Some networking questions

yuray · 01-06-2004, 12:18 AM

>First question :
>the tcpdump command says xxx paquets dropped and normally I should see this paquet on >/var/log/messages. I'm shure this is working in my firewall configuration :
Check syslog.conf. Are you sure what --log-level 3 will be send to /var/log/messages ? (3 what is it ? debug, info or ?)
If syslog.conf is ok
- make all rules -j LOG first rules in tables
- shorter their.
Example
-A OUTPUT -j LOG --log-prefix "IPTABLES-OUTPUT : " --log-level 3

I am not understand www.nordparis.banquepopulaire.fr is "bad url" ?
It is work now ? How about fr.google.com ?

jmcollin92 · 01-06-2004, 02:47 AM

Quote:

Originally posted by yuray
>First question :
>the tcpdump command says xxx paquets dropped and normally I should see this paquet on >/var/log/messages. I'm shure this is working in my firewall configuration :
Check syslog.conf. Are you sure what --log-level 3 will be send to /var/log/messages ? (3 what is it ? debug, info or ?)

The begining my syslog.conf is the following :

Code:

# Various entry
auth,authpriv.*                                                 /var/log/auth.log
*.*;auth,authpriv.none                                          -/var/log/syslog
user.*                                                          -/var/log/user.log

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;;news.none;authpriv.none                                       -/var/log/messages
...

Do you think it's ok ?

Quote:

If syslog.conf is ok
- make all rules -j LOG first rules in tables
- shorter their.
Example
-A OUTPUT -j LOG --log-prefix "IPTABLES-OUTPUT : " --log-level 3

Ok I will do that. My goal was to have only the dropped packet. So I have to put the LOG rule at the end, just before the DROP. Am I wrong ?

Quote:

I am not understand www.nordparis.banquepopulaire.fr is "bad url" ?
It is work now ? How about fr.google.com ?

Ok I should give more explanations (sorry for that). www.nordparis.banquepopulaire.fr is a bad URL too. This URL is more easier to test because, all the site is not answering and not only one button in the site as with fr.yahoo.com (google is working without problem).

Can you give me the good configuration (firewall and syslog.conf) to have a log for each dropped packet ?

Thank you.

jmcollin92 · 01-06-2004, 03:58 AM

Quote:

Originally posted by yuray
Hello.
I read a little more about iptables
Try to check very simple and insecure configuration.
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
( or iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to-source your_static_ip )
iptables -A FORWARD -j LOG --log-level info

In /var/log/messages (I don`t know where you syslog stored info, chekc /etc/syslog.conf ) you
will see requests and replys.

I've try with your commands and there were no more traffic in and out of the Linux box.....
So I've try with these rules :

Code:

# Generated by iptables-save v1.2.7a on Wed Nov 26 23:20:02 2003
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o ppp0 -j MASQUERADE
COMMIT
# Completed on Wed Nov 26 23:20:02 2003
# Generated by iptables-save v1.2.7a on Wed Nov 26 23:20:02 2003
*mangle
:PREROUTING ACCEPT [246:38812]
:INPUT ACCEPT [246:38812]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [245:38575]
:POSTROUTING ACCEPT [245:38575]
COMMIT
# Completed on Wed Nov 26 23:20:02 2003
# Generated by iptables-save v1.2.7a on Wed Nov 26 23:20:02 2003
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Wed Nov 26 23:20:02 2003

and the problem is still the same.
The tcpdump trace says :

Code:

38 packets dropped by kernel

!!
How is it possible to have packets dropped with the rules showns before ?
How to see what packets are dropped (nothing in /var/log/messages) ?
Is there any incorrect packets wich are not traced ?

Answering those questions is certainly the beginning of the solution.

yuray · 01-06-2004, 06:03 AM

Quote:

Originally posted by jmcollin92
[B]The begining my syslog.conf is the following :

Code:

# Various entry
auth,authpriv.*                                                 /var/log/auth.log
*.*;auth,authpriv.none                                          -/var/log/syslog
user.*                                                          -/var/log/user.log

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;;news.none;authpriv.none                                       -/var/log/messages
...

Do you think it's ok ?

You write --log-level 3 ---->
In syslog.h 3 define as LOG_ERROR (error) ----> you logs send to /var/log/syslog
Replace 3 - info and you must get logs into /var/log/messages

Quote:

Ok I will do that. My goal was to have only the dropped packet. So I have to put the LOG rule at the end, just before the DROP. Am I wrong ?

Oopss. Sorry, my fault, you right!

Quote:

Ok I should give more explanations (sorry for that). www.nordparis.banquepopulaire.fr is a bad URL too. This URL is more easier to test because, all the site is not answering and not only one button in the site as with fr.yahoo.com (google is working without problem).

My dump with (localhost linux)
-1 14:39:01.869264 admin414.33706 > 194.51.109.131.http: S [tcp sum ok] 1312746232:1312746232(0) win 5840 <mss 1460,sackOK,timestamp 2199983 0,nop,wscale 0> (DF) (ttl 64, id 31575, len 60)
-2 14:39:01.966707 194.51.109.131.http > admin414.33706: S [tcp sum ok] 2324403888:2324403888(0) ack 1312746233 win 65535 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0,nop,nop,sackOK> (DF) (ttl 104, id 21187, len 64)
-3 14:39:01.966741 admin414.33706 > 194.51.109.131.http: . [tcp sum ok] 1:1(0) ack 1 win 5840 <nop,nop,timestamp 2199993 0> (DF) (ttl 64, id 31576, len 52)
-4 14:39:01.966863 admin414.33706 > 194.51.109.131.http: P [tcp sum ok] 1:504(503) ack 1 win 5840 <nop,nop,timestamp 2199993 0> (DF) (ttl 64, id 31577, len 555)
-5 14:39:02.081956 194.51.109.131.http > admin414.33706: . [tcp sum ok] 1:1449(1448) ack 504 win 65032 <nop,nop,timestamp 220827 2199993> (DF) (ttl 104, id 21188, len 1500)

If compare with your dump will see what len of my packet number 5 is 1448 and your only 40! I don`t understand why so small ?
15:23:47.410162 194.51.109.131.http > 217.128.230.16.3197: . [tcp sum ok] 1:1(0) ack 367 win 65169 (DF) (ttl 118, id 13602, len 40)

Quote:

Can you give me the good configuration (firewall and syslog.conf) to have a log for each dropped packet ?

Sorry, we have not linux firewall

yuray · 01-06-2004, 06:11 AM

Quote:

Originally posted by jmcollin92
[B]I've try with your commands and there were no more traffic in and out of the Linux box.....
So I've try with these rules :

Code:

# Generated by iptables-save v1.2.7a on Wed Nov 26 23:20:02 2003
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o ppp0 -j MASQUERADE
COMMIT
# Completed on Wed Nov 26 23:20:02 2003
# Generated by iptables-save v1.2.7a on Wed Nov 26 23:20:02 2003
*mangle
:PREROUTING ACCEPT [246:38812]
:INPUT ACCEPT [246:38812]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [245:38575]
:POSTROUTING ACCEPT [245:38575]
COMMIT
# Completed on Wed Nov 26 23:20:02 2003
# Generated by iptables-save v1.2.7a on Wed Nov 26 23:20:02 2003
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Wed Nov 26 23:20:02 2003

I dont see what you want log :

Code:

[root@admin414 sys]# /sbin/iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere           LOG level warning
[root@admin414 sys]#

Post iptables result -- not iptables-save

jmcollin92 · 01-06-2004, 06:40 AM

Quote:

Originally posted by yuray
I dont see what you want log :
[/CODE]
Post iptables result -- not iptables-save

I just want to show you that with all rules at ACCEPT, the problem still occurs. So it's not a firewall problem.

The traces shows that there were Dropped packets whereas the firewall was accepting all packets. It's the problem we have to focus on, (I think).

How is it possible ? What are those packets ?
Can it be a hardware pb in the NIC ?

Best regards and thank's for all ......

jmcollin92 · 01-06-2004, 07:14 AM

Quote:

Originally posted by yuray
You write --log-level 3 ---->
In syslog.h 3 define as LOG_ERROR (error) ----> you logs send to /var/log/syslog
Replace 3 - info and you must get logs into /var/log/messages

It's not a pb because Error is > than Info and so messages are in both files.

Quote:

If compare with your dump will see what len of my packet number 5 is 1448 and your only 40! I don`t understand why so small ?
15:23:47.410162 194.51.109.131.http > 217.128.230.16.3197: . [tcp sum ok] 1:1(0) ack 367 win 65169 (DF) (ttl 118, id 13602, len 40)

It's a response packet no ?. Is it possible to see what is in the packet ? Perhaps there is an error or something like in this packet.

jmcollin92 · 01-06-2004, 03:53 PM

Here is another dialog with this site :
(from eth0) :

Code:

10:38:02.062004 ticeropo1.ticero.com.1028 > ticerosrv1.ticero.com.domain: [udp sum ok]  102+ A? www.nordparis.banquepopulaire.fr. (50) (ttl 128, id 22023, len 78)
10:38:02.226571 ticerosrv1.ticero.com.domain > ticeropo1.ticero.com.1028:  102 q: A? www.nordparis.banquepopulaire.fr. 1/3/2 www.nordparis.banquepopulaire.fr.[|domain] (DF) (ttl 64, id 0, len 190)
10:38:02.230095 ticeropo1.ticero.com.3174 > 194.51.109.131.http: S [tcp sum ok] 300623794:300623794(0) win 65535 <mss 1460,nop,nop,sackOK> (DF) (ttl 128, id 22024, len 48)
10:38:02.354337 194.51.109.131.http > ticeropo1.ticero.com.3174: S [tcp sum ok] 3797335509:3797335509(0) ack 300623795 win 65535 <mss 1460,nop,nop,sackOK> (DF) (ttl 117, id 3596, len 48)

10:38:02.354548 ticeropo1.ticero.com.3174 > 194.51.109.131.http: . [tcp sum ok] 1:1(0) ack 1 win 65535 (DF) (ttl 128, id 22026, len 40)
10:38:02.357818 ticeropo1.ticero.com.3174 > 194.51.109.131.http: P 1:226(225) ack 1 win 65535 (DF) (ttl 128, id 22027, len 265)
10:38:05.353416 ticeropo1.ticero.com.3174 > 194.51.109.131.http: P 1:226(225) ack 1 win 65535 (DF) (ttl 128, id 22029, len 265)

10:38:05.521736 194.51.109.131.http > ticeropo1.ticero.com.3174: . [tcp sum ok] 2921:2921(0) ack 226 win 65310 (DF) (ttl 117, id 3698, len 40)

It's seems to be 3 packets for one call id=22026, 22027 and 22029.
1. Is it a framented packet ?
2. Is it possible that this site refuse fragmented packet ?
3. We have 22026, 22027 and 22029 where is 22028 ?
4. what means the 'P' after http: ?

The same dialog viewed from ppp0 :

Code:

10:38:02.062347 217.128.230.16.32871 > 193.176.144.6.domain:  57209 [1au] A? www.nordparis.banquepopulaire.fr. ar: . (61) (DF) (ttl 64, id 0, len 89)

10:38:02.146333 193.176.144.6.domain > 217.128.230.16.32871:  57209-% q: A? www.nordparis.banquepopulaire.fr. 0/3/2 ns: banquepopulaire.fr.[|domain] (ttl 49, id 11372, len 169)
10:38:02.146605 217.128.230.16.32871 > 194.2.0.2.domain:  53037 [1au] A? www.nordparis.banquepopulaire.fr. ar: . (61) (DF) (ttl 64, id 0, len 89)
10:38:02.226317 194.2.0.2.domain > 217.128.230.16.32871:  53037*-% q: A? www.nordparis.banquepopulaire.fr. 1/3/4 www.nordparis.banquepopulaire.fr.[|domain] (DF) (ttl 59, id 0, len 217)

10:38:02.230129 217.128.230.16.3174 > 194.51.109.131.http: S [tcp sum ok] 300623794:300623794(0) win 65535 <mss 1460,nop,nop,sackOK> (DF) (ttl 127, id 22024, len 48)

10:38:02.230623 217.128.230.16.32871 > 192.93.0.4.domain:  61426 [1au] PTR? 131.109.51.194.in-addr.arpa. ar: . (56) (DF) (ttl 64, id 0, len 84)
10:38:02.306303 192.93.0.4.domain > 217.128.230.16.32871:  61426- q: PTR? 131.109.51.194.in-addr.arpa. 0/5/1 ns: 51.194.in-addr.arpa.[|domain] (ttl 20, id 32408, len 203)
10:38:02.306565 217.128.230.16.32871 > 194.52.1.10.domain:  30713 [1au] PTR? 131.109.51.194.in-addr.arpa. ar: . (56) (DF) (ttl 64, id 0, len 84)

10:38:02.354302 194.51.109.131.http > 217.128.230.16.3174: S [tcp sum ok] 3797335509:3797335509(0) ack 300623795 win 65535 <mss 1460,nop,nop,sackOK> (DF) (ttl 118, id 3596, len 48)
10:38:02.354559 217.128.230.16.3174 > 194.51.109.131.http: . [tcp sum ok] 1:1(0) ack 1 win 65535 (DF) (ttl 127, id 22026, len 40)
10:38:02.357828 217.128.230.16.3174 > 194.51.109.131.http: P 1:226(225) ack 1 win 65535 (DF) (ttl 127, id 22027, len 265)

10:38:02.402279 194.52.1.10.domain > 217.128.230.16.32871:  30713 q: PTR? 131.109.51.194.in-addr.arpa. 0/2/3 ns: 109.51.194.in-addr.arpa.[|domain] (DF) (ttl 243, id 16067, len 161)
10:38:02.402568 217.128.230.16.32871 > 194.51.3.65.domain:  2727 [1au] PTR? 131.109.51.194.in-addr.arpa. ar: . (56) (DF) (ttl 64, id 0, len 84)
10:38:02.466270 194.51.3.65.domain > 217.128.230.16.32871:  2727 NXDomain*- q: PTR? 131.109.51.194.in-addr.arpa. 1/1/1 131.109.51.194.in-addr.arpa.[|domain] (DF) (ttl 248, id 54521, len 173)
10:38:02.466558 217.128.230.16.32871 > 194.51.3.49.domain:  36495 [1au][|domain] (DF) (ttl 64, id 0, len 92)
10:38:02.530261 194.51.3.49.domain > 217.128.230.16.32871:  36495- q:[|domain] (ttl 58, id 10281, len 181)
10:38:02.530642 217.128.230.16.32871 > 194.51.3.65.domain:  58871 [1au][|domain] (DF) (ttl 64, id 0, len 92)
10:38:02.530729 217.128.230.16.32871 > 192.93.0.1.domain: [udp sum ok]  64016 [1au] A? ceprox01.cerius.fr. ar: . OPT UDPsize=2048 (47) (DF) (ttl 64, id 0, len 75)
10:38:02.594253 194.51.3.65.domain > 217.128.230.16.32871:  58871 NXDomain*- q:[|domain] (DF) (ttl 248, id 54522, len 155)
10:38:02.594281 192.93.0.1.domain > 217.128.230.16.32871:  64016-% q: A? ceprox01.cerius.fr. 1/2/3 ceprox01.cerius.fr. A 194.51.109.157[|domain] (ttl 20, id 61307, len 162)

10:38:05.353444 217.128.230.16.3174 > 194.51.109.131.http: P 1:226(225) ack 1 win 65535 (DF) (ttl 127, id 22029, len 265)
10:38:05.521714 194.51.109.131.http > 217.128.230.16.3174: . [tcp sum ok] 2921:2921(0) ack 226 win 65310 (DF) (ttl 118, id 3698, len 40)

3. Why is there so much DNS request ? I understand the first one but why the others ?

jmcollin92 · 01-06-2004, 04:50 PM

Here is a dialog which is OK directly from the server. This was obtained with :

Code:

telnet www.nordparis.banquepopulaire.fr 80
GET /

The dialog from ppp0 :

Code:

# tcpdump -vvv -i ppp0 port not ssh and port not pop3
tcpdump: listening on ppp0
23:38:17.740814 217.128.230.16.45532 > 194.51.109.131.http: S [tcp sum ok] 124488079:124488079(0) win 5808 <mss 1452,sackOK,timestamp 148389463 0,nop,wscale 0> (DF) [tos 0x10]  (ttl 64, id 47064, len 60)
23:38:17.833348 194.51.109.131.http > 217.128.230.16.45532: S [tcp sum ok] 2077187607:2077187607(0) ack 124488080 win 65535 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0,nop,nop,sackOK> (DF) (ttl 118, id 63086, len 64)
23:38:17.833371 217.128.230.16.45532 > 194.51.109.131.http: . [tcp sum ok] 1:1(0) ack 1 win 5808 <nop,nop,timestamp 148389472 0> (DF) [tos 0x10]  (ttl 64, id 47065, len 52)
23:38:21.384845 217.128.230.16.45532 > 194.51.109.131.http: P [tcp sum ok] 1:8(7) ack 1 win 5808 <nop,nop,timestamp 148389827 0> (DF) [tos 0x10]  (ttl 64, id 47066, len 59)
23:38:21.672681 194.51.109.131.http > 217.128.230.16.45532: . 1:1441(1440) ack 8 win 65528 <nop,nop,timestamp 390492 148389827> (DF) (ttl 118, id 63146, len 1492)
23:38:21.672709 217.128.230.16.45532 > 194.51.109.131.http: . [tcp sum ok] 8:8(0) ack 1441 win 8640 <nop,nop,timestamp 148389856 390492> (DF) [tos 0x10] (ttl 64, id 47067, len 52)
23:38:21.688696 194.51.109.131.http > 217.128.230.16.45532: . 1441:2881(1440) ack 8 win 65528 <nop,nop,timestamp 390492 148389827> (DF) (ttl 118, id 63147, len 1492)

In bold you've some differences with a nok dialog.

Can this help ?

yuray · 01-08-2004, 01:56 AM

Quote:

Originally posted by jmcollin92
It's not a pb because Error is > than Info and so messages are in both files.

It's a response packet no ?. Is it possible to see what is in the packet ? Perhaps there is an error or something like in this packet.

Save traffic to file
tcpdump -s 0 -w /file_name -i ppp0

Next step, gui ethereal.

yuray · 01-08-2004, 02:09 AM

Quote:

Originally posted by jmcollin92
[B]Here is another dialog with this site :
(from eth0) :
2921:2921(0) ack 226 win 65310 (DF) (ttl 117, id 3698, len 40)
[/CODE]

It's seems to be 3 packets for one call id=22026, 22027 and 22029.
1. Is it a framented packet ?

If I not wrong (DF) -disable fragmentation

Quote:

4. what means the 'P' after http: ?

P -push flag -- sent urgent data

Quote:

3. Why is there so much DNS request ? I understand the first one but why the others ?

It is tcpdump make resolving for output. Add flag -n

jmcollin92 · 01-08-2004, 03:25 AM

Quote:

Originally posted by yuray
Save traffic to file
tcpdump -s 0 -w /file_name -i ppp0

Next step, gui ethereal.

Ok, I've got the file. What should I do with that ?

yuray · 01-08-2004, 03:47 AM

Quote:

Originally posted by jmcollin92
Here is a dialog which is OK directly from the server. This was obtained with :

Code:

telnet www.nordparis.banquepopulaire.fr 80 GET /

In bold you've some differences with a nok dialog.

Can this help ?

Try to send
GET / HTTP/1.1

yuray · 01-08-2004, 03:48 AM

Quote:

Originally posted by jmcollin92
Ok, I've got the file. What should I do with that ?

You need the program ethereal
This is GUI for showing file contents.

jmcollin92 · 01-08-2004, 06:04 AM

Quote:

Originally posted by yuray
You need the program ethereal
This is GUI for showing file contents.

Is this a X window application or command line ?. Because I cannot export display on other X server.
If it is an X application, is there another way to inspect the packets ?