From owner-freebsd-security  Tue Dec  4  8:24: 7 2001
Delivered-To: freebsd-security@freebsd.org
Received: from salseiros.melim.com.br (salseiros.melim.com.br [200.215.110.23])
	by hub.freebsd.org (Postfix) with ESMTP id D357C37B419
	for <security@freebsd.org>; Tue,  4 Dec 2001 08:24:03 -0800 (PST)
Received: from fazendinha (ressacada.melim.com.br [200.215.110.4])
	by salseiros.melim.com.br (Postfix) with SMTP id 9E635BA9E
	for <security@freebsd.org>; Tue,  4 Dec 2001 14:24:00 -0200 (BRST)
Message-ID: <10f701c17ce0$56141600$2aa8a8c0@melim.com.br>
From: "Ronan Lucio" <ronan@melim.com.br>
To: <security@freebsd.org>
References: <006001c17cdf$ab181d00$04e3a8c0@beco.hu> <008d01c17ce3$910c08f0$04e3a8c0@beco.hu>
Subject: Attack logs
Date: Tue, 4 Dec 2001 14:25:49 -0200
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-2"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hi All,

I hava seem that older versions of FreeBSD had mored detailed logs.

For example:
When some one did a flood, it had show a log like this:

Dec  4 14:15:30 server /kernel: ipfw: 3200 Deny ICMP:8.0 210.90.188.221
192.168.1.224 in via xl0
Dec  4 14:15:30 server /kernel: ipfw: 3200 Deny ICMP:8.0 210.90.188.221
192.168.1.224 in via xl0
Dec  4 14:15:30 server /kernel: ipfw: 3200 Deny ICMP:8.0 210.90.188.221
192.168.1.224 in via xl0
Dec  4 14:15:30 server /kernel: ipfw: 3200 Deny ICMP:8.0 210.90.188.221
192.168.1.224 in via xl0
Dec  4 14:15:30 server /kernel: ipfw: limit reached on rule #3200

Now, after a installed FreeBSD-4.3, it just show me:
ipfw: limit reached on rule #3200

I have looked in the security check output diary mail and /var/log/messages
file.

I have included the follow options:

- Kernel
   options IPFIREWALL
   options IPFIREWALL_VERBOSE
   options IPFIREWALL_VERBOSE_LIMIT=500
   options IPFIREWALL_DEFAULT_TO_ACCEPT

- /etc/rc.conf
    firewall_enable="YES"
    firewall_logging="YES"

- Ipfw rules
    The rules that deny some service are seted with deny log option.

Does anybody could help me to get a more detailed log?

Thank´s to all.

Ronan


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message