Date: Thu, 20 Feb 2003 21:00:06 -0800 (PST) From: Alan Batie <alan@batie.org> To: freebsd-bugs@FreeBSD.org Subject: Re: misc/48444: change to count connection attempts instead of listing them Message-ID: <200302210500.h1L506oC046611@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR misc/48444; it has been noted by GNATS. From: Alan Batie <alan@batie.org> To: Giorgos Keramidas <keramida@freebsd.org> Cc: bug-followup@freebsd.org Subject: Re: misc/48444: change to count connection attempts instead of listing them Date: Thu, 20 Feb 2003 20:57:30 -0800 --6Nae48J/T25AfBN4 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Feb 21, 2003 at 04:26:24AM +0200, Giorgos Keramidas wrote: > : # sh listports.sh | head -6 > : RANK HITS PORT > : 1 32 137 >=20 > Does this look like an interesting addition to periodic/security too? I'm not familiar with ipfilter's output, but if possible, I would recommend ranking by source-ip:port, so that you can tell if someone in particular is hammering you. On the other hand, a DDOS attempt would be better shown by an aggregate, and if you see a high count, you can always go look at the log for the addresses, so I'll leave it to you guys which way you think is best... --=20 Alan Batie ______ alan.batie.org Me alan at batie.org \ / www.qrd.org The Triangle PGPFP DE 3C 29 17 C0 49 7A \ / www.pgpi.com The Weird Numbers 27 40 A5 3C 37 4A DA 52 B9 \/ spamassassin.taint.org NO SPAM! --6Nae48J/T25AfBN4 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (FreeBSD) iQCVAwUBPlWxuov4wNua7QglAQGTfwP8Cp2oepihL0VrR+VRq57t+/HnivHybL3C IFyJBbUL5Pu5q+aHgFy1F8iheRQDRh9ppM1ZGhjrs8tWxtnvxt1P+bIAyeG11uo8 Z9B9kzBTS5fENNFxphCU3tP+9H36TZySWGZyNR+27Oz9VYdkzQKPzsmN+PaQnFQM oi2egTKWK8Q= =zrx4 -----END PGP SIGNATURE----- --6Nae48J/T25AfBN4-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200302210500.h1L506oC046611>