Sponsored Content
Full Discussion: iptables rule sanity check?
Special Forums Cybersecurity iptables rule sanity check? Post 302737215 by unSpawn on Wednesday 28th of November 2012 01:35:39 PM
Old 11-28-2012
Quote:
Originally Posted by unclecameron
why would (..) along with /etc/hosts.deny rule of (..) not stop traffic to/from 180.x.x.x, which I still see by running iftop?
First of all tcp_wrappers may be considered complementary in a multi-layered approach to network access restrictions but there's a fundamental difference between tcp_wrappers and Netfilter. The first works only at the application level (and only if the application was compiled with -libwrap) and the latter works at the network level, meaning no interaction with any application.
In short: Netfilter = "must have", tcp_wrappers = "nice to have".

As for your question you show isolated rules, no rule counters and no evidence of traffic, meaning your rule could be placed below a rule that already accepts traffic or you haven't killed or restarted the network process or didn't reset individual connections so you might be seeing already established connections.


Quote:
Originally Posted by unclecameron
Or could iftop just be showing an artifact and is there a better way to monitor connections real-time?
I doubt that. Iftop uses the libpcap ('man 3 pcap') framework for data handling just like tcpdump, Wireshark or say nmap.
 

8 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

iptables rule to block ping to internet

I want to block ping on a linuxbox to any other address where it would go to the default gateway. vmdebianamd64:/etc/tcng# route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 198.9.200.0 * 255.255.255.0 U 0 ... (1 Reply)
Discussion started by: progressdll
1 Replies

2. Debian

./configure is broken - /lib/cpp fails sanity check

Hi, I first wanted to install my NIC drivers but it said: Makefile:62: *** Linux kernel source not found. Stop. So I installed the kernel source: linux-source-2.6.18_2.6.18.dfsg.1-13etch5_all.deb 1) cd /usr/src 2) -xjvf linux-source.2.6.18.extension (forget what it was) 3) ln -s... (12 Replies)
Discussion started by: Virtuality
12 Replies

3. UNIX for Advanced & Expert Users

*** [Gentoo] sanity check failed! ***

I faced the following error while configuring the spine for cacti. Can any one help me to sort out this problem: hecking how to run the C++ preprocessor... g++ -E checking for g77... g77 checking whether we are using the GNU Fortran 77 compiler... yes checking whether g77 accepts -g... yes... (1 Reply)
Discussion started by: praveen_b744
1 Replies

4. Solaris

lib/cpp fails sanity check

I'm trying to install a new library for php but everytime I run configure I got the following error "lib/cpp" fails sanity check. My OS is solaris 10 Any help on how to solve this issue would be highly appreciated (3 Replies)
Discussion started by: dahr
3 Replies

5. Linux

iptables rule problem

Hi, i have 40 client's in my network, that connected to internet via squid server (WebProxy). i want none of these client can't ping my squid server bat squid server can ping them.i wrote these rules but it is'nt work. iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -A INPUT -p... (1 Reply)
Discussion started by: skynet_boy
1 Replies

6. IP Networking

iptables - most easy way to find rule and remove it?

I have situation where I have rules in iptables with comments. Now... I can for example enter rule like "iptables -A FORWARD -s xxx -j ACCEPT" and delete it with "iptables -D FORWARD -s xxx -j ACCEPT".. but if that rule contain some random comment (-m comment) then ... ? I can find with scripting... (2 Replies)
Discussion started by: darkman_hr
2 Replies

7. Cybersecurity

LDAP - sanity check

I have recently changed jobs and where i used to work we had kerberos. Here they have nothing resembling central password management or Network Authentication. I have started looking at LDAP but wonder if that is a good choice. we have a solaris/centos environment (no windows whoo hooo) with 4... (2 Replies)
Discussion started by: oly_r
2 Replies

8. UNIX for Dummies Questions & Answers

iptables rule to block access from VM Browser to Firewall Login Page

(1 Reply)
Discussion started by: senrabdet
1 Replies
netusage(1)						    BSD General Commands Manual 					       netusage(1)

NAME
netusage -- Display traffic usage statistics about the network SYNOPSIS
netusage [--help] netusage commands [arguments ...] DESCRIPTION
The netusage program interfaces with symptomsd to display and manage network traffic usage statistics. As additional feature of this tool allows for looking up an application or process name using a Mach-O UUID or a PID. NETWORK STATISTICS COMMANDS
The following commands are used to provide different representations of network traffic usage statistics collected on the system. --all-traffic [-p] [-r] [-n name] [-s sortorder] [-d importfile] [-e exportfile] [--unitize] [--compact] [--interactive] [--interval seconds] Display a table listing the total ingress and egress network traffic usage for each application or process categorized by interface. A timestamp of when the first network traffic was observed is also shown. By default, only applications will be shown unless the -p flag is provided. -p Show a list that includes the combination of applications and processes. -r Force a database refresh before showing the list. -n name Only show the application or process matching name. -s sortorder Sort the list according the following available sort orders: t Sort by total network usage. (default) c Sort by cellular interface usage. w Sort by wi-fi interface usage. i Sort by wired interface usage. a Sort by awdl interface usage. e Sort by expensive interface usage. -d importfile Show a traffic usage comparison between the current values and the contents of the file at importfile. -e exportfile Save the current traffic usage values into exportfile. --unitize Show the table values in unitized format (eg. KB/MB/GB). --compact When showing a traffic usage comparison, only list the entries whose values have changed. --interactive Show a traffic usage table that periodically refresh and can be viewed interactively. When an update occurs, the usage value for the application or process that generated network traffic will appear emphasized. You can use the following com- mands to interact with the table. q Quit p Toggles the values between showing raw bytes and unitized format s Change the sort order of the columns r Redraw the screen h Show help Arrow Keys Scroll the list --interval seconds Set the periodic refresh interval to the specified number of seconds. The minimum value is 5 seconds, and the default interval is 15 seconds. (Only valid in interactive mode) MANAGEMENT COMMANDS
These commands are used to manage and reset the collected network traffic usage statistics. --reset-entry [-p] [-n name] Reset the network traffic usage statistics stored for a single entry. Use the -n flag (and optionally the -p flag) to specify the name of the entry. --unitize name Specify the name of the application to reset the network usage statistics. -p Specify a process name instead of an application name. --reset-all Reset the network traffic usage statistics for all the stored entries. OTHER COMMANDS
These are optional utility commands that are available to look up applications or processes. --resolve-uuid uuid Resolve the given mach-O uuid into an application identifier. --resolve-pid pid Resolve the given pid into an application identifier. Darwin May 31, 2019 Darwin
All times are GMT -4. The time now is 10:17 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy