Article View: comp.security.misc
Article #1135Re: Distinguishing Attempted Denial of Service Attack (DoS) or non-DoS Network Problems - With Apache/Webserver? (plus Non reso...
From: Bill Jones
Date: Wed, 11 Nov 1998 00:00
Date: Wed, 11 Nov 1998 00:00
44 lines
2494 bytes
2494 bytes
Lachlan Cranswick wrote:
> <snip>
> PS: Brings up another query - is there a tool that could do a TCPDUMP
> and also tell what files are being transferred as part of the status
> line with respect to http?
> <snip alot of reports not cleaned up...>
You guys are killing me :] try this -
#!/usr/bin/perl
$LIMIT = shift || 5000000;
$|=1;
open (STDIN,"/usr/sbin/tcpdump -lnx -s 1024 dst port 80 |");
while (<>) {
if (/^\S/) {
last unless $LIMIT--;
while ($packet=~/(GET|POST|WWW-Authenticate|Authorization).+/g) {
print "$client -> $host\t$&\n";
}
undef $client; undef $host; undef $packet;
($client,$host) = /(\d+\.\d+\.\d+\.\d+).+ > (\d+\.\d+\.\d+\.\d+)/
if /P \d+:\d+\((\d+)\)/ && $1 > 0;
}
next unless $client && $host;
s/\s+//;
s/([0-9a-f]{2})\s?/chr(hex($1))/eg;
tr/\x1F-\x7E\r\n//cd;
$packet .= $_;
}
Lincoln wrote the above, but it's more or less public domain.
Enjoy!
-Sneex- :]
________________________________________________________________________
Bill Jones | FCCJ Webmaster | x3089 | http://webmaster.fccj.org:81
------------------------------------------------------------------------
__ _ RedHat 5.1 Manhatten
/ /(_)_ __ _ ___ __ http://www.apache.org
/ / | | '_ \| | | \ \/ / http://www.redhat.com
/ /__| | | | | |_| |> < http://www.perl.com
\____/_|_| |_|\__,_/_/\_\ http://www.gimp.org
Technical Details
Message-ID:
<364A2D8B.A20EC1A@fccj.org>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailReferences:
<l.cranswick.209.01C47D5D@dl.ac.uk>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 10952f,d024781699c5dee3,start X-Google-Attributes: gid10952f,public X-Google-Thread: ff723,d024781699c5dee3,start X-Google-Attributes: gidff723,public X-Google-Thread: 1133d0,d024781699c5dee3,start X-Google-Attributes: gid1133d0,public X-Google-Thread: f8b34,d024781699c5dee3,start X-Google-Attributes: gidf8b34,public From: Bill Jones <bill@fccj.org> Subject: Re: Distinguishing Attempted Denial of Service Attack (DoS) or non-DoS Network Problems - With Apache/Webserver? (plus Non resolving IP Addresses) Date: 1998/11/11 Message-ID: <364A2D8B.A20EC1A@fccj.org> X-Deja-AN: 410914442 Content-Transfer-Encoding: 7bit References: <l.cranswick.209.01C47D5D@dl.ac.uk> X-Accept-Language: en Content-Type: text/plain; charset=us-ascii Organization: Florida Community College at Jacksonville MIME-Version: 1.0 Reply-To: bill@astro.fccj.org Newsgroups: comp.security.misc,cern.security.unix,comp.security.unix,comp.infosystems.www.servers.unix