A colleague on lab-node1 needs a capture of the refusal on port 8081 — one with nothing extra in it. From it they will see for themselves who answered their connection and how.
The monitor knocks both on 8080, where drop stands, and on 8081. The card gives no commands: you have seen the interface, the packet count, the filter and writing to a file in this lesson — build your own command from them.
Record the refusal on 8081
A colleague on lab-node1 says a connection to port 8081 on lab-node2 breaks off at once and asks for a capture. Save a connection attempt to 8081 together with the reply from lab-node2 into ~/packets/8081.pcap — port 8081 packets only. The monitor knocks on 8081 every few seconds.
Goals · 0 of 2
- Record a connection attempt to 8081 and the reply from lab-node2 not done yet
- Keep only port 8081 in the capture not done yet
In the capture the SYN to 8081 got [R.], and sudo ip netns exec lab-node2 nft list ruleset has no rules for 8081. What do you check next?
-
dropsends nothing back, and here a reply came. With no rules in the set, the kernel sends the[R.]. -
[R.]is a final refusal: the client gives up at once, and there is nothing to wait for. -
The route is fine: the SYN reached
lab-node2, and the[R.]came back.
An RST without a reject with tcp reset rule means nobody listens on that address and port, which ss -ltn on lab-node2 shows.