Hot answers tagged

2

In short: yes! But that depends a bit in the syslog daemon you're running. Syslog-ng allows that with the program() destination. Rsyslog offers actions.


2

since the application may probably be closed already or not in a state where it can read from the socket anymore, where is the data going to go? It's implementation dependent. If the socket's closed on the application end, the TCP stack can just drop that incoming data on the floor. Alternately, you could have an implementation which didn't return from ...


1

Windows TCP implementation is fairly opaque and you will frequently find that not all registry options are supported in all versions of Windows or are overwritten by some other setting. For reference, when Acknowledgement packets are sent for more than 2 full sized data packets, this is referred to as a Stretch ACK which you can read about here: RFC 2525.


1

Depending on how nice you want to be to the client, a possible solution can be: iptables -I INPUT -p udp --dport 111 -j DROP or iptables -I INPUT -p udp --dport 111 -j REJECT


1

I agree with Greg's comment. RFC 1337 is an Informational RFC only and not part of the TCP standard. To ensure that there isn't any unexpected changes in production networks, it makes sense to keep this feature disabled by default and leave it up to the network admins to decide if they would like to enable it for testing. Dropping RST packets for sockets in ...


1

In my case the following command fixed the problem with missing SYN/ACK replies from Linux server: sysctl -w net.ipv4.tcp_tw_recycle=0 I think it is more correct than disabling TCP timestamps, as TCP timestamps are useful after all (PAWS, window scaling, etc). The documentation on the tcp_tw_recycle explicitly states that it is not recommended to enable ...


1

You can also use PcapSplitter which is part of the PcapPlusPlus package. It does exactly what you need (which is splitting pcap files by TCP or UDP connection), it's multi-platform and it doesn't have a limit on the number of connections in the original file (so you can use it to split a large pcap file containing thousands of connections or even more). The ...



Only top voted, non community-wiki answers of a minimum length are eligible