From owner-freebsd-security  Fri Oct 11 22:26:44 2002
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 77F7237B401
	for <freebsd-security@freebsd.org>; Fri, 11 Oct 2002 22:26:41 -0700 (PDT)
Received: from web40508.mail.yahoo.com (web40508.mail.yahoo.com [66.218.78.125])
	by mx1.FreeBSD.org (Postfix) with SMTP id 27F2643E6E
	for <freebsd-security@freebsd.org>; Fri, 11 Oct 2002 22:26:41 -0700 (PDT)
	(envelope-from sonam_singh_s@yahoo.com)
Message-ID: <20021012052641.80433.qmail@web40508.mail.yahoo.com>
Received: from [202.88.149.172] by web40508.mail.yahoo.com via HTTP; Fri, 11 Oct 2002 22:26:41 PDT
Date: Fri, 11 Oct 2002 22:26:41 -0700 (PDT)
From: sonam singh <sonam_singh_s@yahoo.com>
Subject: Re: monitor ALL connections to ALL ports
To: maildrop@qwest.net, freebsd-security@freebsd.org
In-Reply-To: <NGBBIILBAKIFGHHCHOHPGEDCFJAA.maildrop@qwest.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

u can use packet analyzer or sniffer run the network
card in promiscous mode use ntop or snmp with mrtg or
tcpdump or etheral 
regards
Sonam Singh


--- Maildrop <maildrop@qwest.net> wrote:
> 
> I currently have a DSL line and a FreeBSD
> firewall/gateway (dual homed).  It
> has one internal IP address and 5 external IP
> address (one "real" ip and 4
> alaises on same external nic).
> 
> What I want to do is montior and record (to log) all
> incoming/outging
> connection (just source ip/dest ip/port).  If
> someone connects to my web
> server it should log what ip accessed it, the time,
> which ip (web server
> runs on 2 external ip address) and the port.  Also
> if someone does a port
> scan against the box I should be able to tell it is
> a port scan (since one
> ip address would be opening up a bunch of ports).
> 
> Right now I don't care what data is being
> sent/received, just what
> connections are being made (and the details about
> those connections).
> 
> Any suggestions?
> 
> Regards,
> Jack
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of
> the message


__________________________________________________
Do you Yahoo!?
Faith Hill - Exclusive Performances, Videos & More
http://faith.yahoo.com

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message