Date: Tue, 13 Dec 2016 11:19:18 -0500 From: Michael Butler <imb@protected-networks.net> To: Gary Palmer <gpalmer@freebsd.org> Cc: Dimitry Andric <dim@FreeBSD.org>, FreeBSD Current <freebsd-current@FreeBSD.org> Subject: Re: Log spam: Limiting * response from 1 to 200 packets/sec Message-ID: <b41af591-bbd5-1333-04ce-ccfa82f28d5a@protected-networks.net> In-Reply-To: <20161213161525.GA7032@in-addr.com> References: <630314dc-e14f-02e7-aa48-4456b0feeef9@protected-networks.net> <8332C070-E7C8-4CF3-B5DF-2355D9FA20D1@FreeBSD.org> <1eb2e94b-c460-8116-8ffc-f7884be644f7@protected-networks.net> <20161213161525.GA7032@in-addr.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 12/13/16 11:15, Gary Palmer wrote: > On Tue, Dec 13, 2016 at 10:43:27AM -0500, Michael Butler wrote: >> On 12/13/16 10:29, Dimitry Andric wrote: >> >>> Somebody is most likely port scanning your machines. I see this all the >>> time on boxes connected to the internet. >> >> As are mine. I wouldn't mind so much if the message contained sufficient >> useful information that could be acted on, e.g. originating IP address >> and, when appropriate, destination port. > > sysctl net.inet.tcp.log_in_vain=1 > sysctl net.inet.udp.log_in_vain=1 > > be prepared for a lot of logs if you are being port scanned Or, apparently, have a windoze box on that segment :-( Michael
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?b41af591-bbd5-1333-04ce-ccfa82f28d5a>