Questions tagged [filter]

Usually related with text filtering of some kind, like logs. This may also refer to email filtering. Note that there are other tags that are more appropriate for network and spam filtering.

Filter by
Sorted by
Tagged with
1
vote
0answers
39 views
+50

Using tc to delay packets to several ports

After reading several pages like this this and without having a really deep knowledge about the kernel Linux, I am able to filter up to 3 ports using just the three first leaves of the tree. tc qdisc ...
1
vote
0answers
20 views

TC Filter With BPF and NFTables Packet Marking

I made a TC BPF ingress program and I want it to process specific packets only marked by NFTables. Here's my NFTables table that marks the specific packets: table ip compressor_tc { chain ...
0
votes
0answers
16 views

Exim how to add filter to incoming messages only

I have set up a basic Exim filter for testing purposes that rewrites the mail subject into: "Hello (" + original subject + ")" headers add "Old-Subject: $h_subject:" headers remove "Subject" headers ...
0
votes
2answers
36 views

How to write a complex filter in tomcat web.xml to accept partially a URL?

I am new to tomcat and I need to filter the URLs on a server to accept all clients for some URLs and accept only a specific IP for other URLs. In details, I want to accept ALL clients for for this ...
0
votes
0answers
40 views

how to apply TC htb class to each of IPs in an IP range separately?

I use HTB for TC and mark packets with iptables. First I mark a range of IPs (like 192.168.1.0/24). Now I want to apply a htb class to each of these IPs separately. If I add a class and a filter for ...
0
votes
1answer
16 views

How to filter by status information column in Thruk

I am using Thruk as a monitoring interface. At the top left corner of the page there is a button which opens a stack with filters of which hosts/services etc. you want to apply. You can easily add ...
0
votes
0answers
19 views

Conditional FilterPolicy in SNS Subscription

I have a template with an SNS subscription for an SQS queue which looks as follows (condensed for brevity): "Parameters": { "ProductionIdentifiers": { "Default": "1,2,3", "...
0
votes
1answer
99 views

Microsoft AD - Negative OU= LDAP filter

I am trying to produce a LDAP Filter for MS AD which filters users based on some OUs (in my case excluding a specific OU but also including does not work): (&(cn=Testuser1)(|(ou:dn:=Included1)(ou:...
1
vote
1answer
47 views

Spamassasin rule to flag certain MX IPs

I've noticed a flood of spam that is related to the same range of IPs. All the spam email has different HTML text (which is english but meaningless) and a few embedded pictures (which I block) but ...
0
votes
1answer
30 views

Filter ss process output without using grep

ss -p can give the process name, process id (PID) and the file descriptor associated with the connection. Example: ss -tuanp [...] tcp ESTAB 0 0 x.x.x.x:59594 x.x.x.x:993 users:(("...
0
votes
1answer
203 views

Not logic in docker filter

I have a named container that may or may not be up and if it is up I want to be able to kill all the containers but that one by name. Basically what I want is: docker kill $(docker ps -aq --filter="...
0
votes
0answers
27 views

Why can't block specified string with iptables command?

I want to block any packages flow into my pc which contains the string porn. iptables -A INPUT -m string --algo bm --string "porn" -j DROP Open my firefox and iniput keyword porn in google search ...
0
votes
1answer
43 views

tc filter … ht HANDLE … does not allow buckets of 8 bits

TC-u32 man page states that HANDLE is: HANDLE := { u12_hex_htid:[**u8_hex_hash:[u12_hex_nodeid]** | 0xu32_hex_value } so the size of the bucket should range from 0x00 to 0xff as it is a u8 value. ...
0
votes
0answers
12 views

NGINX ddos filter implementation only with header informations

i would like to know if there is any kind of implementation to to create a ddos filter only by working with headers? In first place i guess some random header has to be generated in order to attache ...
0
votes
0answers
132 views

Restricting sender and recipient with check_sender_access on postfix

i want to restrict sending mails for local senders and domainusers. I want to allow the domainusers to send mails to the Internet and the local domain(domain.de) and the local sender(like root@local ...
0
votes
1answer
71 views

How to configure postfix/dovecot setup to reject certain mail for certain users/accounts

I'd like to be able to reject email from certain users or if it contains certain strings or if the title matches something for certain users. I'm in a multidomain enviroment. Is this possible? ...
0
votes
1answer
129 views

exim filter not working on long emails

I was trying to set a file extension based filter in exim. if $message_body contains "pdf.gz" or $message_body contains "pdf.arj" This filter does work on small mail, such as mail with only test ...
0
votes
1answer
71 views

Is it possible to redirect DNS quries to different URL/DNS like opendns

I have an unbound DNS Resolver in my office lab. I m using this service to block ads and unwanted domains. Is there any possibilities to redirect DNS quires to a specific URL/DNS that shows the site/...
1
vote
1answer
793 views

How to debug Mikrotik bridge filter forward rules not having any effect?

As part of diagnosing a different problem were trying to add a bridge filter rule that will stop all traffic from forwarding between two interfaces on a bridge. The router has two interfaces ether1 ...
0
votes
1answer
108 views

fail2ban filter matches no lines for xmlrpc attack

I'm trying to jail hosts that brute-force attack a web server, thereby creating (hundreds of) lines in /var/log/apache2/error.log of the form [Fri Feb 01 11:17:56.158739 2019] [:error] [pid 15870] [...
0
votes
1answer
176 views

exim filter regex discard rule

We are trying to discard all emails with a matching subject, example of subject: Subject: DOMAIN.COM Alert: NAME We have NOT received your payment We are trying to match any domain, Alert, and "We ...
0
votes
1answer
500 views

Apply Network Filter to Ovirt Guest without Rebooting

I am trying to change the clean-traffic IP address for a oVirt Guest VM. It works as long as I reboot the VM. ( Changed from within the Guest Virtual Machine Network Settings ) But for a production ...
0
votes
1answer
217 views

Exim filter - Matching FROM and TO

I have been receiving a lot of mailer-daemon spam lately ... It's obvious the spammer is spoofing the to & from fields so that mailer-daemon kicks in and delivers the actual message to me. I ...
0
votes
1answer
181 views

fail2ban filter for common apache exploits

Every day I see hackers/script kiddies looking for url's like: /webdav /site.tar /admin /htdocs.php etc. They sometimes hit my sites for several minutes looking for common exploits. Is there a ...
0
votes
1answer
551 views

Get mac address based on ip in filter wireshark

i am a test engineer writing some test cases. I am trying to write a test which has to be performed in wireshark. However, my collegues aren't that "into wireshark" and i would like to keep it as ...
0
votes
1answer
221 views

Exim filter TLD block is blocking more than just the TLD

Need to discard emails to and from ending in a specific TLD but having an issue, example of a filter: if first_delivery and ("$h_to:, $h_cc:" contains ".win$") or ("$h_from:" contains ".win$") then ...
1
vote
1answer
377 views

tc/netem filter explenation

Iam new to tc and i find it mighty confusing, i was able to find and bit understand little command flow, to issue delay on specific IP, but i dont tink it works properly - delaying all traffic ...
0
votes
1answer
172 views

Filter log for a location but allow passing request to proxy

I know how to filter logs for a location: # inside a http block log_format filter '0.0.0.0 - $remote_user [$time_local] "$request"' '$status $body_bytes_sent ' '"$...
1
vote
1answer
200 views

Filtering dpkg logs in syslog-ng

I am new to syslog-ng, and I am setting a syslog-ng, where I am receiving logs of syslog, auth.log and dpkg.log. Although I was able to get the logs for syslog and auth.log, but I am unable to write ...
1
vote
1answer
43 views

Fold burst of many emails into one?

We are running an SGE job scheduling system. Users can let SGE send out emails in case of jobs being cancelled. In the case of a user having large array jobs (say 100'000k entries) and killing all of ...
3
votes
1answer
305 views

Toggle postfix on and off

There's probably an answer to this already, but I just can't figure out how to search for it correctly. Situation: We have a failover situation for two nodes, using keepalived, passing a floating IP ...
2
votes
2answers
571 views

Powershell script - Find LogOn attribute - How from specific OU?

This is the PowerShell script I use to find the LogOn attribute from users in Active Directory. Now rather than getting all users I want it to search only in a specific OU. The domain looks like this: ...
1
vote
0answers
342 views

Correct filtering of raw devices which are multipath components out of LVM

I have a HP MSA P2000 FC with dual controllers, dual HP SAN switches and a couple of servers with QLogic "ISP2532-based" 8G dual-port cards. Everything is connected "each to each" way. The OS is ...
0
votes
1answer
95 views

Filter pcap by subsecond detail?

I'm trying to export a subset of a pcap file given a start and an end message, this start and end message identification is currently done using ngrep on the raw data(because we have no dissector for ...
1
vote
1answer
7k views

Squid proxy_protocol_access with dstdomain acl

I'm configuring a squid proxy to work as a sort of a gateway for traffic egress. The environment in which this is deployed has a client that makes a request through a load balancer which then sends it ...
0
votes
2answers
750 views

unable to filter badly-formatted messages in syslog-ng

I am contacting you regarding an issue I have with syslog-NG. some of our devices (mainly HP switches and SANs) are sending syslog messages that do not respect the syslog RFC 5424 it seems. to give ...
2
votes
1answer
69 views

(“remotely”) Managing filters with Horde 3.3.13

I'm using Horde 3.3.13 (which is an old version I know) and uses the filters all the time. I know that thunderbird, for instance, also support filters. Is there a way to synchronize the filters on ...
0
votes
1answer
3k views

“mapper_parsing_exception” error from Elasticsearch failing to parse [timestamp] from %{COMBINEDAPACHELOG}

I've configured Logstash to filter httpd_access_log messages and grok the fields associated with COMBINEDAPACHELOG. However, I'm receiving errors like the following: [2017-02-10T15:37:39,361][WARN ][...
1
vote
0answers
455 views

Logstash syslog filter not applying to logs?

I'm looking through some syslog logs files in my ELK stack and noticed that all the syslog_severity fields are 'notice', when I can verify in the log files that they are not 'notice'. Seems like ...
1
vote
0answers
226 views

Logstash filter: syslog_pri always defaulting to notice?

I'm looking through some syslog logs files in my ELK stack and noticed that all the syslog_severity fields are 'notice', when I can verify in the log files that they are not 'notice'. Seems like ...
2
votes
1answer
3k views

SSH port filtered on machine only from within local network when using explicit ip address

To describe the situation, I need to define three machines. On the local network I have a machine (LAPTOP) and a machine (SERVER) connected over WAN and LAN to the router, respectively. The third ...
0
votes
1answer
578 views

How to filter wireshark capture to have only packets with local ip as source or destination

How to filter wireshark capture to have only packets with local ip as source or destination? The expression should be valid for both ipv4 and ipv6. I am obviously asking for an other solution than ...
0
votes
1answer
746 views

How to display only the source port with tshark

I can display the source and destination tcp ports with tshark -T fields -e tcp.port 1111,2222 2222,1111 [...] How can I display only the source port in order to get 1111 2222
1
vote
1answer
1k views

nginx multiple sub_filter not working

I have problem here. I've got nginx installed from apt on Debian, so it has the following output for nginx -V: nginx version: nginx/1.6.2 TLS SNI support enabled configure arguments: --with-cc-opt='-...
0
votes
1answer
2k views

negative WMI-Filter for security filtering in GPO

I need to create a group policy object (GPO) that will disable printer redirection for all computers except certain servers. I considered making a security group and adding all the computers except ...
1
vote
0answers
3k views

How to filter ObjectName in Windows logs with Advanced XML Filtering?

I want to deploy a centralized log analysis tool on my domain. I'm currently configuring Windows to audit a shared network drive (read, write, access attempt of domain users) to forward Windows events ...
0
votes
1answer
81 views

Dumping Splunk Events

We have a nagios instance set up so that using MK-Livestatus and splunk, we are able to push all of nagios's alerts through livestatus's socket thanks to a call from splunk. However, splunk is now ...
1
vote
1answer
516 views

Add Filter Based on Client Certificate Name (OpenVPN)

Can anyone show me how to filter (change bandwidth, delay, etc) of one or more users connecting to OpenVPN based on their Client Certificate Name? Why I would like to use the Client Cert name is I ...
0
votes
1answer
1k views

how to control ldap users access using groupdn?

I am using openldap, nslcd and nss-pam-ldapd. I want to restrict users login to ldap client. I have configured this in CentOS 6.5 without any problem using groupdn. but in CentOS 7, there is no ...
1
vote
0answers
29 views

How to block a users name from getting mail using postfix

I have a setup where I use /etc/aliases to define several email addresses for a user, e.g.: foo: user bar: user foo.bar: user However I want to block the users name (user@domain.com) from ...