🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.misc
Article #1135

Re: Distinguishing Attempted Denial of Service Attack (DoS) or non-DoS Network Problems - With Apache/Webserver? (plus Non reso...

#1135
From: Bill Jones
Date: Wed, 11 Nov 1998 00:00
44 lines
2494 bytes
Lachlan Cranswick wrote:
> <snip>
> PS: Brings up another query - is there a tool that could do a TCPDUMP
> and also tell what files are being transferred as part of the status
> line with respect to http?
> <snip alot of reports not cleaned up...>

You guys are killing me :]  try this -

#!/usr/bin/perl
         
$LIMIT = shift || 5000000;
        
$|=1;
open (STDIN,"/usr/sbin/tcpdump -lnx -s 1024 dst port 80 |");
while (<>) {
 if (/^\S/) {
     last unless $LIMIT--;
     while ($packet=~/(GET|POST|WWW-Authenticate|Authorization).+/g)  {
         print "$client -> $host\t$&\n";
     }
     undef $client; undef $host; undef $packet;
     ($client,$host) = /(\d+\.\d+\.\d+\.\d+).+ > (\d+\.\d+\.\d+\.\d+)/
         if /P \d+:\d+\((\d+)\)/ && $1 > 0;
 }
 next unless $client && $host;
 s/\s+//;
 s/([0-9a-f]{2})\s?/chr(hex($1))/eg;
 tr/\x1F-\x7E\r\n//cd;
 $packet .= $_;
}

Lincoln wrote the above, but it's more or less public domain.

Enjoy!
-Sneex-  :]
________________________________________________________________________
Bill Jones  |  FCCJ Webmaster  |  x3089  |  http://webmaster.fccj.org:81
------------------------------------------------------------------------
       __ _  RedHat 5.1 Manhatten 
      / /(_)_ __  _   ___  __   http://www.apache.org 
     / / | | '_ \| | | \ \/ /   http://www.redhat.com 
    / /__| | | | | |_| |>  <    http://www.perl.com 
    \____/_|_| |_|\__,_/_/\_\   http://www.gimp.org
Technical Details
Message-ID: <364A2D8B.A20EC1A@fccj.org>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <l.cranswick.209.01C47D5D@dl.ac.uk>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10952f,d024781699c5dee3,start
X-Google-Attributes: gid10952f,public
X-Google-Thread: ff723,d024781699c5dee3,start
X-Google-Attributes: gidff723,public
X-Google-Thread: 1133d0,d024781699c5dee3,start
X-Google-Attributes: gid1133d0,public
X-Google-Thread: f8b34,d024781699c5dee3,start
X-Google-Attributes: gidf8b34,public
From: Bill Jones <bill@fccj.org>
Subject: Re: Distinguishing Attempted Denial of Service Attack (DoS) or non-DoS  Network Problems - With Apache/Webserver? (plus Non resolving IP  Addresses)
Date: 1998/11/11
Message-ID: <364A2D8B.A20EC1A@fccj.org>
X-Deja-AN: 410914442
Content-Transfer-Encoding: 7bit
References: <l.cranswick.209.01C47D5D@dl.ac.uk>
X-Accept-Language: en
Content-Type: text/plain; charset=us-ascii
Organization: Florida Community College at Jacksonville
MIME-Version: 1.0
Reply-To: bill@astro.fccj.org
Newsgroups: comp.security.misc,cern.security.unix,comp.security.unix,comp.infosystems.www.servers.unix