From owner-freebsd-security Sat Aug 8 13:47:22 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id NAA22717 for freebsd-security-outgoing; Sat, 8 Aug 1998 13:47:22 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from Mercury.unix.acs.cc.unt.edu (mercury.acs.unt.edu [129.120.220.1]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id NAA22703 for ; Sat, 8 Aug 1998 13:47:16 -0700 (PDT) (envelope-from john@unt.edu) Received: from leonardo.cascss.unt.edu (leonardo.cascss.unt.edu [129.120.32.203]) by Mercury.unix.acs.cc.unt.edu (8.8.8/8.8.8) with ESMTP id PAA23456 for ; Sat, 8 Aug 1998 15:46:56 -0500 (CDT) Received: (from john@localhost) by leonardo.cascss.unt.edu (8.8.8/8.6.9) id PAA26643 for freebsd-security@freebsd.org; Sat, 8 Aug 1998 15:45:12 -0500 (CDT) From: john Message-Id: <199808082045.PAA26643@leonardo.cascss.unt.edu> Subject: Network Watcher Program To: freebsd-security@FreeBSD.ORG Date: Sat, 8 Aug 1998 15:45:12 -0500 (CDT) X-Mailer: ELM [version 2.4ME+ PL32 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org The program looks for certain attacks against hosts and possible port scans. It's originally from http://www.rootshell.com I ported the packet capturing part to use libpcap and also added a configuration file to make the program more versatile. ---------------------------------------------- John Booth Computer Support Specialist Arts & Sciences Computing Services University of North Texas phone: (940)565-4498, campus extension 4498 Internet: john@unt.edu GroupWise: cas.po7.john Feel free to modify/use/and or distribute this. Included in the uuencoded file are a source file and a makefile. begin 644 netwatcher.tgz M'XL(`*ZYS#4``^Q;>U,;QY;/OYY/T4OJVA(1DL#825#LN@2$K;L85!;D<;TN MU6BF)?5E-#UW'L@DQ7??WSG=\Y($V`G9K:W:<2(T_3CO/N=T]U$HTZ6;>G,9 M=]ZY5W*J`OG58S^[W>[+_7WQE1"[W[[H5O^:9__EKA`O7[Q\OMM]OK_W'-W/ MN_O[7XGNHU.RXA[>-^ZA_O^CCPK!?Q`(/#<2.S.QHRL] M3BJ3]`#&8@D6SI,[$8K759#IIU0\=>(L_-S93YTK11(1&$7?:'S9_;^ML$=^ M2L8Z534\*@Y:_]WN'>M_M[OW?.];N_Z?[^_OO:#U_^VW+_]__?]//'%G^S$> MYYWVU51)7TQN!(GJ[UF8MJ6?.<[%7"4BBO4L=A=BD0]+M<@2*=*Y%(&:\)*? MR5#&RA.1ZUW)5*`IS6(5SAP,B-WX1BSGRIL+0'.O716XDT`*-Q73-#KH=/#9 MEK(=3(+V3%]W+,PV=-O^IW,22_GCZ%AX>B$3L53IG!`GC!J0%1H;QA^H23YU MNRG<():N?],&"R65GO:E6+J)2!$N0S&-]8*YH*')8@(/5E)'G*;0$IB(G65\`Z M!\NC5%[+$)S$"FX1\*;B1F#FW)-I"Y8=)[(?QSIV0-_'1 M%3O')+.)IH6G,07JUQ#PDFP*!N14IZ9+Z5X)-B.YF0C'Z1D-$VXBAN'D410" M3#``D'P)JUR0J&&G9/ISG06^E99P0XR"]<=D,/B*_SX,6I./G;#- M_SJ+MOG7(:LSPP[9`LFX?Y.Q-M)8*D#VW)A9R#$@?A?+-%]9/>%!=:EQ6)6. MSL)-KDAN$]UV>AAF@2187YZ$T3&DT>@M(T]*P+O?[[5W7WXGDFP"4,2ZG)%Z M>%Y!Z=Z>F6%'MU^T]Q`9GXJ]%_B&_[OM+C$B_YW!&,$"P.1#J0NVLI0K`E1I MFS1A+`[=$P$3)J:=06?4Z;;Y7_'WNRZ:CS_KW!KAM]C4V9XA5.:<1^3E1D%AOL8-.,Y MA0EG-O8.Q))77Y+-9KPEB722J`DB6Y0%`>F=O(&;ILAB'')]'"E,[")GZ\+I MLNNAH8B;\E.*4*XHCB8W"-T+@\8C)/#S(O%B%9&?RI+*C!C!5,19((WWS6,M M.?`$H<'Q]=)X[CQLIUJ;T`VG,N&,P*1?.IO-X3^V.X[S)S-!Y]P&>6+/5W"! M0X/[H(@).^*#F*>$UMQL1(,,)D&>$*M4Q2U7K((\F7HK`A#G4 M;K)%I%*AKY`WJ&MBSHDTI)HJ$&,TD;1M(IKH*:(8[-7`200%4H/,YIV)YX9( M1!/65(*>&%".STLD-88TH@04Z@)`AP5%!!)*2I'4;R`6.0M%M$01B6!M MDG&"I3W/311G6NB2;(P3.QR,6M8H^4=&B.2'B9$Q)6[45I47$D8Q^O7LY/3\ M_-AREYMX+C=@RZ`DI!2N0$('?L-L,8$P8-I(3T*S[A)1L*"(L`F2?23#"BS" M6NP)BG;A8@974#26F.FP#,^WZI+.=`L$.=K6!MM#X;_>7': M/Q/?OWQ"!T.=;3$RB>Z$?,FG2N:+S;.`C>3S^A=OQX^0A%=G(6JFVD/`03=-4=,0L_`V?G=2`.`W MH.M^0@[?=;[&;EI-B]Z+P;O^^>7%^*?#T\N^>($!-L"*GP\OCMZ*T_Y/_=.1 M*.P]G_?NUU'_].3\[/17P\QNM>?RQ[/^17YLOE?TO+U\=W@VN#A\/S@\HY[G M!:[W_>'Y^XL:L@HNTWMX>BI6<9D>BGJKN$S/Z,A@8ERP[8Q",B>"O-/YW7F2 MC:$L?*7W'KT&&A[0AO>R@;9;>%L'L1TBS^DYMTB_)#R[^'WP9C``4^XTE'09TFO$$D8 M6-&WHN<4#F0\/AV<7?XR'CLY")G.YWY,#&8AQ0TZ!R)!SL<^=A;!P7Z+CH@HC3O8[ZT.2'52;3-(4IV. M`QFN=RA_O8V$/M;3Z3KH-%AKR[WP.AA.3ZO-M+2L&=<;?=-8,2K2C!6Y6)%I M_E`0[MW=37NY>K>A*N_FW#E;V"&4ZQG[%173J;3DSRHT9>WVWD$)DDL9>K(R M]%9(;ZXK#<4<%.R09,V_6&_L:`NMMM MF1=:;*3"-^1X`NP]".>WMBVY"=F?H.D[V[24$X^W1:_$?M>VD;+SJ7MY(V]' MS1[M52UVVGX3-O(!19#L.6P%VV_LGCITB0M$6C$\.AQ"L=ET2B(SHWQYS>?0 MN0]!`C2&(R'+FY.`N`$^/YKZO34M"U;$"9VKP@WP"0!V1'2NQP?AM=TZY2CY MGHX55.;0N4YX94"J=C$8R418M&A3":U)^@)S<]8-[J$G)T3T[;%$4E"0DV$. M+'@Y=1@=?H=^B_YB!NBZULK'=FD,Y]QHMN@;O+']1CJF MK[P_&9,,S)O&7CD9&]$TFCT#`Q*P,/#-PO`"!(\Q>WEZG60J\,/*'%^#OH2Z ML@0;:SNY"&?T'B\JKW::H)O%=$P:HS;#+`QG8IJ(SVWHH-E;7V.^5AZV7`1Y MFRCF;5T)Q`5UI$KNEY2TCL-4NS2`H)K4AQ'03M:O!LB6IR5I!;7F4T M2B@^NIV%"\F`!@^,Q[/K)F.A]X(@M'Y``/J]R',@3?"&Y8/5K%J4]TW]6J:P MC1&FP80SG:2TH#X\WZMG#=0A253SJ)Y\](RQ6N54J#/#^`,KIJ%>=7OJA_V> M^N:;IK"9H/IHW9=%Q1NVQFCPYNWEL%411!66CB0VZ[/&%N?O_?=;+>(-V^#Q M\6'_W?F9':NF#>@J9Z>1?Z%=^F]23XN&9E/\(+I-GE,&@TC2[5!CJP)BJUFZ M>5X745UY07S+2!#2:PML36D1N&.K7W M0LN0;05+Z+_"ATA8R(47W30:1K'-IR8(M,0\VGD]'U>_![P-LY.K"ZT0,_P> MR=_>AIF[I4W73^0$:7S%:KLK<%2HZ)2#SJQRMVD,*U^6`I@+/Y;/.M-+0T%^ MLD@'1-=TR@:Q6*]"ARV+-OMA-DE(G\RRT;#&N=W,:5G.B8$&C)TT5"S^IV9] M0#E6*BR4"9L9XUNL0-^7MMXW"R&UA,6R(F">"*RJ"W$,.:M#5__@2H@\\TY M-QQKR*?>FG;M%"!+H15F"'M'"@'QV,P"#H/\1H_>^<-T[;RF)!N=6,T>[9>#;YU;BMF.@.#FLA8:BNOD MU;*"KD7 M-0.-&5T^\)5_&W+<-O]U3(AU:FO#8Q$K!TF[>&!C+",EE+B`*7^.` MG$-!LM7BX.1D/'Q__FXP.FK5CZT*87R6+$L,7R#+*(.]-K;.,1=<66Z2S"/? M-\VHC&2K8*>B,3JD*_AX6EK64VM:!>KU(+O)``C<%Q!-_H],/LQA87GD`9Y? MD)>=#$XO^N_'1^^.>6*!]3"*@AM:LXAL<,DEVJ68%PU MG5F>'^0UAU>@Y-89E6?$C*1Y-]-5NA(D/NG;U?SQSFQP>+`9KZ. M,\SB2"?R@`X#L)BNW2"3MC!%AM+^2[!1-?K'"K>VOHEO<5W8^55`I)IDEUL34T.&A,:VMZ,%<'BX/H M(#Y(#Y8'6["!_W@E^N79F-YR*Q>C9]=K`A)RC/'-Q4JX;9 MN&Y(+B8(L5>]#6#G&\#:/>4Z%(X%W>8F.&H3>=6SCC](WV(#7$7Y94Q[;`,/ MH2Z1P73+!KJ-)P;U(Y;R2F,#DY3';D+!951?AH1O1S:C6&O<=+.-JDN>H!UQ_47/QYFO-U*52+VIJKJ>N)^T4L\,N8:T^E#&8*:6+I223Y_AIE\SJL0V%K8>8RB/`1KXEF1XDR9I6\+(O2H<@U5;/@;I'% MTYPUR]%#S)BR]`+!X.C=4/2/WIZ3RSD=]$?,32+EFE1V%K:"RS[O3!5:*4;Q MKPSZHYH9.B:CD[;V0\0<6I#@YIF);<]L65S"!F8*@N+4U!51M0_)-S_[JBJ<3FH(H',?7:6,2D2F4MJ6 MDM=KJ];DMA/;.BS.I(483*OOBGXMD;2$#H,;<2Q#JF$ZGXJ1J8Q[2&:V3,XR M9;;B[0TH2!0/&Y<,#1EEO6`=;)^*H\S/+M2:(E:??!Z=V-B5ORZ:M!`>/T<< M00I-\>DD'\ZLUCZ:.JT'.;*P;2W7&O:E**(6&W2Q6(GOB>1J/FM'X1>ZG0+P M9K.CG0P7OG/4]']-.6G6SFVY9L@H/-\;LE/\UW0 MIS+C4"YS";;8?05+]R8QEK]F=DQM:0\K9K>9&MO*QZ5_D:\J**I:"]A++'^# M8DTUL8T%\APM->PUZDK M_;"9A(%%_WWH4UOT?.;;=:I&9MO;(0S%%744>3+YZJ M.?TE9E._4ZS:SM#>:\;N,K\\)(?,OT>4Y8\$E[+\?:`VA>_\\[-A%@1FVY)/ MYM2=?[4`MX6T]$K>\($HI8&S0$\H.\'>EF]7P?@4VX/0DP[2'U/97OS$\I$C MZCW7JDZM,J$L8E@Q5UNQMRWKM8:FIFY;50*Q*;ZS@]Q4>44)8J!FH?B]/A4S MS5DH7X7Q9=?'GK@5[FX>Z4W-!E?/&0LR55)W7S_*J+*$K2P4@]M294M#=NX=5%Z& MB]?VZB^_4RM*2^R-(+GV_`?+OI9)^,S\O)I,E%:8#',G:`L"S!$Y6Q[=D,_3 MW._7JAF>NKML&I5K=T,9"16=[5S5IKP*C0H"K-32FG(KVVY+KPKO9JZU\T!K MAJ[ZKC790O6%M@AH7DUI969KN4CG-/*IJ5`WNJ1J>EG9VM$^AP;;'YY;`9BJ ML!H.6]Y9H/!KO-F[D?5W]BJT!RU*R26S9:8LZ,A#D M<0BN38LD15'D?,4F6B7NZ05IG31H]=]OGN1PERM+CAS@4!&)+/'-X7`X0\X, M14FLF-&\54[#*L=I04T_/Z[7A`IBF]>$)PVUJDA+;:VZH@=\)@]L#3=TGX20 MB^T*Q'4"I!WND!TWQ%V,R0G`9-MR3V426Q'2&Q#K@$!#2JR5Y1 M4:5IQ"IS),"DAB8:JI1$FIN>FFHCAIJB,@W$P9)Y_]MPE+];P`H$6OGB)<@\ ML/S@+[NXR$O8#R=39Z2EBP^#+/>T&NZ1VLBQ71$J,%K7NW"`L)S/,O.L'D^^+C-%5M M3SX:G!`[AFG(4Q1ZM0OK\1V9"6(&WM_*CWB"#5B1+.3H!3$[V]M?[&5.@Y1' MC`QL8K3)H(5L#TEKNK_X;G^0WCGCOUBTE5`UO)9\/;R#\?1G;VE0;3-0;(&7 M4Y(07$01UR[)+`W1(X3Q3ZZC%ZL-;*ASJ8KD!& M2UAL"#2W$1*6,&K0,ZR.(5-/GSTGNF?C'C[Z5[?>A%4&;VI!^;J06&#`B2$X MA?I&Z0]X/O>F(/F>_*4X@&-'RYD5EV6BX[(R):XA*/]`A=>4C\M93$"6IDXM M7UWB?"H-Y3\5XED:1`A(,B?(YF5,U$J#(H&=&L8[(2G8`U:A2H`B974&:6]2 MQ.X&T^8$_5)G+[C!]L4TRTT1--?]*EGS-GCX,1^3KZ'6=KK@Z5D,_5M5&G1: M)6L!J:H8"S)AL2AN,L31W&7H^HG#&M9!>CPI<^777`'#V`*H=6(8Q^"A/R1" MG%7[2/X.D<.;0A9#JRRNO"C&4^0FO@"^Q*GEYZ`+;&NS>?'!F7BX76EXX>&; M\G^";>..9&:KKQVS5+PBN4FKPX!T1]`.@]T`Z'@%BTHFH?A/24V@&#&39Z0$ M@Q;<]0BQP0H=3H7YAO.B@#[=G%XBRLV-7LG/;U'?O93>H$'E,5H<)==NY#+G'3ZYL/%]'(Q(@4" M8(4F[^@V%M4N`%7034\^SR>(>&-R`/(1I%?RA@:[`7G-,J0OWA6:17_QNM`@^]<$W[^5=(N++A3J MOI`T6R&^3IKUA/=FI=G(P#<08S<77$-YD[TT?!EYLUF\B.WRGB7`L!/SOI"8 MY[%BS:+&Z8*=B0[LZC^0N2Y4U$&;`L@(T3-$29:]M M/XG&UN,B+]]W&U@$=0>S%HO@,F_$(KA2C2R"C`LS`C:C*B(L7!S0;ZBTBCJK MOW;K=;Z=E+=O6_6!&\)39U$;*'87J"+,F@(@4\!:105F@;@7Q(854S?=04,U)2)J!LDH M3I;#JI5U:'=AC[YFT:JHFIFMQ==0,P0)KD/]*"NDOF$.*,=GSX%Q!V4'J5O& MM@=Y0PI!:@4?;D#D@X6 M^/C'E]$+T(ADV825A6QS^Q'V,C3\M&2OK7^XNTL[_H MIOF['-]085DIK800,%I/US&`N;6KECZ0&\@.NE&!;?/%*W2_4\TCO&<[J#7" MA@*,NM&5I="TE\*;0M)?_:X'Q1&=8QD(7@V^+4()6[\.A*ILRJ90"IFCE9`B M7DU95/&>K-K^U\`V;7F[V*:U7A>6Z#[DS)CF-L$S`AHR52K?SPN0DH&3*OYX M6Q2#`OT,H"V4>%YYEB[RC^D^,EHMXK38L,TT?PT(-#L_67H3^&O?\X8UKGLL M[XHCMQN`^C/H;7T>D`''"5-KNJN8IL@Z<')OQ!*S@58X5]<6^3.#_3+3+9EJ M-].U!C"X=>'DZW!-9&G,(_7D M>_1V^^C'Y\^?/'KU76HV*'3VPR"-E9+ MQ-IX&1D[-):/S&452.#&J,)>5(5C(.AT:AQ=_/A*T[N5:0H;OP)BE5M=[2'6 MNQ=9`W$C\A#K97O(1[$MH:'/;H:%SD6TS&1N(<-1;;Q7SJR?U7IYQ4:#JD&Z MYZ>5;_9C]M8UFQ-9M.BO>9S[K$7341C=,0/N(K7VIJ;0'0.,,V]I?Q6F-%!F MT@"C,^N0V`S8UM%Q*"WQ([.:(/N5GNF$1TD1=6@C>KQL!4!>]SB\#@LW12)6 MK9RB."C7I&_QP@2O9CJ'(4*E0F#4?U4I%H9FJA7OV5:H5[TS:\)D0TJ&81.7 M&->A:@R4*RF;9HM2)TT4"J5(5\OCA7Q+I<*Q1#;G=9"X1F>TLY:P7)-\D`+! M_P7YX$_ZPT=I0J*K)-R2[^H!%Q\$2CD?7=]A[)&=3%&T'4F+MJ/E?'0=1[9Y M:A:BW]FC&^U'LK#+.)#71V=7"#;ZVS:MO9,"MX,5CP"-QI;Z@,, MQC"1;=+\8=C77S> MM9YD;PPGEX#1$C?8$.9=T31^[10'89@^]O;2TXE/!]2=G7].R_ M9,A%^"#W<;-RGGI'R.*KMB/1ZLZ7?>,1A19_?^\#6S4L*I6CA?Y@?A?RD]VD M@CVE*K>J\G`K@+N7+:L+\M4\GRQ8A3U/?WCXR.VX\,]XT_!D\N MJ+;?;]\^UP,$Z@Z0D+.S].3TZFQ(5Y[&\QU\=V`IRQHMK=-*T,*_#P]"VBAC M/?HF.EC@/:@XU`AY*G*>IMR&6OXX-B=H:JM@BGZ]HNC];^RHA2QB#EZ>U_`? MCP^)1![=$?6HOKA^24#E<=+?-;K./0/N=([KJCAA8=,7VG^.V=. M#RV(Z?==;ZA`1S867XZQX M,$55-GF(%7JZ1)C*:P7^L5^")/KC4;%.WR*[=.DS/^@R_.HNW.@ M)>2VL(&(H^Z]V_3[!JZ@_E0IV\M7J3 MN.XD2]>C7-]!CJ.20-_]9K^]GX-:&3[$\Y%S0D\8<3HNRBJ5F-KB$IS/876H M"+LJGB3<,`D0B1>[$%U)^_I2EDF0%<.*4#Q8 MNZ:"5292CV)T/\1LQ.5WK!>(;X(#U\K"[3VW&%SW/8"Q4#X8:"',#`,FT^??;]$Q@A)$(A=J`+WV&;';Z^?X1[+T=>3.>7KWOWOW81B^E\H!'! M,TF3HVS2RR;'V>0D,V^TV2SCHVS\R>OY'T.@A]J M?T5K[/H)'>*3F1T%8`8`S*@);@.'@2=1B6N;P'QX_E7_X/1`L(#'B(HA*.@/ M?65[^Z__<^_\GGQZ<:7R?2]KXUQE;9R@K`VST8;I:,-\M&%"V@#Z-L"^#))D.B)XX$'OI(L. M(":]!P^`':&OQP\>?(O?)B?5$NS52W?C6&/C56,8KQK#>-48QN$8A-)":VX` M8S^`L0Y@?!)DY]X3P7W3DMS1$Z]"DRF]))7HDY?L' MSP#)=%7QW2GF<9=O/N//8<:>R?BGY4;,@)>N/>U1_^"QJ881W[0FV0#W7RKN MPWZXHF[Z\(R`(P^Z^=.F[_&9\B_U`_X/WXZFBX+7O#`7]VZUGO`FA;N)OBW- M"ICT7DSKUKU_[,(N[,(N[,(N[,(N[,(N[,(N[,(N[,(N[,(N[,(N_-W#_P#* '7?5V`*```+U_ ` end To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message