Date: Wed, 3 Mar 2004 15:55:13 +0100 From: Patrick Proniewski <patpro@patpro.net> To: Francisco Reyes <lists@natserv.com> Cc: Liste FreeBSD-security <freebsd-security@FreeBSD.ORG> Subject: Re: How to monitoring activity on a card? Message-ID: <C6629861-6D22-11D8-AE61-0030654D97EC@patpro.net> In-Reply-To: <20040303094647.J93367@zoraida.natserv.net> References: <20040303094647.J93367@zoraida.natserv.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On 03 mars 2004, at 10:51, Francisco Reyes wrote: > My setup 4.9 stable with IPFW. Machine acts as gateway for two > machines. > > What are my options on monitoring activity on my external card? > > This morning I noticed my DSL modem activity light is blinking > non-stop. > Looking at /var/log/ don't see anything suspicious. > > I feel tempted to add "log" to all my ipfw pass rules, but wonder if > there > isn't a better way. > > I am mostly concerned there is either some kind of attack going on or > somehow the machine was hacked and it's running something it's not > supposed to. If you really want some real-time control, you might want to try tcpdump, But you'll soon be flooded by the data. Best practice it probabely to put some log rules to your IPFW and then use a log parser to get some stats from your that. You can also add an IDS of some sort, and checkrootkit on a crontab. patpro -- je cherche un poste d'admin-sys Mac/UNIX (ou une jeune et jolie femme riche) http://patpro.net/cv.php
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?C6629861-6D22-11D8-AE61-0030654D97EC>