Article View: comp.protocols.tcp-ip
Article #15464Re: Where should I report port scans?
From: Walter Dnes
Date: Mon, 16 Apr 2001 01:17
Date: Mon, 16 Apr 2001 01:17
38 lines
3174 bytes
3174 bytes
On Sat, 14 Apr 2001 00:22:55 -0400, Lawrence Baldwin, <baldwinl@mynetwatchman.com> wrote: > I'm working on syslog support...with Netgear being the priority. Maybe you should ask the group comp.os.linux.security for pointers to log analysis scripts. No point in re-inventing the wheel. Save yourself unnecessary grunt work. > Is the time stamp in local time or GMT? > Where is the timestamp obtained? From the router clock? or is > this what the syslogd adds? It's whatever the machine doing the logging is set to. In my case EST (and now, EDT). > Can the time/date format be changed...the one below doesn't even > include the year. Don't know. I suggest asking in comp.os.linux.security. BTW, the Netgear format... > Apr 11 21:04:42 192.168.1.1 NetgearRT314: IP[Src=202.106.67.108 Dst=64.231.17.158 TCP spo=04401 dpo=00111]}S01>R01mD ...is *NOT* the same as ipchains format. Ipchains is the filter used in Redhat linux 6.X. It's the most common one. Here are some sample entries... > Apr 2 20:54:20 waltdnes kernel: Packet log: TCP_IN DENY eth0 PROTO=6 192.168.1.3:20 192.168.1.2:1026 L=60 S=0x08 I=47207 F=0x4000 T=64 SYN (#3) > Apr 3 19:18:49 waltdnes kernel: Packet log: UDP_IN DENY eth0 PROTO=17 192.168.1.1:4096 192.168.1.255:514 L=121 S=0x00 I=20295 F=0x0000 T=255 (#2) > Apr 4 19:23:05 waltdnes kernel: Packet log: UDP_IN DENY eth0 PROTO=17 192.168.1.2:137 192.168.1.255:137 L=96 S=0x00 I=0 F=0x0000 T=128 (#2) The "latest/greatest" linux firewall is iptables (Redhat 7.X). Amongst other things it's stateful and can send TCP-RST to fake a non-existant computer. -- Walter Dnes <waltdnes@waltdnes.org>
Technical Details
Message-ID:
<9bdh73$eu1$6@news.tht.net>Path:
arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!freenix!grolier!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!feed.cgocable.net!hub.org!hub.org!waltdnesReferences:
<3A9C3710.7F2E86F8@mynetwatchman.com> <96gk79.khf.ln@linux.abbitt.org> <wJOy6.3081$Rv.131064@news1.atl> <MPG.15369849667cdc0c989685@news2.mia.bellsouth.net> <xF6z6.315$U4.11027@burlma1-snr2> <MPG.153b74cbe7ab82a8989695@news2.mia.bellsouth.net> <9asm06$pvu$1@new-usenet.uk.sun.com> <B6F8472D.B0F7%nan-ae@nospam.nospam.porterfield.net.foo> <MPG.153d623dfe50249b9896a1@news2.mia.bellsouth.net> <9b69qs$24sc$1@news.tht.net> <MPG.15419aacc57015d19896be@news2.mia.bellsouth.net>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 10090f,64b87d735e5bf97e X-Google-Attributes: gid10090f,public X-Google-Thread: f9325,5fddf9b17d575149 X-Google-Attributes: gidf9325,public X-Google-Thread: 104f05,64b87d735e5bf97e X-Google-Attributes: gid104f05,public X-Google-ArrivalTime: 2001-04-15 18:18:05 PST Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!freenix!grolier!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!feed.cgocable.net!hub.org!hub.org!waltdnes From: waltdnes@waltdnes.org (Walter Dnes) Newsgroups: comp.protocols.tcp-ip,bellsouth.net.security,news.admin.net-abuse.email Subject: Re: Where should I report port scans? Date: Mon, 16 Apr 2001 01:17:23 +0000 (UTC) Organization: Hub.Org Networking Services (http://www.hub.org) Lines: 38 Message-ID: <9bdh73$eu1$6@news.tht.net> References: <3A9C3710.7F2E86F8@mynetwatchman.com> <96gk79.khf.ln@linux.abbitt.org> <wJOy6.3081$Rv.131064@news1.atl> <MPG.15369849667cdc0c989685@news2.mia.bellsouth.net> <xF6z6.315$U4.11027@burlma1-snr2> <MPG.153b74cbe7ab82a8989695@news2.mia.bellsouth.net> <9asm06$pvu$1@new-usenet.uk.sun.com> <B6F8472D.B0F7%nan-ae@nospam.nospam.porterfield.net.foo> <MPG.153d623dfe50249b9896a1@news2.mia.bellsouth.net> <9b69qs$24sc$1@news.tht.net> <MPG.15419aacc57015d19896be@news2.mia.bellsouth.net> Reply-To: waltdnes@waltdnes.org X-Trace: news.tht.net 987383843 15297 216.126.72.2 (16 Apr 2001 01:17:23 GMT) X-Complaints-To: scrappy@hub.org User-Agent: slrn/0.9.6.2 (Linux)