Vytautas, > >> p0f -i eth1 -o /var/log/p0f.log -l 'tcp dst port 25' 2>&1 | > >> /usr/sbin/p0f-analyzer.pl 2345 > > > > I think you should not use the -o option with p0f when piping to > > p0f-analyzer. > > > > With -o option the stdout is empty, so nothing to analyze and nothing > > to handle to Amavis.
Indeed, the -o must not be used, as it redirects the log away from p0f-analyzer.pl . > In maillog I see: > > Sep 22 09:23:35 server amavis[18496]: (18496-10) Fingerprint query: > [::ffff:209.85.218.220]:0 OxeKBBqtbth9 (p0f-analyzer) p0f:127.0.0.1:2345 > > Sep 22 09:23:36 server amavis[18496]: (18496-10) Fingerprint collect: > max_wait=0.000, [::ffff:209.85.218.220] OxeKBBqtbth... => > Changed. Same result. :-( Seems your OS is providing IPv4 addresses in a form of 'IPv4-mapped IPv6 addresses'. The p0f daemon only supports IPv4 addresses, and the p0f-analyzer.pl does not rewrite an 'IPv4-mapped IPv6 addresses' into an IPv4 address, so the query is ignored. I wonder which component decides to produce an IP address in a form '::ffff:209.85.218.220'. Does it come to amavisd in the postfix XFORWARD command? I can provide a patch for p0f-analyzer to rewrite 'IPv4-mapped IPv6 addresses' into an IPv4 address for the sake of p0f daemon, although it might be cleaner to get rid of it at the source, if possible. In principle both forms are equivalent, but for security reasons it is generally not recommended to blindly rewrite 'IPv4-mapped IPv6 addresses' into an IPv4 address - although this concern probably does not apply here. Mark ------------------------------------------------------------------------------ Come build with us! The BlackBerry® Developer Conference in SF, CA is the only developer event you need to attend this year. Jumpstart your developing skills, take BlackBerry mobile applications to market and stay ahead of the curve. Join us from November 9-12, 2009. Register now! http://p.sf.net/sfu/devconf _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
