답변 정말 감사드립니다.
iptables -L -v 실행결과입니다.
중요한 사안이라 무슨 내용인지 분석 부탁드리겠습니다.
Chain INPUT (policy ACCEPT 331588 packets, 73790632 bytes)
pkts bytes target prot opt in out source destination
85351 9767K INETIN all -- eth0 any anywhere anywhere
331K 74M INTERNALIN all -- eth1 any anywhere anywhere
Chain FORWARD (policy DROP 125 packets, 7818 bytes)
pkts bytes target prot opt in out source destination
9316K 2948M ACCEPT all -- any any 192.168.100.0/24 anywhere
11M 12G ACCEPT all -- any any anywhere 192.168.100.0/24 state RELATED,ES
TABLISHED 0 0 ACCEPT tcp -- any any anywhere 192.168.100.77 tcp
dpt:3123 0 0 ACCEPT tcp -- any any anywhere 192.168.100.201 tcp
dpt:telnet 0 0 ACCEPT udp -- any any anywhere 192.168.100.77 u
dp dpt:3123 Chain OUTPUT (policy ACCEPT 135756 packets, 22981501 bytes)
pkts bytes target prot opt in out source destination
907 653K INETOUT all -- any eth0 anywhere anywhere
Chain INETIN (1 references)
pkts bytes target prot opt in out source destination
147 6888 TREJECT all -- any any anywhere anywhere state INVALI
D 469 587K ACCEPT icmp -- any any anywhere anywhere icmp echo-r
equest limit: avg 1/sec burst 5 0 0 ACCEPT icmp -- any any anywhere any
where icmp !echo-request 0 0 TCPACCEPT tcp -- any any anywhere
anywhere tcp spt:ssh dpts:login:1023 flags:!SYN,RST,ACK/SYN state RELATED 0 0 TCPACCEPT
tcp -- any any anywhere anywhere tcp spt:ssh dpts:1024:65535 flags:!S
YN,RST,ACK/SYN state RELATED 0 0 ACCEPT tcp -- any any 192.168.100.0/24 anywhere
tcp dpt:telnet 7 1013 ACCEPT all -- any any anywhere anyw
here state ESTABLISHED 84728 9172K LDROP all -- any any anywhere
anywhere Chain INETOUT (1 references) pkts bytes target prot opt in out source
destination 907 653K ACCEPT all -- any any anywhere
anywhere Chain INTERNALIN (1 references)
pkts bytes target prot opt in out source destination
Chain LDROP (1 references)
pkts bytes target prot opt in out source destination
77981 7549K LOG tcp -- any any anywhere anywhere limit: avg 2
/sec burst 5 LOG level info prefix `TCP Dropped ' 2032 379K LOG udp -- any any anywhere
anywhere limit: avg 2/sec burst 5 LOG level info prefix `UDP Dropped ' 151 12684 LOG
icmp -- any any anywhere anywhere limit: avg 2/sec burst 5 LOG l
evel info prefix `ICMP Dropped ' 0 0 LOG all -f any any anywhere
anywhere limit: avg 2/sec burst 5 LOG level warning prefix `FRAGMENT Dropped ' 84728 9172K DROP
all -- any any anywhere anywhere Chain LREJECT (0 references) pkts by
tes target prot opt in out source destination 0 0 LOG
tcp -- any any anywhere anywhere limit: avg 2/sec burst 5 LOG lev
el info prefix `TCP Rejected ' 0 0 LOG udp -- any any anywhere a
nywhere limit: avg 2/sec burst 5 LOG level info prefix `UDP Rejected ' 0 0 LOG icm
p -- any any anywhere anywhere limit: avg 2/sec burst 5 LOG level info pre
fix `ICMP Dropped ' 0 0 LOG all -f any any anywhere anywhere
limit: avg 2/sec burst 5 LOG level warning prefix `FRAGMENT Rejected ' 0 0 REJECT all -
- any any anywhere anywhere reject-with icmp-port-unreachable Chain LTREJ
ECT (0 references) pkts bytes target prot opt in out source destination
0 0 LOG tcp -- any any anywhere anywhere limi
t: avg 2/sec burst 5 LOG level info prefix `TCP Rejected ' 0 0 LOG udp -- any any
anywhere anywhere limit: avg 2/sec burst 5 LOG level info prefix `UDP Rejected '
0 0 LOG icmp -- any any anywhere anywhere limit: avg 2/se
c burst 5 LOG level info prefix `ICMP Dropped ' 0 0 LOG all -f any any anywhere
anywhere limit: avg 2/sec burst 5 LOG level warning prefix `FRAGMENT Rejected ' 0
0 REJECT tcp -- any any anywhere anywhere reject-with tcp-res
et 0 0 REJECT !tcp -- any any anywhere anywhere reject-
with icmp-port-unreachable 0 0 REJECT all -- any any anywhere anywher
e reject-with icmp-port-unreachable Chain TCPACCEPT (2 references) pkts bytes target prot opt in
out source destination 0 0 ACCEPT tcp -- any any
anywhere anywhere tcp flags:SYN,RST,ACK/SYN limit: avg 4/sec burst 5 0
0 ACCEPT tcp -- any any anywhere anywhere tcp flags:!SYN,RST,A
CK/SYN 0 0 LOG all -- any any anywhere anywhere l
imit: avg 2/sec burst 5 LOG level warning prefix `Mismatch in TCPACCEPT ' 0 0 TREJECT all -- any
any anywhere anywhere Chain TREJECT (3 references) pkts bytes target p
rot opt in out source destination 112 4480 REJECT tcp -- any
any anywhere anywhere reject-with tcp-reset 35 2408 REJECT !tcp
-- any any anywhere anywhere reject-with icmp-port-unreachable 0
0 REJECT all -- any any anywhere anywhere reject-with icmp-
port-unreachable Chain UDPACCEPT (0 references) pkts bytes target prot opt in out source
destination 0 0 ACCEPT udp -- any any anywhere
anywhere 0 0 LOG all -- any any anywhere anywhere
limit: avg 2/sec burst 5 LOG level warning prefix `Mismatch on UDPACCEPT ' 0 0 TREJECT
all -- any any anywhere anywhere [root@ithuriel /root]# iptables -L -v Ch
ain INPUT (policy ACCEPT 331696 packets, 73811325 bytes) pkts bytes target prot opt in out source
destination 85387 9770K INETIN all -- eth0 any anywhere
anywhere 331K 74M INTERNALIN all -- eth1 any anywhere anywhere
Chain FORWARD (policy DROP 125 packets, 7818 bytes) pkts bytes target prot opt in out
source destination 9321K 2949M ACCEPT all -- any any 192.168.100.0/
24 anywhere 11M 12G ACCEPT all -- any any anywhere 192.
168.100.0/24 state RELATED,ESTABLISHED 0 0 ACCEPT tcp -- any any anywhere
192.168.100.77 tcp dpt:3123 0 0 ACCEPT tcp -- any any anywhere
192.168.100.201 tcp dpt:telnet 0 0 ACCEPT udp -- any any anywhere
192.168.100.77 udp dpt:3123 Chain OUTPUT (policy ACCEPT 135820 packets, 22998518 bytes) pkts bytes ta
rget prot opt in out source destination 913 654K INETOUT all
-- any eth0 anywhere anywhere Chain INETIN (1 references)
pkts bytes target prot opt in out source destination
147 6888 TREJECT all -- any any anywhere anywhere state INVALI
D 469 587K ACCEPT icmp -- any any anywhere anywhere icmp echo-r
equest limit: avg 1/sec burst 5 0 0 ACCEPT icmp -- any any anywhere any
where icmp !echo-request 0 0 TCPACCEPT tcp -- any any anywhere
anywhere tcp spt:ssh dpts:login:1023 flags:!SYN,RST,ACK/SYN state RELATED 0 0 TCPACCEPT
tcp -- any any anywhere anywhere tcp spt:ssh dpts:1024:65535 flags:!S
YN,RST,ACK/SYN state RELATED 0 0 ACCEPT tcp -- any any 192.168.100.0/24 anywhere
tcp dpt:telnet 13 1881 ACCEPT all -- any any anywhere anywh
ere state ESTABLISHED 84758 9174K LDROP all -- any any anywhere
anywhere Chain INETOUT (1 references) pkts bytes target prot opt in out source
destination 913 654K ACCEPT all -- any any anywhere
anywhere Chain INTERNALIN (1 references)
pkts bytes target prot opt in out source destination
Chain LDROP (1 references)
pkts bytes target prot opt in out source destination
78008 7551K LOG tcp -- any any anywhere anywhere limit: avg 2
/sec burst 5 LOG level info prefix `TCP Dropped ' 2035 379K LOG udp -- any any anywhere
anywhere limit: avg 2/sec burst 5 LOG level info prefix `UDP Dropped ' 151 12684 LOG
icmp -- any any anywhere anywhere limit: avg 2/sec burst 5 LOG l
evel info prefix `ICMP Dropped ' 0 0 LOG all -f any any anywhere
anywhere limit: avg 2/sec burst 5 LOG level warning prefix `FRAGMENT Dropped ' 84758 9174K DROP
all -- any any anywhere anywhere Chain LREJECT (0 references) pkts by
tes target prot opt in out source destination 0 0 LOG
tcp -- any any anywhere anywhere limit: avg 2/sec burst 5 LOG lev
el info prefix `TCP Rejected ' 0 0 LOG udp -- any any anywhere a
nywhere limit: avg 2/sec burst 5 LOG level info prefix `UDP Rejected ' 0 0 LOG icm
p -- any any anywhere anywhere limit: avg 2/sec burst 5 LOG level info pre
fix `ICMP Dropped ' 0 0 LOG all -f any any anywhere anywhere
limit: avg 2/sec burst 5 LOG level warning prefix `FRAGMENT Rejected ' 0 0 REJECT all -
- any any anywhere anywhere reject-with icmp-port-unreachable Chain LTREJ
ECT (0 references) pkts bytes target prot opt in out source destination
0 0 LOG tcp -- any any anywhere anywhere limi
t: avg 2/sec burst 5 LOG level info prefix `TCP Rejected ' 0 0 LOG udp -- any any
anywhere anywhere limit: avg 2/sec burst 5 LOG level info prefix `UDP Rejected '
0 0 LOG icmp -- any any anywhere anywhere limit: avg 2/se
c burst 5 LOG level info prefix `ICMP Dropped ' 0 0 LOG all -f any any anywhere
anywhere limit: avg 2/sec burst 5 LOG level warning prefix `FRAGMENT Rejected ' 0
0 REJECT tcp -- any any anywhere anywhere reject-with tcp-res
et 0 0 REJECT !tcp -- any any anywhere anywhere reject-
with icmp-port-unreachable 0 0 REJECT all -- any any anywhere anywher
e reject-with icmp-port-unreachable Chain TCPACCEPT (2 references) pkts bytes target prot opt in
out source destination 0 0 ACCEPT tcp -- any any
anywhere anywhere tcp flags:SYN,RST,ACK/SYN limit: avg 4/sec burst 5 0
0 ACCEPT tcp -- any any anywhere anywhere tcp flags:!SYN,RST,A
CK/SYN 0 0 LOG all -- any any anywhere anywhere l
imit: avg 2/sec burst 5 LOG level warning prefix `Mismatch in TCPACCEPT ' 0 0 TREJECT all -- any
any anywhere anywhere Chain TREJECT (3 references) pkts bytes target p
rot opt in out source destination 112 4480 REJECT tcp -- any
any anywhere anywhere reject-with tcp-reset 35 2408 REJECT !tcp
-- any any anywhere anywhere reject-with icmp-port-unreachable 0
0 REJECT all -- any any anywhere anywhere reject-with icmp-
port-unreachable Chain UDPACCEPT (0 references) pkts bytes target prot opt in out source
destination 0 0 ACCEPT udp -- any any anywhere
anywhere 0 0 LOG all -- any any anywhere anywhere
limit: avg 2/sec burst 5 LOG level warning prefix `Mismatch on UDPACCEPT ' 0 0 TREJECT
all -- any any anywhere anywhere [root@ithuriel /root]# iptables -L -v Ch
ain INPUT (policy ACCEPT 332603 packets, 73969418 bytes) pkts bytes target prot opt in out source
destination 85679 9804K INETIN all -- eth0 any anywhere
anywhere 332K 74M INTERNALIN all -- eth1 any anywhere anywhere
Chain FORWARD (policy DROP 125 packets, 7818 bytes) pkts bytes target prot opt in out
source destination 9343K 2951M ACCEPT all -- any any 192.168.100.0/
24 anywhere 11M 12G ACCEPT all -- any any anywhere 192.
168.100.0/24 state RELATED,ESTABLISHED 0 0 ACCEPT tcp -- any any anywhere
192.168.100.77 tcp dpt:3123 0 0 ACCEPT tcp -- any any anywhere
192.168.100.201 tcp dpt:telnet 0 0 ACCEPT udp -- any any anywhere
192.168.100.77 udp dpt:3123 Chain OUTPUT (policy ACCEPT 136195 packets, 23071210 bytes) pkts bytes ta
rget prot opt in out source destination 922 659K INETOUT all
-- any eth0 anywhere anywhere Chain INETIN (1 references)
pkts bytes target prot opt in out source destination
152 7168 TREJECT all -- any any anywhere anywhere state INVALI
D 472 592K ACCEPT icmp -- any any anywhere anywhere icmp echo-r
equest limit: avg 1/sec burst 5 0 0 ACCEPT icmp -- any any anywhere any
where icmp !echo-request 0 0 TCPACCEPT tcp -- any any anywhere
anywhere tcp spt:ssh dpts:login:1023 flags:!SYN,RST,ACK/SYN state RELATED 0 0 TCPACCEPT
tcp -- any any anywhere anywhere tcp spt:ssh dpts:1024:65535 flags:!S
YN,RST,ACK/SYN state RELATED 0 0 ACCEPT tcp -- any any 192.168.100.0/24 anywhere
tcp dpt:telnet 19 2749 ACCEPT all -- any any anywhere anywh
ere state ESTABLISHED 85036 9202K LDROP all -- any any anywhere
anywhere Chain INETOUT (1 references) pkts bytes target prot opt in out source
destination 922 659K ACCEPT all -- any any anywhere
anywhere Chain INTERNALIN (1 references)
pkts bytes target prot opt in out source destination
Chain LDROP (1 references)
pkts bytes target prot opt in out source destination
78271 7577K LOG tcp -- any any anywhere anywhere limit: avg 2
/sec burst 5 LOG level info prefix `TCP Dropped ' 2050 381K LOG udp -- any any anywhere
anywhere limit: avg 2/sec burst 5 LOG level info prefix `UDP Dropped ' 151 12684 LOG
icmp -- any any anywhere anywhere limit: avg 2/sec burst 5 LOG l
evel info prefix `ICMP Dropped ' 0 0 LOG all -f any any anywhere
anywhere limit: avg 2/sec burst 5 LOG level warning prefix `FRAGMENT Dropped ' 85036 9202K DROP
all -- any any anywhere anywhere Chain LREJECT (0 references) pkts by
tes target prot opt in out source destination 0 0 LOG
tcp -- any any anywhere anywhere limit: avg 2/sec burst 5 LOG lev
el info prefix `TCP Rejected ' 0 0 LOG udp -- any any anywhere a
nywhere limit: avg 2/sec burst 5 LOG level info prefix `UDP Rejected ' 0 0 LOG icm
p -- any any anywhere anywhere limit: avg 2/sec burst 5 LOG level info pre
fix `ICMP Dropped ' 0 0 LOG all -f any any anywhere anywhere
limit: avg 2/sec burst 5 LOG level warning prefix `FRAGMENT Rejected ' 0 0 REJECT all -
- any any anywhere anywhere reject-with icmp-port-unreachable Chain LTREJ
ECT (0 references) pkts bytes target prot opt in out source destination
0 0 LOG tcp -- any any anywhere anywhere limi
t: avg 2/sec burst 5 LOG level info prefix `TCP Rejected ' 0 0 LOG udp -- any any
anywhere anywhere limit: avg 2/sec burst 5 LOG level info prefix `UDP Rejected '
0 0 LOG icmp -- any any anywhere anywhere limit: avg 2/se
c burst 5 LOG level info prefix `ICMP Dropped ' 0 0 LOG all -f any any anywhere
anywhere limit: avg 2/sec burst 5 LOG level warning prefix `FRAGMENT Rejected ' 0
0 REJECT tcp -- any any anywhere anywhere reject-with tcp-res
et 0 0 REJECT !tcp -- any any anywhere anywhere reject-
with icmp-port-unreachable 0 0 REJECT all -- any any anywhere anywher
e reject-with icmp-port-unreachable Chain TCPACCEPT (2 references) pkts bytes target prot opt in
out source destination 0 0 ACCEPT tcp -- any any
anywhere anywhere tcp flags:SYN,RST,ACK/SYN limit: avg 4/sec burst 5 0
0 ACCEPT tcp -- any any anywhere anywhere tcp flags:!SYN,RST,A
CK/SYN 0 0 LOG all -- any any anywhere anywhere l
imit: avg 2/sec burst 5 LOG level warning prefix `Mismatch in TCPACCEPT ' 0 0 TREJECT all -- any
any anywhere anywhere Chain TREJECT (3 references) pkts bytes target p
rot opt in out source destination 112 4480 REJECT tcp -- any
any anywhere anywhere reject-with tcp-reset 40 2688 REJECT !tcp
-- any any anywhere anywhere reject-with icmp-port-unreachable 0
0 REJECT all -- any any anywhere anywhere reject-with icmp-
port-unreachable Chain UDPACCEPT (0 references) pkts bytes target prot opt in out source
destination 0 0 ACCEPT udp -- any any anywhere
anywhere 0 0 LOG all -- any any anywhere anywhere
limit: avg 2/sec burst 5 LOG level warning prefix `Mismatch on UDPACCEPT ' 0 0 TREJECT
all -- any any anywhere anywhere : : isp 에서 제공하는 mrtg 분석
화면을 보면 : : 출력량이 512k 한계치까지 지속적으로 나옴니다. : : 개인pc의 바이러스로
이러한 경우가 생긴다고 하는데, : : 사내에서 내부 네트웍을 사용하여 외부와 연결되고 있
어서 : : 어떤 pc 가 원인인지 isp에서 확인이 안된다고 하네요. : : 저희는 리눅스 박스를 마
스커레이딩하여 사용하고 있는데 : : 여기에 mrtg를 설치하고 체크하여야 하나요? : : 어느 pc
가출력을 많이 보내는지 아는 방법을 자세히 조언 부탁드립니다. : : 감사합니다.
:
: 간단하게는 iptables -L -v 해서 룰이 적용된 패킷의 수를 보는 방법이 있고..
: 단순하게 문제만 해결하기 위해서는..
: 물려있는 pc 를 한대씩 꺼보는 방법-_- 은 어떨까 생각됩니다만.
: 고수님들이 더 좋은 방법을 알려주시겠죠.