Re: monitor ALL connections to ALL ports

From: Dragan Mickovic (dmickovic@verio.net)
Date: 10/12/02 

Date: Sat, 12 Oct 2002 10:41:19 -0400
From: Dragan Mickovic <dmickovic@verio.net>
To: Maildrop <maildrop@qwest.net>

You can just put IPFilter with a default rule to pass and log. By default
it will log src,dst,port,len .. ie:

Sep 22 19:39:20 server_name ipmon[84]: 19:39:20.251359 fxp0 @0:20 b 192.168.1.20,137 -> 192.168.1.255,137 PR udp len 20 78 IN

micko

On Sat, Oct 12, 2002 at 12:17:42AM -0500, Maildrop wrote:
>
> I currently have a DSL line and a FreeBSD firewall/gateway (dual homed). It
> has one internal IP address and 5 external IP address (one "real" ip and 4
> alaises on same external nic).
>
> What I want to do is montior and record (to log) all incoming/outging
> connection (just source ip/dest ip/port). If someone connects to my web
> server it should log what ip accessed it, the time, which ip (web server
> runs on 2 external ip address) and the port. Also if someone does a port
> scan against the box I should be able to tell it is a port scan (since one
> ip address would be opening up a bunch of ports).
>
> Right now I don't care what data is being sent/received, just what
> connections are being made (and the details about those connections).
>
> Any suggestions?
>
> Regards,
> Jack
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message 

-- 
Dragan Mickovic
UNIX Systems Administrator
NTT/Verio    x.4012
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • RE: monitor ALL connections to ALL ports
    ... Logging incoming web server connections can be done ... runs on 2 external ip address) and the port. ... with "unsubscribe freebsd-security" in the body of the message ...
    (FreeBSD-Security)
  • FW: monitor ALL connections to ALL ports
    ... ipfw add count log all from any to any ... I want to log all connections, ... >> server it should log what ip accessed it, the time, which ip (web server ... >> runs on 2 external ip address) and the port. ...
    (FreeBSD-Security)
  • monitor ALL connections to ALL ports
    ... I currently have a DSL line and a FreeBSD firewall/gateway. ... server it should log what ip accessed it, the time, which ip (web server ... runs on 2 external ip address) and the port. ... connections are being made. ...
    (FreeBSD-Security)
  • Re: port 80 open?
    ... > machine to see if you have a program that is listening on that port. ... > intercepting incoming connections to prevent you from running a web server. ... > other security programs but normally shouldn't unless you don't want to be ...
    (microsoft.public.windowsxp.security_admin)
  • Re: port 80 open?
    ... you can get a tool like nis or zonealarm that will block those ... on port 80, but even if you aren't you should really have a firewall. ... >> intercepting incoming connections to prevent you from running a web ... >> this is different from you connecting out to a web server, ...
    (microsoft.public.windowsxp.security_admin)