Hot answers tagged tcp
23
The idea behind this is to ensure you don't receive packets targeted for the previous program listening on that port. This TIME_WAIT state is defined in RFC793 as two times the maximum segment lifetime.
I don't know about other Operating Systems but I assume that all of these have some kind of similar behavior.
A workaround for this problem is to set ...
11
netstat -lnp will list the pid and process name next to each listening port. This will work under Linux, but not all others (like AIX.) Add -t if you want TCP only.
# netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:24800 ...
10
Suppose you're exchanging data with a computer on a port <1024, and you know that computer is running some variant of unix. Then you know that the service running on that port is approved by the system administrator: it's running as root, or at least had to be started as root.
On the wide, wild world of the Internet, this doesn't matter. Most servers are ...
10
It's for convenience, but it's also a lower-than-user-level diagnostic. You can isolate the problem you're having with a service that way, for example: Joe has a database server and client. They are not communicating. Is the problem on the network? The server? The client?
Joe goes to the client machine and opens a shell. He uses telnet, just as you ...
10
You probably want to use the ServerAlive settings for this. They do not require any configuration on the server, and can be set on the command line if you wish.
ssh -o ServerAliveInterval=5 -o ServerAliveCountMax=1 $HOST
This will send a ssh keepalive message every 5 seconds, and if it comes time to send another keepalive, but a response to the last one ...
9
t_open() and its associated /dev/tcp and such are part of the TLI/XTI interface, which lost the battle for TCP/IP APIs to BSD sockets.
On Linux, there is a /dev/tcp of sorts. It isn't a real file or kernel device. It's something specially provided by Bash, and it exists only for redirections. This means that even if one were to create an in-kernel /dev/tcp ...
9
There was a time when IANA only assigned ports up to 1023. See RFC1700. At one time this was a standard. Most of the time I have no trouble finding when things change in the stream of RFC's but for the question of changing ports from 1024 to 49152 from registered to assigned I came up short.
In terms of Linux history, there was a question raised about the ...
8
This is does not matter whether you create tcp connection as a root or regular user. Socket creation is a kernel business and TCP connections is a Transport Level of OSI model
But software you use (Application level) can contain software vulnerabilities and hacker can exploit them. So the basic recommendation is not to execute application as with a root ...
7
Telnet is a very simple protocol, where everything that you type in your client (with few exceptions) go to the wire, and everything that comes from the wire is shown in your terminal. The exception is the 0xFF byte, that setups some special communication states. As long as your communication doesn't contain this byte, you can use telnet as sort of a raw ...
7
Using ssh is the easiest solution.
ssh -g -L 8001:localhost:8000 -f -N user@remote-server.com
This forwards the local port 8001 on your workstation to the localhost address on remote-server.com port 8000. -g means allow other clients on my network to connect to port 8001 on my workstation. Otherwise only local clients on your workstation can connect ...
7
In /etc/ssh/sshd for Computer B set:
AllowTcpForwarding yes
TCPKeepAlive yes
From Computer A:
$ ssh -R 2222:localhost:22 ip.of.computer.b
From Computer B:
$ ssh localhost -p 2222
Note that 2222 is an arbitrary high-port number I picked. That port on Computer B will then be tunneled back through the SSH connection initialized on Computer A to port ...
7
Yes. By putting network interfaces into promiscuous mode, tcpdump is able to see exactly what is going out (and in) the network interface.
tcpdump operates at layer2 +. it can be used to look at Ethernet, FDDI, PPP & SLIP, Token Ring, and any other protocol supported by libpcap, which does all of tcpdump's heavy lifting.
Have a look at the ...
7
You can define a new 'tunnel' in your Subversion configuration (~/.subversion/config). Find the section [tunnels] there and define something like:
[tunnels]
foo = ssh -p 20000
Afterwards you can contact your repository via the URL svn+foo://server.com/home/svn/proj1 proj1.
6
Assuming you are speaking about Linux, iptables has a mangle table that can do all sorts of crazy things to outgoing TCP traffic. iptables NAT features might help as well, because it really sounds like you want to do "port address translation" or "manual NAT."
6
setcap 'cap_net_bind_service=+ep' /path/to/program
this will work for specific processes. But to allow a particular user to bind to ports below 1024 you will have to add him to sudoers.
Have a look at this discussion for more.
6
Your question implies that both programs would be running in alternation on the same machine, bound to the same port. This is a bad idea. You will run into the TIME_WAIT (a.k.a. 2MSL) problem if you try this. This article describes the problem. (It's Windows-centric, but most of what it's talking about applies to any TCP/IP stack.)
The BSD sockets API does ...
6
One way is to say lsof -i:57010 -sTCP:ESTABLISHED. This walks the kernel's open file handle table looking for processes with an established TCP connection using that port. (Network sockets are file handles on *ix type systems.) You'd use -sTCP:LISTEN on the server side to filter out only the listener socket instead.
Because of the way lsof works, it can ...
6
Port 5901, generally by convention Port 5900 + XDisplaynumber, is the TCP Port on which the VNC service listens. That's their relation. Actually you may use arbitrary TCP Ports with arbitrary Xdisplaynumbers.
The VNC service is meant to transports input (mouse, keyboard) from the client to the server and output (an image) from the server to the client. This ...
5
No, there is no timeout for CLOSE_WAIT. I think that's what the off means in your output.
To get out of CLOSE_WAIT, the application has to close the socket explicitly (or exit).
See How to break CLOSE_WAIT.
If netstat is showing - in the process column:
are you running with the appropriate privileges and capabilities (e.g. as root)?
they could be ...
5
CLOSE_WAIT indicates that the client is closing the connection but the application hasn't closed it yet, or the client is not. You should identify which program or programs are having this problem. Try using netstat -tonp 2>&1 | grep CLOSE to determine which programs as holding the connections.
If there are no programs listed, then the service is ...
5
tcp_mem is more important because it defines how the tcp stack should behave when it comes to memory usage. IMO send and receive buffer should be a multiple of tcp_mem. Here is a link to a formula for receive buffer: http://www.acc.umu.se/~maswan/linux-netperf.txt. In short:
The overhead is: window/2^tcp_adv_win_scale (tcp_adv_win_scale default is 2)
...
5
iptables -t nat -A PREROUTING -i ppp33 -p tcp --dport 44447 -j DNAT --to 192.168.1.101
This means that your interface ppp33 has Network Address Translation (NAT) setup for all requests to the destination of 192.168.1.101:44447.
iptables -I FORWARD 1 -i ppp33 -p tcp -d 192.168.1.101 --dport 44447 -j ACCEPT
This rule complements the previous rule by ...
5
If you just want to get the number and don't need any details you can read the data from /proc/net/sockstat{,6}. Please keep in mind that you have to combine both values to get the absolute count of connections.
If you want to get the information from the kernel itself you can use NETLINK_INET_DIAG to get the information from the kernel without having to ...
4
(Some of these methods have been mentioned in other answers; I'm giving several possible choices in rough order of preference.)
You can redirect the low port to a high port and listen on the high port.
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 1080
You can start your server as root and drop privileges after it's started ...
4
I too have wondered this and was motivated by your question!
I've collected how close I could come to each of the queues you listed with some information related to each. I welcome comments/feedback, any improvement to monitoring makes things easier to manage!
net.core.somaxconn
net.ipv4.tcp_max_syn_backlog
net.core.netdev_max_backlog
$ ...
4
I believe that the idea of the socket being unavailable to a program is to allow any TCP data segments still in transit to arrive, and get discarded by the kernel. That is, it's possible for an application to call close(2) on a socket, but routing delays or mishaps to control packets or what have you can allow the other side of a TCP connection to send data ...
4
You don't want to intercept this in the air. It's very hard to do well. I suggest you change your network around a bit. You'll need a PC with two network interfaces and two routers to pull this off. Here's how I would do it:
Internet --> Router --> Ubuntu machine --(network port)--> Wifi router --> iPod
Ubuntu needs to "share" the Internet ...
4
Here is a oneliner that simply loops until the port is open. This is quick and dirty, but it might get you started.
while ! nc -z localhost 3000; do sleep 0.1; done; echo 'The server is up!'
Replace the echo statement with your action of choice.
nc is Netcat, "the Swiss-army knife for TCP/IP",
-z means: do not send any data, just check if the port is ...
4
tcpdump usually comes as standard on Linux distros. It will log all packets visible at the server note that
you probably want to set it running with a filter for your client IP to cut down on the noise
I think this includes packets not accepted by iptables on the local machine - but you might want to test this
e.g.
/usr/sbin/tcdump -i eth0 -c 3000000 ...
4
Short answer
Yes it is possible, use tsocks nmap -sT IP
Long answer
First of all Tor doesn't use privoxy, Tor provides an socks proxy for connecting via the Tor network.
This means you won't see any network routes or things like that on your system but you have to configure your applications to use the Tor socks proxy to connect via Tor.
Typical Tor ...
Only top voted, non community-wiki answers of a minimum length are eligible
