Networking

Note: Host seems down. If it is really up, but blocking our ping probes, try -PN

dmesg | grep -i duplex
ethtool eth0
mii-tool
apt-get install curl
curl ifconfig.me
telnet localhost 1234
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused

nmap serverIP -p1234
PORT     STATE  SERVICE
1234/tcp closed unknown
 telnet localhost 1234
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
^]
telnet> quit
Connection closed.

nmap serverIP -p1234
PORT     STATE  SERVICE
4430/tcp open  unknown
iptables -t nat -A PREROUTING -p tcp --dport PortYouChose -j DNAT --to ContainerIP:22
iptables-save
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p udp --dport 9987 -j ACCEPT
iptables-save
ACCEPT     tcp  --  sourceIP  destinationIP tcp dpt:ftp
ACCEPT     tcp  --  sourceIP  destinationIP tcp dpt:ftp
DROP       tcp  --  anywhere  anywhere      tcp dpt:ftp
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables-save
vim /etc/network/interfaces
iface interface inet6 static
#e.g. iface eth0 inet6 static
    gateway IPv6 address to the fourth octet::1
    address IPv6 address
    netmask 64
/etc/init.d/networking restart
traceroute -n -w 2 -q 2 -m 30 8.8.8.8 ; traceroute -n -w 2 -q 2 -m 30 2001:4860:4860::8888
at now + 10 minutes
at> service iptables stop
at> ^D
netstat -tulpn
apt-get install ethstats
nmap -P0 -vvv IP
nmap -P0 -vvv IP | grep port
nmap 127.0.0.1 -p80
nmap 127.0.0.1 -p T:443
nmap -sU 127.0.0.1 -p U:9987 -PN
nmap destination
nmap destination -PN
nmap -PN -sT -vv -n -p1-1000 -T4 -oNmapTCPConnect.txt IPaddress
nmap -PN -sS -f -vv -n -p1001-65535 -T4 -max-rtt-timeout 15 -oNmapSYNScan.txt destination
nmap -PN -sU -vv -n -p U:1-65535 -T4 -max-rtt-timeout 15 -oNmapSYNScan.txt destination
apt-get install ntop
ntop --set-admin-password
chmod 755 /var/lib/ntop
chown -R nobody:root /var/lib/ntop/ (alternatively try ntop:root, nobody:nogroup or ntop:nogroup)
#addressQueue.db can be root:root and interfaces can be nobody:nogroup)

ethernet_dev=venet0:0
ntop -i venet0:0
apt-get install vnstat vnstati
/etc/init.d/vnstat start
# default interface
Interface "eth0"
apt-get install ntp
ntpq -p
ntpq -pn
Sender
| ^
v |
| ^
|<--\ |
v *->/
\->-/
.
.
.
.
Recipient
Sender
v ^ ^ ^ ^
+-/ | | |
+->-/ | |
+->----/ |
+->-------/
v
Recipient
ifconfig eth1:1 ifdown
#!/bin/bash
#netmon.sh
netstat -tulnap | grep -v LISTEN

echo -e "\n`date`" >> netstat.log
netstat -tulnap | grep -v LISTEN >> netstat.log
netstat -ant | wc -l
netstat -n -p|grep SYN_REC | wc -l
cd /root
vim ipblockscript.sh
#!/bin/bash
### Block all traffic from CHINA (CN). Use ISO code ###
ISO="cn"

### Set PATH ###
IPT=/sbin/iptables
WGET=/usr/bin/wget
EGREP=/bin/egrep

### No editing below ###
SPAMLIST="countrydrop"
ZONEROOT="/root/iptables"
DLROOT="http://www.ipdeny.com/ipblocks/data/countries"

cleanOldRules(){
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
}

# create a dir
[ ! -d $ZONEROOT ] && /bin/mkdir -p $ZONEROOT

# clean old rules
cleanOldRules

# create a new iptables list
$IPT -N $SPAMLIST

for c  in $ISO
do
	# local zone file
	tDB=$ZONEROOT/$c.zone

	# get fresh zone file
	$WGET -O $tDB $DLROOT/$c.zone

	# country specific log message
	SPAMDROPMSG="$c Country Drop"

	# get
	BADIPS=$(egrep -v "^#|^$" $tDB)
	for ipblock in $BADIPS
	do
	   $IPT -A $SPAMLIST -s $ipblock -j LOG --log-prefix "$SPAMDROPMSG"
	   $IPT -A $SPAMLIST -s $ipblock -j DROP
	done
done

# Drop everything
$IPT -I INPUT -j $SPAMLIST
$IPT -I OUTPUT -j $SPAMLIST
$IPT -I FORWARD -j $SPAMLIST

# call your other iptable script
# /path/to/other/iptables.sh

exit 0
chmod +x ipblockscript.sh
crontab -e
@weekly /path/to/country.block.iptables.sh
:wq
/root/ipblockscript.sh
iptables -L
top
netstat -ant | wc -l
netstat -ant

iptables -A INPUT -p tcp -s X.X.X.X --dport 80 -j DROP
wget http://www.inetbase.com/scripts/ddos/install.sh
chmod 0700 install.sh
./install.sh
ps aux
netstat -ant
netstat -ant|wc -l
iptables -L
iptables -I INPUT -s 0.0.0.0/0.0.255.255 -j DROP (or individual IP's)
iptables-save
service iptables restart
netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr

netstat -ntu | grep -v TIME_WAIT | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr

netstat -an | grep :80 | awk '{print $5}' | cut -f1 -d":" | sort | uniq -c | sort -n

Address Type	Destination
Default route	::/0 or 2000::/3
Localhost	::1 or ::1/128
Documentation prefix	2001:db8::/32
Link-local prefix	fe80::/10
Multicast prefix	ff00::/8
ULA (unique local addresses)	fc00::/7
Reverse DNS zone format with BIND	C.0.0.0.B.0.0.0.A.0.0.0.1.0.0.2.ip6.arpa

IPv6 test	How to
mtr (more detailed traceroute)	mtr -6 domain.com
Ping	ping6 on Unix, ping on Windows.
Reverse DNS/PTR	dig -x 2001:470:0:64::2 PTR
SSH	ssh -6 domain.com
tracert/traceroute	traceroute6 (ndisc6) on Unix, tracert on Windows
wget	wget -6 domain.com/file.txt


15	netstat
20	FTP (data transfer)
21	FTP (control)
22	SSH (secure logins, file transfers (scp, sftp) and port forwarding)
23	Telnet (use Control + ] to exit telnet session)
24	Any private mail
25	SMTP (Sending mail)
42	nameserv, WINS
43	whois, nickname
50	Remote Mail Checking Protocol
53	DNS
80	HTTP
101	HOSTNAME
106	poppassd (for localhost only)
107	Remote TELNET Service
110	POP3 (Handling and Authenticating mail)
113	Authentication
123 (UDP)	NTP
139	NetBIOS
143	IMAP
443	HTTPS (SSL) (Statistics Port)
465	SMTP Secure (SSL for IMAP)
587	Alternate SMTP
990	FTP Secure (FTP SSL)
993	IMAP Secure
995	POP3 Secure
1433	MSSQL
2082 / 2083	cPanel http / https
2086 / 2087	WHM http / https
2500	Alternate SMTP
3306	MySQL
3389	RDP Protocol
4643	Virtuozzo
5224	Plesk License Update (outgoing)
5666	Nagios (unauthorized use)
5938	TeamViewer
8306	Alternate MySQL
8443	Plesk Secure
8880	Plesk HTTP
TCP 9101, 9102 and 9103	Bacula
UDP 9987	Team Speak
TCP 10011 & 30033	Team Speak
TCP 9999	Java for Red5. Also this, nothing to worry about.

Networking

Block IP addresses by Country

Check NIC speed

Get external facing IP address

Opening a port to listen on (tmp)

IP address locator

IPtables

Allowing or dropping ports

Block an IP address

Order of rules

Rules needed for Virtuozzo and ICMP (ping) traffic

IPv6

Enable on Ubuntu 12.04

Ports and Protocols

Preventing remote access lockout

Monitor packet loss

Network Tools

nmap

IP Traffic

iftop

vnstat

NTP

IPv4 and IPv6

Understanding traceroutes

ifconfig

Navigation menu

Search