Section 8: administration and privileged commands
tcpdmatch – tcp wrapper oracle Synopsys tcpdmatch [-d] daemon client tcpdmatch [-d] daemon[@server] [user@]client Description tcpdmatch predicts how the tcp wrapper would handle a specific request for service. Examples are given below. The program examines the tcpd access control tables (default /etc/hosts.allow and /etc/hosts.deny) and prints its conclusion. For maximal accuracy, it extracts additional information…
tcpdchk – tcp wrapper configuration checker Synopsis tcpdchk [-a] [-d] [-i inet_conf] [-v] Description tcpdchk examines your tcp wrapper configuration and reports all potential and real problems it can find. The program examines the tcpd access control files (by default, these are /etc/hosts.allow and /etc/hosts.deny), and compares the entries in these files against entries in…
tcpd_selinux – Security Enhanced Linux Policy for the tcpd processes Description Security-Enhanced Linux secures the tcpd processes via flexible mandatory access control. The tcpd processes execute with the tcpd_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
tcpd – access control facility for internet services Description The tcpd program can be set up to monitor incoming requests for telnet, finger, ftp, exec, rsh, rlogin, tftp, talk, comsat and other services that have a one-to-one mapping onto executable files. The program supports both 4.3BSD-style sockets and System V.4-style TLI. Functionality may be limited…
tcpcryptd – Implement the tcpcrypt protocol by transparently modifying network I/O Synopsis tcpcryptd [options] Options A list of all options is produced by: tcpcryptd -h Configuration of packet-diversion rules allows the system administrator to control which TCP connections are protected by tcpcryptd. The daemon receives packets for transformation via a "divert port", configurable with -p…
ax25_call, netrom_call, rose_call, tcp_call – make an AX.25, NET/ROM, ROSE or TCP connection Synopsis ax25_call [-c] [-i paclen] [-o paclen] port local_call remote_call [digipeaters …] netrom_call [-c] [-i paclen] [-o paclen] port local_call remote_netrom_addr rose_call [-c] [-i paclen] [-o paclen] port local_call remote_call remote_rose_addr tcp_call [-c] [-i paclen] [-o paclen] remote_addr remote_port Description ax25_call, netrom_call,…
tcnetstat – Print information about network connections protected by tcpcrypt Synopsis tcnetstat Description The tcnetstat utility prints the session id of each TCP connection that is currently being protected by the tcpcrypt protocol. Options Where the tcpcrypt protocol is implemented by the tcpcryptd daemon, this utility communicates with the daemon via a "control socket", configurable…
tc – show / manipulate traffic control settings Synopsis tc [ OPTIONS ] qdisc [ add | change | replace | link | delete ] dev DEV [ parent qdisc-id | root ] [ handle qdisc-id ] [ ingress_block BLOCK_INDEX ] [ egress_block BLOCK_INDEX ] qdisc [ qdisc specific parameters ] tc [ OPTIONS ]…
xt – tc iptables action Synopsis tc … action xt -j TARGET [ TARGET_OPTS ] Description The xt action allows to call arbitrary iptables targets for packets matching the filter this action is attached to. Options -j TARGET [ TARGET_OPTS ] Perform a jump to the given iptables target, optionally passing any target specific options…
vlan – vlan manipulation module Synopsis tc … action vlan { pop | pop_eth | PUSH | MODIFY | PUSH_ETH } [ CONTROL ] PUSH := push [ protocol VLANPROTO ] [ priority VLANPRIO ] id VLANID MODIFY := modify [ protocol VLANPROTO ] [ priority VLANPRIO ] id VLANID PUSH_ETH := push_eth dst_mac LLADDR…
u32 – universal 32bit traffic control filter Synopsis tc filter … [ handle HANDLE ] u32 OPTION_LIST [ offset OFFSET ] [ hashkey HASHKEY ] [ classid CLASSID ] [ divisor uint_value ] [ order u32_value ] [ ht HANDLE ] [ sample SELECTOR [ divisor uint_value ] ] [ link HANDLE ] [ indev…
tunnel_key – Tunnel metadata manipulation Synopsis tc … action tunnel_key { unset | SET } SET := set src_ip ADDRESS dst_ip ADDRESS id KEY_ID dst_port UDP_PORT tos TOS ttl TTL [ csum | nocsum ] Description The tunnel_key action combined with a shared IP tunnel device, allows to perform IP tunnel en- or decapsulation on…
tcindex – traffic control index filter Synopsis tc filter … tcindex [ hash SIZE ] [ mask MASK ] [ shift SHIFT ] [ pass_on | fall_through ] [ classid CLASSID ] [ action ACTION_SPEC ] Description This filter allows to match packets based on their tcindex field value, i.e. the combination of the DSCP…
tbf – Token Bucket Filter Synopsis tc qdisc … tbf rate rate burst bytes/cell ( latency ms | limit bytes ) [ mpu bytes [ peakrate rate mtu bytes/cell ] ] burst is also known as buffer and maxburst. mtu is also known as minburst. Description The Token Bucket Filter is a classful queueing discipline…
TAPRIO – Time Aware Priority Shaper Synopsis tc qdisc … dev dev parent classid [ handle major: ] taprio num_tc tcs map P0 P1 P2 … queues count1 [at] offset1 count2 [at] offset2 … base-time base-time clockid clockid sched-entry <command 1> <gate mask 1> <interval 1> sched-entry <command 2> <gate mask…
tc-stab – Generic size table manipulations Synopsis tc qdisc add … stab [ mtu BYTES ] [ tsize SLOTS ] [ mpu BYTES ] [ overhead BYTES ] [ linklayer { adsl | atm | ethernet } ] … Options For the description of BYTES – please refer to the UNITS section of tc(8). mtu…
skbprio – SKB Priority Queue Synopsis tc qdisc … add skbprio [ limit packets ] Description SKB Priority Queue is a queueing discipline intended to prioritize the most important packets during a denial-of-service ( DoS ) attack. The priority of a packet is given by skb->priority , where a higher value places the packet closer…
skbmod – user-friendly packet editor action Synopsis tc … action skbmod { set SETTABLE | swap SWAPPABLE | ecn } [ CONTROL ] [ index INDEX ] SETTABLE := [ dmac DMAC ] [ smac SMAC ] [ etype ETYPE ] SWAPPABLE := mac CONTROL := { reclassify | pipe | drop | shot |…
skbedit – SKB editing action Synopsis tc … action skbedit [ queue_mapping QUEUE_MAPPING ] [ priority PRIORITY ] [ mark MARK[/MASK] ] [ ptype PTYPE ] [ inheritdsfield ] Description The skbedit action allows to change a packet’s associated meta data. It complements the pedit action, which in turn allows to change parts of the…
simple – basic example action Synopsis tc … action simple [ sdata STRING ] [ index INDEX ] [ CONTROL ] CONTROL := { reclassify | pipe | drop | continue | ok } Description This is a pedagogical example rather than an actually useful action. Upon every access, it prints the given STRING which…