Date: Tue, 13 Dec 2016 17:25:01 +0000 From: Gary Palmer <gpalmer@freebsd.org> To: Michael Butler <imb@protected-networks.net> Cc: Dimitry Andric <dim@FreeBSD.org>, FreeBSD Current <freebsd-current@FreeBSD.org> Subject: Re: Log spam: Limiting * response from 1 to 200 packets/sec Message-ID: <20161213172501.GB7032@in-addr.com> In-Reply-To: <b41af591-bbd5-1333-04ce-ccfa82f28d5a@protected-networks.net> References: <630314dc-e14f-02e7-aa48-4456b0feeef9@protected-networks.net> <8332C070-E7C8-4CF3-B5DF-2355D9FA20D1@FreeBSD.org> <1eb2e94b-c460-8116-8ffc-f7884be644f7@protected-networks.net> <20161213161525.GA7032@in-addr.com> <b41af591-bbd5-1333-04ce-ccfa82f28d5a@protected-networks.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Dec 13, 2016 at 11:19:18AM -0500, Michael Butler wrote: > On 12/13/16 11:15, Gary Palmer wrote: > > On Tue, Dec 13, 2016 at 10:43:27AM -0500, Michael Butler wrote: > >> On 12/13/16 10:29, Dimitry Andric wrote: > >> > >>> Somebody is most likely port scanning your machines. I see this all the > >>> time on boxes connected to the internet. > >> > >> As are mine. I wouldn't mind so much if the message contained sufficient > >> useful information that could be acted on, e.g. originating IP address > >> and, when appropriate, destination port. > > > > sysctl net.inet.tcp.log_in_vain=1 > > sysctl net.inet.udp.log_in_vain=1 > > > > be prepared for a lot of logs if you are being port scanned > > Or, apparently, have a windoze box on that segment :-( Windows client boxes at least do a lot of broadcasts, but in my experience they don't trigger log_in_vain (maybe they will if you have promisc network interfaces enabled). Not sure about servers as I don't have any at home. Gary
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20161213172501.GB7032>