualBox are added with NAT, so the VMs interface isn't directly exposed on the network. To expose it open Settings->Network and change "Attached to:" from NAT to Bridged adapter. You can then decide if you want to use DHCP or static addressing inside the VM. Host-only Networking only provides access to the host and other VMs on the same ...


0

Your container is most likely assigning 10.0.3.127 from the built-in dhcp server. Disable dhcp inside the container or disable the assignment in the config.


-1

Edit your post and paste : /usr/share/lxc/config/ubuntu.common.conf (host) /etc/network/interfaces (lxc container)


1

As @ott's comment mentions, you can't send unicast traffic to a machine that isn't active on the network at that time. 'Active on the network' means different things to different devices though... to a Layer 3 device like your PC or a router it means 'this device has talked to the machine at some time in the last 4 hours' (depends on arp timeout), to a ...


0

HTTPs traffic can generate a very high load due to the encryption requirements. They make add-in cards which allow you to offload SSL encryption/decryption to specifically designed hardware. As mentioned above, you can terminate SSL on a load balancer which will reduce costs because (at least for the F5) these devices come with this SSL offload equipment. ...


3

What you are observing is server .212 trying to communicate with / identify client .65 Probably, your DHCP server (.212) is checking if the client lease .65 is actively used/active or not. Under most circumstances this can considered normal behavior; however, you are the only one that know if communications between .212 and .65 really are OK.


0

This sounds like you may need to configure persistence. What can happen in this situation is that you will login to back end server A) and then on future requests end up connected to server B). You never logged into server B) and you get redirected back to the login page. This clobbers the login data in the local browser for server A) when you log in to ...


0

This problem is not unique.This is a problem of Routing. Run : route -n to show your routing table. My Routing table is like this : Destination Gateway Genmask Flags MSS Window irtt Iface 10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 ...


1

I have had similar problem. My lo vanished after turning off IPv6 (via sysctl) and rebooting the server. To be more precise: it was being created but without any IP set up. So it was visible under ifconfig -a but not under plain ifconfig. So in my case it helped to change /etc/network/interfaces loopback entry to: auto lo iface lo inet static address ...


0

Ok, I have mostly figured out what needs to happen. Android and Linux systems don't report the hostname.fqdn properly for IPv6. This can supposedly be fixed however I could not get it working after days of research and bricking one Linux client. Currently it is not possible to add a DNS suffix to android phones (without rooting) so this will probably not ...


0

Things have come a long way in 5 years. Lines belong in ( /etc/network/interfaces ) See man 5 intefaces for more details. # Choose your own name for your tunnel interface (example uses 'mytun') auto mytun iface mytun inet tunnel mode ipip # Best I can tell, value of 'netmask' does nothing but is required: netmask 255.255.255.255 # Local address ...


0

You don't mention how your Firewall is setup. Typically X0 is LAN and X1 is WAN. So by default, traffic from X1 to X0 is blocked. But I don't think that is the problem. The 10.1.0.0/16 doesn't have a routable interface to 172.16.5.1 on the sonicwall. the subnet masks prevent it. even if you add a static route, you still need a routing interface on the ...


1

Replace your icmp rule by the following: reject icmp 10.10.10.2 any <> 10.10.10.1 any (msg:"Blocking ICMP Packet from 10.10.10.2"; sid:1000001; rev:1;) Note that there is no snort rule action called block. Use either reject or drop. For more information, see this manual page. UPDATE: I am not sure you can put more than one interface in your snort ...


2

As firewalld is based on XML configuration, some might think that it's easier to configure the firewall in a programmatic manner. This can be achieved by iptables just as well, but with a different way, which is not XML. If you are already familiar with the way iptables works, why would you migrate all your configuration to firewalld? If you consider your ...


3

Canonically, that ESTABLISHED rule is actually RELATED,ESTABLISHED. It won't affect SSH or HTTP(S), though—the difference is that RELATED also encompasses what are technically new connections, but at related to an existing one, as in FTP data channel communications or ICMP echo replies. Overall, what you have done here is just fine.


1

You cannot just collect unused blocks and deal them out arbitrarily. Say, some site is allocated 120.0.0.0/8 and it turns out that half of it is not used, say, 120.128.0.0/9. There is a route to 120.0.0.0/8 announced through BGP. Now if you split the block, you need most likely two routes. Doesn't look exciting, but the routing tables in the Default-Free ...


0

If the settings are identical, probably there is a MAC filter on. That means that the IP 10.107.31.99 will only work if also the MAC address on the WAN is correct. So you need to configure your AP with the MAC address (on WAN side) that the original computer has, while the rest must remain the same. Get the MAC address of the initial PC and set it up on the ...


1

To be REALLY sure, that you have the same client version as on the Firebox, you can download the client directly from the firebox itself by opening https://Firebox_IP/sslvpn.html In your case I'd try to reinstall the client. It looks much like there went something wrong during the installation or something corrupted it later. Takes just 5 minutes, so it's ...


0

The tun tap device appears the same to the kernel in that it can't tell whether the data comes from a wire connected to an ethernet interfaces or from a userland application. When data is written it is forwarded to the userland application rather than a physical interface device eg. eth0 The interface a packet is forwarded to will be based on the routing ...


5

The dimensions listed in the advertisements often only measure the main body of the server, and does not include the width of the mounting hardware, which is often optional. In any case, when you order equipment from most vendors you can buy the correct mounting hardware to attach a server to standard racks. Also it is important to keep in mind that the ...


-2

Most of the cabinets are with adjustable rails inside. As usual for this kind of server you will have to buy extra "rack rails". The model and pride can be found at vendors web portal. This server you can use for anything, let's say you can install Open source Ubuntu Server with FTP/SFTP and web services. Good luck!


0

That is the primary purpose of the routing table -- to determine how to get outbound packets TCP/IP packets on to their destination.


0

if you want Intrusion Prevention System[IPS] features try simplewall UTM. it can run under monowall too under bridged mode.


0

Check the link lights on the switch too, they sometimes indicate your link speed by color or combo thereof; the switch manual should detail this. I agree with ChrisB, double check speed and duplex. Also, sometimes "Auto Negotiation" will negotiate a crappy deal, like 10 Mbps half duplex; when 1Gbps full will work. Double check the capabilities of the ...


2

The purpose to allow configuration of Apache in a variety of deployment scenarios where you may have multiple Apache instances or multiple IP addresses and to give the admin a high degree of flexibility in how they might configure this. Your machine may have multiple IP addresses and/or interfaces and you may only want Apache to listen and respond on some ...


0

Are there devices connecting to the new switch that have the port speed and duplex manually set? If so, then the new 1 Gb switch will not correctly auto negotiate those ports where one end is manually configured and is dropping back to 10 Mb half duplex. Set the devices connecting to the new switch to use auto negotiate.


0

Most likely scenario that I've seen in the field is a wire that's on its last leg, this usually happens in stranded cable, or a cable that hasn't been properly pinned out, i.e. the green and blue wires aren't switched. If pins 3 and 6 aren't flipped, you'll typically get some connectivity, at shorter distances, but the speed will typically be greatly ...


0

Based on some research I can't find anything that stands out. I would suggest switching out the network cables. Its possible one of the cables has a broken wire that wasn't affecting the hub (running in half duplex mode) but is now affecting the switch (attempting to run in full duplex).


0

What you can do with Puppet entirely depends on your ability with programming and scripting. On my Linux machines I use Puppet to manage configuration files, update certain software packages, keep up to date csv files of information on the server, create virtual host configurations for Apache...all sorts of tasks. As for my network equipment, I haven't ...


2

Let's say you have a small network (50-60 IPs) and assign everything a 10.x.x.x IP with a subnet of 255.0.0.0. This gives you a huge range of usable IPs. What performance implications will this have on the network if any? For one, you're leaving yourself wide open to ARP attacks and resource exhaustion on your edge router. A /8 subnet can potentially ...


0

I see this is a little bit older post but it could help others. In short you have to enable "Receive Window Auto-Tuning": netsh int tcp set global autotuninglevel=normal CTCP means nothing without above enabled. If you disable "Receive Window Auto-Tuning" you will be stuck on 64KB packet size which has negative impact over long RTT's in high broadband ...


0

With having multiple default routes you can load-balance the traffic ( session lb ). If you want to keep one of the paths as backup , then you need to play with metric. Give a higher metric to the path you wanna use as backup and smaller metric to the main one. This will solve your issue. By the way because main default route will be there although the next ...


1

INPUT, OUTPUT and FORWARD are three separate chains. A packet will only hit one of these three. The order for forwarded packets is: PREROUTING -> [routing] -> FORWARD -> POSTROUTING. The netfilter doco is pretty good on this topic: http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO-6.html


0

Two possible answers: (1) The ARP cache on the Asus losing the MAC address for the modem router. Is there any other device besides the modem that has an interface on 192.168.0.1 ? You say you can ping 192.168.0.1 while WAN connectivity is interrupted, but can you see the Technicolor web interface on 192.168.0.1:80 or telnet to it ? If that changes, ...


0

when i telnet to my router and do ping -c 1 -w 1 -W 1 212.77.100.101 during incident, the command exits immediately Of course it exits immediately, you are giving it just 1 count and 1 second to be successful. -c count Stop after sending count ECHO_REQUEST packets. With deadline option, ping waits for count ECHO_REPLY packets, ...



Top 50 recent answers are included