Login or Register to Ask a Question and Join Our Community


Red Hat

ehternet in debug mode

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Operating Systems Linux Red Hat ehternet in debug mode
# 1  
Old 09-28-2009
ehternet in debug mode
I have a little dell running redhat server. it's getting ethernet traffic to console and /var/log/messages (up 60Mb) i can't seem to find where to turn it off!
any help would be greatly appreciated.

here's syslog:
Quote:
SYSLOGD_OPTIONS="-m 0"
KLOGD_OPTIONS="-x"
here's a snip from the log:
Code:
Sep 28 21:34:08 zgarch_serv kernel: IN=eth0 OUT= MAC=00:18:8b:74:89:1e:00:0e:a6:1b:ff:e7:08:00 SRC=192.168.10.18 DST=65.55.25.60 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=25854 DF PROTO=TCP SPT=2934 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 28 21:34:10 zgarch_serv kernel: IN=eth0 OUT= MAC=00:18:8b:74:89:1e:00:0e:a6:1b:ff:e7:08:00 SRC=192.168.10.18 DST=65.54.81.101 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=25910 DF PROTO=TCP SPT=2935 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Sep 28 21:34:45 zgarch_serv kernel: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:0e:a6:1b:ff:e7:08:00 SRC=192.168.10.18 DST=192.168.10.255 LEN=252 TOS=0x00 PREC=0x00 TTL=128 ID=26060 PROTO=UDP SPT=138 DPT=138 LEN=232
Sep 28 21:37:34 zgarch_serv kernel: IN=eth1 OUT= MAC=00:10:18:27:a3:ef:00:0f:cc:05:96:e0:08:00 SRC=69.162.105.98 DST=76.215.106.233 LEN=40 TOS=0x00 PREC=0x00 TTL=118 ID=256 DF PROTO=TCP SPT=12200 DPT=8085 WINDOW=8192 RES=0x00 SYN URGP=0
Sep 28 21:38:54 zgarch_serv kernel: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:1e:58:ee:6d:81:08:00 SRC=192.168.0.1 DST=255.255.255.255 LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=31482 PROTO=UDP SPT=137 DPT=137 LEN=76

-toferloafer
Last edited by Neo; 09-29-2009 at 05:06 AM.. Reason: please use code tags
# 2  
Old 09-29-2009
Those look like lines generated by iptables when a rule has LOG as the target. As root, check the output of
Code:
iptables -L -n

for that target.
# 3  
Old 09-29-2009
iptables
looks there are several LOG entries... and a bunch of other stuff.
should i start suppressing the lines with "LOG"? or just start over.
this table looks like it suffers from to many users hacking at it.

#
*mangle
:PREROUTING ACCEPT [46908:11484653]
:INPUT ACCEPT [34192:5111549]
:FORWARD ACCEPT [472:46450]
:OUTPUT ACCEPT [69305:5927626]
:POSTROUTING ACCEPT [69838:5988719]
COMMIT
# Completed on Fri Oct 13 16:34:09 2006
# Generated by iptables-save v1.3.5 on Fri Oct 13 16:34:09 2006
*nat
:PREROUTING ACCEPT [85:25137]
:POSTROUTING ACCEPT [79:10430]
:OUTPUT ACCEPT [79:10430]
#Routing Rules
-A PREROUTING -s 192.168.0.0/255.255.0.0 -i eth0 -j LOG
-A PREROUTING -s 192.168.0.0/255.255.0.0 -i eth0 -j ACCEPT
-A PREROUTING -s 172.16.0.0/255.240.0.0 -j LOG
-A PREROUTING -s 172.16.0.0/255.240.0.0 -j DROP
-A PREROUTING -s 10.0.0.0/255.0.0.0 -j ACCEPT
#Web Filter Prerouting
-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
-A PREROUTING -i eth0 -p tcp --dport 3128 -j REDIRECT --to-port 8080
-A PREROUTING -i lo -p tcp --dport 80 -j REDIRECT --to-port 3128
-A PREROUTING -i lo -p tcp --dport 3128 -j REDIRECT --to-port 8080
#VNC Rules:
-A PREROUTING -i eth1 -p tcp --dport 5900 -j DNAT --to-destination 192.168.10.18
-A PREROUTING -i eth1 -p tcp --dport 5901 -j DNAT --to-destination 192.168.10.11

#Your routing table (Refer to /etc/hosts for list of clients)
-A POSTROUTING -s 192.168.10.10 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.11 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.12 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.13 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.14 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.15 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.16 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.17 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.18 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.19 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.20 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.21 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.22 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.23 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.24 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.25 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.26 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.27 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.28 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.29 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.30 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.0.200 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.0.201 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.0.202 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.0.203 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.0.204 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.0.205 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.10.254 -o eth1 -j MASQUERADE
COMMIT
# Completed on Fri Oct 13 16:34:09 2006
# Generated by iptables-save v1.3.5 on Fri Oct 13 16:34:09 2006
*filter
:INPUT DROP [56:30000]
:FORWARD ACCEPT [236:16474]
:OUTPUT ACCEPT [30489:1988516]
#Accept Ping request
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
#Allow all packets from network
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
#-A INPUT -i ath0 -j ACCEPT (WIRELESS)
#Customized Security
-A INPUT -i eth1 -p tcp -m tcp --dport 8009 -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 8008 -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 8080 -j DROP
-A INPUT -i eth1 -p udp -m udp --dport 68 -j ACCEPT
-A INPUT -i eth1 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i eth1 -p udp -m udp --dport 53 -j ACCEPT
#Squid Routing Rules
-A INPUT -i eth0 -p tcp --dport 3128 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i eth0 -p tcp --dport 8080 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#Allow IDENT port
-A INPUT -i eth1 -p tcp -m tcp --dport 113 -m state --state NEW,ESTABLISHED -j ACCEPT
#Apache WebServer
-A INPUT -i eth1 -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
#More Customized security
-A INPUT -i eth1 -p udp -m udp --dport 518 -j LOG
-A INPUT -i eth1 -p udp -m udp --dport 518 -j DROP
-A INPUT -i eth1 -p udp -m udp --dport 517 -j LOG
-A INPUT -i eth1 -p udp -m udp --dport 517 -j DROP
-A INPUT -i eth1 -p udp -m udp --dport 514 -j LOG
-A INPUT -i eth1 -p udp -m udp --dport 514 -j DROP
-A INPUT -i eth1 -p udp -m udp --dport 177 -j LOG
-A INPUT -i eth1 -p udp -m udp --dport 177 -j DROP
-A INPUT -i eth1 -p tcp -m state --state INVALID,NEW -j LOG
-A INPUT -i eth1 -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 455 -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 137 -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 138 -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 139 -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 1080 -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 445 -j DROP
#OpenSSH Rules
-A INPUT -i eth1 -p tcp -m state --state NEW -m tcp --dport 22 -m recent --update --seconds 15 --name DEFAULT --rsource -j DROP
-A INPUT -i eth1 -p tcp -m state --state NEW -m tcp --dport 22 -m recent --set --name DEFAULT --rsource -j ACCEPT
#FTP Rules
-A INPUT -i eth1 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 21 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 20 -j ACCEPT
#SMTP Rule
-A INPUT -i eth1 -p tcp -m tcp --dport 25 -m state --state NEW -j ACCEPT
#POP3 Rules
-A INPUT -i eth1 -p tcp -m tcp --dport 110 -m state --state INVALID -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
#POP3 Secure Rules
-A INPUT -i eth1 -p tcp -m tcp --dport 995 -m state --state INVALID -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 995 -m state --state NEW,ESTABLISHED -j DROP
#Some known problem ports
-A INPUT -i eth1 -p udp -m udp --dport 1026 -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 3306 -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 1433 -j DROP
#IRC Chat Relay Rule
-A INPUT -i eth1 -p tcp -m tcp --dport 6667 -j DROP
#Forwarding Rules
-A FORWARD -i eth1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
#Accept all output from network
-A OUTPUT -o eth0 -j ACCEPT
#Block specific IPAddresses from attacks (generally, outside US)
-A INPUT -i eth1 -s 58.20.23.126 -j DROP
-A INPUT -i eth1 -s 202.171.132.228 -j DROP
-A INPUT -i eth1 -s 220.0.0.0/8 -j DROP
-A INPUT -i eth1 -s 221.0.0.0/8 -j DROP
-A INPUT -i eth1 -s 222.0.0.0/8 -j DROP
-A INPUT -i eth1 -s 114.44.142.36 -j DROP
-A INPUT -i eth1 -s 221.224.81.194 -j DROP
#-A OUTPUT -o ath1 -j ACCEPT (WIRELESS)

#Log and Drop packets from these ports going outside network
-A OUTPUT -o eth1 -p tcp -m tcp --sport 137 -j LOG
-A OUTPUT -o eth1 -p tcp -m tcp --sport 137 -j DROP
-A OUTPUT -o eth1 -p tcp -m tcp --sport 138 -j LOG
-A OUTPUT -o eth1 -p tcp -m tcp --sport 138 -j DROP
-A OUTPUT -o eth1 -p tcp -m tcp --sport 139 -j LOG
-A OUTPUT -o eth1 -p tcp -m tcp --sport 139 -j DROP
COMMIT
# Completed on Fri Oct 13 16:34:09 2006
Login or Register to Ask a Question

Previous Thread | Next Thread

8 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Logging perl and shell debug mode.

I have a shell program which calls a perl program. I am running the shell program with command; $ ksh -x <prog_name> Inside the shell program, I am calling perl with warnings. I want to capture the entire output as it comes on screen. The command I tried is: $ ksh -x... (1 Reply)
Discussion started by: som.nitk
1 Replies

2. Programming

Is there any possibility of running the PHP script in a debug mode ?

Is there any possibility of running the PHP script in a debug mode ? If so, do i have to download any package? Any free downloads available? Can anyone please guide me through? Am a newbie in PHP scripting. Thanks in Advance! (1 Reply)
Discussion started by: vidhyaS
1 Replies

3. Shell Programming and Scripting

perl: a way to see a sub code in debug mode: perl -de 0 ?

Is there a way to see or print a sub code? Sometime a sub could be already defined, but in the debug mode (so, interactively) it could be already out of screen. So, I would think about a way to check if the sub is defined (just 'defined' is not a problem) and how it is defined. Also, if... (4 Replies)
Discussion started by: alex_5161
4 Replies

4. Programming

Compile a proc/c++ file in debug mode.

Hi, I'm using the following commands to execute a proc file, but I'm unable to debug the program. What modifications do I need to make in the command options to debug the program created. I have a proc1.pc file, using the following three steps to generate the proc1 exe. After the proc1 exe... (2 Replies)
Discussion started by: ehari
2 Replies

5. AIX

Running Installp in debug mode

Is there a way I can execute an installp command in debug mode, so that I can see whats happening when a fileset is being installed or updated? (What files are being replace etc etc). I have an installp command failing for unknown reason. (7 Replies)
Discussion started by: balaji_prk
7 Replies

6. Shell Programming and Scripting

Debug mode

When I run a lengthy script in debug mode i need to capture all the steps which are executed. e.g ksh -x script.ksh + test -f /proc/mounts + /bin/ls -l /proc/21326/exe + is=ksh + test ksh = ksh + test -s /etc/ksh.kshrc + . /etc/ksh.kshrc + trap 1 2 3 + who am i + awk {print $1} +... (2 Replies)
Discussion started by: zooby
2 Replies

7. Shell Programming and Scripting

run in debug mode

Hi, I have a question on my korn shell script. When I run without debugging turned on, I can't get the correct result. If I turn on the debug mode, like sh -x myprogram, it will give me the correct result. Can someone tell me what is going on here? Thanks, :rolleyes: (6 Replies)
Discussion started by: whatisthis
6 Replies

8. UNIX for Advanced & Expert Users

“Ostream” object is not printing message on HP-UNIX for debug mode

The following C++ code segment is not working in debug mode build on HP-UNIX machine. It is not printing "Hello World" message on the screen. While it is working fine in release mode build. ============================================== class KLogStreamBuf : public streambuf { public:... (0 Replies)
Discussion started by: heena
0 Replies
Login or Register to Ask a Question