TP2010
Jump to navigation
Jump to search
Info
- Proxy: Squid
- Let op FD's (file descriptors)
- WCCP
- Squid in transparent mode, iptables redirect poort
- Shaping op cisco
Eerst definities: class-map match-all HTTP match protocol http class-map match-any HighPrio match packet length max 384 match protocol icmp
Dan Policy policy-map blaa class HTTP shape average 10000000
En dan toepassen interface fa0/0 service out blaa
[ INET ] | ______|_______ | Cisco 2811 | |______________| | _______|_______ | Cisco 3750 | |_______________| | | | | | | | | ____|__|__|__|_____ ___ _| |_ /_ /| | LAN |--------| | | <-- Squid |_ _| | | | |___________________| |__|/ | ___ |____________________|___| <-- Client /___/
Testconfig (v1)
class-map match-all HTTP match protocol http class-map match-all Prio class-map match-any SSH match protocol ssh class-map match-all High match class-map SSH class-map match-any HTTPS match access-group name HTTPS class-map match-any Normal match class-map HTTP match class-map HTTPS class-map match-any Prios match class-map Normal match class-map High class-map match-all Downstream match class-map Prios class-map match-all Web match class-map HTTP match class-map HTTPS class-map match-all Low ! ! policy-map Prio policy-map High class SSH policy-map Normal class HTTP police rate percent 70 violate-action drop class HTTPS policy-map Prios class Normal bandwidth percent 70 service-policy Normal class High bandwidth percent 30 service-policy High policy-map Downstream class Downstream shape average 1000000 service-policy Prios class class-default shape average 100000 policy-map Low ! interface FastEthernet0 ip address 192.168.38.249 255.255.255.0 ip broadcast-address 0.0.0.0 ip nat outside ip virtual-reassembly duplex auto speed auto ! interface Vlan1 ip address 10.9.0.1 255.255.255.0 ip broadcast-address 0.0.0.0 ip nat inside ip virtual-reassembly service-policy output Downstream ! ip route 0.0.0.0 0.0.0.0 192.168.38.1 ! ip access-list extended HTTP permit tcp any any eq www ip access-list extended HTTPS permit tcp any any eq 443 ip access-list extended Mail permit tcp any any eq pop3 permit tcp any any eq 143 permit tcp any any eq 993 permit tcp any any eq 995 permit tcp any any eq smtp !
testconfig (v5)
Wanneer verkeer is binnen gekomen heeft het geen nut meer om te shapen. De queue van de provider zit dan al vol. De clue zit hem dus in het upstream shapen (upload naar je ISP) zodat je de eigen queue kan beheren. (WAN-out-shape)
Downstream kunnen we wel policen om zo de TCP sessies te remmen. (WAN-in-police)
Services
ACL
Opmerkingen: FTP, ipsec, pptp en l2tp: op nbar laten staan?
BIJWERKEN
Gaming
WoW
TCP: 3724, 6112, 6881-6999 Game: TCP 1119 & 3724 Voice: UDP 3724 Downloader (updates): TCP 6112 & 6881-6999
Steam
Steam Client * UDP 27000 to 27015 inclusive (Game client traffic) * UDP 27015 to 27030 inclusive (Typically Matchmaking and HLTV) * TCP 27014 to 27050 inclusive (Steam downloads) * UDP 4380 Dedicated or Listen Servers * TCP 27015 (SRCDS Rcon port) Steamworks P2P Networking and Steam Voice Chat * UDP 3478 (Outbound) * UDP 4379 (Outbound) * UDP 4380 (Outbound) Additional Ports for Call of Duty: Modern Warfare 2 Multiplayer * UDP 1500 (outbound) * UDP 3005 (outbound) * UDP 3101 (outbound) * UDP 28960
IM
MSN
Sign in to the Messenger service TCP 80, 443, 1863 Network Detection TCP 7001 UDP 9, 7001 Audio TCP 80, 443, 1863 TCP/UDP 30000 - 65535 Audio (Legacy) UDP 5004 – 65535 Webcam and Video Conversations TCP 80 TCP/UDP 5000 - 65535 File Transfer TCP 443, 1863 TCP/UDP 1025 - 65535 File Transfer (Legacy) TCP 6891 - 6900 Sharing Folders TCP 1863 TCP/UDP 1025 – 65535 Whiteboard and Application Sharing TCP 1503 Remote Assistance TCP 3389 TCP/UDP 49152 – 65535 Windows Live Call TCP 443, 5061 UDP 5004 - 65525 Games TCP 80, 443, 1863 TCP/UDP 1025 - 65535
Skype
Niet mogelijk vast te stellen?
IRC
TCP 6667
ICQ
TCP 5190
Blocked
Torrent
Op basis van headers? Is het nodig om dit te blokkeren als we inbound connecties niet door laten?
NNTP
TCP 119
Analyse
DNS
IPTraf ┌ Packet Distribution by Size ─────────────────────────────────────────────────┠│ │ │ Packet size brackets for interface eth0 │ │ │ │ │ │ Packet Size (bytes) Count Packet Size (bytes) Count │ │ 1 to 75: 6118 751 to 825: 0 │ │ 76 to 150: 6710 826 to 900: 0 │ │ 151 to 225: 900 901 to 975: 0 │ │ 226 to 300: 329 976 to 1050: 0 │ │ 301 to 375: 130 1051 to 1125: 1 │ │ 376 to 450: 154 1126 to 1200: 0 │ │ 451 to 525: 101 1201 to 1275: 0 │ │ 526 to 600: 42 1276 to 1350: 0 │ │ 601 to 675: 4 1351 to 1425: 0 │ │ 676 to 750: 0 1426 to 1500+: 2 │ │ │ │ │ │ Interface MTU is 1500 bytes, not counting the data-link header │ │ Maximum packet size is the MTU plus the data-link header length │ │ Packet size computations include data-link headers, if any │ └ Elapsed time: 0:05 ────────────────────────────────────────────────────────┘
SSH
Proto/Port ───────── Pkts ─── Bytes ── PktsTo ─ BytesTo PktsFrom BytesFrom ─ TCP/22 621 87044 311 16220 310 70824
Sent: 621 p -> 87044 bytes = 140 bytes pp Received: 310 p -> 70824 bytes = 228 bytes pp