Hot answers tagged

33

No, this is not normal. Contact your provider to resolve this issue. When they can't, switch away ASAP.


28

From researching this with a different angle, I have found with openvpn routes that it can be possible to traffic specific content. I've found the following type of setup could be used: # redirect all default traffic via the VPN redirect-gateway def1 # redirect the Intranet network 192.168.1/24 via the VPN route 192.168.1.0 255.255.255.0 # redirect another ...


22

I had exactly the same problem and unfortunately auditd didn't do much for me. I had traffic from some of my servers going towards google DNS addresses, 8.8.8.8 and 8.8.4.4. Now, my network admin has mild OCD and he wanted to clean all the unnecessary traffic since we have our intern DNS caches. He wanted to disable outgoing port 53 for everyone except ...


20

Simply use a DisplayFilter http like this:


15

Nginx now has an http mirror module. Documentation is at https://nginx.org/en/docs/http/ngx_http_mirror_module.html Example configuration from the documentation: location / { mirror /mirror; proxy_pass http://backend; } location /mirror { internal; proxy_pass http://test_backend$request_uri; }


14

It has been a while since I consulted to the telecom industry so I am going off of what is still likely. For DSL, this is sub-par. You should never see traffic destined for another IP address. I would check with your provider. This is not a standard configuration and it is likely that there are some settings in the RedBack that are not right. Each ...


7

Here's a systemtap option, using the netfilter probes available in stap verson 1.8 and later. See also man probe::netfilter.ip.local_out. # stap -e 'probe netfilter.ip.local_out { if (dport == 53) # or parametrize printf("%s[%d] %s:%d\n", execname(), pid(), daddr, dport) }' ping[24738] 192.168.1.10:53 ping[24738] 192.168.1.10:53 ^C


6

The certificate itself does not affect the scaling of the application. The performance might be affected by the size of the certificate and the chain, so a short certificate chain might perform better. But in practice this does not matter that much as long as session reuse is enabled at the server side (usually the default configuration). I think the main ...


6

Yes, the tc is designed for this. TC works over any types of interfaces (physical and software). Most simple queue scheduler is the htb (Hierarchical Token Bucket). Typical simple configuration: htb root queue discipline root class (100% bandwidth) default leaf class (80% bandwidth guarantee, up to to 100% bandwidth) bandwidth limited leaf class 1 (10% ...


5

Well, it's not possible because your provider said so. How can we know your provider's network architecture? That said, it's trivial to configure an IPSec association (probably transport mode) between your two servers to allow private, authenticated, encrypted communication.


5

you are correct there is only so much Memory and only so many processors you can through at a server. Not to mention the fact that if you only have a single server running your application you have all your eggs in one basket. What if your single server fails? So we scale out, we add multiple servers running the same application to add scalability and high ...


5

I believe that nftables counters are stored in kernel memory only, similar to tables and rules. They may not persist across reboots. My suggestion to keep permanent record of the counter values is to: Declare your counters in a separate file and include it from your main nftables configuration file. Have the counter declaration file updated with current ...


4

netstat + grep is a good and simple option for a few connections but if you have a huge number of connections I would recommend ss as recommended in nixCraft. For instance: ss -s Total: 78 (kernel 79) TCP: 31 (estab 27, closed 0, orphaned 0, synrecv 0, timewait 0/0), ports 16 Transport Total IP IPv6 * 79 - - RAW 0 ...


4

If it's cable, by definition it's shared circuit. Seeing other people's downstream under global logging of all packets would be normal. Promisc mode cable gear would be an interesting anomaly but that sounds like exactly what is happening.


4

It would depend entirely on the amount of packages you had installed, the amount of updates released during that month, and now often you updated apt cache. In other words, how long is a piece of string?


4

Bandwidth consumption is more complicated than what can be described with just a single number. However the exact scenario you are asking about can mostly be explained by looking at two measures. What is the actual link speed and what is the monthly quota? Link speeds are usually measured in megabits per second (Mb/s for short). Typically those ranges from ...


4

You should be able do this by using src-nat with destination address lists and setting to-address to the desired ip. for the default ip, copy the rule and don't set a dest. address list. For dns names you'll want to create a script to run using the scheduler which will update an address-list with the ip addresses the website uses. The firewall rules work ...


3

You can possibly make a script which periodically calls any tool like this (http://nethogs.sourceforge.net/) or similar others. Keep appending this output to a file with time info. Run this script as a daemon. Next day you can see what is that "culprit" process. This thread seems to have more such tools : Network usage top/htop on Linux


3

Be aware that when using autitctl, nscd for example uses a slightly different parameter in the socket system call, when doing a DNS query: socket(AF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) So to make sure you catch those queries in addition to the ones that were mentioned above, you can add an additional filter, with the same name if you want: ...


3

Here is new feature from nginx (1.13.4): http://nginx.org/en/docs/http/ngx_http_mirror_module.html#mirror The ngx_http_mirror_module module (1.13.4) implements mirroring of an original request by creating background mirror subrequests. Responses to mirror subrequests are ignored.


3

The most efficient solution might be to write a daemon that would tail -f the access.log, and keep track of the $http_referer field. However, a quick and dirty solution would be to add an extra access_log file, to log only the $http_referer variable with a custom log_format, and to automatically rotate the log every X minutes. This can be accomplished with ...


3

This is how you do what you asked with iptables: sysctl net.ipv4.ip_forward=1 iptables -t nat -A PREROUTING -p tcp -d x.x.x.x --dport 500 -j DNAT --to-destination 127.0.0.1:500 iptables -t nat -A POSTROUTING -j MASQUERADE As for your shell scripting problems, you either have to setuid the script (bad idea) or use popen() to run sudo /path/to/yourscript and ...


3

Perhaps your images need a root location too. server { listen *:80; server_name dl2.rahim-soft.org; location / { location ~* \.(jpe?g|png|gif)$ { valid_referers none blocked rahim-soft.org *.rahim-soft.org; if ($invalid_referer) { return 403; } } root F:/dl2.rahim-soft.org; index index.html index....


3

Is it normal that my server is requesting dns with 22/udp as source port? No. You would expect DNS queries from a client to use either: a random ephemeral port (which you can adjust in /proc/sys/net/ipv4/ip_local_port_range but is typically 32769-60999) when no port randomization is used: UDP port 53


2

scp -l 8192 file.txt user_name@111.111.1.11:/tmp //8192 = 8192 KB per second I know this thread is quite old, but hope this will help someone.


2

Yes, of course it is possible in NGINX! What you could do is implement the following DFA: Implement rate limiting, based on $http_referer, possibly using some regex through a map to normalise the values. When the limit is exceeded, an internal error page is raised, which you can catch through an error_page handler as per a related question, going to a new ...


2

Guys I found the answer! On Firebox System Manager (the one where you use to look at Traffic Monitor), click on File -> Settings. Check the "Show Log Field Names" box and click OK. Here are the answers: Date Time Permission (ie Allow, Deny, etc) src_ip dst_ip pr (ie the looked up protocol such as ntp/udp, 8080/udp, 6699/udp, netbios-ns/udp, dns/udp, ...


2

Without further knowledge on your actual config I am going to assume you have a cgroup problem. Try this to exclude your cgroups and just to limit the device itself. #!/bin/bash # Using ifb device to shape ingress traffic modprobe ifb ifconfig ifb0 up # flush tc tc qdisc del dev eth0 root &> /dev/null tc qdisc del dev eth0 ingress &> /dev/...


2

This question reeks of premature optimization. I was hoping there would be something which would understand that one file is in high demand, for example when a new episode comes out, and would put it in a RAM cache. Can NGINX be used in that way? That's nothing you even need to worry about - it'll get cached by the OS and put into RAM the very first time ...


2

I wouldn't expect there to be much difference, if any, between Apache/Nginx/Lighttpd in this case. I would expect Apache to be slightly more memory heavy assuming you trimmed down all the modules that you don't need (which is likely most of them). My personal choice would be Lighttpd simply because I'm more familiar with it for serving static files and I've ...


Only top voted, non community-wiki answers of a minimum length are eligible