Hot answers tagged

25

Apart from not getting detailed information about your test setup the main problem seems to be, that you use a message size of 64 byte. This is far away from the usual MTU of 1500 bytes and makes UDP highly inefficient: while TCP merges multiple sends into a single packet on the wire (except if TCP_NODELAY is set) to make efficient use of the link, each UDP ...


24

What do the three rules do? Those 3 rules seem pretty self-explanatory: Reject incoming UDP packets with an ICMP message "port unreachable" Reject incoming TCP packets with "tcp reset" Reject incoming packets (of any other protocol) with ICMP message "protocol unreachable" If you're looking for more detail (about UDP/TCP packets, ICMP), you need to ...


8

Actually, the above answer is not entirely accurate. The sysctls net.inet.ip.portrange.first and net.inet.ip.portrange.last specify the range of ports the OS can allocate for random ports. You would want to make sure that the range of reserved ports for your application does not fall within these variables. Take a look in the FreeBSD Handbook, section: ...


7

Technically, there's no such thing as a "reserved port". In TCP/UDP, the only way to "reserve" a port is to actually bind() a socket to it. A bound port will not be used by other applications; an unused port is, well, unused so other applications are free to use it. If you are writing server software, then you can bind your sockets to specific ports as ...


7

Judging by the specific output Connection to Connection to 10.1.0.100 53 port [udp/domain] succeeded! you are using openbsd-netcat. Looking at the code for that the test is to bind to the UDP socket, i.e. there is an open connection: if (vflag || zflag) { /* For UDP, make sure we are connected. */ ...


6

Short answer Yes it is possible, use tsocks nmap -sT IP Long answer First of all Tor doesn't use privoxy, Tor provides an socks proxy for connecting via the Tor network. This means you won't see any network routes or things like that on your system but you have to configure your applications to use the Tor socks proxy to connect via Tor. Typical Tor ...


6

For such a large amount of IPs you should use the ipsets module. ipset creates datasets on which iptables can react, it can easily handle 10s of 1000s of entries. Make sure you have the EPEL repo enabled and then install ipset via: yum install ipset An example: ipset -N blockedip iphash creates a set called 'blockedip' in format 'iphash' (there are ...


5

tcpdump usually comes as standard on Linux distros. It will log all packets visible at the server note that you probably want to set it running with a filter for your client IP to cut down on the noise I think this includes packets not accepted by iptables on the local machine - but you might want to test this e.g. /usr/sbin/tcdump -i eth0 -c 3000000 ...


5

I understand that your host, 192.168.2.7 is sending multicast packet to group 239.255.250.250 on port 9131 NOTE: I assume however that servers are listening on port 9131. you didn't provide any info on this. From ifconfig output, I can see that MULTICAST is enabled and the tcpdump confirm this. First make sure that the host running the servers (the one ...


5

Edited following OP's clarification on the use case: You can not do that using the latest official release of bash (currently 4.3.30 according to this page). lib/sh/netopen.c shows that bash opens a UDP socket (SOCK_DGRAM) then directly tries to connect without looking at the ip address to determine whether it would make sense to set specific socket options ...


5

There is an ICMP message to signalize that a port, even an UDP one, is closed. So if a host sends this message then the port can be assumed to be closed. https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Destination_unreachable


5

try nc from man nc nc — arbitrary TCP and UDP connections and listens


4

To ensure the kernel won't give out 49000 and 49001 to clients as you wish to use them for your servers on linux. sysctl -w net.ipv4.ip_local_reserved_ports = 49000, 49001 drop it in /etc/sysctl.conf, and then run sysctl -p. Note that this is untested. References Documentation / networking / ip-sysctl.txt


4

I saw the same symptom — kernel apparently ignoring IGMP group membership queries from the router — on a CentOS 5 server. I tracked the problem down to a "deny by default" firewall configuration. You, like me, probably didn't sit down and think about IGMP when implementing your firewall. The CentOS system-config-firewall tool doesn't even ask ...


4

I you mean that someone may open 2 TCP connections to your machine, one to port 50505 and another to port 60606, send data on the first one intended to be fed to P and expect to read the output of P from the second TCP connection, then that would be: < /dev/null nc -q -1 -l 50505 | P | nc -l 60606 > /dev/null Or with socat: socat -u ...


4

You don't want to enable the dgram (UDP) one. That allows an attacker to make your machine send UDP packets with any content, and if attackers are able to have packets with spoofed source address delivered to you, that means any UDP packet to any destination. For instance if the attacker does: packit -t UDP -s 10.10.10.10 -S 7 -d 10.10.10.11 -D 7 -p ...


4

I believe there is a confusion of terms at work here. In fact, both the IP layer and the link layer work together to make multicasting work. For both IPv4 and IPv6, multicast IP addresses are mapped to link-layer multicast MAC addresses. There are dedicated, multicast-only MAC addresses. For IPv4, the MAC address has the form 01:00:5e:xx:yy:zz and for IPv6 ...


3

The fact that it says localhost.localdomain connects to localhost.localdomain means that this can't be multicast. Here is a description of multicast in IPv6: http://en.wikipedia.org/wiki/IPv6#Multicasting It would be easier to help you if you describe what you are trying to achieve. Do you want to use multicast, if so for what exactly? Or is your goal to ...


3

You could use ZeroConf: http://en.wikipedia.org/wiki/Multicast_DNS Check avahi out: https://help.ubuntu.com/community/HowToZeroconf (ubuntu howto, should be easily adaptable to CentOS)


3

Try to increase the maximum block size on the server (e.g. --blocksize 1468). Check with server in debug mode, see if there are retransmits. Check if you really have Gb connection end-to-end. Test on a different client node. Check if there is some other problem not related to tftp - try iperf, tcpdump, ethtool ...


3

As richard already mentioned, what you're looking for has existed for a long time. It's called inetd. There are several implementations of inetd around. Some are simple and do just that socket activation thing (they're usually just the inetd program from some bigger software package containing other basic networking tools, such as GNU inetutils or BusyBox ...


3

There are two possibilities for this. You're seeing UDP broadcast traffic. You're seeing UDP traffic between two remote systems. You are correct in that a Switch isolates traffic by MAC address. However, in order to do that it needs to know which segments target which MAC addresses. It does that by learning, based on traffic. When the Switch receives a ...


2

I don't have a good way to test this right now, but... I believe you can use iptables to translate every port to a single port. It would be something like the following: iptables -t nat -I PREROUTING -m multiport -sports 0:65535 -J DNAT --to-destination 127.0.0.1:1024 That should redirect all incoming ports to 1024. You can then start a server on 1024.


2

The following set of steps were able to resolve the problem: Open a terminal and type: system-config-firewall Enter your password if prompted. Click "Other Ports" on the left-hand side: Click the "Add" button on the right-hand side: Check "User Defined" and enter the values below: Click "OK" and then click the "Apply" button in the toolbar: If you are ...


2

I'm not aware of any expiration policy for IGMP group membership within the Linux stack. It may happen, but I doubt it, since there are at least two ways for the kernel to be told (one explicit, the other implicit) when a program's IGMP membership should be dropped. Therefore, I think you have a bug in the software listening for the multicast packets. (Care ...


2

Seems that tcpdump is the best, if not the only answer here. It looks perfect for this job. Since, I'm using very limited version of Linux on my NAS, it wasn't there. But simple call to ipkg install tcpdump solved the problem (hopefully I've installed Optware before, as it was also missing). For this particular problem (listening for UDP packets on ports ...


2

for upload/download testing i found the iperf tool quite useful: user@hostA: iperf -s user@hostB: iperf -c hostA if the kernel is really the problem, you will usually get a kernel oops before the crash. the main problem is accessing anything the kernel prints to the console, when you are using a graphical interface (and cannot switch to the console ...


2

can some other app also connect to the UDP port and subscribe to the data passing through the port? Port numbers are unique -- e.g. you can't have more than one process open a specific port for listening. However, there's no such limit to the number of connections that can be made to the port. It is up to the one process controlling the port to accept ...


2

Server side: # nc -l -u -p 666 > /tmp/666.txt Other server side's shell: # tail -F /tmp/666.txt | while IFS= read -r line; do echo "$line"; # do what you want. done; Client side: # nc -uv 127.0.0.1 666 #### Print your commands.


2

UDP is a connectionless protocol. SS probably won't show one in LISTEN state, only in UCONN or ESTAB. If I do this, $ nc -u -l 2333 Then ss will show (in a 2nd shell): $ ss -au|grep 2333 UNCONN 0 0 *:2333 *:* If I then connect to it (3rd shell) $ nc -u localhost 2333 then SS shows: $ ss ...



Only top voted, non community-wiki answers of a minimum length are eligible