From owner-freebsd-questions@FreeBSD.ORG  Thu Feb 12 08:04:25 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 0E57B16A4CE
	for <freebsd-questions@freebsd.org>;
	Thu, 12 Feb 2004 08:04:25 -0800 (PST)
Received: from wildbean.clapper.org (wildbean.clapper.org [216.158.26.4])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A49C043D1D
	for <freebsd-questions@freebsd.org>;
	Thu, 12 Feb 2004 08:04:24 -0800 (PST)	(envelope-from bmc@clapper.org)
Received: from condor.inside.clapper.org (phantom@condor.inside.clapper.org
	[172.16.87.5])i1CG4NqS004954;	Thu, 12 Feb 2004 11:04:23 -0500 (EST)
Received: from z.inside.clapper.org (z.inside.clapper.org [172.16.87.2])
	i1CG4NGd086160;	Thu, 12 Feb 2004 11:04:23 -0500 (EST)
Received: from z.inside.clapper.org (localhost [127.0.0.1])
	i1CG4Nij032998;	Thu, 12 Feb 2004 11:04:23 -0500 (EST)
Message-Id: <200402121604.i1CG4Nij032998@z.inside.clapper.org>
From: Brian Clapper <bmc@clapper.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Date: Thu, 12 Feb 2004 11:04:23 -0500
To: Dragoncrest <dragoncrest@voyager.net>
In-Reply-To: <5.2.0.9.2.20040212110826.00a9b620@pop.voyager.net>
References: <5.2.0.9.2.20040212110826.00a9b620@pop.voyager.net>
X-Mailer: VM 7.17 under Emacs 21.2.1
X-Face: /perrud9r1.|7j.*=/6)a%vZ$^sBn!P[?+}vWBxd1ps{4hd2ZOw8]u&t';}(kj=x;
	JpdSF7
	1b<*T{.38]wnWl]j/ULRB*49qdsET_/)-siUd7A_n-<VVrW}pnh(Ioe~GEm$q1x!?(sc<kF^2@o<wN
	v#uaK[Pz*3"/wH`:*P(sD3n]NcPzP<oxv64:8w&MNwdhqOE[EKN5v<7((|`oNIJp3
cc: freebsd-questions@freebsd.org
Subject: Re: Problem with someone port scanning me
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 12 Feb 2004 16:04:25 -0000

On 12 February, 2004, at 11:12 (-0500)
Dragoncrest <dragoncrest@voyager.net> wrote:

> For the past couple of days I've had someone on our lan port scanning my
> box.  Not sure what's up with that, but I'm curious if there's a way to log
> what IP address this is coming from.  I don't have IPFW enabled yet as I
> haven't had the time to configure it at this point as it's currently behind
> the company firewall on our T3.  Is there a way to log where it's coming
> from?  Or is that already being logged somewhere?

The "snort" port (/usr/ports/security/port) can help.

-Brian Clapper, bmc @ clapper.org, http://www.clapper.org/bmc/