Very Computer

by **Gennady Kuznetso** » Fri, 18 May 2001 15:25:17

Hi!

What means are usually used for logging TCP connections (attempts) and
UDP port scans in Digital UNIX 4.0D? Can the logging be done by kernel?

Thanks,
Gennady.

by **Michael Fu** » Wed, 23 May 2001 01:15:53

> What means are usually used for logging TCP connections (attempts) and
> UDP port scans in Digital UNIX 4.0D? Can the logging be done by kernel?

I haven't seen any follow-ups to your message so I'll mention one
possibility: use a sniffer like tcpdump to watch for unauthorized
connections, or write your own sniffer with the libpcap library.

http://www.tcpdump.org/

You could also use a search engine to look for an Intrusion Detection
System (IDS) that uses libpcap.

--
Michael Fuhr
http://www.fuhr.org/~mfuhr/

by **Norm** » Sat, 26 May 2001 18:01:30

> Hi!

> What means are usually used for logging TCP connections (attempts) and
> UDP port scans in Digital UNIX 4.0D? Can the logging be done by kernel?

> Thanks,
> Gennady.

Try Snort

http://www.snort.org

you will need libpcap.a from http://www.tcpdump.org

by **Norm** » Mon, 28 May 2001 12:03:21

> Hi!

> What means are usually used for logging TCP connections (attempts) and
> UDP port scans in Digital UNIX 4.0D? Can the logging be done by kernel?

> Thanks,
> Gennady.

You could also try tcpwrappers from Weiste Venema
http://www.porcupine.org/wietse/
if your services are being run from inetd.

Very Computer

TCP/UDP logging

TCP/UDP logging

TCP/UDP logging

TCP/UDP logging

TCP/UDP logging