ipv4 | Walking in Light with Christ - Faith, Computing, Diary

Posts Tagged ‘ipv4’

How to check what process is listening on network port with: lsof & fuser commands in Linux / BSD

Saturday, March 16th, 2013

It is a common thing for me as a Linux and FreeBSD sysadmin to know what process assignes to which port number? I'm sure many novice system administrators will end up sooner or later with same question. Knowing what kind of processes has listening to TCP and UDP protocol / ports is a must to have a proper configured Linux / BSD system. In Linux there are two commands ( lsof and fuser) with which you can get various extra PID information on running processes (i.e. get information which cannot otherwise be obtained via the usual ps and netstat To use them on most Linux distributions, you will have to have them installed.

1. Install fuser / lsof on Linux / BSD

a) On RPM based Linux distros – Fedora, CentOS, RHEL, SuSE /sbin/fuser is usually part of base install psmisc rpm package, however /usr/sbin/lsof is not among standard installed rpms, so you have to manually install via yum:

[root@centos ~]# yum install -y lsof
….

b) On Deb based Linuxes (Debian, Ubuntu, Mint, ArchLinux etc.). both lsof and fuser has to be installed via a separate packages non-part of Debian base install packs.

server:~# apt-get --yes install lsof fuser ....
On Debian full path location of both is in /bin/fuser and /usr/bin/lsof.

Two tools are precious swiss army knife outfit to use, whether you doubt someone cracked into a server or in doubt you might have "hidden" cracker processes on server.

c) Install fuser on Free/Net/Open/ BSD

bsd# cd /usr/ports/sysutils/fuser bsd# make install clean .... bsd# cd /usr/ports/sysutils/lsof bsd# make install clean ....
2. Using fuser and lsof to look up process PIDs assigned to port numbers

lsof name is derived from List Open Files, as we know in UNIX, GNU / Linux, *BSD everything on the system is a file, thus to get all kind of information concerning all active files (i.e. ports, PIDs, procotols and process names;

server:~# lsof +M -i4 | less

COMMAND     PID     USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
portmap    1317   daemon    4u IPv4     3930      0t0 UDP *:sunrpc[portmapper]
portmap    1317   daemon    5u IPv4     3939      0t0 TCP *:sunrpc[portmapper] (LISTEN)
rpc.statd 1329    statd    4u IPv4     3974      0t0 UDP *:657
rpc.statd 1329    statd    6u IPv4     3983      0t0 UDP *:28530[status]
rpc.statd 1329    statd    7u IPv4     3986      0t0 TCP *:58515[status] (LISTEN)
apache2    1625 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    1625 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
sshd       1918     root    3u IPv4     4945      0t0 TCP *:ssh (LISTEN)
miniserv. 2155     root    5u IPv4     5299      0t0 TCP *:20000 (LISTEN)
miniserv. 2155     root    6u IPv4     5300      0t0 UDP *:20000
miniserv. 2161     root    6u IPv4     5367      0t0 TCP *:webmin (LISTEN)
miniserv. 2161     root    7u IPv4     5368      0t0 UDP *:10000
ntpd       2172      ntp   16u IPv4     5395      0t0 UDP *:ntp
ntpd       2172      ntp   18u IPv4     5402      0t0 UDP localhost:ntp
ntpd       2172      ntp   19u IPv4     5403      0t0 UDP iqtest.soccerfame.com:ntp
ntpd       2172      ntp   20u IPv4    16028      0t0 UDP secure.broomlake.com:ntp
apache2    4505 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    4505 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    4539 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    4539 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    4780 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    4780 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    4900 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    4900 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    4907 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    4907 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    4915 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    4915 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5067 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5067 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5133 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5133 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5134 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5134 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5148 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5148 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5152 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5152 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5259 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5259 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5265 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5265 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5266 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5266 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5346 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5346 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5356 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5356 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5467 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5467 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5523 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5523 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5568 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5568 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5715 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5715 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5716 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5716 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5758 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5758 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    5789 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    5789 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2    6106 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2    6106 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   16608 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   16608 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   16904 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   16904 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   17124 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   17124 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   17280 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   17280 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   20855 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   20855 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   20920 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   20920 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   21023 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   21023 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   22182 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   22182 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   23307 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   23307 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   23366 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   23366 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   23408 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   23408 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   23419 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   23419 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   23428 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   23428 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   23452 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   23452 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   23561 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   23561 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   23579 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   23579 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   23851 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   23851 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   24103 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   24103 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   24659 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   24659 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
sshd      25073     root    3u IPv4 29855891      0t0 TCP iqtest.soccerfame.com:ssh->pc-freak.net:50176 (ESTABLISHED)
sshd      25084     hipo    3u IPv4 29855891      0t0 TCP iqtest.soccerfame.com:ssh->pc-freak.net:50176 (ESTABLISHED)
apache2   25089 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   25089 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   26737 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   26737 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   27243 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   27243 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   27282 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   27282 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   27633 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   27633 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   28205 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   28205 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   29244 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   29244 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   29372 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   29372 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   29411 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   29411 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   29462 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   29462 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   29548 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   29548 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   30161 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   30161 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   31876 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   31876 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   31958 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   31958 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   32052 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   32052 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   32061 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   32061 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   32143 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   32143 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   32149 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   32149 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   32440 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   32440 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   32635 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   32635 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   32790 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   32790 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   40211 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   40211 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   40309 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   40309 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   40432 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   40432 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   40476 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   40476 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   46319     root    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   46319     root    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   46438 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   46438 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   46439 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   46439 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   46440 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   46440 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   46441 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   46441 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   46442 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   46442 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   46443 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   46443 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   46509     root    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   46509     root    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   46510     root    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   46510     root    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   46515     root    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   46515     root    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   51287 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   51287 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   51485 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   51485 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   51804 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   51804 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
named     54418     bind   20u IPv4 31298857      0t0 TCP localhost:domain (LISTEN)
named     54418     bind   21u IPv4 31298859      0t0 TCP iqtest.soccerfame.com:domain (LISTEN)
named     54418     bind   22u IPv4 31298861      0t0 TCP secure.broomlake.com:domain (LISTEN)
named     54418     bind   23u IPv4 31298865      0t0 TCP localhost:953 (LISTEN)
named     54418     bind 512u IPv4 31298856      0t0 UDP localhost:domain
named     54418     bind 513u IPv4 31298858      0t0 UDP iqtest.soccerfame.com:domain
named     54418     bind 514u IPv4 31298860      0t0 UDP secure.broomlake.com:domain
named     54418     bind 515u IPv4 31298864      0t0 UDP *:domain
proftpd   62010 proftpd    1u IPv4 31306260      0t0 TCP *:ftp (LISTEN)
mysqld    62420    mysql   11u IPv4 31306903      0t0 TCP *:mysql (LISTEN)
apache2   62582 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   62582 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   62845 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   62845 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)
apache2   64748 www-data    3u IPv4     5456      0t0 TCP *:www (LISTEN)
apache2   64748 www-data    4u IPv4     5458      0t0 TCP *:https (LISTEN)

Above lsof command lists all active listening processes port number on UDP and TCP/IP 4 proto with the assigned process PID number (in second column). This is very useful if you find out to have listening service on port number and you cannot figure out what process name exactly is listening.

A classic example, where this is very helpful is if you have a listening process on SMTP port 25 and you cannot identify what kind of mail server is taking up the port? This has happened me many times on Debian Linux based hosts, which by default had priorly installed sendmail and I later removed sendmail to install Postfix or Exim SMTP.
To find out what is assigning port 25, you had to grep the protocol name from all binded host processes, like so:

server:~# lsof +M -i4 | grep -i smtp

exim4 17550 root 3u IPv4 31577966 0t0 TCP localhost:smtp (LISTEN)

Whether you want to get information on Process ID, binding other random port lets say port 10000, following same logic you can grep it:

server:~# lsof +M -i4 |grep -i 10000 miniserv. 2161 root 7u IPv4 5368 0t0 UDP *:10000
To get rid of a process for which you're unsure what kind of (/etc/init.d/service-name) init script is starting it, you can then use kill cmd to stop it;

server:~# kill -9 2161
Second approach to find out what kind of process is listening on a random port or socket, lets say port num 58515 is by using fuser.

server:~# netstat -ltn4 Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:10000 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:58515 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN tcp 0 0 77.92.85.71:53 0.0.0.0:* LISTEN tcp 0 0 109.123.106.44:53 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:20000 0.0.0.0:* LISTEN
Below netstat cmmand, lists all active listening processes on respective IP address and port for protocol TCPIP v.4.

Hence on to get more information on what process is listening on port 58515?

server:~# fuser -v 58515/tcp

USER PID ACCESS COMMAND
58515/tcp: statd 1329 F…. rpc.statd

Once you know what is listening, whether you want to kill it this is also possible directly through fuser;

server:~# fuser -vk 58515/tcp

As a close-up, I will say fuser and lsof are two must have software tools on any productive server. It is among the critical applications admin has to install during initial server set-up. fuser and lsof helps me often in my sysadmin work, it was more than once I've used them to identify script-kiddies exploit scanners running as a standard process names, as well secretly listening on weird port number cracker back-doors.

Hopefully this little article, helps someone learn something new. Plenty is written and will be written and if one takes the time to research he can learn much, much more. I'm sure my tiny article is nothing new under the sun for old-school admins, I still hope it will be of use to novice. I'm looking forward to hear if I'm missing some neat use or some interesting case, when lsof or fuser "saved your ass"

Share this on

Tags: 3983, bsd system, configured linux, fedora, ipv4, Linux, lsof, most linux distributions, running processes, statd, swiss army knife, tcp and udp, Ubuntu, udp protocol, www data
Posted in FreeBSD, System Administration, Web and CMS | No Comments »

Resolving “nf_conntrack: table full, dropping packet.” flood message in dmesg Linux kernel log

Wednesday, March 28th, 2012

On many busy servers, you might encounter in /var/log/syslog or dmesg kernel log messages like

nf_conntrack: table full, dropping packet

to appear repeatingly:

[1737157.057528] nf_conntrack: table full, dropping packet. [1737157.160357] nf_conntrack: table full, dropping packet. [1737157.260534] nf_conntrack: table full, dropping packet. [1737157.361837] nf_conntrack: table full, dropping packet. [1737157.462305] nf_conntrack: table full, dropping packet. [1737157.564270] nf_conntrack: table full, dropping packet. [1737157.666836] nf_conntrack: table full, dropping packet. [1737157.767348] nf_conntrack: table full, dropping packet. [1737157.868338] nf_conntrack: table full, dropping packet. [1737157.969828] nf_conntrack: table full, dropping packet. [1737157.969928] nf_conntrack: table full, dropping packet [1737157.989828] nf_conntrack: table full, dropping packet [1737162.214084] __ratelimit: 83 callbacks suppressed

There are two type of servers, I've encountered this message on:

1. Xen OpenVZ / VPS (Virtual Private Servers)
2. ISPs – Internet Providers with heavy traffic NAT network routers

I. What is the meaning of nf_conntrack: table full dropping packet error message

In short, this message is received because the nf_conntrack kernel maximum number assigned value gets reached.
The common reason for that is a heavy traffic passing by the server or very often a DoS or DDoS (Distributed Denial of Service) attack. Sometimes encountering the err is a result of a bad server planning (incorrect data about expected traffic load by a company/companeis) or simply a sys admin error…

- Checking the current maximum nf_conntrack value assigned on host:

linux:~# cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max 65536

- Alternative way to check the current kernel values for nf_conntrack is through:

linux:~# /sbin/sysctl -a|grep -i nf_conntrack_max error: permission denied on key 'net.ipv4.route.flush' net.netfilter.nf_conntrack_max = 65536 error: permission denied on key 'net.ipv6.route.flush' net.nf_conntrack_max = 65536

- Check the current sysctl nf_conntrack active connections

To check present connection tracking opened on a system:

linux:~# /sbin/sysctl net.netfilter.nf_conntrack_count net.netfilter.nf_conntrack_count = 12742

The shown connections are assigned dynamicly on each new succesful TCP / IP NAT-ted connection. Btw, on a systems that work normally without the dmesg log being flooded with the message, the output of lsmod is:

linux:~# /sbin/lsmod | egrep 'ip_tables|conntrack' ip_tables 9899 1 iptable_filter x_tables 14175 1 ip_tables

On servers which are encountering nf_conntrack: table full, dropping packet error, you can see, when issuing lsmod, extra modules related to nf_conntrack are shown as loaded:

linux:~# /sbin/lsmod | egrep 'ip_tables|conntrack' nf_conntrack_ipv4 10346 3 iptable_nat,nf_nat nf_conntrack 60975 4 ipt_MASQUERADE,iptable_nat,nf_nat,nf_conntrack_ipv4 nf_defrag_ipv4 1073 1 nf_conntrack_ipv4 ip_tables 9899 2 iptable_nat,iptable_filter x_tables 14175 3 ipt_MASQUERADE,iptable_nat,ip_tables

II. Remove completely nf_conntrack support if it is not really necessery

It is a good practice to limit or try to omit completely use of any iptables NAT rules to prevent yourself from ending with flooding your kernel log with the messages and respectively stop your system from dropping connections.

Another option is to completely remove any modules related to nf_conntrack, iptables_nat and nf_nat.
To remove nf_conntrack support from the Linux kernel, if for instance the system is not used for Network Address Translation use:

/sbin/rmmod iptable_nat /sbin/rmmod ipt_MASQUERADE /sbin/rmmod rmmod nf_nat /sbin/rmmod rmmod nf_conntrack_ipv4 /sbin/rmmod nf_conntrack /sbin/rmmod nf_defrag_ipv4

Once the modules are removed, be sure to not use iptables -t nat .. rules. Even attempt to list, if there are any NAT related rules with iptables -t nat -L -n will force the kernel to load the nf_conntrack modules again.

Btw nf_conntrack: table full, dropping packet. message is observable across all GNU / Linux distributions, so this is not some kind of local distribution bug or Linux kernel (distro) customization.

III. Fixing the nf_conntrack … dropping packets error

- One temporary, fix if you need to keep your iptables NAT rules is:

linux:~# sysctl -w net.netfilter.nf_conntrack_max=131072

I say temporary, because raising the nf_conntrack_max doesn't guarantee, things will get smoothly from now on.
However on many not so heavily traffic loaded servers just raising the net.netfilter.nf_conntrack_max=131072 to a high enough value will be enough to resolve the hassle.

- Increasing the size of nf_conntrack hash-table

The Hash table hashsize value, which stores lists of conntrack-entries should be increased propertionally, whenever net.netfilter.nf_conntrack_max is raised.

linux:~# echo 32768 > /sys/module/nf_conntrack/parameters/hashsizeThe rule to calculate the right value to set is:
hashsize = nf_conntrack_max / 4

- To permanently store the made changes ;a) put into /etc/sysctl.conf:

linux:~# echo 'net.netfilter.nf_conntrack_count = 131072' >> /etc/sysctl.conf linux:~# /sbin/sysct -p

b) put in /etc/rc.local (before the exit 0 line):

echo 32768 > /sys/module/nf_conntrack/parameters/hashsize

Note: Be careful with this variable, according to my experience raising it to too high value (especially on XEN patched kernels) could freeze the system.
Also raising the value to a too high number can freeze a regular Linux server running on old hardware.

- For the diagnosis of nf_conntrack stuff there is ;

/proc/sys/net/netfilter kernel memory stored directory. There you can find some values dynamically stored which gives info concerning nf_conntrack operations in "real time":

linux:~# cd /proc/sys/net/netfilter linux:/proc/sys/net/netfilter# ls -al nf_log/ total 0 dr-xr-xr-x 0 root root 0 Mar 23 23:02 ./ dr-xr-xr-x 0 root root 0 Mar 23 23:02 ../ -rw-r--r-- 1 root root 0 Mar 23 23:02 0 -rw-r--r-- 1 root root 0 Mar 23 23:02 1 -rw-r--r-- 1 root root 0 Mar 23 23:02 10 -rw-r--r-- 1 root root 0 Mar 23 23:02 11 -rw-r--r-- 1 root root 0 Mar 23 23:02 12 -rw-r--r-- 1 root root 0 Mar 23 23:02 2 -rw-r--r-- 1 root root 0 Mar 23 23:02 3 -rw-r--r-- 1 root root 0 Mar 23 23:02 4 -rw-r--r-- 1 root root 0 Mar 23 23:02 5 -rw-r--r-- 1 root root 0 Mar 23 23:02 6 -rw-r--r-- 1 root root 0 Mar 23 23:02 7 -rw-r--r-- 1 root root 0 Mar 23 23:02 8 -rw-r--r-- 1 root root 0 Mar 23 23:02 9

IV. Decreasing other nf_conntrack NAT time-out values to prevent server against DoS attacks

Generally, the default value for nf_conntrack_* time-outs are (unnecessery) large.
Therefore, for large flows of traffic even if you increase nf_conntrack_max, still shorty you can get a nf_conntrack overflow table resulting in dropping server connections. To make this not happen, check and decrease the other nf_conntrack timeout connection tracking values:

linux:~# sysctl -a | grep conntrack | grep timeout net.netfilter.nf_conntrack_generic_timeout = 600 net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 120 net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60 net.netfilter.nf_conntrack_tcp_timeout_established = 432000 net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120 net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60 net.netfilter.nf_conntrack_tcp_timeout_last_ack = 30 net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120 net.netfilter.nf_conntrack_tcp_timeout_close = 10 net.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300 net.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300 net.netfilter.nf_conntrack_udp_timeout = 30 net.netfilter.nf_conntrack_udp_timeout_stream = 180 net.netfilter.nf_conntrack_icmp_timeout = 30 net.netfilter.nf_conntrack_events_retry_timeout = 15 net.ipv4.netfilter.ip_conntrack_generic_timeout = 600 net.ipv4.netfilter.ip_conntrack_tcp_timeout_syn_sent = 120 net.ipv4.netfilter.ip_conntrack_tcp_timeout_syn_sent2 = 120 net.ipv4.netfilter.ip_conntrack_tcp_timeout_syn_recv = 60 net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = 432000 net.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait = 120 net.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait = 60 net.ipv4.netfilter.ip_conntrack_tcp_timeout_last_ack = 30 net.ipv4.netfilter.ip_conntrack_tcp_timeout_time_wait = 120 net.ipv4.netfilter.ip_conntrack_tcp_timeout_close = 10 net.ipv4.netfilter.ip_conntrack_tcp_timeout_max_retrans = 300 net.ipv4.netfilter.ip_conntrack_udp_timeout = 30 net.ipv4.netfilter.ip_conntrack_udp_timeout_stream = 180 net.ipv4.netfilter.ip_conntrack_icmp_timeout = 30

All the timeouts are in seconds. net.netfilter.nf_conntrack_generic_timeout as you see is quite high – 600 secs = (10 minutes).
This kind of value means any NAT-ted connection not responding can stay hanging for 10 minutes!

The value net.netfilter.nf_conntrack_tcp_timeout_established = 432000 is quite high too (5 days!)
If this values, are not lowered the server will be an easy target for anyone who would like to flood it with excessive connections, once this happens the server will quick reach even the raised up value for net.nf_conntrack_max and the initial connection dropping will re-occur again …

With all said, to prevent the server from malicious users, situated behind the NAT plaguing you with Denial of Service attacks:

Lower net.ipv4.netfilter.ip_conntrack_generic_timeout to 60 – 120 seconds and net.ipv4.netfilter.ip_conntrack_tcp_timeout_established to stmh. like 54000

linux:~# sysctl -w net.ipv4.netfilter.ip_conntrack_generic_timeout = 120 linux:~# sysctl -w net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = 54000

This timeout should work fine on the router without creating interruptions for regular NAT users. After changing the values and monitoring for at least few days make the changes permanent by adding them to /etc/sysctl.conf

linux:~# echo 'net.ipv4.netfilter.ip_conntrack_generic_timeout = 120' >> /etc/sysctl.conf linux:~# echo 'net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = 54000' >> /etc/sysctl.conf

Share this on

Tags: Auto, callbacks, connection, conntrack, count, denial of service, denial of service attack, dmesg, Draft, error message, flood, heavy traffic, host linux, instance, internet providers, ipt, ipv, ipv4, ISPs, kernel, Linux, linux kernel, log, log messages, Mar, maximum number, message, nat network, nbsp, necessery, network routers, option, packet, quot, ratelimit, Resolving, root, servers, support, syslog, TABLE, time, traffic load, Translation, type, value, var, virtual private servers, wait, work, xen
Posted in Linux, System Administration | 4 Comments »

How to disable IPv6 on GNU / Linux

Friday, December 9th, 2011

I have few servers, which have automatically enabled IPv6 protocols (IPv6 gets automatically enabled on Debian), as well as on most latest Linux distribituions nowdays.

Disabling IPv6 network protocol on Linux if not used has 2 reasons:

1. Security (It's well known security practice to disable anything not used on a server)
Besides that IPv6 has been known for few criticil security vulnerabilities, which has historically affected the Linux kernel.
2. Performance (Sometimes disabling IPv6 could have positive impact on IPv4 especially on heavy traffic network servers).
I've red people claiming disabling IPv6 improves the DNS performance, however since this is not rumors and did not check it personally I cannot positively confirm this.

Disabling IPv6 on all GNU / Linuces can be achieved by changing the kernel sysctl settings net.ipv6.conf.all.disable_ipv6 by default net.ipv6.conf.all.disable_ipv6 equals 1 which means IPv6 is enabled, hence to disable IPv6 I issued:

server:~# sysctl net.ipv6.conf.all.disable_ipv6=0

To set it permanently on system boot I put the setting also in /etc/sysctl.conf :

server:~# echo 'net.ipv6.conf.all.disable = 1 >> /etc/sysctl.conf

The aforedescribed methods should be working on most Linux kernels version > 2.6.27 in that number it should work 100% on recent versions of Fedora, CentOS, Debian and Ubuntu.
To disable IPv6 protocol on Debian Lenny its necessery to blackist the ipv6 module in /etc/modprobe.d/blacklist by issuing:

echo 'blacklist ipv6' >> /etc/modprobe.d/blacklist

On Fedora / CentOS there is a another universal "Redhat" way disable IPv6.

On them disabling IPv6 is done by editting /etc/sysconfig/network and adding:

NETWORKING_IPV6=no IPV6INIT=no

I would be happy to hear how people achieved disabling the IPv6, since on earlier and (various by distro) Linuxes the way to disable the IPv6 is probably different.

Share this on

Tags: blackist, boot, Cannot, CentOS, conf, Debian, Disabling, distro, DNS, fedora, gnu linux, heavy traffic, impact, ipv, ipv4, ipv6, kernel, kernel 2, Linux, linux kernel, linux kernels, methodology, modprobe, Module, necessery, net, network, network protocol, network servers, Networking, number, performance, Protocol, protocols, quot, Redhat, security, security practice, security vulnerabilities, sysctl, system boot, traffic network, Ubuntu, version, way
Posted in Linux, System Administration | No Comments »

How to configure and enable Xen Linux dedicated server’s Virtual machines Internet to work / Enable multipe real IPs and one MAC only in (SolusVM) through NAT routed and iptables

Saturday, June 4th, 2011

Xen Linux Virtual Machine Logo

I’ve been hired as a consultant recently to solve a small task on a newly bought Xen based dedicated server.
The server had installed on itself SolusVM

The server was a good hard-iron machine running with CentOS Linux with enabled Xen virtualization support.
The Data Center (DC) has provided the client with 4 IP public addresses, whether the machine was assigned to possess only one MAC address!

The original idea was the dedicated server is supposed to use 4 of the IP addresses assigned by the DC whether only one of the IPs has an external internet connected ethernet interface with assigned MAC address.

In that case using Xen’s bridging capabilities was pretty much impossible and therefore Xen’s routing mode has to be used, plus an Iptables Network Address Translation or an IP MASQUERADE .

In overall the server would have contained 3 virtual machines inside the Xen installed with 3 copies of:

Microsoft Windows 2008

The scenario I had to deal with is pretty much explained in Xen’s Networking wiki Two Way Routed Network

In this article I will describe as thoroughfully as I can how I configured the server to be able to use the 3 qemu virtual machines (running inside the Xen) with their respective real interner visible public IP addresses.

1. Enable Proxyarp for the eth0 interface

To enable proxyarp for eth0 on boot time and in real time on the server issue the commands:

[root@centos ~]# echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp[root@centos ~]# echo 'net.ipv4.conf.all.proxy_arp = 1' >> /etc/sysctl.conf

2. Enable IP packet forwarding for eth interfaces

This is important pre-requirement in order to make the iptables NAT to work.

[root@centos ~]# echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf [root@centos ~]# echo 'net.ipv6.conf.all.forwarding=1' >> /etc/sysctl.conf

If you get errors during execution of /etc/init.d/xendomains , like for example:

[root@centos ~]# /etc/init.d/xendomains restart /etc/xen/scripts/network-route: line 29: /proc/sys/net/ipv4/conf/eth0/proxy_arp: No such file or directory /etc/xen/scripts/network-route: line 29: /proc/sys/net/ipv6/conf/eth0/proxy_arp: No such file or directory

in order to get rid of the message you will have to edit /etc/xen/scripts/network-route and comment out the lines:

echo 1 >/proc/sys/net/ipv4/conf/${netdev}/proxy_arp echo 1 > /proc/sys/net/ipv6/conf/eth0/proxy_arp e.g. #echo 1 >/proc/sys/net/ipv4/conf/${netdev}/proxy_arp #echo 1 > /proc/sys/net/ipv6/conf/eth0/proxy_arp

3. Edit /etc/xen/xend-config.sxp, disable ethernet bridging and enable eth0 routing (route mode) and NAT for Xen’s routed mode

Make absolutely sure that in /etc/xen/xend-config.sxp the lines related to bridging are commented.
The lines you need to comment out are:

(network-script network-bridge) (vif-script vif-bridge)

make them look like:

#(network-script network-bridge) #(vif-script vif-bridge)br />

Now as bridging is disabled let’s enable Xen routed network traffic as an bridged networking alternative.

Find the commented (network-script network-route) and (vif-script vif-route) lines and uncomment them:

#(network-script network-route) #(vif-script vif-route)

The above commented lines should become:

(network-script network-route) (vif-script vif-route)

Next step is to enable NAT for routed traffic in Xen (necessery to make routed mode work).
Below commented two lines in /etc/xen/xend-config.sxp, should be uncommented e.g.:

#(network-script network-nat) #(vif-script vif-nat)

Should become:

(network-script network-nat) (vif-script vif-nat)

4. Restart Xen control daemon and reload installed Xen’s Virtual Machines installed domains

To do so invoke the commands:

[root@centos ~]# /etc/init.d/xend [root@centos ~]# /etc/init.d/xendomains restart

This two commands will probably take about 7 to 10 minutes (at least they took this serious amount of time in my case).
If you think this time is too much to speed-up the procedure of restarting Xen and qemu attached virtual machines, restart the whole Linux server, e.g.:

[root@centos ~]# restart

5. Configure iptables NAT rules on the CentOS host

After the server boots up, you will have to initiate the following ifconfig & iptables rules in order to make the Iptables NAT to work out:

echo > > /proc/sys/net/ipv4/conf/tap1.0/proxy_arp /sbin/ifconfig eth0:1 11.22.33.44 netmask 255.255.252.0 /sbin/ifconfig eth0:2 22.33.44.55 netmask 255.255.252.0 /sbin/ifconfig eth0:3 33.44.55.66 netmask 255.255.252.0

/sbin/iptables -t nat -A PREROUTING -d 11.22.33.44 -i eth0 -j DNAT --to-destination 192.168.1.2 /sbin/iptables -t nat -A PREROUTING -d 22.33.44.55 -i eth0 -j DNAT --to-destination 192.168.1.3 /sbin/iptables -t nat -A PREROUTING -d 33.44.55.66 -i eth0 -j DNAT --to-destination 192.168.1.4 /sbin/iptables -t nat -A POSTROUTING -s 192.168.1.2 -o eth0 -j SNAT --to-source 11.22.33.44 /sbin/iptables -t nat -A POSTROUTING -s 192.168.1.3 -o eth0 -j SNAT --to-source 22.33.44.55 /sbin/iptables -t nat -A POSTROUTING -s 192.168.1.4 -o eth0 -j SNAT --to-source 33.44.55.66

In the above ifconfig and iptables rules the IP addresses:

11.22.33.44, 22.33.44.55, 33.44.55.66 are real IP addresses visible from the Internet.
In the above rules eth0:1, eth0:2 and eth0:3 are virtual ips assigned to the main eth0 interface.

This ifconfig and iptables setup assumes that the 3 Windows virtual machines running inside the Xen dedicated server will be configured to use (local) private network IP addresses:

192.168.1.2, 192.168.1.3 and 192.168.1.4

You will have also to substitute the 11.22.33.44, 22.33.44.55 and 33.44.55.66 with your real IP addreses.

To store the iptables rules permanently on the fedora you can use the iptables-save command:

[root@centos ~]# /sbin/iptables-save

However I personally did not use this approach to save my inserserted iptable rules for later boots but I use my small script set_ips.sh to add virtual interfaces and iptables rules via the /etc/rc.local invokation:

If you like the way I have integrated my virtual eths initiation and iptables kernel firewall inclusion, download my script and set it to run in /etc/rc.local, like so:

[root@centos ~]# cd /usr/sbin [root@centos sbin]# wget http://www.pc-freak.net/bshscr/set_ips.sh ... [root@centos ~]# chmod +x /usr/sbin/set_ips.sh [root@centos ~]# mv set_ips.sh /usr/sbin [root@centos ~]# echo '/usr/sbin/set_ips.sh' >> /etc/rc.local

Note that you will have to modify my set_ips.sh script to substitute the 11.22.33.44, 22.33.44.55 and 33.44.55.66 with your real IP address.

So far so good, one might think that all this should be enough for the Virtual Machines Windows hosts to be able to connect to the Internet and Internet requests to the virtual machines to arrive, but no it’s not!!

6. Debugging Limited Connectivity Windows LAN troubles on the Xen dedicated server

Even though the iptables rules were correct and the vif route and vif nat was enabled inside the Xen node, as well as everything was correctly configured in the Windows 2008 host Virtual machines, the virtual machines’s LAN cards were not able to connect properly to connect to the internet and the Windows LAN interface kept constantly showing Limited Connectivity! , neither a ping was available to the gateway configured for the Windows VM host (which in my case was: 192.168.1.1).

You see the error with Limited connectivity inside the Windows on below’s screenshot:

Limited Connectivty Windows error Lan Interface, status screenshot

Here is also a screenshot of my VNC connection to the Virtual machine with the correct IP settings – (TCP/IPv4) Properties Window:

Windows Xen Network Connections Windows VNC TCP/IPv4 Properties Window

This kind of Limited Connectivity VM Windows error was really strange and hard to diagnose, thus I started investigating what is wrong with this whole situation and why is not able the Virtualized Windows to connect properly to the Internet, through the Iptables NAT inbound and outbound traffic redirection.

To diagnose the problem, I started up with listing the exact network interfaces showing to be on the Xen Dedicated server:

[root@centos ~]# /sbin/ifconfig |grep -i 'Link encap' -A 1 eth0 Link encap:Ethernet HWaddr 00:19:99:9C:08:3A inet addr:111.22.33.55 Bcast:111.22.33.255 Mask:255.255.252.0 -- eth0:1 Link encap:Ethernet HWaddr 00:19:99:9C:08:3A inet addr:11.22.33.44 Bcast:11.22.33.255 Mask:255.255.252.0 -- eth0:2 Link encap:Ethernet HWaddr 00:19:99:9C:08:3A inet addr:22.33.44.55 Bcast:22.33.44.255 Mask:255.255.252.0 -- eth0:3 Link encap:Ethernet HWaddr 00:19:99:9C:08:3A inet addr:33.44.55.66 Bcast:33.44.55.255 Mask:255.255.252.0 -- lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 -- tap1.0 Link encap:Ethernet HWaddr FA:07:EF:CA:13:31 -- vifvm101.0 Link encap:Ethernet HWaddr FE:FF:FF:FF:FF:FF inet addr:111.22.33.55 Bcast:111.22.33.55 Mask:255.255.255.255

I started debugging the issue, using the expelling logic.
In the output concerning my interfaces via ifconfig on eth0, I have my primary server IP address 111.22.33.55 , this one is working for sure as I was currently connected to the server through it.

The other virtual IP addresses assigned on the virtual network interfaces eth0:1, eth0:2 and eth0:3 were also assigned correctly as I was able to ping this ips from my Desktop machine from the Internet.

The lo , interface was also properly configured as I could ping without a problem the loopback ip – 127.0.0.1

The rest of the interfaces displayed by my ifconfig output were: tap1.0, vifvm101.0

After a bit of ressearch, I’ve figured out that they’re virtual interfaces and they belong to the Xen domains which are running qemu virtual machines with the Windows host.

I used tcpdump to debug what kind of traffic does flow through the tap1.0 and vifvm101.0 interfaces, like so

[root@centos ~]# tcpdump -i vifvm101.0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on vifvm101.0, link-type EN10MB (Ethernet), capture size 96 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel [root@centos ~]# tcpdump -i tap1.0 cpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tap1.0, link-type EN10MB (Ethernet), capture size 96 bytes ^C 08:55:52.490249 IP 229.197.34.95.customer.cdi.no.15685 > 192.168.1.2.12857: UDP, length 42

I’ve figured out as it’s also observable in above’s two tcpdump commands output, that nothing flows through the vifvm101.0 interface, and that there was some traffic passing by tap1.0 interface.

7. Solving the Limited Connectivy Windows Internet network connection problems

As below’s ifconfig output reveals, there is no IP address assigned to tap1.0 interface, using some guidelines and suggestions from guys in irc.freenode.net’s #netfilter irc channel, I’ve decided to give a go to set up an IP address of 192.168.1.1 to tap1.0 .

I choose for a reason as this IP address is configured to be my Gateway’s IP Address inside the Emulated Windows 2008 hosts

To assign the 192.168.1.1 to tap1.0, I issued:

[root@centos ~]# /sbin/ifconfig tap1.0 192.168.1.1 netmask 255.255.255.0To test if there is difference I logged in to the Virtual Machine host with gtkvncviewer (which by the way is a very nice VNC client for Gnome) and noticed there was an established connection to the internet inside the Virtual Machine

I issued a ping to google which was also returned and opened a browser to really test if everything is fine with the Internet.
Thanks God! I could browse and everything was fine

8. Making tap1.0 192.168.1.1 (VM hosts gateway to be set automatically, each time server reboots)

After rebooting the server the tap1.0 assignmend of 192.168.1.1 disappeared thus I had to make the 192.168.1.1, be assigned automatically each time the CentoS server boots.

To give it a try, I decided to place /sbin/ifconfig tap1.0 192.168.1.1 netmask 255.255.255.0 into /etc/rc.local, but this worked not as the tap1.0 interface got initialized a while after all the xendomains gets initialized.

I tried few times to set some kind of sleep time interval with the sleep , right before the /sbin/ifconfig tap1.0 … ip initialization but this did not worked out, so I finally completely abandoned this methodology and make the tap1.0 get initialized with an IP through a cron daemon.
For that purpose I’ve created a script to be invoked, every two minutes via cron which checked if the tap1.0 interface is up and if not issues the ifconfig command to initialize the interface and assign the 192.168.1.1 IP to it.

Here is my set_tap_1_iface.sh shell script

To set it up on your host in /usr/sbin issue:

[root@centos ~]# cd /usr/sbin/ [root@centos sbin]# wget http://www.pc-freak.net/bshscr/set_tap_1_iface.sh ...In order to set it on cron to make the tap1.0 initialization automatically every two minutes use the cmd:

[root@centos ~]# crontab -u root -e

After the cronedit opens up, place the set_tap_1_iface.sh cron invokation rules:

*/2 * * * * /usr/sbin/set_tap_1_iface.sh >/dev/null 2>&1

and save.

That’s all now your Xen dedicated and the installed virtual machines with their public internet IPs will work
If this article helped you to configure your NAT routing in Xen drop me a thanks message, buy me a beer or hire me! Cheers

Share this on

Tags: addr, amount, arp, arpecho, Bcast, boot time, center dc, control, dedicated server, echo 1, eth, execution, external internet, host, ip masquerade, ips, iptables nat, ipv, ipv4, ipv6, iron machine, mac address, memory, Metric, microsoft windows, modeMake, necessery, Netmask, network address translation, POSTROUTING, proxy arp, public addresses, public ip addresses, qemu, Restart, root, screenshot, sxp, time, uncomment, vif, Virtual, virtual machines, work, xend
Posted in Linux, System Administration | 3 Comments »

Walking in Light with Christ – Faith, Computing, Diary

Posts Tagged ‘ipv4’

GET ARTICLE UPDATES

Daily Bible quote

Recent Posts

Useful blog? Help it:

Similar Posts

Categories

Links to Other Places

About Myself

Recent Comments

Ads

Top Post Views

blogtopsites

June 2013
M	T	W	T	F	S	S
« May
					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30