Date: Thu, 6 Dec 2001 10:10:06 -0200 From: "Ronan Lucio" <ronan@melim.com.br> To: "Crist J . Clark" <cjc@FreeBSD.ORG> Cc: <security@FreeBSD.ORG> Subject: Re: Securty logs Message-ID: <00c001c17e4e$f14cb6d0$2aa8a8c0@melim.com.br> References: <02f601c17dab$85743670$2aa8a8c0@melim.com.br> <20011205135449.E3061@blossom.cjclark.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Cris,
> > If I have icmp 8,0 denied for external computers, when
> > someone pings, it create an entry in security log file:
> >
> > Dec 5 14:01:12 server /kernel: ipfw: 3000 Deny ICMP:8.0 62.211.157.214
> > 255.255.255.255 in via fxp0
> >
> > But if such computer give a flood attack, I think it will
> > create the same entry.
> >
> > How can I identify if an entry in security log file was creted
> > by simple ping or by a flood attack?
>
> By how many of those log entries you get. Each packet will generate a
> message.
I did a test:
I pinged for the machine and typed Ctrl-C.
The pind returned 9 packets sent/0 packets received.
In the security log of the target machine it shows just one line.
I have FreeBSD-4.3 seted the follow options:
- Kernel
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=500
options IPFIREWALL_DEFAULT_TO_ACCEPT
- /etc/rc.conf
firewall_enable="YES"
firewall_logging="YES"
- Ipfw rules
The rules that deny some service are seted with deny log option.
Do I need to configure anything diferent or some option more?
Thank´s
Ronan
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?00c001c17e4e$f14cb6d0$2aa8a8c0>