From owner-freebsd-security Sat Oct 12 7:39:34 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1CA3E37B401 for ; Sat, 12 Oct 2002 07:39:32 -0700 (PDT) Received: from micko.boca.verio.net (r00.nat.boca.verio.net [208.55.254.110]) by mx1.FreeBSD.org (Postfix) with ESMTP id 52DE443E9C for ; Sat, 12 Oct 2002 07:39:31 -0700 (PDT) (envelope-from micko@micko.boca.verio.net) Received: from micko.boca.verio.net (localhost.boca.verio.net [127.0.0.1]) by micko.boca.verio.net (8.12.5/8.12.5) with ESMTP id g9CEfK4M044814; Sat, 12 Oct 2002 10:41:20 -0400 (EDT) (envelope-from micko@micko.boca.verio.net) Received: (from micko@localhost) by micko.boca.verio.net (8.12.5/8.12.5/Submit) id g9CEfJlF044813; Sat, 12 Oct 2002 10:41:19 -0400 (EDT) Date: Sat, 12 Oct 2002 10:41:19 -0400 From: Dragan Mickovic To: Maildrop Cc: freebsd-security@freebsd.org Subject: Re: monitor ALL connections to ALL ports Message-ID: <20021012104119.A43753@verio.net> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: ; from maildrop@qwest.net on Sat, Oct 12, 2002 at 12:17:42AM -0500 X-Operating-System: FreeBSD micko.boca.verio.net 4.6-STABLE FreeBSD 4.6-STABLE Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org You can just put IPFilter with a default rule to pass and log. By default it will log src,dst,port,len .. ie: Sep 22 19:39:20 server_name ipmon[84]: 19:39:20.251359 fxp0 @0:20 b 192.168.1.20,137 -> 192.168.1.255,137 PR udp len 20 78 IN micko On Sat, Oct 12, 2002 at 12:17:42AM -0500, Maildrop wrote: > > I currently have a DSL line and a FreeBSD firewall/gateway (dual homed). It > has one internal IP address and 5 external IP address (one "real" ip and 4 > alaises on same external nic). > > What I want to do is montior and record (to log) all incoming/outging > connection (just source ip/dest ip/port). If someone connects to my web > server it should log what ip accessed it, the time, which ip (web server > runs on 2 external ip address) and the port. Also if someone does a port > scan against the box I should be able to tell it is a port scan (since one > ip address would be opening up a bunch of ports). > > Right now I don't care what data is being sent/received, just what > connections are being made (and the details about those connections). > > Any suggestions? > > Regards, > Jack > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message -- Dragan Mickovic UNIX Systems Administrator NTT/Verio x.4012 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message