Port Forward and system real time dump

u6804 — Fri, 13 May 2011 09:54:43 GMT

Hello

I'm a novice and I have maybe stupid two questions.

How can I dump and display (real time) incoming and outgoing traffic on the interface (or all interfaces) ?.For example: typical view from tcpdump.

~# tcpdump -n host 193.165.XXX.XXX and port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
11:31:03.161906 IP 193.165.xxx.xxx.52653 > 193.165.xxx.xxx.80: Flags , seq 3021987991, win 8192, options [mss 1314,nop,wscale 2,nop,nop,sackOK], length 0
11:31:03.161972 IP 193.165.xxx.xxx.80 > 193.165.xxx.xxx.52653: Flags [S.], seq 21024193, ack 3021987992, win 5840, options [mss 1460,nop,nop,sackOK,nop,wscale 5], length 0
11:31:03.919630 IP 193.165.xxx.xxx.52653 > 193.165.xxx.xxx.80: Flags [.], ack 1, win 16425, length 0
11:31:03.930313 IP 193.165.xxx.xxx.52653 > 193.165.xxx.xxx.80: Flags [P.], seq 1:368, ack 1, win 16425, length 367
11:31:03.930367 IP 193.165.xxx.xxx.80 > 193.165.209.xxx.52653: Flags [.], ack 368, win 216, length 0
11:31:07.207545 IP 193.165.xxx.xxx.80 > 193.165.209.xxx.52653: Flags [P.], seq 1:486, ack 368, win 216, length 485
11:31:07.488402 IP 193.165.xxx.xxx.52653 > 193.165.xxx.xxx.80: Flags [P.], seq 368:716, ack 486, win 16303, length 348
11:31:07.488445 IP 193.165.xxx.xxx.80 > 193.165.xxx.xxx.52653: Flags [.], ack 716, win 250, length 0

Could you write me please step by step how can I forward traffic from external (WAN - any) traffic to LAN (internal mailserver)

For example:

WAN - any (port 25) ---->| eht1/3 (213.161.212.12) ------- eth1/4(192.168.1.1)| --- mailserver(192.168.1.10)

Thanks for your help.

PeTe

Re: Port Forward and system real time dump

mharding — Fri, 13 May 2011 13:17:14 GMT

You can dump traffic with a few sets of commands. You'll have to setup a debug dataplane packet-capture, and then view-pcap follow yes filter-pcap name.pcap. You could also scp or tftp that pcap to your desktop and view it in Wireshark.

You would want to setup a NAT rule to get mail from the Internal to your Internal network. (Don't forget you're security rule too!)

Re: Port Forward and system real time dump

bpappas — Fri, 13 May 2011 14:13:11 GMT

Remember: the packet capture tool on the PAN firewall is a debugging commmand. If you use it improperly you can adversely affect traffic throughput. Do not turn this feature on and leave it on indefinitely!!!!

topic Port Forward and system real time dump in General Topics

Port Forward and system real time dump

Re: Port Forward and system real time dump

Re: Port Forward and system real time dump