From owner-freebsd-ipfw@FreeBSD.ORG Sat Sep 20 08:53:46 2003 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AE71016A4B3 for ; Sat, 20 Sep 2003 08:53:46 -0700 (PDT) Received: from out003.verizon.net (out003pub.verizon.net [206.46.170.103]) by mx1.FreeBSD.org (Postfix) with ESMTP id AFC9543FF5 for ; Sat, 20 Sep 2003 08:53:45 -0700 (PDT) (envelope-from cswiger@mac.com) Received: from mac.com ([68.237.14.199]) by out003.verizon.net (InterMail vM.5.01.05.33 201-253-122-126-133-20030313) with ESMTP id <20030920155344.BKHM29617.out003.verizon.net@mac.com> for ; Sat, 20 Sep 2003 10:53:44 -0500 Message-ID: <3F6C7808.8070408@mac.com> Date: Sat, 20 Sep 2003 11:53:44 -0400 From: Chuck Swiger Organization: The Courts of Chaos User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20030916 X-Accept-Language: en-us, en MIME-Version: 1.0 To: freebsd-ipfw@FreeBSD.ORG References: <200309201510.h8KFAOxL062601@lurza.secnetix.de> In-Reply-To: <200309201510.h8KFAOxL062601@lurza.secnetix.de> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Authentication-Info: Submitted using SMTP AUTH at out003.verizon.net from [68.237.14.199] at Sat, 20 Sep 2003 10:53:44 -0500 Subject: Re: ssh/scp filtering, iplen problem X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Sep 2003 15:53:46 -0000 Oliver Fromme wrote: [ ... ] > If not -- is there any other way to accomplish nwhat I > want to achieve? The other poster's suggestion about using port 22 for interactive and some other port for scp copying is probably the easist. The next thought I had would be to instrument ssh and log a line indicating the amount of traffic consumed, perhaps via syslog to a central machine, if you wanted to monitor traffic for lots of machines rather than just one test server. A quick look at "ssh -v" suggests that ssh keeps a byte counter, and doing filecopy invokes ssh on the remote side with a command of "scp -t ..." (so that you could distinguish between interactive and copying modes within ssh). -- -Chuck