andy’s blog

here is the scenario: i got LDAP host located on an isp in the private network, i got one of my application server (i call it nakula) located on the same ISP and luckily designed to have private ip and public ip. so this one will not have a problem talking to LDAP server. but my other application server (and let’s call this one sadewa) is located on the other side of the world somewhere. these applications heavily dependant on directory entries kept in that LDAP server. nakula has 2 network interface, one is for serving it’s application to public therefore assigned public ip, and the other one is for talking to LDAP server, so private ip assigned to it. the problem is on sadewa, it has no physical connection to my LDAP server.

Bookmark to:

i got pretty tight iptables rules set, and all un desired packets are logged through ulog. below is one liner command(s) to check who ‘attacked’ (not exactly attack, there were all un wanted packets actually) me today:

for i in `grep “PROTO=UDP” /var/log/ulog/syslogemu.log | sed “s/^.*SRC=//g” | sed “s/DST=.*$//g” | sort | uniq` ; do echo `grep $i /var/log/ulog/syslogemu.log | wc -l ` ” ” $i >> attacker.txt ; done ; sort -r -n -k 1 attacker.txt > tmp ; mv tmp attacker.txt

Bookmark to: