From owner-freebsd-current@freebsd.org  Tue Dec 13 16:15:28 2016
Return-Path: <owner-freebsd-current@freebsd.org>
Delivered-To: freebsd-current@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 301B8C75E19
 for <freebsd-current@mailman.ysv.freebsd.org>;
 Tue, 13 Dec 2016 16:15:28 +0000 (UTC)
 (envelope-from gpalmer@freebsd.org)
Received: from mail.in-addr.com (mail.in-addr.com
 [IPv6:2a01:4f8:191:61e8::2525:2525])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id EE6E42D1;
 Tue, 13 Dec 2016 16:15:27 +0000 (UTC)
 (envelope-from gpalmer@freebsd.org)
Received: from gjp by mail.in-addr.com with local (Exim 4.87 (FreeBSD))
 (envelope-from <gpalmer@freebsd.org>)
 id 1cGpjh-000OrR-GQ; Tue, 13 Dec 2016 16:15:25 +0000
Date: Tue, 13 Dec 2016 16:15:25 +0000
From: Gary Palmer <gpalmer@freebsd.org>
To: Michael Butler <imb@protected-networks.net>
Cc: Dimitry Andric <dim@FreeBSD.org>,
 FreeBSD Current <freebsd-current@FreeBSD.org>
Subject: Re: Log spam: Limiting * response from 1 to 200 packets/sec
Message-ID: <20161213161525.GA7032@in-addr.com>
References: <630314dc-e14f-02e7-aa48-4456b0feeef9@protected-networks.net>
 <8332C070-E7C8-4CF3-B5DF-2355D9FA20D1@FreeBSD.org>
 <1eb2e94b-c460-8116-8ffc-f7884be644f7@protected-networks.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1eb2e94b-c460-8116-8ffc-f7884be644f7@protected-networks.net>
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: gpalmer@freebsd.org
X-SA-Exim-Scanned: No (on mail.in-addr.com); SAEximRunCond expanded to false
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
 <freebsd-current.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-current>, 
 <mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current/>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
 <mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 13 Dec 2016 16:15:28 -0000

On Tue, Dec 13, 2016 at 10:43:27AM -0500, Michael Butler wrote:
> On 12/13/16 10:29, Dimitry Andric wrote:
> 
> > Somebody is most likely port scanning your machines.  I see this all the
> > time on boxes connected to the internet.
> 
> As are mine. I wouldn't mind so much if the message contained sufficient 
> useful information that could be acted on, e.g. originating IP address 
> and, when appropriate, destination port.

sysctl net.inet.tcp.log_in_vain=1
sysctl net.inet.udp.log_in_vain=1

be prepared for a lot of logs if you are being port scanned

Regards,

Gary