TCPDMATCH(8)

✨ TCPDMATCH(8) ✨

okay bestie, welcome to TCPDMATCH(8) — a page from the System Manager's Manual, and honestly? it's giving "crystal ball but for your firewall" 🔮

---

💖 NAME 💖

tcpdmatch — the tcp wrapper oracle 🧚

---

🌸 SYNOPSIS 🌸

tcpdmatch [-d] [-i inet_conf] daemon client

tcpdmatch [-d] [-i inet_conf] daemon[@server] [user@]client

---

🦋 DESCRIPTION 🦋

so here's the vibe: tcpdmatch predicts how the tcp wrapper would handle one specific request for service. like, it's not doing the thing, it's telling you what would happen. examples are down below in EXAMPLES, no worries.

The program goes and examines the tcpd access control tables — default /etc/hosts.allow and /etc/hosts.deny — and then prints its conclusion. and for maximal accuracy?? it also pulls extra info out of your inetd network configuration file. maximal accuracy, we love to see it.

When tcpdmatch finds a match in the access control tables, it identifies the matched rule. AND on top of that, it displays the optional shell commands or options in a pretty-printed format — which makes it way easier for you to spot any discrepancies between what you want and what the program understands. iconic behaviour honestly 💅

---

🎀 ARGUMENTS 🎀

These next two are always required, no skipping, periodt:

• daemon — a daemon process name. typically it's the last component of a daemon executable pathname.
• client — a host name or network address, or one of the unknown or paranoid wildcard patterns.
  • When you specify a client host name, tcpdmatch gives you a prediction for each address listed for that client. (yes, each one. it does the work so you don't have to 🫶)
  • When you specify a client address, tcpdmatch predicts what tcpd would do when client name lookup fails.

Now the optional info you can pass with the daemon@server form:

• server — a host name or network address, or one of the unknown or paranoid wildcard patterns. The default server name is unknown.

And the optional info you can pass with the user@client form:

• user — a client user identifier. typically a login name or a numeric userid. The default user name is unknown.

---

✨ OPTIONS ✨

• -d — examine hosts.allow and hosts.deny files in the current directory instead of the default ones. (local files only, bestie, it's not gonna go snooping in /etc 💀)
• -i inet_conf — specify this option when tcpdmatch is unable to find your inetd.conf network configuration file, or when you suspect that the program uses the wrong one. like handing your friend the aux cord because they keep picking the wrong song 🎧

---

🔥 EXAMPLES 🔥

Wanna predict how tcpd would handle a telnet request from the local system? say less:

tcpdmatch in.telnetd localhost

Same request, but pretending that hostname lookup failed:

tcpdmatch in.telnetd 127.0.0.1

And to predict what tcpd would do when the client name does not match the client address:

tcpdmatch in.telnetd paranoid

heads up bestie: on some systems, daemon names have no in. prefix, or tcpdmatch may need some help to locate the inetd configuration file. so if it's acting confused, that's why. 🙈

---

🍓 FILES 🍓

The default locations of the tcpd access control tables are:

/etc/hosts.allow
/etc/hosts.deny

---

🌈 SEE ALSO 🌈

• tcpdchk(8), tcpd configuration checker
• hosts_access(5), format of the tcpd access control tables.
• hosts_options(5), format of the language extensions.
• inetd.conf(5), format of the inetd control file.

---

👑 AUTHORS 👑

Wietse Venema (wietse@wzv.win.tue.nl), Department of Mathematics and Computing Science, Eindhoven University of Technology Den Dolech 2, P.O. Box 513, 5600 MB Eindhoven, The Netherlands

---

and that's the whole page, bestie!! 💖 this was from TCPDMATCH(8) in the System Manager's Manual — go forth and predict your tcp wrapper's decisions with main character energy 🦋✨💅