Tag Info

New answers tagged

1

New versions of kernels not respond to messages with invalid TCP flags. You could be tested by sending packets with invalid flags Hping3 using the tool. If you need to use iptables , I leave my script: #!/bin/bash # -- UTF 8 -- iptables="/sbin/iptables" CADENA="put INPUT, FORWARD or OUTPUT" IPWS="put destination IP" IFACE_Nro1="put input interface ...


3

You can do this using auditd; ask it to audit all calls to bind(2) and listen(2) -- the former so you can see what port is being bound to, and the latter to know when the listening starts.


0

I don't have enough points to comment, so I'll post an "answer" instead. I'm having what appears to be a similar/identical problem (see serverfault question here). My (and probably your) problem is the send buffer of the iperf client on windows. It does not grow beyond 64 KB. Windows is supposed to dynamically grow the buffer when it is not explicitly ...


0

TCP timestamps are used to improve performance as well as protect against late packets messing up your data flow. If you disable TCP timestamps you should expect worse performance and less reliable connections. This is the case regardless of the method used to disable TCP timestamps. Any modifications made to packets by a middlebox can cause additional ...


0

If you are looking for a justification for the multiplicative decrease factor of 0.5 (as opposed to, for example, an additive decrease, or a larger multiplicative constant like 0.9), there is one in appendix D of this paper by Van Jacobson, one of the designers of the original TCP congestion control algorithms.


4

I just had this bite me, so perhaps someone might benefit from my pain and suffering. First, an involved link with lots of info: http://vincent.bernat.im/en/blog/2014-tcp-time-wait-state-linux.html In particular: The mere result of this lack of documentation is that we find numerous tuning guides advising to set both these settings to 1 to reduce the ...


3

TCP connections are not identified by just the local port number. They are identified by the tuple consisting of local IP address, local port number, remote IP address, and remote port number. Since the remote port number differs, they are different connections. The socket API has one socket per connection plus one listening socket for accepting incoming ...


1

You send 36 bytes, because you are providing the UUID as a human readable string. To generate valid binary UUID, you can use uuid(1) utility. Output of which you can pipe to netcat.


0

A tcp session is identified by the tupple (sourceIP, sourcePort, destIP, destPort). Hence the TIME_WAIT does work on every tcp connection. Regarding the closing side, in some scenarios, closing from the client side can reduce TIME_WAIT sockets on the server, thus slightly reducing memory. In cases when socket space can be exhausted (due to ephemeral port ...


1

I recommend looking at MQTT. It does exactly what you require and is quickly becoming a defacto standard for IoT style implementations. Its also now an OASIS standard as well.


2

As for my understanding of TCP, asserting "Keeping TCP connections alive" is misleading, as there is no TCP-protocol-specific mechanism dealing with timeout, when referred to ESTABLISHED connections. I mean: once established, they can last forever, until a RESET, a FIN or a timeout in receiving an ACK (...following some transmission to be ACKnowledged, in ...


1

Your idea is fine; in fact, modern mobile devices use the exact same approach for their notifications, they maintain a permanent connection to the OS developer's server and that server pushes notifications down that connection (third-party app developers send notifications to the OS's developer which in turn relays them to the appropriate mobile device). An ...


1

So Im assuming your WiFi clients are being served and allowed to be served by the servers. If there is a public address hitting a server that it shouldnt, I suggest there is a port forward or a NAT rule on your router that points any traffic on an outside port of your router to the IP and port of that server. If the public IP always hits the same internal ...


1

To change TCP window from iptables you need to: checkout https://github.com/p5n/ipt_tcpwin build both modules using "make" add iptables rule, for example: iptables -t mangle -I OUTPUT -p tcp --sport 80 --tcp-flags SYN,ACK SYN,ACK -j TCPWIN --tcpwin-set 1000


2

The Wireshark Wiki lists many options to investigate. These tools can be used to "anonymize" capture files, replacing fields such as IP addresses with randomized values. AnonTool from the CRAWDAD archive of wireless traffic. The bittwiste tool from Bit-Twist. The Crypto-PAn tool. The Network Expect tool, which can be used to anonymize packets. The pktanon ...


1

Use your firewall to reject (not drop) UDP packets from squid. It'll soon get the message. I do wonder why on earth you'd want to do this, though.


-1

You can never be sure with an unreliable protocol, that you have received the last message from your peer device, therefore it is dangerous to assume that your peer has hung up the phone rather suddenly. It is a major disadvantage of TCP protocol that only 65000 or so ports can be open simultaneously. But the way to overcome this would be to move to a server ...


1

One good way to detect loss is by using a UDP stream of packets (there are various tools that do this, mainly for QoS testing). You can vary size, frequency, delay. It should show you if you have actual loss.



Top 50 recent answers are included