Date: Thu, 6 Dec 2001 10:51:46 -0800 From: "Crist J . Clark" <cristjc@earthlink.net> To: Ronan Lucio <ronan@melim.com.br> Cc: security@FreeBSD.ORG Subject: Re: Securty logs Message-ID: <20011206105146.A8975@blossom.cjclark.org> In-Reply-To: <00c001c17e4e$f14cb6d0$2aa8a8c0@melim.com.br>; from ronan@melim.com.br on Thu, Dec 06, 2001 at 10:10:06AM -0200 References: <02f601c17dab$85743670$2aa8a8c0@melim.com.br> <20011205135449.E3061@blossom.cjclark.org> <00c001c17e4e$f14cb6d0$2aa8a8c0@melim.com.br>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Dec 06, 2001 at 10:10:06AM -0200, Ronan Lucio wrote:
> Hi Cris,
>
> > > If I have icmp 8,0 denied for external computers, when
> > > someone pings, it create an entry in security log file:
> > >
> > > Dec 5 14:01:12 server /kernel: ipfw: 3000 Deny ICMP:8.0 62.211.157.214
> > > 255.255.255.255 in via fxp0
> > >
> > > But if such computer give a flood attack, I think it will
> > > create the same entry.
> > >
> > > How can I identify if an entry in security log file was creted
> > > by simple ping or by a flood attack?
> >
> > By how many of those log entries you get. Each packet will generate a
> > message.
>
> I did a test:
>
> I pinged for the machine and typed Ctrl-C.
> The pind returned 9 packets sent/0 packets received.
>
> In the security log of the target machine it shows just one line.
But did it say something like,
Dec 5 14:01:12 server /kernel: ipfw: 3000 Deny ICMP:8.0 62.211.157.214 255.255.255.255 in via fxp0
Dec 5 14:01:21 server last message repeated 8 times
Each packet will generate a message, but syslogd(8) may use its
mechanism for supressing duplicate messages and print a "last message
repeated" line.
--
"It's always funny until someone gets hurt. Then it's hilarious."
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011206105146.A8975>