Date: Tue, 12 Mar 2002 17:12:54 -0800 From: "Crist J. Clark" <cjc@FreeBSD.ORG> To: Poul-Henning Kamp <phk@FreeBSD.ORG> Cc: hackers@FreeBSD.ORG, security@FreeBSD.ORG Subject: Re: Userland Hacker Task: divert socket listener... Message-ID: <20020312171254.H29705@blossom.cjclark.org> In-Reply-To: <35126.1015973393@critter.freebsd.dk>; from phk@FreeBSD.ORG on Tue, Mar 12, 2002 at 11:49:53PM %2B0100 References: <35126.1015973393@critter.freebsd.dk>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
On Tue, Mar 12, 2002 at 11:49:53PM +0100, Poul-Henning Kamp wrote:
>
> Here is something I miss a lot:
>
> I would like a small program which can listen to a specified divert(4)
> socket and act on the incoming packets.
>
> Specifically I want to direct all unwanted trafic from my ipfw rules
> into the divert socket and have the program examine these packets
> and when configured thresholds were exceeded take actions like:
>
> Add a blackhole route for a period of time to the source
> IP to prevent any packets getting back to the attacker.
>
> Add a blocking ipfw rule for incoming trafic from the
> attackers IP# for some period of time.
>
> Add a divert ipfw rule for incoming trafic from the
> attackers IP# to capture all the tricks he is trying to
> do.
>
> Log the received packets in detail in pcap format files.
>
> Report the packets to Dshield.org
>
> etc.
>
> Any takers ?
I wrote a framework for something like that a few months ago during a
fit of boredom. Meet dpcd, the Divert Packet Capture Daemon. I don't
even remember if I left the code in a working state. I'm sure I had
writing pcap(3) files working at one point.
Tarball of what I got attatched.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
[-- Attachment #2 --]
a<