See whats happening!

statuszero · 06-25-2002, 12:40 PM

Hi,
Does anyone know of a program that will let you see when you have been attacked or pinged etc. I know firestarter does it but me and firestarter do not get on. Im using guarddog to configure the firewall but its quite nice to be able to see that the firewall is actually stopping things.

Any programs out there that show you hit information that you can recommend?

thanks
s0

peter_robb · 06-25-2002, 01:38 PM

Good news... there are lots..

IDS is the common name for programmes that determine if you are being compromised or scanned etc.
My favourite is Snort, and I use SnortSnarf to produce readable log files.

The simplest method however is to add log entries to your iptables script and use a log analyser to read these and help make sense of them.

Snort is at http://www.snort.org
SnortSnarf is at http://www.silicondefense.com/softwa...narf/index.htm
fwlogwatch is at http://rpmfind.net//linux/RPM/cooker...3mdk.i586.html
iptables tutorials are at http://www.linux.org/docs/ldp/howto/...DEX/index.html

Regards,
Peter.

Noerr · 06-26-2002, 11:24 AM

to see open connections do
netstat -apen
to see request from iptables do
more /proc/net/ip_conntrack