jliendo
  • Member for 12 years, 2 months
  • Last seen this week
IPv6 link-local routing
Accepted answer
14 votes

A router will never forward a packet with a source unicast link-local ipv6 address. Please take a look at this example: linux machine with only link-local address trying to ping ipv6.google.com (...

View answer
tcpdump How do I use it to capture all traffic headers
Accepted answer
12 votes

My best bet would be to use something like: tcpdump -ieth0 -s96 -w traffic.dump 'ip or icmp or tcp or udp' Where the "tricky" part will be to chose a correct value for the "-s" (snaplen) parameter (...

View answer
What is a Cisco BVI interface? What is it used for?
Accepted answer
12 votes

A BVI (Bridge Group Virtual Interface) is a routed interface that represents a set of interfaces that gets bridged. So lets say for example that in your router you have two interfaces that needs to ...

View answer
FTP hangs on: 150 Opening ASCII mode data connection
11 votes

FTP server and FTP client negotiates which ports are going to be used for the transfer of data (including the directory list when you do a "dir" or "ls") using the "control channel" of FTP. So if your ...

View answer
What steps can I take to determin if my server has been hacked?
Accepted answer
6 votes

The mail you received may very well be "backscatter", that is, the result of spam sent using your email address and the .ru SMTP server bouncing it. Not necessarily because your server was compromised ...

View answer
What can I do to "stress test" an ASA5505?
Accepted answer
5 votes

For a firewall device It is quite common to stress test the throughput capacity and simultaneous connections (and in some scenarios even the maximum size of the NAT translation table). Then there is ...

View answer
how to find out mac addresses of all machines on network
5 votes

Depending on your LAN topology, your best shot may be to display the MAC address table on your switches. So for example, if your switch infrastructure is Cisco, you may try a sh mac address-table ...

View answer
TCP sequence number and ACK number
4 votes

From TCP Connection Establishment Sequence Number Synchronization and Parameter Exchange : Once each device has chosen its ISN, it sends this value to the other device in the Sequence Number ...

View answer
Wireshark - Graphic analysis tool. anyone knows?
Accepted answer
4 votes

Have you tried Wireshark's own "statistics" tools. You have some pretty nice tools to do endpoint conversation analysis (somehow similar to netflow), IO graphs, per protocol statistics, protocols ...

View answer
man-in-the-middle attack over internet
3 votes

There are many types of MITM attacks. Each of them depends on the protocol the attacker wants to abuse or his position in relation to your topology/traffic. As you mentioned there are LAN based MITM ...

View answer
Connecting to screen
3 votes

screen -d -r 15941.pts-18.vishnuvm6

View answer
Exposing an apache port 80 that is in an office behind a firewall?
Accepted answer
2 votes

In general terms you should at your office's router or firewall add a static NAT to map an internet public address to the internal IP address of your web server. Then you should allow traffic to ...

View answer
Need confirmation on layer 2 security question
Accepted answer
2 votes

Well, for the most part you are right. Under proper configuration/normal operation all layer two traffic should not be able to "escape" the VLAN where it is generated. There are some scenarios (VLAN ...

View answer
Windows firewall blocks MS SQL Server even with firewall exceptions
Accepted answer
2 votes

Port 3306 if for mySQL. Ports 1433 and 1434 are for MS SQL server. I would advice you to configure your firewall to allow traffic for TCP/UDP on these ports.

View answer
Windows TFTP Server Recomendations?
Accepted answer
2 votes

tftp32

View answer
Is it effective installing firewall within same machine which offering service?
2 votes

If you are careful to open your ports only to the minimal subset of IP addresses that need to access those services (i.e. open custom-apps/NFS/SSH ports to just the smallest set of IP addresses that ...

View answer
writing an iptables rule which forward OSPF packets from one interface to another
Accepted answer
2 votes

[In your question it is not clear to me if the linux box is acting as a bridge/layer 2 or as a layer 3 device, so I'm assuming the later.] The OSPF Hello packets configured for a broadcast multiple-...

View answer
how to monitor traffic at port 53 (DNS)
2 votes

If you only want to see who is talking with whom on port udp/tcp 53 without requiring to have the detailed payload of such conversation, your best bet is to use netflow. I would dare to guess that ...

View answer
PAM example of performing authentication using a custom external script?
2 votes

There are a couple of examples described in pam_exec-0.2.1/doc's README

View answer
Cisco ASA subinterface limit - per interface or global?
Accepted answer
2 votes

The number of VLANs (subinterfaces) an ASA can support depends on the model and license you are using (for models below the 5520). So this number is pretty much global and not per-physical interface. ...

View answer
Tunneling over IPv4 network
2 votes

Most definitely. In case you are asking how to do it for a Cisco environment the configurations would be the following: (r100) tun1 (IPv4) ==> IPv6 Core => (r107) tun0 (IPv4) r100's e0/0 ipv6 ...

View answer
Configure hairpinning on Cisco 871 IOS 12.4(15)T4?
Accepted answer
1 votes

Assuming... my understanding of the question is right (please see comment @petrus) and that you are exposing your internal server to the internet using a static nat using something such as: (config)#...

View answer
How do you configure ASA5505 to be its own CA?
Accepted answer
1 votes

https://hostname/+CSCOCA+/enroll.html This document may help: ASA: Local CA Server configuration

View answer
wget blocked by iptables in CentOS 5.5 and iptables 1.3.5
1 votes

Have you tried iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT It may be related to "state" module/kernel extension missing/having-issues/playing-mind-games (?). May worth ...

View answer
Choose the right hardware to build a squid proxy server (200 users)
Accepted answer
1 votes

This document may give you some ideas/pointers/references

View answer
Is it possible to configure a DMZ zone on a Cisco ASA/PIX 515e device on "transparent mode"?
Accepted answer
1 votes

You will need to have your PIX in routed mode. If you use transparent mode you are assuming your internal/DMZ/outside network are all on the same layer two network (i.e. same layer two broadcast ...

View answer
Run cgi-script on commandline as user www?
1 votes

Have you tried what is suggested on Run as different user under FreeBSD?

View answer
Simple example of transparent proxy with Cisco IOS and Squid
Accepted answer
1 votes

Have you seen this: Transparent Squid with WCCP?

View answer
Run Cron Every Hour Debian
1 votes

Command scheduling with cron. Take a look at /etc/cron.hourly. Everything you place in there will get executed each and every hour.

View answer
sflow network analysis for firewall engineering
1 votes

I've being using nfdump/nfsen and Scrutinizer from Plixer since quite some time now (more nfdump than scrutinizer lately). Both are fantastic tools but they each have it's own "niche" of users. ...

View answer