From owner-freebsd-security Tue Oct 15 8:55:29 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7E58737B401 for ; Tue, 15 Oct 2002 08:55:27 -0700 (PDT) Received: from pa169.kurdwanowa.sdi.tpnet.pl (pa169.kurdwanowa.sdi.tpnet.pl [213.77.148.169]) by mx1.FreeBSD.org (Postfix) with ESMTP id A0F7943EB2 for ; Tue, 15 Oct 2002 08:55:26 -0700 (PDT) (envelope-from kzaraska@student.uci.agh.edu.pl) Received: from velvet (velvet.zaraska.dhs.org [192.168.11.2]) by pa169.kurdwanowa.sdi.tpnet.pl (Postfix) with SMTP id A08421F8F; Tue, 15 Oct 2002 15:55:21 +0000 (GMT) Date: Tue, 15 Oct 2002 17:57:14 +0200 From: Krzysztof Zaraska To: Mike Hoskins , "Maildrop" Cc: freebsd-security@freebsd.org Subject: Re: FW: monitor ALL connections to ALL ports Message-Id: <20021015175714.6ecbd83a.kzaraska@student.uci.agh.edu.pl> In-Reply-To: <20021014145602.K1231-100000@fubar.adept.org> References: <20021014145602.K1231-100000@fubar.adept.org> X-Mailer: Sylpheed version 0.8.5 (GTK+ 1.2.10; i386-portbld-freebsd5.0) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Mon, 14 Oct 2002 14:58:50 -0700 (PDT) Mike Hoskins wrote: > > I put these rule in: > > ipfw add count log all from any to any > > Is this rule before the other allow rules in your chain? Since the rule > chain is parsed on a first-match basis, you'll either need this rule > before all others or you'll need to add log entires to each of your > other rules. There's another problem I can see here: this setup will generate a log entry on EVERY packet, what is clearly an overkill. I think it would be more useful to log only opening of the connection; this can be accomplished using for example a 'setup' keyword, e.g.: # Allow access to our WWW ${fwcmd} add pass log tcp from any to ${oip} 80 setup -- // Krzysztof Zaraska * kzaraska (at) student.uci.agh.edu.pl // Prelude IDS: http://www.prelude-ids.org/ // A dream will always triumph over reality, once it is given the chance. // -- Stanislaw Lem To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message