user3018558's questions

I'm trying to write a simple network discovery for my linux 2.6 router.

I'm testing arping which is bult inot busybox. I can't work out why sending a single request to the direct broadcast is not enough.

root@router:# arping -h
BusyBox v1.32.1 (2021-03-26 15:21:46 CET) multi-call binary.

Usage: arping [-fqbDUA] [-c CNT] [-w TIMEOUT] [-I IFACE] [-s SRC_IP] DST_IP

Send ARP requests/replies

        -f              Quit on first ARP reply
        -q              Quiet
        -b              Keep broadcasting, don't go unicast
        -D              Exit with 1 if DST_IP replies
        -U              Unsolicited ARP mode, update your neighbors
        -A              ARP answer mode, update your neighbors
        -c N            Stop after sending N ARP requests
        -w TIMEOUT      Seconds to wait for ARP reply
        -I IFACE        Interface to use (default eth0)
        -s SRC_IP       Sender IP address
        DST_IP          Target IP address

So at this point I try:

root@router:# arping -c1 -w1 -I br1 -s 10.10.11.5 10.10.11.255
ARPING 10.10.11.255 from 10.10.11.5 br1
Sent 1 probe(s) (0 broadcast(s))
Received 0 response(s) (0 request(s), 0 broadcast(s))

What am I missing here? I would expect all the devices within the LAN to answer the arp request but it doens't seems to happen. The only alternative I'm left is to send one arping per possible IP but this is extremely memory consuming considering the small device.

So in a nutshell: how can I make a single arping command to request a full subnet to respond so that my arp table can be considered a reliable source of info when it comes to network mapping?

Thanks!

For the sake of storage limitation I was wondering if the webpages stored in my open source router firmware could be individually compressed to reduce demand on flash. So index.html would be stored as index.html.gz or something.

I guess this would means having the httpd process decompressing on-the-fly as it's requested by the browser right?

I read up on mod_deflate but (unless I'm reading this wrong) it does compress on-the-go uncompressed source files. My question instead revolves about reducing source pages storage size so I guess it wouldn't help my situation.

Can anybody shed some light on whether this is possible?

Thanks

I'm writing a script to extract information from BusyBox v1.25.1/Linux 2.6.36/router where the user can simply run the script and copy/paste the output into a submission form to request support. The script it's essentially a list of commands like route, ifconfig, etc. Because of the busybox implication I'm restricted to /bin/sh.

I'm trying to find a smart way to automatically mask all the public IP addresses only from the output. Replace the full IP would be already good but if it's possible I would be looking for a command to pipe at the end of each command (even an internal function) to simply replace let's say the first two octects e.g. 80.80.80.80 with XX.XX.80.80

A nice to have feature would be to replace the same number of digits to retain formatting where possible. e.g.

8.8.8.8=X.X.X.X 80.80.8.8=XX.XX.X.X 180.180.80.8=XXX.XXX.XX.X

practical example:

root@router:/proc# route | filtering-goes-here Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface XX.XX.168.1 * 255.255.255.255 UH 0 0 0 vlan2 172.16.9.0 * 255.255.255.0 U 0 0 0 br1 10.10.9.0 * 255.255.255.0 U 0 0 0 br0 10.114.126.0 * 255.255.254.0 U 0 0 0 tun11 XX.XX.168.0 * 255.255.252.0 U 0 0 0 vlan2 10.10.0.0 * 255.255.0.0 U 0 0 0 tinc 127.0.0.0 * 255.0.0.0 U 0 0 0 lo default cpc86269 0.0.0.0 UG 0 0 0 vlan2

Thanks!!

I have some information stored in an external file.

On the main script I'm parsing the secondary file to work out how information should be processed.

To do so I have tried this:

cat ./secondary.file
file:block.txt @"^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.)" | awk '{print $1"/"$3}'

which essentially defines where to get data and what to do to obtain the correct output. The idea being every line will have a new file:filename reference and a way to obtain a consistent output from each file.

So on the main file I can do this:

source=`cat ./secondary.file | grep -Ev "^#|^$" | tr -d "\r" | cut -d@ -f2`

which gives me "the method":

"^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.)" | awk '{print $1"/"$3}'

I'm now trying to add this in a pipe of commands on the main script

... | grep -E $regex

which I was hoping would translate into something along the lines:

... | grep -E "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.)" | awk '{print $1"/"$3}'

but it fails complaining about grep not being a command and same for awk. I've tried to store full commands in the secondary-file like this

file:block.txt @grep -E "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.)" | awk '{print $1"/"$3}'

but and call it on the primary file like this:

source=`cat ./secondary.file | grep -Ev "^#|^$" | tr -d "\r" | cut -d@ -f2`
echo $source
  grep -E "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.)" | awk '{print $1"/"$3}'



... | $source | ...

but again no luck. Running out of ideas...

What I'm trying to do is to forward all the emails that are stored (moved) into a specific user folder to a predefined email address

e.g.

Any new email stored in /home/mycooluser/mail/spam-mail to be forwarded [email protected].

I'm trying to achieve this with some procmail config the issue is that messages needs to be zipped up and sent as an attachment.

Can anybody shed some light on how I could achieve this?

I have set up a VPN to a private service provider via OpenVPN.
This setup is using the VPN as default gateway.
It all works fine but when I try to apply some basic iptables rules to filter traffic in and out the tunnel, I don't seem to be able to affect the inbound traffic. Outbound filtering appears to work fine though.

I suppose my iptables rules refer to tun12 which for output can be filtered happily but inbound I would only see the UDP traffic on port 1194 as it's still encrypted. I'm working with the FORWARD table at the moment.

How do I go applying iptables filtering inbound?

root@router# iptables -nvL FORWARD
Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DOTHIS-IN  all  --  tun12  *       0.0.0.0/0            0.0.0.0/0            state NEW
11323  780K DOTHIS-OUT all  --  *      tun12   0.0.0.0/0            0.0.0.0/0            state NEW

NOTE: this is happening only when I match status NEW. If I remove the match the iptables work fine.

root@router# iptables -nvL FORWARD
Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DOTHIS-IN  all  --  tun12  *       0.0.0.0/0            0.0.0.0/0            state NEW
6154K 8071M DOTHIS-IN  all  --  tun12  *       0.0.0.0/0            0.0.0.0/0

NOTE2: the tunnel is nat enabled

Thanks!

I have logging enabled on specific iptables packet drops. The rules I'm using are IP/port related only and this is what I can easily see in the logs, however occasionally I do get MAC address information logged as well. Like:

"....OUT=eth1 IN= MAC=00:26:a9:7b:c9:30:00:17:0f:ac:6a:80:08:00"...

These mac-addresses related logs are sporadic.

What I have noticed:

• these dropped/mac-logged communication are always inbound
• the source mac-address logged is the one of my default-gateway (Service Provider), although the source IPs are different.
• the destination mac (obvious but just to confirm) is the one of my interface

What I'm trying to understand:

• what is the iptables logic when deciding to capture in the logs "MAC addresses + IP/port" instead of "IP/port" only.

I'm trying to work out what is the iptables behaviour when you have multiple custom chains and you sue a mix between -goto and -jump

Example:

INPUT
iptables -A INPUT -i eth1 -j CUSTOM-A

CUSTOM-A
few commands here...
iptables -A CUSTOM-A -i eth1 -p tcp -dport 80 -g CUSTOM-B
few optional commands here...
iptables -A CUSTOM-A -i eth1 -s 0/0 -g CUSTOM-B

CUSTOM-B
iptables -A CUSTOM-B few commands here... -j CUSTOM-C
iptables -A CUSTOM-B few commands here... -j CUSTOM-C
iptables -A CUSTOM-B few commands here... -j CUSTOM-C
iptables -A CUSTOM-B -i eth1 -s 0/0 -j RETURN

CUSTOM-C
iptables -A CUSTOM-C -s 0/0 -j LOG
iptables -A CUSTOM-C -s 0/0 -j DROP

With the above scenario packets matched on CUSTOM-A tcp/80 will go to CUSTOM-B and if they reach the bottom of the table they would RETURN. Is the RETURN actually returning the packet to INPUT since the packet got there via a goto?