I use portsentry as well. It is good.
One trick:
To get it to trigger, you need to open up your input firewall rules for the
ports that it is monitoring.
I can also run a script before it drops the route.
I get a message that looks like this............
----------------------------------------------------------------------------
--
Host 209.13.235.138 attacked port 23
traceroute to 209.13.235.138 (209.13.235.138), 30 hops max, 38 byte packets
1 gw.chw5.Sydney.telstra.net (139.130.37.193) 117.666 ms 98.725 ms
99.759 ms
2 Ethernet4-1.chw-core1.Sydney.telstra.net (139.130.36.193) 109.912 ms
118.943 ms 109.787 ms
3 Pos0-2.ken-core1.Sydney.telstra.net (203.50.6.25) 109.869 ms 108.559
ms 109.858 ms
4 Pos2-0.wel-core3.Perth.telstra.net (203.50.6.46) 159.796 ms 158.771 ms
159.821 ms
5 GigabitEthernet4-0.wel-gw1.Perth.telstra.net (203.50.113.18) 159.806 ms
168.816 ms 159.820 ms
6 205.174.75.69 (205.174.75.69) 419.847 ms 398.742 ms 409.755 ms
7 199.37.127.181 (199.37.127.181) 409.827 ms 408.880 ms 399.785 ms
8 POS2-0-0.GW5.SFO4.ALTER.NET (157.130.197.77) 399.890 ms 408.712 ms
419.806 ms
9 145.ATM3-0.XR2.SFO4.ALTER.NET (146.188.149.38) 399.894 ms 398.869 ms
409.813 ms
10 191.at-1-0-0.TR4.SCL1.ALTER.NET (152.63.49.10) 419.879 ms 408.892 ms
399.873 ms
11 207.ATM6-0.TR2.NYC1.ALTER.NET (152.63.3.201) 489.799 ms 488.856 ms
489.771 ms
12 198.ATM6-0.XR2.EWR1.ALTER.NET (146.188.179.1) 489.876 ms 498.832 ms
499.766 ms
13 192.ATM4-0-0.SR2.BLM1.ALTER.NET (152.63.22.45) 489.877 ms 498.932 ms
499.866 ms
14 telintar-gw2.customer.ALTER.NET (157.130.19.14) 1079.874 ms 1068.858
ms 1029.687 ms
15 border-atm4-0-0-38-uos.telintar.net.ar (200.16.235.30) 849.907 ms
859.166 ms 859.895 ms
16 border-atm12-0-1-ciba2.telintar.net.ar (200.16.170.5) 1079.992 ms
1059.240 ms 1100.028 ms
17 ciba2-advance-advance.telintar.net.ar (200.16.199.14) 1079.800 ms
1018.833 ms 1069.902 ms
18 10.10.20.2 (10.10.20.2) 1029.735 ms 1078.904 ms 1079.817 ms
19 209.13.160.114 (209.13.160.114) 1079.834 ms 1068.819 ms 1369.853 ms
20 * * *
21 * * *
22 * * *
23 RCH2ppp-393.uc.infovia.com.ar (209.13.235.138) 1240.244 ms 1218.122 ms
1359.758 ms
Now we shut him down!!
----------------------------------------------------------------------------
----------------
My script looks like this.......
#!/bin/sh
#name:attack.notify
# Run to notify an attack
{
echo "Host $1 attacked port $2"
traceroute $1 2>&1
echo ""
echo "Now we shut him down!!"
} | mail -s'Attack!!' root
----------------------------------------------------
I would love to be able to do something nasty back at them,
but when you get at least one a day, it get's tiresome.
Better to let the system look after itself and get on with life!!
Ian.
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
