Last time we set up a Perl script that would use the Net::Pcap module to sniff the network and print information about DNS requests to standard output. The output looks like this
sourceipaddr -> destipaddr: dnshostname
Sniffing with Net::Cap to stealthily managing iptables rules remotely, Part 1
In our saga that began several weeks ago, we’re trying to create a firewall setup that allows no inbound access by default that can be modified remotely to allow a small window of inbound SSH connectivity. Remember that this machine must have no inbound TCP ports accessible to pass muster with the Windows-biased IT administrators, yet we want to allow inbound SSH dynamically when needed.[1]
Understanding IPTABLES
Disclaimer
Packet filtering is something I’ve always hard a hard time getting my head around. Not the basics; that’s easy
enough. It’s just the incredible level of detail, the difficulty of keeping it all in your head at once.
And then, of course, there are all the different flavors: ipfw, ipfilters, ipchains, and now iptables. It gets more
than a little confusing, and I’ve never taken the time for more than a cursory look at any of them.