From owner-freebsd-questions@FreeBSD.ORG  Fri Jun 18 09:44:31 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id CFCCB16A4CE
	for <freebsd-questions@freebsd.org>;
	Fri, 18 Jun 2004 09:44:31 +0000 (GMT)
Received: from redfirst.wax.co.uk (redfirst.wax.co.uk [212.134.89.140])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B982243D49
	for <freebsd-questions@freebsd.org>;
	Fri, 18 Jun 2004 09:44:30 +0000 (GMT)
	(envelope-from uwe.kolsch@wax.co.uk)
Received: from uwe (clients.wax.local [212.158.204.132])
	(authenticated bits=0)
	by redfirst.wax.co.uk (8.12.6/8.12.6) with ESMTP id i5I9h6MF027676
	for <freebsd-questions@freebsd.org>; Fri, 18 Jun 2004 10:43:06 +0100
From: "Uwe Kolsch" <uwe.kolsch@wax.co.uk>
To: "Freebsd-Questions" <freebsd-questions@freebsd.org>
Date: Fri, 18 Jun 2004 10:43:06 +0100
Message-ID: <LMEHIFLKDJOKILNLEFHPMEJAGEAA.uwe.kolsch@wax.co.uk>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
Importance: Normal
X-MailScanner-Information: Please contact the administrator for more
	information
X-redfirst.wax.co.uk-MailScanner: Found to be clean
Subject: IPFW log results analysis
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 18 Jun 2004 09:44:31 -0000

Is there a tool for FBSD like logwatch on Linux, which can provide a detailed
but still somehow summarized output based on the logging results of IPFW. I mean
more detailed than this from the daily security run:

> 02010    557     48486 deny log ip from any to any out
> 10000   1026     49716 deny ip from any to any in setup
> 10003   3859    828227 deny ip from any to any in

... and more like this.

###
Logged packets on interface eth0:

   From 4.10.38.220 (4.10.38.220).
      To 212.146.89.141 (212.146.89.141).
         Service: 2745 (tcp/2745)
            (,eth0,none) - 3 packet(s)
      Total of 3 packet(s).
   Total of 3 packet(s).

   From 4.10.95.247 (4.10.95.247).
      To 212.146.89.140 (212.146.89.140).
         Service: swat (tcp/901)
            (,eth0,none) - 1 packet(s)
      Total of 1 packet(s).
      To 212.146.89.141 (212.146.89.141).
         Service: swat (tcp/901)
            (,eth0,none) - 1 packet(s)
      Total of 1 packet(s).
   Total of 2 packet(s).
###

Thanks

Uwe Kolsch