7:22 p.m.
Hi All,
Fc37
What is this all about (iptables)?
Feb 17 17:17:36 rn6 kernel: dsl-out Everything Else IN= OUT=eno2
SRC=192.168.250.10 DST=225.0.0.50 LEN=36 TOS=0x00 PREC=0x00 TTL=1
ID=30677 DF PROTO=UDP SPT=33445 DPT=3780 LEN=16
over and over
$ grep -i 3870 /etc/services
ovsam-d-agent 3870/tcp # hp OVSAM HostAgent Disco
ovsam-d-agent 3870/udp # hp OVSAM HostAgent Disco
Inquiring minds want to know!
Many thanks,
-T
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Having been erased,
The document you're seeking
Must now be retyped.
~~~~~~~~~~~~~~~~~~~~~~~~~~~
9:53 a.m.
On Fri, Feb 17, 2023 at 9:22 PM ToddAndMargo via users <
users(a)lists.fedoraproject.org> wrote:
Hi All,
Fc37
What is this all about (iptables)?
Feb 17 17:17:36 rn6 kernel: dsl-out Everything Else IN= OUT=eno2
SRC=192.168.250.10 DST=225.0.0.50 LEN=36 TOS=0x00 PREC=0x00 TTL=1
ID=30677 DF PROTO=UDP SPT=33445 DPT=3780 LEN=16
over and over
$ grep -i 3870 /etc/services
ovsam-d-agent 3870/tcp # hp OVSAM HostAgent Disco
ovsam-d-agent 3870/udp # hp OVSAM HostAgent Disco
Inquiring minds want to know!
https://en.wikipedia.org/wiki/HP_OpenView_Storage_Area_Manager
--
George N. White III
4:38 p.m.
On 2/18/23 07:53, George N. White III wrote:
On Fri, Feb 17, 2023 at 9:22 PM ToddAndMargo via users
<users(a)lists.fedoraproject.org <mailto:users@lists.fedoraproject.org>>
wrote:
Hi All,
Fc37
What is this all about (iptables)?
Feb 17 17:17:36 rn6 kernel: dsl-out Everything Else IN= OUT=eno2
SRC=192.168.250.10 DST=225.0.0.50 LEN=36 TOS=0x00 PREC=0x00 TTL=1
ID=30677 DF PROTO=UDP SPT=33445 DPT=3780 LEN=16
over and over
$ grep -i 3870 /etc/services
ovsam-d-agent 3870/tcp # hp OVSAM HostAgent Disco
ovsam-d-agent 3870/udp # hp OVSAM HostAgent Disco
Inquiring minds want to know!
https://en.wikipedia.org/wiki/HP_OpenView_Storage_Area_Manager
<https://en.wikipedia.org/wiki/HP_OpenView_Storage_Area_Manager>
--
George N. White III
I do not understand. I have no HP software
on my machine. As for storage, I do have Samba
running, but it does not use this port.
4:44 p.m.
On 2/17/23 17:22, ToddAndMargo via users wrote:
Hi All,
Fc37
What is this all about (iptables)?
Feb 17 17:17:36 rn6 kernel: dsl-out Everything Else IN= OUT=eno2
SRC=192.168.250.10 DST=225.0.0.50 LEN=36 TOS=0x00 PREC=0x00 TTL=1
ID=30677 DF PROTO=UDP SPT=33445 DPT=3780 LEN=16
over and over
$ grep -i 3870 /etc/services
ovsam-d-agent 3870/tcp # hp OVSAM HostAgent Disco
ovsam-d-agent 3870/udp # hp OVSAM HostAgent Disco
Inquiring minds want to know!
Many thanks,
-T
The destination address (225.0.0.50) does
not resolve on any of the web IP look up
tools.
I am starting to wonder if it is some
kind of local address to my system.
5:47 p.m.
On Sat, Feb 18, 2023, at 2:44 PM, ToddAndMargo via users wrote:
On 2/17/23 17:22, ToddAndMargo via users wrote:
> Hi All,
>
> Fc37
>
> What is this all about (iptables)?
>
> Feb 17 17:17:36 rn6 kernel: dsl-out Everything Else IN= OUT=eno2
> SRC=192.168.250.10 DST=225.0.0.50 LEN=36 TOS=0x00 PREC=0x00 TTL=1
> ID=30677 DF PROTO=UDP SPT=33445 DPT=3780 LEN=16
>
> over and over
>
> $ grep -i 3870 /etc/services
> ovsam-d-agent 3870/tcp # hp OVSAM HostAgent Disco
> ovsam-d-agent 3870/udp # hp OVSAM HostAgent Disco
>
> Inquiring minds want to know!
>
> Many thanks,
> -T
The destination address (225.0.0.50) does
not resolve on any of the web IP look up
tools.
I am starting to wonder if it is some
kind of local address to my system.
That is a multicast reserved ip:
RESERVED (225.0.0.0-231.255.255.255 (7 /8s))
Reference
[RFC5771]
5:49 p.m.
On 2/18/23 15:47, Doug Herr wrote:
On Sat, Feb 18, 2023, at 2:44 PM, ToddAndMargo via users wrote:
> On 2/17/23 17:22, ToddAndMargo via users wrote:
>> Hi All,
>>
>> Fc37
>>
>> What is this all about (iptables)?
>>
>> Feb 17 17:17:36 rn6 kernel: dsl-out Everything Else IN= OUT=eno2
>> SRC=192.168.250.10 DST=225.0.0.50 LEN=36 TOS=0x00 PREC=0x00 TTL=1
>> ID=30677 DF PROTO=UDP SPT=33445 DPT=3780 LEN=16
>>
>> over and over
>>
>> $ grep -i 3870 /etc/services
>> ovsam-d-agent 3870/tcp # hp OVSAM HostAgent Disco
>> ovsam-d-agent 3870/udp # hp OVSAM HostAgent Disco
>>
>> Inquiring minds want to know!
>>
>> Many thanks,
>> -T
>
>
> The destination address (225.0.0.50) does
> not resolve on any of the web IP look up
> tools.
>
> I am starting to wonder if it is some
> kind of local address to my system.
That is a multicast reserved ip:
RESERVED (225.0.0.0-231.255.255.255 (7 /8s))
Reference
[RFC5771]
Who would be trying to write to that?
6:22 p.m.
On Sat, 18 Feb 2023 15:49:16 -0800
ToddAndMargo via users wrote:
Who would be trying to write to that?
Try "sudo ss -l -p -n | fgrep 3780" that might tell you what
program is listening on port 3780 (if any) then you could use
rpm -q -i -f /program/name to see what the heck it is.
6:33 p.m.
On 2/18/23 16:22, Tom Horsley wrote:
On Sat, 18 Feb 2023 15:49:16 -0800
ToddAndMargo via users wrote:
> Who would be trying to write to that?
Try "sudo ss -l -p -n | fgrep 3780" that might tell you what
program is listening on port 3780 (if any) then you could use
rpm -q -i -f /program/name to see what the heck it is.
Love the tips!
$ ss -l -p -n | fgrep 3780
udp UNCONN 0 0
0.0.0.0:3780 0.0.0.0:*
Of course, I would have to remove the firewall
block to get anytime to show up. I will do that
in a few days, schedule permitting
Thank you!
6:54 p.m.
On Sat, 18 Feb 2023 16:36:54 -0800
ToddAndMargo via users wrote:
How do you get ss to tell you the program name?
That's what running as root and using the -p option is supposed to do.
On my system for instance, I see this:
sudo ss -l -p -n | fgrep 22
one of the lines that appears is:
tcp LISTEN 0 128 0.0.0.0:22
0.0.0.0:* users:(("sshd",pid=1344,fd=3))
Don't know what it means if no program appears.
7:05 p.m.
On 2/18/23 16:54, Tom Horsley wrote:
On Sat, 18 Feb 2023 16:36:54 -0800
ToddAndMargo via users wrote:
> How do you get ss to tell you the program name?
That's what running as root and using the -p option is supposed to do.
On my system for instance, I see this:
sudo ss -l -p -n | fgrep 22
one of the lines that appears is:
tcp LISTEN 0 128 0.0.0.0:22
0.0.0.0:* users:(("sshd",pid=1344,fd=3))
Don't know what it means if no program appears.
Opps, forgot to run it as root. See result way below.
It is "conntrackd". Am I even usig that with iptables?
Looks like not:
# dnf remove conntrack
Dependencies resolved.
================================================================================
Package Arch Version Repository
Size
================================================================================
Removing:
conntrack-tools x86_64 1.4.6-4.fc37 @fedora
670 k
Removing unused dependencies:
libnetfilter_cthelper x86_64 1.0.0-22.fc37 @fedora
43 k
libnetfilter_cttimeout x86_64 1.0.0-20.fc37 @fedora
43 k
libnetfilter_queue x86_64 1.0.5-3.fc37 @fedora
53 k
Transaction Summary
================================================================================
Remove 4 Packages
Freed space: 809 k
Is this ok [y/N]:
Do you thnk I cold get away with removing it?
$ su root -c "ss -l -p -n | fgrep 3780"
Password:
udp UNCONN 0 0
0.0.0.0:3780 0.0.0.0:* users:(("conntrackd",pid=5617,fd=6))
$ rpm -q -i -f $(which conntrackd)
Name : conntrack-tools
Version : 1.4.6
Release : 4.fc37
Architecture: x86_64
Install Date: Tue 13 Dec 2022 07:07:59 AM PST
Group : Unspecified
Size : 685579
License : GPLv2
Signature : RSA/SHA256, Wed 20 Jul 2022 05:20:15 PM PDT, Key ID
f55ad3fb5323552a
Source RPM : conntrack-tools-1.4.6-4.fc37.src.rpm
Build Date : Wed 20 Jul 2022 04:44:59 PM PDT
Build Host : buildvm-x86-29.iad2.fedoraproject.org
Packager : Fedora Project
Vendor : Fedora Project
URL : http://conntrack-tools.netfilter.org/
Bug URL : https://bugz.fedoraproject.org/conntrack-tools
Summary : Manipulate netfilter connection tracking table and run
High Availability
Description :
With conntrack-tools you can setup a High Availability cluster and
synchronize conntrack state between multiple firewalls.
The conntrack-tools package contains two programs:
- conntrack: the command line interface to interact with the connection
tracking system.
- conntrackd: the connection tracking userspace daemon that can be used to
deploy highly available GNU/Linux firewalls and collect
statistics of the firewall use.
conntrack is used to search, list, inspect and maintain the netfilter
connection tracking subsystem of the Linux kernel.
Using conntrack, you can dump a list of all (or a filtered selection of)
currently tracked connections, delete connections from the state table,
and even add new ones.
In addition, you can also monitor connection tracking events, e.g.
show an event message (one line) per newly established connection.
8:31 p.m.
On 2023-02-18 17:10, ToddAndMargo via users wrote:
On 2/18/23 16:59, Samuel Sieb wrote:
> lsof -i tcp:6556
Pretty!
# lsof -i udp:3780
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
conntrack 5617 root 6u IPv4 33770 0t0 UDP *:nnp
I am using iptables. Do you think I can just remove
conntrack?
Check the full command for that PID because I wouldn't expect the
firewall to have a process like that.
8:35 p.m.
On 2/18/23 18:31, Samuel Sieb wrote:
On 2023-02-18 17:10, ToddAndMargo via users wrote:
> On 2/18/23 16:59, Samuel Sieb wrote:
>> lsof -i tcp:6556
>
> Pretty!
>
> # lsof -i udp:3780
> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
> conntrack 5617 root 6u IPv4 33770 0t0 UDP *:nnp
>
>
> I am using iptables. Do you think I can just remove
> conntrack?
Check the full command for that PID because I wouldn't expect the
firewall to have a process like that.
$ ps ax | grep [5]617
5617 ? Ss 0:03 /usr/sbin/conntrackd -C
/etc/conntrackd/conntrackd.conf
I also looked at
# dnf remove conntrack
Dependencies resolved.
================================================================================
Package Arch Version Repository
Size
================================================================================
Removing:
conntrack-tools x86_64 1.4.6-4.fc37 @fedora
670 k
Removing unused dependencies:
libnetfilter_cthelper x86_64 1.0.0-22.fc37 @fedora
43 k
libnetfilter_cttimeout x86_64 1.0.0-20.fc37 @fedora
43 k
libnetfilter_queue x86_64 1.0.5-3.fc37 @fedora
53 k
Transaction Summary
================================================================================
Remove 4 Packages
No sign of iptables in that.
11:09 p.m.
On 2023-02-18 18:35, ToddAndMargo via users wrote:
On 2/18/23 18:31, Samuel Sieb wrote:
> On 2023-02-18 17:10, ToddAndMargo via users wrote:
>> On 2/18/23 16:59, Samuel Sieb wrote:
>>> lsof -i tcp:6556
>>
>> Pretty!
>>
>> # lsof -i udp:3780
>> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
>> conntrack 5617 root 6u IPv4 33770 0t0 UDP *:nnp
>>
>>
>> I am using iptables. Do you think I can just remove
>> conntrack?
>
> Check the full command for that PID because I wouldn't expect the
> firewall to have a process like that.
$ ps ax | grep [5]617
5617 ? Ss 0:03 /usr/sbin/conntrackd -C
/etc/conntrackd/conntrackd.conf
I also looked at
# dnf remove conntrack
Dependencies resolved.
================================================================================
Package Arch Version Repository
Size
================================================================================
Removing:
conntrack-tools x86_64 1.4.6-4.fc37 @fedora 670 k
Removing unused dependencies:
libnetfilter_cthelper x86_64 1.0.0-22.fc37 @fedora 43 k
libnetfilter_cttimeout x86_64 1.0.0-20.fc37 @fedora 43 k
libnetfilter_queue x86_64 1.0.5-3.fc37 @fedora 53 k
Transaction Summary
================================================================================
Remove 4 Packages
No sign of iptables in that.
It's a process primarily for managing and synchronizing the connection
state in a cluster. I don't know why you have it installed, it's not
default for workstation at least. Did you do a server install? You can
certainly delete it if you want.
6:22 p.m.
On 2/18/23 21:09, Samuel Sieb wrote:
On 2023-02-18 18:35, ToddAndMargo via users wrote:
> On 2/18/23 18:31, Samuel Sieb wrote:
>> On 2023-02-18 17:10, ToddAndMargo via users wrote:
>>> On 2/18/23 16:59, Samuel Sieb wrote:
>>>> lsof -i tcp:6556
>>>
>>> Pretty!
>>>
>>> # lsof -i udp:3780
>>> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
>>> conntrack 5617 root 6u IPv4 33770 0t0 UDP *:nnp
>>>
>>>
>>> I am using iptables. Do you think I can just remove
>>> conntrack?
>>
>> Check the full command for that PID because I wouldn't expect the
>> firewall to have a process like that.
>
> $ ps ax | grep [5]617
> 5617 ? Ss 0:03 /usr/sbin/conntrackd -C
> /etc/conntrackd/conntrackd.conf
>
> I also looked at
>
> # dnf remove conntrack
> Dependencies resolved.
> ================================================================================
> Package Arch Version
> Repository Size
> ================================================================================
> Removing:
> conntrack-tools x86_64 1.4.6-4.fc37 @fedora
> 670 k
> Removing unused dependencies:
> libnetfilter_cthelper x86_64 1.0.0-22.fc37 @fedora
> 43 k
> libnetfilter_cttimeout x86_64 1.0.0-20.fc37 @fedora
> 43 k
> libnetfilter_queue x86_64 1.0.5-3.fc37 @fedora
> 53 k
>
> Transaction Summary
> ================================================================================
> Remove 4 Packages
>
>
> No sign of iptables in that.
It's a process primarily for managing and synchronizing the connection
state in a cluster. I don't know why you have it installed, it's not
default for workstation at least.
Years and years ago, I installed from Xfce's Live USB.
A lot of weird stuff got installed when I upgraded
from fc36 to fc37. Netfilter for one, which did a job on
my iptables.
Did you do a server install?
No. I am a believer is doing a dead level
minimalist install and then adding what
services you need as they arise.
You can certainly delete it if you want.
Thank you for the confirmation Sam!
Oh and silly me! If I was worried about iptables
not working if I removed conntrack, all I had to do
was a simple test:
# systemctl stop conntrackd
And blessed silence in my log file. Test outgoing
ports I know are blocked with tcpping to verify
my firewall is still working. Then
# dnf remove conntrack
restart my firewall.
Happy camping has returned.
All these years I never knew how to trace down
what program was using what port in Linux.
I now have it written down!
Thank you all for the help!
-T
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
If I had a dime every time I didn't know
what was going on, I'd be like, "Why is
everyone giving me all these dimes?"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
12:42 a.m.
On Sun, 2023-02-19 at 16:22 -0800, ToddAndMargo via users wrote:
All these years I never knew how to trace down
what program was using what port in Linux.
I now have it written down!
netstat is another one,
netstat -antu
Will show what TCP (t) and UDP (u) ports are active (a) [open and
listening] by numerical (n) values only.
Remove the n, and they'll be shown by names (resolving the IP addresses
and showing the usual names for known port numbers).
Adding more options, like "netstat -antuevp" will show extra
information, such as which programs are using those ports.
--
uname -rsvp
Linux 3.10.0-1160.83.1.el7.x86_64 #1 SMP Wed Jan 25 16:41:43 UTC 2023 x86_64
Boilerplate: All unexpected mail to my mailbox is automatically deleted.
I will only get to see the messages that are posted to the mailing list.
441
days inactive
443
days old
17 comments
6 participants
participants (6)
-
Doug Herr -
George N. White III -
Samuel Sieb -
Tim -
ToddAndMargo -
Tom Horsley