T
T
TODO•SEC
Search…
Linux Basic Networking
Linux 'Piping'
Check which applications listen on which ports and filter with grep
1
netstat -tulpn | grep <tcp port number>
Copied!
Check if port 8080 is open
1
netstat -tap | grep 8080
Copied!
Traceroute to specific TCP port - <"traceroute" + -p (port) + "TCP port number" + target host, dotted decimal>
1
sudo traceroute -p 9100 192.168.18.250
Copied!
Allow blocked traffic on Linux Firewall (iptables)
1
sudo vi /etc/sysconfig/iptables.cust
Copied!
Add the allowed subnet
1
sudo /usr/remote/odutils/stop-maintenance.sh
Copied!
Check Printer
1
ping XX.XX.XX.XX
2
telnet XX.XX.XX.XX 9100/515
3
lpstat –s | grep XX.XX.XX.XX
Copied!
tcpdump UAP RSF - [ Hint: An anagram for the TCP flags: Unskilled Attackers Pester Real Security Folk ]
Show me all URGENT (URG) packets...
1
tcpdump 'tcp[13] & 32 != 0'
Copied!
Show me all ACKNOWLEDGE (ACK) packets...
1
tcpdump 'tcp[13] & 16 != 0'
Copied!
Show me all PUSH (PSH) packets...
tcpdump 'tcp[13] & 8 != 0'
Show me all RESET (RST) packets...
1
tcpdump 'tcp[13] & 4 != 0'
Copied!
Show me all SYNCHRONIZE (SYN) packets...
1
tcpdump 'tcp[13] & 2 != 0'
Copied!
Show me all FINISH (FIN) packets...
1
tcpdump 'tcp[13] & 1 != 0'
Copied!
Show me all SYNCHRONIZE/ACKNOWLEDGE (SYNACK) packets...
1
tcpdump 'tcp[13] = 18'
Copied!
Note: Only the PSH, RST, SYN, and FIN flags are displayed in tcpdump's flag field output. URGs and ACKs are displayed, but they are shown elsewhere in the output rather than in the flags field
Temporary routes Add, why temporary? Upon server reboot, routing table should be re-built
1
sudo ip route add 192.0.0.0/8 via 192.168.1.254
2
sudo /sbin/route add –net X.X.X.X netmask 255.X.X.X gw Y.Y.Y.Y
Copied!
sudo /sbin/route add -net 192.168.100.0 netmask 255.255.255.0 gw 10.0.156.129 && sudo /sbin/route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.1.254
Temporary routes Delete
1
sudo /sbin/route del –net X.X.X.X netmask 255.X.X.X gw Y.Y.Y.Y
Copied!
Permanent Route editing with VI
1
sudo vi /etc/sysconfig/network-scripts/route-eth0
2
3
#Press (i)nsert
4
#Example route below <network id + '/' + cidr + 'via' + gateway ipv4 address>
5
6
10.0.0.0/8 via 192.168.1.254
7
192.0.0.0/8 via 192.168.1.254
8
9
#Press (esc)ape
10
#Save (wq!)
Copied!
Restart network process
1
sudo /sbin/service network restart
Copied!
Show routing table & open interface Route-Eth0 routes file
1
netstat -rn && sudo vi /etc/sysconfig/network-scripts/route-eth1
Copied!
Specific to RHEL7
1
Restart network service using SYSTEMCTL; PING to host on defined subnet using range {1...(1+n)}
2
3
sudo systemctl restart network && netstat -rn && sudo tcpdump host 100.65.150.111 && for i in {1..254}; do ping -c 5 192.168.1.$i | grep '1'; done
Copied!
Specific to RHEL6
1
Restart network service using /sbin/service network + show routing table + PING host(s) within subnet - TESTING
2
3
sudo /sbin/service network restart && netstat -rn && for i in {1..254}; do ping -c 1 192.168.1.$i | grep '1'; done && sudo tcpdump host 192.168.1 -nvv
4
5
Testing - PING host(s) within subnet
6
7
for i in {1..254}; do ping -c 1 192.17.254.$i | grep '1'; done
Copied!
Ping sweep and output only live hosts
1
for i in {1..255}; do ping -c 1 192.168.1.$i | grep "64 bytes from" | cut -d " " -f 4 | sed 's/.$//'; done
Copied!
My Traceroute, -r for outputing the results on the terminal;
1
sudo mtr -r -c 5 100.65.150.160 --no-dns | grep "." | cut -d " " -f 4
Copied!
My traceroute and PING test
1
sudo mtr -r -c 5 192.168.1.1 && sudo mtr -r -c 5 192.168.1.18 && for i in {1..254}; do ping -c 5 192.168.1.$i | grep '1'; done
Copied!
For loop with mtr - For i in range 160-190 runs a mytraceroute to specified #X.X.X.$i IP address (no DNS resolution flag); greps prints the lines that #contain a "." (such as #ones with dotted decimal IP addresses); cut -d uses #space as delimiter ; done completes the loop. Useful for checking routing path in a whole subnet
1
for i in {160..190}; do sudo mtr -r -c 5 100.65.150.$i --no-dns | grep "." | cut -d " " -f 4; done
Copied!
Last modified 8d ago
Copy link