Hot answers tagged

40 votes
Accepted

Do DNS queries always travel over UDP?

Normal DNS queries use UDP port 53, but longer queries (> 512 octets) will receive a 'truncated' reply, that results in a TCP 53 conversation to facilitate sending/receiving the entire query. Also, ...
32 votes

What is the difference between Unix sockets and TCP/IP sockets?

What's the difference between Unix socket and TCP/IP socket? A TCP/IP socket is used for communication across TCP/IP networks. A connected TCP socket is identified by the combination of local IP, ...
  • 4,096
29 votes

Do DNS queries always travel over UDP?

This started as a comment to George's answer, but it got long. The larger picture is somewhat complicated, as it requires understanding some history. RFC 1035 originally called for a limit of 512 ...
  • 32.1k
28 votes
Accepted

What is the best way to measure latency via a "telnet to port" test, preferably with built-in Linux tools?

What about : time nc -zw30 <host> <port>
20 votes

Why is it good practice to compare checksums when downloading a file?

There is probably a zillion reasons why one should check the md5sum but a few do come to my mind: Malicious activity - your ISO could have been tampered with on the way from the server The page ...
20 votes

Why is it good practice to compare checksums when downloading a file?

As has been noted by others, there are many possibilities for data corruption where any checksum at the transport layer cannot help, such as corruption happening already before the checksum is ...
19 votes
Accepted

How to configure iptables so an unwanted port is not reported as filtered

Don't use DROP, that's easily identified as "filtered" if you know the box is up. Instead, you may use the following to send a RST. (as if there is a service listening, but it doesn't accept ...
  • 1,126
18 votes
Accepted

Under HTTP2, how often are new TCP connections initiated?

There are only few guidelines in the relevant section 9 of the specification: There should not be multiple connections from the browser to the same server Connections should not be closed "until it ...
17 votes
Accepted

Netcat fails to start in listening mode

I ran into the same issue. You can solve it this way: # Removes the old package yum erase nc # Manually downloads the working package from the Official Repository wget http://vault.centos.org/6.6/os/...
  • 489
16 votes
Accepted

Simulate slow connection between two ubuntu server machines

To do this you can make usage of tc alone with u32 filters or combined with iptables marking (maybe more straightforward if you don't want to learn the complex filters syntax). I'll in the following ...
  • 12.9k
16 votes
Accepted

How do I dump raw data from a TCP port in Windows using the netsh command?

Yes, you can do that with netsh: Run this command as admin: netsh trace start capture=yes tracefile=c:\temp\trace.etl then, stop the capture with netsh trace stop and grab the .etl file. Download ...
  • 6,445
15 votes

Why would a server not send a SYN/ACK packet in response to a SYN packet

In my case the following command fixed the problem with missing SYN/ACK replies from Linux server: sysctl -w net.ipv4.tcp_tw_recycle=0 I think it is more correct than disabling TCP timestamps, as TCP ...
  • 351
15 votes
Accepted

Why are connections in FIN_WAIT2 state not closed by the Linux kernel?

The kernel timeout only applies if the connection is orphaned. If the connection is still attached to a socket, the program that owns that socket is responsible for timing out the shutdown of the ...
13 votes

Is there a way to see what is actually filtering TCP port communication?

Nmap provides several ways to get more information about what is causing the filtering: The --reason option will show the type of response that caused the "filtered" port state. This could be "no-...
  • 4,380
12 votes

Which is the default TCP connect timeout in Windows?

Usually "connect timeout" refers to the timeout for creating the initial connection to a host. In many systems (Windows 7 included), this value is configured using separate settings from timeouts for ...
12 votes

Does HTTPS use TCP or UDP?

Nowadays HTTPS can run above either TCP or UDP. The new "QUIC" protocol aims to replace multiple TCP connections with one multiplexed UDP connection, and hence can handle SSL and HTTPS: HTTPS &...
12 votes

Is ARP Connection oriented or connectionless?

ARP Connection oriented or connectionless? Connectionless - it's just a request and a response (or a broadcast just letting everyone know about something). It uses TCP It doesn't use TCP - TCP is ...
12 votes
Accepted

Is there a way to see what is actually filtering TCP port communication?

This is what the nmap docs say about the filtered state filtered Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering ...
  • 115k
12 votes
Accepted

Does UDP includes of source address?

Both UDP and TCP does not include source address Your question is based on a misunderstanding. It's true that neither UDP or TCP headers include a source address, but that's because they don't have ...
  • 32.1k
10 votes
Accepted

tool for splitting pcap files by TCP connection?

You can also use PcapSplitter which is part of the PcapPlusPlus package. It does exactly what you need (which is splitting pcap files by TCP or UDP connection), it's multi-platform and it doesn't have ...
  • 408
10 votes

ran out of tcp udp ports

I recommend to plan separation of roles (unless the gateway requires the SQL to be on the same host) - not due the fact that you're running out of ports. If the SQL is not required by the gateway and/...
10 votes

How to configure iptables so an unwanted port is not reported as filtered

-A INPUT -p tcp -m tcp --dport 995 -j REJECT --reject-with tcp-reset should be doing what you want (reply with RST).
  • 97.9k
10 votes
Accepted

Do clients typically implement failover/load-balancing on multiple A records?

The short answer is that it varies. When multiple address records are present in the answer set, a queried DNS server normally returns them in a randomized order. The operating system will typically ...
  • 32.1k
10 votes
Accepted

TCP congestion control for IPv6 under Linux

Yes, both sysctl (net.ipv4.tcp_allowed_congestion_control and net.ipv4.tcp_available_congestion_control) and /proc entry (/proc/sys/net/ipv4/tcp_congestion_control) apply to every IPv4 and IPv6 TCP ...
10 votes
Accepted

How to set up a persistent TCP gender-changer proxy?

The important question is, how will A react to loss of connection, or to connection being refused? Anything that just assumes that a single TCP connection will stay up forever is going to be fragile; ...
  • 4,253
10 votes
Accepted

What do the following mean: TCP:RA, TCP:FA ,TCP:PA, TCP:S, TCP:SEC

They represent the TCP flags, indeed. RFC 793, 3.1: Control Bits: 6 bits (from left to right): URG: Urgent Pointer field significant ACK: Acknowledgment field significant PSH: Push Function RST: ...
  • 44.6k
9 votes

TCP/IP routing: accessing a LAN device with wrong static IP configuration

To be able to access the device, all you need is an additional IP address in the same network as the device which has a wrong IP. There is no need to directly attach the device to your computer. ...
  • 3,647
9 votes

Extreme UDP packet loss at 300Mbit (14%), but TCP > 800Mbit w/o retransmits

There is no problem. This is normal and expected behaviour. The reason for the packet loss is that UDP doesn't have any congestion control. In tcp when congestion control algorithms kick in, it ...
  • 14.3k
9 votes

Netcat fails to start in listening mode

This particular version of netcat has a bug. Until there's a fix out for it, the only thing you can do is to downgrade to a previous version - sudo yum remove nc-1.84-24.el6.x86_64; sudo yum install ...
  • 27.5k

Only top scored, non community-wiki answers of a minimum length are eligible