From owner-freebsd-security Wed Dec 5 13:54:59 2001 Delivered-To: freebsd-security@freebsd.org Received: from harrier.prod.itd.earthlink.net (harrier.mail.pas.earthlink.net [207.217.120.12]) by hub.freebsd.org (Postfix) with ESMTP id 1BC1037B405 for ; Wed, 5 Dec 2001 13:54:57 -0800 (PST) Received: from dialup-209.244.107.135.dial1.sanjose1.level3.net ([209.244.107.135] helo=blossom.cjclark.org) by harrier.prod.itd.earthlink.net with esmtp (Exim 3.33 #1) id 16Bk0F-0003jp-00; Wed, 05 Dec 2001 13:54:56 -0800 Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.3) id fB5LsnL04403; Wed, 5 Dec 2001 13:54:49 -0800 (PST) (envelope-from cjc) Date: Wed, 5 Dec 2001 13:54:49 -0800 From: "Crist J . Clark" To: Ronan Lucio Cc: security@FreeBSD.ORG Subject: Re: Securty logs Message-ID: <20011205135449.E3061@blossom.cjclark.org> References: <02f601c17dab$85743670$2aa8a8c0@melim.com.br> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <02f601c17dab$85743670$2aa8a8c0@melim.com.br>; from ronan@melim.com.br on Wed, Dec 05, 2001 at 02:40:17PM -0200 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Wed, Dec 05, 2001 at 02:40:17PM -0200, Ronan Lucio wrote: > Hi All, > > I have a doubt about the entries in the security log file. > > If I have icmp 8,0 denied for external computers, when > someone pings, it create an entry in security log file: > > Dec 5 14:01:12 server /kernel: ipfw: 3000 Deny ICMP:8.0 62.211.157.214 > 255.255.255.255 in via fxp0 > > But if such computer give a flood attack, I think it will > create the same entry. > > How can I identify if an entry in security log file was creted > by simple ping or by a flood attack? By how many of those log entries you get. Each packet will generate a message. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message