Reputation
711
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
1 7 21
Impact
~31k people reached

2d
comment Shorewall forwarding subnet on bridged interfaces
I have a very similar setup as yours (several containers, each with its own bridge). My understanding from your question is that the firewall is Linux (because shorewall) but the system you want to ping from is Windows? I have a hard time understanding the topology of the network (the firewall is remote to the host you ping from? looks so from the route. Also what are the subnets on each portion?). Have you tried to do a tcpdump on br1 while on the FW to check what happens to packets afterwards?
Mar
31
comment How to automatically add a local route after OpenVPN start?
I was hoping to be able to keep that information in the .ovpn file (to keep it in a source management system) but otherwise, yes, this is what I meant by I need to do it somehow outside the OpenVPN startup process. Thanks.
Mar
31
comment How do I assign specific IP address to my OpenVPN server?
I use a configuration file for my server and have the exact same question. Your answer suggests that I should rewrite the assignment part in the config file (in other words, replicate the code below the ... in my config file (with the IP I want to assign). Is that correct? How does this code overwrites the default one (which also uses ifconfig, as seen in the logs)
Mar
30
comment Why is TTL increasing? (and generally behaving erratically)
Thank you. It is now obvious, as they are echo replies (so new packets). Is there a way to check the TTL along the trip of the packet? (I wonder if this is not in essence the traceroute command)
Mar
21
comment What does a REGISTRATION; NEGATIVE; RESPONSE; UNICAST message mean (UDP 137)?
@Sven: I realized in the meantime that my question was probably too specific, i.e. that it dealt with a specific device while the problem may have been a more general one (NetBIOS registration). I should have edited it instead, you are right.
Mar
19
comment Why are ICMP packets not captured on the target interface?
@GuyHarris: yes, int0 masquerades traffic from lan0to internet. There is also DNAT to redirect a port on 192.168.0.10 to an internal host.
Mar
19
comment Why are ICMP packets not captured on the target interface?
Thank you. and the gateway says "192.168.0.10 - hey, that's me!" - is this exactly "192.168.0.10 - hey, that's me on another interface!"? In that case how does this work for the third case?
Mar
19
comment Why are ICMP packets not captured on the target interface?
@tokozedg: yes - this is why (among others) I can ping hosts on Internet
Oct
27
comment How to write logs in JSON format?
(cont'd) I also thought that a JSON input was required for format-json to be used - you mention in the example that * the source is a JSON encoded log message* - which misled me to think that it works with JSON as a source only (which is not true, after very carefully reading the docs). And nevertheless THANK YOU for this great piece of software.
Oct
27
comment How to write logs in JSON format?
Hello Robert: when searching on how to format JSON output, I found format-json and json-parser. I was not clear on how to use either of them. The macros part does not either explicitly state which elements from the input syslog data get parsed into what fields. I was too harsh, sorry, with the "really, really obscure" statement - it is rather that for someone who is not an expert in the field it is not obvious what to use. I believe that adding a practical example and possibly explain more down-to-earth elements like selected-macros or nv-pairswould help.
Oct
25
comment Unable to write to disk but disk isn't full
@felwithe: you could try to do a rsync -a --delete /yourdirfulloffiles /anemptydir
Oct
23
comment How to write logs in JSON format?
Following your answer, I read again the docs and while they are really, really obscure I manage to get what I needed. I updated my question accordingly. Thanks.
Oct
21
comment How to format log data before forwarding them as JSON to elasticsearch?
@GregL: I see, it seems to be exactly what I was looking for, thank you. It seems that it is not possible to dynamically map the fields but I will be required to specifically add one add_fieldentry per field in my JSON, right?
Oct
21
comment How to format log data before forwarding them as JSON to elasticsearch?
@GregL: I edited my question with your request. I am new to logstash, so how exacltly can I "run the message field through the json filter to expand it"?
Sep
16
comment Why does it take tens of seconds to get a shell prompt?
@Mike: same here - I would recommend to start with this one as it is easy to fix. It was 100% in my case.
Sep
8
comment Why would a node not have shards?
The move generated an error and the key infprmation was [NO(target node version [1.6.2-SNAPSHOT] is older than source node version [1.7.1])]. Upgrading fixed the issue.
Sep
8
comment Why would a node not have shards?
I found the problem. When testing the rerouting API it reported why a shard move was not successful. The failed part was about the version of elasticsearch on eu2 (it was lower that the others). Upgrading it immediately fixed the problem, thanks. If you cold turn your useful comment about moving shards into an answer I could accept it.
Sep
8
comment Why would a node not have shards?
@GregL: no, but shouldn't that be automatic? All the other nodes got shards automatically (without any action from my side)
Aug
25
comment Is it valid to have several IP addresses resolving back (PTR) to one name that doesn't match either of the relevant A records?
@AndrewB: I agree with you. I have plenty of bogus PTRs for IP addresses provided by hosters which point to old domains and our scans routinely seem to be scanning www.clearly-not-our-company.com (from the results, which include a reverse DNS, the scans being based on IP ranges). This is horrendous and I very much prefer to have bare IPs in that case. My question's background is quite specific, though, as i want to use DNS names as PTRs as a mean to communicate with the receiving operator of a system. My key concern was about MUST NOT in RFC terms.
Aug
25
comment Is it valid to have several IP addresses resolving back (PTR) to one name that doesn't match either of the relevant A records?
Yes, I am aware of mail related issues. Some services (notably ssh) were also very sensitive to that (it was taking an awful long time to get the prompt after the key exchange). None of the cases would apply in my case - I was rather looking for possible cases where such a setting would break bind. Thanks for the RFC pointer.