Networking - Revision history

Rootadminacc: /* IPv6 */

2013-05-16T09:18:28Z

IPv6

← Older revision		Revision as of 10:18, 16 May 2013
Line 151:		Line 151:

	== IPv6 ==		== IPv6 ==

			IPv6 can potentially replace SSL as it is a much more secure protocol than IPv4.

			However for the time being, SSL will continue to be used with IPv6, and so the need to purchase certificates would remain. That might change when v6 becomes mainstream.

			In summary, the main advantages are;

			* More security – IPSec is incorporated into IPv6 as standard
			* More IP capacity – there is less restriction to assigning extra IP addresses per server as we there is with IPv4. It means companies can easily assign hundreds of IPv6 addresses per server if needed.

	{\| border="1" align="center" style="text-align:center;"		{\| border="1" align="center" style="text-align:center;"

Rootadminacc: /* Netstat */

2013-05-15T12:17:32Z

Netstat

← Older revision		Revision as of 13:17, 15 May 2013
Line 427:		Line 427:
	-l shows just listening sockets<br>		-l shows just listening sockets<br>
	-n stops it doing a DNS lookup<br>		-n stops it doing a DNS lookup<br>
			-p show the PID and name of the program to which each socket belongs<br>
	-t for TCP<br>		-t for TCP<br>
	-u for UDP		-u for UDP

Rootadminacc at 12:17, 15 May 2013

2013-05-15T12:17:04Z

← Older revision		Revision as of 13:17, 15 May 2013
Line 1:		Line 1:
	~~An important command to check what service is running on a port is ([http://www.cyberciti.biz/faq/find-out-which-service-listening-specific-port General Guide]).~~

	To check what is listening on IPv4 or IPv6 use lsof -Pnl +M -i4 (or -i6)		To check what is listening on IPv4 or IPv6 use lsof -Pnl +M -i4 (or -i6)

Rootadminacc: /* Netstat */

2013-05-15T12:16:55Z

Netstat

← Older revision		Revision as of 13:16, 15 May 2013
Line 416:		Line 416:
	== Netstat ==		== Netstat ==

	~~man netstat~~		An important command to check what service is running on a port is:

	-a shows both listening and non-listening sockets		<pre>netstat -tulpn</pre>
	-l shows just listening sockets
	-n stops it doing a DNS lookup		[http://www.cyberciti.biz/faq/find-out-which-service-listening-specific-port General Guide]
	-t for TCP
			<pre>man netstat</pre>

			netstat -pant is also good for monitoring network connections. man netstat

			-a shows both listening and non-listening sockets<br>
			-l shows just listening sockets<br>
			-n stops it doing a DNS lookup<br>
			-t for TCP<br>
	-u for UDP		-u for UDP

Rootadminacc at 12:15, 15 May 2013

2013-05-15T12:15:37Z

← Older revision		Revision as of 13:15, 15 May 2013
Line 1:		Line 1:
	An important command to check what service is running on a port is ([http://www.cyberciti.biz/faq/find-out-which-service-listening-specific-port General Guide]):		An important command to check what service is running on a port is ([http://www.cyberciti.biz/faq/find-out-which-service-listening-specific-port General Guide]).

	~~netstat -tulpn<br>~~
	~~netstat -pant is also good for monitoring network connections~~. ~~man netstat~~

	To check what is listening on IPv4 or IPv6 use lsof -Pnl +M -i4 (or -i6)		To check what is listening on IPv4 or IPv6 use lsof -Pnl +M -i4 (or -i6)

Rootadminacc: /* Network Tools */

2013-05-15T12:15:18Z

Network Tools

← Older revision		Revision as of 13:15, 15 May 2013
Line 416:		Line 416:

	netstat -s for a full report, from [http://serverfault.com/questions/318909/how-passively-monitor-for-tcp-packet-loss-linux here]		netstat -s for a full report, from [http://serverfault.com/questions/318909/how-passively-monitor-for-tcp-packet-loss-linux here]

			== Netstat ==

			man netstat

			-a shows both listening and non-listening sockets
			-l shows just listening sockets
			-n stops it doing a DNS lookup
			-t for TCP
			-u for UDP

	== Network Tools ==		== Network Tools ==

Rootadminacc: /* DOS (Denial of Service) */

2013-05-15T09:29:44Z

DOS (Denial of Service)

← Older revision		Revision as of 10:29, 15 May 2013
Line 654:		Line 654:
	'''''Under construction'''''.		'''''Under construction'''''.

	~~You~~ may get consistently signal exited from the server. If the DOS is just on one port, e.g. Apache on 80, simply kill the process and the attack cannot get through then. This will give you time to set up the rules to block it. Please be aware that the amount of combinations for just two octets (0.0.'''0.0''') is 65000 and so is a lot to manually do, even more if it is over three octets.		During a DOS/DDoS you may get consistently signal exited from the server. If the DOS is just on one port, e.g. Apache on 80, simply kill the process and the attack cannot get through then. This will give you time to set up the rules to block it. Please be aware that the amount of combinations for just two octets (0.0.'''0.0''') is 65000 and so is a lot to manually do, even more if it is over three octets.

	To ban an IP by a specific port number, for instance port 80 use this where X.X.X.X = the IP address:		To ban an IP by a specific port number, for instance port 80 use this where X.X.X.X = the IP address:
Line 666:		Line 666:
	./install.sh</pre>		./install.sh</pre>

	~~'''~~Block outgoing UDP traffic~~'''~~		=== Block outgoing UDP traffic ===

	iptables -A OUTPUT -s 192.168.0.1 -p udp -j DROP		<pre>iptables -A OUTPUT -s 192.168.0.1 -p udp -j DROP
	iptables -A OUTPUT -s 127.0.0.1 -p udp -j DROP		iptables -A OUTPUT -s 127.0.0.1 -p udp -j DROP</pre>

	Display open ports and established UDP connections:		Display open ports and established UDP connections:

	netstat -vaun		<pre>netstat -vaun</pre>

	<!--		<!--
Line 684:		Line 684:

	netstat -atun \| awk '{print $5}' \| cut -d: -f1 \| sed -e '/^$/d' \|sort \| uniq -c \| sort -n -->		netstat -atun \| awk '{print $5}' \| cut -d: -f1 \| sed -e '/^$/d' \|sort \| uniq -c \| sort -n -->

	Old method:		Old method:

	Before using the drop command please replace 0.0.0.0 with the IP received from netstat.		Before using the drop command please replace X.X.X.X with the IP received from netstat.

	<pre>ps aux		<pre>ps aux
Line 693:		Line 692:
	netstat -ant\|wc -l		netstat -ant\|wc -l
	iptables -L		iptables -L
	iptables -I INPUT -s 0.0.0.~~0/0.0.255.255~~ -j DROP ~~(or individual IP's)~~		iptables -I INPUT -s X.X.X.X -j DROP
	iptables-save		iptables-save
	service iptables restart</pre>		service iptables restart</pre>

Rootadminacc: /* DOS (Denial of Service) */

2013-05-15T09:13:24Z

DOS (Denial of Service)

Show changes

Rootadminacc: /* IPtables */

2013-05-10T14:58:48Z

IPtables

← Older revision		Revision as of 15:58, 10 May 2013
Line 108:		Line 108:

	Or DROP. These will do source: anywhere and destination: anywhere		Or DROP. These will do source: anywhere and destination: anywhere

			For a specific IP to access anything you would do:

			<pre>iptables -A INPUT -s SourceIP -j ACCEPT</pre>

	For a specific IP to access FTP you would do:		For a specific IP to access FTP you would do:

	iptables -A INPUT -m tcp -p tcp --src <IPsource> --dst <destinationIP> --dport 21 -j ACCEPT~~<br>~~		<pre>iptables -A INPUT -m tcp -p tcp --src <IPsource> --dst <destinationIP> --dport 21 -j ACCEPT
	iptables-save		iptables-save</pre>

	=== Block an IP address ===		=== Block an IP address ===

Rootadminacc: /* IPtables */

2013-05-10T14:57:09Z

IPtables

← Older revision		Revision as of 15:57, 10 May 2013
Line 76:		Line 76:
	== IPtables ==		== IPtables ==

	To clear all iptables rules use the -F option.~~<br>~~		* To clear all iptables rules use the -F option.
	To clear the nat rules do iptables -F -t nat~~<br>~~		* To clear the nat rules do iptables -F -t nat
	To clear a single rule in [[SSH]] do the following (CHAIN refers to INPUT, OUTPUT or FORWARD) e.g.:		* To clear a single rule in [[SSH]] do the following (CHAIN refers to INPUT, OUTPUT or FORWARD) e.g.:

	iptables -D INPUT number		<pre>iptables -D INPUT number</pre>

	and then do ~~iptables-save~~		and then do:

	For example iptables -D INPUT 18		<pre>iptables-save</pre>

			For example this would remove the 18th line in the INPUT chain:

			<pre>iptables -D INPUT 18</pre>

	To check the nat chain/table, do:		To check the nat chain/table, do:

	iptables -t nat -L		<pre>iptables -t nat -L</pre>

	To route traffic from the server straight through to a container for example:		To route traffic from the server straight through to a container for example: