Filter by Multicast / Broadcast in Wireshark

When tracking down multicast and broadcast sources it is useful to be able to filter everything to leave only the multicast and broadcast traffic.

To do this in the wireshark GUI enter this into your filter and click apply.

(eth.dst[0] & 1)

It is also worth noting that at the bottom of the screen it displays the total number of packets captured and the number displayed.  This is a nice quick way of seeing just what percentage of your packets are multi/broadcast to this server or span port vs the rest of your traffic.

Configure sendmail to relay via smarthost

Sendmail appears to be falling out of favour to other MTAs such as postfix but I often find myself using it because it tends to be available on every distribution and is still widely used.  Problems or security issues are usually quickly patched.  Sendmail is definately one of the harder MTAs to configure so if you are looking to do more than basic relaying you might be better of learning how to configure postfix instead.

Assuming you have sendmail pre-installed or installed via:

apt-get install sendmail

or

yum install sendmail  (you might also need to install m4 to build the configurations)

Make sure your sendmail host can resolve and reach your smarthost relay, if required add an entry to your hosts file or setup your resolv file.

vi /etc/hosts

Now edit the sendmail.mc file in your favorite text editor:

vi /etc/mail/sendmail.mc

As here we are only setting up a single smart host just add the line:

define(`SMART_HOST’, `server.fqdn’)

Where server.fqdn matches the entry in DNS or your host file.  Make sure you use the exact format above, it might help to copy and paste this into your config file via putty.

Once this is done we need to compile the sendmail configuration.  The easiest way is with the following command:

sendmailconfig

Respond yes to the various prompts and now your sendmail install should forward all emails out via the newly defined smarthost.

Failing this you could try using m4 with the following command: (Make sure you are in the right directory)

m4 sendmail.mc > sendmail.cf

While the default configuration is reasonable with sendmail it would be wise to make sure you aren’t creating an open relay here.  Consider checking and if required setting up an iptables /firewalld rule to block unwanted hosts from connecting to port 25.

Also review the contents of /etc/mail/relay-domains and make sure you are only relaying mail for domains you intend to.  Any changes here will require a sendmail service restart.

service sendmail restart