IBM Support

Why can't I monitor localhost connection to PostgresSQL, with Guardium stap, on windows?

Question & Answer


Question

Why can't I monitor localhost connection to PostgresSQL, with Guardium stap, on windows? I use the PostgresSQL GUI locally on a Windows server. I've noticed that when I connect to localhost the Guardium will not record my session. If I login to 127.0.0.1 then my session is recorded ok. Also if I login like this it's not monitored: psql -h localhost -U postgres

Answer

The connection to localhost is done with IPv6 unless you have disabled IPv6.

Guardium don't support IPv6.

To stop Windows from using IPv6 see this article --> 
https://support.microsoft.com/en-us/kb/929852

To see if IPv6 is used. Test like this:

--------
C:\Program Files\PostgreSQL\9.5\bin>psql -h localhost -U postgres
psql (9.5.0)

postgres=#
--------

Then, run "netstat -b"

--------
C:\Program Files\PostgreSQL\9.5\bin>netstat -b

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    9.68.240.142:3389      argyle:57842           ESTABLISHED
  Dnscache
 [svchost.exe]
  TCP    [::1]:5432             grddb12:53365          ESTABLISHED
 [postgres.exe]
  TCP    [::1]:53365            grddb12:5432           ESTABLISHED
 [psql.exe]

C:\Program Files\PostgreSQL\9.5\bin>
--------

If you see ::1, then that is a local IPv6 address.

If you specify 127.0.0.1,

--------
C:\Program Files\PostgreSQL\9.5\bin>psql -h 127.0.0.1 -U postgres
psql (9.5.0)

postgres=#
--------

You'll find the local IPv4 address (127.0.0.1), and that will be captured ok.

--------
C:\Program Files\PostgreSQL\9.5\bin>netstat -b

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    9.68.240.142:3389      argyle:57842           ESTABLISHED
  Dnscache
 [svchost.exe]
  TCP    127.0.0.1:5432         grddb12:53368          ESTABLISHED
 [postgres.exe]
  TCP    127.0.0.1:53368        grddb12:5432           ESTABLISHED
 [psql.exe]

C:\Program Files\PostgreSQL\9.5\bin>
--------

[{"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"--","Platform":[{"code":"PF033","label":"Windows"}],"Version":"10.0;10.0.1;10.1;9.0;9.1;9.5","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21985408