frr's questions

T-shark is a powerful command-line sibling of Wireshark, the packet capture tool.

At the basic verbosity level, you get one text row per packet, with just some basic information. Example:

tshark -n -i eth1

This yields:

1 0.000000000 ec:46:70:00:fc:ad → 01:1b:19:00:00:00 PTPv2 124 Announce Message
2 0.364764469 00:60:e9:2e:bd:f8 → 01:80:c2:00:00:0e PTPv2 68 Path_Delay_Req Message
3 0.364796580 00:0b:ab:45:b4:d0 → 01:80:c2:00:00:0e PTPv2 68 Path_Delay_Resp Message
4 0.364830284 00:0b:ab:45:b4:d0 → 01:80:c2:00:00:0e PTPv2 68 Path_Delay_Resp_Follow_Up Message
5 0.704678057 00:0b:ab:45:b4:d0 → 01:80:c2:00:00:0e PTPv2 68 Path_Delay_Req Message
6 0.720285509 00:60:e9:2e:bd:f8 → 01:80:c2:00:00:0e PTPv2 68 Path_Delay_Resp Message
7 0.729102466 00:60:e9:2e:bd:f8 → 01:80:c2:00:00:0e PTPv2 68 Path_Delay_Resp_Follow_Up Message
8 0.757962110 ec:46:70:00:fc:ad → 01:1b:19:00:00:00 PTPv2 60 Sync Message
9 0.767993002 ec:46:70:00:fc:ad → 01:1b:19:00:00:00 PTPv2 60 Follow_Up Message
10 1.000119946 ec:46:70:00:fc:ad → 01:1b:19:00:00:00 PTPv2 124 Announce Message

If you call tshark with the -V argument, it gets verbose = dissects the contents of the packets. E.g. for PTP, I get maybe two pages of dissected listing per packet. A short snippet for example:

Precision Time Protocol (IEEE1588)
    0000 .... = transportSpecific: 0x0
        ...0 .... = 802.1as conform: False
    .... 1011 = messageId: Announce Message (0xb)
    .... 0010 = versionPTP: 2
    messageLength: 110
    subdomainNumber: 0
    flags: 0x003c
        0... .... .... .... = PTP_SECURITY: False
        .0.. .... .... .... = PTP profile Specific 2: False
        ..0. .... .... .... = PTP profile Specific 1: False
        .... .0.. .... .... = PTP_UNICAST: False
        .... ..0. .... .... = PTP_TWO_STEP: False

...etc. The verbose dump really is a wallpaper.

You can also select individual fields to print, using the -T and -e arguments. Example:

tshark -i eth1 -T fields -e ptp.v2.messageid -e ptp.v2.sequenceid -e ptp.v2.correction.ns

This can yield:

2       2087    0
3       2087    0
10      2087    0
0       14206   13255
8       14206   0

Note that the messageId field, the first column above, is printed numeric (and decimal). Note that this particular field encodes "message type". E.g., 0xB encodes the Announce Message. Wireshark/T-shark know how to interpret it, and give you a textual description in the expanded Verbose output. Also, in the default compact output (one row per packet), you get that messageId interpreted too. The GUI-flavoured Wireshark has a column in the grid, called Info, which contains this textual interpretation of the message type.

Just... how do I ask for this textual interpretation of the ptp.v2.messageid, when using a custom "fields" output using -T and -e ? Either the interpretation corresponding to the ptp.v2.messageid field specifically, or the derived "Info" field. Is there any way?

I'm using my specific examples, but the question is possibly broader = how to ask tshark for a textual interpretation of a specific field using -T / -e.

Dear fellow system tinkerers,

an admin friend has asked me the following question:

On a number of network elements and servers, he's using remote authentication against a TACACS+ server. On some such proprietary appliances, the authentication only asks a local auth DB if the remote method returns "auth server unavailable" (unreachable, timed out). If the remote auth server is available, and returns a negative response, the box in question takes that at face value and does not try to auth against a local user database.

Now... on a Linux-based box, he would like to achieve the same behavior. And he cannot seem to be able to. The Linux OS first tries the remote auth, but upon a clear negative response (server responds "authentication failure, those are not valid credentials") it goes ahead and just tries the local database too.

I've come to understand that the remote TACACS+ auth is arranged by a nice PAM module called pam_tacplus. Reading about PAM in general, it seems to dawn on me that pam_tacplus is not to blame. Rather, the observed behavior is just the way PAM as a whole works. If that's the case, a direct solution would probably have to involve adding a configurable global option to the PAM codebase, and maybe specific PAM config-file keywords/syntax, to modify the behavior in the desired direction.

Any further notes on this topic are welcome :-)

Dear polite people in this forum,

I've recently migrated to a new mailserver. As the hardware "age gap" was too large, it would be difficult to simply upgrade from Debian Squeeze to Jessie at the same time (and it would possibly not solve my problem either). So I just installed a clean Jessie and moved the user accounts, old e-mail etc. by hand. Well at least I know more about the internals.

The one thing that I seem to be struggling with is the bayesian database operated by Spamassassin - as enslaved by amavisd-new. (Heh already got to know when I wanted to get the SPAM score headers included in every e-mail message: the $sa_tag_level_deflt lives in an amavis config file.)

I do have

use_bayes 1
bayes_path /var/lib/spamassassin/.spamassassin/bayes

in spamassassin/local.cf . I find it curious that the path ends with "bayes", but this last string is not an actual directory, it seems to be a mere prefix for the _toks and _seen files.

If I try "spamassassin -D --lint 2>&1 | less" I can see some praise:

Jul  9 11:21:15.091 [5076] dbg: bayes: tie-ing to DB file R/O /var/lib/spamassassin/.spamassassin/bayes_toks
Jul  9 11:21:15.091 [5076] dbg: bayes: tie-ing to DB file R/O /var/lib/spamassassin/.spamassassin/bayes_seen

Possibly depending on directory where I run it, I have once seen BAYES_20 in that listing as well.

Also sa-learn-cyrus seems to be updating the database just fine, and sa-sync doesn't complain either.

I've actually migrated the bayes DB files from the old server, using

sa-learn --backup 
sa-learn --restore=...

and I had to adjust some permissions afterwards of memory serves... sa-learn-cyrus.conf contains the user and group under which it should run, which should match the ownership of the database.

Now for the curious bit:

I cannot see any traces of the bayes filter actually working on the e-mail passing through. Amavis does work, I can see its actions in /var/log/amavis.log, sometimes it catches a SPAM based on its other heuristic rules. But I haven't managed to catch a BAYES score in the received e-mails (which now do contain the expected X-Spam-Status header) nor in the highly positive stuff quarantined in /var/virusmails.

In other words, if I run "grep -ri bayes *" in /var/log/ and /var/virusmails/, I get exactly nothing :-(

Is it possible that the bayesian filter is working and I just don't know?

If the bayes filter does not actually work (in spamassassin under amavisd-new), what other places should I look for relevant config?

If it may be working just fine, is there a way to increase its verbosity? To have its score always printed in some log, or preferably, included in the X-Spam-Status header?

Also, is there a way for me to map the Bayes score to a Spamassassin score increment? I mean - to see and maybe configure how Amavis or SA adds the bayesian contribution...

I was also wondering if I'm missing something in the system, such as a package not installed. But "aptitude search bayes" only returns "spambayes", which is some python-based project, competing to the bayesian filter that's part of spamassassin...

Any ideas are welcome :-)

Frank