Questions tagged [packets]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
13 views

How to get syn flags, ack flags, sequence number and acknowledgement number in tcp packets with nfqueue?

I am working on a project which can redirect the network traffic in tcp (packets sent by client to server1 will be redirected to server2) with netfilterqueue, so I need to classify the packets by ...
user avatar
  • 1
0 votes
2 answers
28 views

Do routers need to have assigne IP from given VLAN to foward VLAN packages?

(sorry for my basic question but I had noone to ask) Does routers/smart-switches that foward/pass vlan packets inside same network need to have assign IP from that given VLAN that they foward packets (...
user avatar
0 votes
1 answer
47 views

TCP/IP packet transmission through NAT

Why my TCP packets do not reach the destination? I send http requests from one PC to another PC, both behind NAT: PC1 behind NAT1, runs Wireshark. PC2 behind NAT2, this one sends http requests. To ...
user avatar
1 vote
1 answer
130 views

In WireGuard on a sending peer, how is packet sent from the `wg0` interface to the UDP port?

I'm trying to understand, once a packet reaches the WireGuard interface (wg0) how is it sent to the UDP port from where it can be sent to the receiving peer. I was reading the WireGuard whitepaper and ...
user avatar
  • 111
-2 votes
1 answer
322 views

I need to block all but one IP address from access to Mongo running on my local Mac using packet filter

Could someone help me block all incoming traffic on my network which has port forwarding set up on the router to allow incoming requests on port 27017 to be sent to the Mac running Mongo internally ...
user avatar
  • 101
0 votes
1 answer
133 views

iptables-dropped packet understanding

Today I read in my the below iptables-dropped packet logs and I don't really understand this log. I hope somebody can help me. I only opened an inbound SSH port 2221 and for my outgoing traffic I ...
user avatar
-1 votes
1 answer
418 views

iptables matching pattern followed by 4 random values followed by another pattern

I'm trying to create a iptables rule that matches the following pattern in this UDP packet: 0x0000: 0000 030a 0000 0000 0000 0000 0000 0800 ................ 0x0010: 4500 0027 5d30 0000 6c11 232a ...
user avatar
0 votes
1 answer
40 views

Under ddos attack, legit packets increase length also?

I would like to know about packets length, for example, with normal traffic (without DDoS attack) packets length is 20-40, which I believe is normal, once DDoS attack starts packets length goes over ...
user avatar
0 votes
1 answer
639 views

Cisco 2960-x doesn't ping default-gateway and creates duplicate packets

I need someone's help I have 3 Cisco 2960-X distribution switches stacked (1 master, 2 slaves), Once a week, our monitoring system alert us that the switch is down, until we reboot it. I ping/...
user avatar
2 votes
1 answer
254 views

UDP. Sending speed is limited by the minimal Ethernet adapter configuration

I have 1Gbit Ethernet adapter on my computer. And I have the other computer with Ethernet adapter 100Mbit. The both in one LAN and connected through the 1Gbit switch. 1 Test: I try to send from my ...
user avatar
2 votes
1 answer
98 views

when should I raise an alarm if I see dropped packets ( packet_in or packet_out)

I am trying to create a simple anomaly alarm detection by looking at the KPI of my Linux servers. I was wondering when should I flag an alarm if see dropped packets ( both packet_in and/or packet_out)....
user avatar
  • 121
0 votes
1 answer
90 views

Network Packets - Is the data always received sequentially?

Let's say you sit on your home computer and request https://google.com through your browser of choice. The TCP Handshake completes and google's server sends out the HTML/JS pages (and whatever other ...
user avatar
2 votes
1 answer
252 views

Arista switch - Forward multicast traffic from vlan to vlan on different switch ports with different subsets

I have an Arista DCS-7150S-24-R I got a cross connect from provider X into port #1 (port marked as vlan 100) I got a linux host connected to to the switch at port #2 (port marked as vlan 200) Ports ...
user avatar
  • 61
-1 votes
1 answer
1k views

How to prevent Source Engine Query DDoS Attack?

I recently started a game hosting company and one of my boxes is being hit very hard by what i believe is a botnet(getting thousands of ip addresses sending traffic to a port where a game server is ...
user avatar
  • 1
-3 votes
2 answers
108 views

What is the reason to use SSL on websites if it can be decrypted easily?

Since SSL can be decrypted easily using a basic man in the middle node, whats the reason to continue using it? Don't most ISPs decrypt on a daily basis using Deep Packet Inspection? And isn't it ...
user avatar
  • 99
1 vote
2 answers
22k views

How to set the UDP Packet Size with iperf3?

How to set the UDP Packet Size with iperf3? The flag "-M" does not work with iperf3. Is there an alternative?
user avatar
  • 241
0 votes
1 answer
368 views

Why iptables is not working as expected?

I have put these four filters with iptables: iptables -I FORWARD -p udp -i eth0 -j DROP iptables -I FORWARD -p udp -o eth0 -j DROP iptables -I INPUT -p udp -i eth0 -j DROP iptables -I OUTPUT -p udp -...
user avatar
2 votes
1 answer
1k views

Proving packets per second bottleneck?

I have a '100Mb' network connection that's currently consistently transmitting at about 20K packets/sec, irrespective of packet size in the range of 300-600 bytes. This yields an observed bandwidth ...
user avatar
3 votes
2 answers
3k views

Drop fragmented packets in nftables

Using iptables is it possible to block fragmented packets with this rule: iptables -A INPUT -f -j DROP But there isn't a equivalent in nftables. There is any way to do it?
user avatar
  • 644
-1 votes
1 answer
800 views

the MAC header of captured wireshark packets

I have been reading about the IEEE 802.11 and especially on the MAC layer, and i noticed that it contains a lot of informations, but when i start to capture with wireshark with my wireless card, the ...
user avatar
  • 141
0 votes
1 answer
435 views

Why are duplicated UDP packets being dropped 10 out of 11 times by this iptables configuration?

I am trying to duplicate UDP packets flowing to port 50007 on an Internet address from devices on a local NAT network (192.168.12.0/24) with the intent of processing them locally (on 192.168.12.1:...
user avatar
1 vote
0 answers
1k views

tcp previous segment not captured when NAT

I have a client request web service on a server behide NAT. My client IP is 10.54.10.193 NAT address: 10.54.28.183 Server address: 62.209.39.203 When client request web service on server we have TCP ...
user avatar
  • 11
2 votes
1 answer
717 views

Packets being routed to the wrong IP

Looked around, can't find a similar issue anywhere... I have been having some very strange and hard to explain problems on my network lately, and in my efforts to find the cause, I came across an ...
user avatar
1 vote
1 answer
5k views

Setting ToS/QoS for VoIP on Mikrotik

I have a Mikrotik router which looks like iptables. I need to setup QoS to ensure VoIP phones get top traffic priority. How do I know what ToS to use and how would I get it? I searched and can't seem ...
user avatar
  • 3,791
1 vote
1 answer
1k views

Opening a port to only one external ip address

I want my port 2255 on 192.168.1.101 to accept and send packets only from and to 74.22.22.22 What settings needs to be added on the windows firewall and my router?
user avatar
0 votes
1 answer
482 views

How to connect Network and GRE Tunnel Traffic and control and flow of TCP/UDP Packets?

I need some serious help with a complex routing setup I am doing. Lets I have a /24 IPv4 .I am announcing the same /24 at two different locations. One is a ISP exchange center where all the ISPs peer ...
user avatar
1 vote
2 answers
436 views

Best way to trace outgoing requests from a server

We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php HTTP/1....
user avatar
  • 289
2 votes
0 answers
300 views

Apache Instance in Private Subnet not returning packets

How can we get the Apache instance in a private subnet to work? Configuration Public subnet with 1 NAT instance Private subnet with 1 App instance Details 1. Masquerading is turned on NAT on via ...
user avatar
  • 1,525
0 votes
1 answer
381 views

How can I tell what's happening to my packets?

I'm trying to bring up a little box on my network. I just reflashed the firmware and it's supposed to come up as 192.168.1.1 by default. My router is a DSL modem at 192.168.0.1; it usually uses a ...
user avatar
5 votes
3 answers
7k views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
user avatar
  • 51
0 votes
1 answer
41 views

How to specify packets in traceroute? [closed]

I reading the manual pages for help, but I didn't find a parameter that allows you to specify how many packets to send with the program? Would appreciate tips from you guys, thanks!
user avatar
  • 113
0 votes
1 answer
195 views

Windows XP procedurally drop packets [closed]

We have a need in our office network to procedurally drop incoming packets on an Windows XP machine acting as a server. By procedurally we mean to drop a percentage of packets incoming to the XP ...
user avatar
  • 175
2 votes
0 answers
527 views

PHP-FPM slowlog and Mysql lost connection

I was having an issue with PHP-FPM and mysql. When I needed to process an input file that would generate several selects/inserts/updates for each line, it would stop after approximately 60s with ...
user avatar
3 votes
1 answer
3k views

Need help understanding capturing from Wireshark?

I am having issues with my FTP servers. Connecting, sending and receiving fail sometimes, and it is not consistent. I manage to capture and filter by IP the packets, I just need pointers on what can ...
user avatar
1 vote
2 answers
56 views

What do other nodes do with a switch's packets the first time the packets are sent out? [closed]

When it comes to switches I learned that the first time packets are sent from one node to another, the packets are sent to all nodes on that network. The switch then remembers where, for example, ...
user avatar
4 votes
1 answer
5k views

How does an Access Point handle broadcast packets from the wired side?

I have an Cisco AP 1242AG autonomous AP connected to L2 switches. Let's say I have 100 wired devices each sending 2 broadcast UDP packets per second. Obviously these packets will reach the Access ...
user avatar
3 votes
1 answer
3k views

Percona: Got an error writing communication packets

Since a few days, two of our php-applications (symfony2) are reporting the following errors in mysql-logs: [Warning] Aborted connection 253 to db: '$appname' user: '$appname' host: 'localhost' (Got ...
user avatar
0 votes
1 answer
2k views

Is there a way to explicitly set the maximum number of packets tcpdump will capture before terminating?

We have a small script that essentially does the following: A) Capture packets using tcpdump and pipe to output file. B) Run our own clean + sort script on output file. C) Display results using | ...
user avatar
0 votes
1 answer
4k views

tcpdump: can't create rx ring on packet socket: Cannot allocate memory

I've been using tcpdump without any issues before this error popped up. I use the following two commands with variations as soon as my server is attacked so the packets automatically get dumped if the ...
user avatar
19 votes
3 answers
78k views

ifconfig eth0 RX dropped packets

The problem The ifconfig command shows more and more dropped packets in the RX section. So, there seem to be a problem to some packets arriving from the Internet to my server. The questions What ...
user avatar
  • 922
2 votes
1 answer
5k views

is there such a thing as "too many packets per second"?

we have 2 offices in separate buildings. there is an ethernet link between the two. The link is provided by the company that manages one of the buildings, and they provide us with 100Mbps bandwidth ...
user avatar
1 vote
2 answers
5k views

F5 Packet filtering or iRules or both?

I need to set-up a custom filter for a virtual host that requires both ip address checks and URL check. Like so: _if_ _(_ http-request matches url _and_ ip is from certain host/net range _)_ ...
user avatar
  • 193
2 votes
2 answers
200 views

Wireshark and mirrored ports bringing in 10k+ packets a second

I've got wireshark setup on a monitoring machine to monitor our offices internet traffic (approx 40 machines). However, whenever I start wireshark within about 30-40 seconds it has crashed - I think ...
user avatar
1 vote
0 answers
594 views

Duplicate syn packets sent from Windows server 2003 sp2

My pc is running Windows server 2003 sp2. Whenever I establish an internet connection (e.g., with internet explorer to google.com), my host sends the syn packet twice. It is (probably not) a ...
user avatar
1 vote
1 answer
685 views

iptables/haproxy limit packets per second

Is it possible to limit incoming tcp packets per second (or bytes per second) with iptables or haproxy? I have found many examples but none of them seem to work.
user avatar
  • 21
1 vote
2 answers
3k views

irqbalance on linux and dropped packets

I am investigating dropped packets on a dual core, quad XEON box running Linux. One thing I see is irqbalance running on the system. I have a couple of questions. Reading the docs here I think I ...
user avatar
  • 57
2 votes
4 answers
1k views

Reject all mail packages on all ports (outgoing) on Ubuntu

I just had a problem with our ISP; our internet connection was blocked because there was to much mail being send from our ip. The problem is that we all use gmail and that no mail is being send ...
user avatar
  • 125
5 votes
2 answers
2k views

How do I fake dropped packets (or actually make them fail)?

Background One of our clients suffers from an intermittant problem with their internet where it will drop packets when a user downloads a large file (their IT is looking into the problem). I have ...
user avatar
1 vote
0 answers
199 views

Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?

iptables -N NEW_TCP_PACKETS_NO_SYN iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:" iptables ...
user avatar
  • 1,327
1 vote
1 answer
477 views

Mysteriously dropped packets

I have server with Broadcom Corporation NetXtreme II BCM5706 Gigabit Ethernet chips, and 2.6.18-164.2.1.el5 kernel from Red Hat Enterprise Linux Server release 5.4 (Tikanga). During normal work day ...
user avatar