From owner-freebsd-security Fri May 28 2:51:33 1999 Delivered-To: freebsd-security@freebsd.org Received: from shell6.ba.best.com (shell6.ba.best.com [206.184.139.137]) by hub.freebsd.org (Postfix) with ESMTP id 3CC3D14F84 for ; Fri, 28 May 1999 02:51:32 -0700 (PDT) (envelope-from jkb@shell6.ba.best.com) Received: (from jkb@localhost) by shell6.ba.best.com (8.9.3/8.9.2/best.sh) id CAA18491; Fri, 28 May 1999 02:50:07 -0700 (PDT) Message-ID: <19990528025007.C15594@best.com> Date: Fri, 28 May 1999 02:50:07 -0700 From: "Jan B. Koum " To: ark@eltex.ru Cc: dada@sbox.tu-graz.ac.at, security@FreeBSD.ORG Subject: Re: TCP connect data logger References: <19990528023139.A15594@best.com> <199905280942.NAA13537@paranoid.eltex.spb.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.93.2i In-Reply-To: <199905280942.NAA13537@paranoid.eltex.spb.ru>; from ark@eltex.ru on Fri, May 28, 1999 at 01:42:56PM +0400 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Fri, May 28, 1999 at 01:42:56PM +0400, ark@eltex.ru wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > nuqneH, > > I remember a patch was posted here to log all TCP packets that are not part > of some known sequence. Really simple thing. Are you talking about http://www.best.com/~jkb/tcp_input.diff.txt one? I need to make it better .. I don't think it handles fast scan rate on 100base network well. -- Yan > > You should also note that net.inet.tcp.log_in_vain will ONLY log > > packets which have SYN bit set. That sucks if you get port scanned by > > something like nmap which can use FIN scan for example. (Or some other > > stealth scanning technique). To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message