🚀 go-pugleaf

On Tue, 10 Apr 2001 19:33:10 -0400, Lawrence Baldwin, <baldwinl@mynetwatchman.com> wrote:

> The other solution is getting more agents reporting the attacks,
> so it's a lot easier to have 3,4,5++ victims reporting the
> same attacker...but I'm workin on that....should have >format-
> independent< log uploader done in about a week...this will add
> the much awaited Zone Alarm support (currently  myNetWatchman
> Agent for Windows  only supports BlackICE) AND all uploads will
> be real- time via HTTP (vs. delayed FTP).

  How about syslogd format ?  The Netgear RT314 has powerful firewalling
rules, but the telnet interface is somewhat klunky.  I have it log
dropped packets, and my linux machine picks up the log data.  Here is
sample output.  Note that each line starts with Date+Time.  It probably
wraps horribly on your display.

Apr 10 22:21:22 192.168.1.1 NetgearRT314: IP[Src=64.250.146.56 Dst=64.231.8.153 UDP spo=00137  dpo=00137]}S01>R02mD
Apr 10 22:23:56 192.168.1.1 last message repeated 3 times
Apr 10 22:23:59 192.168.1.1 last message repeated 2 times
Apr 11 01:26:00 192.168.1.1 NetgearRT314: IP[Src=63.238.218.124 Dst=64.231.1.208 TCP spo=03379  dpo=00111]}S01>R01mD
Apr 11 01:26:03 192.168.1.1 NetgearRT314: IP[Src=63.238.218.124 Dst=64.231.1.208 TCP spo=03379  dpo=00111]}S01>R01mD
Apr 11 01:53:57 192.168.1.1 NetgearRT314: IP[Src=64.230.181.205 Dst=64.231.1.208 TCP spo=01944  dpo=00021]}S01>R01mD
Apr 11 01:54:00 192.168.1.1 NetgearRT314: IP[Src=64.230.181.205 Dst=64.231.1.208 TCP spo=01944  dpo=00021]}S01>R01mD
Apr 11 20:33:39 192.168.1.1 NetgearRT314: IP[Src=211.78.243.11 Dst=64.231.17.158 TCP spo=02343  dpo=00111]}S01>R01mD
Apr 11 21:04:42 192.168.1.1 NetgearRT314: IP[Src=202.106.67.108 Dst=64.231.17.158 TCP spo=04401  dpo=00111]}S01>R01mD

  The interesting stuff is...
  - "IP[Src=" the (alleged) source
  - "Dst=" destination (my IP address at that time)
  - UDP/TCP (protocol type)
  - "spo="/"dpo=" source/destination port respectively

  My rule descriptor obviously depends on the exact rules I have defined.
See http://www.waltdnes.org/security/netgear.html for my "paranoia plus"
Netgear ruleset.

  }S01>R02mD
     \   \ \\_Drop packet
      \   \ \_take action (in this case, Drop) when condition is matched
       \   \__Rule 2 within the Set
        \_____Set 1 (Each Set can contain up to 6 Rules)

  This may not be standard ipchains output, but it's close.  I seem to
occasionally inherit a dynamic IP that recently belonged to a Napster
server, and I get a storm of attempted connections.

-- 
Walter Dnes
<waltdnes@waltdnes.org>