HowTo Geolocate Active Connection Information - Revision history

Rwh at 12:51, 16 August 2011

2011-08-16T12:51:08Z

← Older revision		Revision as of 08:51, 16 August 2011
Line 1:		Line 1:
			__TOC__
	= Quick Start =		= Quick Start =

Paul Blankenbaker: /* Kernel 2.6.40 (3.0) Issues */

2011-08-16T11:48:03Z

Kernel 2.6.40 (3.0) Issues

← Older revision		Revision as of 07:48, 16 August 2011
Line 41:		Line 41:

	[root@dhcp150 ~]#		[root@dhcp150 ~]#

			Our future intention, to address this issue, is to update the NST WUI to detect this situation and provide a button for you to press allowing you to enable the ''nf_conntrack'' tables directly from your browser.

Paul Blankenbaker: /* Kernel 2.6.40 (3.0) Issues */

2011-08-16T11:46:14Z

Kernel 2.6.40 (3.0) Issues

← Older revision		Revision as of 07:46, 16 August 2011
Line 17:		Line 17:
	In any case, when they decided to disable the ''nf_conntrack'' tables by default in the new kernel. The means when you first bring up the NST Active Connections page, you will just see a empty table initially when monitoring the ''Local'' connections as shown in the image below.		In any case, when they decided to disable the ''nf_conntrack'' tables by default in the new kernel. The means when you first bring up the NST Active Connections page, you will just see a empty table initially when monitoring the ''Local'' connections as shown in the image below.

	[[File:Thunderbolt.png\|frame\|left\|'''[[Feature Release Symbol \| <center>NST 2.15.0<br /> SVN: 2515</center>]]''']] [[Image:active-connections-missing-module.png\|~~center\|frame~~\|Initial Active Connections With 2.6.40 Kernel]]		[[File:Thunderbolt.png\|frame\|left\|'''[[Feature Release Symbol \| <center>NST 2.15.0<br /> SVN: 2515</center>]]''']] [[Image:active-connections-missing-module.png\|560px\|Initial Active Connections With 2.6.40 Kernel]]

	To enable the updating of the ''nf_conntrack'' tables on your NST system, you need to run the following commands:		To enable the updating of the ''nf_conntrack'' tables on your NST system, you need to run the following commands:

Paul Blankenbaker: /* Screencasts */

2011-08-16T11:38:26Z

Screencasts

← Older revision		Revision as of 07:38, 16 August 2011
Line 10:		Line 10:

	{{#ev:youtube\|Uqk7iGYMvbE\|640\|360}}		{{#ev:youtube\|Uqk7iGYMvbE\|640\|360}}

			= Kernel 2.6.40 (3.0) Issues =

			The Fedora project made a decision to move to the new Linux 3.0 kernel after the initial release of Fedora 15. They renamed the kernel release from a 3.0 series to a 2.6.40 series (I'm guessing they were worried that some programs might look for the 2.6 in the kernel version and might fail if they found 3.0).

			In any case, when they decided to disable the ''nf_conntrack'' tables by default in the new kernel. The means when you first bring up the NST Active Connections page, you will just see a empty table initially when monitoring the ''Local'' connections as shown in the image below.

			[[File:Thunderbolt.png\|frame\|left\|'''[[Feature Release Symbol \| <center>NST 2.15.0<br /> SVN: 2515</center>]]''']] [[Image:active-connections-missing-module.png\|center\|frame\|Initial Active Connections With 2.6.40 Kernel]]

			To enable the updating of the ''nf_conntrack'' tables on your NST system, you need to run the following commands:

			[root@dhcp150 ~]# modprobe nf_conntrack_ipv4
			[root@dhcp150 ~]# sysctl net.netfilter.nf_conntrack_acct=1
			net.netfilter.nf_conntrack_acct = 1
			[root@dhcp150 ~]#

			If you also want to monitor IPv6 traffic (this will make the tables very wide), then run the following command:

			[root@dhcp150 ~]# modprobe nf_conntrack_ipv6
			[root@dhcp150 ~]#

			As a side note, you can run '''ssh''' to a IPv6 address on a NST system using the following syntax (this will let you verify that the IPv6 addresses are showing up in your Active Connections table):

			[pkb@rice ~]$ ssh -6 "root@fe80::a00:27ff:fe8f:118c%eth0"
			Last login: Tue Aug 16 11:30:00 2011 from fe80::224:1dff:fe19:4344%p2p1

			================================================
			= Linux Network Security Toolkit (NST v2.15.0) =
			================================================

			[root@dhcp150 ~]#

Paul Blankenbaker: /* Screen Casts */

2011-04-26T14:47:49Z

Screen Casts

← Older revision		Revision as of 10:47, 26 April 2011
Line 5:		Line 5:
	* Explore the controls and information displayed and try out ''Map'' mode (Hint: there are tool tips everywhere).		* Explore the controls and information displayed and try out ''Map'' mode (Hint: there are tool tips everywhere).

	= ~~Screen Casts~~ =		= Screencasts =

	The [http://www.youtube.com/watch?v=Uqk7iGYMvbE Active Connection Introduction] screencast provides a introduction and overview to the Active Connection page.		The [http://www.youtube.com/watch?v=Uqk7iGYMvbE Active Connection Introduction] screencast provides a introduction and overview to the Active Connection page.

	{{#ev:youtube\|Uqk7iGYMvbE\|640\|360}}		{{#ev:youtube\|Uqk7iGYMvbE\|640\|360}}

Paul Blankenbaker: /* Screen Casts */

2011-04-26T14:46:30Z

Screen Casts

← Older revision		Revision as of 10:46, 26 April 2011
Line 9:		Line 9:
	The [http://www.youtube.com/watch?v=Uqk7iGYMvbE Active Connection Introduction] screencast provides a introduction and overview to the Active Connection page.		The [http://www.youtube.com/watch?v=Uqk7iGYMvbE Active Connection Introduction] screencast provides a introduction and overview to the Active Connection page.

	{{#ev:youtube\|Uqk7iGYMvbE}}		{{#ev:youtube\|Uqk7iGYMvbE\|640\|360}}

Paul Blankenbaker: /* Screen Casts */

2011-04-26T14:35:34Z

Screen Casts

← Older revision		Revision as of 10:35, 26 April 2011
Line 9:		Line 9:
	The [http://www.youtube.com/watch?v=Uqk7iGYMvbE Active Connection Introduction] screencast provides a introduction and overview to the Active Connection page.		The [http://www.youtube.com/watch?v=Uqk7iGYMvbE Active Connection Introduction] screencast provides a introduction and overview to the Active Connection page.

	{{#ev:youtube\|Uqk7iGYMvbE~~\|640\|left\|Active Connections Introduction~~}}		{{#ev:youtube\|Uqk7iGYMvbE}}

Paul Blankenbaker: /* Screen Casts */

2011-04-26T14:32:27Z

Screen Casts

← Older revision		Revision as of 10:32, 26 April 2011
Line 1:		Line 1:
			= Quick Start =

			* Set up your NST system such that it can geolocate IP addresses (see: [[HowTo Setup The NST System To Geolocate Data]]).
			* From the NST WUI menu bar select the ''Network'' menu, then ''Monitors'' and finally ''Active Connections''.
			* Explore the controls and information displayed and try out ''Map'' mode (Hint: there are tool tips everywhere).

	= Screen Casts =		= Screen Casts =

Paul Blankenbaker: /* Screen Casts */

2011-04-26T14:26:09Z

Screen Casts

← Older revision		Revision as of 10:26, 26 April 2011
Line 2:		Line 2:

	The [http://www.youtube.com/watch?v=Uqk7iGYMvbE Active Connection Introduction] screencast provides a introduction and overview to the Active Connection page.		The [http://www.youtube.com/watch?v=Uqk7iGYMvbE Active Connection Introduction] screencast provides a introduction and overview to the Active Connection page.

			{{#ev:youtube\|Uqk7iGYMvbE\|640\|left\|Active Connections Introduction}}

Paul Blankenbaker at 14:14, 26 April 2011

2011-04-26T14:14:36Z

← Older revision		Revision as of 10:14, 26 April 2011
Line 1:		Line 1:
	~~<center>'''<span style~~=~~'color~~: ~~red; font-size: 200%;'>*Note: Page Under Construction*<~~/~~span>'''<~~/~~center>~~		= Screen Casts =

			The [http://www.youtube.com/watch?v=Uqk7iGYMvbE Active Connection Introduction] screencast provides a introduction and overview to the Active Connection page.