Date: Thu, 9 Nov 2000 00:08:26 -0500 From: Phil C <mongo@elephantitis.org> To: freebsd-questions@freebsd.org Subject: ipfw/database/logging development Message-ID: <20001109000826.B13677@planw-22-181.pompano.net>
next in thread | raw e-mail | index | archive | help
I have been pondering over the past few days, if would be more sensable to develop something one way or the other... Anyone interested in commenting please do.... I wanted to initially write a perl script to monitor /var/log/security for user defined ongoing's of ipfw. I was then going to use this data in a database, which would expire entries after a defined amount of time. The database (using MLDBM), could keep track of each ip which, for example was blocked, the port(s) they tried to connect from/to and when... Monitoring scans, both immediate and those gradually building over time would be simplified greatly... (on a cable network I find myself under a regular barrage of various intrusion attempts etc ranging from doze based attempts, like sub7 scans to scans of ftp ssh portmap etc... ...) Though since the idea's inception it occured to me that grabbing the logs could mean that I would miss data. (ie if I am scanned by let's say nmap -- default mode -- with a denial on tcp connnections at logamount 1000 that limit will fill up pretty quick). This while simple and for the most part effective has become rather unappealing... My other thought was to somehow use perl's XS to write some functions etc in C and translate them into perl subs. But to do this (I have not figured out all of the logistics yet...) I would have to create a daemon that either polled the kernel somehow or ... Dunno what... The design model here is incomplete but it seems to be the most appealing, because of the flexability ... and quite frankly the challenge... But good documentation for this has been hard to come by... So am I on crack... ???? What I am looking for here... is someone to either tell me I am reinventing the wheel... a place for good ipfw docs (I am already sub'ed to freebsd-ipfw, just in case)... or perhaps a better design method... if you feel there is one. Thanks, Phil To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001109000826.B13677>