Questions tagged [packets]
The packets tag has no usage guidance.
54
questions
1
vote
0
answers
80
views
Why are network packets getting sent to incorrect switch port
All,
I have multiple security monitoring devices that lose communication/connectivity on a regular basis throughout the week.
I have set up WireShark to monitor the network traffic going to/from one ...
- 11
0
votes
1
answer
119
views
How to get syn flags, ack flags, sequence number and acknowledgement number in tcp packets with nfqueue?
I am working on a project which can redirect the network traffic in tcp (packets sent by client to server1 will be redirected to server2) with netfilterqueue, so I need to classify the packets by ...
- 1
0
votes
2
answers
31
views
Do routers need to have assigne IP from given VLAN to foward VLAN packages?
(sorry for my basic question but I had noone to ask)
Does routers/smart-switches that foward/pass vlan packets inside same network need to have assign IP from that given VLAN that they foward packets (...
- 26
0
votes
1
answer
308
views
TCP/IP packet transmission through NAT
Why my TCP packets do not reach the destination?
I send http requests from one PC to another PC, both behind NAT:
PC1 behind NAT1, runs Wireshark.
PC2 behind NAT2, this one sends http requests.
To ...
1
vote
1
answer
414
views
In WireGuard on a sending peer, how is packet sent from the `wg0` interface to the UDP port?
I'm trying to understand, once a packet reaches the WireGuard interface (wg0) how is it sent to the UDP port from where it can be sent to the receiving peer.
I was reading the WireGuard whitepaper and ...
- 111
-2
votes
1
answer
631
views
I need to block all but one IP address from access to Mongo running on my local Mac using packet filter
Could someone help me block all incoming traffic on my network which has port forwarding set up on the router to allow incoming requests on port 27017 to be sent to the Mac running Mongo internally ...
- 101
0
votes
1
answer
424
views
iptables-dropped packet understanding
Today I read in my the below iptables-dropped packet logs and I don't really understand this log. I hope somebody can help me.
I only opened an inbound SSH port 2221 and for my outgoing traffic I ...
- 67
-1
votes
1
answer
791
views
iptables matching pattern followed by 4 random values followed by another pattern
I'm trying to create a iptables rule that matches the following pattern in this UDP packet:
0x0000: 0000 030a 0000 0000 0000 0000 0000 0800 ................
0x0010: 4500 0027 5d30 0000 6c11 232a ...
0
votes
1
answer
88
views
Under ddos attack, legit packets increase length also?
I would like to know about packets length, for example, with normal traffic (without DDoS attack) packets length is 20-40, which I believe is normal, once DDoS attack starts packets length goes over ...
0
votes
1
answer
885
views
Cisco 2960-x doesn't ping default-gateway and creates duplicate packets
I need someone's help
I have 3 Cisco 2960-X distribution switches stacked (1 master, 2 slaves),
Once a week, our monitoring system alert us that the switch is down, until we reboot it.
I ping/...
- 1
3
votes
1
answer
576
views
UDP. Sending speed is limited by the minimal Ethernet adapter configuration
I have 1Gbit Ethernet adapter on my computer. And I have the other computer with Ethernet adapter 100Mbit. The both in one LAN and connected through the 1Gbit switch.
1 Test: I try to send from my ...
2
votes
1
answer
123
views
when should I raise an alarm if I see dropped packets ( packet_in or packet_out)
I am trying to create a simple anomaly alarm detection by looking at the KPI of my Linux servers. I was wondering when should I flag an alarm if see dropped packets ( both packet_in and/or packet_out)....
- 121
0
votes
1
answer
185
views
Network Packets - Is the data always received sequentially?
Let's say you sit on your home computer and request https://google.com through your browser of choice. The TCP Handshake completes and google's server sends out the HTML/JS pages (and whatever other ...
2
votes
1
answer
383
views
Arista switch - Forward multicast traffic from vlan to vlan on different switch ports with different subsets
I have an Arista DCS-7150S-24-R
I got a cross connect from provider X into port #1 (port marked as vlan 100)
I got a linux host connected to to the switch at port #2 (port marked as vlan 200)
Ports ...
- 61
-1
votes
1
answer
1k
views
How to prevent Source Engine Query DDoS Attack?
I recently started a game hosting company and one of my boxes is being hit very hard by what i believe is a botnet(getting thousands of ip addresses sending traffic to a port where a game server is ...
- 1
-3
votes
2
answers
159
views
What is the reason to use SSL on websites if it can be decrypted easily?
Since SSL can be decrypted easily using a basic man in the middle node, whats the reason to continue using it? Don't most ISPs decrypt on a daily basis using Deep Packet Inspection? And isn't it ...
- 99
1
vote
2
answers
29k
views
How to set the UDP Packet Size with iperf3?
How to set the UDP Packet Size with iperf3?
The flag "-M" does not work with iperf3. Is there an alternative?
- 341
0
votes
1
answer
626
views
Why iptables is not working as expected?
I have put these four filters with iptables:
iptables -I FORWARD -p udp -i eth0 -j DROP
iptables -I FORWARD -p udp -o eth0 -j DROP
iptables -I INPUT -p udp -i eth0 -j DROP
iptables -I OUTPUT -p udp -...
2
votes
1
answer
1k
views
Proving packets per second bottleneck?
I have a '100Mb' network connection that's currently consistently transmitting at about 20K packets/sec, irrespective of packet size in the range of 300-600 bytes. This yields an observed bandwidth ...
- 125
3
votes
2
answers
4k
views
Drop fragmented packets in nftables
Using iptables is it possible to block fragmented packets with this rule:
iptables -A INPUT -f -j DROP
But there isn't a equivalent in nftables. There is any way to do it?
- 772
-1
votes
1
answer
941
views
the MAC header of captured wireshark packets
I have been reading about the IEEE 802.11 and especially on the MAC layer, and i noticed that it contains a lot of informations, but when i start to capture with wireshark with my wireless card, the ...
- 141
0
votes
1
answer
504
views
Why are duplicated UDP packets being dropped 10 out of 11 times by this iptables configuration?
I am trying to duplicate UDP packets flowing to port 50007 on an Internet address from devices on a local NAT network (192.168.12.0/24) with the intent of processing them locally (on 192.168.12.1:...
- 243
1
vote
0
answers
1k
views
tcp previous segment not captured when NAT
I have a client request web service on a server behide NAT.
My client IP is 10.54.10.193
NAT address: 10.54.28.183
Server address: 62.209.39.203
When client request web service on server we have TCP ...
- 11
2
votes
1
answer
896
views
Packets being routed to the wrong IP
Looked around, can't find a similar issue anywhere...
I have been having some very strange and hard to explain problems on my network lately, and in my efforts to find the cause, I came across an ...
- 143
1
vote
1
answer
6k
views
Setting ToS/QoS for VoIP on Mikrotik
I have a Mikrotik router which looks like iptables. I need to setup QoS to ensure VoIP phones get top traffic priority. How do I know what ToS to use and how would I get it? I searched and can't seem ...
- 3,931
1
vote
1
answer
2k
views
Opening a port to only one external ip address
I want my port 2255 on 192.168.1.101 to accept and send packets only from and to 74.22.22.22
What settings needs to be added on the windows firewall and my router?
0
votes
1
answer
543
views
How to connect Network and GRE Tunnel Traffic and control and flow of TCP/UDP Packets?
I need some serious help with a complex routing setup I am doing.
Lets I have a /24 IPv4 .I am announcing the same /24 at two different locations.
One is a ISP exchange center where all the ISPs peer ...
1
vote
2
answers
863
views
Best way to trace outgoing requests from a server
We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php HTTP/1....
- 289
2
votes
0
answers
329
views
Apache Instance in Private Subnet not returning packets
How can we get the Apache instance in a private subnet to work?
Configuration
Public subnet with 1 NAT instance
Private subnet with 1 App instance
Details
1. Masquerading is turned on NAT on via ...
- 1,555
0
votes
1
answer
394
views
How can I tell what's happening to my packets?
I'm trying to bring up a little box on my network. I just reflashed the firmware and it's supposed to come up as 192.168.1.1 by default. My router is a DSL modem at 192.168.0.1; it usually uses a ...
- 131
5
votes
3
answers
9k
views
Tcpdump on ec2 not seeing all packets
I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page).
Running tcpdump with the command
# ...
- 51
0
votes
1
answer
43
views
How to specify packets in traceroute? [closed]
I reading the manual pages for help, but I didn't find a parameter that allows you to specify how many packets to send with the program?
Would appreciate tips from you guys, thanks!
- 113
0
votes
1
answer
201
views
Windows XP procedurally drop packets [closed]
We have a need in our office network to procedurally drop incoming packets on an Windows XP machine acting as a server.
By procedurally we mean to drop a percentage of packets incoming to the XP ...
- 175
2
votes
0
answers
573
views
PHP-FPM slowlog and Mysql lost connection
I was having an issue with PHP-FPM and mysql. When I needed to process an input file that would generate several selects/inserts/updates for each line, it would stop after approximately 60s with ...
- 327
3
votes
1
answer
3k
views
Need help understanding capturing from Wireshark?
I am having issues with my FTP servers.
Connecting, sending and receiving fail sometimes, and it is not consistent.
I manage to capture and filter by IP the packets, I just need pointers on what can ...
- 31
1
vote
2
answers
82
views
What do other nodes do with a switch's packets the first time the packets are sent out? [closed]
When it comes to switches I learned that the first time packets are sent from one node to another, the packets are sent to all nodes on that network. The switch then remembers where, for example, ...
- 123
4
votes
1
answer
6k
views
How does an Access Point handle broadcast packets from the wired side?
I have an Cisco AP 1242AG autonomous AP connected to L2 switches.
Let's say I have 100 wired devices each sending 2 broadcast UDP packets per second.
Obviously these packets will reach the Access ...
- 69
3
votes
1
answer
3k
views
Percona: Got an error writing communication packets
Since a few days, two of our php-applications (symfony2) are reporting the following errors in mysql-logs:
[Warning] Aborted connection 253 to db: '$appname' user: '$appname' host: 'localhost' (Got ...
- 197
1
vote
1
answer
4k
views
Is there a way to explicitly set the maximum number of packets tcpdump will capture before terminating?
We have a small script that essentially does the following:
A) Capture packets using tcpdump and pipe to output file.
B) Run our own clean + sort script on output file.
C) Display results using | ...
- 1,018
0
votes
1
answer
4k
views
tcpdump: can't create rx ring on packet socket: Cannot allocate memory
I've been using tcpdump without any issues before this error popped up. I use the following two commands with variations as soon as my server is attacked so the packets automatically get dumped if the ...
- 437
19
votes
3
answers
85k
views
ifconfig eth0 RX dropped packets
The problem
The ifconfig command shows more and more dropped packets in the RX section. So, there seem to be a problem to some packets arriving from the Internet to my server.
The questions
What ...
- 1,002
2
votes
1
answer
5k
views
is there such a thing as "too many packets per second"?
we have 2 offices in separate buildings. there is an ethernet link between the two.
The link is provided by the company that manages one of the buildings, and they provide us with 100Mbps bandwidth ...
user175416
1
vote
2
answers
6k
views
F5 Packet filtering or iRules or both?
I need to set-up a custom filter for a virtual host that requires both ip address checks and URL check. Like so:
_if_ _(_ http-request matches url _and_ ip is from certain host/net range _)_
...
- 193
2
votes
2
answers
205
views
Wireshark and mirrored ports bringing in 10k+ packets a second
I've got wireshark setup on a monitoring machine to monitor our offices internet traffic (approx 40 machines). However, whenever I start wireshark within about 30-40 seconds it has crashed - I think ...
- 21
1
vote
0
answers
672
views
Duplicate syn packets sent from Windows server 2003 sp2
My pc is running Windows server 2003 sp2. Whenever I establish an internet connection (e.g., with internet explorer to google.com), my host sends the syn packet twice. It is (probably not) a ...
- 11
1
vote
1
answer
783
views
iptables/haproxy limit packets per second
Is it possible to limit incoming tcp packets per second (or bytes per second) with iptables or haproxy? I have found many examples but none of them seem to work.
- 21
1
vote
2
answers
3k
views
irqbalance on linux and dropped packets
I am investigating dropped packets on a dual core, quad XEON box running Linux. One thing I see is irqbalance running on the system. I have a couple of questions. Reading the docs here I think I ...
- 57
2
votes
4
answers
2k
views
Reject all mail packages on all ports (outgoing) on Ubuntu
I just had a problem with our ISP; our internet connection was blocked because there was to much mail being send from our ip. The problem is that we all use gmail and that no mail is being send ...
- 125
5
votes
2
answers
2k
views
How do I fake dropped packets (or actually make them fail)?
Background
One of our clients suffers from an intermittant problem with their internet where it will drop packets when a user downloads a large file (their IT is looking into the problem).
I have ...
1
vote
0
answers
204
views
Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?
iptables -N NEW_TCP_PACKETS_NO_SYN
iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:"
iptables ...
- 1,367