Date: Mon, 19 Oct 2009 23:43:46 -0700 (PDT) From: =?iso-8859-1?Q?D=E1nielisz_L=E1szl=F3?= <laszlo_danielisz@yahoo.com> To: Matthew Seaman <m.seaman@infracaninophile.co.uk> Cc: freebsd-questions@freebsd.org Subject: Re: pf+time stamp Message-ID: <189701.37514.qm@web30807.mail.mud.yahoo.com> In-Reply-To: <4ADCB101.808@infracaninophile.co.uk> References: <823621.39942.qm@web30801.mail.mud.yahoo.com> <4ADCB101.808@infracaninophile.co.uk>
next in thread | previous in thread | raw e-mail | index | archive | help
Oh, great!=0A=0AThank you!=0A=0A=0A=0A=0A________________________________=
=0AFrom: Matthew Seaman <m.seaman@infracaninophile.co.uk>=0ATo: D=E1nielisz=
L=E1szl=F3 <laszlo_danielisz@yahoo.com>=0ACc: freebsd-questions@freebsd.or=
g=0ASent: Mon, October 19, 2009 8:33:37 PM=0ASubject: Re: pf+time stamp=0A=
=0AD=E1nielisz L=E1szl=F3 wrote:=0A> Hello,=0A> =0A> Do you have any idea h=
ow to add and read time stamp of pf/pf.log?=0A> =0A> Thank you!=0A> Laci=0A=
=0ADo you mean /var/log/pflog ? Which is the default location where a=0Are=
cord of logged packets ends up if you run pflogd(8).=0A=0AThat's actually a=
pcap (packet capture) file, and you can read it=0Ausing tcpdump:=0A=0A # =
tcpdump -r /var/log/pflog=0A=0AEach packet is recorded with a high resoluti=
on timestamp that tcpdump=0Awill display for you -- like this naughty chap =
suffering the consequences=0Aof trying to brute-force my ssh daemon just be=
fore 1:00pm today:=0A=0A12:52:44.891373 IP customer-201-134-103-165.uninet-=
ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: . ack 299195=
8242 win 1460 <nop,nop,timestamp 2 9319378 1107347817,[|tcp]>=0A12:52:45.51=
6283 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.=
infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop,timestamp 2093=
19535 1107347817>=0A12:52:48.387822 IP customer-201-134-103-165.uninet-ide.=
com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 w=
in 1460 <nop,nop,timestamp 209320253 1107347817>=0A12:52:54.131863 IP custo=
mer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracaninoph=
ile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop,timestamp 209321689 1107347=
817>=0A12:52:57.113810 IP customer-201-134-103-165.uninet-ide.com.mx.2316 >=
happy-idiot-talk.infracaninophile.co.uk.ssh: . ack 1 win 1460 <nop,nop,tim=
estamp 209322434 1107347817,[|tcp]>=0A12:53:05.620251 IP customer-201-134-1=
03-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh=
: F 0:0(0) ack 1 win 1460 <nop,nop,timestamp 209324561 1107347817>=0A12:53:=
28.597524 IP customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-=
talk.infracaninophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop,timestamp=
209330305 1107347817>=0A12:54:14.550822 IP customer-201-134-103-165.uninet=
-ide.com.mx.2316 > happy-idiot-talk.infracaninophile.co.uk.ssh: F 0:0(0) ac=
k 1 win 1460 <nop,nop,timestamp 209341793 1107347817>=0A12:55:46.457353 IP =
customer-201-134-103-165.uninet-ide.com.mx.2316 > happy-idiot-talk.infracan=
inophile.co.uk.ssh: F 0:0(0) ack 1 win 1460 <nop,nop,timestamp 209364769 11=
07347817>=0A13:00:15.032146 IP customer-201-134-103-165.uninet-ide.com.mx.2=
316 > happy-idiot-talk.infracaninophile.co.uk.ssh: R 1230911050:1230911050(=
0) win 1460=0A=0A Cheers,=0A=0A Matthew=0A=0A-- Dr Matthew J Seaman M=
A, D.Phil. 7 Priory Courtyard=0A =
Flat 3=0APGP: http://www.infracaninophile.co.uk/pgp=
key Ramsgate=0A Kent, C=
T11 9PW=0A=0A=0A
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?189701.37514.qm>