Ubuntu Networking :: Too Much Traffic Recorded On /var/log/messages?
Apr 19, 2011
For about 3-4 weeks, my file system used space was growing and growing. After some days, I decided to analyze the file system in order to understand what is going on. Well, the results returned that the log files at /var/log ( especially kern.log, syslog and messages ) were the log files that were sucking the free space. I searched if this was some kind of bug but it turned out that if these files are growing, the problem is in the records.
So I picked from the tail of the messages log the last 50 lines and I saw this:
I need to set up my centOS computer as a firewall in my home network. Ive got 2 interfaces, eth0 and eth1. I want to allow and forward all traffic on eth0 and block all traffic on eth1 except ssh, ping(icmp) and DNS. How do I do this? Ive tried some editing in /etc/sysconfig/iptables but no luck.
I wanted to tell my server to block all traffic but US only traffic. So i followed this guide:[URL].. Now I know, it's the best way to help prevent hackers/crackers (doesn't matter to me what they are called. I just have to stop them). My server only deals with US clients anyways so might as well just start right there for my server's security before getting into the brute force and injection preventions. So I got it all done compiled everything moved to the proper directory. I then started to setup my iptables. Like so
Recently I notice that when I'm connected to an vpn server (pptpd) and I'm using it as a default gateway my download and upload speed decreases almost to the half of the usual speed. I made a test using iptables in order to count how much GRE packets are generated (except the real traffic itself) in that way:
Code: iptables -I INPUT -p gre -j ACCEPT iptables -I OUTPUT -p gre -j ACCEPT
iptables -I FORWARD -s 172.16.10.101 -j ACCEPT iptables -I FORWARD -d 172.16.10.101 -j ACCEPT The first 2 rules match all GRE packets between the pptpd server and client, and the next rules - the traffic between the server and the client.
When I turn the counters to zero and begin to generate traffic (to browse, to download etc.) I see that the GRE packets are even more than these in the FORWARD chain.
So, my question is first of all is my test correct and is it true that so much gre traffic is being generated during the browsing (it becames clear that the traffic is double than if the pptpd wasn't used as a gateway) and if yes - can that traffic be reduced?
We have something on our network that is reaking havoc with our content filter. I am trying to track it down, but so far I have been unsuccessful. We have approximately 500 devices in 100+ different locations spread across 9 states. Looking at each computer is not really feasible.
I need a machine that can sit in between our network and our internet connection and graphically monitor in real time and logs how much traffic each device is sending and receiving. It would need to sit inline so it has to have two nics and be able to pass traffic. The machine also needs to be transparent. Reconfiguration of our routers or workstations is not an option.
I have used ethereal and wireshark before. Ethereal may be a viable option, but wireshark seems to provide lots of information, but no practical way to make use of it. how to set up the box to be a transparent device on the network that will allow internet bound traffic to flow (freely)?
I recently switched to Ubuntu and I'm loving it, except i am having sound problems with both my laptop and my desktop.My laptop is using an internal microphone (it is a Toshiba Satellite P500) but the mic is not recognized, I hook up my M-Audio USB audio interface which has my studio mic connected to it, it gets recognized as an input device but it doesnt recordSame thing on my desktop, it gets recognized, doesnt record.My laptop is 64-bit and my desktop is 32-bit, both have Ubuntu 10.04
I'm running Ubuntu 10.10 in a Samsung R510. I've tried to record sound with an external microphone and there have always been a permanent noise accompanying it.I thought it could be the internal microphone, that's causing the noise, but even when I disabled it the noise remains. Or maybe I didn't disable it the right way !
I am on 64-bit Natty and for the first time since my install a month ago, I have had a system hang requiring a power-off restart. It happened yesterday and a few moments ago.My question is that I want to troubleshoot this myself and wonder if the activities that my system were running just prior to crashing are recorded in a log file somewhere.I used to look int /var/log.messages or /var/log/boot, but this was in the Maverick days.
I tried ubuntu 10.0 yesterday (running from my usb pen) and I liked it. A lot. However, there are a few issues that i need to know if there's any way to solve them, before making the transition: Keyboard keys are swapped; I mean, if I press alt+(anyNumber) I get another character. Why does this happen?-I develop a lot of code in VBA; I tried to record a macro using Open Office Calc, but I got the impression that the code used in the recorded macro is slightly different.
Using Debian Lenny I recorded a wav file with Audacity to burn to a cd with K3b.The problem is when I played the cd with KsCD; it wouldn't stop when it got to the end; it just kept studdering. I didn't have problems using KsCD to play CDs I had ripped and then burned with K3b.Is this a problem with KsCD, or do I need to do something when I finish the file with Audacity?
I recorded some clips on the internet through the sound card withAudacity. I exported the recording as a wave file, and burnt it to a CD. The problem is stop playing. It comes to the end and just repeats the last fraction of a second over and over.I used K3b to burn other audio CDs that I copied and didn't havea problem with KsCD playing them. Is this a problem with Audacity,KsCD or did I do something wrong?I recorded the file; saved project and then exported as a wave file
I am having some problems with recording with my laptop. When I try to record something through the laptops mic, usb webcam mic or with desktop recorders audio record feature all playback is too fast (sounds a bit like alvin and the chipmunks :L ) Is anybody else having this problem, or even better know how to fix it ?
Sorry if this has been asked before, I'm running 10.10 and had never tried recording before I upgraded to 10.04. I had the same problem in 10.04 though.
I have ubuntu server with PPTP on it. I need to limit single connection speed for ip 1 mbit/s, and mounthly traffic limit to 5 GB. How i can do this my task. I try to find somthing with ip tables, but can't find how to creat mounthly limits.PPTP do not have this option, maybe is some other, not hard for configure VPN server? Maybe someone make this task with iptables, and can give commands for limiting? Ofcorse VPN program with integrated accaunts and limits will be better.
I've got 4 or 5 of these TRENDnet USB network adapters ( TU-ET100c ) that I use frequently when I'm configuring firewalls or IPS devices for customers. I use them in combination with VirtualBox to test. They've always worked great until my new laptop I just got, and I put 10.04 on it. Previously I was on 9.x. Sometimes they will give a link light, other times not. And when they do the interface shows that it's up, but I can't get any traffic across the interface.
I have access to a VPN I use when having confidential instant messaging sessions. For the purposes of my work, essentially.I'm a command line kind of guy, and like to use Finch (the shell version of Pidgin) for those.However, when I turn on my OpenVPN connection it routes all traffic through the VPN. Web-browsing, IMing, and I can no longer access other machines on my home network.Can I set OpenVPN to only route traffic I ask through that connection (either by port number or application, or some way I haven't thought of), while other traffic flows through my usual home network?Some kind of local proxy perhaps? Or a dd-wrt box set up as a proxy, connected to OpenVPN?I've played around with the GUI environment too (I have a basic GUI I sometimes use on my main machine) and have installed the full desktop 10.10 on a second machine just to see if I can work it out.
I have a VPN account and have been running it perfectly on windows without any problems but I deleted my windows OS because I wanted to force myself to learn a Linux OS. I have installed the configuration package through the terminal and have followed this guide exactly
[URL]
The VPN was giving me a no secrets error to start off but I managed to fix and now it connects for about 40seconds but whilst it is connected, the internet is completely useless and I can't get on anything... It then disconnects after 40 seconds saying it has failed.
I installed firestarter to see if I could tweak it there to work but it was beyond me and I could also see from the data being sent that none of it was going through tap0 whilst the VPN was connected..
I want to measure the time it takes to execute a C function. The question is which is the best method to record time. After a lot of searching online, I found two ways [URL]:
a. using clock_gettime(CLOCK_MONOTONIC, &t) b. using TSC
I call the C function 50 times (recording the time it takes for each call). The average is found only for the last 35 calls.
Using (a), I get:
48345 us 28350 us 28379 us 27716 us
[code]....
Average time for the last 35 loops: 121450.47 microseconds
Average for the last 35 loops: 27236.66 cycles What could be causing the strange value of 3322259 us in method (a)? I could just use method (b) but I would like to know what is going on here... Btw, I am using a desktop - with Linux debian 2.6.26 #1 SMP.
I have a syslog-ng running and kernel build of 2.6.34.8 I use a syslog API in my program with facility LOG_LOCAL5 and and levels debug err and crit and info. when I ran on the older syslog facility I had everything logged fine as I intended. now I have written these rules into the syslog-ng.conf:
I have a lot of recordings on my mythtv box.i can see/play them fine within the mythfrontend interface, and mythweb loads almost all pages ok (including schedules, guides, etc.), but when I click on 'recorded programs' at the top, Allowed memory size of 33554432 bytes exhausted (tried to allocate 88 bytes) in /usr/ share/ mythtv/mythweb/includes/translate.php on line 142.I've had this error before, and it went away when I purged my list of recordings.
I'm trying to record video off my webcam, and tried two different programs - cheese and wxcam.
I honestly didn't have much luck with cheese - it seemed to work fine, but when it came time to record video, the frame rate dropped to a ridiculous level, making the video completely unusable. I could wave my arm in front of the camera, and it might pick up one frame of that.
Moving on, I tried wxcam, which I like a lot.. however, when I record video with the xvid compression, they play back considerably faster than they were recorded.
I need to be able to do the following: Physical Router located at 192.168.40.1
On Ubuntu 10.04 Lucid machine: eth0 with static ip 192.168.40.2 eth1 with static ip 192.168.40.3 eth2 with static ip 192.168.40.4
Associate a virtual address to eth1 with an entirely different network address such as 192.168.50.1 Do the same (virtual address) for eth2 -- e.g. 192.168.60.1 In the application:
register phone number A at 192.168.40.1 (The application will automatically use eth0 for this) register phone number B at 192.168.50.1 register phone number C at 192.168.60.1
Somehow forward all traffic (including the register request) sent to 192.168.50.1 to 192.168.40.1 as if the register had been made directly to 192.168.40.1. In other words, the app "sends" registration and traffic to 192.168.50.1 but then Ubuntu forwards it to 192.168.40.1 (but the app does not know that). Similarly, forward all traffic sent to 192.168.60.1 to the router at 192.168.40.1.
Do the same for the reverse, forward all traffic that the router sends back to 192.168.40.3 (eth1) to 192.168.50.1 (within the Ubuntu machine) so that the app knows it is for phone B. Similarly forward all traffic that the router sends back to 192.168.40.4 (eth2) to 192.168.60.1 so that the app knows it is for phone C. Thus, the application believes that it is registering at 3 completely separate routers on 3 completely separate networks via 3 separate network interfaces but in fact is really registering all three to the same router (but does not know that). Similarly, the router believes that it is receiving 3 separate registrations because it receives each registration request and traffic from 3 separate interfaces and thus 3 separate mac addresses (i.e., of eth0, eth1, and eth2). Traffic sent to and from the router for each of the 3 phone numbers (via eth0, eth1, and eth2) are not mixed because the translation happens in both directions.
I'm facing a problem when I establish VPN connections using OpenVPN to Your Freedom Server. " you can see their documentation here ", I've installed OpenVPN from synaptic and I used the client to connect through VPN and it works !! but there is no traffic in FF or any application !!I tired to insert some HTTP proxy also belongs to the same server and it works. What really wonders me is that OpenVPN seems to work only when I'm connecting to streams sites "e.g. ustream, justin.tv" Is there anyway to force the whole traffic to use OpenVPN " I'm using Mobile modem and it works fine with OpenVPN in win7
I noticed a huge data transfer to my computer. I wasn't downloading anything big, I have just opened Firefox, Thunderbird etc. It stopped after a minute but I'd like to know, what that was - this wasn't the first time something like this happened. I promptly started Wireshark and captured a few packets, all of them look like this:
[code]...
I tried to look at [URL]... but that webpage does not work. what the traffic might be caused by? Couldn't anyone hacked my pc?
Linksys Router with firewall 1 Linux Server -- Running Dapper Multiple Linux ThinClients running off the linux server Multiple Freestanding Linux Machines -- Running ubuntu variants Multiple Freestanding Windows Machines -- Running windows variants
The issue is that certain websites will not load on the freestanding linux machines, but they will load on our linux server and all the windows machines. examples: [URL].. These sites will start to load, but they never really finish and just seem to time out. I have tried changing the dns on the freestanding linux laptops to use 208.67.220.220 and this does not solve the problem.
I have checked the firewall rules and they seem pretty standard.when the linux machines are used on other networks, these websites work, so the problem seems to be related to this particular network.
When I do (freestanding linux): Code: traceroute acer.com -I The trace times out at 30 hops When I do (linux server): Code: traceroute acer.com -I The trace reaches the destination at 19 hops
Both of the traceroute requests start by going through the router. So the big issue is that websites will load on our linux server and all our windows machines, but not on freestanding linux clients.
Does anybody know a way to log traffic on a single interface/IP by process? Specifically what I want to record is traffic usage by user, but I can match PIDs against user to product stats and the user would also be in the full command line of the process.
There is a nice tool called nethogs that I often use to monitor traffic this way in realtime, but I would like to log the accumulated traffic rather than just monitor it.
My laptop has become very sluggish. So I loaded firestarter firewall. It is reporting loads of incoming UDP traffic. I only use this machine for Skype and Firefox based work as most of my stuff is kept on the cloud. Is it safe to stop all this UDP traffic? It would free up my CPU I guess. It seems port 56095 is getting hammered.
I have recently installed OpenSUSE 11.3. I can play audio files, but there is a problem recording, namely the recording is way too slow. This was tried 3 ways: in Audacity, in Skype (making a test call), and using the arecord command in a console, as root. To make the playback sound normal, I tried taking the already-recorded file and speeding it up in Audacity. It was necessary to speed up the recording by 50%. I've tried updating alsa and other suggestions which I could figure out, and run the scripts for diagnostic information. BTW, I'm using a headset plugged in to standard 1/8 inch mic and speaker jacks, not a USB headset.
I've succesfullly connected to my vpn with kvpnc, but none of my traffic is going through the vpn! I dont know how to route traffic to the vpn. for instance, when I go to whatsmyip.com it still has my previous ip.
I have a comcast business network adapter that has a 4 port switch. It also handles nat 1 to 1 translation for static IPs (That's just how they do it, there is no other choice).
In port 1, I have a cat6 that brings traffic to and from my linux machines, allows me to vpn, ssh, a mail server, etc. Everything here is fine.
In port 2, I have a netgear router that is setup with a point to point VPN for a client.
Here are the issues:
1. Machines that are connected to the netgear vpn router/switch can access machines on my network - I don't want this.
2. I can't access the machines connected to his lan from my lan - I need this to administer his machines somehow. Even if I have to VPN to the concentrator and do it like that.
Here is the network structure.
Code: Internet <-> 10.10.10.1 -> switch with 10.10.10.x machines | -> internal vpn IP 10.10.10.50 |
[Code]....
The external network for the VPN is 10.10.10.x and the internal is 10.10.20.x. So, a machine with IP 10.10.20.100 can get to 10.10.10.X and I don't want that. I guessing it's doing this because technically, I'm 'from the internet' on 10.10.10.x and the vpn machines are going 'out to the internet'. Is there a way to have this:
vpn -> gateway traffic only?
I have a cisco 1811w at my disposal if I need to use it; however, I'm all thumbs when it comes to cisco IOS and networking in general.
