disabling ipv6

felosi · 06-01-2006, 10:26 PM

I have a debian server and when I do netstat it does not give complete ip address due to the tcp6. This is preventing any dos protection script or apf from blocking malicious ips because it does not get the entire ip. Here is an example

Code:

tcp6       0      0 ::ffff:65.23.156.190:80 ::ffff:67.136.33.:60256 TIME_WAIT  -
tcp6       0      0 ::ffff:65.23.156.190:80 ::ffff:67.136.33.:60257 TIME_WAIT  -
tcp6       0   1584 ::ffff:65.23.156.190:22 ::ffff:67.136.33.:60194 ESTABLISHED4493/2
tcp6       0      0 ::ffff:65.23.156.190:80 ::ffff:69.14.5.10:62328 TIME_WAIT  -
tcp6       0      0 ::ffff:65.23.156.190:80 ::ffff:67.136.33.:60250 TIME_WAIT  -
tcp6       0      0 ::ffff:65.23.156.190:80 ::ffff:67.136.33.:60251 TIME_WAIT  -
tcp6       0      0 ::ffff:65.23.156.190:80 ::ffff:67.136.33.:60252 TIME_WAIT  -
tcp6       0      0 ::ffff:65.23.156.190:80 ::ffff:67.136.33.:60253 TIME_WAIT  -
tcp6       0      0 ::ffff:65.23.156.190:80 ::ffff:67.136.33.:60254 TIME_WAIT  -
tcp6       0      0 ::ffff:65.23.156.190:80 ::ffff:67.136.33.:60255 TIME_WAIT  -

I found where you can edit modprode aliases and disable it but then I found where you cant. All my connections to ssh and port 80 are tcp6. If I disable this and reboot will I be able to connect to my box? Will it pick up the new protocol? What can I do?
Thanks a lot

macemoneta · 06-02-2006, 04:18 PM

Have you tried with the '-v' option?

Quote:

-v Be verbose. Avoids truncation of long addresses.

felosi · 06-02-2006, 11:21 PM

well that displays the hostname but not the ip. I also got these errors when I did that:

Code:

netstat: no support for `AF IPX' on this system.
netstat: no support for `AF AX25' on this system.
netstat: no support for `AF X25' on this system.
netstat: no support for `AF NETROM' on this system.

macemoneta · 06-02-2006, 11:31 PM

From the 'man netstat' documentation:

Quote:

--numeric , -n
Show numerical addresses instead of trying to determine symbolic host,
port or user names.

Also, if you would like to suppress errors, you can route stderr to /dev/null:

netstat -v -n 2>/dev/null

felosi · 06-03-2006, 11:46 PM

yeah I know about -n it is not displaying full ips on any because of the ipv6

macemoneta · 06-04-2006, 12:11 AM

If you're saying that entering 'netstat -v -n 2>/dev/null' still truncates the IP addresses, then open a bug with the packager of the netstat you are using; they appear to have missed a patch.

felosi · 06-05-2006, 10:07 PM

thanks for your help. Im currently running debian sarge with plesk so it is the one that is with that. Do you think it would screw up anything or mess with the plesk if I was to upgrade it to testing? Or do you know of where I can get a replacement netstat? I wish debian would hurry up with etch, sarge is getting outdated.
Thanks Again

macemoneta · 06-05-2006, 10:46 PM

Well, for debian, you could download the latest version of net-tools from testing or unstable.